Black-box Attack on CelebA-HQ
99.2IRSE50 ScoreSIDeR
Evaluation results
| Method | Links | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| SIDeRvariant=Recovery-Unauthorized2026.02 | 99.2 | 95.5 | 97.2 | 99.5 | 97.26 | — | — | — | — | — | |
| SIDeRvariant=Decoy2026.02 | 99.1 | 95.4 | 97 | 99.5 | 97.16 | — | — | — | — | — | |
| SIDeRvariant=Hidden2026.02 | 99.1 | 96.3 | 96.6 | 99.7 | 97.36 | — | — | — | — | — | |
| SIDeRvariant=Cover2026.02 | 99 | 96.3 | 96.6 | 99.7 | 97.33 | — | — | — | — | — | |
| DiffAMCategory=Makeup-based2024.05 | 92 | 63.13 | 64.67 | 83.35 | 77.88 | — | — | — | — | — | |
| DiffAMcategory=Makeup-Based2026.02 | 89.66 | 65.09 | 62.99 | 84.51 | 76.79 | — | — | — | — | — | |
| Adv-CPGcategory=Facial Semantic Invariant2026.02 | 88.72 | 76.96 | 63.5 | 87.95 | 79.65 | — | — | — | — | — | |
| GIFTcategory=Makeup-Based2026.02 | 83.72 | 73.84 | 56.48 | 86.37 | 74.4 | — | — | — | — | — | |
| P3-Maskcategory=Facial Semantic Invariant2026.02 | 83.4 | 73.47 | 60.24 | 69.64 | 71.74 | — | — | — | — | — | |
| Adv-Diffusioncategory=Facial Semantic Invariant2026.02 | 81.67 | 52.84 | 34.95 | 70.78 | 58.91 | — | — | — | — | — | |
| CLIP2ProtectCategory=Makeup-based2024.05 | 81.1 | 48.42 | 41.72 | 75.26 | 64.9 | — | — | — | — | — | |
| Clip2Protectcategory=Makeup-Based2026.02 | 80.96 | 47.63 | 42.57 | 73.64 | 63.09 | — | — | — | — | — | |
| DFPPcategory=Makeup-Based2026.02 | 80.59 | 46.38 | 45.37 | 72.13 | 69.2 | — | — | — | — | — | |
| SD4Privacycategory=Facial Semantic Invariant2026.02 | 79.96 | 66.89 | 53.49 | 74.58 | 65.16 | — | — | — | — | — | |
| DiffProtectcategory=Facial Semantic Invariant2026.02 | 79.34 | 58.64 | 24.69 | 75.91 | 59.16 | — | — | — | — | — | |
| AMT-GANCategory=Makeup-based2024.05 | 76.96 | 35.13 | 16.62 | 50.71 | 52.84 | — | — | — | — | — | |
| MI-FGSMcategory=Noise-Based2026.02 | 70.57 | 46.53 | 27.09 | 58.94 | 51.07 | — | — | — | — | — | |
| TI-DIMCategory=Noise-based2024.05 | 63.63 | 36.17 | 15.3 | 57.12 | 41.64 | — | — | — | — | — | |
| PGDcategory=Noise-Based2026.02 | 63.23 | 41.87 | 19.62 | 57.34 | 46.35 | — | — | — | — | — | |
| DPGcategory=Facial Semantic Invariant2026.02 | 62.47 | 42.89 | 35.83 | 66.42 | 53.11 | — | — | — | — | — | |
| TI-DIMcategory=Noise-Based2026.02 | 62.38 | 35.13 | 13.68 | 52.84 | 42.69 | — | — | — | — | — | |
| TIP-IMcategory=Noise-Based2026.02 | 57.29 | 41.26 | 39.07 | 49.56 | 51.58 | — | — | — | — | — | |
| TIP-IMCategory=Noise-based2024.05 | 54.4 | 37.23 | 40.74 | 48.72 | 50.06 | — | — | — | — | — | |
| AMT-GANcategory=Makeup-Based2026.02 | 53.26 | 12.09 | 4.87 | 47.95 | 29.6 | — | — | — | — | — | |
| FGSMcategory=Noise-Based2026.02 | 45.81 | 12.07 | 1.35 | 53.02 | 28.29 | — | — | — | — | — | |
| MI-FGSMCategory=Noise-based2024.05 | 45.79 | 25.03 | 2.58 | 45.85 | 30.63 | — | — | — | — | — | |
| PGDCategory=Noise-based2024.05 | 36.87 | 20.68 | 1.85 | 43.99 | 25.6 | — | — | — | — | — | |
| Adv MakeupCategory=Makeup-based2024.05 | 21.95 | 9.48 | 1.37 | 22 | 14.72 | — | — | — | — | — | |
| Adv-Makeupcategory=Makeup-Based2026.02 | 19.95 | 12.68 | 1.37 | 22.11 | 14.15 | — | — | — | — | — | |
| Adv-Hatcategory=Makeup-Based2026.02 | 16.88 | 5.04 | 4.91 | 12.64 | 10.46 | — | — | — | — | — | |
| Clean2024.05 | 7.29 | 3.8 | 1.08 | 12.68 | 4.61 | — | — | — | — | — | |
| Cleantype=baseline2026.02 | 5.74 | 4.64 | 1.06 | 13.27 | 5.38 | — | — | — | — | — | |
| Adv-DiffusionAttack Type=Facial Semantic Invariant2026.06 | — | — | — | — | — | 43.1 | 79.8 | 26 | 78.6 | 56.8 | |
| AMT-GANAttack Type=Makeup-Based2026.06 | — | — | — | — | — | 35.1 | 76.9 | 16.6 | 50.7 | 44.8 | |
| CleanAttack Type=Baseline2026.06 | — | — | — | — | — | 4.5 | 12.7 | 1.6 | 23.1 | 10.4 | |
| Clip2ProtectAttack Type=Makeup-Based2026.06 | — | — | — | — | — | 41.8 | 85.7 | 41.6 | 78.7 | 61.9 | |
| DiffAMAttack Type=Makeup-Based2026.06 | — | — | — | — | — | 69.5 | 93.6 | 53.7 | 87 | 75.9 | |
| DiffProtectAttack Type=Facial Semantic Invariant2026.06 | — | — | — | — | — | 52.5 | 73.9 | 36.8 | 71.1 | 58.5 | |
| EFPPAttack Type=Facial Semantic Invariant2026.06 | — | — | — | — | — | 71.2 | 90.9 | 60.5 | 90.4 | 78.2 | |
| Flux-GuardAttack Type=Facial edit2026.06 | — | — | — | — | — | 85.4 | 98.5 | 62.9 | 99.5 | 86.5 | |
| PGDAttack Type=Noise-Based2026.06 | — | — | — | — | — | 20.6 | 36.8 | 1.85 | 43.9 | 25.7 | |
| TIP-IMAttack Type=Noise-Based2026.06 | — | — | — | — | — | 50 | 72.1 | 11.5 | 79 | 53.1 |