Anti-facial recognition (AFR) image filters alter images in ways that are subtle to people but blinding to computer vision. Yet, despite widespread interest in these technologies to subvert surveillance, users rarely use them in practice -- because the ``subtle'' alterations are visible enough to conflict with users' self-presentation goals. To address this challenge, we propose AuraMask: a novel approach to creating AFR filters that are both adversarially effective and aesthetically acceptable. Using AuraMask, we produce 40 ``aesthetic'' filters that emulate popular ``one-click'' Instagram image filters. We show that AuraMask filters meet or exceed the adversarial effectiveness of prior methods against open-source facial recognition models. Moreover, in a controlled online user study ($N=630$) we confirm these filters achieve significantly higher user acceptance than prior methods. Lastly, we provide our AFR pipeline to the community for accelerated research in adversarially effective and aesthetically acceptable protections.

翻译：抗人脸识别（AFR）图像滤镜以对人眼细微但让计算机视觉失效的方式修改图像。然而，尽管人们对利用这些技术规避监控有着广泛兴趣，用户在实践中的使用率却很低——因为这种“细微”的修改足够明显，以至于与用户的自我呈现目标相冲突。为应对这一挑战，我们提出AuraMask：一种创建兼具对抗有效性与美学可接受性的AFR滤镜的新方法。利用AuraMask，我们生成了40种模拟流行“一键式”Instagram图像滤镜的“美学”滤镜。我们证明，AuraMask滤镜在对抗开源人脸识别模型时，其有效性达到或超越了先前方法。此外，在一项受控在线用户研究（N=630）中，我们确认这些滤镜的用户接受度显著高于先前方法。最后，我们向社区提供AFR流水线，以加速对抗有效且美学可接受保护技术的研究。