KAN See Your Face

Dong Han; Joachim Denzler; Yong Li

REVIEW 5 major objections 5 minor 1 cited by

KAN See Your Face

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A KAN-based mapping reconstructs faces from privacy-preserving embeddings

desk verdict The paper shows a plausible embedding-mapping attack against PPFR models, but the headline ASR numbers may not survive an identity-disjoint split, and the paper never reports ASR on unseen identities. read the letter →

arxiv 2411.18165 v1 pith:2RCTAVNI submitted 2024-11-27 cs.CV

Dong Han , Yong Li , Joachim Denzler This is my paper · ORCID

classification cs.CV

keywords facereconstructionprivacy-preservingrecognitionembeddinginversionKolmogorov-ArnoldNetworkdiffusionmodeltemplateprotectionattacksuccessratepartialleakage

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Face embeddings are compact identity templates, but this paper shows they can be mapped back into recognizable face images. The authors train Face Embedding Mapping (FEM) models, an MLP variant and a Kolmogorov-Arnold Network variant (FEM-KAN), to translate embeddings from standard face recognition and privacy-preserving face recognition (PPFR) models into the embedding space of a pre-trained IPA-FaceID diffusion generator. On black-box verification, the best mapping lifts attack success from a roughly 5% baseline to 67.6% average for the DCTDP PPFR model, and it also works from partially leaked and MLP-Hash-protected embeddings. The paper positions this as the first inversion of PPFR embeddings into realistic faces, exposing a privacy gap in systems meant to protect face templates.

What carries the argument

The load-bearing object is the Face Embedding Mapping (FEM) model, and in particular FEM-KAN, a Kolmogorov-Arnold Network that replaces fixed activation functions with learnable univariate functions on the edges so it can fit the non-linear distribution shift between the target model's embedding space and the default FR embedding space used by IPA-FaceID. FEM is trained on paired embeddings $\mathbf{e}_i$ from the default FR model and $\mathbf{e}'_i$ from the target model, extracted from the same images, using a joint loss of mean-square error, pairwise Euclidean distance, and cosine embedding distance. At inference, the trained FEM maps a leaked embedding into the IPA-FaceID embedding domain and the diffusion model turns it into a face image.

What would settle it

Train FEM-KAN on paired embeddings from real-world face datasets rather than synthetic Arc2Face-generated identities, then evaluate attack success on an unseen real-world identity set; if the average attack success rate falls to the roughly 5% no-mapping baseline, the transferability claim is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that a supervised embedding-to-embedding mapping, learned from paired embeddings of the same identities, transfers across face recognition backbones well enough that a pre-trained IPA-FaceID diffusion model can regenerate realistic, verifiable face images from a target model's embeddings. The FEM-KAN variant, which uses learnable univariate activations at network edges, outperforms the MLP variant on most PPFR targets and is presented as the first method to invert embeddings from privacy-preserving face recognition models, reaching 67.6% average attack success rate against black-box verifiers for DCTDP. The mapping also extends to zero-padded partial embeddings and to MLP-Hash-protected embeddings, while PolyProtect-protected embeddings largely resist the attack under the tested parameters.

Load-bearing premise

The FEM is trained on paired embeddings extracted from synthetic faces generated by Arc2Face, and the paper assumes this supervised mapping transfers to real-world identities and to zero-padded partial or protected embeddings without adaptation.

Editorial extensions

If this is right

For each tested FR and PPFR model, a leaked 512-dimensional embedding can be turned into realistic faces that black-box verifiers accept at rates roughly an order of magnitude above the no-mapping baseline.
Zero-padding a partial embedding down to 10% of its values still permits reconstruction, so splitting embeddings across servers does not in itself prevent identity leakage.
MLP-Hash-protected embeddings remain vulnerable under the tested fixed-seed setting, with FEM-KAN reaching 71.6% attack success on ArcFace.
PolyProtect with the tested parameters resists the mapping, with attack success staying near the no-mapping baseline.
FEM-KAN's advantage over FEM-MLP is largest on PPFR targets, indicating learnable univariate activations fit the larger distribution shift introduced by privacy-preserving transforms.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural but untested consequence is that reconstruction fidelity is capped by the pre-trained IPA-FaceID generator's own demographic biases; the paper's lower success on African identities and on male faces likely reflects generator bias, so debiasing the generator would be needed to make reconstruction fair.
The PolyProtect failure suggests a concrete design rule for template protection: schemes that non-linearly expand the value range with user-specific parameters resist this mapping better than schemes that preserve the embedding's original scale.
The MLP-Hash result with a fixed seed implies that seed secrecy is the real protection; if the seed is shared or leaks, binarized embeddings are about as invertible as plain ones.
The paper trains on synthetic faces, so a natural extension is to measure how the mapping degrades on real faces with pose, lighting, and aging variation, which the current Synth-500 test does not fully capture.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First, what to know: this is a reasonable empirical paper that combines a KAN/MLP mapping network with the pre-trained IPA-FaceID diffusion model to invert face embeddings from normal and privacy-preserving face recognition models. The experiments are broad: partial embeddings, PolyProtect/MLP-Hash protected embeddings, and racial bias. The writing is clear and the authors are honest about the PolyProtect failure, which is a point in their favor.

What's new: using KAN as the mapping network is a minor extension, not a conceptual jump. The real novelty is targeting PPFR models (DCTDP, HFCF, PartialFace) with this embedding-to-embedding mapping. That is a legitimate application. The MLP baseline is fair, and the ablation on loss functions is useful.

Where it gets soft: the stress-test concern is real. The training set is 5000 images generated from a subset of CelebA-HQ, five images per identity. Table 1 reports ASR "on CelebA-HQ" but never states that the evaluation identities are disjoint from training. If they overlap, the FEM can memorize per-identity pairs, and the 60-67% ASR numbers are inflated. The paper evaluates Synth-500, which has never-before-seen identities, but only reports image quality metrics there, not ASR. Figure 4 shows the cosine similarity distribution on Synth-500, and most samples sit around 0.1, which is consistent with failed verification. So the central attack scenario—an adversary reconstructs an arbitrary new victim's face—is not actually demonstrated. That is the load-bearing claim, and it is unsupported.

Other issues are secondary: no error bars, no comparison against the prior GAN-based inversion of Otroshi Shahreza & Marcel, and the loss weights are tuned on the evaluation dataset. No code release either.

Who this is for: people working on template inversion or PPFR robustness. It is a useful cautionary data point if the identity-disjoint evaluation holds up, but right now the evidence for practical transfer is missing.

Recommendation: send it to peer review, but require a clear identity-disjoint split for the ASR tables and an ASR number on Synth-500. If the ASR collapses on unseen identities, the paper's significance drops to a modest within-field observation.

Referee Report

5 major / 5 minor

Summary. The paper proposes Face Embedding Mapping (FEM), a learned embedding-to-embedding transformation in two variants (FEM-KAN and FEM-MLP), trained on paired embeddings from a target face recognition or privacy-preserving face recognition (PPFR) model and the default IPA-FaceID embedding space, so that a pre-trained IPA-FaceID diffusion model can reconstruct face images from target-model embeddings. Experiments report attack success rates (ASR) against four black-box verifiers on CelebA-HQ, image-quality metrics on the Synth-500 out-of-distribution set, robustness to partial and protected embeddings (PolyProtect, MLP-Hash), and demographic bias on RFW. The headline result is that FEM raises ASR from single-digit baselines to roughly 55-68% on CelebA-HQ, with FEM-KAN generally outperforming FEM-MLP.

Significance. If the generalization claims hold, this is a practically relevant demonstration of template inversion against modern PPFR systems, and it is apparently the first application of KAN to embedding-to-face inversion. The paper's strengths include a clear problem formulation, evaluations across multiple target models and verifiers, a partial-leakage study, an honest negative result for PolyProtect, and a candid discussion of the limits of generic image-quality metrics. However, the current experimental design does not establish that the FEM's success transfers to identities unseen during training, which is the core property needed for a realistic attack scenario. The lack of identity-disjoint ASR results and the absence of comparisons with prior inversion methods leave the central claims only partially supported.

major comments (5)

[§4.1, §5.1, Table 1] The CelebA-HQ ASR experiments do not state whether the evaluation identities are disjoint from the 1,000 identities used to build the 5,000-image training set. If Table 1 uses the same identities, the FEM could memorize per-identity embedding pairs, and the reported ASR would not reflect a realistic attack on unseen identities. Please specify the evaluation split explicitly and report ASR on an identity-disjoint CelebA-HQ split.
[§5.2, Table 3, Figure 4] For the out-of-distribution Synth-500 set, only image-quality metrics (FID, PSNR, SSIM, MMD, LPIPS) are reported, and Figure 4 shows that most FEM-mapped samples have cosine similarity around 0.1, which is below a typical verification threshold. Without an ASR measurement on Synth-500 at the same FAR=0.01 used elsewhere, the claim of generalization to never-before-seen identities is unsupported; please add identity-disjoint ASR results.
[§3.3, §5.5, Table 6] The joint-loss weights are described as empirically chosen to yield the best ASR, but the paper does not state whether this selection was made on a validation split disjoint from the CelebA-HQ evaluation set, and no variance over random seeds or model initializations is reported. Please specify the tuning protocol and add multiple-seed results or error bars to support the comparative claims between FEM-MLP and FEM-KAN.
[§5.1, Table 1] The paper reports only a 'None' baseline and its own FEM variants; it does not compare against existing face reconstruction methods (e.g., Shahreza et al. 2022a; Otroshi Shahreza & Marcel 2024) under the same target-model and verifier settings. As a result, the claimed advantage of the diffusion-based pipeline over prior inversion methods is not established; please add comparisons to these prior approaches on matching protocols.
[Abstract, §1, §5.4, Table 5] The abstract and contribution list state that FEMs can reconstruct faces from protected embeddings, but the PolyProtect results in Table 5 show ASR of 5.0-15.6%, close to the baseline. Please restrict the claim to the successful MLP-Hash case or explicitly qualify the scope of the protected-embedding claim.

minor comments (5)

[§3.3] The text says 'MES loss' in Equation (2) but should be 'MSE loss'.
[§4.1] The text says 'PEM-MLP' where 'FEM-MLP' is intended; the same typo appears in Table 2 and in §5.4 as 'FMEs'.
[§4.1] The hidden-layer structure is specified for FEM-MLP but not for FEM-KAN (e.g., grid size, spline order, number of layers); please provide these details for reproducibility.
[§5.5, Table 6] The target model is called 'IR50' in Table 6 but 'IRSE50' elsewhere; please unify the naming.
[§5.2, Figure 4] The figure caption does not specify exactly which embeddings are compared (target-model embedding of the original image vs. embedding of the reconstructed image) or the histogram binning; please clarify.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the FEM is a supervised embedding regressor trained on paired embeddings and evaluated against independent verifiers.

full rationale

The paper's only fitted component is the face embedding mapping M, trained with Eq. (5) to minimize MSE, pairwise distance, and cosine distance between the mapped target embedding and the IPA-FaceID default embedding on paired training examples. This is standard supervised regression, not a quantity that is defined in terms of the claimed output. The headline ASR results in Table 1 are obtained by feeding images generated from the mapped embeddings to four external FR verifiers (FaceNet, VGG-Face, GhostFaceNet, ArcFace), none of which is used to train the FEM, so the evaluation does not reduce to the training objective by construction. The self-citations to Han et al. (2024a,b) supply the HFCF and HFCF-SkinColor target models, which are legitimate experimental targets rather than load-bearing justifications for the method's validity. The KAN construction is motivated by the Kolmogorov-Arnold representation cited to Liu et al. (2024), but the empirical attack results do not depend on that theorem. The paper also honestly reports a failure on PolyProtect (§5.4) and acknowledges in Appendix A.4 that image-quality metrics do not align with perceptual similarity. The strongest methodological concern, whether the CelebA-HQ identities used for ASR in Table 1 overlap with the 5,000 training identities described in §4.1, is an evaluation-validity and generalization question rather than a demonstrable circularity: the paper does not state the split, but one cannot exhibit from the text a specific reduction in which the prediction is forced by the fitted parameters. Accordingly, no circular step meets the evidentiary standard, and the derivation chain is self-contained with respect to the external benchmarks reported.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper's central apparatus is an empirical mapping; its only mathematical axiom is the Kolmogorov-Arnold representation, used as motivation. The load-bearing assumptions are domain assumptions about the transferability of a learned embedding mapping, which the experiments partially validate and partially contradict (PolyProtect).

free parameters (2)

Loss weights lambda1, lambda2, lambda3 = 1, 0.5, 10
Selected empirically in Section 3.3 as 'best performance' on the evaluation dataset, then fixed for all experiments.
FEM hidden layer sizes = [512, 1024, 3072, 512]
Chosen by hand for FEM-MLP; the same structure is implied for FEM-KAN but not explicitly specified.

assumptions (4)

standard math Kolmogorov-Arnold representation theorem: any continuous multivariate function can be expressed as a finite sum of univariate functions.
Used to motivate the KAN architecture in Section 3.1.
domain assumption A learnable deterministic mapping exists between the embedding spaces of different face recognition models for the same identity.
Stated in Section 3.4: 'We assume there is a transformation or mapping algorithm between embeddings from the same identity that are extracted by different backbones.'
domain assumption IPA-FaceID's embedding space is a valid target domain: closeness in embedding space implies identity-preserving generation.
The training loss in Section 3.3 minimizes distance between mapped and default embeddings, assuming this transfers to generation quality.
domain assumption The training set of synthetic faces is representative of real-world test identities.
Section 4.1 generates 5000 synthetic images; generalization is then tested on CelebA-HQ and Synth-500.

how reviews work

0 comments

Cite this review

Pith. "Pith review of KAN See Your Face." pith.science (2026). https://pith.science/paper/2RCTAVNI

@misc{pith2026241118165,
  author       = {Pith},
  title        = {Pith review of: KAN See Your Face},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2RCTAVNI}},
  note         = {Machine review of arXiv:2411.18165}
}

read the original abstract

With the advancement of face reconstruction (FR) systems, privacy-preserving face recognition (PPFR) has gained popularity for its secure face recognition, enhanced facial privacy protection, and robustness to various attacks. Besides, specific models and algorithms are proposed for face embedding protection by mapping embeddings to a secure space. However, there is a lack of studies on investigating and evaluating the possibility of extracting face images from embeddings of those systems, especially for PPFR. In this work, we introduce the first approach to exploit Kolmogorov-Arnold Network (KAN) for conducting embedding-to-face attacks against state-of-the-art (SOTA) FR and PPFR systems. Face embedding mapping (FEM) models are proposed to learn the distribution mapping relation between the embeddings from the initial domain and target domain. In comparison with Multi-Layer Perceptrons (MLP), we provide two variants, FEM-KAN and FEM-MLP, for efficient non-linear embedding-to-embedding mapping in order to reconstruct realistic face images from the corresponding face embedding. To verify our methods, we conduct extensive experiments with various PPFR and FR models. We also measure reconstructed face images with different metrics to evaluate the image quality. Through comprehensive experiments, we demonstrate the effectiveness of FEMs in accurate embedding mapping and face reconstruction.

Figures

Figures reproduced from arXiv: 2411.18165 by the authors.

**Figure 2.** Pipeline of face reconstruction by face embedding mapping. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Two variants of FEM models and the process of embedding-to-embedding mapping. (a) [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Cosine similarity distributions between input and generated faces from FEMs. ArcFace is used as target model to extract embeddings from Synth-500. FEMs are trained on FFHQ dataset. As shown in [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 5.** Figure 5: Reconstructed faces by FEM-KAN from different percentage of embedding leakage. [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

**Figure 6.** Figure 6: Reconstructed faces from protected embeddings. Considering more strict to the accessing original embeddings that directly computed by the feature extractor of PPFR models, we test FEMs on face embeddings that being protected by particular embedding protection algorith…

**Figure 7.** Figure 7: Failed samples from HFCF. The red and green symbol indicate generated face image passed and failed in face verification. Failed cases and bias. Although the pretrained IPA-FaceID has ability to generate face image even on “weak” face embedding which is not accuratel…

**Figure 8.** Figure 8: Image quality metrics are not perfect align with visual similarity. Samples are taken from [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Efficiency Bottlenecks of Convolutional Kolmogorov-Arnold Networks: A Comprehensive Scrutiny with ImageNet, AlexNet, LeNet and Tabular Classification
cs.CV 2025-01 reject novelty 5.0 of 10

CKANs are measurably less efficient than standard CNNs, and on ImageNet the accuracy gap is large, but the paper's baseline and timing comparisons are not controlled.

Reference graph

Works this paper leans on

13 extracted references · 8 canonical work pages · cited by 1 Pith paper

[5]

Arc2face: A foundation model of human faces

Foivos Paraperas Papantoniou, Alexandros Lattas, Stylianos Moschoglou, Jiankang Deng, Bernhard Kainz, and Stefanos Zafeiriou. Arc2face: A foundation model of human faces. arXiv preprint arXiv:2403.11641,

arXiv
[6]

Deep face recognition

Omkar Parkhi, Andrea Vedaldi, and Andrew Zisserman. Deep face recognition. In BMVC 2015- Proceedings of the British Machine Vision Conference

work page 2015
[7]

U-net: Convolutional networks for biomed- ical image segmentation

Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomed- ical image segmentation. In Medical image computing and computer-assisted intervention– MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceed- ings, part III 18 , pp. 234–241. Springer,

work page 2015
[9]

Instantid: Zero-shot identity- preserving generation in seconds

Qixun Wang, Xu Bai, Haofan Wang, Zekui Qin, and Anthony Chen. Instantid: Zero-shot identity- preserving generation in seconds. arXiv preprint arXiv:2401.07519, 2024a. Tao Wang, Yushu Zhang, Xiangli Xiao, Lin Yuan, Zhihua Xia, and Jian Weng. Make privacy renewable! generating privacy-preserving faces supporting cancelable biometric recognition. In ACM Mult...

arXiv 2024
[2006]

Vggface2: A dataset for recognising faces across pose and age

Qiong Cao, Li Shen, Weidi Xie, Omkar M Parkhi, and Andrew Zisserman. Vggface2: A dataset for recognising faces across pose and age. In 2018 13th IEEE international conference on automatic face & gesture recognition (FG

work page 2018
[2015]

Face reconstruction from partially leaked facial embeddings

Hatef Otroshi Shahreza and S ´ebastien Marcel. Face reconstruction from partially leaked facial embeddings. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 4930–4934. IEEE, 2024a. Hatef Otroshi Shahreza and S ´ebastien Marcel. Breaking template protection: Reconstruction of face images from protec...

work page 2024
[2016]

Besides, we use default training configurations for PartialFace implementation (Mi et al., 2023)9, 27 random sub channels are selecting for training

Optimizer SGD Loss Function ArcFace Epoch 24 Batch Size 128 For the detailed setting of ArcFace loss, scale s = 64 , weight w = 1 .0 and margin m = 0 .3. Besides, we use default training configurations for PartialFace implementation (Mi et al., 2023)9, 27 random sub channels are selecting for training. The only two differences are that we use ResNet34 as ...

work page 2023
[2017]

Progressive growing of gans for improved quality, stability, and variation

Tero Karras. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv:1710.10196,

arXiv

Show all 13 references

[2018]

During the training stage of PartialFace, the input RGB image is transferred into the frequency do- main by discrete cosine transform (DCT) (Ahmed et al., 1974)

dataset for training in order to have the same setting with other PPFR models implementation in our work. During the training stage of PartialFace, the input RGB image is transferred into the frequency do- main by discrete cosine transform (DCT) (Ahmed et al., 1974). The initi...

1974
[2021]

Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models

Hu Ye, Jun Zhang, Sibo Liu, Xiao Han, and Wei Yang. Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models. arXiv preprint arXiv:2308.06721,

arXiv
[2022]

Robust skin color driven privacy-preserving face recognition via function secret sharing

Dong Han, Yufan Jiang, Yong Li, Ricardo Mendes, and Joachim Denzler. Robust skin color driven privacy-preserving face recognition via function secret sharing. In 2024 IEEE International Con- ference on Image Processing (ICIP), pp. 3965–3971. IEEE, 2024a. Dong Han, Yong Li, and...

2024
[2023]

PPFR models have much lower accuracy on non-Caucasians than Caucasians

94.23 89.27 90.76 87.70 As depicted in Table 10, we test PPFR models that used in our work on RFW dataset to show the racial bias. PPFR models have much lower accuracy on non-Caucasians than Caucasians. 9https://github.com/Tencent/TFace/tree/master/recognition/tasks/partialfac...

2022
[2024]

Kan: Kolmogorov-arnold networks

Ziming Liu, Yixuan Wang, Sachin Vaidya, Fabian Ruehle, James Halverson, Marin Solja ˇci´c, Thomas Y Hou, and Max Tegmark. Kan: Kolmogorov-arnold networks. arXiv preprint arXiv:2404.19756,

arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [5]

Arc2face: A foundation model of human faces

Foivos Paraperas Papantoniou, Alexandros Lattas, Stylianos Moschoglou, Jiankang Deng, Bernhard Kainz, and Stefanos Zafeiriou. Arc2face: A foundation model of human faces. arXiv preprint arXiv:2403.11641,

arXiv

[2] [6]

Deep face recognition

Omkar Parkhi, Andrea Vedaldi, and Andrew Zisserman. Deep face recognition. In BMVC 2015- Proceedings of the British Machine Vision Conference

work page 2015

[3] [7]

U-net: Convolutional networks for biomed- ical image segmentation

Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomed- ical image segmentation. In Medical image computing and computer-assisted intervention– MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceed- ings, part III 18 , pp. 234–241. Springer,

work page 2015

[4] [9]

Instantid: Zero-shot identity- preserving generation in seconds

Qixun Wang, Xu Bai, Haofan Wang, Zekui Qin, and Anthony Chen. Instantid: Zero-shot identity- preserving generation in seconds. arXiv preprint arXiv:2401.07519, 2024a. Tao Wang, Yushu Zhang, Xiangli Xiao, Lin Yuan, Zhihua Xia, and Jian Weng. Make privacy renewable! generating privacy-preserving faces supporting cancelable biometric recognition. In ACM Mult...

arXiv 2024

[5] [2006]

Vggface2: A dataset for recognising faces across pose and age

Qiong Cao, Li Shen, Weidi Xie, Omkar M Parkhi, and Andrew Zisserman. Vggface2: A dataset for recognising faces across pose and age. In 2018 13th IEEE international conference on automatic face & gesture recognition (FG

work page 2018

[6] [2015]

Face reconstruction from partially leaked facial embeddings

Hatef Otroshi Shahreza and S ´ebastien Marcel. Face reconstruction from partially leaked facial embeddings. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 4930–4934. IEEE, 2024a. Hatef Otroshi Shahreza and S ´ebastien Marcel. Breaking template protection: Reconstruction of face images from protec...

work page 2024

[7] [2016]

Besides, we use default training configurations for PartialFace implementation (Mi et al., 2023)9, 27 random sub channels are selecting for training

Optimizer SGD Loss Function ArcFace Epoch 24 Batch Size 128 For the detailed setting of ArcFace loss, scale s = 64 , weight w = 1 .0 and margin m = 0 .3. Besides, we use default training configurations for PartialFace implementation (Mi et al., 2023)9, 27 random sub channels are selecting for training. The only two differences are that we use ResNet34 as ...

work page 2023

[8] [2017]

Progressive growing of gans for improved quality, stability, and variation

Tero Karras. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv:1710.10196,

arXiv