[mel_llaguno]

Would this also apply to LowKey? https://arxiv.org/pdf/2101.07922.pdf

[compressedgas]

I think that all methods that apply a distortion can have a GAN trained to ignore it. Both Fawkes and LowKey are adversarial example generators which can be used to produce training data that forces the model to become more robust.

Once they are incorporated in training of the recognition system's model, their effectiveness as protection disappears.