Private Face Distillation is proposed, an identity-decoupling and geometry-preserving framework that uses Orthogonal Geometry Preservation to construct decoupled proxy identities from private identity representations while maintaining hyperspherical geometry, and Relational Topology Alignment to preserve identity relations for recognition learning.
Abstract
Publishing private face recognition~(FR) training datasets is privacy-sensitive because faces expose identity information. Private FR training dataset publication mitigates this risk by releasing protected proxies as substitutes for private training faces. However, training FR models with such data introduces an identity paradox: \emph{the identity cues that make released faces useful for recognition supervision are also the cues that make them linkable to real individuals.} A protected face should be decoupled from the original identity, yet still behave as a reliable identity sample for training. Removing these cues too aggressively may destroy the class structure needed for recognition learning, whereas preserving them too faithfully may increase source-identity linkability. We argue that this paradox stems from conflating source-aligned identity semantics with recognition-useful proxy identity geometry. The former should be suppressed to reduce linkage to private individuals, while the latter should be preserved for FR learning. Based on this insight, we propose \textbf{Private Face Distillation}, an identity-decoupling and geometry-preserving framework. It uses Orthogonal Geometry Preservation to construct decoupled proxy identities from private identity representations while maintaining hyperspherical geometry, and Relational Topology Alignment to preserve identity relations for recognition learning. Experiments across multiple domain-shifted FR scenarios show that Private Face Distillation achieves stronger utility than the evaluated publication baselines. On IJB-C surveillance, it improves $\mathrm{TAR}@\mathrm{FAR}{=}1\text{e-}{3}$ by 3.94\% over the baseline while reducing source-identity linkability. These results suggest that private FR training dataset publication should decouple source-identity correspondence while preserving proxy identity geometry.
Face-swapping has emerged as a promising approach to facial privacy protection, replacing a target individual's appearance with that of a donor while preserving non-facial context. The resulting images visually resemble the donor, and face recognition systems tend to suppress the target's match scores -- ostensibly satisfying privacy requirements. Empirical evaluation across a range of face-swapping models, however, reveals that significant target identity leakage still occurs. This raises a deeper question: why does leakage occur, and can it be predicted? We propose a linear stochastic model that treats face-swappers as transformations on the space of identity embeddings, providing an interpretable account of the leakage mechanism. The model is fit to empirical observations and used to derive testable predictions. The aim is to ground privacy assessments in principled, interpretable analysis, thus making formal privacy guarantees explainable -- and perfectible -- rather than purely observational.
Generative diffusion models have revolutionized facial image synthesis, yet robust identity preservation in high resolution outputs remains a critical challenge. This issue is especially vital for security systems, biometric authentication, and privacy sensitive applications, where any drift in identity integrity can undermine trust and functionality. We introduce Diff-ID, a diffusion based framework that enforces identity consistency while delivering photorealistic quality. Central to our approach is a custom 210K image dataset synthesized from CelebA-HQ, FFHQ, and LAION-Face and captioned via a fine tuned BLIP model to bolster identity awareness during training. Diff-ID integrates ArcFace and CLIP embeddings through a dual cross attention adapter within a fine tuned Stable Diffusion UNet. To further reinforce identity fidelity, we propose a pseudo discriminator loss based on ArcFace cosine similarity with exponential timestep weighting. Experiments on held out and unseen faces show that Diff-ID does not exceed InstantID in raw ArcFace Face Similarity, but achieves substantially lower FID and the strongest FIQ based identity--realism trade off among the evaluated methods. We also present a unified DDIM based morphing pipeline that enables qualitative facial interpolation without per identity fine tuning. We further argue that identity preservation and photorealism should be evaluated jointly rather than in isolation, as high identity similarity alone does not guarantee realistic outputs. To make this trade off explicit, we report Face Image Quality (FIQ) as a complementary ratio based score that combines identity similarity and perceptual realism while keeping FS and FID as the primary metrics.
T. Rizwan, Sara Atito, Muhammad Awais et al.· 0 citations
A comparative study of four audits applicable to pre-trained, black-box face generators, which consistently reveal substantial identity distinguishability while reporting markedly different epsilon estimates that reflect each method's distinct assumptions and finite-sample treatment.
Arman Zareian Jahromi, Vishnu Bondalakunta, M. Shah et al.· 0 citations
Face recognition models represent each face as an embedding vector on the unit hypersphere by clustering embeddings of the same identity while pushing different identities apart through angular-margin losses. Because these losses act only on training identities, non-member identities may form clusters with different geometric properties. In this paper, we quantify the magnitude of this difference and what training-time factors control it. We compute four statistics based on cluster geometry across 180 face recognition models in a factorial design over IResNet backbone size, loss head, training duration, and the number of training identities, and evaluate each configuration on nine benchmarks. Our results indicate that the number of training identities has the largest effect on member/non-member separability, while backbone and loss head contribute far less, and that, on a same-domain held-out reference, the geometric membership signal decreases monotonically as more identities are added to training. We provide an analysis of cross-domain (pose, age, quality, ethnicity) non-member benchmarks and report that these inflate the apparent membership signal. Finally, we fuse all four statistics with a learned classifier to reveal additional membership information beyond the best individual statistic.
Protecting facial recognition privacy is crucial amid deep fake threats, biometric risks, and third-party database access concerns. Despite many recent face recognition methods achieving high accuracy, most existing works either ignore privacy protection or apply privacy mechanisms without designing CNN structures that effectively learn from heavily perturbed facial data. This research introduces a secure face recognition system based on Differential Privacy (DP), employing a Convolutional Neural Network (CNN) and face classifiers. In this study, we develop a CNN through the incorporation of multiple batch normalization layers. This CNN is capable of recognizing the randomized image of the DP technique. To ensure privacy, the face database undergoes perturbation using DP techniques before releasing to any unauthorized access. The CNN model learns from these perturbed images, extracting features that are subsequently used by a predictor to classify the face. The CNN model learns from these images and then this trained CNN extracts features from an image that needs to be recognized. Ultimately, a predictor classifies this face. We evaluate three DP techniques namely Laplacian, Gaussian, and DP-blur using four predictors to evaluate the privacy-preserving capabilities of the proposed method. Each DP technique is evaluated by varying privacy parameters from 0.5 to 8 with an interval of 0.5. This research employs two datasets, namely LFW and IC. The DP blur with Logistic regression predictors provides the highest privacy, achieving excellent accuracy rates of 97% and 77% for these datasets. This outcome surpasses all baseline methods. The research offers an in-depth analysis of various DP techniques to construct a secure face recognition system. The method will aid in the automatic recognition of faces while ensuring privacy.
Muhammad Minoar Hossain, Mohammad Motiur Rahman· PLoS ONE· 0 citations
Face recognition in unconstrained environments remains a challenge due to variations of illumination, pose, expression and partial occlusion while large scale biometric deployment raises significant privacy concern with regards to processing sensitive facial data. This paper presents PrivFace-AI which is a framework for private face recognition using federated learning to securely perform biometric identification without transferring raw facial data to centralized servers. PrivFace-AI combines deep embeddings extracted from facial embedding using FaceNet; cosine similarity matching; decentralized model aggregation via FedAvg and liveness detection which improves robustness against spoofing attacks under real world operating conditions. A complete web-based implementation coupled with optional embedded hardware interaction was developed to validate practical deployment of the framework in intelligent access control scenarios. Experimental results obtained on LFW, KinectFace and custom real world datasets demonstrate 97.8% recognition accuracy in real-time response capability confirming the effectiveness of PrivFace-AI in combining privacy preservation, recognition robustness and operational feasibility under unconstrained environment.
Laila Ouannes, Mariem Lallouch, S. Gazzah· International Conference on...· 0 citations