5 ms·

Fair shake, this time I cropped the image too so that it wasn't looking at any of the boundary to identify it either. Here's the original image: https://imgur.

Fair shake, this time I cropped the image too so that it wasn't looking at any of the boundary to identify it either. Here's the original image: https://imgur.com/a/Td4rhoy https://imgur.com/a/Td4rhoy And the cloaked: https://imgur.com/a/cPCiCZo https://imgur.com/a/cPCiCZo These were both saved as JPG with compression level 8/12. I searched for the cloaked crop (96.jpg) first this time: https://imgur.com/a/FSehQWO https://imgur.com/a/FSehQWO And the original crop (10.jpg) next: https://imgur.com/a/yx4jF0B https://imgur.com/a/yx4jF0B This time, Google reverse image search did better at identifying the name of the singer in the cloaked image, instead of just giving the band name for the uncloaked. Not super scientific since we don't really know what's going on behind-the-scenes with Google reverse image search, but it's certainly one adversary that doesn't seem to be easily fooled if there are other images of "you" out there for it to find. I also tried these small crops in Google Lens with less success (I got unrelated portraits for both images, cloaked or not).

hadeson 6y ago
Yandex seem to give even more precise matches than Google. Maybe image of someone less popular would work better.
cookiecaper 6y ago
The goal, afaik, is to stop facial detection software from learning to recognize you and put a face to a name, not to frustrate visual similarity searches. The images are supposed to be visually similar -- so similar that they're indistinguishable to a human viewer. Surveillance software that purports to accurately identify a person across multiple images is not just looking for the same content with some visually insignificant modifications. It's reading your facial structure, attaching your name to it, and searching for it in every image received. Fawkes is working to defeat that specific use case, not all fuzzy matchers in general. P.S. If you have a human assailant running a reverse image search for photos of you, I think you're well past the point that something like this could be expected to help.
- Sniffnoy 6y ago
  But this suggests a way to defeat the cloak -- run your input through image similarity search, then run your facial recognition software on the hits. This won't work in full generality, not every picture is on the internet like that, but it can certainly help, I imagine.
  - cookiecaper 6y ago
    I think that technique probably works a lot better with high-resolution professional headshots than it does with candid photos at the family reunion, for example. However, if someone is willing to go to that level of effort, the target probably needs to aim for something a little more forceful than tricking Facebook's autotagger.
- nl 6y ago
  Since visual similarity uses similar feature vectors to facial recognition it calls into question their whole theory of operation.

hadeson 6y ago

Yandex seem to give even more precise matches than Google. Maybe image of someone less popular would work better.

cookiecaper 6y ago

The goal, afaik, is to stop facial detection software from learning to recognize you and put a face to a name, not to frustrate visual similarity searches. The images are supposed to be visually similar -- so similar that they're indistinguishable to a human viewer. Surveillance software that purports to accurately identify a person across multiple images is not just looking for the same content with some visually insignificant modifications. It's reading your facial structure, attaching your name to it, and searching for it in every image received. Fawkes is working to defeat that specific use case, not all fuzzy matchers in general. P.S. If you have a human assailant running a reverse image search for photos of you, I think you're well past the point that something like this could be expected to help.

Sniffnoy 6y ago
But this suggests a way to defeat the cloak -- run your input through image similarity search, then run your facial recognition software on the hits. This won't work in full generality, not every picture is on the internet like that, but it can certainly help, I imagine.
- cookiecaper 6y ago
  I think that technique probably works a lot better with high-resolution professional headshots than it does with candid photos at the family reunion, for example. However, if someone is willing to go to that level of effort, the target probably needs to aim for something a little more forceful than tricking Facebook's autotagger.
nl 6y ago
Since visual similarity uses similar feature vectors to facial recognition it calls into question their whole theory of operation.