Protego：面向人脸识别所致数字足迹暴露的以用户为中心的姿态不变隐私保护
Protego: User-Centric Pose-Invariant Privacy Protection Against Face Recognition-Induced Digital Footprint Exposure
面向人脸检索系统的黑盒隐私保护：把用户 3D 人脸签名压成姿态不变的 2D 表征，再按目标图像姿态/表情动态形变为自然外观的 3D 掩码，并放大 FR 模型对保护图像的敏感度使其连自身都无法匹配——这套「姿态不变签名 + 动态形变掩码」思路可直接迁移到人脸识别对抗防御与视频级隐私保护。
原文依据 Protego encapsulates a user's 3D facial signatures into a pose-invariant 2D representation
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论人脸识别（FR）技术正越来越多地被用于支撑大规模图像检索系统，由此引发了严重的隐私担忧。Clearview AI 和 PimEyes 等服务允许任何人上传一张人脸照片，并检索到与该人相关的大量网络内容。这不仅使身份推断成为可能，还会在当事人往往并不知情的情况下暴露其数字足迹，例如社交媒体活动、私人照片和新闻报道。为应对这一新兴威胁，我们提出 Protego，一种以用户为中心的隐私保护方法，可保护人脸图像免受此类基于检索的隐私侵犯。Protego 将用户的 3D 人脸签名封装为一种姿态不变的 2D 表征，该表征会被动态形变为自然外观的 3D 掩码，并针对该用户任意人脸图像的姿态与表情进行定制，在图像在线分享之前施加。受现有方法一项关键局限的启发，Protego 放大了 FR 模型的敏感度，使得受保护图像即便在彼此之间也无法被匹配。实验表明，Protego 在多种黑盒 FR 模型上显著降低了检索准确率，性能至少比现有方法好 2 倍。它还提供了前所未有的视觉连贯性，在一致性与自然外观至关重要的视频场景中尤为突出。总体而言，Protego 为对抗人脸识别被滥用于大规模监控和身份追踪做出了贡献。
英文原文摘要 1481 字符
Face recognition (FR) technologies are increasingly used to power large-scale image retrieval systems, raising serious privacy concerns. Services like Clearview AI and PimEyes allow anyone to upload a facial photo and retrieve a large amount of online content associated with that person. This not only enables identity inference but also exposes their digital footprint, such as social media activity, private photos, and news reports, often without their consent. In response to this emerging threat, we propose Protego, a user-centric privacy protection method that safeguards facial images from such retrieval-based privacy intrusions. Protego encapsulates a user's 3D facial signatures into a pose-invariant 2D representation, which is dynamically deformed into a natural-looking 3D mask tailored to the pose and expression of any facial image of the user, and applied prior to online sharing. Motivated by a critical limitation of existing methods, Protego amplifies the sensitivity of FR models so that protected images cannot be matched even among themselves. Experiments show that Protego significantly reduces retrieval accuracy across a wide range of black-box FR models and performs at least 2x better than existing methods. It also offers unprecedented visual coherence, particularly in video settings where consistency and natural appearance are essential. Overall, Protego contributes to the fight against the misuse of FR for mass surveillance and identity tracing.