INN-RAE: Reversible adversarial examples based on invertible neural networks for facial protection

Abstract

Reversible adversarial examples can effectively prevent data from being accessed and recognized by unauthorized deep neural network models, but existing methods struggle to balance the visual quality and attack effectiveness of the generated adversarial examples. This paper proposes a method for generating reversible adversarial examples based on invertible neural networks (INN-RAE), achieving an effective unification of high attack success rate and high visual stealthiness. Specifically, during the forward propagation phase of the invertible neural network, both the clean sample and a noise matrix are input simultaneously, and adversarial examples are generated by fine-tuning the noise matrix. When restoring the adversarial examples, the same invertible neural network can be used to achieve high-quality restoration and remove the attack noise, thereby realizing end-to-end reversible adversarial example generation and restoration. Compared with existing reversible adversarial example generation algorithms, INN-RAE achieves state-of-the-art levels of attack success rate on multiple face datasets and face recognition models, while also achieving better visual stealthiness and restoration effects.