📖 Red Teaming Privacy-Protective Perturbation: Blind Face Restoration as an Attack Strategy

This repository contains the code for the adaptive test and the model weight tuned by the Protective Perturbation Simulation Scheme.

Model weight for restoration models: DiffBIR, Codeformer

Model weight for restoration models fine-tuned by the Protective Perturbation Simulation Scheme DiffBIR, Codeformer.

🔒 Applying Adaptive Protection

bash scripts/train_(codeformer/diffbir).sh %s %s'%(input_path, output_path)

(The codeformer weight can be automatically download while the diffbir weight should be downloaded and modify the path in DiffBIR_adapt line 858)

🔓 restoration attack

Please refer to DiffBIR, Codeformer to launch the restoration attack.

Codeformer inference:

python inference_codeformer.py -w 0.5 --has_aligned --input_path --output_path

DiffBIR inference:

python -u inference.py \--task face \--upscale 1 \--version v2 \--sampler spaced \--steps 50 \--captioner none \--pos_prompt \'\' \--neg_prompt \'low quality, blurry, low-resolution, noisy, unsharp, weird textures\' \--cfg_scale 4.0 \--input  --output CAAT_atkpdm_v3_wm_diffbir/%s --device cuda --precision fp32

Code for the algorithms included in the experiments

🛡️ Protective Perturbation

• All protective perturbations use random seed 1042.
• We adopt the official implementations from the following repositories (default settings used):
  • AdvDM
  • Anti-DreamBooth
  • CAAT
  • MetaCloak
  • DisDiff
  • SimAC

---

🧑‍🎨 Personalized Generation

• DreamBooth is run with random seed 10042.
• We use the following codebases with default settings:
  • DreamBooth
  • Custom Diffusion

---

🧼 Purification-based Attack

• Official implementations are adopted with default configurations:
  • GridPure
  • PDM-Pure

---

🧯 Restoration-based Attack

• We use the following repositories (default settings applied):
  • CodeFormer
  • DiffBIR

---

📏 Evaluation Metrics

• Metric implementations are reused from:
  • ISM, FDFR
  • CLIP-IQAC, LIQE