CAREER: Resisting Automated Algorithmic Surveillance with Human-centered Adversarial Machine Learning

该项目研究对抗性机器学习技术，这些技术将抵制面部识别和其他形式的自动推理，即人们在网上分享的图像中的个人身份信息。这种方法包括以人眼很难或不可能检测到的方式修改图像的方法，但这种方式可靠地降低了机器学习分类器的准确性。目前的对抗性机器学习技术确实允许终端用户干扰他们打算在网上分享的图像，但到目前为止，这些技术的开发和评估都是从以技术为中心的角度，而不是以人为中心的角度。目前尚不清楚消费者是否认为开发的技术有用和实用。该项目重新设计了这些技术，以提高消费者的接受度。该项目引入了一种以人为中心的方法来设计和评估对抗性机器学习反监视技术。与承担在线共享图像自动监视特别高风险的人群的倡导组织合作，加强了拟议工作的教育和研究影响。拟议的具体活动涉及创建一套标准化的措施，通过这些措施，以人为中心的对抗性机器学习的开发人员要求人类评估者评估受干扰图像的质量和可接受性。当创建标准化措施时，将创建对抗性机器学习反监视技术的人类质量评估的公共存储库，并以对现有系统的评估为种子。该项目还包括创建一个可区分损失术语，该术语捕捉到反面扰动图像的美学质量。可区分损失术语可用于帮助生成人类用户认为高质量的对抗性例子。对至少一个流行的机器学习库的这个新的损失术语的开源实现将使其他研究人员更容易使用并在此工作的基础上创建针对自动监控的以人类为中心的新型对抗性攻击。该项目还涉及使用联合设计过程来开发一种新的、新颖的以人类为中心的对抗性机器学习应用程序，该应用程序将允许最终用户以一种既美观又有助于避免面部识别和其他形式的个人身份信息自动推理的方式来润色他们选择在网上分享的图像。拟议的工作还包括向公众开放的网络研讨会和视频讲座等教育活动，并与针对自动化监控风险较高的人群的倡导组织协调组织，以提高公众素养和如何保护在线共享图像免受自动化监控的知识。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This project studies adversarial machine learning technologies that will resist facial recognition and other forms of automated inferencing of personally-identifiable information in images that people share online. This approach includes methods to modify images in a manner that is difficult or impossible to detect with the human eye but that reliably reduce the accuracy of machine learning classifiers. Current adversarial machine learning techniques do allow end-users to perturb images that they intend to share online but these technologies have, to date, been developed and evaluated from a technology-centered perspective, rather than a human-centered perspective. It remains unclear whether consumers find the developed technologies useful and practical. This project re-designs these technologies to improve consumer acceptance. The project introduces a human-centered approach to designing and evaluating adversarial machine learning anti-surveillance technologies. Collaboration with advocacy organizations for populations that bear especially high risks from automated surveillance of images shared online enhance the educational and research impacts of the proposed work.The specific activities proposed involves the creation of a standardized set of measures through which developers of human-centered adversarial machine learning ask human evaluators to assess the quality and acceptability of perturbed images. When a standardized measure is created, a public repository of human quality assessments of adversarial machine learning anti-surveillance technologies will be created and seeded with evaluations of extant systems. The project also involves the creation of a differentiable-loss term that captures the aesthetic quality of adversarially perturbed images. The differentiable-loss term can be used to help generate adversarial examples that human users perceive to be high quality. An open-source implementation of this novel loss term for at least one popular machine learning library will make it easier for other researchers to use and build on this work in the creation of novel human-centered adversarial attacks against automated surveillance. The project also involves the use of co-design processes to develop a new and novel human-centered adversarial machine learning application that will allow end-users to touch-up images they choose to share online in a manner that is both aesthetically pleasing and that helps evade facial recognition and other forms of automated inferencing of personally-identifiable information. The proposed work also entails educational activities such as webinars and video lectures open to the public and organized in concert with advocacy organizations for populations at higher risk of automated surveillance, to improve public literacy and knowledge of how to protect images shared online from automated surveillance.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.