Pith. sign in

REVIEW 3 major objections 4 minor 48 references

CryptoFace: End-to-End Encrypted Face Recognition

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CryptoFace is the first face recognition system to keep the whole pipeline—extraction, matching, and decision—encrypted, and it reports a 7x speedup with accuracy gains over prior encrypted networks.

desk verdict First credible end-to-end encrypted face recognition under FHE, with a load-bearing security overclaim that needs fixing before the headline holds. read the letter →

arxiv 2509.00332 v1 pith:DJ5Y3OFA submitted 2025-08-30 cs.CV cs.CR

Wei Ao , Vishnu Naresh Boddeti This is my paper
classification cs.CVcs.CR
keywords facerecognitionfullyhomomorphicencryptionencryptedinferenceprivacy-preservingbiometricspatch-basedconvolutionalnetworkspolynomialactivationsCKKScosinesimilarity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims to build the first face recognition system that runs the entire verification pipeline—feature extraction, similarity matching, and score thresholding—under fully homomorphic encryption, so a server never sees a plaintext face, feature, or match decision. The central design is CryptoFaceNet, a mixture of shallow patch convolutional networks: each patch of a face is processed by a small network with low multiplicative depth, the patch networks are evaluated in parallel, and their outputs are fused by ciphertext additions, which keeps latency near constant as resolution grows. Against state-of-the-art FHE neural networks adapted for face recognition, the paper reports a 7.2x speedup over the strongest baseline and up to 8.8 percentage points higher verification accuracy, with a single bootstrapping operation per inference. The authors position CryptoFace as a practical route to face recognition with robust, post-quantum security guarantees.

What carries the argument

The load-bearing mechanism is CryptoFaceNet, a mixture of shallow patch convolutional networks (PCNNs). A face is divided into non-overlapping patches, each processed by a small CNN whose low multiplicative depth allows encrypted evaluation with only one bootstrapping operation; the patch CNNs run in parallel, and their local features are fused by a decomposed vector-matrix product that reduces to ciphertext additions. Two supporting pieces carry the rest of the argument: a depth-optimal shifted AESPA block, a convolutional block whose Hermite polynomial activation is merged into the preceding convolution to save two multiplicative levels; and a distribution-aware degree-2 polynomial p(t)=β2

What would settle it

Run the cited template-recovery attack against the CryptoFace match oracle: let an adversarial client craft probe faces, receive the decrypted positive/negative result, and attempt to recover the server's reference feature. Recovery of the template, or of a face image whose matching behavior matches the reference, would refute the paper's end-to-end privacy claim.

Watch

Extended reading notes

Core claim

CryptoFace's central claim is that all three stages of face recognition—feature extraction, feature matching, and threshold comparison—can be performed in the encrypted domain with no decryption at any point, under the CKKS fully homomorphic encryption scheme. The client encrypts a probe face and sends it to the server, which extracts an encrypted feature with CryptoFaceNet, matches it against an encrypted reference feature in the server's database, computes the cosine-similarity score via a distribution-aware degree-2 polynomial approximation of the inverse square root, compares the score to a threshold, and returns only an encrypted positive/negative result that the client decrypts. The pa

Load-bearing premise

The entire privacy guarantee rests on the claim that an adversarial client who receives only an encrypted match/no-match result cannot infer the server's reference features; the paper asserts this without proof, and the template-recovery attack it cites suggests the binary oracle may leak enough to reconstruct the template.

Editorial extensions

If this is right

  • A server can offer face verification without ever seeing raw face images or feature vectors in plaintext, shifting the privacy boundary from the feature extractor to the client's secret key.
  • The same architecture handles higher-resolution inputs with negligible latency increase, so secure face recognition can use more informative images rather than being limited to tiny crops.
  • Reducing the pipeline to a single bootstrapping operation cuts both latency and RAM footprint relative to prior FHE CNNs, which need multiple bootstrappings.
  • Because matching and thresholding happen under encryption, the system supports one-to-many identification as well as one-to-one verification, with rank-1 accuracy of 92.19% on a 1:128 retrieval task.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The end-to-end privacy guarantee reduces to the behavior of the match/no-match oracle: if an adversarial client can query the server with crafted probes and observe the decrypted binary result, the cited template-recovery attack suggests the reference feature may be recoverable; the paper does not test this.
  • The near-resolution-independent latency figure assumes enough parallel compute for all patch networks at once; on hardware with limited parallelism, doubling resolution should raise latency, so the constant-latency behavior is deployment-dependent.
  • The polynomial ℓ2 approximation and the decision threshold are calibrated on the distribution of squared feature norms in the test data; using CryptoFace on a much harder or out-of-distribution face set would likely require recalibrating the control points and threshold.
  • The same patch-mixture recipe could transfer to other encrypted high-resolution vision tasks such as iris or gait recognition, since the FHE constraints—low multiplicative depth, parallel patch evaluation, polynomial activations—are generic.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper presents CryptoFace, an end-to-end encrypted face recognition system built on CKKS fully homomorphic encryption (FHE). All stages of the pipeline—feature extraction, feature matching, and score thresholding—are performed on encrypted data, and the client receives only an encrypted accept/reject bit. The core architecture, CryptoFaceNet, is a mixture of shallow patch-based CNNs that reduces multiplicative depth to a single bootstrapping operation and is evaluated in parallel, giving near-resolution-independent latency. A degree-2 polynomial is used to approximate the L2 normalization, and the matching threshold is estimated on the cleartext training folds. Experiments on standard face benchmarks (LFW, AgeDB, CALFW, CPLFW, CFP-FP, and subsets of IJB-B/IJB-C) report a 7x speedup over MPCNN and AutoFHE baselines adapted for face recognition, with accuracy improvements up to +8.8 percentage points. The code is released.

Significance. If the results hold, CryptoFace is a useful engineering contribution: it demonstrates a practical FHE-based face recognition pipeline that avoids decryption at the server, provides a detailed latency breakdown, and releases source code. The patch-based parallel design and the depth-optimized convolution block are sensible and likely to be adopted by practitioners. However, the paper's headline security guarantee is not established. The threat-model argument in Sec. 3.1 dismisses oracle-based template recovery without proof, and the baseline comparison is partly handicapped by a transferred AutoFHE configuration. These issues do not invalidate the empirical findings, but they do affect the strength of the central claims.

major comments (3)
  1. [Sec. 3.1, Threat Model] The assertion that an adversarial client 'cannot infer the encrypted features stored on the server' is unsupported. The protocol gives the client an oracle: after decrypting the returned bit, the client can submit arbitrary crafted probe images and observe match/no-match results. The paper itself cites Bassit et al. [2], a template recovery attack against homomorphically encrypted biometric systems with unprotected threshold comparison—exactly the interface CryptoFace exposes. No simulator, query-complexity bound, or formal security definition is provided. This is load-bearing for the 'robust and provable security' claim in the abstract and conclusion. Please either provide a proof bounding template recovery from binary oracle access, or restate the guarantee as security against a semi-honest server and against passive leakage of intermediate features, explicitly excluding active oracle-
  2. [Sec. 4, Baselines] AutoFHE is evaluated using a search result obtained on CIFAR and transferred to the face dataset without re-running the search. This is disclosed, but it likely handicaps the baseline: AutoFHE's architecture is not adapted to 64x64 face inputs or to the face recognition task, whereas CryptoFaceNet is designed specifically for this setting. As a result, the claimed '+6.73%' accuracy and '2.9x' speedup over AutoFHE are not a like-for-like comparison. Please either run AutoFHE's search on a face dataset (or a close proxy), or clearly label the comparison as 'out-of-the-box transfer' and temper the claims accordingly.
  3. [Table 1, Sec. 4.1] The 10-fold cross-validation results are reported as point estimates only, with no variance or significance testing. Given the small accuracy gaps between methods (e.g., MPCNN ResNet44 at 89.64% vs. CryptoFaceNet4 at 89.42% for 64x64), it is unclear whether the observed differences are statistically meaningful. Please include fold-level standard deviations or a paired significance test.
minor comments (4)
  1. [Sec. 3.1, Eq. (3)] In the definition of Score, the second term should be y2/||y2||, not y1/||y1||. As written, the expression is identically zero and the subsequent simplification to 2 - 2 y1·y2/(||y1||||y2||) is inconsistent.
  2. [Sec. 4.1, Table 1] The labels CryptoFaceNet4/9/16 are introduced after the table but can be confusing at first reading; please define the naming convention (number of patches) explicitly before the table or in a footnote.
  3. [Sec. 4.1, first paragraph after Table 1] The comparison 'CryptoFace speeds up inference by 5.4x and increases FR performance by +3.82%' should state the explicit baseline (MPCNN ResNet32) in the same sentence for clarity.
  4. [Fig. 6] The bottom panel reports log2 approximation error, but the caption does not state the base of the logarithm. Please add this detail.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the accuracy and latency claims are measured benchmark results under cross-validation, not predictions derived from fitted constants or self-citations.

full rationale

I examined the claimed derivation chain. The main engineering claims (patch-parallel FHE feature extraction, depth-reduced CryptoFaceNet blocks, polynomial ℓ2-normalization approximation, thresholding) are supported by the construction in Sec. 3.2–3.3 and by implementation measurements in Sec. 4. The polynomial coefficients and matching threshold are estimated in the nine cleartext training folds and evaluated on the held-out ciphertext fold (Sec. 4.1: 'nine groups (cleartext) are used to estimate the threshold and polynomial approximation of ℓ2 normalization, while the standalone group (ciphertext) is used to test performance'), so this is standard cross-validation, not a fitted input called a prediction. The reported verification accuracies and latencies (Tables 1–3, Fig. 7) are measurements on standard benchmarks, not predictions that reduce to fitted constants by construction. The authors' self-citations ([1] AutoFHE, [3], [15]) are used as baselines, threat-model reference, and implementation scaffolding, but the central novelty does not rest on an unverified premise imported from those citations. The assertion in Sec. 3.1 that an adversarial client 'cannot infer the encrypted features stored on the server' is a security-proof gap (the client is given a decrypted match/no-match bit and can query repeatedly), but that is a correctness/rigor concern, not a circular reduction of a claimed result to its inputs. No circular step meeting the rubric's evidentiary standard was found.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The core cryptographic mechanism is standard CKKS FHE. The main data-dependent components are the polynomial L2 approximation coefficients and the matching threshold, both fit on the test data's cleartext folds. The security model includes an unproven assumption about the difficulty of template recovery from a binary oracle, which is the most fragile part of the paper.

free parameters (2)
  • Polynomial coefficients beta0, beta1, beta2 for 1/sqrt(t) approximation = Not reported; fit on cleartext folds using control points t1=Mean-Std, t2=Mean, t3=Mean+Std
    These three coefficients are fitted to the distribution of ||y||^2 on the test data's cleartext portion (Section 3.3, Section 4.1). They are not derived from first principles.
  • Matching threshold T = Estimated per dataset on nine cleartext folds (Section 4.1)
    The threshold is set to accommodate the polynomial L2 approximation and is estimated from the same dataset used for evaluation, a standard but data-dependent procedure.
assumptions (4)
  • standard math CKKS FHE scheme provides semantic security and approximate arithmetic under the chosen ring degree and modulus (2^16, 46-bit modulus)
    Security relies on the LWE/RLWE hardness assumption from cited literature [7,8,9]. The 128-bit security claim follows from prior analysis [10].
  • domain assumption Cosine similarity is the appropriate distance metric for face verification
    The Match function in Equation 3 is built from cosine similarity, following standard practice in face recognition [13]. This assumption is inherited from the face recognition literature.
  • domain assumption A three-point polynomial p(t) with control points at Mean-Std, Mean, Mean+Std approximates 1/sqrt(t) with sufficient accuracy on the test distribution
    The authors verify this empirically in Figure 6 (error <= 2^-10) but provide no guarantee for out-of-distribution data. The polynomial is fitted to the same data distribution it is evaluated on.
  • ad hoc to paper A semi-honest adversarial client cannot recover server reference features from the binary match result
    Asserted in Section 3.1 without a formal proof. This is load-bearing for the security claim and is in tension with the cited template recovery attack [2].

how reviews work

0 comments
Cite this review

Pith. "Pith review of CryptoFace: End-to-End Encrypted Face Recognition." pith.science (2026). https://pith.science/paper/DJ5Y3OFA

@misc{pith2026250900332,
  author       = {Pith},
  title        = {Pith review of: CryptoFace: End-to-End Encrypted Face Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DJ5Y3OFA}},
  note         = {Machine review of arXiv:2509.00332}
}
read the original abstract

Face recognition is central to many authentication, security, and personalized applications. Yet, it suffers from significant privacy risks, particularly arising from unauthorized access to sensitive biometric data. This paper introduces CryptoFace, the first end-to-end encrypted face recognition system with fully homomorphic encryption (FHE). It enables secure processing of facial data across all stages of a face-recognition process--feature extraction, storage, and matching--without exposing raw images or features. We introduce a mixture of shallow patch convolutional networks to support higher-dimensional tensors via patch-based processing while reducing the multiplicative depth and, thus, inference latency. Parallel FHE evaluation of these networks ensures near-resolution-independent latency. On standard face recognition benchmarks, CryptoFace significantly accelerates inference and increases verification accuracy compared to the state-of-the-art FHE neural networks adapted for face recognition. CryptoFace will facilitate secure face recognition systems requiring robust and provable security. The code is available at https://github.com/human-analysis/CryptoFace.

Figures

Figures reproduced from arXiv: 2509.00332 by the authors.

Figure 1
Figure 1. Secure FR systems. (1) Top: existing secure FR system [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. CryptoFace. Top: offline; bottom: online. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Left: cleartext training; right: encrypted inference. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Convolutional blocks and their FHE implementations. Left: ResNet [ [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: CryptoFaceNet. Top: training; bottom: inference. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 7
Figure 7. Figure 7: Experiments on IJB-B and IJB-C [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

48 extracted references · 44 canonical work pages

  1. [2]

    Template recovery at- tack on homomorphically encrypted biometric recognition systems with unprotected threshold comparison

    Amina Bassit, Florian Hahn, Zohra Rezgui, Una Kelly, Ray- mond Veldhuis, and Andreas Peter. Template recovery at- tack on homomorphically encrypted biometric recognition systems with unprotected threshold comparison. In IEEE International Joint Conference on Biometrics . IEEE, 2023. 1

    work page 2023

  2. [1]

    AutoFHE: Automated adaption of CNNs for efficient evaluation over FHE

    Wei Ao and Vishnu Naresh Boddeti. AutoFHE: Automated adaption of CNNs for efficient evaluation over FHE. In USENIX Security Symposium , pages 2173–2190. USENIX Association, 2024. 2, 3, 4, 5, 6, 7

    work page 2024

  3. [3]

    Secure face matching using fully homomorphic encryption

    Vishnu Naresh Boddeti. Secure face matching using fully homomorphic encryption. In IEEE International Conference on Biometrics: Theory, Applications, and Systems, pages 1–

    work page

  4. [4]

    Efficient bootstrapping for approximate homomorphic encryption with non-sparse keys

    Jean-Philippe Bossuat, Christian Mouchet, Juan Troncoso- Pastoriza, and Jean-Pierre Hubaux. Efficient bootstrapping for approximate homomorphic encryption with non-sparse keys. In International Conference on the Theory and Appli- cations of Cryptographic Techniques, pages 587–617, 2021. 3

    work page 2021

  5. [5]

    Low latency privacy preserving inference

    Alon Brutzkus, Ran Gilad-Bachrach, and Oren Elisha. Low latency privacy preserving inference. In International Con- ference on Machine Learning, pages 812–821, 2019. 3

    work page 2019

  6. [6]

    Jigsaw-ViT: Learning jigsaw puzzles in vision transformer

    Yingyi Chen, Xi Shen, Yahui Liu, Qinghua Tao, and Jo- han AK Suykens. Jigsaw-ViT: Learning jigsaw puzzles in vision transformer. Pattern Recognition Letters, 166:53–60,

    work page

  7. [7]

    Homomorphic encryption for arithmetic of approx- imate numbers

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. Homomorphic encryption for arithmetic of approx- imate numbers. In International Conference on the The- ory and Application of Cryptology and Information Security, pages 409–437, 2017. 1, 2, 3

    work page 2017

  8. [8]

    Bootstrapping for approximate homo- morphic encryption

    Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song. Bootstrapping for approximate homo- morphic encryption. In International Conference on the The- ory and Applications of Cryptographic Techniques , pages 360–384, 2018. 3

    work page 2018

Show all 48 references
  1. [9]

    A full RNS variant of approximate ho- momorphic encryption

    Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim, and Yongsoo Song. A full RNS variant of approximate ho- momorphic encryption. In International Conference on Se- lected Areas in Cryptography, pages 347–368, 2018. 1, 2

    2018

  2. [10]

    A hybrid of dual and meet-in-the-middle attack on sparse and ternary secret LWE

    Jung Hee Cheon, Minki Hhan, Seungwan Hong, and Yongha Son. A hybrid of dual and meet-in-the-middle attack on sparse and ternary secret LWE. IEEE Access , 7:89497– 89506, 2019. 7

    2019

  3. [11]

    Faster CryptoNets: Leveraging sparsity for real-world encrypted inference

    Edward Chou, Josh Beal, Daniel Levy, Serena Yeung, Al- bert Haque, and Li Fei-Fei. Faster CryptoNets: Leveraging sparsity for real-world encrypted inference. arXiv preprint arXiv:1811.09953, 2018. 3

    2018 arXiv

  4. [12]

    AdvFaces: Adversarial face synthesis

    Debayan Deb, Jianbang Zhang, and Anil K Jain. AdvFaces: Adversarial face synthesis. In IEEE International Joint Con- ference on Biometrics, pages 1–10. IEEE, 2020. 2

    2020

  5. [13]

    ArcFace: Additive angular mar- gin loss for deep face recognition.IEEE Transactions on Pat- tern Analysis and Machine Intelligence , 44(10):5962–5979,

    Jiankang Deng, Jia Guo, Jing Yang, Niannan Xue, Irene Kot- sia, and Stefanos Zafeiriou. ArcFace: Additive angular mar- gin loss for deep face recognition.IEEE Transactions on Pat- tern Analysis and Machine Intelligence , 44(10):5962–5979,

  6. [14]

    An image is worth 16x16 words: Trans- formers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, et al. An image is worth 16x16 words: Trans- formers for image recognition at scale. InInternational ...

    2020

  7. [15]

    HERS: homomorphically encrypted representation search

    Joshua J Engelsma, Anil K Jain, and Vishnu Naresh Boddeti. HERS: homomorphically encrypted representation search. IEEE Transactions on Biometrics, Behavior, and Identity Science, 4(3):349–360, 2022. 1, 2, 4

    2022

  8. [16]

    A fully homomorphic encryption scheme

    Craig Gentry. A fully homomorphic encryption scheme. Stan- ford University, 2009. 1, 2

    2009

  9. [17]

    Fully homomorphic encryption using ideal lattices

    Craig Gentry. Fully homomorphic encryption using ideal lattices. In ACM Symposium on Theory of Computing, pages 169–178, 2009. 1, 2

    2009

  10. [18]

    CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy

    Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy. In International Conference on Machine Learning, pages 201–210, 2016. 2, 3

    2016

  11. [19]

    Algorithms in HElib

    Shai Halevi and Victor Shoup. Algorithms in HElib. In Ad- vances in Cryptology, pages 554–571. Springer, 2014. 5

    2014

  12. [20]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 770–778, 2016. 4, 6

    2016

  13. [21]

    Labeled faces in the wild: A database for studying face recognition in unconstrained environments

    Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller. Labeled faces in the wild: A database for studying face recognition in unconstrained environments. In Workshop on faces in’Real-Life’Images: Detection, Align- ment, and Recognition, 2008. 6

    2008

  14. [22]

    https://github.com/deepinsight/ insightface, 2023

    Insightface. https://github.com/deepinsight/ insightface, 2023. 6

    2023

  15. [23]

    Privacy-preserving face recognition with learn- able privacy budgets in frequency domain

    Jiazhen Ji, Huan Wang, Yuge Huang, Jiaxiang Wu, Xingkun Xu, Shouhong Ding, ShengChuan Zhang, Liujuan Cao, and Rongrong Ji. Privacy-preserving face recognition with learn- able privacy budgets in frequency domain. InEuropean Con- ference on Computer Vision, pages 475–491. Sprin...

    2022

  16. [24]

    GAZELLE: A low latency framework for secure neural network inference

    Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chan- drakasan. GAZELLE: A low latency framework for secure neural network inference. In USENIX Security Symposium, pages 1651–1669, 2018. 3

    2018

  17. [25]

    HyPHEN: A hybrid packing method and its optimizations for homomorphic encryption- based neural networks

    Donghwan Kim, Jaiyoung Park, Jongmin Kim, Sangpyo Kim, and Jung Ho Ahn. HyPHEN: A hybrid packing method and its optimizations for homomorphic encryption- based neural networks. IEEE Access, 2023. 3

    2023

  18. [26]

    Adaface: Quality adaptive margin for face recognition

    Minchul Kim, Anil K Jain, and Xiaoming Liu. Adaface: Quality adaptive margin for face recognition. In IEEE/CVF Conference on Computer Vision and Pattern Recognition ,

  19. [27]

    Minimax approximation of sign function by composite polynomial for homomorphic comparison

    Eunsang Lee, Joon-Woo Lee, Young-Sik Kim, and Jong- Seon No. Minimax approximation of sign function by composite polynomial for homomorphic comparison. IEEE Transactions on Dependable and Secure Computing , 2021. 3, 6 9

    2021

  20. [28]

    Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions

    Eunsang Lee, Joon-Woo Lee, Junghyun Lee, Young-Sik Kim, Yongjune Kim, Jong-Seon No, and Woosuk Choi. Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions. In International Conference on Machine Learning, page...

    2022

  21. [29]

    Precise approximation of convolutional neural networks for homomorphically en- crypted data

    Junghyun Lee, Eunsang Lee, Joon-Woo Lee, Yongjune Kim, Young-Sik Kim, and Jong-Seon No. Precise approximation of convolutional neural networks for homomorphically en- crypted data. arXiv preprint arXiv:2105.10879, 2021. 3

    2021 arXiv

  22. [30]

    High-precision bootstrapping of RNS-CKKS homomorphic encryption using optimal mini- max polynomial approximation and inverse sine function

    Joon-Woo Lee, Eunsang Lee, Yongwoo Lee, Young-Sik Kim, and Jong-Seon No. High-precision bootstrapping of RNS-CKKS homomorphic encryption using optimal mini- max polynomial approximation and inverse sine function. In International Conference on the Theory and Applications of Cr...

    2021

  23. [31]

    HEMET: A homomorphic- encryption-friendly privacy-preserving mobile neural net- work architecture

    Qian Lou and Lei Jiang. HEMET: A homomorphic- encryption-friendly privacy-preserving mobile neural net- work architecture. In International Conference on Machine Learning, pages 7102–7110, 2021. 5

    2021

  24. [32]

    On ideal lattices and learning with errors over rings

    Vadim Lyubashevsky, Chris Peikert, and Oded Regev. On ideal lattices and learning with errors over rings. In Interna- tional Conference on the Theory and Applications of Cryp- tographic Techniques, pages 1–23. Springer, 2010. 1, 2

    2010

  25. [33]

    IARPA janus benchmark-C: Face dataset and protocol

    Brianna Maze, Jocelyn Adams, James A Duncan, Nathan Kalka, Tim Miller, Charles Otto, Anil K Jain, W Tyler Niggel, Janet Anderson, Jordan Cheney, et al. IARPA janus benchmark-C: Face dataset and protocol. In International Conference on Biometrics, pages 158–165. IEEE, 2018. 8

    2018

  26. [34]

    Privacy–enhancing face biometrics: A com- prehensive survey.IEEE Transactions on Information Foren- sics and Security, 16:4147–4183, 2021

    Bla ˇz Meden, Peter Rot, Philipp Terh ¨orst, Naser Damer, Ar- jan Kuijper, Walter J Scheirer, Arun Ross, Peter Peer, and Vitomir ˇStruc. Privacy–enhancing face biometrics: A com- prehensive survey.IEEE Transactions on Information Foren- sics and Security, 16:4147–4183, 2021. 1

    2021

  27. [35]

    Privacy-preserving face recognition using trainable feature subtraction

    Yuxi Mi, Zhizhou Zhong, Yuge Huang, Jiazhen Ji, Jian- qing Xu, Jun Wang, Shaoming Wang, Shouhong Ding, and Shuigeng Zhou. Privacy-preserving face recognition using trainable feature subtraction. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 297–307,

  28. [36]

    Delphi: A crypto- graphic inference service for neural networks

    Pratyush Mishra, Ryan Lehmkuhl, Akshayaram Srinivasan, Wenting Zheng, and Raluca Ada Popa. Delphi: A crypto- graphic inference service for neural networks. In USENIX Security Symposium, pages 2505–2522, 2020. 4

    2020

  29. [37]

    AgeDB: the first manually collected, in-the-wild age database

    Stylianos Moschoglou, Athanasios Papaioannou, Chris- tos Sagonas, Jiankang Deng, Irene Kotsia, and Stefanos Zafeiriou. AgeDB: the first manually collected, in-the-wild age database. In IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 51–59, 2017. 6

    2017

  30. [38]

    Unsupervised learning of visual representations by solving jigsaw puzzles

    Mehdi Noroozi and Paolo Favaro. Unsupervised learning of visual representations by solving jigsaw puzzles. In European Conference on Computer Vision , pages 69–84. Springer, 2016. 5

    2016

  31. [39]

    AESPA: Accuracy preserving low-degree polynomial activation for fast private inference

    Jaiyoung Park, Michael Jaemin Kim, Wonkyung Jung, and Jung Ho Ahn. AESPA: Accuracy preserving low-degree polynomial activation for fast private inference. arXiv preprint arXiv:2201.06699, 2022. 2, 3, 5, 6

    2022 arXiv

  32. [40]

    Masked jigsaw puzzle: A versatile po- sition embedding for vision transformers

    Bin Ren, Yahui Liu, Yue Song, Wei Bi, Rita Cucchiara, Nicu Sebe, and Wei Wang. Masked jigsaw puzzle: A versatile po- sition embedding for vision transformers. InIEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 20382–20391, 2023. 5

    2023

  33. [41]

    Microsoft SEAL (3.6)

    SEAL. Microsoft SEAL (3.6). Microsoft Research, 2020. 6

    2020

  34. [42]

    Frontal to profile face verification in the wild

    Soumyadip Sengupta, Jun-Cheng Chen, Carlos Castillo, Vishal M Patel, Rama Chellappa, and David W Jacobs. Frontal to profile face verification in the wild. In IEEE Win- ter Conference on Applications of Computer Vision , pages 1–9. IEEE, 2016. 6

    2016

  35. [43]

    The EU general data protection regulation GDPR

    Paul V oigt and Axel V on dem Bussche. The EU general data protection regulation GDPR. A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10(3152676):10– 5555, 2017. 1

    2017

  36. [44]

    Cos- Face: Large margin cosine loss for deep face recognition

    Hao Wang, Yitong Wang, Zheng Zhou, Xing Ji, Dihong Gong, Jingchao Zhou, Zhifeng Li, and Wei Liu. Cos- Face: Large margin cosine loss for deep face recognition. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5265–5274, 2018. 1, 4

    2018

  37. [45]

    IARPA janus benchmark-b face dataset

    Cameron Whitelam, Emma Taborsky, Austin Blanton, Bri- anna Maze, Jocelyn Adams, Tim Miller, Nathan Kalka, Anil K Jain, James A Duncan, Kristen Allen, et al. IARPA janus benchmark-b face dataset. In IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops , page...

    2017

  38. [46]

    Cross-Pose LFW: a database for studying cross-pose face recognition in un- constrained environments

    Tianyue Zheng and Weihong Deng. Cross-Pose LFW: a database for studying cross-pose face recognition in un- constrained environments. Beijing University of Posts and Telecommunications, Tech. Rep, 5(7):5, 2018. 6

    2018

  39. [47]

    Cross- Age LFW: A database for studying cross-age face recog- nition in unconstrained environments

    Tianyue Zheng, Weihong Deng, and Jiani Hu. Cross- Age LFW: A database for studying cross-age face recog- nition in unconstrained environments. arXiv preprint arXiv:1708.08197, 2017. 6

    2017 arXiv

  40. [48]

    WebFace260M: A benchmark unveiling the power of million-scale deep face recognition

    Zheng Zhu, Guan Huang, Jiankang Deng, Yun Ye, Junjie Huang, Xinze Chen, Jiagang Zhu, Tian Yang, Jiwen Lu, Da- long Du, et al. WebFace260M: A benchmark unveiling the power of million-scale deep face recognition. In IEEE/CVF Conference on Computer Vision and Pattern Recognition ...

    2021

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.