Enhancing Facial Privacy Protection via Weakening Diffusion Purification (CVPR 2025) [ArXiv]

Ali Salar, Qing Liu, Yingli Tian, Guoying Zhao

Abstract

The rapid growth of social media has led to the widespread sharing of individual portrait images, which pose serious privacy risks due to the capabilities of automatic face recognition (AFR) systems for mass surveillance. Hence, protecting facial privacy against unauthorized AFR systems is essential. Inspired by the generation capability of the emerging diffusion models, recent methods employ diffusion models to generate adversarial face images for privacy protection. However, they suffer from the diffusion purification effect, leading to a low protection success rate (PSR). In this paper, we first propose learning unconditional embeddings to increase the learning capacity for adversarial modifications and then use them to guide the modification of the adversarial latent code to weaken the diffusion purification effect. Moreover, we integrate an identity-preserving structure to maintain structural consistency between the original and generated images, allowing human observers to recognize the generated image as having the same identity as the original. Extensive experiments conducted on two public datasets, i.e., CelebA-HQ and LADN, demonstrate the superiority of our approach. The protected faces generated by our method outperform those produced by existing facial privacy protection approaches in terms of transferability and natural appearance.

Setup

• Get code

git clone https://github.com/parham1998/Facial-Privacy-Protection.git

• Build environment

cd Facial-Privacy-Protection
# use anaconda to build environment 
conda create -n Facial-Privacy-Protection python=3.11
conda activate Facial-Privacy-Protection
# install packages
pip install -r requirements.txt

• Download assets

  • Download pre-trained face recognition models and datasets from AMT-GAN and place them in the assets folder

• The final assets folder should be like this:

assets
  └- datasets
    └- CelebA-HQ
    └- CelebA-HQ-500_pairs
    └- LADN
  └- face_recognition_models
    └- facenet.pth
    └- facenet.py
    └- ...
  └- obfs_target_images
  └- target_images
  └- test_images

• Aligning the images in the dataset folder before starting the protection:

python align.py

• For impersonation:

source_dir=source images folder path for impersonation
is_obfuscation=False
MTCNN_cropping=True
target_choice=Choice of target identity, as in AMT-GAN: 1, 2, 3, 4

• For obfuscation:

source_dir=source images folder path for obfuscation
test_dir=test images folder path for obfuscation
is_obfuscation=True
MTCNN_cropping=False
target_choice=5

5. Run the code:

python main.py

Citation

@inproceedings{salar2025enhancing,
  title={Enhancing Facial Privacy Protection via Weakening Diffusion Purification},
  author={Salar, Ali and Liu, Qing and Tian, Yingli and Zhao, Guoying},
  booktitle={Proceedings of the Computer Vision and Pattern Recognition Conference},
  pages={8235--8244},
  year={2025}
}

Acknowledgments

Our code structure is based on Prompt-to-Prompt