{"id":"63a7945a-a553-4ba2-9889-53b87fe8ae36","arxiv_id":"2505.12688","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Combining Matryoshka-style compression, CKKS fully homomorphic encryption, and an encrypted-domain PolyProtect hash reduces age, gender, and ethnicity inference from face embeddings to near-random levels while preserving identification accuracy.","lead":"This paper proposes a privacy layer for face embeddings that combines compression, homomorphic encryption, and an irreversible hash, reducing attribute inference while keeping face identification usable. A generalist should read it to see a practical, if slow, recipe for running face recognition on encrypted templates.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Privacy claim is tested only by SVM on ASCII-serialized ciphertexts; that is a pseudorandom surface, so the real protocol-level attack surface (match-score or decryption outputs, CKKS approximate-noise channels) remains unexamined.","rationale":"The reader's weakest assumption points to the ASCII-ciphertext SVM attack surface not being a faithful proxy for a determined attribute-inference adversary. My independent read agrees and sharpens it: under the paper's own threat model, if the CKKS instantiation is semantically secure, the ASCII experiment is guaranteed to yield chance-level results, so it cannot distinguish a real shield from ordinary encryption. The load-bearing condition for the central claim is therefore not 'SVM on serialized ciphertext fails' but 'no attribute information leaks through any channel the protocol exposes.' The most concrete unexamined channel is the decrypted match-score / decision output that a legitimate client sees; approximate-FHE oracle attacks are a second known channel. The paper provides no formal security argument and no parameter-level security estimate, so this is an internal gap between the empirical evidence and the claim, not merely a disagreement with consensus. The concern is addressable: a protocol-level attack experiment plus a parameter/security analysis would either falsify the shield or support it. Because the paper is otherwise a plausible FHE-based identification pipeline with useful utility results, the correct disposition is to keep the reader's CONDITIONAL verdict: accept only after the missing adversarial evaluation and security parameter analysis are supplied.","tokens_in":14972,"tokens_out":10984,"duration_ms":127903,"concrete_test":"Run a protocol-level attribute-inference attack on the actual MRL+FHE+PP identification protocol: the attacker plays a curious client with legitimate decryption access, submits a sequence of chosen probe embeddings (faces with known gender, age, and ethnicity) to the server, and records the decrypted cosine-similarity scores or top-1 identity responses the protocol returns. Use these returned scores as features to classify soft biometrics of the matched gallery templates on the same CelebSet and CFD splits as Table VII. If the AUC 95% confidence interval excludes 0.5, the shield fails against a protocol-level adversary; if the interval includes 0.5, the authors should still replace the ASCII-SVM experiment with this protocol-level evaluation and report HEAAN/CKKS parameter-derived security levels (e.g., via the LWE estimator) to substantiate the cryptographic assumption.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim that MRL+FHE+PP shields embeddings from attribute inference is supported in Section V-E only by training SVMs on the 'ASCII values of the encrypted embeddings' and reporting near-random AUC in Table VII. That experiment cannot bear the weight of the claim: if the HEAAN/CKKS instantiation is IND-CPA secure, raw ciphertext bytes are pseudorandom, so an SVM on those bytes is expected to perform at chance whether or not the method provides real protection. The result is a sanity check, not an adversarial evaluation. The actual attack surface of the protocol is different and unexamined. A curious server has the public key, the evaluation key, the PP parameters, and the encrypted gallery, and can homomorphically evaluate functions on the ciphertexts; a curious client receives decrypted cosine-similarity scores or top-1 identification results, which can be used as a similarity oracle to infer soft biometrics of stored templates. CKKS is an approximate scheme, and oracle-based attacks on approximate FHE (including the paper's own ref. [30]) are known; the paper neither rules these out nor gives a reduction to RLWE with concrete parameters. In addition, Tables V and VII show MRL+FHE and MRL+FHE+PP are numerically almost identical, so the added PP layer is not demonstrated to add any measurable privacy. Because the guarantee is entirely empirical and the only direct experiment attacks a pseudorandom surface, the central claim is unsupported as stated.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a multi-layer protection pipeline for face embeddings: Matryoshka Representation Learning (MRL) compression, Fully Homomorphic Encryption (FHE) using the HEAAN/CKKS scheme, and PolyProtect (PP) hashing applied in the encrypted domain. The central claim is that this pipeline shields latent face representations from soft-biometric attribute inference (age, gender, ethnicity) while preserving face identification accuracy. Experiments on CelebSet and the Chicago Face Database with AdaFace and ArcFace encoders show near-chance attribute classification rates (AUC around 0.5, gender accuracy around 50%, age accuracy as low as 6%) on encrypted embeddings, while Rank-1 identification remains above 96% on CelebSet and above 84% on CFD. The paper also compares against Differential Privacy, template protection schemes, and compression alone, reporting privacy gain and suppression rate metrics.","tokens_in":15261,"tokens_out":3723,"duration_ms":42279,"significance":"If the central claim were fully supported, the proposed pipeline would be a practically relevant contribution to privacy-preserving facial analytics, combining a cryptographic primitive with an irreversible transform while retaining high utility. The paper's strengths include a systematic comparison of several protection techniques on two datasets and two encoders, careful ablation of MRL and PolyProtect parameters, and a concrete FHE implementation with Taylor-series approximation and execution-time measurements. However, the empirical evidence for the main privacy claim is not load-bearing: the attribute-inference experiment is performed on ASCII-serialized ciphertexts, which, under the IND-CPA security of CKKS, are pseudorandom and should defeat any classifier regardless of whether the method provides meaningful protection. The paper therefore does not currently support its headline claim as stated.","major_comments":[{"comment":"The only direct attribute-inference attack on the proposed protection is the SVM trained on the 'ASCII values of the encrypted embeddings.' Under the standard IND-CPA security of the CKKS/HEAAN scheme, raw ciphertext bytes are pseudorandom, so a classifier trained on those bytes is expected to perform at chance whether or not any semantic information remains in the plaintext embedding or in the protocol outputs. The near-chance accuracies and AUCs in Tables V and VII are therefore a sanity check on ciphertext pseudorandomness, not evidence of resistance to attribute-inference attacks. The actual attack surface of the protocol—the server's ability to compute homomorphically on ciphertexts, the approximate-noise behavior of CKKS, and any decrypted outputs such as match scores returned to the client—is not examined. Without a formal reduction to a hardness assumption or an adversarial evaluation that includes at least one of these channels, the central privacy claim is unsupported.","section":"Section V-E and Tables V-VII"},{"comment":"The results for MRL+FHE and MRL+FHE+PP are numerically almost identical throughout Tables V and VII: attribute accuracies differ by at most a few hundredths of a percentage point, and AUCs are identical or within 0.01. Thus the experimental evaluation does not demonstrate that the PolyProtect layer adds any measurable privacy benefit. The paper describes PP as providing a second layer of security in case the FHE secret key leaks, but no experiment or analysis supports this additional layer; the 'dual-layer' claim is not backed by the presented data.","section":"Tables V and VII"},{"comment":"The threat model states that the attacker (the server) possesses the public key and evaluation key and can perform computations on the ciphertexts, but the paper does not analyze what an attacker with these capabilities can learn from the CKKS ciphertext structure or from the approximate-noise distribution. The paper cites Li and Micciancio [30] on the security of approximate homomorphic encryption but does not explain why their attack or similar attacks do not apply to the proposed instantiation. Since the privacy guarantee is claimed to follow from FHE, this is a load-bearing gap: the paper needs either a concrete security argument for the specific HEAAN parameters and operations used, or an explicit statement that the guarantee holds only under the assumption that no such attacks apply.","section":"Section II (Threat Model) and Section III (Prior Work)"}],"minor_comments":[{"comment":"In the AdaFace-CelebSet row for MRL+FHE, the entry '52.226.12' appears to be a typographical error and should be '52.22 6.12'.","section":"Table V"},{"comment":"The DP accuracy values shown in Figure 6(iii) for AdaFace on CelebSet (Age 66.31, Gender 70.87, Ethnicity 85.37) do not match the corresponding values in Table V (48.12, 59.17, 54.66). Please reconcile the figure with the table.","section":"Figure 6"},{"comment":"The name 'Matryoshka' is misspelled as 'Matryoksha' in multiple places (e.g., Table V and Table VI captions).","section":"Section III and captions"},{"comment":"The paragraph on embedding compression contains a duplicated sentence about adaptive bit allocation starting with 'Based on their importance, Zhao et al.'; the second occurrence should be removed.","section":"Section III"},{"comment":"The sentence 'Since gender and ethnicity classification problems are multi-class' is inaccurate for gender, which is binary in both datasets; only ethnicity is multi-class.","section":"Section VI"}],"recommendation":"major_revision","confidential_remarks":"The central empirical claim rests on an attack experiment that is essentially a tautology under the FHE security assumption. The authors should either replace the SVM-on-ASCII experiment with a formal security argument (e.g., a reduction to RLWE for the specific HEAAN operations) and an adversarial evaluation of protocol-level outputs (e.g., match-score oracles), or substantially weaken the paper's claims. The usefulness of the engineering contribution (MRL+FHE+PP, Taylor approximation, timing) is real, but the privacy claim as currently stated is not supported by the reported experiments."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The stress-test note is right on the nose. Kaushik et al. build a genuine end-to-end FHE pipeline for face identification—MRL compression, CKKS encryption, FHE-domain PolyProtect, and a Taylor-approximated cosine similarity over 64-dimensional embeddings—and they report concrete execution times with a 627% speedup from compression. That engineering is real and worth a look if you work on encrypted biometrics.\n\nThe problem is the paper's central claim: that this 'shields' embeddings from attribute inference. The only direct evidence is an SVM trained on the ASCII values of encrypted embeddings, which then performs at chance. That experiment cannot carry the argument. CKKS ciphertexts are pseudorandom under standard assumptions; a classifier on serialized bytes is expected to hit chance regardless of whether the method protects anything. It is a sanity check, not an attack. The actual attack surface—a curious server with public key and evaluation key who can homomorphically evaluate functions, a client who receives decrypted match scores and can use them as a similarity oracle, CKKS approximate-noise channels—is untouched. The paper cites [30] on approximate-HE attacks but does not address it in the threat model.\n\nTwo softer but real issues: (1) MRL+FHE and MRL+FHE+PP give almost identical numbers in every table, so the added PP layer shows no measurable privacy benefit; the 'dual-layer' story is unsupported. (2) The Privacy Gain metric is mis-defined in the text (it says recognition performances) but computed from attribute accuracies; the numbers only make sense under the latter. Also, hyperparameters are tuned on the same datasets used for final results, and there are no error bars, so the 'outperforms SOTA' phrasing is stronger than the evidence.\n\nThe paper is not junk. The pipeline is novel, the FHE implementation is nontrivial, and the comparison of template-protection schemes leaking soft biometrics is useful. But the headline privacy claim needs either a real adversary model (match-score oracle, CKKS noise attacks) or a sharp reframing to 'resists attribute classifiers on raw ciphertexts.' As it stands, I would not accept the privacy claim at face value.\n\nFor peer review: yes, send it to referees—it deserves serious engagement, but expect heavy revision on the evaluation and framing.","headline":"Real FHE pipeline, but the paper's privacy claim rests on an SVM against pseudorandom ciphertexts—a sanity check, not an adversarial evaluation.","tokens_in":15834,"tokens_out":3580,"would_cite":false,"duration_ms":39470,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Encrypted face embeddings leak almost no age or gender","keywords":["face embeddings","soft biometrics","attribute inference","fully homomorphic encryption","CKKS","Matryoshka representation learning","PolyProtect","template protection"],"falsifier":"Train attribute classifiers directly on the raw CKKS ciphertext coefficients (or give an attacker oracle access to match scores) on the same CelebSet splits used in Table VII; if any classifier predicts gender or age with AUC significantly above 0.5, the paper's central privacy claim is falsified.","tokens_in":14738,"feed_emoji":"🔐","tokens_out":7835,"duration_ms":72630,"temperature":0.7,"pith_summary":"Face embeddings used for identification secretly carry soft-biometric information: age, gender, and ethnicity can be read out of them. The paper claims that standard protections — template hashing, compression, and differential privacy — either leave this leakage intact or destroy the identification capability. Its proposed stack compresses the embedding with Matryoshka Representation Learning, encrypts it with the CKKS fully homomorphic scheme, and then applies the irreversible PolyProtect transform inside the encrypted domain. Across two face encoders and two datasets, attribute classifiers fall to near random chance (gender accuracy about 50 percent, age as low as 6 percent, AUC near 0.5) while Rank-1 identification stays above 96 percent on CelebSet and above 84 percent on the Chicago Face Database. The paper concludes that encryption, not any single plaintext transform, is the layer doing the shielding, and the other layers exist to make encrypted processing practical.","feed_headline":"Encrypted face embeddings leak almost no age or gender","feed_subtitle":"Three-layer shield drops attribute inference to chance while keeping face identification above 96 percent on CelebSet.","key_machinery":"The load-bearing object is the MRL+FHE+PP pipeline: Matryoshka Representation Learning compresses a 512-dimensional face embedding to 64 dimensions; the CKKS scheme, implemented with the HEAAN library, encrypts the compressed vector so arithmetic can be performed on ciphertexts; and PolyProtect, a multivariate polynomial map with user-specific coefficients, is applied inside the encrypted domain using Taylor-series approximations and ciphertext packing. To run the primary task on ciphertexts, the inverse-square-root step of cosine similarity is replaced by an 8th-degree polynomial approximation. The privacy measurement uses SVM classifiers trained on the ASCII values of the encrypted embeddings, and the paper treats their failure as evidence that attribute information is unrecoverable.","core_discovery":"Under a full-disclosure threat model where the attacker knows the hashing algorithm, its parameters, and the FHE public key but not the private key, the paper shows that existing template protections leak soft biometrics: PolyProtect, Negative Face Recognition, and Minimum Information Units all leave gender, age, and ethnicity recoverable at high accuracy. Adding CKKS encryption, with Matryoshka compression to keep ciphertexts small and PolyProtect applied inside the encrypted domain, reduces attribute classification to random-guessing levels in nearly every setting while cosine-distance face identification on the protected templates retains more than 96 percent Rank-1 accuracy on CelebSet and more than 84 percent on the Chicago Face Database. The paper also finds that differential privacy suppresses attributes but collapses identification accuracy, and that the compression step mainly buys speed, yielding a 627 percent speedup over FHE without compression.","pith_inferences":["The privacy claim is empirical and attack-specific: it is established against SVM classifiers fed ASCII representations of ciphertexts, not against an adversary who exploits CKKS coefficient structure, approximate-noise behaviour, or match-score oracles; a broader attack surface could change the conclusion.","The same compress-encrypt-hash recipe should transfer to other embedding domains, such as medical or speech representations, whenever attribute leakage is a concern; the paper tests only face embeddings.","Because the authors note that near-ideal Privacy Gain may reflect dataset imbalance, a balanced multi-attribute benchmark would give a cleaner estimate of how much attribute information actually remains.","A formal guarantee would require tying attribute hiding to a cryptographic indistinguishability notion rather than to measured classifier accuracy; without that, the shield is best read as demonstrated resistance, not proven impossibility."],"forward_implications":["Template protection alone is insufficient: any of the three tested manifold hashes leaves soft biometrics readable, so the encryption layer, not the hash, is what suppresses attribute inference.","Differential privacy is not a viable alternative here because the noise needed to hide attributes reduces identification accuracy to near zero; the FHE-based stack is the method that keeps both properties.","Encrypted face identification is practical enough to deploy in the tested setting: MRL+FHE+PP takes about 715 ms and cosine matching on 64-dimensional encrypted embeddings about 1077 ms.","If the FHE private key leaks, the irreversible PolyProtect layer remains as a backstop; applying the hash after encryption, rather than before, prevents leaked hash parameters from enabling inversion."],"supporting_citations":[{"why":"Supplies the Matryoshka Representation Learning compression that reduces embedding dimension before encryption.","marker":"[28]"},{"why":"Supplies the CKKS/HEAAN FHE scheme used for all encrypted-domain operations.","marker":"[8]"},{"why":"Supplies PolyProtect, the irreversible feature manifold hash adapted to run inside FHE and used as the template-protection layer.","marker":"[18]"},{"why":"One of the two face encoders whose embeddings are protected and tested.","marker":"[11]"},{"why":"The other face encoder used in the experiments.","marker":"[26]"},{"why":"Documents attacks on soft-biometric privacy enhancement, motivating the dual-layer FHE-plus-hash design.","marker":"[47]"},{"why":"Provides the differential privacy baseline (Laplacian mechanism) that the paper compares against.","marker":"[49]"},{"why":"Prior hybrid protection combining FHE and cancelable biometrics, the approach this work extends.","marker":"[57]"},{"why":"Negative Face Recognition, one of the template-protection baselines shown to leak soft biometrics.","marker":"[60]"},{"why":"Minimum Information Units, another template-protection baseline shown to leak soft biometrics.","marker":"[61]"}],"fun_headline_variants":["Three-layer shield blocks age/gender leaks from face embeddings","Attribute inference drops to chance while face ID stays above 96%","Encrypted face vectors: age and gender hidden, identity preserved","New face embedding shield: privacy at random guess, ID at 96%","Full-disclosure proof: encrypted face embeddings leak no soft biometrics"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that training SVM classifiers on the ASCII values of encrypted embeddings is a fair stand-in for a determined attribute-inference adversary; if an attacker can instead exploit the algebraic structure of the CKKS ciphertext or query match scores, the near-chance accuracies may not reflect true leakage.","fun_headline_variants_meta":{"raw":{"variants":["Three-layer shield blocks age/gender leaks from face embeddings","Attribute inference drops to chance while face ID stays above 96%","Encrypted face vectors: age and gender hidden, identity preserved","New face embedding shield: privacy at random guess, ID at 96%","Full-disclosure proof: encrypted face embeddings leak no soft biometrics"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000382,"raw_usage":{"total_tokens":2009,"prompt_tokens":916,"completion_tokens":1093,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":532,"completion_tokens_details":{"reasoning_tokens":1003}},"tokens_in":532,"tokens_out":1093,"duration_ms":10012,"temperature":1.0,"reasoning_tokens":1003,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:29:16.774072+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train attribute classifiers directly on the raw CKKS ciphertext coefficients (or give an attacker oracle access to match scores) on the same CelebSet splits used in Table VII; if any classifier predicts gender or age with AUC significantly above 0.5, the paper's central privacy claim is falsified.","supporting_citations":[{"cited_title":"Kusupati, G","cited_arxiv_id":null,"evidence_quote":"Supplies the Matryoshka Representation Learning compression that reduces embedding dimension before encryption."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the CKKS/HEAAN FHE scheme used for all encrypted-domain operations."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies PolyProtect, the irreversible feature manifold hash adapted to run inside FHE and used as the template-protection layer."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"One of the two face encoders whose embeddings are protected and tested."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The other face encoder used in the experiments."},{"cited_title":"Osorio-Roig, C","cited_arxiv_id":null,"evidence_quote":"Documents attacks on soft-biometric privacy enhancement, motivating the dual-layer FHE-plus-hash design."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the differential privacy baseline (Laplacian mechanism) that the paper compares against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Prior hybrid protection combining FHE and cancelable biometrics, the approach this work extends."},{"cited_title":"Terh ¨orst, K","cited_arxiv_id":null,"evidence_quote":"Minimum Information Units, another template-protection baseline shown to leak soft biometrics."}],"review_version":1}