Unmasking the Threat: Detecting Cloaking Attacks in Facial Recognition

Individuals who are concerned about their privacy may choose to safeguard their online photographs by adding imperceptible pixel-level disturbances. This technique, known as “cloaking” is a form of clean-label poisoning attack. Manipulated data is fed to a facial recognition model for training while maintaining the original labels, potentially misleading the model, and slowly poisoning the model’s understanding of a person’s facial features. Consequently, the performance of the model is diminished for certain identities. By retraining a model to be robust against these disturbances, it is possible to avoid these attacks. However, the expenses associated with retraining or replacing a model may be prohibitive, especially since there is no assurance that the model will be robust against future attacks. Instead, we offer a method for identifying cloaked pictures and excluding them from training pipelines. Our method uses img2vec with a ResNet-18 model that has been pretrained for rapid convergence. Our approach achieved an accuracy of 97% across a wide variety of perturbation budgets, and it is also possible to reuse elements of an existing model to decrease the need to construct yet another model.