Anti persona disrupts unauthorized identity recognition in vision language models
Anti-Persona: Disrupting Unauthorized Identity Binding and Recognition in Personalized Vision--Language Models
Computer Vision and Pattern Recognition
Summary
Personalized vision-language AI models can learn to recognize specific people from just a few pictures, which creates privacy risks. The authors created Anti-Persona, a technique that subtly changes images to prevent these models from linking those pictures to a person’s identity. This change is hard to notice and still works even after the images are compressed. Their experiments show this method blocks up to 95% of unauthorized identity detection without ruining the image quality.
What this means in practice
- •For privacy engineers: Protect images from being linked to specific people in personalized vision-language AI systems by applying subtle visual changes.
- •For image service providers: Defend user-uploaded images against unauthorized identity recognition in personalized visual AI services, maintaining image clarity after compression.$Commercial implications: Enables image hosting or social media platforms to offer privacy protection services that block unauthorized AI identity detection.
Authors
Abhishek Basu, Fahad Shamshad, Karthik Nandakumar
Abstract
Few-shot personalization enables large vision--language models (LVLMs) to learn user-specific visual concepts for applications such as personalized retrieval and subject-aware querying. However, it also creates a privacy risk: an adversary can bind a target identity from a few reference images and subsequently detect that identity in new images through natural-language queries. We introduce Anti-Persona, an image-level defense against unauthorized identity binding and recognition in personalized LVLMs. Our key insight is that identity personalization relies on visual features shared across multiple reference images. We aggregate these features into an identity prototype and optimize visually subtle perturbations that disrupt prototype alignment in the vision-encoder space. Spatial smoothing and low-frequency preservation further promote visual fidelity and practical resilience to image compression. The resulting protection does not depend on a specific prompt and supports both proactive anti-personalization and reactive image protection. Experiments on two representative personalized LVLMs demonstrate protection rates of up to $95.0\%$ while preserving visual fidelity. The method remains stable across prompt variations and evaluated identity-query tasks, and improves black-box transfer under encoder mismatch.