Pith. sign in

REVIEW 4 major objections 6 minor 43 references

DecoyFace: Beyond Obfuscation via Controllable and Imperceptible Identity Misdirection for Privacy-Preserving Face Recognition

T0 review · 4 major / 6 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read DecoyFace argues that privacy protection in split face recognition should steer unauthorized reconstructions toward a plausible decoy identity instead of degrading them, while preserving authorized verification.

desk verdict DecoyFace has a genuinely new idea—misdirection instead of obfuscation—but the privacy numbers are probably measured against non-adaptive attackers, and the 'controllable' part is a 30% hit rate. read the letter →

arxiv 2607.17504 v1 pith:3QKUCL73 submitted 2026-07-20 cs.CV cs.AI

Zhihan Ren , Lijun He , Xinyao Wang , Xinzhu Fu , Fan Li This is my paper
classification cs.CVcs.AI
keywords facerecognitionprivacy-preservingfeatureinversionattacksplitinferencedecoyidentitymisdirectionsubspacedecompositionhonest-but-curiousserverleakage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DecoyFace claims that privacy in split face recognition is best protected not by making reconstructions fail, but by making them succeed at the wrong identity. It decomposes the transmitted feature into a reconstruction-sensitive subspace, where decoy identity cues are injected, and a complementary subspace, which carries only sparse recognition-relevant evidence. The authorized server suppresses the decoy component through a matched canonicalization module and still verifies the true identity. Experiments report competitive recognition accuracy, with LFW at 99.77% and IJB-C at 93.35% TAR@FAR=10^-4, while identity leakage drops to 2.93% under a U-Net attacker and 0.74% under a flow-matching attacker, with face validity above 99.78%.

What carries the argument

Reconstruction-Sensitive Subspace Decomposition (RSSD): an eigendecomposition of the covariance of reconstruction-loss gradients, computed with a proxy inversion network; the top eigenvectors define the reconstruction-sensitive subspace (RSS) used for decoy injection. Decoy-Guided Coherent Mixing (DGCM): channel-shuffled grouping with instance normalization, a routing mask that keeps a small number of true-sample groups, and replacement of the remaining groups with auxiliary decoy complementary groups, with a coherent subset sharing few sources. Authorized Canonicalization Module (ACM): projection onto the complementary subspace, group-wise quantile calibration, addition of a fixed mean RSS

What would settle it

Train an inversion model directly on DecoyFace's protected features rather than on clean features, and measure the top-1 identity match; if the identity leakage ratio rises well above the reported 0.7% to 3.9% under this adaptive attacker, the subspace-decomposition premise is wrong. Concretely, compute the reconstruction-loss gradient covariance restricted to the complementary subspace P_N and check whether perturbing a few P_N components produces a recognizable original identity.

Watch

Extended reading notes

Core claim

The central claim is that a single intermediate feature can be split into a reconstruction-sensitive subspace, where decoy identity cues dominate, and a complementary subspace, where only sparse true-identity evidence survives. This split lets an attacker reconstruct a plausible but wrong identity while an authorized server, using matched projection and calibration, still verifies the true identity. The server-side projection cancels the decoy component exactly because decoy cues lie in the range of P_rec and P_N P_rec = 0, and the remaining complementary carrier, after group-wise quantile calibration and a fixed RSS anchor, is discriminative but not reconstructable. The paper demonstrates t

Load-bearing premise

The load-bearing premise is that the reconstruction-sensitive subspace estimated from one proxy attacker's gradient covariance is the same subspace any real attacker would rely on, and that the complementary subspace carries no exploitable identity evidence; if an attacker is sensitive to the complementary subspace or trains on protected features, identity leakage can return.

Editorial extensions

If this is right

  • An eavesdropper who inverts the transmitted feature gets a realistic face of the wrong identity, making the presence of protection harder to detect.
  • An honest-but-curious server that runs the canonicalization pipeline still cannot reconstruct the true identity: identity leakage stays below 0.34% on the tested benchmarks while face validity remains above 99.9%.
  • Authorized verification accuracy remains competitive, so utility and misdirection are not mutually exclusive.
  • Changing the selected decoy changes the identity of the reconstruction under both U-Net and flow-matching attackers, giving the defender controllable redirection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the subspace is truly attacker-agnostic, the same decomposition could be estimated from a stronger or black-box proxy, such as a diffusion-based inversion model, to raise the bar against advanced attackers; the paper does not test this directly.
  • The sharp rise in identity leakage when the number of preserved true-sample groups goes from 3 to 4 suggests a cliff between enough signal for verification and too much for reconstruction, implying that per-sample adaptive group selection could widen the safe operating range.
  • The separation principle could transfer to other split-inference tasks, such as speaker verification or medical-image classification, wherever reconstruction-sensitive and task-relevant directions can be separated; only faces are evaluated here.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. DecoyFace proposes a decoy-oriented privacy-preserving framework for split face recognition. The client decomposes an intermediate face feature into a reconstruction-sensitive subspace and a complementary subspace, injects decoy identity cues into the sensitive component, and transmits a stochastically mixed protected feature. A server-side canonicalization module suppresses the decoy component and recovers a recognition-friendly representation. The paper reports competitive verification accuracy on seven benchmarks (e.g., LFW 99.77%, IJB-C 93.35% TAR@FAR=10^-4), low identity leakage under U-Net and Flow-Matching inversion attackers (ILR 2.63%–3.86% and 0.74%–1.79% respectively), high face validity (FVR > 98.7%), and strong redirection away from the original identity (IRR 96–99%). It also evaluates an HBC server that reconstructs from the canonicalized feature, reporting ILR below 0.34%.

Significance. If the results hold, the paper offers a conceptually novel alternative to obfuscation-based PPFR: rather than making reconstructions fail, it steers them toward a plausible but incorrect identity. The idea of separating reconstruction-sensitive and recognition-relevant subspaces is original and clearly presented. The evaluation is broad in terms of benchmarks and attacker families, and the privacy metrics use an independent face-recognition oracle and face detector, which is a strength. The main risks are (i) whether the evaluated attackers instantiate the paper's own black-box threat model, and (ii) whether the 'controllable' misdirection claim is quantitatively supported, since the only reported decoy-hit ratio is about 30%.

major comments (4)
  1. [Section III-A and Section V-B, Tables III–VII] The threat model states that the malicious attacker has black-box query access to the client and trains on queried pairs (x_i, z_i). In a deployed system, the client emits the protected feature z_t, not the clean intermediate feature F_c(x). Section V-B only says the attackers are 'trained on CelebA for 100,000 iterations' and never states whether the training features are clean or protected. The RSSD proxy in Section IV-B is explicitly built from clean features z_i = F_c(x_i). If the evaluated U-Net and Flow-Matching attackers were trained on clean features and tested on protected features, then Tables III–VII measure a non-adaptive transfer attack, not the stated adversary. The authors must specify the training features and, if necessary, retrain the attackers on the protected features z_t (and on z_can for the HBC case) under the same query budget.
  2. [Table IX and Section V-E (Any Who)] The 'controllable identity misdirection' claim is not supported by the reported numbers. With the full method, DHR is only 30.19% on CPLFW, meaning that only about 30% of valid reconstructions are recognized as the assigned target decoy; the remaining ~67% are redirected to some non-original identity but not the intended one. DHR is omitted from the main privacy tables (Tables III–VII) and appears only in the ablation, which makes the controllability claim difficult to evaluate. Please report DHR (and ideally top-k decoy hit or embedding similarity to the target decoy) on all benchmarks and all ablations. If the goal is merely redirection to 'a non-original identity,' the title and contributions should be revised accordingly.
  3. [Section IV-B and Section V-B (RSSD generalization)] The reconstruction-sensitive subspace is estimated from a single U-Net proxy trained on clean features, and the evaluated U-Net attacker is the same architecture family trained on the same data. This creates a nontrivial risk that the reported U-Net ILR numbers reflect overfitting to the proxy, rather than a general property of the decomposition. The Flow-Matching result is more reassuring but it too appears to be trained on clean features. To support the 'Any Way' and 'Any Who' claims, the authors should evaluate at least one attacker that (a) is trained on protected features z_t rather than clean features, and (b) uses an inversion family not used to construct RSSD (e.g., a diffusion-prior inversion). The K=3 preserved true-sample groups in the complementary subspace are a concrete exploitation target: an adaptive attacker could learn to emphasize those groups, and the current experime
  4. [Section V-D.2, Table VIII] The HBC-server evaluation compares only against FaceObfuscator. Because the other baselines do not have a canonicalization pipeline, it is unclear how the comparison generalizes. More importantly, the HBC attacker is assumed to know the full recovery pipeline, but the experimental description does not state whether the HBC reconstruction model is trained on z_can features computed from clean images or from protected images. This is the same ambiguity as Major Comment 1, but it applies to the server-side setting where the threat model is even stronger. Please clarify and, if training is on clean-derived z_can, retrain on the actual canonicalized representations.
minor comments (6)
  1. [Section V-A, Eq. (23)] The face-validity threshold θ_f is never specified. Please state the detector and threshold used for FVR, since FVR is central to the 'imperceptible face' claim.
  2. [Title/Abstract and Section V-D] The word 'imperceptible' is validated only through face detector confidence (FVR). A human perceptual study or perceptual metrics (e.g., FID/LPIPS) would better support the claim that reconstructions are visually plausible and that protection is not perceptible.
  3. [Table II] The columns 'Privacy Protected' and 'Imperceptible' use checkmarks/crosses without a formal definition. Define the criteria for these qualitative columns.
  4. [Equation (15)] Equation (15) uses a constant ξ in the denominator, but the text says 'ε is a small constant.' The notation should be unified.
  5. [Footnote 1] Footnote 1 contains an incomplete URL placeholder. This should be removed or replaced with a proper citation/source.
  6. [Tables III–VII] The main privacy tables do not report DHR, even though it is defined in Eq. (26). Including it would align the tables with the paper's stated decoy-oriented objective.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: privacy metrics are measured with independent attackers and an independent face-recognition oracle; the U-Net proxy/attacker overlap is a caveat, not a definitional reduction.

full rationale

The load-bearing derivation is the RSSD construction (Eqs. 1-3, 13-14): P_rec is estimated from the gradient covariance of an offline U-Net proxy, and the protected feature is formed as z_tilde = n_tilde + r_B with r_B in range(P_rec); the server-side cancellation z_s = P_N n_tilde follows from P_N P_rec = 0 by construction. These are explicit construction identities, not hidden reuses of the target result. The privacy metrics (ILR, IRR, FVR, COS) are not computed from the fitted subspace constants or from the training loss; they are obtained by running independently trained U-Net and Flow-Matching attackers and scoring reconstructions with an external face-recognition oracle and face detector. A genuine caveat is that the RSSD proxy and the evaluated U-Net attacker share the same architecture and dataset (Section IV-B vs V-B), so the 2.93% U-Net ILR reflects a partially matched inversion family rather than a fully transferable guarantee; however, the Flow-Matching attacker and the HBC-server evaluation provide independent evidence for the central misdirection claim. Self-citation [8] is used as an attack benchmark and threat-model motivation, not as a uniqueness theorem or as a premise that forces the defense's design. Therefore no circular step rises to the level of a definitional or fitted-input prediction.

Assumptions & free parameters 9 free parameters · 5 assumptions · 1 invented entities

All load-bearing structure is empirical: the subspace is learned from a proxy, the bank and mixing hyperparameters are chosen/ablated, and the security claim is supported only by the paper's own two-attacker evaluation. There are no new physical entities; the RSS is a modeling construct with no independent evidence outside the paper.

free parameters (9)
  • RSS rank r = 32
    Number of top eigenvectors of proxy gradient covariance; hand-chosen, not ablated; sets how much decoy is injected into the reconstruction-sensitive subspace.
  • preserved true groups K = 3
    Ablated in Table X: K=2 drops accuracy to 80.98%, K=4 raises ILR to 83.48%; load-bearing utility/privacy knob.
  • group count G = 16
    Group size 4 over C=64 channels; G=32 with K=6 degrades both accuracy and ILR in Table X.
  • quantile q and target server scale tau_s = q=0.95, tau_s=0.8
    Server canonicalization constants; no sensitivity analysis; affect recognition stability and HBC reconstruction.
  • coherent-subset size s_c and shared-source count L = s_c ~ U[8,12], L ~ U[2,4]
    Control source sharing among replaced groups; removing coherence raises ILR from 2.63% to 86.69% (Table IX).
  • auxiliary decoy bank size M = 5000
    Sampled from CelebA; supplies replacement groups and the RSS anchor mu_rec; size not varied.
  • random scale exponent k = uniform in [-3,3]
    Transport-time scaling; removing it raises ILR to 72.89% (Table IX).
  • consistency-loss weight lambda_cons = 0.1
    Multi-view embedding consistency weight; ablation without it drops accuracy to 88.77% on CPLFW.
  • proxy U-Net / reconstruction-sensitive subspace P_rec = 30,000-iteration U-Net on CelebA; top-32 eigenvectors
    The entire decoy injection and server suppression depend on this estimated subspace; the proxy family matches the evaluated U-Net attacker, so it may be overfit.
assumptions (5)
  • domain assumption First-order gradient covariance of a single proxy inversion network identifies the directions that dominate any reconstruction attack.
    Used in Section IV-B, Eqs. (1)-(2). No curvature terms, no model-mismatch guarantee, no formal transfer argument.
  • domain assumption The evaluated attackers are representative of a real adversary who has black-box access to the deployed protected client.
    Section V-B/V-D never states whether the U-Net and Flow-Matching attackers are trained on original features z or protected features z_t; if trained on original features, the reported ILR overstates protection.
  • domain assumption An HBC server that knows the full canonicalization pipeline cannot recover the true identity from z_can even though the authorized path can.
    Section IV-D and Table VIII. The recognition utility must rely on the same K true groups that reconstruction supposedly cannot exploit; no argument beyond experiments.
  • domain assumption The closed-set gallery T contains the true identity and assigned decoy identity for every test sample.
    Section V-A, Eqs. (23)-(26). The gallery is never specified; if it excludes true identities, ILR is trivially near zero and IRR is forced high.
  • standard math Orthogonal projection cancellation P_N P_rec = 0 holds as in Eq. (14).
    True by construction for orthogonal projectors; load-bearing for server-side removal of the decoy.
invented entities (1)
  • Reconstruction-sensitive subspace (RSS) and complementary subspace
    purpose: Decompose intermediate features so decoy cues can be injected into directions that dominate inversion while recognition evidence is carried in the complement.
    Defined by eigendecomposition of the proxy's gradient covariance (Section IV-B). The only evidence for its attacker-transferability is the paper's own experiments; no external or formal validation is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DecoyFace: Beyond Obfuscation via Controllable and Imperceptible Identity Misdirection for Privacy-Preserving Face Recognition." pith.science (2026). https://pith.science/paper/3QKUCL73

@misc{pith2026260717504,
  author       = {Pith},
  title        = {Pith review of: DecoyFace: Beyond Obfuscation via Controllable and Imperceptible Identity Misdirection for Privacy-Preserving Face Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3QKUCL73}},
  note         = {Machine review of arXiv:2607.17504}
}
read the original abstract

Split face recognition reduces client-side computation but exposes intermediate features to feature inversion attacks and unauthorized analysis by honest-but-curious (HBC) servers. Existing privacy-preserving face recognition methods mainly aim to resist unauthorized reconstruction, typically producing features whose inversion yields visibly degraded results, which may reveal the existence of protection and motivate adaptive attacks. To address this issue, we propose DecoyFace, an imperceptible decoy-oriented framework that steers unauthorized reconstruction toward a plausible but incorrect identity while preserving recognition utility. The key idea is to decompose the intermediate representation into a reconstruction-sensitive subspace and its complementary subspace. The client injects decoy identity cues into the reconstruction-sensitive subspace, while limited recognition-relevant evidence from the true sample is retained in the complementary subspace. On the server side, an authorized canonicalization module suppresses decoy-dominant components and recovers a recognition-friendly representation. This design addresses both attacker-side inversion from intercepted features and HBC server-side reconstruction from canonicalized representations. Experiments show that DecoyFace preserves competitive recognition accuracy while substantially reducing identity leakage to 2.93% under U-Net attacks and 0.74% under Flow-Matching attacks while yielding visually plausible and imperceptible reconstructions, with over 99.78% face validity on LFW dataset.

Figures

Figures reproduced from arXiv: 2607.17504 by the authors.

Figure 1
Figure 1. Comparison between existing PPFR methods (Top Row) and the [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of the proposed DecoyFace framework. The edge device decomposes the intermediate representation, injects decoy cues into the reconstruction [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Construction and illustration of the reconstruction-sensitive subspace. Perturbations restricted to the RSS induce substantially larger reconstruction [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Detailed design of Decoy-Guided Coherent Mixing (DGCM). DGCM first applies channel-shuffled grouping (CSG) to partition complementary features [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Qualitative reconstruction results under U-Net and Flow-Matching attackers. DecoyFace produces plausible reconstructions that are visually closer to [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Privacy–utility visualization on the LFW. The markers of [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Privacy–utility visualization on the AgeDB. The markers of [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Privacy–utility visualization on the CFP-FP. The markers of [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Privacy–utility visualization on the CALFW. The markers of [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Privacy–utility visualization on the CPLFW. The markers of [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Qualitative results with different decoy identities. The original face [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

43 extracted references · 7 linked inside Pith

  1. [1]

    Neurosurgeon: Collaborative intelligence between the cloud and mobile edge.ACM SIGARCH Computer Architecture News, 45(1):615–629, 2017

    Yiping Kang, Johann Hauswald, Cao Gao, Austin Rovinski, Trevor Mudge, Jason Mars, and Lingjia Tang. Neurosurgeon: Collaborative intelligence between the cloud and mobile edge.ACM SIGARCH Computer Architecture News, 45(1):615–629, 2017

    2017

  2. [2]

    Distributed deep neural networks over the cloud, the edge and end devices

    Surat Teerapittayanon, Bradley McDanel, and Hsiang-Tsung Kung. Distributed deep neural networks over the cloud, the edge and end devices. In2017 IEEE 37th international conference on distributed computing systems, pages 328–339. IEEE, 2017

    2017

  3. [3]

    Simba: Split infer- ence—mechanisms, benchmarks and attacks

    Abhishek Singh, Vivek Sharma, Rohan Sukumaran, John Mose, Jef- frey Chiu, Justin Yu, and Ramesh Raskar. Simba: Split infer- ence—mechanisms, benchmarks and attacks. InEur . Conf. Comput. Vis., pages 214–232. Springer, 2024

    2024

  4. [4]

    Gan you see me? enhanced data reconstruction attacks against split inference.Adv

    Ziang Li, Mengda Yang, Yaxin Liu, Juan Wang, Hongxin Hu, Wenzhe Yi, and Xiaoyang Xu. Gan you see me? enhanced data reconstruction attacks against split inference.Adv. Neural Inform. Process. Syst., 36:54554– 54566, 2023

    2023

  5. [5]

    Dia: Diffusion based inverse network attack on collaborative inference

    Dake Chen, Shiduo Li, Yuke Zhang, Chenghao Li, Souvik Kundu, and Peter A Beerel. Dia: Diffusion based inverse network attack on collaborative inference. InIEEE Conf. Comput. Vis. Pattern Recog., pages 124–130, 2024

    2024

  6. [6]

    Unlocking visual secrets: Inverting features with diffusion priors for image reconstruction

    Sai Qian Zhang, Ziyun Li, Chuan Guo, Saeed Mahloujifar, Deeksha Dan- gwal, Edward Suh, Barbara De Salvo, and Chiao Liu. Unlocking visual secrets: Inverting features with diffusion priors for image reconstruction. arXiv preprint arXiv:2412.10448, 2024

    arXiv 2024

  7. [7]

    Drag: Data reconstruction attack using guided diffusion

    Wa-Kin Lei, Jun-Cheng Chen, and Shang-Tse Chen. Drag: Data reconstruction attack using guided diffusion. InInternational Conference on Machine Learning, pages 33883–33901. PMLR, 2025

    2025

  8. [8]

    What your features reveal: Data-efficient black-box feature inversion attack for split dnns

    Zhihan Ren, Lijun He, Jiaxi Liang, Xinzhu Fu, Haixia Bi, and Fan Li. What your features reveal: Data-efficient black-box feature inversion attack for split dnns. InIEEE Conf. Comput. Vis. Pattern Recog., pages 13366–13375, 2026

    2026

Show all 43 references
  1. [9]

    Anti-fake vaccine: Safeguarding privacy against face swapping via visual-semantic dual degradation.Int

    Jingzhi Li, Changjiang Luo, Hua Zhang, Yang Cao, Xin Liao, and Xiaochun Cao. Anti-fake vaccine: Safeguarding privacy against face swapping via visual-semantic dual degradation.Int. J. Comput. Vis., 133(4):2025–2043, 2025

    2025

  2. [10]

    Faceswapguard: Safeguarding facial privacy from deepfake threats through identity obfuscation.arXiv preprint arXiv:2502.10801, 2025

    Li Wang, Zheng Li, Xuhong Zhang, Shouling Ji, and Shanqing Guo. Faceswapguard: Safeguarding facial privacy from deepfake threats through identity obfuscation.arXiv preprint arXiv:2502.10801, 2025

    2025 arXiv

  3. [11]

    Nullswap: Proactive identity cloaking against deepfake face swapping

    Tianyi Wang, Shuaicheng Niu, Harry Cheng, Xiao Zhang, and Yinglong Wang. Nullswap: Proactive identity cloaking against deepfake face swapping. InInt. Conf. Comput. Vis., pages 9945–9954, 2025

    2025

  4. [12]

    On generating identifiable virtual faces

    Zhuowen Yuan, Zhengxin You, Sheng Li, Zhenxing Qian, Xinpeng Zhang, and Alex Kot. On generating identifiable virtual faces. InACM Int. Conf. Multimedia, pages 1465–1473, 2022

    2022

  5. [13]

    Make privacy renewable! generating privacy-preserving JOURNAL OF LATEX CLASS FILES, VOL

    Tao Wang, Yushu Zhang, Xiangli Xiao, Lin Yuan, Zhihua Xia, and Jian Weng. Make privacy renewable! generating privacy-preserving JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 13 faces supporting cancelable biometric recognition. InACM Int. Conf. Multimedia, pages 10...

    2021

  6. [14]

    Image feature extraction in encrypted domain with privacy-preserving sift.IEEE Trans

    Chao-Yung Hsu, Chun-Shien Lu, and Soo-Chang Pei. Image feature extraction in encrypted domain with privacy-preserving sift.IEEE Trans. Image Process., 21(11):4593–4607, 2012

    2012

  7. [15]

    Cryptoface: End-to-end encrypted face recognition

    Wei Ao and Vishnu Naresh Boddeti. Cryptoface: End-to-end encrypted face recognition. InIEEE Conf. Comput. Vis. Pattern Recog., pages 19197–19206, 2025

    2025

  8. [16]

    Privacy-preserving face recognition with learnable privacy budgets in frequency domain

    Jiazhen Ji, Huan Wang, Yuge Huang, Jiaxiang Wu, Xingkun Xu, Shouhong Ding, ShengChuan Zhang, Liujuan Cao, and Rongrong Ji. Privacy-preserving face recognition with learnable privacy budgets in frequency domain. InEur . Conf. Comput. Vis., pages 475–491. Springer, 2022

    2022

  9. [17]

    Privacy-preserving adversarial facial features

    Zhibo Wang, He Wang, Shuaifan Jin, Wenwen Zhang, Jiahui Hu, Yan Wang, Peng Sun, Wei Yuan, Kaixin Liu, and Kui Ren. Privacy-preserving adversarial facial features. InIEEE Conf. Comput. Vis. Pattern Recog., pages 8212–8221, 2023

    2023

  10. [18]

    Duetface: Collaborative privacy-preserving face recognition via channel splitting in the frequency domain

    Yuxi Mi, Yuge Huang, Jiazhen Ji, Hongquan Liu, Xingkun Xu, Shouhong Ding, and Shuigeng Zhou. Duetface: Collaborative privacy-preserving face recognition via channel splitting in the frequency domain. InACM Int. Conf. Multimedia, pages 6755–6764, 2022

    2022

  11. [19]

    Privacy- preserving face recognition using trainable feature subtraction

    Yuxi Mi, Zhizhou Zhong, Yuge Huang, Jiazhen Ji, Jianqing Xu, Jun Wang, Shaoming Wang, Shouhong Ding, and Shuigeng Zhou. Privacy- preserving face recognition using trainable feature subtraction. InIEEE Conf. Comput. Vis. Pattern Recog., pages 297–307, 2024

    2024

  12. [20]

    FaceObfuscator: Defending deep learning-based privacy attacks with gradient descent-resistant features in face recognition

    Shuaifan Jin, He Wang, Zhibo Wang, Feng Xiao, Jiahui Hu, Yuan He, Wenwen Zhang, Zhongjie Ba, Weijie Fang, Shuhong Yuan, et al. FaceObfuscator: Defending deep learning-based privacy attacks with gradient descent-resistant features in face recognition. In33rd USENIX Security Sym...

    2024

  13. [21]

    Fracface: Breaking the visual clues—fractal-based privacy- preserving face recognition

    Wanying Dai, Beibei Li, Naipeng Dong, Guangdong Bai, and Jin Song Dong. Fracface: Breaking the visual clues—fractal-based privacy- preserving face recognition. InAdv. Neural Inform. Process. Syst., 2025

    2025

  14. [22]

    Generative modeling by estimating gradients of the data distribution.Adv

    Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution.Adv. Neural Inform. Process. Syst., 32, 2019

    2019

  15. [23]

    Context aware edge-enhanced gan for remote sensing image super-resolution.IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 17:1363–1376, 2023

    Zhihan Ren, Lijun He, and Jichuan Lu. Context aware edge-enhanced gan for remote sensing image super-resolution.IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 17:1363–1376, 2023

    2023

  16. [24]

    Unsupervised pansharpening based on double-cycle consistency.IEEE Transactions on Geoscience and Remote Sensing, 62:1–15, 2024

    Lijun He, Zhihan Ren, Wanyue Zhang, Fan Li, and Shaohui Mei. Unsupervised pansharpening based on double-cycle consistency.IEEE Transactions on Geoscience and Remote Sensing, 62:1–15, 2024

    2024

  17. [25]

    Super-resolution learning strategy based on expert knowledge supervision.Remote Sensing, 16(16):2888, 2024

    Zhihan Ren, Lijun He, and Peipei Zhu. Super-resolution learning strategy based on expert knowledge supervision.Remote Sensing, 16(16):2888, 2024

    2024

  18. [26]

    Beyond hallucinations: A multimodal-guided task-aware generative image com- pression for ultra-low bitrate.arXiv preprint arXiv:2512.06344, 2025

    Kaile Wang, Lijun He, Haisheng Fu, Haixia Bi, and Fan Li. Beyond hallucinations: A multimodal-guided task-aware generative image com- pression for ultra-low bitrate.arXiv preprint arXiv:2512.06344, 2025

    2025 arXiv

  19. [27]

    Blind inversion using latent diffusion priors.IEEE Trans

    Weimin Bai, Siyi Chen, Wenzheng Chen, and He Sun. Blind inversion using latent diffusion priors.IEEE Trans. Image Process., 2026

    2026

  20. [28]

    Score-based generative modeling through stochastic differential equations.arXiv preprint arXiv:2011.13456, 2020

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations.arXiv preprint arXiv:2011.13456, 2020

    2011 arXiv

  21. [29]

    Flow matching for generative modeling.arXiv preprint arXiv:2210.02747, 2022

    Yaron Lipman, Ricky TQ Chen, Heli Ben-Hamu, Maximilian Nickel, and Matt Le. Flow matching for generative modeling.arXiv preprint arXiv:2210.02747, 2022

    2022 arXiv

  22. [30]

    Instance normalization: The missing ingredient for fast stylization.arXiv preprint arXiv:1607.08022, 2016

    Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Instance normalization: The missing ingredient for fast stylization.arXiv preprint arXiv:1607.08022, 2016

    2016 arXiv

  23. [31]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. InIEEE Conf. Comput. Vis. Pattern Recog., pages 4690–4699, 2019

    2019

  24. [32]

    Ms-celeb-1m: A dataset and benchmark for large-scale face recognition

    Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao. Ms-celeb-1m: A dataset and benchmark for large-scale face recognition. InEur . Conf. Comput. Vis., pages 87–102. Springer, 2016

    2016

  25. [33]

    Labeled faces in the wild: A database forstudying face recognition in unconstrained environments

    Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller. Labeled faces in the wild: A database forstudying face recognition in unconstrained environments. InWorkshop on faces in Real-Life Images: detection, alignment, and recognition, 2008

    2008

  26. [34]

    Agedb: the first manually collected, in-the-wild age database

    Stylianos Moschoglou, Athanasios Papaioannou, Christos Sagonas, Jiankang Deng, Irene Kotsia, and Stefanos Zafeiriou. Agedb: the first manually collected, in-the-wild age database. InIEEE Conf. Comput. Vis. Pattern Recog. Worksh., pages 51–59, 2017

    2017

  27. [35]

    Frontal to profile face verification in the wild

    Soumyadip Sengupta, Jun-Cheng Chen, Carlos Castillo, Vishal M Patel, Rama Chellappa, and David W Jacobs. Frontal to profile face verification in the wild. In2016 IEEE winter conference on applications of computer vision, pages 1–9. IEEE, 2016

    2016

  28. [36]

    Cross-age LFW: A database for studying cross-age face recognition in unconstrained environments

    Tianyue Zheng, Weihong Deng, and Jiani Hu. Cross-age LFW: A database for studying cross-age face recognition in unconstrained environments. arXiv preprint arXiv:1708.08197, 2017

    2017 arXiv

  29. [37]

    Cross-pose lfw: A database for studying cross-pose face recognition in unconstrained environments

    Tianyue Zheng and Weihong Deng. Cross-pose lfw: A database for studying cross-pose face recognition in unconstrained environments. Beijing University of Posts and Telecommunications, Tech. Rep, 5(7):5, 2018

    2018

  30. [38]

    Iarpa janus benchmark-b face dataset

    Cameron Whitelam, Emma Taborsky, Austin Blanton, Brianna Maze, Jocelyn Adams, Tim Miller, Nathan Kalka, Anil K Jain, James A Duncan, Kristen Allen, et al. Iarpa janus benchmark-b face dataset. InIEEE Conf. Comput. Vis. Pattern Recog. Worksh., pages 90–98, 2017

    2017

  31. [39]

    Iarpa janus benchmark-c: Face dataset and protocol

    Brianna Maze, Jocelyn Adams, James A Duncan, Nathan Kalka, Tim Miller, Charles Otto, Anil K Jain, W Tyler Niggel, Janet Anderson, Jordan Cheney, et al. Iarpa janus benchmark-c: Face dataset and protocol. In2018 international conference on biometrics (ICB), pages 158–165. IEEE, 2018

    2018

  32. [40]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InIEEE Conf. Comput. Vis. Pattern Recog., pages 770–778, 2016

    2016

  33. [41]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. InInt. Conf. Comput. Vis., pages 3730–3738, 2015

    2015

  34. [42]

    U-net: Convo- lutional networks for biomedical image segmentation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convo- lutional networks for biomedical image segmentation. InInternational Conference on Medical image computing and computer-assisted inter- vention, pages 234–241. Springer, 2015

    2015

  35. [43]

    Not all features are equal: Discovering essential features for preserving prediction privacy

    Fatemehsadat Mireshghallah, Mohammadkazem Taram, Ali Jalali, Ahmed Taha Taha Elthakeb, Dean Tullsen, and Hadi Esmaeilzadeh. Not all features are equal: Discovering essential features for preserving prediction privacy. InProceedings of the Web Conference, pages 669–680, 2021

    2021

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.