Adversarial noise that fools facial recognition

What it does

Fawkes takes your photos and cloaks them with adversarial perturbations designed to make facial-recognition models misclassify your face. You pick a protection level (low, mid, or high), and the tool returns altered images you can share instead of the originals. It runs entirely offline, which matters because your raw face never leaves the machine.

The interesting bit

The tool applies adversarial-ML techniques—optimized perturbations—to make facial-recognition models fail on your images. It is USENIX Security 2020 research from UChicago’s SANDLab, offered as open-source code for personal and academic use.

Key highlights

• Three protection modes (low, mid, high) trade off perturbation size against privacy strength.
• Runs locally with no cloud service or API calls required.
• Published academic work (USENIX Security 2020) with an open codebase intended only for personal and academic use.
• Distributed via PyPI with a command-line interface.

Caveats

• The standard PyPI package and binary ship without GPU support, leaving CPU-only speeds unless you modify the source dependencies.
• The authors state that Python scripts for testing protection effectiveness are still being prepared and not yet available.
• Perturbation generation takes roughly 60 seconds per image on CPU, so processing large albums is slow.

Verdict

Worth exploring if you share photos online and want unauthorized facial-recognition models to misidentify you, or if you study adversarial machine learning. Skip it if you need polished consumer software—this is research code with visible rough edges.