  Few-shot-based facial recognition systems have gained increasing attention
due to their scalability and ability to work with a few face images during the
model deployment phase. However, the power of facial recognition systems
enables entities with moderate resources to canvas the Internet and build
well-performed facial recognition models without people's awareness and
consent. To prevent the face images from being misused, one straightforward
approach is to modify the raw face images before sharing them, which inevitably
destroys the semantic information, increases the difficulty of retroactivity,
and is still prone to adaptive attacks. Therefore, an auditing method that does
not interfere with the facial recognition model's utility and cannot be quickly
bypassed is urgently needed.
  In this paper, we formulate the auditing process as a user-level membership
inference problem and propose a complete toolkit FACE-AUDITOR that can
carefully choose the probing set to query the few-shot-based facial recognition
model and determine whether any of a user's face images is used in training the
model. We further propose to use the similarity scores between the original
face images as reference information to improve the auditing performance.
Extensive experiments on multiple real-world face image datasets show that
FACE-AUDITOR can achieve auditing accuracy of up to $99\%$. Finally, we show
that FACE-AUDITOR is robust in the presence of several perturbation mechanisms
to the training images or the target models. The source code of our experiments
can be found at \url{https://github.com/MinChen00/Face-Auditor}.
