How does image cloaking with a tool like Fawkes protect your photos from face recognition?

Fawkes adds tiny, human-invisible pixel changes that "poison" face-recognition models — so a model trained on cloaked images learns a distorted version of your face and fails to recognise the real you.

Image cloaking makes faces in photos unrecognisable to automated systems while looking completely normal to humans. Fawkes does this through adversarial perturbation:

• Invisible modification: it adds pixel-level changes imperceptible to the human eye but deceptive to algorithms.
• Model poisoning: when cloaked images are used for training, the model learns a distorted representation of your face.
• Protection mechanism: later attempts to identify you from un-cloaked photos then fail.

In tests, protection success against face-recognition APIs reached up to 100% (e.g. Microsoft Azure Face, Face++) with a robust cloak — though results varied (Amazon Rekognition was only 34% with a normal cloak).

Tip: Cloaking is a poisoning defence, not a masking one — it works best if your cloaked images are what the adversary scrapes for training. Try it at sandlab.cs.uchicago.edu/fawkes.

Go deeper:

• Fawkes — SANDLab (GitHub) — how adversarial cloaking perturbation poisons recognition models.