Few-shot-based facial recognition systems have gained increasing attention due to their scalability and ability to work with a few face images during the model deployment phase. However, the power of facial recognition systems enables entities with moderate resources to canvas the Internet and build well-performed facial recognition models without people's awareness and consent. To prevent the face images from being misused, one straightforward approach is to modify the raw face images before sharing them, which inevitably destroys the semantic information, increases the difficulty of retroactivity, and is still prone to adaptive attacks. Therefore, an auditing method that does not interfere with the facial recognition model's utility and cannot be quickly bypassed is urgently needed. In this paper, we formulate the auditing process as a user-level membership inference problem and propose a complete toolkit FACE-AUDITOR that can carefully choose the probing set to query the few-shot-based facial recognition model and determine whether any of a user's face images is used in training the model. We further propose to use the similarity scores between the original face images as reference information to improve the auditing performance. Extensive experiments on multiple real-world face image datasets show that FACE-AUDITOR can achieve auditing accuracy of up to $99\%$. Finally, we show that FACE-AUDITOR is robust in the presence of several perturbation mechanisms to the training images or the target models. The source code of our experiments can be found at \url{https://github.com/MinChen00/Face-Auditor}.

翻译：基于小样本的人脸识别系统因其可扩展性以及在模型部署阶段仅需少量人脸图像即可工作的能力而日益受到关注。然而，人脸识别系统的强大功能使得中等资源的实体能够扫描互联网并在未经人们知晓和同意的情况下构建性能良好的人脸识别模型。为防止人脸图像被滥用，一种直接的方法是在共享前对原始人脸图像进行修改，但这不可避免地会破坏语义信息、增加可追溯性的难度，并且仍然容易受到自适应攻击。因此，亟需一种不干扰人脸识别模型效用且难以被快速规避的审计方法。在本文中，我们将审计过程形式化为用户级成员推断问题，并提出了一套完整的工具包FACE-AUDITOR，该工具包能够精心选择探针集来查询基于小样本的人脸识别模型，并判断用户的人脸图像是否被用于训练该模型。我们进一步提出利用原始人脸图像之间的相似度分数作为参考信息来提升审计性能。在多个真实世界人脸图像数据集上的大量实验表明，FACE-AUDITOR可实现高达$99\%$的审计准确率。最后，我们证明FACE-AUDITOR在面对训练图像或目标模型的多种扰动机制时具有鲁棒性。我们的实验源代码可在\url{https://github.com/MinChen00/Face-Auditor}获取。