{"id":"1e11155d-8484-4f69-ae38-752d93468eb1","arxiv_id":"2607.17504","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"DecoyFace redirects inversion of split face-recognition features toward a plausible decoy identity while preserving authorized verification.","lead":"DecoyFace is a privacy defense for face recognition in which the phone sends a modified face code to the server, so anyone who steals the code and tries to rebuild the face instead gets a realistic but different person, while the authorized server can still recognize the real user. The paper reports very low identity leakage rates and high face plausibility, which would make protection harder for attackers to detect if the results hold.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attacker evaluation appears to train on clean features, not protected features; central privacy numbers may not hold under the paper's own black-box query threat model.","rationale":"The reader's verdict is CONDITIONAL, and my read does not move it. The most load-bearing unverified link in the chain is the attacker-side evaluation: the threat model specifies an adaptive black-box attacker, but the experimental section does not establish that the evaluated U-Net and Flow-Matching attackers were trained on the protected feature distribution. Since the RSSD proxy itself is trained on clean features, the reported privacy numbers could be a transfer result from a non-adaptive attacker rather than a demonstration under the paper's adversary. This is precisely the 'attacker trains on protected rather than original features' clause of the reader's weakest assumption, so I agree with that assessment. I also considered the under-specified identity gallery T, threshold theta_f, and recognizer phi in Section V-A; that is a real reproducibility gap, but it is secondary because even a fully specified metric protocol would not resolve whether the attacker was trained on the correct distribution. The proposed test directly settles the main concern: if adaptive attackers maintain the low ILR, the central claim holds; if not, the conditional verdict should be tightened or the claim narrowed.","tokens_in":20074,"tokens_out":9619,"duration_ms":98116,"concrete_test":"Retrain both attackers under the stated threat model: for CelebA training images x_i, query the deployed DecoyFace client (with the same random routing, decoy bank, and scaling) to obtain protected features z_t(x_i); train the same U-Net and Flow-Matching architectures on (x_i, z_t(x_i)) pairs; then recompute Table III's ILR/IRR/FVR and DHR. Also include a third inverter with an architecture different from the U-Net proxy (e.g., a diffusion-based or transformer-based inverter) trained on the same protected features. If ILR rises materially above the reported 2.93%/0.74% (or DHR drops), the central attacker-side privacy claim fails under the paper's own threat model; if ILR stays comparably low, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (abstract; Tables III-VII) is that DecoyFace reduces identity leakage to 2.93% (U-Net) and 0.74% (Flow-Matching) while keeping FVR > 99%. But the threat model in Section III-A explicitly gives the malicious attacker black-box query access to the client and says the attacker trains a reconstruction model on queried pairs {x_i, z_i}. Since the deployed client emits protected features z_t, an attacker following the stated threat model would train on (x_i, z_t(x_i)), not on clean intermediate features F_c(x_i). Section V-B only states that both attackers are 'trained on CelebA for 100,000 iterations' and never specifies whether the training features are clean or protected; the RSSD proxy is explicitly a clean-feature U-Net (Section IV-B), making it plausible that the evaluated attackers are also clean-feature attackers. If so, Tables III-VII measure transfer from a non-adaptive attacker, and the reported ILR does not instantiate the paper's own adversary. The complementary subspace P_N is estimated from that same clean-feature U-Net; there is no evidence that a different inversion family, or an attacker trained on protected features, cannot exploit the K=3 true-sample complementary groups that must remain in z_t to support 91-99% verification accuracy. This is load-bearing because the entire 'Any Way / Any Who' privacy claim depends on the attacker being unable to use those true groups, not just on the proxy's gradient geometry. The HBC experiment (Section V-D) shows the authors can train on a protected/canonicalized representation, but the analogous adaptive training for the malicious attacker is missing.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"DecoyFace proposes a decoy-oriented privacy-preserving framework for split face recognition. The client decomposes an intermediate face feature into a reconstruction-sensitive subspace and a complementary subspace, injects decoy identity cues into the sensitive component, and transmits a stochastically mixed protected feature. A server-side canonicalization module suppresses the decoy component and recovers a recognition-friendly representation. The paper reports competitive verification accuracy on seven benchmarks (e.g., LFW 99.77%, IJB-C 93.35% TAR@FAR=10^-4), low identity leakage under U-Net and Flow-Matching inversion attackers (ILR 2.63%–3.86% and 0.74%–1.79% respectively), high face validity (FVR > 98.7%), and strong redirection away from the original identity (IRR 96–99%). It also evaluates an HBC server that reconstructs from the canonicalized feature, reporting ILR below 0.34%.","tokens_in":20532,"tokens_out":5507,"duration_ms":55555,"significance":"If the results hold, the paper offers a conceptually novel alternative to obfuscation-based PPFR: rather than making reconstructions fail, it steers them toward a plausible but incorrect identity. The idea of separating reconstruction-sensitive and recognition-relevant subspaces is original and clearly presented. The evaluation is broad in terms of benchmarks and attacker families, and the privacy metrics use an independent face-recognition oracle and face detector, which is a strength. The main risks are (i) whether the evaluated attackers instantiate the paper's own black-box threat model, and (ii) whether the 'controllable' misdirection claim is quantitatively supported, since the only reported decoy-hit ratio is about 30%.","major_comments":[{"comment":"The threat model states that the malicious attacker has black-box query access to the client and trains on queried pairs (x_i, z_i). In a deployed system, the client emits the protected feature z_t, not the clean intermediate feature F_c(x). Section V-B only says the attackers are 'trained on CelebA for 100,000 iterations' and never states whether the training features are clean or protected. The RSSD proxy in Section IV-B is explicitly built from clean features z_i = F_c(x_i). If the evaluated U-Net and Flow-Matching attackers were trained on clean features and tested on protected features, then Tables III–VII measure a non-adaptive transfer attack, not the stated adversary. The authors must specify the training features and, if necessary, retrain the attackers on the protected features z_t (and on z_can for the HBC case) under the same query budget.","section":"Section III-A and Section V-B, Tables III–VII"},{"comment":"The 'controllable identity misdirection' claim is not supported by the reported numbers. With the full method, DHR is only 30.19% on CPLFW, meaning that only about 30% of valid reconstructions are recognized as the assigned target decoy; the remaining ~67% are redirected to some non-original identity but not the intended one. DHR is omitted from the main privacy tables (Tables III–VII) and appears only in the ablation, which makes the controllability claim difficult to evaluate. Please report DHR (and ideally top-k decoy hit or embedding similarity to the target decoy) on all benchmarks and all ablations. If the goal is merely redirection to 'a non-original identity,' the title and contributions should be revised accordingly.","section":"Table IX and Section V-E (Any Who)"},{"comment":"The reconstruction-sensitive subspace is estimated from a single U-Net proxy trained on clean features, and the evaluated U-Net attacker is the same architecture family trained on the same data. This creates a nontrivial risk that the reported U-Net ILR numbers reflect overfitting to the proxy, rather than a general property of the decomposition. The Flow-Matching result is more reassuring but it too appears to be trained on clean features. To support the 'Any Way' and 'Any Who' claims, the authors should evaluate at least one attacker that (a) is trained on protected features z_t rather than clean features, and (b) uses an inversion family not used to construct RSSD (e.g., a diffusion-prior inversion). The K=3 preserved true-sample groups in the complementary subspace are a concrete exploitation target: an adaptive attacker could learn to emphasize those groups, and the current experime","section":"Section IV-B and Section V-B (RSSD generalization)"},{"comment":"The HBC-server evaluation compares only against FaceObfuscator. Because the other baselines do not have a canonicalization pipeline, it is unclear how the comparison generalizes. More importantly, the HBC attacker is assumed to know the full recovery pipeline, but the experimental description does not state whether the HBC reconstruction model is trained on z_can features computed from clean images or from protected images. This is the same ambiguity as Major Comment 1, but it applies to the server-side setting where the threat model is even stronger. Please clarify and, if training is on clean-derived z_can, retrain on the actual canonicalized representations.","section":"Section V-D.2, Table VIII"}],"minor_comments":[{"comment":"The face-validity threshold θ_f is never specified. Please state the detector and threshold used for FVR, since FVR is central to the 'imperceptible face' claim.","section":"Section V-A, Eq. (23)"},{"comment":"The word 'imperceptible' is validated only through face detector confidence (FVR). A human perceptual study or perceptual metrics (e.g., FID/LPIPS) would better support the claim that reconstructions are visually plausible and that protection is not perceptible.","section":"Title/Abstract and Section V-D"},{"comment":"The columns 'Privacy Protected' and 'Imperceptible' use checkmarks/crosses without a formal definition. Define the criteria for these qualitative columns.","section":"Table II"},{"comment":"Equation (15) uses a constant ξ in the denominator, but the text says 'ε is a small constant.' The notation should be unified.","section":"Equation (15)"},{"comment":"Footnote 1 contains an incomplete URL placeholder. This should be removed or replaced with a proper citation/source.","section":"Footnote 1"},{"comment":"The main privacy tables do not report DHR, even though it is defined in Eq. (26). Including it would align the tables with the paper's stated decoy-oriented objective.","section":"Tables III–VII"}],"recommendation":"major_revision","confidential_remarks":"The paper presents a promising and timely idea, and the evaluation is broad. The two main risks are (1) the attacker-training protocol seems inconsistent with the stated black-box threat model—the reported privacy numbers may only hold for non-adaptive attackers—and (2) the 'controllable' claim is quantitatively weak (DHR ~30%). Both are fixable with additional experiments and careful reporting. I recommend major revision rather than rejection, because the core framework is interesting and the paper's central mechanism is not disproven; however, the current evidence does not yet support the 'Any Who' and 'Any Way' claims as strongly as the abstract and contributions assert."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hi [Name],\n\nQuick take on arXiv:2607.17504. The core idea is worth your time: instead of making inversion fail or look distorted, DecoyFace steers the reconstruction toward a plausible decoy identity while keeping the authorized server able to verify the true identity. The reconstruction-sensitive subspace decomposition via proxy gradient covariance (Section IV-B) and the server-side canonicalization are new relative to the cited PPFR baselines, and the paper does cover the HBC server case, which most prior work skips. The experimental sweep is broad: seven benchmarks, two attacker families, and ablations for every component. The recognition accuracy holds up (LFW 99.77%, IJB-C 93.35% TAR@1e-4). So the contribution is real.\n\nThe soft spots are substantial, though. The biggest one: the malicious-attacker evaluation probably does not instantiate the paper's own threat model. Section III-A says the attacker has black-box query access to the client and trains on queried pairs {x_i, z_i}. Since the deployed client emits protected features z_t, an adaptive attacker would train on (x_i, z_t(x_i)). Section V-B only says both attackers were 'trained on CelebA for 100,000 iterations' and never says whether the training features were clean or protected. The RSSD proxy is explicitly a clean-feature U-Net, so it's plausible the evaluated attackers are also clean-feature. If so, Tables III-VII measure transfer from a non-adaptive attacker, and the 2.93% and 0.74% ILR numbers don't reflect the stated adversary. This is load-bearing because the defense depends on the attacker being unable to exploit the K=3 true-sample complementary groups that must remain for 91%+ verification accuracy. The HBC experiment does train on the protected canonicalized features, but the analogous adaptive training for the malicious attacker is missing.\n\nSecond, the 'controllable' claim is weaker than the title suggests. The only reported decoy-hit ratio (DHR) is 30.19% in the ablation (Table IX), and the main tables omit it. So most redirected reconstructions go to some non-original identity, not the intended decoy. That's still a useful property, but it's not really 'controllable misdirection' at the level claimed.\n\nThird, the identity metrics depend on an unspecified closed-set gallery T and face-validity threshold theta_f, so the numbers aren't reproducible as reported. The free-parameter list is long, and the sensitivity of DHR to K is sharp (2.63% ILR at K=3, 83% at K=4), which suggests the operating point is narrow.\n\nNet: this is a legitimate new direction and the paper deserves a serious referee, but it needs major revision—adaptive attackers, DHR in the main tables, defined metrics, and ideally code—before the central claims can be trusted.\n\nBest,\n[Your name]","headline":"DecoyFace has a genuinely new idea—misdirection instead of obfuscation—but the privacy numbers are probably measured against non-adaptive attackers, and the 'controllable' part is a 30% hit rate.","tokens_in":21028,"tokens_out":3991,"would_cite":false,"duration_ms":35562,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DecoyFace argues that privacy protection in split face recognition should steer unauthorized reconstructions toward a plausible decoy identity instead of degrading them, while preserving authorized verification.","keywords":["face recognition","privacy-preserving face recognition","feature inversion attack","split inference","decoy identity misdirection","subspace decomposition","honest-but-curious server","identity leakage"],"falsifier":"Train an inversion model directly on DecoyFace's protected features rather than on clean features, and measure the top-1 identity match; if the identity leakage ratio rises well above the reported 0.7% to 3.9% under this adaptive attacker, the subspace-decomposition premise is wrong. Concretely, compute the reconstruction-loss gradient covariance restricted to the complementary subspace P_N and check whether perturbing a few P_N components produces a recognizable original identity.","tokens_in":19993,"feed_emoji":"🎭","tokens_out":4873,"duration_ms":45983,"temperature":0.7,"pith_summary":"DecoyFace claims that privacy in split face recognition is best protected not by making reconstructions fail, but by making them succeed at the wrong identity. It decomposes the transmitted feature into a reconstruction-sensitive subspace, where decoy identity cues are injected, and a complementary subspace, which carries only sparse recognition-relevant evidence. The authorized server suppresses the decoy component through a matched canonicalization module and still verifies the true identity. Experiments report competitive recognition accuracy, with LFW at 99.77% and IJB-C at 93.35% TAR@FAR=10^-4, while identity leakage drops to 2.93% under a U-Net attacker and 0.74% under a flow-matching attacker, with face validity above 99.78%.","feed_headline":"DecoyFace turns leaked face features into a plausible wrong identity","feed_subtitle":"Verification still passes while inversion recovers a different, realistic face; identity leakage drops below 3 percent.","key_machinery":"Reconstruction-Sensitive Subspace Decomposition (RSSD): an eigendecomposition of the covariance of reconstruction-loss gradients, computed with a proxy inversion network; the top eigenvectors define the reconstruction-sensitive subspace (RSS) used for decoy injection. Decoy-Guided Coherent Mixing (DGCM): channel-shuffled grouping with instance normalization, a routing mask that keeps a small number of true-sample groups, and replacement of the remaining groups with auxiliary decoy complementary groups, with a coherent subset sharing few sources. Authorized Canonicalization Module (ACM): projection onto the complementary subspace, group-wise quantile calibration, addition of a fixed mean RSS","core_discovery":"The central claim is that a single intermediate feature can be split into a reconstruction-sensitive subspace, where decoy identity cues dominate, and a complementary subspace, where only sparse true-identity evidence survives. This split lets an attacker reconstruct a plausible but wrong identity while an authorized server, using matched projection and calibration, still verifies the true identity. The server-side projection cancels the decoy component exactly because decoy cues lie in the range of P_rec and P_N P_rec = 0, and the remaining complementary carrier, after group-wise quantile calibration and a fixed RSS anchor, is discriminative but not reconstructable. The paper demonstrates t","pith_inferences":["If the subspace is truly attacker-agnostic, the same decomposition could be estimated from a stronger or black-box proxy, such as a diffusion-based inversion model, to raise the bar against advanced attackers; the paper does not test this directly.","The sharp rise in identity leakage when the number of preserved true-sample groups goes from 3 to 4 suggests a cliff between enough signal for verification and too much for reconstruction, implying that per-sample adaptive group selection could widen the safe operating range.","The separation principle could transfer to other split-inference tasks, such as speaker verification or medical-image classification, wherever reconstruction-sensitive and task-relevant directions can be separated; only faces are evaluated here."],"forward_implications":["An eavesdropper who inverts the transmitted feature gets a realistic face of the wrong identity, making the presence of protection harder to detect.","An honest-but-curious server that runs the canonicalization pipeline still cannot reconstruct the true identity: identity leakage stays below 0.34% on the tested benchmarks while face validity remains above 99.9%.","Authorized verification accuracy remains competitive, so utility and misdirection are not mutually exclusive.","Changing the selected decoy changes the identity of the reconstruction under both U-Net and flow-matching attackers, giving the defender controllable redirection."],"fun_headline_variants":["DecoyFace: real verification, fake reconstruction","Attacker gets a plausible wrong face, server gets you","DecoyFace: realistic decoys cut identity leakage to 3%","Leaked face features? DecoyFace sends a decoy identity","Privacy: wrong face for attackers, right face for servers"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the reconstruction-sensitive subspace estimated from one proxy attacker's gradient covariance is the same subspace any real attacker would rely on, and that the complementary subspace carries no exploitable identity evidence; if an attacker is sensitive to the complementary subspace or trains on protected features, identity leakage can return.","fun_headline_variants_meta":{"raw":{"variants":["DecoyFace: real verification, fake reconstruction","Attacker gets a plausible wrong face, server gets you","DecoyFace: realistic decoys cut identity leakage to 3%","Leaked face features? DecoyFace sends a decoy identity","Privacy: wrong face for attackers, right face for servers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00027,"raw_usage":{"total_tokens":1470,"prompt_tokens":759,"completion_tokens":711,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":503,"completion_tokens_details":{"reasoning_tokens":627}},"tokens_in":503,"tokens_out":711,"duration_ms":7298,"temperature":1.0,"reasoning_tokens":627,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T17:46:58.844751+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train an inversion model directly on DecoyFace's protected features rather than on clean features, and measure the top-1 identity match; if the identity leakage ratio rises well above the reported 0.7% to 3.9% under this adaptive attacker, the subspace-decomposition premise is wrong. Concretely, compute the reconstruction-loss gradient covariance restricted to the complementary subspace P_N and check whether perturbing a few P_N components produces a recognizable original identity.","supporting_citations":[],"review_version":1}