The recently proposed facial cloaking attacks add invisible perturbation
(cloaks) to facial images to protect users from being recognized by
unauthorized facial recognition models. However, we show that the "cloaks" are
not robust enough and can be removed from images.
This paper introduces PuFace, an image purification system leveraging the
generalization ability of neural networks to diminish the impact of cloaks by
pushing the cloaked images towards the manifold of natural (uncloaked) images
before the training process of facial recognition models. Specifically, we
devise a purifier that takes all the training images including both cloaked and
natural images as input and generates the purified facial images close to the
manifold where natural images lie. To meet the defense goal, we propose to
train the purifier on particularly amplified cloaked images with a loss
function that combines image loss and feature loss. Our empirical experiment
shows PuFace can effectively defend against two state-of-the-art facial
cloaking attacks and reduces the attack success rate from 69.84\% to 7.61\% on
average without degrading the normal accuracy for various facial recognition
models. Moreover, PuFace is a model-agnostic defense mechanism that can be
applied to any facial recognition model without modifying the model structure.

PuFace 是一种图像净化系统，利用神经网络的泛化能力通过将带有面部覆盖的图像推向自然（不带覆盖的）图像的流形，减小覆盖的影响，并通过特别放大的覆盖图像进行训练，成功地防御了两种先进的面部覆盖攻击，将攻击成功率从 69.84％降低到 7.61％，而不降低各种面部识别模型的正常准确性。此外，PuFace 是一种与模型无关的防御机制，可应用于任何面部识别模型而不修改模型结构。