Legal services startup DoNotPay is best known for its “robot attorney”, an automated bot that handles tedious online tasks such as canceling TV subscriptions and requesting refunds from airlines. Now the company has unveiled a new tool that will help protect users’ photos from reverse image search and facial recognition AI.
It’s called Photo Ninja and is one of dozens of DoNotPay widgets that allow subscribers access to $36 per year. Photo Ninja works like any image filter. When you upload a photo you want to protect, the software adds a layer of perturbation at the pixel level that is barely noticeable to humans, but changes the image drastically to the eyes of a moving machine.
In the end, DoNotPay CEO Joshua Browder said The Verge, Images protected with Photo Ninja don’t give any results when run through Google Image Search or a search tool like TinEye. You can verify this in the example below using Joe Biden’s photo.
The tool also tricks popular facial recognition software from Microsoft and Amazon with a 99% success rate. This, combined with the reverse image search function, makes Photo Ninja convenient in a variety of scenarios. For example, you can upload a selfie to social media or a dating app. First I run the image through Photo Ninja and people can’t link this image to other information on the web.
The browser emphasizes, but Photo Ninja does not surpass all facial recognition tools. When it comes to Clearview AI, a controversial facial recognition service widely used by US law enforcement, for example, Browder says the company “expects” Photo Ninja to trick the company’s software, but cannot guarantee it.
Partly because Clearview AI already has user photos in its database that were scraped from public sources a long time ago. Company CEO Hoan Ton- he said in an interview New York Times Last year: “There are billions of unmodified photos on the Internet, all of them on different domain names. It’s actually too late to complete the technology. [that hides you from facial recognition search] Deploy at scale. “
Browder agrees: “In a perfect world, all images released from day one change. It is perceived as an important limitation to the efficiency of pixel-level changes as it is not for most people. So our tool’s focus and intended use case was to avoid detection by Google Reverse Image Search and TinEye. “
DoNotPay wasn’t the first to create this kind of tool. In August 2020, researchers at the University of Chicago’s SAND Lab created an open source program called Fawkes that does the same. In fact, Browder says that DoNotPay’s engineers referenced this work in their own research. However, while Fawkes is a low-profile software that is unlikely to be used by the average internet consumer, DoNotPay has a slightly larger reach, although limited to tech-savvy users whose bots can sue. instead.
Tools like this don’t offer silver bullets against modern privacy breaches, but as face recognition and reverse image retrieval tools become more common, it makes sense to deploy at least some protection. Photo Ninja doesn’t hide you from law enforcement or authoritarian state governments, but it can trick a decent stalker or two.