Research map / Architectures and efficiency / CNN design
CryptoFace: End-to-End Encrypted Face Recognition
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CryptoFace, an end-to-end fully homomorphic encryption face recognition system using a mixture of shallow patch CNNs (CryptoFaceNet) evaluated in parallel under FHE.
Problem
Face recognition on encrypted data is slow under FHE and prior secure FR only encrypts features (with client-side extraction), leaving raw images and the server's database exposed to attacks; high-resolution encrypted CNN inference is also prohibitively deep.
Approach
Split face images into patches processed by a mixture of shallow patch CNNs whose outputs are summed under FHE, reducing multiplicative depth to one bootstrapping per PCNN and keeping latency near resolution-independent; plus a distribution-aware low-degree polynomial approximation of the inverse square root for encrypted L2 normalization so cosine similarity can be computed under FHE.
Key results
- CryptoFaceNet4 at 64x64 reaches 89.42% average verification accuracy in 1,364 s online latency versus 9,845 s for MPCNN ResNet44 (89.64%), a 7.2x speedup with a 0.22% accuracy drop.
- CryptoFaceNet16 at 128x128 reaches 91.46% average accuracy at 1,446 s latency, nearly constant across resolutions.
- Compared to AutoFHE transferred to face recognition (82.69% avg, 4,001 s), CryptoFace improves accuracy by up to 8.8% (per abstract, +6.73% at 64x64 in text) and speeds up inference by 2.9x.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace MPCNN ResNet32 with CryptoFaceNet4 | Encrypted face verification · Average across LFW, AgeDB, CALFW, CPLFW, CFP-FP (64×64) | verification accuracy: 85.60 -> 89.42 (+3.82%) | Helped |
| Replace MPCNN ResNet44 with CryptoFaceNet4 | Encrypted face verification · Average across LFW, AgeDB, CALFW, CPLFW, CFP-FP (64×64) | verification accuracy: 89.64 -> 89.42 (-0.22%) | Hurt |
| Replace AutoFHE ResNet32 with CryptoFaceNet4 | Encrypted face verification · Average across LFW, AgeDB, CALFW, CPLFW, CFP-FP (64×64) | verification accuracy: +6.73% | Helped |
| Increase resolution from 64×64 to 96×96 using CryptoFaceNet9 | CryptoFace · Average across five standard verification datasets | verification accuracy: +1.57% | Helped |
| Increase resolution from 64×64 to 128×128 using CryptoFaceNet16 | CryptoFace · Average across five standard verification datasets | verification accuracy: +2.04% | Helped |
| Use CryptoFaceNet4 instead of MPCNN ResNet44 | Encrypted face verification · 64×64 | online latency: 7.2× | Helped |
| Use higher-resolution CryptoFaceNet9 or CryptoFaceNet16 instead of CryptoFaceNet4 | CryptoFace · 64×64 to 96×96 or 128×128 encrypted faces | online latency: 1,364 to 1,446 seconds | No clear effect |
Surprising findings
- Bootstrapping dominates MPCNN latency (about 68-70%), but CryptoFace reduces it to about 10% by using only one bootstrapping per patch CNN.
Limitations
- Semi-honest threat model only; security assumptions limited to two semi-honest parties.
- Evaluation on IJB-B/IJB-C uses only 1,200 randomly sampled pairs due to computational cost.
- AutoFHE was adapted by transferring a CIFAR search result to WebFace, which may not reflect its best possible performance.
Experimental setup
Datasets: WebFace4M
Benchmarks: LFW AgeDB CALFW CPLFW CFP-FP IJB-B IJB-C
Metrics: verification accuracy latency RAM footprint AUC Rank-1 accuracy Rank-5 accuracy
Baselines: MPCNN AutoFHE
Builds on: MPCNN AESPA AutoFHE AdaFace ArcFace
Closest papers by meaning
- How Private is Private? A Comparative Study for Face De-Identification (NeurIPS 2026 · similarity 0.85)
- FaceRSA: RSA-Aware Facial Identity Cryptography Framework (AAAI 2024 · similarity 0.85)
- Validating Privacy-Preserving Face Recognition under a Minimum Assumption (CVPR 2024 · similarity 0.85)
- FSFM: A Generalizable Face Security Foundation Model via Self-Supervised Facial Representation Learning (CVPR 2025 · similarity 0.84)
- Privacy-Preserving Face Recognition Using Trainable Feature Subtraction (CVPR 2024 · similarity 0.83)
- DCT-CryptoNets: Scaling Private Inference in the Frequency Domain (ICLR 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.