Image Cloaking and Data Poisoning: Fawkes and LowKey
Imperceptible pixel perturbations added before posting, so that any facial recognition model trained on your photos learns a wrong representation of your face — data poisoning at the training stage rather than an inference-time attack. Severe limits: no help for already-scraped images, requires near-complete coverage since one uncloaked photo undoes it, and defeated by retraining on more robust models. Best understood as raising the cost of building a model, not protection.
**Image cloaking** protects photographs you publish by adding perturbations that are imperceptible to humans but corrupt any facial recognition model trained on those images. The best known implementation is **Fawkes**, from the SAND Lab at the University of Chicago; **LowKey** takes a similar approach. ## How it works Facial recognition systems are commonly built by scraping public photographs and training a model to associate a face with an identity. Cloaking attacks that pipeline at the training stage rather than at inference. Before posting, the tool alters your images at the pixel level in a way that is visually undetectable but shifts the feature representation the model would learn. A system trained on cloaked photos learns a **wrong** internal representation of your face — so when it later encounters an uncloaked photo of you, it fails to match. This is **data poisoning**: the attack is on the training set, not on the classifier's runtime input. It differs from Adversarial Fashion: Clothing and Makeup That Attack Computer Vision, which attacks at inference time. ## The limitations, which are severe **It cannot help with photographs already scraped.** Anything already collected is already in the training data. For most people with any online history, a meaningful portion of the damage predates the tool. **It requires near-complete coverage.** A model that has enough uncloaked images of you learns the correct representation regardless. One untagged photo posted by a friend can undo the effort. **Retraining and detection defeat it.** As newer, more robust models appear, and as poison-detection methods develop, previously cloaked images stop protecting. The authors have been candid that the approach is shelf-lifed by design. **It is asymmetric in the wrong direction.** You must cloak every image forever; the adversary needs to solve it once. ## What it is actually for Cloaking is best understood as **raising the cost** of building a recognition model from public photos, not as protection. It is a meaningful contribution for someone with limited online presence starting now, and close to useless for someone with a decade of tagged photographs already indexed. The broader lesson generalises across this whole category: technical countermeasures against a system that can retrain are temporary by construction. See Counter-Surveillance as an Arms Race: Why the Durable Lever Is Legal, Not Technical.