Pith. sign in

REVIEW 4 major objections 6 minor 44 references

Local Features Meet Stochastic Anonymization: Revolutionizing Privacy-Preserving Face Recognition for Black-Box Models

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A privacy-preserving face anonymizer claims 94.21% black-box verification accuracy by keeping local features and making the mapping stochastic, with reconstructed images reduced to an average face.

desk verdict A genuinely new combination for black-box PPFR with a promising 94% transfer result, but the privacy claim needs a much stronger attack model. read the letter →

arxiv 2412.08276 v1 pith:7NCT57QO submitted 2024-12-11 cs.CV

Yuanwei Liu , Chengyu Jia , Ruqi Xiao , Xuemai Jia , Hui Wei , Kui Jiang , Zheng Wang This is my paper · ORCID
classification cs.CV
keywords privacy-preservingfacerecognitionblack-boxanonymizationlocalfeaturesstochasticinjectionreconstructionattackFourierhigh-passfilteringensembleoptimization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to establish that privacy-preserving face recognition can work for black-box recognition models, not just for the specific model a protection scheme was trained on. The observation is that face recognition models identify people from local details like contours, edges, and skin texture, whereas human viewers read the global structure of a face; so a transform that removes the global structure and keeps the local structure can anonymize for humans while remaining usable for machines. The paper makes this transform non-deterministic by filling pruned image regions with stochastic values and adding multi-scale temporal noise under an entropy-increasing loss, so that the anonymization cannot be learned and inverted by a reconstruction network. On this basis it reports an average recognition accuracy of 94.21% across six mainstream face recognition models under a black-box protocol, with lower image similarity scores after reconstruction attacks than prior methods.

What carries the argument

The load-bearing object is a stochastic identity-preserving transform. Its core pieces are a Fourier high-pass filter $H(u,v) = \mathbb{I}[\sqrt{u^2+v^2} > \omega_C]$ that removes global facial structure while keeping high-frequency microstructure; a stochastic nonlinear fill $R(x,y) \sim \mathcal{N}(\mu(x,y), \sigma(x,y)\kappa)$ that replaces the removed regions with random values; multi-scale temporal noise $N'(x,y,\sigma) = \sum_{k=0}^{n} \varepsilon^k N(\tau^k x/\lambda, \tau^k y/\lambda, \sigma)$ that makes each anonymization iteration different; and an entropy regularizer $H(X) = -\sum_i p(X_i)\log p(X_i)$ that drives pixel distributions toward disorder. These are combined in a momentum-based iterative optimizer, $X_{t+1} = X_t + N'(x,y,\sigma)\alpha(\mu g_t + \nabla_X L_{\mathrm{total}}(X_t)/\|\nabla_X L_{\mathrm{total}}(X_t)\|_p)$, with $L_{\mathrm{total}} = \sum_i \beta_i f_i(X, X_t) + \gamma E(H(X_t))$, so that recognition loss from an ensemble of surrogate face models and entropy pressure are optimized together. The stochastic components are what make the transform irreversible: reconstruction networks cannot learn a stable inverse mapping from $(X, X')$ pairs.

What would settle it

An evaluator could take a face recognition model outside the tested six with a different architecture or training domain, run the anonymized images through it, and measure verification accuracy; if it approaches the near-zero level of the prior methods instead of 94.21%, the black-box transfer claim collapses. Separately, train a reconstruction network on a large set of anonymized pairs generated with different noise seeds and test whether the reconstructed faces can be matched to the originals; if they can, the claimed irreversibility of the stochastic injection fails.

Watch

Extended reading notes

Core claim

On its own terms the paper's central claim is that the hard part of privacy-preserving face recognition is not the recognizer but the mapping from a face image to a protected image. Because CNN face recognizers rely on local microstructure rather than the global face layout that humans perceive, the paper keeps the local detail and replaces global structure with stochastic noise. The protected image is generated by Fourier high-pass filtering, randomized filling of the removed regions, iterated addition of multi-scale temporal noise, and an entropy-increasing regularizer, which together make the mapping non-deterministic. The paper reports that under a black-box protocol where the evaluated model is excluded from the optimization ensemble, the method retains an average verification accuracy of 94.21% on five face datasets and six face recognition models, while reconstruction networks trained on anonymized pairs recover only an average face, with SSIM and PSNR lower than the compared methods.

Load-bearing premise

The load-bearing premise is that a pool of six standard convolutional face recognizers represents the black-box models a deployment would actually meet; if real-world face recognizers rely on different local features or different preprocessing, the preserved local structure may not transfer and the 94.21% average would not hold.

Editorial extensions

If this is right

  • Anonymized images can be handed to existing face recognition models without retraining or a dedicated feature codec, because the retained local features are the generic cues CNN recognizers use.
  • A reconstruction model trained on a large set of anonymized pairs learns no stable inverse; its output converges to an average face rather than the target identity.
  • The method's black-box transfer depends on ensemble diversity: with one or two surrogate models accuracy is much lower, and three or more are needed to reach the reported level.
  • Since the comparison baselines drop below 2% black-box accuracy, 94.21% is the method's claimed separation from prior reversible-encoding approaches, not an incremental improvement.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Not in the paper: if the local-feature hypothesis is general, the same recipe of preserving edge and texture microstructure while destroying global layout and injecting stochasticity could extend to privacy-preserving recognition of other biometrics such as gait or iris, though only faces are tested.
  • Not in the paper: an averaging attack is a natural next test; if an adversary collects many stochastic anonymizations of the same identity and denoises them, the identity might resurface, and that attack is not evaluated.
  • Not in the paper: the reported accuracy is measured against recognizers that share a CNN inductive bias, so a deployment recognizer built on a different architecture or preprocessing pipeline would test whether the transfer claim holds beyond the six-model pool.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a privacy-preserving face recognition (PPFR) method built on the observation that machine face recognizers rely on local features more than global ones. A source image is high-pass filtered in the Fourier domain, the discarded regions are filled with stochastic Gaussian values, and the resulting image is iteratively updated with multi-scale temporal noise under a momentum-driven ensemble recognition loss plus an entropy regularization term. The authors report 94.21% average verification accuracy on six black-box face recognition models across five datasets, lower SSIM between original and anonymized images than four prior methods, and lower SSIM/PSNR after a U-net reconstruction attack. The core claims are that the method transfers to black-box models without retraining and that the stochastic injection makes the anonymization irreversible.

Significance. Should the accuracy result hold, the local-feature-preservation idea with ensemble optimization is a useful step for PPFR: it would decouple anonymization from a specific recognition architecture and avoid the per-model retraining required by frequency-domain baselines. The evaluation is designed to avoid the most obvious circularity, since the target model is excluded from the optimization ensemble; the reported Table 4 numbers are internally consistent, and the qualitative comparison in Fig. 5 is suggestive. However, the second central claim, irreversibility, is not established by the current evidence, and the black-box claim is stronger than the experiments support. The paper needs a substantially stronger privacy evaluation and a true held-out architecture/domain test before its main claims can be accepted.

major comments (4)
  1. [Sec. 3.2, Eq. (4)] The stochastic fill is mean-preserving, because R(x,y) ~ N(µ(x,y), σ(x,y)·κ) has conditional expectation µ(x,y). An adversary with several anonymized versions of the same image can therefore average them to cancel the injected randomness and expose a deterministic function of the original. This is in tension with the 'irreversible stochastic injection' claim in Sec. 1 and Sec. 3.3-3.4. The reconstruction evaluation in Sec. 4.4 and Table 3 uses a single U-net and pixel-level SSIM/PSNR only; low pixel similarity does not imply that identity is protected, since a reconstructed face can match the original identity at high rate while having low SSIM. Please add a multi-observation averaging attack, an identity-based metric on reconstructed images, and a precise definition of irreversibility (or a differential-privacy-style bound).
  2. [Sec. 4.3, Table 5] The held-out protocol correctly excludes the evaluated model from the optimization ensemble, but all six evaluated models are standard CNN face recognizers of the same general family used as surrogates. No genuinely unseen architecture or domain is tested (for example, a ViT-based face recognizer or a commercial black-box API), so the abstract's claim that the method 'works on black-box models' is an extrapolation. Please add at least one held-out architecture/domain outside the pool, or restrict the claim to CNN recognizers of this type.
  3. [Sec. 4.5, Table 5 vs. Table 2] Table 5 reports 61.00% for FaceNet with an ensemble of three models, while Table 2 reports 92.00% for FaceNet on LFW with the full method. The text concludes that a minimum of three models is sufficient, but for FaceNet the fourth model appears to be necessary, and the configuration underlying the headline 94.21% is not uniquely specified. Please reconcile the two tables and state which ensemble size produced the results in Tables 2 and 4.
  4. [Sec. 3.2-3.5] Key hyperparameters are missing (ω_C, κ, α, momentum µ, ensemble weights β_i, entropy weight γ, number of noise orders n, persistence ε, scales τ and λ, and the number of optimization iterations), and no code is provided. Because the method is an iterative optimization procedure, these choices are load-bearing for reproducing the 94.21% average. Please report the full configuration and include standard deviations or confidence intervals for the percentages in Tables 2-6.
minor comments (6)
  1. [Sec. 3.2, Eq. (3)] The inverse-transform normalization is written as 1/(MN), but the transform in Eq. (1) is over an H×W image; this should be 1/(HW).
  2. [Sec. 3.2, after Eq. (4)] The sentence 'N (x, y) represents a normal distribution where the mix is the mean' should read 'where µ(x,y) is the mean'.
  3. [Sec. 3.3, Eq. (5)] The smoothing function φ(x−i, y−i) appears to use the same index i in both coordinates; if the second coordinate should be y−j, please correct it.
  4. [Fig. 1] The caption labels (a) as 'Lack of robust privacy protection' and (b) as 'Limited adaptability to black-box scenarios', but the panel headings are the reverse; please align them.
  5. [Tables 1 and 4] Dataset names are inconsistent ('C ELEBA', 'CELEB A', 'CELEBA', 'A GEDB'); standardize to CelebA and AgeDB.
  6. [Tables 2 and 5] 'Moblienet' should be 'MobileNet'.

Circularity Check

1 steps flagged · score 6.0 of 10

Partial circularity in the privacy claim: Equation (4) defines the stochastic fill as zero-mean noise around the original image's color statistics, so the claimed 'irreversible' anonymization reduces to a deterministic function of the input in expectation; the black-box accuracy result is not circular.

  1. self definitional [Sec. 3.2, Eq. (4)]
    "the remaining areas are filled using a stochastic nonlinear function R(x, y), R(x, y) ∼ N(µ(x, y), σ(x, y) · κ). ... This step ensures that only the most critical local features are retained, while the randomized treatment of other regions strengthens the anonymization and mitigates the risk of reconstructing the original image."

    The paper defines µ(x,y) and σ(x,y) from the original image's color statistics, so by construction E[R(x,y)] = µ(x,y): the stochastic component is zero-mean noise around a deterministic function of the very global color information the high-pass filter was meant to remove. The 'irreversible stochastic injection' conclusion is therefore not derived; it is assumed by labeling a mean-preserving random fill as irreversible. Averaging multiple anonymized versions cancels the noise and recovers µ(x,y), and a squared-error reconstruction model can learn the conditional mean. The anti-reconstruction prediction reduces, by the paper's own equation, to a deterministic function of the input, making the privacy claim self-definitional rather than established.

full rationale

The black-box accuracy chain is not circular: Table 5 states that 'the model indicated by the column header is excluded from the optimization process for that model, ensuring a fully black-box setup,' so the reported recognition accuracy is transfer to held-out models, not a fit renamed as prediction; no self-citations are load-bearing and no uniqueness theorem is imported. The partial circularity is confined to the paper's central privacy claim: Eq. (4)'s stochastic fill is mean-preserving with respect to the original image's color statistics, so the 'irreversible stochastic injection' asserted in Secs. 1 and 3.2 reduces by construction to a deterministic function of the input in expectation. This is a specific, quotable reduction rather than a vague concern. The remaining reconstruction-resistance evidence (Sec. 4.4, Tab. 3) uses only a single U-net attack scored by SSIM/PSNR, which does not test identity recovery or multi-query averaging; this missing support is weighed as part of the circularity because the claimed property is already negated by the construction of Eq. (4).

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The method has no derived physical constants; all reported numbers come from an empirical pipeline. The free parameters listed above are the main tunable choices on which the central accuracy and privacy claims depend. The axioms are the assumptions that make the method work: local-feature reliance, transferability of surrogates, and irreversibility of stochastic noise. No new particle, force, or external entity is introduced.

free parameters (6)
  • Frequency cutoff omega_C
    High-pass threshold in Eq. (2) is a hand-set hyperparameter; its value is never reported.
  • Stochastic fill scale kappa
    Scaling factor for the Gaussian filling distribution in Eq. (4); value not reported.
  • Learning rate alpha and momentum mu
    Optimizer hyperparameters in Eq. (9); values not reported.
  • Ensemble weights beta_i and entropy weight gamma
    Weights in the loss function Eq. (10); values not reported.
  • Noise schedule parameters n, epsilon, tau, lambda
    Multi-scale noise construction in Eq. (5)-(6) depends on these constants; none are reported.
  • Eye/region preservation mask
    The paper says sensitive regions such as the eyes are preserved, but the mask selection rule is not specified, making it a hand-designed choice.
assumptions (5)
  • domain assumption Face recognition models primarily rely on local or high-frequency features for identification.
    Stated in Sec. 3.1 and used to justify high-pass filtering. If the assumption is false, removing global features would destroy recognition accuracy.
  • domain assumption Human visual recognition relies mainly on global features such as overall shape and color distribution.
    Stated in Sec. 3.1 and used to justify visual anonymization. If humans can recognize faces from local details alone, the privacy claim weakens.
  • ad hoc to paper Stochastic injection makes the anonymization mapping irreversible and prevents learning the inverse.
    Asserted in Sec. 3.3 and Sec. 4.4, but not proven. The paper only demonstrates one U-net attack failing, not a general irreversibility result.
  • domain assumption Optimizing against an ensemble of surrogate models transfers to held-out black-box face recognition models.
    The black-box protocol in Sec. 4.3 assumes that six standard CNN models represent general black-box behavior. No truly unseen architecture is tested.
  • domain assumption High-entropy images disrupt convolutional reconstruction models because of reduced spatial consistency.
    Stated in Sec. 3.4 as an informal mechanism connecting entropy regularization to reconstruction difficulty. It is not formally demonstrated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Local Features Meet Stochastic Anonymization: Revolutionizing Privacy-Preserving Face Recognition for Black-Box Models." pith.science (2026). https://pith.science/paper/7NCT57QO

@misc{pith2026241208276,
  author       = {Pith},
  title        = {Pith review of: Local Features Meet Stochastic Anonymization: Revolutionizing Privacy-Preserving Face Recognition for Black-Box Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7NCT57QO}},
  note         = {Machine review of arXiv:2412.08276}
}
read the original abstract

The task of privacy-preserving face recognition (PPFR) currently faces two major unsolved challenges: (1) existing methods are typically effective only on specific face recognition models and struggle to generalize to black-box face recognition models; (2) current methods employ data-driven reversible representation encoding for privacy protection, making them susceptible to adversarial learning and reconstruction of the original image. We observe that face recognition models primarily rely on local features ({e.g., face contour, skin texture, and so on) for identification. Thus, by disrupting global features while enhancing local features, we achieve effective recognition even in black-box environments. Additionally, to prevent adversarial models from learning and reversing the anonymization process, we adopt an adversarial learning-based approach with irreversible stochastic injection to ensure the stochastic nature of the anonymization. Experimental results demonstrate that our method achieves an average recognition accuracy of 94.21\% on black-box models, outperforming existing methods in both privacy protection and anti-reconstruction capabilities.

Figures

Figures reproduced from arXiv: 2412.08276 by the authors.

Figure 1
Figure 1. SOTA methods face two primary challenges. (a) Lack of robust privacy protection: SOTA methods are vulnerable to reconstruction models G ′ that can learn the encoding scheme and recover the original image. (b) Limited adaptability to black￾box scenarios: SOTA methods are tailored to specific face recog￾nition models, limiting their effectiveness on general-purpose face recognition models. and transformation-based [3,… view at source ↗
Figure 2
Figure 2. The overview of our method. The pipeline consists of two stages: preprocessing and learning. 1) In the preprocessing stage, we apply a Fourier transform to image X to obtain its frequency representation f(u, v) and preserve high-frequency components f ′ (u, v) through high-pass filtering. After inverse transformation, pruning, and stochastic nonlinear filling, the initial image X0 is obtained. 2) In the learning sta… view at source ↗
Figure 3
Figure 3. Subjective comparison of SOTA methods and ours. We present the ground truth alongside anonymized results from existing methods, including DuetFace [26], PartialFace [27], Pro￾Face [40], and MinusFace [28]. While these methods retain the overall facial structure, our approach completely removes global features. Method Venue LFW CELEBA AGEDB CPLFW CALFW DuetFace [26] MM’22 0.37 0.32 0.31 0.37 0.31 ProFace [40] MM’22 0… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The visualization of the anonymization effect of our method. We selected a diverse set of samples across various datasets to demonstrate the anonymization effectiveness of our method. The figure showcases a range of face samples varying in age, gender, and expression, …
Figure 5
Figure 5. Figure 5: Subjective comparison of resilience to reconstruction attack between SOTA and our methods. Specifically, (a) shows the anonymization results of SOTA methods and ours, while (b) displays the respective recovered images obtained from (a). ings indicate that a minimum of …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 36 canonical work pages

  1. [1]

    Secure face matching using fully homomorphic encryption

    Vishnu Naresh Boddeti. Secure face matching using fully homomorphic encryption. In 2018 IEEE 9th international conference on biometrics theory, applications and systems (BTAS), pages 1–10. IEEE, 2018. 1

    work page 2018

  2. [2]

    Sface: Privacy-friendly and accurate face recognition using synthetic data

    Fadi Boutros, Marco Huber, Patrick Siebke, Tim Rieber, and Naser Damer. Sface: Privacy-friendly and accurate face recognition using synthetic data. In 2022 IEEE International Joint Conference on Biometrics (IJCB) , pages 1–11. IEEE,

    2022

  3. [3]

    Privacy pre- serving face recognition utilizing differential privacy

    Mahawaga Arachchige Pathum Chamikara, Peter Bertok, Ibrahim Khalil, Dongxi Liu, and Seyit Camtepe. Privacy pre- serving face recognition utilizing differential privacy. Com- puters & Security, 97:101951, 2020. 1, 2

    work page 2020

  4. [4]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition , pages 4690–4699, 2019. 5, 8

    work page 2019

  5. [5]

    Inverting visual rep- resentations with convolutional networks

    Alexey Dosovitskiy and Thomas Brox. Inverting visual rep- resentations with convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recog- nition, pages 4829–4837, 2016. 2, 3

    work page 2016

  6. [6]

    Model inversion attacks that exploit confidence information and basic countermeasures

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications secu- rity, pages 1322–1333, 2015. 3

    work page 2015

  7. [7]

    Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness.arXiv preprint arXiv:1811.12231, 2018

    Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness.arXiv preprint arXiv:1811.12231, 2018. 2

    arXiv 2018

  8. [8]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 5, 8

    work page 2016

Show all 44 references
  1. [9]

    Model inver- sion attacks against collaborative inference

    Zecheng He, Tianwei Zhang, and Ruby B Lee. Model inver- sion attacks against collaborative inference. In Proceedings of the 35th Annual Computer Security Applications Confer- ence, pages 148–162, 2019. 2, 3

    2019

  2. [10]

    Mobilenets: Efficient convolutional neu- ral networks for mobile vision applications

    Andrew G Howard. Mobilenets: Efficient convolutional neu- ral networks for mobile vision applications. arXiv preprint arXiv:1704.04861, 2017. 5, 8

    2017 arXiv

  3. [11]

    Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller

    Gary B. Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller. Labeled faces in the wild: A database for studying face recognition in unconstrained environ- ments. Technical Report 07-49, University of Massachusetts, Amherst, 2007. 5

    2007

  4. [12]

    Instahide: Instance-hiding schemes for private distributed learning

    Yangsibo Huang, Zhao Song, Kai Li, and Sanjeev Arora. Instahide: Instance-hiding schemes for private distributed learning. In International conference on machine learning , pages 4507–4518. PMLR, 2020. 2

    2020

  5. [13]

    Comparing the visual representations and performance of humans and deep neural networks

    Robert A Jacobs and Christopher J Bates. Comparing the visual representations and performance of humans and deep neural networks. Current Directions in Psychological Sci- ence, 28(1):34–39, 2019. 2

    2019

  6. [14]

    Privacy-preserving face recognition with learn- able privacy budgets in frequency domain

    Jiazhen Ji, Huan Wang, Yuge Huang, Jiaxiang Wu, Xingkun Xu, Shouhong Ding, ShengChuan Zhang, Liujuan Cao, and Rongrong Ji. Privacy-preserving face recognition with learn- able privacy budgets in frequency domain. InEuropean Con- ference on Computer Vision, pages 475–491. Sprin...

    2022

  7. [15]

    Efficient and privacy-preserving distributed face recogni- tion scheme via facenet

    Xiaoyu Kou, Ziling Zhang, Yuelei Zhang, and Linlin Li. Efficient and privacy-preserving distributed face recogni- tion scheme via facenet. In Proceedings of the ACM Tur- ing Award Celebration Conference-China , pages 110–115,

  8. [16]

    Toward a privacy-preserving face recog- nition system: A survey of leakages and solutions

    Lamyanba Laishram, Muhammad Shaheryar, Jong Taek Lee, and Soon Ki Jung. Toward a privacy-preserving face recog- nition system: A survey of leakages and solutions. ACM Comput. Surv., 2024. Just Accepted. 1

    2024

  9. [17]

    Transferable adversar- ial facial images for privacy protection

    Minghui Li, Jiangxiong Wang, Hao Zhang, Ziqi Zhou, Shengshan Hu, and Xiaobing Pei. Transferable adversar- ial facial images for privacy protection. arXiv preprint arXiv:2408.01428, 2024. 2

    2024 arXiv

  10. [18]

    Il- lumination invariant face recognition using near-infrared im- ages

    Stan Z Li, RuFeng Chu, ShengCai Liao, and Lun Zhang. Il- lumination invariant face recognition using near-infrared im- ages. IEEE Transactions on pattern analysis and machine intelligence, 29(4):627–639, 2007. 5, 8

    2007

  11. [19]

    Privacy- preserving lightweight face recognition

    Yuancheng Li, Yimeng Wang, and Daoxing Li. Privacy- preserving lightweight face recognition. Neurocomputing, 363:212–222, 2019. 2

    2019

  12. [20]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pages 3730–3738, 2015. 5

    2015

  13. [21]

    Lightweight privacy-preserving ensemble classification for face recognition

    Zhuo Ma, Yang Liu, Ximeng Liu, Jianfeng Ma, and Kui Ren. Lightweight privacy-preserving ensemble classification for face recognition. IEEE Internet of Things Journal, 6(3): 5778–5790, 2019. 1

    2019

  14. [22]

    On the reconstruction of face images from deep face templates

    Guangcan Mai, Kai Cao, Pong C Yuen, and Anil K Jain. On the reconstruction of face images from deep face templates. IEEE transactions on pattern analysis and machine intelli- gence, 41(5):1188–1202, 2018. 2, 3

    2018

  15. [23]

    A privacy-preserving deep learning approach for face recognition with edge computing

    Yunlong Mao, Shanhe Yi, Qun Li, Jinghao Feng, Fengyuan Xu, and Sheng Zhong. A privacy-preserving deep learning approach for face recognition with edge computing. In Proc. USENIX Workshop Hot Topics Edge Comput.(HotEdge) , pages 1–6, 2018. 1, 2

    2018

  16. [24]

    Scheirer, Arun Ross, Peter Peer, and Vitomir ˇStruc

    Bla ˇz Meden, Peter Rot, Philipp Terh ¨orst, Naser Damer, Ar- jan Kuijper, Walter J. Scheirer, Arun Ross, Peter Peer, and Vitomir ˇStruc. Privacy–enhancing face biometrics: A com- 9 prehensive survey.IEEE Transactions on Information Foren- sics and Security, 16:4147–4183, 2021. 1

    2021

  17. [25]

    An overview of privacy-enhancing technologies in biometric recognition

    Pietro Melzi, Christian Rathgeb, Rub ´en Tolosana, Ruben Vera-Rodriguez, and Christoph Busch. An overview of privacy-enhancing technologies in biometric recognition. ACM Computing Surveys, 56(12):1–28, 2024. 1

    2024

  18. [26]

    Duetface: Collab- orative privacy-preserving face recognition via channel split- ting in the frequency domain

    Yuxi Mi, Yuge Huang, Jiazhen Ji, Hongquan Liu, Xingkun Xu, Shouhong Ding, and Shuigeng Zhou. Duetface: Collab- orative privacy-preserving face recognition via channel split- ting in the frequency domain. In Proceedings of the 30th ACM International Conference on Multimedia, pa...

    2022

  19. [27]

    Privacy- preserving face recognition using random frequency compo- nents

    Yuxi Mi, Yuge Huang, Jiazhen Ji, Minyi Zhao, Jiaxiang Wu, Xingkun Xu, Shouhong Ding, and Shuigeng Zhou. Privacy- preserving face recognition using random frequency compo- nents. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 19673–19684, 20...

    2023

  20. [28]

    Privacy-preserving face recognition us- ing trainable feature subtraction

    Yuxi Mi, Zhizhou Zhong, Yuge Huang, Jiazhen Ji, Jian- qing Xu, Jun Wang, Shaoming Wang, Shouhong Ding, and Shuigeng Zhou. Privacy-preserving face recognition us- ing trainable feature subtraction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni...

    2024

  21. [29]

    Gender privacy: An ensemble of semi adversarial networks for con- founding arbitrary gender classifiers

    Vahid Mirjalili, Sebastian Raschka, and Arun Ross. Gender privacy: An ensemble of semi adversarial networks for con- founding arbitrary gender classifiers. In 2018 IEEE 9th In- ternational Conference on Biometrics Theory, Applications and Systems (BTAS), pages 1–10. IEEE, 2018. 2

    2018

  22. [30]

    Agedb: the first manually collected, in-the-wild age database

    Stylianos Moschoglou, Athanasios Papaioannou, Chris- tos Sagonas, Jiankang Deng, Irene Kotsia, and Stefanos Zafeiriou. Agedb: the first manually collected, in-the-wild age database. In proceedings of the IEEE conference on computer vision and pattern recognition workshops , pa...

    2017

  23. [31]

    Black-box face recovery from identity features

    Anton Razzhigaev, Klim Kireev, Edgar Kaziakhmedov, Nurislam Tursynbek, and Aleksandr Petiushko. Black-box face recovery from identity features. In Computer Vision– ECCV 2020 Workshops: Glasgow, UK, August 23–28, 2020, Proceedings, Part V 16, pages 462–475. Springer, 2020. 3

    2020

  24. [32]

    A meta-analysis and review of holistic face processing

    Jennifer J Richler and Isabel Gauthier. A meta-analysis and review of holistic face processing. Psychological bulletin, 140(5):1281, 2014. 2

    2014

  25. [33]

    U-net: Convolutional networks for biomedical image segmentation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assisted Inter- vention - MICCAI 2015 - 18th International Conference Mu- nich, Germany, October 5 - 9, 2015, Proceeding...

    2015

  26. [34]

    Facenet: A unified embedding for face recognition and clus- tering

    Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clus- tering. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 815–823, 2015. 5, 8

    2015

  27. [35]

    Ad- ditive margin softmax for face verification.IEEE Signal Pro- cessing Letters, 25(7):926–930, 2018

    Feng Wang, Jian Cheng, Weiyang Liu, and Haijun Liu. Ad- ditive margin softmax for face verification.IEEE Signal Pro- cessing Letters, 25(7):926–930, 2018. 5, 8

    2018

  28. [36]

    Privacy-preserving face recognition in the frequency domain

    Yinggui Wang, Jian Liu, Man Luo, Le Yang, and Li Wang. Privacy-preserving face recognition in the frequency domain. In Proceedings of the AAAI Conference on Artificial Intelli- gence, pages 2558–2566, 2022. 2

    2022

  29. [37]

    Privacy-preserving adversarial facial features

    Zhibo Wang, He Wang, Shuaifan Jin, Wenwen Zhang, Jiahui Hu, Yan Wang, Peng Sun, Wei Yuan, Kaixin Liu, and Kui Ren. Privacy-preserving adversarial facial features. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8212–8221, 2023. 3

    2023

  30. [38]

    A review of homomorphic encryption for privacy- preserving biometrics

    Wencheng Yang, Song Wang, Hui Cui, Zhaohui Tang, and Yan Li. A review of homomorphic encryption for privacy- preserving biometrics. Sensors, 23(7):3566, 2023. 1

    2023

  31. [39]

    Efficient and privacy-preserving online face recog- nition over encrypted outsourced data

    Xiaopeng Yang, Hui Zhu, Rongxing Lu, Ximeng Liu, and Hui Li. Efficient and privacy-preserving online face recog- nition over encrypted outsourced data. In 2018 IEEE In- ternational Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom...

    2018

  32. [40]

    Pro-face: A generic framework for privacy- preserving recognizable obfuscation of face images

    Lin Yuan, Linguo Liu, Xiao Pu, Zhao Li, Hongbo Li, and Xinbo Gao. Pro-face: A generic framework for privacy- preserving recognizable obfuscation of face images. In Pro- ceedings of the 30th ACM international conference on mul- timedia, pages 1661–1669, 2022. 1, 2, 6, 7, 8

    2022

  33. [41]

    A privacy-preserving multi-task learning framework for face detection, landmark localization, pose estimation, and gender recognition

    Chen Zhang, Xiongwei Hu, Yu Xie, Maoguo Gong, and Bin Yu. A privacy-preserving multi-task learning framework for face detection, landmark localization, pose estimation, and gender recognition. Frontiers in neurorobotics, 13:112,

  34. [42]

    Cross-pose lfw: A database for studying cross-pose face recognition in un- constrained environments

    Tianyue Zheng and Weihong Deng. Cross-pose lfw: A database for studying cross-pose face recognition in un- constrained environments. Beijing University of Posts and Telecommunications, Tech. Rep, 5(7):5, 2018. 5

    2018

  35. [43]

    Cross-age lfw: A database for studying cross-age face recognition in un- constrained environments

    Tianyue Zheng, Weihong Deng, and Jiani Hu. Cross-age lfw: A database for studying cross-age face recognition in un- constrained environments. arXiv preprint arXiv:1708.08197,

    arXiv

  36. [44]

    Inverting face em- beddings with convolutional neural networks

    Andrey Zhmoginov and Mark Sandler. Inverting face em- beddings with convolutional neural networks. arXiv preprint arXiv:1606.04189, 2016. 3 10

    2016 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.