Crafter: Facial Feature Crafting against Inversion-based Identity Theft on Deep Models

Crafter: Facial Feature Crafting against Inversion-based Identity Theft on Deep Models

Speakers: Shiming Wang

Conference: NDSS Symposium

YouTube: (no public video)

Overview

In the rapidly evolving landscape of deep learning, the shift towards edge computing for privacy-sensitive data is becoming increasingly prevalent. This talk introduces Crafter, a novel system designed to protect user identity from inversion-based identity theft in deep learning applications, particularly those processing facial images. Given the growing concerns around data privacy and stringent regulations, pre-processing sensitive raw data at the edge and transmitting only abstract features to the cloud is a critical architectural trend. However, these features, if not adequately protected, can still be inverted by malicious actors to reconstruct original, private images, leading to identity leakage.

Crafter addresses a fundamental weakness in conventional privacy-preserving methods: their vulnerability to adaptive attacks. Many existing defenses rely on adversarial game-based approaches that try to "shed" identity information. While effective against basic threats, these "stay-away" strategies often fail when attackers adapt their models to counter known defenses, creating an unsustainable arms race. Crafter fundamentally rethinks this by adopting a "get-close" approach, crafting features at the edge to mislead an attacker into reconstructing images based on a non-private prior, thereby minimizing the information gained about the true identity. This strategy effectively "poisons" the attacker's adaptive models, making them reconstruct generic, average faces instead of private ones.

The significance of Crafter lies in its robust defense against both basic and sophisticated adaptive attacks, a capability that state-of-the-art adversarial game-based methods have struggled to achieve. By ensuring that cloud-based machine learning tasks can still be performed accurately while preventing identity theft, Crafter offers a practical and theoretically grounded solution for preserving privacy in real-world edge-cloud deployments of deep learning models, particularly for sensitive applications like facial recognition and analysis.

Background

[▶ Watch: Introduction: Crafter's defense against identity theft (0:00)]()

To understand Crafter's innovative approach, it's essential to grasp several foundational concepts and the limitations of prior work in privacy-preserving machine learning.

A core mathematical tool employed by Crafter is the Earth Mover's Distance (EMD), also known as the Wasserstein distance. EMD quantifies the minimum "cost" of transforming one probability distribution into another, making it a robust metric for comparing high-dimensional data distributions like those of images. Direct computation of EMD for complex data is often intractable, so Crafter utilizes its dual form, which can be approximated using a discriminator network, similar to the architecture of Wasserstein-GANs (WGANs). To ensure stability and theoretical guarantees, a 1-Lipschitz constraint is enforced on the discriminator's gradient through a gradient penalty term. This allows for a meaningful comparison between the distribution of reconstructed images and a non-private prior.

Another crucial set of mathematical concepts underpinning Crafter's design are Implicit Differentiation, the Implicit Function Theorem (IFT) (Lemma 1), and Neumann Inverse Approximation (Lemma 2). These advanced techniques are indispensable for solving nested optimization problems, where one optimization problem is embedded within another. In Crafter's context, the attacker's best-response reconstruction is an inner optimization loop, and the defender's feature crafting is an outer loop. IFT enables the computation of gradients for the outer optimization problem despite the inner problem's dependence on the outer variables, allowing Crafter to optimize its defense strategy effectively.

Existing defenses against privacy leakage in deep learning generally fall into a few categories. Reconstruction distortion-based defenses (e.g., [37]) and attribute inference-based defenses (e.g., [11, 28, 17, 33, 18]) aim to prevent the reconstruction of original images or the inference of sensitive attributes. However, these methods often introduce imperceptible perturbations that, while potentially disrupting automated recognition models, may not evade visual detection by humans, thus failing to protect identity perceptual privacy—a more holistic concept encompassing both reconstruction quality and high-level semantic information.

Many prior works adopt an adversarial game-based approach (e.g., [37, 17, 33, 18, 29]), where a defender actively tries to push the transmitted features away from any information that could reveal private identity. This "stay-away" strategy, as illustrated in the talk, is fundamentally vulnerable to adaptive attackers. An adaptive attacker can continuously update their inversion models in response to the defender's fixed or predictable defense strategy, eventually learning to bypass the protection. This leads to a continuous, often losing, race for the defender. Crafter, in stark contrast, adopts a "get-close" approach. Instead of pushing features away from the private identity, it draws them towards a non-private prior (e.g., average faces), effectively making adaptive attacks ineffective by providing "poisoned" training samples to the attacker's models. This paradigm shift is central to Crafter's robustness.

Key Findings

[▶ Watch: Crafter's core strategy: Misleading attackers with non-private prior (1:00)]()

Crafter introduces a paradigm-shifting approach to protecting identity in deep learning models, yielding several critical findings:

• Novel Feature Crafting Mechanism: Crafter proposes a unique feature crafting mechanism deployed at the network edge. Unlike prior methods that manipulate raw images or attempt to remove information, Crafter actively sculpts the feature representation to mislead attackers.
• Robustness Against Adaptive Attacks: A primary contribution is Crafter's demonstrated robustness against a comprehensive suite of adaptive attacks. This includes scenarios where attackers continuously update their models (A1), utilize different or stronger generative models (A2), or attempt to average out perturbations over multiple queries (A3). This capability significantly surpasses the resilience of state-of-the-art adversarial game-based defenses, which typically fail against such adaptive adversaries.
• "Get-Close" to Non-Private Prior: The core innovation is the "get-close" strategy, where crafted features are subtly altered to appear as if they originated from a non-private prior (e.g., average facial images) in the reconstructed image space. This effectively turns the crafted features into "poison training samples" for adaptive attackers, causing them to reconstruct generic faces rather than private identities.
• Formalized Privacy Metric (e-PII): Crafter introduces e-Perceptual Inversion Indistinguishability (e-PII), a novel privacy metric inspired by differential privacy and t-closeness. e-PII uses EMD to quantify the indistinguishability between images reconstructed from private features and those from a public, non-private prior, providing a holistic measure of identity leakage that considers both pixel-level distortion and semantic perception.
• Optimal Privacy-Utility Tradeoff: Experimental results consistently demonstrate that Crafter achieves a superior privacy-utility tradeoff compared to existing baselines. It significantly reduces the attacker's ability to reconstruct private identities while maintaining high accuracy for downstream cloud-based machine learning tasks.
• Plug-and-Play Edge Deployment: Crafter operates as a plug-in at the edge, requiring no modifications to the backend cloud models or their training procedures. This makes it a highly practical and easily deployable solution for existing deep learning infrastructures.
• Justification for Implicit Optimization: The necessity of complex implicit optimization (using the Implicit Function Theorem) is empirically justified. While a simpler direct latent space optimization (Crafter-z) exists, it yields a significantly poorer privacy-utility tradeoff, highlighting the importance of fine-grained control in the high-dimensional feature space.

Technical Deep Dive

[▶ Watch: Background: Key math concepts and limitations of prior work (2:00)]()

Crafter operates within a typical edge-cloud computing scenario, where users capture sensitive facial data at the edge. This data X is locally encoded by an Encoder (Enc) model into a feature representation Enc(X), which is then transmitted to an untrusted cloud for various ML services (e.g., makeup recommendations, facial expression detection). The paramount objective is to protect user identity while ensuring the utility of these cloud-based tasks.

The primary threat is non-targeted feature inversion attacks. An attacker, who could be an insider or a man-in-the-middle, intercepts the transmitted feature Enc(X) and attempts to reconstruct the original private image X. If the reconstructed image X* closely resembles X, the user's identity is compromised. Crafter defines its privacy goal as identity perceptual privacy, which assesses how much an inverted image X* is perceived as the true private identity by an attacker, akin to human observation, going beyond mere pixel-level metrics.

The talk categorizes attackers into basic attacks and adaptive attacks:

• Basic Attacks:
• Black-box attacker: Queries the user's local Enc with public images (Xpub) to train a shadow decoder Dec. Reconstruction is X* = Dec(Enc(X)).
• White-box attacker: Has full access to Enc parameters. They train a Wasserstein-GAN (WGAN) to distill public prior knowledge, generating average faces G(zr). Reconstruction X* = G(z*) is achieved by optimizing a latent representation z to minimize ||Enc(X) - Enc o G(z)||². Advanced StyleGAN-based reconstructions are also considered.
• Hybrid white-box attacker: Initializes optimization with a black-box decoder output and then performs pixel-level optimization.
• Adaptive Attacks: These adversaries adjust their strategies to counter known defenses.
• A1: Continue the optimization: After the defense releases features Fx, the attacker continuously updates their G or Dec model using Fx to minimize reconstruction loss.
• A2: Utilize different generators: The attacker employs a generator model (G) that is different from, or potentially stronger than, the G used by the defender.
• A3: Average features over multiple queries: The attacker queries the defender multiple times with the same input and averages the resulting protected features to remove perturbations.

The threat model assumes a white-box attacker who knows the defender's strategy and all model weights. This strong assumption ensures robustness against real-world, less omniscient attackers. The defender has access to a trained G from trusted third parties but doesn't know the adversary's specific reconstruction model.

Crafter's design is guided by three principles: privacy, utility, and robustness.

1. Feature-Manipulation Protection: Instead of perturbing raw images (which can be easily undone by encoding), Crafter perturbs the locally encoded feature representation Enc(X) before transmission. This disrupts attacker reconstruction while keeping perturbations small to preserve utility. The Enc model itself is left untouched to maintain its pre-trained utility for downstream tasks.
2. Protection against White-box Attacks: The scheme is explicitly designed to withstand white-box attackers, which are considered the strongest threat.
3. Exploiting Non-private Prior ("Get-Close" Approach): This is the core novelty. Unlike "stay-away" methods, Crafter draws the released features Fx close to a non-private prior in the reconstructed image space. This prior consists of average faces G(zr) that are not associated with any specific private identity. By doing so, Fx acts as a "poisoned" training sample, misleading the attacker into reconstructing non-private images.

To formally quantify privacy and utility, Crafter defines two loss functions:

• Privacy Loss (Lp): Quantifies the attacker's perception of identity using the EMD between the distribution of attacker's inverted images G(z*(Fx)) and the non-private prior G(zr). z*(Fx) is the attacker's best-response latent representation for Fx that minimizes the white-box inversion loss Linv(Fx, z) = ||Fx - Enc o G(z)||². Minimizing Lp means the attacker is tricked into generating images close to average faces.
• Utility Preservation (Lu): Restricts the deviation of Fx from the original feature Enc(X): Lu(Fx) = ||Fx - Enc(X)||². This ensures downstream utility is preserved and decouples privacy from specific task models.

The overall objective is a constrained optimization problem:

min Fx Lp(z*(Fx)) subject to Lu(Fx) ≤ λ

This is transformed into its Lagrange dual form and, to handle the EMD minimization, a minimax game formulation akin to Wasserstein-GAN is used, where a discriminator D distinguishes reconstructed images from the prior. The full objective becomes:

min Fx max D, DL1 Lp(D, z*(Fx)) + β Lu(Fx)

where Lp(D, z*(Fx)) = Ezr[D o G(zr)] - Ez*[D o G(z*(Fx))].

The optimization problem is a nested optimization because z* (the attacker's best response) is a function of Fx. Crafter solves this using the Implicit Function Theorem (IFT). The Crafter Algorithm (Algorithm 1) proceeds iteratively:

1. Initialization: Fx starts as Enc(X).
2. Attacker's Best Response (Inner Loop): For the current Fx, the algorithm simulates the attacker by finding z* that minimizes Linv(Fx, z).
3. Discriminator Training: The discriminator D is trained for ncritic steps to distinguish G(z*(i)) (reconstructed from Fx) from G(zr) (non-private prior).
4. Feature Update (Outer Loop): Fx is updated to minimize Lp (making G(z*(Fx)) closer to G(zr)) and Lu (keeping Fx close to Enc(X)). This crucial step uses the IFT to compute the indirect gradient of Lp with respect to Fx, involving the approxInverseHVP (Algorithm 2) for the Hessian-vector product. The β parameter controls the privacy-utility tradeoff.

Crafter operates in two phases:

• Offline: A trusted party trains a WGAN on Xpub to obtain G, and Enc is prepared. G and Enc are distributed to users.
• Online: The user runs Algorithm 1 locally to craft Fx from their private image X, then sends Fx to the cloud.

To formally quantify privacy, Crafter introduces e-Perceptual Inversion Indistinguishability (e-PII) (Definition 2). A system M is e-PII if EMD(G o M(Xpvt), G o M(Xpub)) ≤ ε. A smaller ε implies stronger perceptual privacy, as reconstructed private images become indistinguishable from public ones. Crafter directly minimizes the EMD, achieving this. It normalizes public faces for stability. e-PII differs from e-Differential Privacy (e-DP) (which focuses on adjacent datasets and max divergence) and t-closeness (tabular data, sensitive attributes), by focusing on raw private images, reconstructed images, and using EMD for perceptual alignment.

Crafter's robustness against adaptive attacks is a cornerstone.

• A1 (Continue optimization): While adversarial game-based defenses fail as attackers update their models, Crafter's "poisoned" features Fx mislead the attacker to reconstruct G(zr). The attacker's best response G(z*) remains close to G(zr), independent of private images, rendering A1 ineffective.
• A2 (Different generators): Crafter's robustness against different or stronger G models (e.g., StyleGAN) comes from its reliance on a simulated attack that can extract identity. As long as the defender's G has fair reconstruction, Crafter provides qualified defense.
• A3 (Average features): To counter averaging attacks that could remove perturbations, Crafter incorporates input shuffling as an inherent part of the encoder. By shuffling the user's batch of data for each query, perturbations become mismatched, preventing effective averaging.

The complexity of implicit optimization is justified by empirical results. An alternative, Crafter-z, directly optimizes the latent representation z (Fx = Enc o G(z)), avoiding IFT. However, Crafter-z yields a poor privacy-utility tradeoff because direct manipulation of Fx in the high-dimensional feature space offers superior, fine-grained control compared to indirect manipulation through the lower-dimensional latent space z.

Demo / Proof of Concept

[▶ Watch: Problem: Threat model, adaptive attacks, identity perceptual privacy (4:00)]()

The efficacy of Crafter was rigorously demonstrated through extensive experiments using standard deep learning frameworks and datasets.

Implementation Details:

Crafter was implemented using PyTorch 1.10.0 and evaluated on NVIDIA GeForce RTX 3090 GPUs.

Datasets:

Experiments utilized widely adopted facial image datasets, ensuring no identity overlap between public and private sets:

• CelebA: 200,000 public images (Xpub), 17,000 private training images (Xtrain), 4,000 private test images (Xtest). Images were 64x64 pixels. The cloud task was 40 facial attributes classification.
• LFW: 10,000 public images, 2,000 private training, 1,000 private test. Images were 128x128 pixels. The cloud task was 10 attributes classification.
• VGGFace2: Images were 112x112 pixels. The cloud task was 5-class hair color classification.

In all cases, 'identity' was the private attribute targeted for protection.

Models:

• Encoder (Enc) and Downstream Task (f): Various architectures were used, including ResNet18, VGG16, and ResNet50. Enc typically comprised the initial layers of these networks.
• Discriminator (D): A standard CNN model.
• Generator (G): For white-box attacks, three models were used: G1, G2 (both ConvTranspose2D stacks), and a more advanced StyleGAN 5. For black-box attacks, a decoder Dec was employed.

Metrics:

• Utility: Measured by Mean AUC for cloud-based attribute classification tasks.
• Privacy: Evaluated against simulated white-box, black-box, hybrid, and adaptive attacks using:
• Evaluation Accuracy (Eval Acc): Identity identification accuracy of a face verification model (e.g., Facenet [26], Azure Face API [2]) on reconstructed private test images. Lower is better.
• Feature Similarity (FSIM): Cosine similarity of penultimate layer outputs from an evaluating network between inverted and raw private images. Lower is better.
• SSIM (Structural Similarity Index Measure): Pixel-level resemblance between reconstructed and original images. Lower is better.
• Human Study: To quantify perceptual privacy by human observers.

Baselines:

Crafter's performance was benchmarked against several state-of-the-art privacy-preserving approaches:

• Adv Learning [37]: An adversarial game-based, task-oriented defense.
• Disco [29]: Similar to Adv Learning but includes a pruner for privacy-leaking channels.
• TIPRDC [17]: A task-independent method maximizing mutual information.
• Fawkes [11] & LowKey [28]: Image-manipulation-based defenses adapted to the edge-cloud threat model.
• Crafter-z: Crafter's alternative using direct latent space optimization, for comparison of implicit optimization necessity.

Evaluation and Results - Basic Attacks:

Crafter demonstrated superior performance against basic inversion attacks:

• White-box Attacks (Figure 6): Crafter consistently achieved the best privacy-utility tradeoff on CelebA and LFW, positioning closest to the ideal lower-right corner (high AUC, low Eval Acc). On CelebA, with β=1, Crafter reduced Eval Acc from 49.22% (unprotected) to 8.59%, while the downstream AUC dropped only 0.05. Crafter-z offered a less satisfactory tradeoff. Adv Learning largely failed against white-box attacks, with Eval Acc around 30% on CelebA, incurring a significant 0.20 AUC drop.
• Black-box Attacks (Figure 7): Crafter achieved comparable or lower Eval Acc/SSIM values against black-box attacks, maintaining a good utility-privacy tradeoff. Crafter-z also performed comparably but was less stable.
• Hybrid White-box Attacks (Figure 8): Against strong hybrid attacks (e.g., 97.65% Eval Acc on LFW without protection), Crafter again demonstrated better tradeoffs compared to Adv Learning and Disco.

Evaluation and Results - Adaptive Attacks:

Crafter's core strength lies in its robustness against adaptive adversaries:

• A1: Continue the optimization (Figures 11, 12, 13): As predicted, Adv Learning and Disco were vulnerable, with privacy loss metrics (Eval Acc, SSIM) drastically increasing as the attacker's model adapted. In stark contrast, Crafter's Eval Acc and SSIM either dropped or maintained levels comparable to basic attacks, confirming its robustness. For model development, TIPRDC also failed against A1, while Crafter remained robust.
• A2: Utilize different generators (Figure 15, Table IV): Crafter was evaluated against attackers using different G models (G1, G2) and varying latent dimensions. Eval Acc fluctuated minimally (within 3%), and FSIM differed by no more than 0.01. Against a more advanced StyleGAN model, Crafter achieved a 0% success rate on CelebA, demonstrating effectiveness against stronger, unseen generators.
• A3: Average features over multiple queries (Table V): Without input shuffling, averaging features indeed weakened the defense, significantly increasing Eval Acc. However, with batch shuffling enabled, the attack success rate was reduced to almost 0%, validating this design choice.

Image-manipulation Defenses (Figures 16, 17):

Comparison with Fawkes and LowKey revealed their ineffectiveness in the edge-cloud scenario. While LowKey achieved comparable Eval Acc, it showed high SSIM, meaning reconstructed images still highly resembled originals. Visual inspection confirmed that the encoding process stripped away their perturbations, leading to poor privacy.

Human Study (Table VI, Figure 18):

A human study for perceptual privacy showed that for images protected by Crafter, participants' ability to identify the original identity from a set of options (or "None above") resulted in a Macro-F1 measure of 0.251, very close to a random guess (0.200). This confirmed Crafter's effectiveness in misleading human perception of identity.

Running Time (Table VII):

Crafter's running time per image was found to be comparable to existing methods. For a 128x128 LFW image, Crafter took 30.82 seconds/image, which is significantly faster than LowKey's 87.45 seconds/image. The inversion and approxInverseHVP steps were identified as the main bottlenecks, with future work aiming for speedup via offline amortizer training.

Limitations and Future Work:

While robust, Crafter has limitations. Accidental exposure of 10% of private images or, more critically, the original features Enc(X) with corresponding identity labels, could reduce Crafter's effectiveness (Table VIII). Therefore, preventing such exposures is paramount. Future work includes speeding up inversion and exploring even more advanced adaptive attack scenarios.

Defensive Implications

[▶ Watch: Crafter's design: Feature manipulation, 'get-close' approach (6:00)]()

The insights from Crafter's development and evaluation provide crucial implications for defenders operating in edge-cloud machine learning environments, particularly those handling sensitive facial data:

1. Embrace Feature Crafting at the Edge: Defenders should prioritize privacy mechanisms that operate at the edge, manipulating feature representations before transmission to the cloud. This pre-processing step is critical for disrupting inversion attacks without requiring modifications to backend ML models.
2. Beware of "Stay-Away" Defenses: Conventional adversarial game-based defenses that aim to maximize the distance between protected features and private information (stay-away approach) are fundamentally vulnerable to adaptive attackers. Defenders should critically re-evaluate the robustness of such methods and consider adopting "get-close" strategies like Crafter's, which mislead attackers towards non-private priors.
3. Implement Robustness Against Adaptive Attacks: Any deployed defense mechanism must be rigorously tested against adaptive adversaries that can learn and counter static protection strategies. This includes scenarios where attackers continue optimizing their models (A1), use different or stronger generative models (A2), or attempt to average out perturbations (A3). Input shuffling, as demonstrated by Crafter, is a simple yet effective countermeasure against averaging attacks.
4. Understand the Criticality of Original Features and Labels: While Crafter offers strong protection for transmitted features, the accidental exposure of original, unprotected features (Enc(X)) alongside their identity labels poses a significant threat. Defenders must ensure that users are not incentivized or enabled to share such ground truth information, as this could directly allow attackers to train identity classification networks.
5. Prioritize Perceptual Privacy: Beyond pixel-level distortion, defenders should focus on identity perceptual privacy, ensuring that even if an image is reconstructed, it does not perceptually reveal the private identity to human observers or automated verification systems. Metrics like e-PII, which leverage EMD, are valuable for this.
6. Consider the Privacy-Utility Tradeoff: There is always a balance between privacy protection and the utility of features for downstream ML tasks. Defenders need to carefully select defense parameters (like Crafter's β) to achieve an optimal tradeoff that meets both privacy requirements and task performance goals.
7. Recognize the Limitations of Image-Manipulation Defenses: Methods that perturb raw images (e.g., Fawkes, LowKey) are often ineffective in edge-cloud scenarios because the encoding process can inadvertently strip away these perturbations, compromising privacy.

Key Takeaways

• Novel "Get-Close" Strategy: Crafter introduces a unique feature crafting mechanism that actively misleads adaptive attackers by drawing crafted features towards a non-private prior, effectively "poisoning" their inversion models.
• Robustness Against Adaptive Attacks: Unlike prior adversarial game-based defenses, Crafter is demonstrably robust against sophisticated adaptive attacks, including continuous optimization, use of different generators, and feature averaging.
• Holistic Privacy Metric: The introduction of e-Perceptual Inversion Indistinguishability (e-PII) offers a comprehensive way to quantify identity leakage, considering both reconstruction fidelity and semantic perception.
• Optimal Privacy-Utility Balance: Crafter consistently achieves a superior privacy-utility tradeoff, significantly reducing identity leakage while maintaining high accuracy for downstream cloud-based ML tasks.
• Practical Edge Deployment: Operating as a plug-in at the edge with no required modifications to backend cloud models, Crafter provides a practical and easily deployable solution for real-world scenarios.
• Justification for Implicit Optimization: The complexity of implicit optimization using the Implicit Function Theorem is justified by its superior performance in achieving fine-grained control over the privacy-utility tradeoff compared to simpler direct latent space manipulations.

About the Speaker(s)

This detailed technical article is based on the presentation by Shiming Wang at the NDSS Symposium. The talk highlights his significant contributions to the field of privacy-preserving machine learning, particularly in developing robust defenses against adaptive identity theft in deep models.