{"id":"f86662b5-a018-40a7-b320-cd9ff0c537a5","arxiv_id":"2411.18165","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A KAN-based mapping network can translate embeddings from privacy-preserving face recognition systems into the input space of a face diffusion model, enabling face reconstruction attacks with high attack success rates.","lead":"This paper shows that face images can be reconstructed from the numeric face 'templates' produced by privacy-preserving face recognition systems, using a learned mapping into a pre-trained face-generating diffusion model. It matters because it tests whether supposedly privacy-protected face embeddings still leak enough identity information to recreate recognizable faces.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Main ASR claim may only hold for training identities; no ASR is reported on identity-disjoint test sets, and Figure 4 suggests poor generalization to unseen identities.","rationale":"The attack scenario is an adversary holding an embedding from an arbitrary victim, so generalization to identities not seen in FEM training is essential. The paper's headline ASR in Table 1 is reported on 'CelebA-HQ dataset' without specifying identity-disjoint splitting, and the only explicit out-of-distribution evaluation (Synth-500) reports image-quality metrics but no ASR. Figure 4 indicates that on Synth-500 many generated faces have low cosine similarity, suggesting ASR would be substantially lower than the 67.6% headline. The reader's identified weakness (protected embedding transfer) is acknowledged in §5.4 and is a secondary overclaim, not the core of the attack claim. The concrete test is straightforward and would settle whether the mapping actually transfers to unseen identities. The reader's verdict of CONDITIONAL remains appropriate, pending this evidence.","tokens_in":13765,"tokens_out":6823,"duration_ms":57814,"concrete_test":"Train FEM-KAN and FEM-MLP on the CelebA-HQ generated set (5000 images, 1000 identities). Construct a held-out identity set from CelebA-HQ (e.g., the remaining identities, or Synth-500) ensuring no identity overlap with training. Extract target-model embeddings from real images of these held-out identities, apply the trained FEM, generate faces with IPA-FaceID, and compute ASR against FaceNet, VGG-Face, GhostFaceNet, and ArcFace using the same FAR=0.01 protocol as §4.3. Also state explicitly whether the Table 1 evaluation used identities overlapping with training. If average ASR on held-out identities is substantially lower than the reported 67.6% (e.g., below 30%), the central generalization claim is unsupported and the headline should be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim of high attack success rates (up to 67.6% average in Table 1) rests on an implicit split that is never stated: whether the CelebA-HQ identities used to evaluate ASR in §5.1/Table 1 are disjoint from the identities used to generate the 5,000 training images in §4.1. The training set is described as '5000 images ... based on the subset of CelebA-HQ' with five images per identity; Table 1 is described only as 'on CelebA-HQ dataset'. If the evaluation identities overlap with training identities, the FEM can memorize per-identity embedding pairs, inflating ASR. Crucially, the paper never reports ASR on the out-of-distribution Synth-500 identities: Table 3 only reports image-quality metrics (FID, PSNR, SSIM, LPIPS, MMD), and Figure 4 shows that on Synth-500 the majority of generated samples have cosine similarity around 0.1, which likely corresponds to failed verification. The claimed generalization of the mapping to unseen identities is therefore the load-bearing assumption for the attack scenario, and it is unsupported by any ASR measurement on identities disjoint from training. This is distinct from the acknowledged PolyProtect failure, which is reported honestly in §5.4. The overclaim on protected embeddings in the introduction is secondary; the more serious issue is that the headline ASR may not transfer to the realistic attack setting.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Face Embedding Mapping (FEM), a learned embedding-to-embedding transformation in two variants (FEM-KAN and FEM-MLP), trained on paired embeddings from a target face recognition or privacy-preserving face recognition (PPFR) model and the default IPA-FaceID embedding space, so that a pre-trained IPA-FaceID diffusion model can reconstruct face images from target-model embeddings. Experiments report attack success rates (ASR) against four black-box verifiers on CelebA-HQ, image-quality metrics on the Synth-500 out-of-distribution set, robustness to partial and protected embeddings (PolyProtect, MLP-Hash), and demographic bias on RFW. The headline result is that FEM raises ASR from single-digit baselines to roughly 55-68% on CelebA-HQ, with FEM-KAN generally outperforming FEM-MLP.","tokens_in":14037,"tokens_out":3820,"duration_ms":33763,"significance":"If the generalization claims hold, this is a practically relevant demonstration of template inversion against modern PPFR systems, and it is apparently the first application of KAN to embedding-to-face inversion. The paper's strengths include a clear problem formulation, evaluations across multiple target models and verifiers, a partial-leakage study, an honest negative result for PolyProtect, and a candid discussion of the limits of generic image-quality metrics. However, the current experimental design does not establish that the FEM's success transfers to identities unseen during training, which is the core property needed for a realistic attack scenario. The lack of identity-disjoint ASR results and the absence of comparisons with prior inversion methods leave the central claims only partially supported.","major_comments":[{"comment":"The CelebA-HQ ASR experiments do not state whether the evaluation identities are disjoint from the 1,000 identities used to build the 5,000-image training set. If Table 1 uses the same identities, the FEM could memorize per-identity embedding pairs, and the reported ASR would not reflect a realistic attack on unseen identities. Please specify the evaluation split explicitly and report ASR on an identity-disjoint CelebA-HQ split.","section":"§4.1, §5.1, Table 1"},{"comment":"For the out-of-distribution Synth-500 set, only image-quality metrics (FID, PSNR, SSIM, MMD, LPIPS) are reported, and Figure 4 shows that most FEM-mapped samples have cosine similarity around 0.1, which is below a typical verification threshold. Without an ASR measurement on Synth-500 at the same FAR=0.01 used elsewhere, the claim of generalization to never-before-seen identities is unsupported; please add identity-disjoint ASR results.","section":"§5.2, Table 3, Figure 4"},{"comment":"The joint-loss weights are described as empirically chosen to yield the best ASR, but the paper does not state whether this selection was made on a validation split disjoint from the CelebA-HQ evaluation set, and no variance over random seeds or model initializations is reported. Please specify the tuning protocol and add multiple-seed results or error bars to support the comparative claims between FEM-MLP and FEM-KAN.","section":"§3.3, §5.5, Table 6"},{"comment":"The paper reports only a 'None' baseline and its own FEM variants; it does not compare against existing face reconstruction methods (e.g., Shahreza et al. 2022a; Otroshi Shahreza & Marcel 2024) under the same target-model and verifier settings. As a result, the claimed advantage of the diffusion-based pipeline over prior inversion methods is not established; please add comparisons to these prior approaches on matching protocols.","section":"§5.1, Table 1"},{"comment":"The abstract and contribution list state that FEMs can reconstruct faces from protected embeddings, but the PolyProtect results in Table 5 show ASR of 5.0-15.6%, close to the baseline. Please restrict the claim to the successful MLP-Hash case or explicitly qualify the scope of the protected-embedding claim.","section":"Abstract, §1, §5.4, Table 5"}],"minor_comments":[{"comment":"The text says 'MES loss' in Equation (2) but should be 'MSE loss'.","section":"§3.3"},{"comment":"The text says 'PEM-MLP' where 'FEM-MLP' is intended; the same typo appears in Table 2 and in §5.4 as 'FMEs'.","section":"§4.1"},{"comment":"The hidden-layer structure is specified for FEM-MLP but not for FEM-KAN (e.g., grid size, spline order, number of layers); please provide these details for reproducibility.","section":"§4.1"},{"comment":"The target model is called 'IR50' in Table 6 but 'IRSE50' elsewhere; please unify the naming.","section":"§5.5, Table 6"},{"comment":"The figure caption does not specify exactly which embeddings are compared (target-model embedding of the original image vs. embedding of the reconstructed image) or the histogram binning; please clarify.","section":"§5.2, Figure 4"}],"recommendation":"major_revision","confidential_remarks":"The main unresolved risk is the implicit identity overlap between training and evaluation on CelebA-HQ. If the evaluation identities are indeed the same as the training identities, the headline ASR numbers would not support the attack claim. A revision that reports identity-disjoint ASR on both CelebA-HQ and Synth-500 would resolve this. Also consider requiring comparisons to prior inversion methods, since the claimed first demonstration against PPFR models needs that context to be properly assessed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, what to know: this is a reasonable empirical paper that combines a KAN/MLP mapping network with the pre-trained IPA-FaceID diffusion model to invert face embeddings from normal and privacy-preserving face recognition models. The experiments are broad: partial embeddings, PolyProtect/MLP-Hash protected embeddings, and racial bias. The writing is clear and the authors are honest about the PolyProtect failure, which is a point in their favor.\n\nWhat's new: using KAN as the mapping network is a minor extension, not a conceptual jump. The real novelty is targeting PPFR models (DCTDP, HFCF, PartialFace) with this embedding-to-embedding mapping. That is a legitimate application. The MLP baseline is fair, and the ablation on loss functions is useful.\n\nWhere it gets soft: the stress-test concern is real. The training set is 5000 images generated from a subset of CelebA-HQ, five images per identity. Table 1 reports ASR \"on CelebA-HQ\" but never states that the evaluation identities are disjoint from training. If they overlap, the FEM can memorize per-identity pairs, and the 60-67% ASR numbers are inflated. The paper evaluates Synth-500, which has never-before-seen identities, but only reports image quality metrics there, not ASR. Figure 4 shows the cosine similarity distribution on Synth-500, and most samples sit around 0.1, which is consistent with failed verification. So the central attack scenario—an adversary reconstructs an arbitrary new victim's face—is not actually demonstrated. That is the load-bearing claim, and it is unsupported.\n\nOther issues are secondary: no error bars, no comparison against the prior GAN-based inversion of Otroshi Shahreza & Marcel, and the loss weights are tuned on the evaluation dataset. No code release either.\n\nWho this is for: people working on template inversion or PPFR robustness. It is a useful cautionary data point if the identity-disjoint evaluation holds up, but right now the evidence for practical transfer is missing.\n\nRecommendation: send it to peer review, but require a clear identity-disjoint split for the ASR tables and an ASR number on Synth-500. If the ASR collapses on unseen identities, the paper's significance drops to a modest within-field observation.","headline":"The paper shows a plausible embedding-mapping attack against PPFR models, but the headline ASR numbers may not survive an identity-disjoint split, and the paper never reports ASR on unseen identities.","tokens_in":14568,"tokens_out":2340,"would_cite":false,"duration_ms":20038,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A KAN-based mapping reconstructs faces from privacy-preserving embeddings","keywords":["face reconstruction","privacy-preserving face recognition","embedding inversion","Kolmogorov-Arnold Network","diffusion model","face template protection","attack success rate","partial embedding leakage"],"falsifier":"Train FEM-KAN on paired embeddings from real-world face datasets rather than synthetic Arc2Face-generated identities, then evaluate attack success on an unseen real-world identity set; if the average attack success rate falls to the roughly 5% no-mapping baseline, the transferability claim is falsified.","tokens_in":13550,"feed_emoji":"👤","tokens_out":12777,"duration_ms":92059,"temperature":0.7,"pith_summary":"Face embeddings are compact identity templates, but this paper shows they can be mapped back into recognizable face images. The authors train Face Embedding Mapping (FEM) models, an MLP variant and a Kolmogorov-Arnold Network variant (FEM-KAN), to translate embeddings from standard face recognition and privacy-preserving face recognition (PPFR) models into the embedding space of a pre-trained IPA-FaceID diffusion generator. On black-box verification, the best mapping lifts attack success from a roughly 5% baseline to 67.6% average for the DCTDP PPFR model, and it also works from partially leaked and MLP-Hash-protected embeddings. The paper positions this as the first inversion of PPFR embeddings into realistic faces, exposing a privacy gap in systems meant to protect face templates.","feed_headline":"KAN face-embedding mapping hits 67.6% attack success","feed_subtitle":"A learned mapping plus diffusion turns leaked face templates from privacy-preserving systems into realistic images","key_machinery":"The load-bearing object is the Face Embedding Mapping (FEM) model, and in particular FEM-KAN, a Kolmogorov-Arnold Network that replaces fixed activation functions with learnable univariate functions on the edges so it can fit the non-linear distribution shift between the target model's embedding space and the default FR embedding space used by IPA-FaceID. FEM is trained on paired embeddings $\\mathbf{e}_i$ from the default FR model and $\\mathbf{e}'_i$ from the target model, extracted from the same images, using a joint loss of mean-square error, pairwise Euclidean distance, and cosine embedding distance. At inference, the trained FEM maps a leaked embedding into the IPA-FaceID embedding domain and the diffusion model turns it into a face image.","core_discovery":"The paper's central claim is that a supervised embedding-to-embedding mapping, learned from paired embeddings of the same identities, transfers across face recognition backbones well enough that a pre-trained IPA-FaceID diffusion model can regenerate realistic, verifiable face images from a target model's embeddings. The FEM-KAN variant, which uses learnable univariate activations at network edges, outperforms the MLP variant on most PPFR targets and is presented as the first method to invert embeddings from privacy-preserving face recognition models, reaching 67.6% average attack success rate against black-box verifiers for DCTDP. The mapping also extends to zero-padded partial embeddings and to MLP-Hash-protected embeddings, while PolyProtect-protected embeddings largely resist the attack under the tested parameters.","pith_inferences":["A natural but untested consequence is that reconstruction fidelity is capped by the pre-trained IPA-FaceID generator's own demographic biases; the paper's lower success on African identities and on male faces likely reflects generator bias, so debiasing the generator would be needed to make reconstruction fair.","The PolyProtect failure suggests a concrete design rule for template protection: schemes that non-linearly expand the value range with user-specific parameters resist this mapping better than schemes that preserve the embedding's original scale.","The MLP-Hash result with a fixed seed implies that seed secrecy is the real protection; if the seed is shared or leaks, binarized embeddings are about as invertible as plain ones.","The paper trains on synthetic faces, so a natural extension is to measure how the mapping degrades on real faces with pose, lighting, and aging variation, which the current Synth-500 test does not fully capture."],"forward_implications":["For each tested FR and PPFR model, a leaked 512-dimensional embedding can be turned into realistic faces that black-box verifiers accept at rates roughly an order of magnitude above the no-mapping baseline.","Zero-padding a partial embedding down to 10% of its values still permits reconstruction, so splitting embeddings across servers does not in itself prevent identity leakage.","MLP-Hash-protected embeddings remain vulnerable under the tested fixed-seed setting, with FEM-KAN reaching 71.6% attack success on ArcFace.","PolyProtect with the tested parameters resists the mapping, with attack success staying near the no-mapping baseline.","FEM-KAN's advantage over FEM-MLP is largest on PPFR targets, indicating learnable univariate activations fit the larger distribution shift introduced by privacy-preserving transforms."],"supporting_citations":[{"why":"Supplies the pre-trained IPA-FaceID diffusion generator into whose embedding space the FEM maps.","marker":"(Ye et al., 2023)"},{"why":"Introduces Kolmogorov-Arnold Networks, the architecture behind the FEM-KAN variant.","marker":"(Liu et al., 2024)"},{"why":"Arc2Face model used to generate the synthetic training faces for FEM.","marker":"(Papantoniou et al., 2024)"},{"why":"Defines the DCTDP PPFR target model on which FEM-KAN achieves its highest attack success.","marker":"(Ji et al., 2022)"},{"why":"Defines the PartialFace PPFR model and the partial-frequency-channel leakage scenario.","marker":"(Mi et al., 2023)"},{"why":"Defines the HFCF PPFR target used in the protected-embedding and bias experiments.","marker":"(Han et al., 2024b)"},{"why":"Defines PolyProtect, the template-protection scheme that resists the proposed mapping.","marker":"(Hahn & Marcel, 2022)"},{"why":"Defines MLP-Hash, the protection scheme that remains vulnerable to FEM mapping.","marker":"(Shahreza et al., 2023)"},{"why":"ArcFace, used both as a target face recognition model and as a black-box verifier.","marker":"(Deng et al., 2019)"}],"fun_headline_variants":["KAN see your face: first attack on privacy-preserving recognition","KAN flips face embeddings back into recognizable images","KAN model recovers faces from secure embeddings at 67.6% rate","First KAN embedding-to-face attack beats MLP on PPFR"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The FEM is trained on paired embeddings extracted from synthetic faces generated by Arc2Face, and the paper assumes this supervised mapping transfers to real-world identities and to zero-padded partial or protected embeddings without adaptation.","fun_headline_variants_meta":{"raw":{"variants":["KAN see your face: first attack on privacy-preserving recognition","KAN flips face embeddings back into recognizable images","KAN model recovers faces from secure embeddings at 67.6% rate","First KAN embedding-to-face attack beats MLP on PPFR"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00023,"raw_usage":{"total_tokens":1470,"prompt_tokens":922,"completion_tokens":548,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":538,"completion_tokens_details":{"reasoning_tokens":473}},"tokens_in":538,"tokens_out":548,"duration_ms":5212,"temperature":1.0,"reasoning_tokens":473,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T11:27:19.239503+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train FEM-KAN on paired embeddings from real-world face datasets rather than synthetic Arc2Face-generated identities, then evaluate attack success on an unseen real-world identity set; if the average attack success rate falls to the roughly 5% no-mapping baseline, the transferability claim is falsified.","supporting_citations":[],"review_version":1}