Research map / Federated learning and privacy / Privacy attacks and secure learning
Privacy-Preserving Face Recognition Using Trainable Feature Subtraction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MinusFace, a privacy-preserving face recognition method that creates a protective face image by subtracting a trained autoencoder regeneration from the original in a high-dimensional DCT space, then randomly shuffling channels.
Problem
Face images sent to online face recognition services can be viewed or recovered by third parties; existing transform-based PPFR methods trade off recognition accuracy against resistance to recovery attacks.
Approach
Imitate image compression: the residue between an original face and its learned regeneration is visually uninformative, so co-train a recognizer on a high-dimensional (DCT) residue that keeps identity features, then random channel shuffling yields a privacy-preserving spatial image with randomized textures.
Key results
- MinusFace reaches 96.92 on CFP-FP, 91.90 on AgeDB and 94.70 on IJB-C, within about 2% of the unprotected ArcFace baseline and on par with frequency-based SOTAs.
- Under a recovery attack, MinusFace obtains the lowest SSIM (0.50) and PSNR (10.98) among compared methods, versus 0.59-0.87 SSIM for SOTAs.
- MinusFace's protective image is a spatial image requiring about 1x storage, versus 5.3x to 63x for prior high-dimensional protective representations; latency is about 69 ms on a laptop.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use MinusFace instead of DuetFace | Face verification · CFP-FP | accuracy: 97.79 -> 96.92 | Hurt |
| Use MinusFace instead of DuetFace | Face verification · LFW | accuracy: 99.82 -> 99.78 | No clear effect |
| Use MinusFace instead of DuetFace | Face verification · AgeDB | accuracy: 97.93 -> 97.57 | Hurt |
| Use MinusFace instead of DuetFace | Face verification · CPLFW | accuracy: 92.35 -> 91.90 | Hurt |
| Use MinusFace instead of DuetFace | Face verification · CALFW | accuracy: 96.10 -> 95.90 | Hurt |
| Use MinusFace instead of PPFR-FD | Face identification · IJB-B | TPR@FPR(1e-4): 92.93 -> 93.37 | Helped |
| Use MinusFace instead of DuetFace | Face identification · IJB-C | TPR@FPR(1e-4): 95.30 -> 94.70 | Hurt |
| Add high-dimensional residue r as the recognition model input instead of decoded spatial residue R′ (ablation) | MinusFace · CFP-FP | accuracy: 53.85 -> 98.27 | Helped |
| Add high-dimensional residue r as the recognition model input instead of decoded spatial residue R′ (ablation) | MinusFace · AgeDB | accuracy: 54.71 -> 97.82 | Helped |
| Add high-dimensional residue r as the recognition model input instead of decoded spatial residue R′ (ablation) | MinusFace · CPLFW | accuracy: 51.20 -> 92.73 | Helped |
| Apply random channel shuffling to produce the protective representation | MinusFace · IJB-C recovery attack | SSIM: 0.50 | Helped |
Surprising findings
- Recovery attacks can still reconstruct several frequency-based and adversarial PPFR methods' protective images despite their resistance claims.
- Training the FR model directly on the spatial residue R' yields near-chance accuracy (about 51-55%), confirming that naive feature subtraction removes identity features.
Limitations
- Accuracy trails the unprotected ArcFace baseline by up to about 2%.
- Attack evaluation uses a single U-Net recovery attacker trained on BUPT; stronger attackers are not fully explored.
- Some baselines (PPFR-FD, AdvFace) were reproduced by the authors without official code, so comparisons may be inconsistent.
Experimental setup
Datasets: MS1Mv2 LFW CFP-FP AgeDB CPLFW CALFW IJB-B IJB-C BUPT
Benchmarks: LFW CFP-FP AgeDB CPLFW CALFW IJB-B IJB-C
Metrics: recognition accuracy TPR@FPR=1e-4 SSIM PSNR storage size
Baselines: ArcFace PEEP InstaHide Cloak PPFR-FD DCTDP DuetFace PartialFace ProFace AdvFace
Builds on: ArcFace U-Net JPEG compression DuetFace PartialFace
Closest papers by meaning
- Disguise without Disruption: Utility-Preserving Face De-identification (AAAI 2024 · similarity 0.88)
- Validating Privacy-Preserving Face Recognition under a Minimum Assumption (CVPR 2024 · similarity 0.87)
- Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition (NeurIPS 2026 · similarity 0.86)
- Transferable Facial Privacy Protection against Blind Face Restoration via Domain-Consistent Adversarial Obfuscation (ICML 2024 · similarity 0.86)
- Privacy-Preserving Optics for Enhancing Protection in Face De-Identification (CVPR 2024 · similarity 0.86)
- Enhancing Facial Privacy Protection via Weakening Diffusion Purification (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.