Face Verification on CelebA-HQ
95PSR (IRSE50)FaceCloak
Evaluation Results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| FaceCloak2026.05 | 95 | 73.5 | 65.5 | 97.5 | 82.9 | |
| DiffAM2026.05 | 89.7 | 65.1 | 63 | 84.5 | 75.6 | |
| Adv-CPG2026.05 | 88.7 | 77 | 63.5 | 88 | 79.3 | |
| GIFT2026.05 | 83.7 | 73.8 | 56.5 | 86.4 | 75.1 | |
| P3-Mask2026.05 | 83.4 | 73.5 | 60.2 | 69.6 | 71.7 | |
| Adv-Diffusion2026.05 | 81.7 | 52.8 | 35 | 70.8 | 60.1 | |
| CLIP2ProtectAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 81.1 | 48.42 | 41.72 | 75.26 | — | |
| Clip2Protect2026.05 | 81 | 47.6 | 42.6 | 73.6 | 61.2 | |
| DFPP2026.05 | 80.6 | 46.4 | 45.4 | 72.1 | 61.1 | |
| SD4Privacy2026.05 | 80 | 66.9 | 53.5 | 74.6 | 68.7 | |
| DiffProtect2026.05 | 79.3 | 58.6 | 24.7 | 75.9 | 59.6 | |
| AMT-GANAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 76.96 | 35.13 | 16.62 | 50.71 | — | |
| MI-FGSM2026.05 | 70.6 | 46.5 | 27.1 | 58.9 | 50.8 | |
| TI-DIMAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 63.63 | 36.17 | 15.3 | 57.12 | — | |
| PGD2026.05 | 63.2 | 41.9 | 19.6 | 57.3 | 45.5 | |
| DPG2026.05 | 62.5 | 42.9 | 35.8 | 66.4 | 51.9 | |
| TI-DIM2026.05 | 62.4 | 35.1 | 13.7 | 52.8 | 41.3 | |
| TIP-IM2026.05 | 57.3 | 41.3 | 39.1 | 49.6 | 46.8 | |
| TIP-IMAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 54.4 | 37.23 | 40.74 | 48.72 | — | |
| AMT-GAN2026.05 | 53.3 | 12.1 | 4.9 | 48 | 29.5 | |
| FGSM2026.05 | 45.8 | 12.1 | 1.4 | 53 | 28.1 | |
| MI-FGSMAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 45.79 | 25.03 | 2.58 | 45.85 | — | |
| PGDAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 36.87 | 20.68 | 1.85 | 43.99 | — | |
| Adv-MakeupAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 21.95 | 9.48 | 1.37 | 22 | — | |
| Adv-Makeup2026.05 | 20 | 12.7 | 1.4 | 22.1 | 14 | |
| Adv-Hat2026.05 | 16.9 | 5 | 4.9 | 12.6 | 9.9 | |
| CleanAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 7.29 | 3.8 | 1.08 | 12.68 | — | |
| InvertedAttack Type=Black-box impersonation, Surrogate Models=Other three FR systems2023.06 | 5.57 | 2.77 | 0.6 | 13.32 | — |