Split face recognition reduces client-side computation but exposes intermediate features to feature inversion attacks and unauthorized analysis by honest-but-curious (HBC) servers. Existing privacy-preserving face recognition methods mainly aim to resist unauthorized reconstruction, typically producing features whose inversion yields visibly degraded results, which may reveal the existence of protection and motivate adaptive attacks.
arXiv:2602.02914v4 Announce Type: replace
Abstract: Privacy-preserving face recognition (PPFR) and face anonymization have different goals, but both must retain some identity-related information for...
By Wenqi Guo, Qingyun Qian, Mohamed Shehata, Shan Du
arXiv:2510. 25687v4 Announce Type: replace-cross Abstract: Model inversion attacks pose an open challenge to privacy-sensitive applications that use machine learning (ML) models.
By Mallika Prabhakar, Louise Xu, Prateek Saxena
arXiv:2607. 29144v1 Announce Type: cross Abstract: Synthetic face datasets are increasingly used to reduce privacy exposure and data access constraints in biometric recognition.
By Pawe{\l} Borsukiewicz, Daniele Lunghi, Wendk\^uuni C. Ou\'edraogo, Jacques Klein, Tegawend\'e F. Bissyand\'e
arXiv:2409. 01062v4 Announce Type: replace Abstract: Model Inversion (MI) attacks pose a significant privacy threat by reconstructing private training data from machine learning models.
By Viet-Hung Tran, Ngoc-Bao Nguyen, Son T. Mai, Hans Vandierendonck, Ira Assent, Alex Kot, Ngai-Man Cheung
arXiv:2608.21455v1 Announce Type: new
Abstract: Face presentation attack detection (PAD) is traditionally formulated as a face-specific problem, although many of the visual artifacts introduced by pr...
By Guray Ozgur, Fadi Boutros, Naser Damer
arXiv:2609.27011v1 Announce Type: new
Abstract: Target-oriented face de-identification models aim to anonymize the identity of a target individual across different images or video frames, such that t...
By Felix Rosberg, Vitomir \v{S}truc, Cristofer Englund, Eren Erdal Aksoy, Fernando Alonso-Fernandez
The paper compares four audit methods for assessing identity‑level differential privacy in pre‑trained, black‑box face generators. Each method—GaussMech, KDE‑LR, MMD‑TV, and ROC‑HT—has distinct assumptions, hyperparameters, and finite‑sample limitations, and they produce markedly different epsilon estimates when applied to FaceFusion and InstantID. The study finds that all methods reveal significant identity distinguishability, but none can be reliably ranked in this high‑distinguishability regime, suggesting that future work should evaluate them on partially private mechanisms.
By Arman Zareian Jahromi, Vishnu Bondalakunta, Mohammad Akbar Bin Shah, Naimul Haque, Shuangqing Wei, George T. Amariucai
arXiv:2609.27022v1 Announce Type: new
Abstract: In this paper, we investigate the impact of adversarial attacks on identity encoders within a realistic de-identification framework. Our experiments sh...
By Felix Rosberg, Cristofer Englund, Eren Erdal Aksoy, Fernando Alonso-Fernandez
arXiv:2607. 25926v1 Announce Type: cross Abstract: Face de-identification (De-ID) aims to remove or conceal personally identifiable facial features in images or videos to prevent identity recognition while preserving utility for downstream tasks.
By Hui Wei, Hao Yu, Guoying Zhao
The paper investigates privacy risks in Vision Transformer (ViT) split‑inference systems that use token reduction and token shuffling to lower computation and communication costs. It shows that even after token shuffling, transmitted token embeddings still contain enough positional information for a new attack, the Spatially Aligned Reconstruction Attack (SARA), which predicts token positions, restores spatial layout, fills missing embeddings with a masked autoencoder, and reconstructs the input image. While token reduction offers stronger protection, significant leakage remains when retained tokens preserve semantic and positional cues, and the authors propose a lightweight edge‑side defense that removes positional embeddings and adapts transformer blocks via knowledge distillation to reduce SARA’s effectiveness without harming downstream accuracy.
By Stefano Leggio, Giulio Rossolini, Alessandro Biondi
arXiv:2608. 08521v1 Announce Type: cross Abstract: Face recognition systems face two distinct, commonly-separated failure modes: spoofing, where an impostor presents a photograph or video of an authorized user, and disguise, where a legitimate user is rejected because their appearance differs from their enrolled template due to accessories, facial hair, illumination, or pose.
By Sangiya Pararajasingham