{"id":"a583d5c0-7908-4ba4-b979-909d9ee650c8","arxiv_id":"2507.12050","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"IDFace identifies faces among one million encrypted templates in 126ms with less than 1% accuracy loss and roughly 2x plaintext speed overhead.","lead":"Researchers built a face identification system that searches a database of one million encrypted face templates in about 0.13 seconds, only about twice as slow as searching unencrypted templates. If the results hold, privacy-protected facial ID at airports or building entrances could run in real time without exposing stored face data.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Proposition 1 does not deliver a usable finite-d guarantee at d=512: its proof invokes unproved Assumption 1 and, with the paper's own parameter choices, the derived δ bound exceeds 1, leaving the (0.111, o(1), θ)-isometry claim asymptotic and empirically supported only.","rationale":"Read in good faith: IDFace's main practical achievement is a 126 ms / 1M identification with an additive-only homomorphic pipeline, and this is supported by consistent timing and storage tables plus a broad accuracy evaluation across six face recognition models. I am not alleging misconduct or dismissing the experimental work. The load-bearing weakness is the mismatch between the advertised formal guarantee and what the proof actually establishes. The proof of Proposition 1 is explicitly contingent on an unverified expectation (Assumption 1, Appendix B.2), and the derived δ is asymptotically vanishing with constants that exceed 1 at d=512. Therefore the statement 'For d=512 and α=341, Tα is (0.111, o(1), θ)-isometry' cannot be read as a concrete finite-dimensional guarantee; it is asymptotic motivation. This matters because the paper's novelty is presented both as an efficient scheme and as a theoretical explanation of why accuracy is preserved. The benchmarks and Figure 6 may be sufficient evidence in practice, but they are not a substitute for the claimed theorem. The proposed Monte Carlo and constant-evaluation test would settle whether the theorem's failure is only a proof gap or an actual property failure. Because the empirical core is otherwise solid, the appropriate action is to keep the paper conditional pending this clarification rather than to reject it.","tokens_in":47248,"tokens_out":19491,"duration_ms":228938,"concrete_test":"Re-derive Proposition 2's constants at the fixed dimension d=512 instead of asymptotically. Specifically: (a) compute Assumption 1 by Monte Carlo, estimating E[<X,W>/(||X||_2 ||W||_2)] with at least 10^7 samples on a grid of θ ∈ (0,π); (b) evaluate the Lemma 1 failure bound δ = 67·d^{-1/3} at d=512 — if δ > 1, the claimed (0.111, o(1), θ)-isometry is vacuous at the stated dimension; (c) estimate the empirical failure rate Pr(|<T_341(x), T_341(y)> − <x,y>| > 0.111) at d=512 over the same θ grid. If (c) is small, the practical isometry claim survives as an empirical fact despite the proof gap; if (c) is not small, both the theoretical contribution and the accuracy story require revision.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.1 advertises Proposition 1 as the theoretical basis for preserving angular distance, and Appendix B.2 supplies the proof. Two gaps prevent that proof from certifying the operating dimension d=512. First, Lemma 2 is stated conditionally on Assumption 1: E[<X,W>/(||X||_2 ||W||_2)] = cosθ + o(1), where W = (X + tanθ·Y)/sqrt(1+tan^2θ). The appendix's only justification is the numerical Figure 4; no proof is given. Second, even granting Assumption 1, the proof sets ξ1 = ξ2 = d^{-1/3} and obtains δ = d^{-1}(3ξ1^{-2} + 64ξ2^{-2}) = 67·d^{-1/3}. At d=512 this is roughly 8.4, which is not a probability; the Chebyshev/union-bound constants are vacuous. Thus the stated (0.111, o(1), θ)-isometry is a large-d asymptotic statement, not a theorem about d=512. The empirical Figures 4-6 and the benchmarks may still show that the transformation works, but the advertised formal guarantee does not cover the practical setting. The paper itself concedes in Appendix D.3 and D.6 that the uniform-sphere analysis may not match real face distributions and that the 0.111 bound is too coarse to explain the observed accuracy. The central practical claim is therefore supported by experiments, not by the isometry theorem.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes IDFace, a homomorphic-encryption-based face template protection scheme for large-scale identification. It introduces two techniques: (1) an almost-isometric transformation Tα that maps a 512-dimensional unit face template to a ternary vector with α nonzero ±1 entries, allowing inner products to be computed by additions only; (2) a space-efficient encoding that packs multiple transformed templates into a single plaintext slot, reducing the number of ciphertexts. The authors instantiate IDFace with Paillier and CKKS, report identification times of 126–753 ms for 1M identities with 2×–12× overhead over plaintext identification, and report less than 1% accuracy degradation on LFW, CFP-FP, AgeDB, and IJB-C benchmarks across several face recognition models. They also provide a theoretical analysis (Proposition 1/2, Appendix B) claiming that Tα is an almost isometry, and they include extensions to speaker and fingerprint verification.","tokens_in":47580,"tokens_out":10162,"duration_ms":115652,"significance":"If the efficiency and accuracy results hold, IDFace is a substantial advance over prior HE-based biometric identification: Table 2 shows 16–98× faster identification than HERS and 23.5× faster than MFBR-ID at comparable or better accuracy, with only ~2× overhead over plaintext identification. The accuracy study is unusually broad (six face recognition models, four benchmark datasets, plus speaker and fingerprint evaluations), and the packing/encoding technique is simple and clearly described. However, the theoretical guarantee is weaker than advertised: Proposition 1 relies on an unproved assumption and an asymptotic δ bound that is vacuous at d=512, and the authors themselves concede in Appendices D.3 and D.6 that the uniform-sphere analysis does not match real face distributions and that the 0.111 bound is too coarse to explain observed accuracy. The practical claims rest on experiments rather than on the isometry theorem, so the formal contribution needs substantial revision.","major_comments":[{"comment":"The proof of Lemma 2, and hence of Proposition 1, is conditional on Assumption 1, which is not proved in the manuscript; the only support is the numerical check in Figure 4. Since Proposition 1 is presented in Section 4.1 as the formal basis for the distance-preservation claim, the proof is incomplete. The authors should either supply an analytic proof of Assumption 1 (for example, a concentration or delta-method argument for the normalized inner product of X and W) or re-label Proposition 1 as conditional/experimental.","section":"Appendix B.2, Lemma 2 / Assumption 1"},{"comment":"Setting ξ1 = ξ2 = d^{-1/3} in Lemma 1 gives δ = d^{-1}(3ξ1^{-2} + 64ξ2^{-2}) = 67 d^{-1/3}, which exceeds 1 for d = 512 (67/8 ≈ 8.4). Thus the derived probability bound is vacuous at the operating dimension, and the statement \"For d = 512 and α = 341, Tα is (0.111, o(1), θ)-isometry\" is not a finite-dimensional theorem. The main text should distinguish the asymptotic isometry statement from any usable d=512 guarantee, or provide a non-vacuous finite-d bound.","section":"Appendix B.2, proof of Lemma 1"},{"comment":"The paper itself concedes that the face feature distribution is \"quite far from uniform\" and that the theoretical analysis \"may or may not fit with reality\" (D.3), and that the 0.111 worst-case bound is \"too high to explain the small accuracy drop\" (D.6). These concessions directly qualify the central theoretical claim and should be stated in Section 4.1 when Proposition 1 is invoked; as written, the main text presents the isometry result without these caveats, and the accuracy guarantee is de facto empirical.","section":"Appendix D.3 and D.6"}],"minor_comments":[{"comment":"The proposition is stated for fixed d=512 with an o(1) term; since o(1) is asymptotic in d, the statement should clarify whether the isometry is claimed for the fixed dimension or for a sequence d→∞ with α=⌊2d/3⌋.","section":"Section 4.1, Proposition 1"},{"comment":"The sentence \"less than 1% performance loss ... even for the setting β=63\" should specify the column (341,63); for the (63,63) column, CFP-FP and AgeDB show drops of 1.04 and 1.52 percentage points, respectively.","section":"Section 5.2, Table 3"},{"comment":"The notation is inconsistent: the lemma statement defines X(α) as the α-th order statistic, but the proof uses X(d−α) without redefining it; please align notation so that Pr[E1]=α/d is unambiguous.","section":"Appendix B.2, Lemma 5"},{"comment":"The security analysis is informal; no formal BTP security games are defined for irreversibility, revocability, and unlinkability. Since the paper invokes ISO/IEC 24745, a precise mapping of the construction to those requirements would strengthen the claims.","section":"Section 5.3"}],"recommendation":"major_revision","confidential_remarks":"This is a strong systems paper with directly measured efficiency numbers and a broad accuracy evaluation, but the theoretical framing in Section 4.1/Appendix B overclaims: the isometry proof rests on an unproved assumption and a vacuous finite-d bound, and the authors' own appendices acknowledge the mismatch with real face distributions. I would not reject, because the practical claims are experimentally supported and the theory could be fixed by proving Assumption 1, providing a non-vacuous bound, or explicitly downgrading Proposition 1 to a conjectural/asymptotic statement. The revision should also move the D.3/D.6 caveats into the main text so that the advertised guarantee matches what is actually established."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know about IDFace is that the practical result is real: 1M encrypted templates identified in 126ms with ~2x overhead over plaintext, measured directly and reported with error bars. That is a big jump over prior HE-based schemes, and it holds up as a system-level contribution. The sign-separated packed-slot encoding is a genuine trick worth studying, and the paper is honest about the transformation being the same map as IronMask's decoding algorithm. The new contribution is the isometry analysis and the complete identification protocol, not the quantization itself. Credit where due: the accuracy benchmarks are extensive, covering multiple face models and datasets, plus speaker and fingerprint extensions, and the accuracy loss is consistently under 1% for the recommended parameters. The parameter choice for alpha is driven by a combinatorial criterion independent of accuracy, so there is no obvious tuning-to-benchmark circularity.\n\nThe soft spots are real but localized. The formal isometry guarantee, Proposition 1, does not deliver what it advertises for d=512. The proof leans on an unproved Assumption 1, justified only by a numerical figure, and even granting that, the derived delta bound is vacuous at operating dimension: 67*d^{-1/3} is around 8.4, not a probability. The paper itself concedes in Appendices D.3 and D.6 that the uniform-sphere assumption likely misses real face distributions and that the 0.111 bound is too coarse to explain the observed accuracy. So the stated (0.111, o(1), theta)-isometry is an asymptotic statement, and the practical accuracy claim rests on experiments, not on that theorem. That is worth saying plainly. Also minor: no code is released, and the 1M efficiency numbers use random vectors, while accuracy is not benchmarked at 1M scale.\n\nFor a reader in biometric template protection or applied HE, this paper is valuable. The efficiency numbers are credible and the encoding idea is reusable. The theory needs a rewrite—either prove the assumption, give a real finite-d bound, or explicitly relegate the isometry analysis to motivation. As is, the paper would benefit from careful refereeing rather than desk rejection.","headline":"A practical HE-based face identification system with real measured speedups, but the advertised isometry theorem does not prove a usable finite-dimension guarantee, so the theoretical framing overreaches while the empirical core largely stands.","tokens_in":48129,"tokens_out":1092,"would_cite":true,"duration_ms":15310,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68P25","94A60"],"pacs":[],"model":"deepseek-v4-flash","headline":"IDFace claims encrypted face identification over 1M templates in 126ms, only 2x slower than plaintext search, using a sign-locked ternary transform and slot-packing to make inner products addition-only.","keywords":["face template protection","homomorphic encryption","biometric identification","ternary quantization","almost isometry","cosine similarity","SIMD packing"],"falsifier":"Evaluate the expectation in Assumption 1 directly at d=512 over a dense grid of θ, using exact quadrature or a very large Monte Carlo sample; if the bias exceeds 0.01 for any θ, Lemma 2 in the proof loses its guarantee and the (0.111, o(1), θ)-isometry statement is unsupported. A complementary empirical check is to sample real face embeddings from a public template set, compute max |⟨Tα(x),Tα(y)⟩ − ⟨x,y⟩| for pairs at the operating threshold, and see whether the 99th percentile stays well below 0.111.","tokens_in":47058,"feed_emoji":"🔐","tokens_out":9334,"duration_ms":103710,"temperature":0.7,"pith_summary":"IDFace claims to make homomorphically encrypted face identification practical at million-person scale. The paper's central assertions are that mapping each unit-length template into a sparse ternary vector — retaining only the top ~341 of 512 coordinates by magnitude, as ±1, and zeroing the rest — preserves cosine similarity well enough to hold accuracy loss to about 1% on standard benchmarks, and that packing several such transformed templates into one ciphertext slot, so their inner products decode cleanly, brings identification over 1M encrypted templates down to 126 ms, roughly 2x the cost of the unprotected matrix-vector search. The claim matters because prior HE-based template protection ran hundreds of times slower than plaintext, which made real-time secure identification at airports or building entrances impractical.","feed_headline":"Encrypted face ID searches 1M templates in 126ms","feed_subtitle":"A sign-locked ternary transform turns encrypted matching into additions, cutting the usual HE overhead to 2x.","key_machinery":"The load-bearing device is the almost-isometric ternary transform Tα: given a unit vector, it selects the α coordinates with the largest absolute values and replaces them by +1 or −1 according to sign, zeroing everything else; after normalization the output lies in Z^d_α, the set of ternary vectors with exactly α nonzeros. Templates with α nonzero ±1 entries have inner products that are just counts of matching signs minus mismatching signs, so the encrypted matching test becomes additions and look-ups, with no homomorphic multiplications at all. The paper formalizes the needed property as an (ε, δ, θ)-isometry and proves the d=512, α=341 parameter statement in the supplement, using a classical order-statistics asymptotic to control which coordinates survive the threshold. The second device, Encode/Decode, writes m transformed templates as digits of a base-p number inside each AHE slot so that m inner products arrive in a single decrypted word and are recovered by modular decoding.","core_discovery":"The central discovery is that an encrypted inner product can be reduced to additions when templates are first passed through Tα, the map that keeps the α largest-magnitude coordinates as their signs and zeros the rest. The paper proves (Proposition 1 in the main text, with the full statement and proof in the supplement) that for d=512 and α=341 this map is an (0.111, o(1), θ)-isometry for every angle θ, meaning that for uniformly random unit vectors at angle θ the inner product of the transformed vectors differs from cosθ by less than 0.111 except with probability tending to zero as the dimension grows. An Encode/Decode layer then packs m transformed templates into a single message slot using base-p representation, so one homomorphic addition yields m inner products at once. The reported result is 126 ms identification over 1M enrolled templates with CKKS (7.08 s with Paillier at the same speed setting), with storage of 1.5–6.6 GB depending on parameters and accuracy loss held below 1% on LFW, CFP-FP, AgeDB and IJB-C.","pith_inferences":["The isometry theorem is proven for uniformly random unit vectors, but real face embeddings are strongly non-uniform, so the formal 0.111 bound probably overstates the distortion seen in practice; one could measure the empirical isometry error directly on real template pairs at the operating threshold rather than on random vectors.","Since the speed-up eliminates homomorphic multiplications, the same ternary transform could accelerate other encrypted inner-product workloads, such as private nearest-neighbor search or encrypted recommender scoring, whenever a couple of percent accuracy loss is acceptable.","The 126 ms figure covers only the encrypted search computation; an end-to-end deployment also pays for key-server decryption and two-server communication, so the complete identification latency will be higher in practice.","Choosing α to maximize the number of codewords is a worst-case heuristic; searching over α values fitted to actual template statistics might reduce the inner-product error further than the reported α=341."],"forward_implications":["If the claims are correct, template-protected identification at 1M scale becomes real time, with a 126–753 ms range covering the β = 63, 127, 341 trade-off between speed and accuracy.","Because the matching test is addition-only, any additive homomorphic encryption works; the CKKS instantiation is not special, only faster due to slot packing.","Accuracy degradation stays under about 1% across LFW, CFP-FP, AgeDB and IJB-C for several recent face recognition backbones, so the protection can be plugged in without retraining the recognizer.","The claimed 2x overhead is measured against a plaintext matrix–vector product; storage for 1M identities remains modest, from 1.5 GB (Paillier) to 6.6 GB (CKKS).","The appendix's speaker and fingerprint results indicate the same transform-and-pack recipe extends to any biometric scored by cosine similarity."],"supporting_citations":[{"why":"Supplies the baseline column-encrypted database scheme (encrypt each column, compute weighted sums) that IDFace extends.","marker":"[27]"},{"why":"Introduces the same sign-of-top-α-coordinates map as a decoding algorithm; IDFace reuses the map for its almost-isometry property.","marker":"[58]"},{"why":"Gives the order-statistics asymptotic used to bound the positions of the retained coordinates in the proof.","marker":"[84]"},{"why":"Shows that normalizing a Gaussian vector yields a uniform point on the sphere, the bridge used in the proof.","marker":"[85]"},{"why":"One of the two additive homomorphic encryption instantiations in the experiments, at 2048-bit modulus and 112-bit security.","marker":"[91]"},{"why":"The CKKS homomorphic encryption scheme used for the fast 126 ms instantiation with 4096 slots and 50-bit precision.","marker":"[13]"},{"why":"Closest prior multiplication-free scheme; its runtime, enrollment time and storage are the main comparison points.","marker":"[4]"},{"why":"Face recognition model used as the feature extractor for the main accuracy benchmarks.","marker":"[56]"},{"why":"IJB-C identification benchmark on which the true positive identification rate is reported.","marker":"[76]"}],"fun_headline_variants":["Encrypted face search hits 126ms with a sign transform","A sign trick makes encrypted face ID nearly plaintext-fast","Turning encrypted face matching into additions: 126ms","Cheap encrypted face ID: sign-locked transform cuts cost","From HE overhead to 2x: encrypting face search in 126ms"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The formal distance-preservation guarantee rests on an unproved statistical assumption, stated as Assumption 1 in the supplement: for independent d-dimensional Gaussian vectors X and Y and W = (X + tanθ·Y)/√(1+tan²θ), the expected cosine between X and W equals cosθ up to a term that vanishes as d grows, which the authors verify only by numerical sampling.","fun_headline_variants_meta":{"raw":{"variants":["Encrypted face search hits 126ms with a sign transform","A sign trick makes encrypted face ID nearly plaintext-fast","Turning encrypted face matching into additions: 126ms","Cheap encrypted face ID: sign-locked transform cuts cost","From HE overhead to 2x: encrypting face search in 126ms"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000223,"raw_usage":{"total_tokens":1510,"prompt_tokens":1048,"completion_tokens":462,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":664,"completion_tokens_details":{"reasoning_tokens":375}},"tokens_in":664,"tokens_out":462,"duration_ms":5898,"temperature":1.0,"reasoning_tokens":375,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T16:56:34.165988+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Evaluate the expectation in Assumption 1 directly at d=512 over a dense grid of θ, using exact quadrature or a very large Monte Carlo sample; if the bias exceeds 0.01 for any θ, Lemma 2 in the proof loses its guarantee and the (0.111, o(1), θ)-isometry statement is unsupported. A complementary empirical check is to sample real face embeddings from a public template set, compute max |⟨Tα(x),Tα(y)⟩ − ⟨x,y⟩| for pairs at the operating threshold, and see whether the 99th percentile stays well below 0.111.","supporting_citations":[{"cited_title":"Ironmask: Modular architecture for protecting deep face template","cited_arxiv_id":null,"evidence_quote":"Introduces the same sign-of-top-α-coordinates map as a decoding algorithm; IDFace reuses the map for its almost-isometry property."},{"cited_title":"On Some Useful ”Inefficient” Statis- tics","cited_arxiv_id":null,"evidence_quote":"Gives the order-statistics asymptotic used to bound the positions of the retained coordinates in the proof."},{"cited_title":"A note on a method for generating points uniformly on n-dimensional spheres","cited_arxiv_id":null,"evidence_quote":"Shows that normalizing a Gaussian vector yields a uniform point on the sphere, the bridge used in the proof."},{"cited_title":"Public-key cryptosystems based on compos- ite degree residuosity classes","cited_arxiv_id":null,"evidence_quote":"One of the two additive homomorphic encryption instantiations in the experiments, at 2048-bit modulus and 112-bit security."},{"cited_title":"Adaface: Quality adaptive margin for face recognition","cited_arxiv_id":null,"evidence_quote":"Face recognition model used as the feature extractor for the main accuracy benchmarks."},{"cited_title":"Iarpa janus benchmark-c: Face dataset and protocol","cited_arxiv_id":null,"evidence_quote":"IJB-C identification benchmark on which the true positive identification rate is reported."}],"review_version":1}