Research map / Federated learning and privacy / Privacy attacks and secure learning
Validating Privacy-Preserving Face Recognition under a Minimum Assumption
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Map2V, a query-efficient, training-free privacy validation method that reconstructs faces from PPFR similarity scores via StyleGAN2 prior space, rank-and-ensemble initialization, and zeroth-order gradient estimation under a minimal (1k1c) threat model.
Problem
Existing privacy validation methods for privacy-preserving face recognition (PPFR) rely on unrealistic assumptions (white/black-box access, collectible protected data, unlimited queries, training a reconstruction network), so their true protection level is unclear.
Approach
Frame face privacy inference as a black-box zeroth-order optimization over StyleGAN2 latent codes, initialized from a prior space built by encoding public face images and a rank-and-ensemble of top-k latent codes, requiring only similarity-score queries and no attack-model training.
Key results
- Map2V reaches PSI of about 97.5% on DuetFace (LFW, 6900 queries) versus the 2k2c native validation's 96.5% with about 1 million queries, and 96.4% on DCTDP vs 79.6%.
- Human observers recognized the reconstructed face as the target with a subjective privacy score of 93.97% on a 100-observer quiz.
- Ablation shows PSC raises same-system PSI to 97.55 and REI raises different-system PSI to 84.57 when both are combined (84.89).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Map2V instead of native 2k2c validation | DuetFace privacy validation on LFW · LFW | privacy score (%): 96.52 -> 97.46; ∼1 million -> 6900 queries | Helped |
| Use Map2V instead of native 2k2c validation | DCTDP privacy validation on LFW · LFW | privacy score (%): 79.60 -> 96.43; ∼1 million -> 6900 queries | Helped |
| Use Map2V instead of native 2k2c validation | PartialFace privacy validation on LFW · LFW | privacy score (%): 65.35 -> 98.90; ∼1 million -> 6900 queries | Helped |
| Increase prior-space modes from n=500 to n=1000 | Map2V on LFW · LFW | privacy score (%): 97.46 -> 97.53; 6900 -> 7400 | Helped |
| Add PSC (ablation) | Map2V on DuetFace, same-system evaluation · LFW | PSI: 97.34 -> 97.55 | Helped |
| Add PSC (ablation) | Map2V on DuetFace, different-system evaluation · LFW | PSI: 79.82 -> 75.72 | Hurt |
| Add REI to Map2V with PSC (ablation) | Map2V on DuetFace, same-system evaluation · LFW | PSI: 97.55 -> 97.46 | No clear effect |
| Add REI to Map2V with PSC (ablation) | Map2V on DuetFace, different-system evaluation · LFW | PSI: 75.72 -> 84.89 | Helped |
| Add PSC to Map2V with REI (ablation) | Map2V on DuetFace, same-system evaluation · LFW | PSI: 97.38 -> 97.46 | No clear effect |
| Add PSC to Map2V with REI (ablation) | Map2V on DuetFace, different-system evaluation · LFW | PSI: 84.57 -> 84.89 | Helped |
Surprising findings
- Map2V with about 6900 queries achieves privacy scores comparable to or higher than 2k2c attacks that use around 1 million queries, suggesting prior claims of PPFR privacy are overstated.
Limitations
- Reconstruction quality depends on the StyleGAN prior and gender-bias appears when target image quality is poor.
- Generalizability across systems degrades when PSC is used alone; REI is needed to recover it.
Experimental setup
Datasets: LFW CelebA FairFace
Benchmarks: LFW CelebA
Metrics: privacy score PSI privacy score PSII attribute matching rate subjective privacy score subjective recognition rate query count
Baselines: DuetFace 2k2c reconstruction DCTDP 2k2c reconstruction PartialFace 2k2c reconstruction
Builds on: StyleGAN2 Tov et al. encoder for StyleGAN inversion zeroth-order gradient estimation Wasserstein distance
Closest papers by meaning
- Privacy-Preserving Face Recognition Using Trainable Feature Subtraction (CVPR 2024 · similarity 0.87)
- Privacy-Preserving Optics for Enhancing Protection in Face De-Identification (CVPR 2024 · similarity 0.86)
- How Private is Private? A Comparative Study for Face De-Identification (NeurIPS 2026 · similarity 0.86)
- MultiPriv: Benchmarking Individual-Level Privacy Reasoning in Vision-Language Models (ICML 2026 · similarity 0.86)
- Disguise without Disruption: Utility-Preserving Face De-identification (AAAI 2024 · similarity 0.86)
- CryptoFace: End-to-End Encrypted Face Recognition (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.