Fairness Properties of Face Recognition and Obfuscation Systems

September 2, 2022  •  4 min  • 837 words  •

Tags: ML Security Privacy Fairness Conference

Pdf Cite Code

Information

Authors

Harrison Rosenberg , Brian Tang, Kassem Fawaz , Somesh Jha

Conference

32nd USENIX Security Symposium (2023)

Blog

Intro

The proliferation of automated face recognition in various commercial and government sectors has caused significant privacy concerns for individuals. A recent, popular approach to address these privacy concerns is to employ evasion attacks against the metric embedding networks powering face recognition systems. Face obfuscation systems generate imperceptible perturbations, when added to an image, cause the face recognition system to misidentify the user. The key to these approaches is the generation of perturbations using a pre-trained metric embedding network followed by their application to an online system, whose model might be proprietary. This dependence of face obfuscation on metric embedding networks, which are known to be unfair in the context of face recognition, surfaces the question of demographic fairness – are there demographic disparities in the performance of face obfuscation systems?

Embedding Space Structure

To address this question, we perform an analytical and empirical exploration of the performance of recent face obfuscation systems that rely on deep embedding networks. Intuitively, the embedding space is comprised of images belonging to identities (left) and identities belonging to larger demographic groups (right).

We find that metric embedding networks are demographically aware; they cluster faces in the embedding space based on their demographic attributes. Below is a visual representation of the embedding space using a dimensionality reduction technique known as t-SNE¹.

Evaluation

Adversarially perturbing these identities may require different robustness budgets² depending on the individual’s demographic and the neighboring identities. We observe this in the disparities between L2 perturbation costs for the Carlini-Wagner attack³. Thus, this effect carries through to face obfuscation systems: faces belonging to minority groups incur reduced utility compared to those from majority groups.

This disparity also exists in the adversarial strength of the attacks. Consider the following whitebox attacks on subsets of demographics - the performance discrepancies are vast.

For blackbox attacks, the average obfuscation success rate on the online Face++ API can reach up to 20 percentage points.

Root Cause Investigation

We utilized TCAV⁴ to investigate whether intermediate layers of the network learn to distinguish demographic attributes. After retrofitting the TCAV framework to metric embedding networks, we used skin tones as the demographic concepts and annotated images with the Fitzpatrick scale. The results demonstrate high utilization of skin tone concepts by two early layers in the network. Darker skin tones are learned separately (Conv2d 2a) than lighter skin tones (Block 35) suggesting that metric embedding networks differentiate between skin colors in the early layers.

By examining estimates of the local Lipschitz constants, we investigate the stability of metric embedding networks in relation to the demographic distribution of their training sets. A classifier’s margin scales inversely with the Lipschitz constant, making classifiers with high local Lipschitz constants less stable and easier to attack⁵⁶. We use the RecurJac ⁷ and Fast-Lin ⁸ bound algorithms to upper-bound local Lipschitz constants within small neural networks trained on datasets with uniform and non-uniform distributions of demographic groups.

Further, identities corresponding to minority demographic groups have larger upper bounds on local Lipschitz constants than do majority identities. These results suggest networks generalize worse for demographic groups which are a minority in the training set, thus networks are less robust to perturbation for certain demographics.

Citation

@inproceedings{rosenberg2023fairness,
    title={Fairness Properties of Face Recognition and Obfuscation Systems},
    author={Rosenberg, Harrison and Tang, Brian and Fawaz, Kassem and Jha, Somesh},
    booktitle={32nd USENIX Security Symposium},
    year={2023}
}

Relevant Links

https://arxiv.org/abs/2108.02707

References