# Face Privacy Protection

Adversarial perturbations added to photos can stop a diffusion model from learning a person's identity, but earlier methods altered the whole face densely, and the accumulated distortion became visible around facial features. SEAL confines the perturbation to 5% of spatial locations, jointly optimizing where it lands and its values with a differentiable top-k mask, and disrupts the latent variance of a frozen VAE encoder. On CelebA-HQ and VGGFace2, protected images reach above 41 dB PSNR, 0.97 SSIM and at most 0.07 LPIPS, while identity similarity after DreamBooth personalization stays at most 0.15.

Adversarial perturbations added to photos can stop a diffusion model from learning a person's identity, but earlier methods altered the whole face densely, and the accumulated distortion became visible around facial features. SEAL confines the perturbation to 5% of spatial locations, jointly optimizing where it lands and its values with a differentiable top-k mask, and disrupts the latent variance of a frozen VAE encoder. On CelebA-HQ and VGGFace2, protected images reach above 41 dB PSNR, 0.97 SSIM and at most 0.07 LPIPS, while identity similarity after DreamBooth personalization stays at most 0.15.