Research map / Image generation / Editing and style transfer
SlerpFace: Face Template Protection via Spherical Linear Interpolation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SlerpFace, a transform-based face template protection method that rotates templates toward random key templates via spherical linear interpolation, plus learnable feature grouping and dropout, defending against diffusion-based inversion attacks.
Problem
Face template protection is vulnerable to diffusion-model inversion attacks that synthesize high-quality, identity-preserving face images from protected or unprotected templates, as well as to reconstruction, score-based attacks, and secret exposure in transform-based methods.
Approach
Rotate each template on its hypersphere toward a sample-wise random noise key via slerp, which degrades diffusion-model identity inversion while preserving relative angular margins; split templates into groups with learnable grouping and dropout to resist inversion of the rotation without the key.
Key results
- SlerpFace achieves 99.42 LFW, 95.70 AgeDB, 92.25 IJB-C accuracy/TPR, outperforming PolyProtect on most datasets while trailing it on CFP-FP and CPLFW.
- Under inversion attack, SlerpFace reduces SRRA to 0.10% versus 98.83% for unprotected templates and 73.83% for PolyProtect.
- SlerpFace matching takes 0.17 ms per template and enrollment 0.35 ms, versus 1.88 ms and 1.86 ms for PolyProtect.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| protect templates with SlerpFace rather than leaving them unprotected | IR-50 face templates · LFW inversion attack | Sim: 0.46 -> 0.05 | Helped |
| protect templates with SlerpFace rather than leaving them unprotected | IR-50 face templates · LFW inversion attack | SRRA: 98.83% -> 0.10% | Helped |
| protect templates with SlerpFace rather than leaving them unprotected | IR-50 face templates · LFW score-based attack | Sim: 0.16 -> 0.05 | Helped |
| protect templates with SlerpFace rather than leaving them unprotected | IR-50 face templates · LFW reconstruction attack | SRRA: 6.50% -> 0.43% | Helped |
| add learnable feature grouping and weighted dropout (ablation) | SlerpFace · CFP-FP | accuracy: 87.13 -> 92.79 | Helped |
| add learnable feature grouping and weighted dropout (ablation) | SlerpFace · AgeDB | accuracy: 90.73 -> 95.70 | Helped |
| add weighted dropout (ablation) | SlerpFace with learnable feature grouping · CFP-FP | accuracy: 92.56 -> 92.79 | Helped |
| add weighted dropout (ablation) | SlerpFace with learnable feature grouping · AgeDB | accuracy: 93.67 -> 95.70 | Helped |
Surprising findings
- Replacing authentic templates with random Gaussian noise as diffusion context makes identity inversion inconsistent, which motivates the defense.
- Feature grouping alone causes a substantial accuracy drop (e.g., CFP-FP from 98.00 to 87.13 without learnable grouping), recovered largely by learnable grouping.
Limitations
- Feature grouping reduces recognition accuracy on pose-variation datasets such as CFP-FP and CPLFW relative to PolyProtect.
- Security relies partly on secret keys; exposure of keys with dropout is only analyzed by simulated Newton-Raphson attacks and a theoretical entropy framework.
Experimental setup
Datasets: MS1Mv2 LFW CFP-FP AgeDB CPLFW CALFW IJB-B IJB-C
Benchmarks: LFW CFP-FP AgeDB CPLFW CALFW IJB-B IJB-C
Metrics: accuracy TPR@FPR=1e-4 enrollment time matching time Sim SRRA SSWL entropy
Baselines: ArcFace Boddeti IronMask ASE MLP-Hash PolyProtect
Builds on: ArcFace IDiff-Face IronMask PolyProtect MLP-Hash
Closest papers by meaning
- Enhancing Facial Privacy Protection via Weakening Diffusion Purification (CVPR 2025 · similarity 0.85)
- DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection (CVPR 2024 · similarity 0.84)
- Privacy-Preserving Face Recognition Using Trainable Feature Subtraction (CVPR 2024 · similarity 0.83)
- $\text{ID}^3$: Identity-Preserving-yet-Diversified Diffusion Models for Synthetic Face Recognition (NeurIPS 2024 · similarity 0.83)
- Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition (NeurIPS 2026 · similarity 0.83)
- Non-Adaptive Adversarial Face Generation (NeurIPS 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.