Pith. sign in

REVIEW 3 major objections 5 minor 68 references

Shielding Latent Face Representations From Privacy Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Encrypted face embeddings leak almost no age or gender

desk verdict Real FHE pipeline, but the paper's privacy claim rests on an SVM against pseudorandom ciphertexts—a sanity check, not an adversarial evaluation. read the letter →

arxiv 2505.12688 v1 pith:XYMLXZ7N submitted 2025-05-19 cs.CR

Arjun Ramesh Kaushik , Bharat Chandra Yalavarthi , Arun Ross , Vishnu Boddeti , Nalini Ratha This is my paper · ORCID
classification cs.CR
keywords faceembeddingssoftbiometricsattributeinferencefullyhomomorphicencryptionCKKSMatryoshkarepresentationlearningPolyProtecttemplateprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Face embeddings used for identification secretly carry soft-biometric information: age, gender, and ethnicity can be read out of them. The paper claims that standard protections — template hashing, compression, and differential privacy — either leave this leakage intact or destroy the identification capability. Its proposed stack compresses the embedding with Matryoshka Representation Learning, encrypts it with the CKKS fully homomorphic scheme, and then applies the irreversible PolyProtect transform inside the encrypted domain. Across two face encoders and two datasets, attribute classifiers fall to near random chance (gender accuracy about 50 percent, age as low as 6 percent, AUC near 0.5) while Rank-1 identification stays above 96 percent on CelebSet and above 84 percent on the Chicago Face Database. The paper concludes that encryption, not any single plaintext transform, is the layer doing the shielding, and the other layers exist to make encrypted processing practical.

What carries the argument

The load-bearing object is the MRL+FHE+PP pipeline: Matryoshka Representation Learning compresses a 512-dimensional face embedding to 64 dimensions; the CKKS scheme, implemented with the HEAAN library, encrypts the compressed vector so arithmetic can be performed on ciphertexts; and PolyProtect, a multivariate polynomial map with user-specific coefficients, is applied inside the encrypted domain using Taylor-series approximations and ciphertext packing. To run the primary task on ciphertexts, the inverse-square-root step of cosine similarity is replaced by an 8th-degree polynomial approximation. The privacy measurement uses SVM classifiers trained on the ASCII values of the encrypted embeddings, and the paper treats their failure as evidence that attribute information is unrecoverable.

What would settle it

Train attribute classifiers directly on the raw CKKS ciphertext coefficients (or give an attacker oracle access to match scores) on the same CelebSet splits used in Table VII; if any classifier predicts gender or age with AUC significantly above 0.5, the paper's central privacy claim is falsified.

Watch

Extended reading notes

Core claim

Under a full-disclosure threat model where the attacker knows the hashing algorithm, its parameters, and the FHE public key but not the private key, the paper shows that existing template protections leak soft biometrics: PolyProtect, Negative Face Recognition, and Minimum Information Units all leave gender, age, and ethnicity recoverable at high accuracy. Adding CKKS encryption, with Matryoshka compression to keep ciphertexts small and PolyProtect applied inside the encrypted domain, reduces attribute classification to random-guessing levels in nearly every setting while cosine-distance face identification on the protected templates retains more than 96 percent Rank-1 accuracy on CelebSet and more than 84 percent on the Chicago Face Database. The paper also finds that differential privacy suppresses attributes but collapses identification accuracy, and that the compression step mainly buys speed, yielding a 627 percent speedup over FHE without compression.

Load-bearing premise

The load-bearing premise is that training SVM classifiers on the ASCII values of encrypted embeddings is a fair stand-in for a determined attribute-inference adversary; if an attacker can instead exploit the algebraic structure of the CKKS ciphertext or query match scores, the near-chance accuracies may not reflect true leakage.

Editorial extensions

If this is right

  • Template protection alone is insufficient: any of the three tested manifold hashes leaves soft biometrics readable, so the encryption layer, not the hash, is what suppresses attribute inference.
  • Differential privacy is not a viable alternative here because the noise needed to hide attributes reduces identification accuracy to near zero; the FHE-based stack is the method that keeps both properties.
  • Encrypted face identification is practical enough to deploy in the tested setting: MRL+FHE+PP takes about 715 ms and cosine matching on 64-dimensional encrypted embeddings about 1077 ms.
  • If the FHE private key leaks, the irreversible PolyProtect layer remains as a backstop; applying the hash after encryption, rather than before, prevents leaked hash parameters from enabling inversion.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The privacy claim is empirical and attack-specific: it is established against SVM classifiers fed ASCII representations of ciphertexts, not against an adversary who exploits CKKS coefficient structure, approximate-noise behaviour, or match-score oracles; a broader attack surface could change the conclusion.
  • The same compress-encrypt-hash recipe should transfer to other embedding domains, such as medical or speech representations, whenever attribute leakage is a concern; the paper tests only face embeddings.
  • Because the authors note that near-ideal Privacy Gain may reflect dataset imbalance, a balanced multi-attribute benchmark would give a cleaner estimate of how much attribute information actually remains.
  • A formal guarantee would require tying attribute hiding to a cryptographic indistinguishability notion rather than to measured classifier accuracy; without that, the shield is best read as demonstrated resistance, not proven impossibility.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a multi-layer protection pipeline for face embeddings: Matryoshka Representation Learning (MRL) compression, Fully Homomorphic Encryption (FHE) using the HEAAN/CKKS scheme, and PolyProtect (PP) hashing applied in the encrypted domain. The central claim is that this pipeline shields latent face representations from soft-biometric attribute inference (age, gender, ethnicity) while preserving face identification accuracy. Experiments on CelebSet and the Chicago Face Database with AdaFace and ArcFace encoders show near-chance attribute classification rates (AUC around 0.5, gender accuracy around 50%, age accuracy as low as 6%) on encrypted embeddings, while Rank-1 identification remains above 96% on CelebSet and above 84% on CFD. The paper also compares against Differential Privacy, template protection schemes, and compression alone, reporting privacy gain and suppression rate metrics.

Significance. If the central claim were fully supported, the proposed pipeline would be a practically relevant contribution to privacy-preserving facial analytics, combining a cryptographic primitive with an irreversible transform while retaining high utility. The paper's strengths include a systematic comparison of several protection techniques on two datasets and two encoders, careful ablation of MRL and PolyProtect parameters, and a concrete FHE implementation with Taylor-series approximation and execution-time measurements. However, the empirical evidence for the main privacy claim is not load-bearing: the attribute-inference experiment is performed on ASCII-serialized ciphertexts, which, under the IND-CPA security of CKKS, are pseudorandom and should defeat any classifier regardless of whether the method provides meaningful protection. The paper therefore does not currently support its headline claim as stated.

major comments (3)
  1. [Section V-E and Tables V-VII] The only direct attribute-inference attack on the proposed protection is the SVM trained on the 'ASCII values of the encrypted embeddings.' Under the standard IND-CPA security of the CKKS/HEAAN scheme, raw ciphertext bytes are pseudorandom, so a classifier trained on those bytes is expected to perform at chance whether or not any semantic information remains in the plaintext embedding or in the protocol outputs. The near-chance accuracies and AUCs in Tables V and VII are therefore a sanity check on ciphertext pseudorandomness, not evidence of resistance to attribute-inference attacks. The actual attack surface of the protocol—the server's ability to compute homomorphically on ciphertexts, the approximate-noise behavior of CKKS, and any decrypted outputs such as match scores returned to the client—is not examined. Without a formal reduction to a hardness assumption or an adversarial evaluation that includes at least one of these channels, the central privacy claim is unsupported.
  2. [Tables V and VII] The results for MRL+FHE and MRL+FHE+PP are numerically almost identical throughout Tables V and VII: attribute accuracies differ by at most a few hundredths of a percentage point, and AUCs are identical or within 0.01. Thus the experimental evaluation does not demonstrate that the PolyProtect layer adds any measurable privacy benefit. The paper describes PP as providing a second layer of security in case the FHE secret key leaks, but no experiment or analysis supports this additional layer; the 'dual-layer' claim is not backed by the presented data.
  3. [Section II (Threat Model) and Section III (Prior Work)] The threat model states that the attacker (the server) possesses the public key and evaluation key and can perform computations on the ciphertexts, but the paper does not analyze what an attacker with these capabilities can learn from the CKKS ciphertext structure or from the approximate-noise distribution. The paper cites Li and Micciancio [30] on the security of approximate homomorphic encryption but does not explain why their attack or similar attacks do not apply to the proposed instantiation. Since the privacy guarantee is claimed to follow from FHE, this is a load-bearing gap: the paper needs either a concrete security argument for the specific HEAAN parameters and operations used, or an explicit statement that the guarantee holds only under the assumption that no such attacks apply.
minor comments (5)
  1. [Table V] In the AdaFace-CelebSet row for MRL+FHE, the entry '52.226.12' appears to be a typographical error and should be '52.22 6.12'.
  2. [Figure 6] The DP accuracy values shown in Figure 6(iii) for AdaFace on CelebSet (Age 66.31, Gender 70.87, Ethnicity 85.37) do not match the corresponding values in Table V (48.12, 59.17, 54.66). Please reconcile the figure with the table.
  3. [Section III and captions] The name 'Matryoshka' is misspelled as 'Matryoksha' in multiple places (e.g., Table V and Table VI captions).
  4. [Section III] The paragraph on embedding compression contains a duplicated sentence about adaptive bit allocation starting with 'Based on their importance, Zhao et al.'; the second occurrence should be removed.
  5. [Section VI] The sentence 'Since gender and ethnicity classification problems are multi-class' is inaccurate for gender, which is binary in both datasets; only ethnicity is multi-class.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central privacy/utility claims are empirical and rest on external cryptographic and representation-learning primitives, not on self-referential equations.

full rationale

The paper's derivation chain contains no step in which a predicted quantity is defined as, or algebraically telescoped back into, its own input. The proposed pipeline (MRL compression, HEAAN/CKKS FHE encryption, PolyProtect hashing) is evaluated empirically: utility is measured by Rank-1 identification and FMR/FNMR curves, and privacy is measured by attribute-classification accuracy and AUC against SVM probes. The near-chance results under MRL+FHE(+PP) are consequences of the external IND-CPA-style security assumption imported from the HEAAN/CKKS literature (refs. [8,17,30]), not of a parameter fitted to those same results. The SVM-on-ASCII attack surface is weak because semantically secure ciphertexts are pseudorandom, making chance-level accuracy an expected sanity check rather than evidence against a protocol-level adversary; this is an experimental-adequacy limitation, not circularity. Self-citations ([14,21,44]) are background references to prior FHE face-matching systems and do not supply the paper's load-bearing claims. Privacy Gain and Suppression Rate are defined from attribute-accuracy deltas and are used as reporting metrics, and the paper's privacy conclusion is directly supported by Tables V and VII rather than by a metric that equals its own output. No load-bearing result reduces by construction to its inputs.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

This is an empirical systems paper with no formal derivation. The central claim depends on several implementation choices (compression dimension, PP parameters, Taylor degree, FHE parameters) and on the imported cryptographic security of CKKS and the irreversibility of PolyProtect. The paper does not ship code or data, so these parameters are not independently reproducible.

free parameters (5)
  • MRL compressed embedding dimension = 64
    Selected via ablation on CelebSet (Fig. 3) as the best trade-off between identification accuracy and attribute suppression; used in the central MRL+FHE+PP pipeline.
  • PolyProtect parameters (m, C, overlap) = m=5, C=50, overlap=0
    Chosen via ablation on CelebSet (Fig. 2) to maximize attribute suppression; these values are inputs to the FHE-domain PolyProtect layer.
  • Taylor polynomial degree for inverse square root = 8th degree
    The paper states the cosine distance inverse-square-root is approximated by an 8th-degree polynomial (Section V-E); no ablation or error analysis is provided, yet it directly affects identification accuracy in the encrypted domain.
  • Differential privacy baseline parameters = epsilon <= 1e-3, sensitivity = 2
    Used for the DP baseline (Section V-D). The tiny epsilon destroys identification accuracy (about 1 percent), making the comparison to the proposed method favorable.
  • FHE scheme parameters (ring dimension, scale, level) = not specified
    Required to reproduce the encrypted-domain experiments; the paper names HEAAN/CKKS but does not report the concrete security parameters.
assumptions (4)
  • domain assumption Semantic security of the CKKS FHE scheme
    The claim that an attacker with ciphertexts but no secret key cannot infer attributes depends on the cryptographic security of CKKS, imported from the cryptography literature and not analyzed in the paper.
  • domain assumption PolyProtect is irreversible and unlinkable
    The paper relies on the properties of PolyProtect established in [18] to argue that the hash layer protects embeddings even if the FHE secret key leaks (Section IV, VIII). This property is cited, not proven.
  • ad hoc to paper SVM on ASCII-serialized ciphertexts is a representative attribute-inference attacker
    Section V-E evaluates leakage by training SVM classifiers on the ASCII values of encrypted embeddings. The paper implicitly assumes this attack surface is the relevant one; if a stronger adversary exploits the ciphertext polynomial structure or protocol-level decryption oracles, the empirical privacy claim is unsupported.
  • domain assumption Attribute classifiers trained on plaintext embeddings measure the information available to the defender
    Suppression rate and privacy gain are computed relative to attribute classification accuracy on unprotected embeddings; this presumes the plaintext-label SVM accuracy is the right baseline for leakage.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Shielding Latent Face Representations From Privacy Attacks." pith.science (2026). https://pith.science/paper/XYMLXZ7N

@misc{pith2026250512688,
  author       = {Pith},
  title        = {Pith review of: Shielding Latent Face Representations From Privacy Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XYMLXZ7N}},
  note         = {Machine review of arXiv:2505.12688}
}
read the original abstract

In today's data-driven analytics landscape, deep learning has become a powerful tool, with latent representations, known as embeddings, playing a central role in several applications. In the face analytics domain, such embeddings are commonly used for biometric recognition (e.g., face identification). However, these embeddings, or templates, can inadvertently expose sensitive attributes such as age, gender, and ethnicity. Leaking such information can compromise personal privacy and affect civil liberty and human rights. To address these concerns, we introduce a multi-layer protection framework for embeddings. It consists of a sequence of operations: (a) encrypting embeddings using Fully Homomorphic Encryption (FHE), and (b) hashing them using irreversible feature manifold hashing. Unlike conventional encryption methods, FHE enables computations directly on encrypted data, allowing downstream analytics while maintaining strong privacy guarantees. To reduce the overhead of encrypted processing, we employ embedding compression. Our proposed method shields latent representations of sensitive data from leaking private attributes (such as age and gender) while retaining essential functional capabilities (such as face identification). Extensive experiments on two datasets using two face encoders demonstrate that our approach outperforms several state-of-the-art privacy protection methods.

Figures

Figures reproduced from arXiv: 2505.12688 by the authors.

Figure 1
Figure 1. (a) Existing embedding protection techniques typ [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Ablation Study with PolyProtect shows soft biometric leakage under different settings. (a) Overlap (b) m - Length [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Performance of attribute extraction (Age, Gender, [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Classification accuracy of attributes (Age, Gender, [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: False Match Rate (FMR) vs False Non-Match Rate [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Identification accuracy (Identity) and attribute clas [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

68 extracted references · 66 canonical work pages

  1. [30]

    Li and D

    B. Li and D. Micciancio. On the security of homomorphic encryption on approximate numbers. InAdvances in Cryptology – EUROCRYPT: 40th Annual International Conference on the Theory and Applications of Cryptographic Techniques, October 17–21, Proceedings, Part I, page 648–677. Springer-Verlag, 2021

    work page 2021

  2. [1]

    Alfalou, C

    A. Alfalou, C. Brosseau, and W. Kaddah. Optimization of decision making for face recognition based on nonlinear correlation plane. Optics Communications, 343:22–27, 2015

    work page 2015

  3. [2]

    J. S. Assine, A. Godoy, and E. Valle. Compressing representations for embedded deep learning, 2019.https://arxiv.org/abs/ 1911.10321

    work page Pith review arXiv 2019

  4. [3]

    Bassit, F

    A. Bassit, F. Hahn, R. Veldhuis, and A. Peter. Hybrid biometric template protection: Resolving the agony of choice between bloom filters and homomorphic encryption.IET biometrics, 11(5):430–444, 2022

    work page 2022

  5. [4]

    Bauspieß, C.-M

    P. Bauspieß, C.-M. Zok, A. Costache, C. Rathgeb, J. Kolberg, and C. Busch. Mt-pro: Multibiometric template protection based on homomorphic transciphering. InIEEE International Workshop on Information Forensics and Security (WIFS), pages 1–6, 2023

    work page 2023

  6. [5]

    Bharatia and P

    D. Bharatia and P. Rane. Research on advanced image analysis and it’s applications. InGlobal Conference for Advancement in Technology (GCAT), pages 1–5, 2019

    work page 2019

  7. [6]

    Bortolato, M

    B. Bortolato, M. Ivanovska, P. Rot, J. Kri ˇzaj, P. Terh ¨orst, N. Damer, P. Peer, and V .ˇStruc. Learning privacy-enhancing face representations through feature disentanglement. In15th IEEE International Con- ference on Automatic Face and Gesture Recognition, pages 495–502, 2020

    work page 2020

  8. [7]

    Chamikara, P

    M. Chamikara, P. Bertok, I. Khalil, D. Liu, and S. Camtepe. Privacy preserving face recognition utilizing differential privacy.Computers & Security, 97:101951, 2020

    work page 2020

Show all 68 references
  1. [8]

    J. H. Cheon, A. Kim, M. Kim, and Y . Song. Homomorphic encryption for arithmetic of approximate numbers. In T. Takagi and T. Peyrin, editors,Advances in Cryptology – ASIACRYPT, pages 409–437, Cham,

  2. [9]

    W. L. Croft, J.-R. Sack, and W. Shi. Differentially private obfuscation of facial images. In A. Holzinger, P. Kieseberg, A. M. Tjoa, and E. Weippl, editors,Machine Learning and Knowledge Extraction, pages 229–249, Cham, 2019. Springer International Publishing

    2019

  3. [10]

    Dantcheva, P

    A. Dantcheva, P. Elia, and A. Ross. What else does your biometric data reveal? A survey on soft biometrics.IEEE Transactions on Information Forensics and Security, 11(3):441–467, 2016

    2016

  4. [11]

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4690– 4699, 2019

    2019

  5. [12]

    A. Dyda, M. Purcell, S. Curtis, E. Field, P. Pillai, K. Ricardo, H. Weng, J. C. Moore, M. Hewett, G. Williams, and C. L. Lau. Differential privacy for public health data: An innovative tool to optimize information sharing while protecting data confidentiality. Patterns, 2(12):...

    2021

  6. [13]

    Eichelberg, K

    M. Eichelberg, K. Kleber, and M. K ¨ammerer. Cybersecurity challenges for pacs and medical imaging.Academic Radiology, 27(8):1126–1139, 2020

    2020

  7. [14]

    J. J. Engelsma, A. K. Jain, and V . N. Boddeti. Hers: Homomorphically encrypted representation search.IEEE Transactions on Biometrics, Behavior, and Identity Science, 4(3):349–360, 2022

    2022

  8. [15]

    F ´abi´an and G

    I. F ´abi´an and G. Guly ´as. De-anonymizing facial recognition embed- dings.Infocommunications Journal, 12:50–56, 01 2020

    2020

  9. [16]

    Secure noise generation for differential privacy, 2019

    Google. Secure noise generation for differential privacy, 2019

    2019

  10. [17]

    Gorantala, R

    S. Gorantala, R. Springer, and B. Gipson. Unlocking the potential of fully homomorphic encryption.Commun. ACM, 66(5):72–81, apr 2023

    2023

  11. [18]

    V . K. Hahn and S. Marcel. Towards protecting face embeddings in mobile face verification scenarios.IEEE Transactions on Biometrics, Behavior, and Identity Science, 4(1):117–134, 2022

    2022

  12. [19]

    M. K. Hasan, S. Islam, R. Sulaiman, S. Khan, A.-H. A. Hashim, S. Habib, M. Islam, S. Alyahya, M. M. Ahmed, S. Kamil, and M. A. Hassan. Lightweight encryption technique to enhance medical image security on internet of medical things applications.IEEE Access, 9:47731–47742, 2021

    2021

  13. [20]

    Huang, Q

    J. Huang, Q. Cui, Z. Zhou, K. Yu, C.-N. Yang, and K.-K. R. Choo. Encrypted domain secret medical-image sharing with secure outsourcing computation in iot environment.IEEE Internet of Things Journal, 2023

    2023

  14. [21]

    N. Jain, K. Nandakumar, N. K. Ratha, S. Pankanti, and U. Kumar. Efficient CNN building blocks for encrypted data. InAssociation for the Advancement of Artificial Intelligence (AAAI) Workshop, 2021

    2021

  15. [22]

    Jang and X

    T. Jang and X. Wang. Fades: Fair disentanglement with sensitive relevance. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12067–12076, June 2024

    2024

  16. [23]

    Jia and N

    J. Jia and N. Z. Gong. AttriGuard: A practical defense against attribute inference attacks via adversarial machine learning. In27th USENIX Security Symposium (USENIX Security 18), pages 513–529, Baltimore, MD, Aug. 2018. USENIX Association

    2018

  17. [24]

    Jiang, J

    H. Jiang, J. Pei, D. Yu, J. Yu, B. Gong, and X. Cheng. Applications of differential privacy in social network analysis: A survey.IEEE Transactions on Knowledge and Data Engineering, 35(1):108–127, 2023

    2023

  18. [25]

    A. K. Jindal, I. Shaik, V . Vasudha, S. R. Chalamala, R. Ma, and S. Lodha. Secure and privacy preserving method for biometric template protection using fully homomorphic encryption. InIEEE 19th International Conference on Trust, Security and Privacy in Computing and Communicat...

    2020

  19. [26]

    M. Kim, A. K. Jain, and X. Liu. Adaface: Quality adaptive margin for face recognition. InIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 18729–18738, 2022

    2022

  20. [27]

    Parameshachari, H

    Kiran, B. Parameshachari, H. Panduranga, and S. liberata Ullo. Anal- ysis and computation of encryption technique to enhance security of medical images.IOP Conference Series: Materials Science and Engineering, 925(1):012028, Sep 2020

    2020

  21. [28]

    Kusupati, G

    A. Kusupati, G. Bhatt, A. Rege, M. Wallingford, A. Sinha, V . Ramanu- jan, W. Howard-Snyder, K. Chen, S. Kakade, P. Jain, and A. Farhadi. Matryoshka representation learning. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors,Advances in Neural Inform...

    2022

  22. [29]

    S. Lee, G. Lee, J. W. Kim, J. Shin, and M.-K. Lee. Hetal: efficient privacy-preserving transfer learning with homomorphic encryption. In International Conference on Machine Learning, pages 19010–19035, 2023

    2023

  23. [31]

    Li et al

    J. Li et al. Recent advances in end-to-end automatic speech recog- nition.APSIPA Transactions on Signal and Information Processing, 11(1), 2022

    2022

  24. [32]

    K. Li, G. Luo, Y . Ye, W. Li, S. Ji, and Z. Cai. Adversarial privacy- preserving graph embedding against inference attack.IEEE Internet of Things Journal, 8(8):6904–6915, 2021

    2021

  25. [33]

    S. Liao, J. Chen, Y . Wang, Q. Qiu, and B. Yuan. Embedding compression with isotropic iterative quantization.Proceedings of the AAAI Conference on Artificial Intelligence, 34(05):8336–8343, Apr. 2020

    2020

  26. [34]

    Y . Liu, X. Zhu, J. Wang, and J. Xiao. A quantitative metric for privacy leakage in federated learning. InIEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3065–3069, 2021

    2021

  27. [35]

    T. K. Lively. Facial recognition in the united states: Privacy concerns and legal developments.Security Technology, 2021

    2021

  28. [36]

    D. S. Ma, J. Correll, and B. Wittenbrink. The Chicago Face Database: A Free Stimulus Set of Faces and Norming Data.Behav Res Methods, 47(4):1122–1135, Dec. 2015

    2015

  29. [37]

    G. Mai, K. Cao, P. C. Yuen, and A. K. Jain. On the reconstruction of face images from deep face templates.IEEE Transactions on Pattern Analysis and Machine Intelligence, 41(5):1188–1202, 2019

    2019

  30. [38]

    Y . Mao, J. Feng, F. Xu, and S. Zhong. A privacy-preserving deep learning approach for face recognition with edge computing. In USENIX Workshop on Hot Topics in Edge Computing, 2018

    2018

  31. [39]

    Meden, P

    B. Meden, P. Rot, P. Terh ¨orst, N. Damer, A. Kuijper, W. J. Scheirer, A. Ross, P. Peer, and V . ˇStruc. Privacy–enhancing face biometrics: A comprehensive survey.IEEE Transactions on Information Forensics and Security, 16:4147–4183, 2021

    2021

  32. [40]

    Melzi, H

    P. Melzi, H. O. Shahreza, C. Rathgeb, R. Tolosana, R. Vera-Rodriguez, J. Fierrez, S. Marcel, and C. Busch. Multi-ive: Privacy enhancement of multiple soft-biometrics in face embeddings. InIEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACVW), pages 32...

    2023

  33. [41]

    Mirjalili, S

    V . Mirjalili, S. Raschka, and A. Ross. Privacynet: Semi-adversarial networks for multi-attribute face privacy.IEEE Transactions on Image Processing, 29:9400–9412, 2020

    2020

  34. [42]

    Morales, J

    A. Morales, J. Fierrez, R. Vera-Rodriguez, and R. Tolosana. Sen- sitiveNets: Learning Agnostic Representations with Application to Face Images .IEEE Transactions on Pattern Analysis & Machine Intelligence, 43(06):2158–2164, June 2021

    2021

  35. [43]

    Munjal and R

    K. Munjal and R. Bhatia. A systematic review of homomorphic encryption and its contributions in healthcare industry.Complex & Intelligent Systems, 9:1–28, 2022

    2022

  36. [44]

    Naresh Boddeti

    V . Naresh Boddeti. Secure face matching using fully homomorphic encryption. InIEEE 9th International Conference on Biometrics Theory, Applications and Systems (BTAS), page 1–10, 2018

    2018

  37. [45]

    The National Academies Press, Washington, DC, 2024

    National Academies of Sciences, Engineering, and Medicine.Facial Recognition Technology: Current Capabilities, Future Prospects, and Governance. The National Academies Press, Washington, DC, 2024

    2024

  38. [46]

    Osorio-Roig, P

    D. Osorio-Roig, P. A. Gerlitz, C. Rathgeb, and C. Busch. Reversing deep face embeddings with probable privacy protection. InIEEE International Workshop on Information Forensics and Security (WIFS), pages 1–6. IEEE, 2023

    2023

  39. [47]

    Osorio-Roig, C

    D. Osorio-Roig, C. Rathgeb, P. Drozdowski, P. Terh ¨orst, V .ˇStruc, and C. Busch. An attack on facial soft-biometric privacy enhancement. IEEE Transactions on Biometrics, Behavior, and Identity Science, 4(2):263–275, 2022

    2022

  40. [48]

    L. Ou, Y . He, S. Liao, Z. Qin, Y . Hong, D. Zhang, and X. Jia. Faceidp: Face identification differential privacy via dictionary learning neural networks.IEEE Access, 11:31829–31841, 2023

    2023

  41. [49]

    A. E. Ouadrhiri and A. Abdelhadi. Differential privacy for deep and federated learning: A survey.IEEE Access, 10:22359–22380, 2022

    2022

  42. [50]

    S. Poudel. A study of disease diagnosis using machine learning. Medical Sciences Forum, 10(1), 2022

    2022

  43. [51]

    Pradel and C

    G. Pradel and C. Mitchell. Privacy-preserving biometric matching using homomorphic encryption. In L. Zhao, N. Kumar, R. Hsu, and Z. Zou, editors,Proceedings: IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom, Shenyang, ...

    2021

  44. [52]

    Pu and Z

    J. Pu and Z. Takhirov. Embedding attack project (work report). Technical report, PnS Privacy Innovation Lab, TikTok, 2024

    2024

  45. [53]

    Raji and J

    D. Raji and J. Lee. Celebset, 2019. ”https://tinyurl.com/ 362s54h9”, Accessed: 2024-11-13

    2019

  46. [54]

    I. D. Raji, T. Gebru, M. Mitchell, J. Buolamwini, J. Lee, and E. Denton. Saving face: Investigating the ethical concerns of facial recognition auditing. InProceedings of the AAAI/ACM Conference on AI, Ethics, and Society, page 145–151. Association for Computing Machinery, 2020

    2020

  47. [55]

    A. Ross, S. Banerjee, and A. Chowdhury. Deducing health cues from biometric data.Computer Vision and Image Understanding, 221:103438, 2022

    2022

  48. [56]

    M. H. Sarhan, N. Navab, A. Eslami, and S. Albarqouni. Fairness by learning orthogonal disentangled representations. InEuropean Conference on Computer Vision, pages 746–761. Springer, 2020

    2020

  49. [57]

    H. O. Shahreza, C. Rathgeb, D. Osorio-Roig, V . K. Hahn, S. Marcel, and C. Busch. Hybrid protection of biometric templates by combining homomorphic encryption and cancelable biometrics. InIEEE Inter- national Joint Conference on Biometrics (IJCB), pages 1–10, 2022

    2022

  50. [58]

    Shokri, M

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov. Membership in- ference attacks against machine learning models. InIEEE Symposium on Security and Privacy (SP), pages 3–18, 2017

    2017

  51. [59]

    Tastan and K

    N. Tastan and K. Nandakumar. Capride learning: Confidential and private decentralized learning based on encryption-friendly distillation loss. InIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 8084–8092, 2023

    2023

  52. [60]

    Terh ¨orst, M

    P. Terh ¨orst, M. Huber, N. Damer, F. Kirchbuchner, and A. Kuijper. Un- supervised enhancement of soft-biometric privacy with negative face recognition, 2020.https://arxiv.org/abs/2002.09181

    2020 arXiv

  53. [61]

    Terh ¨orst, K

    P. Terh ¨orst, K. Riehl, N. Damer, P. Rot, B. Bortolato, F. Kirchbuchner, V . Struc, and A. Kuijper. Pe-miu: A training-free privacy-enhancing face recognition approach based on minimum information units.IEEE Access, 8:93635–93647, 2020

    2020

  54. [62]

    Wagner and D

    I. Wagner and D. Eckhoff. Technical privacy metrics: A systematic survey.ACM Comput. Surv., 51(3), 2018

    2018

  55. [63]

    Q. Wang, A. Alfalou, and C. Brosseau. New perspectives in face correlation research: a tutorial.Advances in Optics and Photonics, 9(1):1–78, Mar 2017

    2017

  56. [64]

    W. Yang, S. Wang, J. Hu, X. Tao, and Y . Li. Feature extraction and learning approaches for cancellable biometrics: A survey.CAAI Transactions on Intelligence Technology, 9(1):4–25, 2024

    2024

  57. [65]

    Y . Yang, H. Zhang, J. W. Gichoya, D. Katabi, and M. Ghassemi. The limits of fair medical imaging AI in real-world generalization.Nature Medicine, pages 1–11, 2024

    2024

  58. [66]

    D. Ye, S. Shen, T. Zhu, B. Liu, and W. Zhou. One parameter defense: Defending against data inference attacks via differential privacy.IEEE Transactions on Information Forensics and Security, 17:1466–1480, 2022

    2022

  59. [67]

    C. Zhao, X. Li, and Y . Cang. Bisecting k-means clustering based face recognition using block-based bag of words model.Optik - International Journal for Light and Electron Optics, 126(19):1761– 1766, 2015

    2015

  60. [2017]

    Springer International Publishing

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.