The remarkable success of face recognition (FR) has endangered the privacy of internet users particularly in social media. Recently, researchers turned to use adversarial examples as a countermeasure. In this paper, we assess the effectiveness of using two widely known adversarial methods (BIM and ILLC) for de-identifying personal images. We discovered, unlike previous claims in the literature, that it is not easy to get a high protection success rate (suppressing identification rate) with imperceptible adversarial perturbation to the human visual system. Finally, we found out that the transferability of adversarial examples is highly affected by the training parameters of the network with which they are generated.

翻译：人脸识别（FR）技术的显著成功已危及互联网用户的隐私，尤其在社交媒体领域。近期，研究者开始采用对抗样本作为防护措施。本文评估了两种广泛使用的对抗方法（BIM和ILLC）在个人图像去标识化中的有效性。我们发现，与既有文献所述不同，在人类视觉系统难以察觉的对抗扰动下，难以获得高保护成功率（即抑制识别率）。最终，我们观察到对抗样本的可迁移性高度依赖于生成该样本时网络的训练参数。