University of Toronto Research Explored a Privacy Filter for Face Detection
In May 2018, University of Toronto researchers described a privacy filter that used adversarial perturbations to reduce detections by a Faster R-CNN face detector on the 300-W test set. The paper reported a drop from about 99.5% detected faces to 0.5% under its tested setup, highlighting both privacy techniques and the limits of computer-vision systems.
University of Toronto Engineering reported in May 2018 that researchers Parham Aarabi and Avishek Bose had developed a research prototype designed to disrupt a face detector while making only subtle changes to an image. The work was presented as a privacy-oriented use of adversarial machine learning, not as a general-purpose tool for disabling every facial-recognition system.
Tested against a specific face detector
The accompanying paper evaluated a generator trained against a Faster R-CNN-based face detector on the cropped 300-W face dataset. In that setup, the authors reported that detected faces fell from about 99.5% to 0.5%. The University of Toronto announcement described the same result as reducing originally detectable faces from nearly 100% to 0.5%.
The method generated small, image-specific perturbations intended to cause the tested detector to miss faces. The result is important because it demonstrates that visual systems can be sensitive to changes that are hard for people to notice. It does not demonstrate that the method works against all face-recognition products, camera pipelines or real-world conditions.
A privacy and robustness lesson
The study sits at the intersection of privacy research and adversarial robustness. Its potential privacy value came with an equally useful warning for builders of computer-vision systems: a model that performs well on ordinary images can still be vulnerable to intentionally crafted inputs. The paper also found that results changed under JPEG compression, reinforcing that the outcome depended on the tested conditions.
For practitioners, the durable lesson is to evaluate vision models for adversarial robustness alongside ordinary accuracy. Privacy-preserving techniques and detection systems both need testing that reflects their specific deployment environment, assumptions and failure modes.
Key Points
- 1The research used adversarial perturbations to disrupt a tested Faster R-CNN face detector.
- 2On the cropped 300-W test set, the paper reported detection falling from about 99.5% to 0.5%.
- 3The result demonstrates a specific robustness limitation, not universal protection from facial-recognition systems.
Scoring Rationale
A relevant early privacy and adversarial-robustness research result, with clear risk-awareness value but limited currentness and no demonstrated broad deployment.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems