Live · browser · on-device

blindspot

Drop in your face and pick a target who looks nothing like you. blindspot finds a tiny, near-invisible change to your pixels that makes a real face recognizer certain you’re the target. You still see yourself, the model is now sure you’re someone else. Scrub the strength slider and watch its distance to the target fall past the “same person” match line while its distance to the real you climbs away. Everything runs in the tab; the photo never leaves your device.

Try it

Why it exists

It is the direct sibling of faceprint. faceprint makes “a recognition embedding isn’t anonymous” playable; blindspot makes the next unsettling fact playable: that the same recognizer can be steered to a chosen identity by a change you cannot see. Modern face recognition is brittle in ways invisible to humans: a confident match is not the proof of identity it looks like. The point lands hardest on your own face, turned into a stranger who looks nothing like you, with noise you’d never notice.

How it works

Face recognition doesn’t sort people into named buckets. It embeds a face into a vector and compares distances. Two photos are “the same person” when their vectors land within a threshold of each other. The recognizer here is the well-known dlib / face-api ResNet embedder; its same-person line sits at a distance of 0.60. Your photo is detected and aligned with a TinyFaceDetector and a 68-point landmark model, then embedded.

So fooling it is not flipping a label. It is an impersonation attack on the embedding. Starting from your aligned face, the page runs projected gradient descent: a few dozen steps that each nudge your pixels in the direction that moves your face vector toward the target’s vector, while a tight bound keeps every pixel within a few values of the original. The result lands almost exactly on the target’s embedding, so the recognizer reports a confident match, yet to your eye nothing changed. A third panel amplifies the change so you can see the faint pattern that does all the work.

The slider scrubs that same perturbation from 0% to full. The left meter (distance to the target) dives under the 0.60 line while the right meter (distance to the real you) lifts above it: in a few hundredths of a unit of invisible noise, you stop being you and become a stranger. The gradient attack needs a runtime that exposes gradients, so this page runs on TensorFlow.js rather than the ONNX runtime the other on-device pages use. The targets are AI-generated faces of people who don’t exist, so no real person’s data is ever involved, and no photo, embedding, or pixel is uploaded. Reload and it is gone.

Open blindspot