FACE-AUDITOR: Data Auditing in Facial Recognition Systems

Min Chen,Zhikun Zhang,Tianhao Wang,Michael Backes,Yang Zhang
2023-04-06
Abstract:Few-shot-based facial recognition systems have gained increasing attention due to their scalability and ability to work with a few face images during the model deployment phase. However, the power of facial recognition systems enables entities with moderate resources to canvas the Internet and build well-performed facial recognition models without people's awareness and consent. To prevent the face images from being misused, one straightforward approach is to modify the raw face images before sharing them, which inevitably destroys the semantic information, increases the difficulty of retroactivity, and is still prone to adaptive attacks. Therefore, an auditing method that does not interfere with the facial recognition model's utility and cannot be quickly bypassed is urgently needed. In this paper, we formulate the auditing process as a user-level membership inference problem and propose a complete toolkit FACE-AUDITOR that can carefully choose the probing set to query the few-shot-based facial recognition model and determine whether any of a user's face images is used in training the model. We further propose to use the similarity scores between the original face images as reference information to improve the auditing performance. Extensive experiments on multiple real-world face image datasets show that FACE-AUDITOR can achieve auditing accuracy of up to $99\%$. Finally, we show that FACE-AUDITOR is robust in the presence of several perturbation mechanisms to the training images or the target models. The source code of our experiments can be found at \url{<a class="link-external link-https" href="https://github.com/MinChen00/Face-Auditor" rel="external noopener nofollow">this https URL</a>}.
Cryptography and Security,Computer Vision and Pattern Recognition
What problem does this paper attempt to address?
The paper attempts to address the issue of how to prevent individuals' facial images from being used to train facial recognition systems without their consent. Specifically, the paper proposes a toolkit named FACE-AUDITOR, which aims to audit facial recognition models through user-level membership inference to determine whether a user's facial image has been used to train a specific facial recognition model. This approach not only does not interfere with the normal functionality of facial recognition models but is also difficult to bypass quickly, providing users with an effective way to protect their privacy data from being infringed. The paper mentions that traditional methods to prevent the misuse of facial images, such as modifying the original images, can protect privacy to some extent but may destroy the semantic information of the images, increase the difficulty of traceability, and are easily bypassed by new technical means. Therefore, proposing an auditing method that can protect user privacy without affecting the performance of facial recognition systems is particularly important. FACE-AUDITOR is designed based on this need, and it can detect with up to 99% accuracy whether a user's facial image has been used to train a facial recognition model, showing strong robustness against various perturbation mechanisms.