{"id":"0ff21b1a-8941-4b01-8276-bc1e72b5570a","arxiv_id":"2412.17038","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A conditional GAN adds transferable, self-erasable semantic masks that break black-box face recognition while allowing a trusted partner to reconstruct the original face.","lead":"ErasableMask edits a face photo so face recognition systems fail, then uses a separate network to erase the edit and recover the original for authorized users. The paper reports over 72% average attack confidence on commercial systems and over 90% erasion success, a practical privacy-usability balance.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'erasion' claim is validated only by ESR, which measures dissimilarity to the target face, not identity match to the source; restored faces may be unusable for trusted-authority verification.","rationale":"The reader's weakest assumption identifies exactly the load-bearing issue: ESR measures only the absence of similarity to the adversarial target, not preservation of the source identity. The paper's promise to trusted authorities is that restored faces can be used for forensics and authentication, which requires matching the original person. Without an identity-verification experiment on x_rec versus x_cov, the high ESR numbers are consistent with a restorer that merely destroys all identity information. This is not a disagreement with current consensus or a stylistic critique; it is a missing validation of the paper's defining capability. The proposed test directly measures the claimed usability and would settle whether the erasion mechanism works. Because this is an addressable missing experiment rather than a demonstrated error, the appropriate verdict remains conditional, matching the reader's assessment.","tokens_in":16844,"tokens_out":4950,"duration_ms":45550,"concrete_test":"On the CelebA-HQ and FFHQ test sets, for every protected face x_adv, compute the restored face x_rec and evaluate whether x_rec verifies against the source face x_cov using the same six offline FR models used in Table II and at least one commercial API (e.g., Face++ or Aliyun). Report the fraction of images for which cos(FR(x_rec), FR(x_cov)) exceeds the model's own verification threshold (the same threshold used for clean-image verification in the paper), and compare this fraction to the clean-image verification rate. If the restored-face verification rate is not close to the clean-image rate (e.g., within 5 percentage points), the erasion claim fails even if ESR remains above 90%.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central contribution is that a trusted authority can recover a usable clean face from a protected image. The only reported evidence for this is the Erasion Success Rate (Eq. 18), which counts success when the cosine similarity between the restored face x_rec and the adversarial target face x_target falls below 0.1 times the False Acceptance Rate threshold. This is a negative condition: it only verifies that x_rec no longer impersonates the target. It does not verify that x_rec matches the original source identity x_cov. A restorer that outputs a generic blur or an average face would score high ESR while being useless for forensic face verification. The training loss for the restorer, Lera in Eq. (13), is an L2 pixel loss between x_rec and x_cov; L2 closeness does not guarantee closeness in face-recognition embedding space, especially under semantic attribute editing. No experiment in the paper reports face verification between x_rec and x_cov, nor any TAR@FAR or cosine-similarity distribution for restored faces. Moreover, the problem formulation in Eq. (2) defines erasion as minimizing similarity to x_target subject to proximity to x_cov, which is consistent with the ESR metric but not with the stated goal that TAs should be able to verify x_rec as the source identity. Thus the 'erasable' property is not actually demonstrated; the claim that over 90% erasion success rate supports the scheme's usability is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ErasableMask, a facial privacy protection method that generates attribute-based semantic adversarial perturbations against face recognition (FR) models and includes a restorer module intended to remove the perturbation so that a trusted authority can recover a clean, verifiable face. The method combines a GAN-based attribute editor with a meta-learning auxiliary attack, a clean-domain information injection branch, and a three-stage curriculum learning schedule. Experiments on CelebA-HQ and FFHQ report attack success rates (ASR) and erasion success rates (ESR) against offline and commercial black-box FR systems, as well as robustness to common image processing operations.","tokens_in":17162,"tokens_out":6276,"duration_ms":57971,"significance":"If fully supported, the paper would be a useful contribution: it is among the first to combine transferable semantic adversarial perturbations with a self-erasable mechanism for face privacy, and the reported transferability numbers (e.g., over 70% ASR in commercial systems) are competitive with prior face-based attacks. The meta-auxiliary attack is a genuinely interesting way to balance surrogate models, and the three-stage curriculum is a sensible engineering choice. However, the paper's distinctive claim—erasability for trusted authorities—is not validated by the reported metric: ESR measures only that the restored image is no longer similar to the target identity, not that it is recognized as the source identity. Because the core novelty rests on the erasion property, this is a load-bearing gap that needs new experiments rather than a simple revision of wording.","major_comments":[{"comment":"The formalization of erasion and its evaluation do not establish identity preservation. Eq. (2) minimizes D(FR(x_rec), FR(x_target)) subject to a pixel-space proximity constraint, and ESR counts success when cos[FR(x_rec), FR(x_target)] < 0.1 times the FAR. Neither condition ensures that x_rec matches x_cov in the FR embedding, so a restorer that outputs a generic or blurred face could achieve high ESR while being useless for trusted-authority verification. The reconstruction loss in Eq. (13) is an L2 pixel loss, which does not guarantee embedding-space identity preservation, especially under semantic attribute editing. Please report verification experiments for x_rec against x_cov, e.g., TAR@FAR at standard operating points, cosine-similarity distributions, or 1:N identification, for each black-box FR model. Without this, the claim of over 90% erasion success rate cannot be interpreted as 'the TA can verify the restored face.'","section":"Section III-B and Section V-A2, Eq. (18)"},{"comment":"The commercial-API erasion results are inconsistent with the claim that x_rec is nearly identical to the original clean face. The overall mean erasion confidence (23.92) is higher than the clean-image baseline (17.74), and for Face++ the erasion value (42.72) exceeds the clean value (39.92). If the restorer truly removed the adversarial target-specific information, the restored image should not, on average, be more target-like than the unperturbed source image. This discrepancy needs an explanation, or the erasion claim should be substantially weakened.","section":"Table III"},{"comment":"The robustness claim is not supported for rotation and cropping. ESR drops to 23.8–67.3% under Random Rotate and to 4.9–44.0% under Central Crop across the six evaluated models (e.g., IRSE50: 36.7/18.9; CosFace: 23.8/14.9; IR152: 28.7/12.0). The text dismisses these as methods that trusted authorities will not apply, but robustness is advertised as a central contribution in the abstract and Section I, and Table V explicitly presents these transformations as part of the evaluation. Please either exclude these operations from the robustness claim or show that an alignment preprocessing step restores ESR to acceptable levels.","section":"Section V-E, Table V"},{"comment":"The experimental protocol is ambiguous. The text says that three of the six models are used as white-box models for training and the remaining three as black-box models for evaluation, yet Table II reports ASR and ESR for all six models (Facenet, ArcFace, IRSE50, MobileFace, CosFace, IR152). Please clarify how the held-out models are chosen, whether the reported numbers are averaged over multiple splits, and which columns correspond to held-out (truly black-box) models. In addition, please report the number of random seeds and standard deviations, since the headline numbers are presented without any variance information.","section":"Section V-A4 and Table II"}],"minor_comments":[{"comment":"The definition of w_i(t) is hard to parse; please write the normalization explicitly and define rate_i(t) with consistent notation (the text currently uses 'M ean' with a space).","section":"Section IV-B, Eq. (11)"},{"comment":"The update in line 7 uses θ'_E = θ_E − lr·∇θ_E Lpri, but the text says Eadv is initialized with Genc's parameters; please clarify which parameters are updated during meta-train and meta-test, and how θ'_E is used when computing Laux in Eq. (10).","section":"Algorithm 1"},{"comment":"The role of ε in Ladv = max(... , ε) is unclear; if it is a constant lower bound, the gradient is zero whenever the loss is below ε, so please clarify how this 'adjusts the perturbation intensity.'","section":"Section IV-B, Eq. (12)"},{"comment":"The thresholds τ1 and τ2 are defined relative to the False Acceptance Rate, but the FAR operating point per model is not given; please provide the FAR values used for each FR model.","section":"Section V-A2"},{"comment":"Please state whether the image-processing operations are applied to both x_adv and x_rec before computing ASR and ESR, and whether any face alignment (e.g., MTCNN re-detection) is performed after the transformations.","section":"Table V"},{"comment":"The paper uses the nonstandard term 'erasion' throughout; consider 'erasure' or 'perturbation removal' for readability, and fix typos such as 'server a promising solution' (Section II-A) and 'the results are demonstrated in Table. III' (Section V-C).","section":"Throughout"},{"comment":"The Conclusion's limitation paragraph notes that existing quality metrics do not apply to semantic perturbations, but it does not acknowledge the identity-preservation gap in the erasion evaluation; please state this limitation explicitly.","section":"Section VI"}],"recommendation":"major_revision","confidential_remarks":"The paper's central contribution is the erasable property, and the current evidence is insufficient: ESR does not measure identity recovery, and the commercial-API erasion numbers are not clean relative to the baseline. The authors should be asked to add identity-verification experiments for restored faces and to clarify the black-box split. The commercial-API evaluation on 100 random images is acceptable as a pilot but is not, by itself, strong evidence of usability."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: this paper has a plausible, well-engineered attack that seems to genuinely improve black-box transferability, but the 'erasable' half of the scheme is validated with the wrong metric. The 90% erasion success rate does not mean the restored face is usable for identity verification. That gap is load-bearing because the whole point of the scheme is that a trusted authority can recover a face they can verify.\n\nWhat's new: the meta-auxiliary attack—using one surrogate as primary, others as auxiliary, with a meta-learning update and adaptive weighting—is a reasonable extension of Sibling-Attack and gives a real boost in the ablation (roughly +5-10 ASR on several black-box models). The clean-domain information injection via a shared decoder copy is also a sensible way to give the restorer something to work with. The three-stage curriculum is standard but applied sensibly. The experiments are extensive: six offline models, three commercial APIs, robust models, ablations, image quality. The 72% mean confidence on commercial systems is a solid headline.\n\nThe soft spots are real. The erasion metric, ESR, only checks that the restored face is no longer similar to the target face. It never checks that the restored face matches the source identity. The restorer is trained with an L2 reconstruction loss, and L2 closeness does not guarantee embedding-space identity. A generic blur or an averaged face would pass ESR while being useless for a trusted authority. There is no verification experiment—no TAR@FAR, no cosine similarity between x_rec and x_cov in any FR model. The problem statement in Eq. 2 reinforces this: it minimizes similarity to the target under a pixel constraint, which is not the same as preserving identity.\n\nThe paper also omits direct comparison with Adv-Attribute and CLIP2Protect, which are the closest prior art for transferable face attacks with attribute-style perturbations. Both are cited in the references but never appear in the tables. That's a conspicuous gap.\n\nFinally, the robustness section shows ESR collapses under random rotation and central crop (down to 23-44% in some rows), and the authors dismiss this by saying TAs won't apply these operations. That is a minor point, but it is a bit of a stretch for a paper claiming robustness. No error bars are reported either, which makes small differences in the ablation tables hard to interpret.\n\nOverall: the attack side is worth engaging with; the erasion claim is not yet supported. The fix is straightforward—add identity-verification experiments for reconstructed faces, compare with the missing baselines, and be explicit about what ESR does and does not measure. This deserves a serious referee, but it needs substantial revision before it can be accepted.","headline":"A strong transferable attack with an under-supported erasion claim; the recovery promise needs identity-based verification, not just a dissimilarity metric.","tokens_in":17699,"tokens_out":4467,"would_cite":false,"duration_ms":35143,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"ErasableMask claims that semantic adversarial face masks can be made transferable to black-box face recognition systems and then erased by a trained restorer, letting trusted authorities recover a usable face.","keywords":["facial privacy protection","adversarial examples","face recognition","transferability","perturbation erasion","meta-learning","curriculum learning","conditional GAN"],"falsifier":"Take a set of restored faces produced by ErasableMask and run standard face verification between each restored face and the original source image. If verification fails for a substantial fraction, the erasion claim would collapse despite high ESR numbers, because the goal is to preserve identifiable information for trusted authorities.","tokens_in":16654,"feed_emoji":"🎭","tokens_out":4775,"duration_ms":39447,"temperature":0.7,"pith_summary":"This paper proposes ErasableMask, a facial privacy protection scheme built on adversarial examples that alter facial attributes to stop black-box face recognition models from matching a person to their identity. Its two central claims are that the attribute-based perturbations transfer to unseen face recognition systems with state-of-the-art success (average confidence above 72% on commercial systems), and that a trained restorer can erase those perturbations, letting a trusted authority recover a face image that no longer matches the adversarial target (over 90% erasion success). The paper argues that both properties come from the same design: a meta-auxiliary attack that balances optimization across surrogate models, and a clean-domain information injection that gives the restorer enough source information to undo semantic changes. If correct, the scheme would let users share face images publicly without granting unauthorized face matching, while still allowing authorized verification.","feed_headline":"ErasableMask blocks face recognition, then erases the mask","feed_subtitle":"A privacy scheme that stops unauthorized face matching while letting trusted authorities recover a clean face.","key_machinery":"The key machinery is the meta-auxiliary attack (a double-gradient update where the perturbation encoder is fine-tuned on one surrogate FR model and then evaluated on the others) and the clean-domain information injection (an extra decoder branch fed with the source face's clean features, fused into the protected generation at a weight gamma). The meta-auxiliary attack makes the optimization robust to the imbalance between easy and hard surrogate models, improving transferability; the information injection provides the restorer with source details that semantic perturbations would otherwise destroy, improving erasion. The three-stage curriculum learning schedule is what lets these two opposing objectives be trained without one destroying the other.","core_discovery":"The paper's central discovery is that semantic perturbations, generated by editing facial attributes in latent space, can be made simultaneously transferable and erasable, provided the generator and restorer are trained with a meta-learning attack and shared clean-domain information. The meta-auxiliary attack splits the surrogate face recognition models into one primary and several auxiliary tasks; it takes a meta-training step on the primary model, then uses the auxiliary models' losses on the updated parameters to adjust the optimization direction, with self-adaptive weights preventing any single surrogate from dominating. The restorer is trained to invert the semantic perturbation using a copy of the decoder that injects the source face's clean latent features, and a three-stage curriculum first teaches attribute editing, then couples the perturbation encoder with the restorer, then hardens the restorer against image processing. The result reported is that protected faces reach over 72% mean similarity confidence to the target on commercial systems, while restored faces drop below 0.1 times the False Acceptance Rate on over 90% of examples.","pith_inferences":["The reported erasion success is defined relative to the target identity, so a restored image could theoretically be a different person's face and still be counted as clean; an identity-verification test against the source would be a stronger check.","The information-injection design suggests a general recipe for reversible adversarial perturbations: keep a clean branch during generation so the inverse model has access to what was destroyed.","The meta-auxiliary double-gradient update is a flexible regularizer; it might improve transferability for other adversarial perturbations, not just semantic attribute edits.","Because ESR drops sharply under random rotation and central cropping, the scheme's robustness claim is mostly about standard image-processing pipelines, not geometric distortions."],"forward_implications":["Publicly shared face images could be made useless for unauthorized identity matching while remaining recoverable for forensics.","The meta-auxiliary attack recipe could be reused in other black-box adversarial settings where multiple surrogate models are available.","The gamma trade-off offers a practical knob to favor either stronger privacy protection or higher recovery fidelity depending on the deployment.","Double-digit gains over strong baselines on robust (adversarially trained) face recognition suggest the scheme survives better than gradient-based attacks."],"supporting_citations":[{"why":"Supplies the FGSM gradient-based baseline that ErasableMask must beat in transferability.","marker":"[29]"},{"why":"Supplies the PGD gradient-based baseline used as another white-box attack comparison.","marker":"[30]"},{"why":"AdvFaces provides the face-based adversarial synthesis baseline for black-box transferability.","marker":"[6]"},{"why":"SemanticAdv motivates the use of attribute-conditioned image editing for semantic perturbations.","marker":"[11]"},{"why":"Sibling-Attack is the auxiliary-task attack that the meta-auxiliary strategy directly builds on.","marker":"[31]"},{"why":"GMAA is the manifold-based transferability baseline whose performance ErasableMask claims to surpass.","marker":"[32]"},{"why":"MAML provides the meta-learning formulation underlying the meta-train/meta-test attack.","marker":"[25]"},{"why":"The noise pool technique is used to make both attack and erasion robust to image processing.","marker":"[27]"},{"why":"The curriculum learning survey motivates the three-stage training schedule that resolves optimization conflicts.","marker":"[28]"},{"why":"AttGAN supplies the conditional GAN architecture on which the generator and restorer are based.","marker":"[40]"}],"fun_headline_variants":["ErasableMask fools face AI, then erases the mask","Face privacy with punch: fool black-box AI, then restore","Transferable face attack, now erasable","Fool face recognition, then clean up","ErasableMask: hide your face, then get it back"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a restored face counts as a success whenever its similarity to the adversarial target falls below a small multiple of the False Acceptance Rate, even though no experiment checks whether the restored face still matches the original person's identity.","fun_headline_variants_meta":{"raw":{"variants":["ErasableMask fools face AI, then erases the mask","Face privacy with punch: fool black-box AI, then restore","Transferable face attack, now erasable","Fool face recognition, then clean up","ErasableMask: hide your face, then get it back"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000232,"raw_usage":{"total_tokens":1511,"prompt_tokens":990,"completion_tokens":521,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":606,"completion_tokens_details":{"reasoning_tokens":441}},"tokens_in":606,"tokens_out":521,"duration_ms":4950,"temperature":1.0,"reasoning_tokens":441,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T05:50:22.738875+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a set of restored faces produced by ErasableMask and run standard face verification between each restored face and the original source image. If verification fails for a substantial fraction, the erasion claim would collapse despite high ESR numbers, because the goal is to preserve identifiable information for trusted authorities.","supporting_citations":[{"cited_title":"Towards deep learning models resistant to adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies the PGD gradient-based baseline used as another white-box attack comparison."},{"cited_title":"Advfaces: Adversarial face synthesis,","cited_arxiv_id":null,"evidence_quote":"AdvFaces provides the face-based adversarial synthesis baseline for black-box transferability."},{"cited_title":"Semanticadv: Gen- erating adversarial examples via attribute-conditioned image editing,","cited_arxiv_id":null,"evidence_quote":"SemanticAdv motivates the use of attribute-conditioned image editing for semantic perturbations."},{"cited_title":"Sibling- attack: Rethinking transferable adversarial attacks against face recogni- tion,","cited_arxiv_id":null,"evidence_quote":"Sibling-Attack is the auxiliary-task attack that the meta-auxiliary strategy directly builds on."},{"cited_title":"Discrete point-wise attack is not enough: Generalized manifold adversarial attack for face recognition,","cited_arxiv_id":null,"evidence_quote":"GMAA is the manifold-based transferability baseline whose performance ErasableMask claims to surpass."},{"cited_title":"Mbrs: Enhancing robustness of dnn- based watermarking by mini-batch of real and simulated jpeg com- pression,","cited_arxiv_id":null,"evidence_quote":"The noise pool technique is used to make both attack and erasion robust to image processing."},{"cited_title":"Attgan: Facial attribute editing by only changing what you want,","cited_arxiv_id":null,"evidence_quote":"AttGAN supplies the conditional GAN architecture on which the generator and restorer are based."}],"review_version":1}