Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images

Arman Zareian Jahromi; Vishnu Bondalakunta; Mohammad Akbar Bin Shah; Naimul Haque; Shuangqing Wei; George T. Amariucai

Source-linked AI summary

Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images

Arman Zareian Jahromi, Vishnu Bondalakunta, Mohammad Akbar Bin Shah, Naimul Haque, Shuangqing Wei, George T. Amariucai

arXiv:2608.17147v1Aug 17, 2026cs.CRcs.LG

TL;DR

Formal privacy auditing of black-box face generators cannot rely on visual dissimilarity alone. This paper compares four embedding-based audits and finds substantial identity distinguishability, but no reliable method ranking in this regime.

Problem
Visual dissimilarity is sometimes treated as privacy evidence, leaving how much identity survives image-to-image generation as a measurement question.
Method
The study compares GaussMech, KDE-LR, MMD-TV, and ROC-HT across eight encoder–dataset–generator conditions using a shared identity-substitution audit task.
Results
15 of 20 VGGFace2 stress-test pairs exceed ε = 1, while all four audits reveal substantial identity distinguishability without supporting a reliable ranking.
Takeaways & Limitations
In this high-distinguishability regime, the methods’ relative trade-offs cannot be reliably ranked from these experiments.
Takeaways & Limitations
The comparison is limited to precomputed FaceFusion and InstantID outputs whose missing generation manifest prevents reproducing images or attributing differences to a specific generator revision.

Abstract

from arXiv · show

Image-to-image face generators are widely used, and visual dissimilarity between their outputs and source images is sometimes treated as evidence of privacy. Auditing whether these systems satisfy formal identity-level (epsilon, delta)-differential privacy requires choosing among several distinct routes for converting embedding-space observations into estimates or bounds on the differential privacy parameter epsilon. We present a comparative study of four such audits applicable to pre-trained, black-box face generators: a Gaussian-mechanism reading of per-identity sensitivity (GaussMech); a per-dimension kernel-density log-ratio aggregated by basic composition (KDE-LR); an analytical population-level lower bound on pure-DP epsilon derived from the maximum mean discrepancy via the total variation distance (MMD-TV); and a hypothesis-testing evaluation of a cross-validated classifier's out-of-fold ROC (ROC-HT). For each method we make explicit its assumptions, hyperparameter dependence, finite-sample limitations, and the regime in which its epsilon estimate is informative. Applied to FaceFusion and InstantID across multiple identity encoders and reference datasets, the audits consistently reveal substantial identity distinguishability while reporting markedly different epsilon estimates that reflect each method's distinct assumptions and finite-sample treatment. In this high-distinguishability regime, the experiments do not support a reliable ranking of the four methods. Their relative trade-offs should be evaluated on partially private mechanisms, which we identify as the natural next study. The resulting framework places these audits in a shared identity-level audit setting and clarifies how their assumptions and finite-sample treatments shape the resulting differential privacy estimates.

1. Introduction

This paper frames identity-level differential-privacy auditing for black-box face generators as a comparison of four embedding-based routes with distinct assumptions and finite-sample treatments. Across FaceFusion and InstantID, the audits find substantial identity distinguishability, but their differing scales do not support a reliable ranking.

Audit setting: Identity-level (ε, δ)-DP treats identities as private inputs and requires the output-distribution inequality for every pair of distinct identities.The audit uses complete identity adjacency, with each identity indexing a per-query output distribution.
Methods: The comparison evaluates GAUSSMECH, KDE-LR, MMD-TV, and ROC-HT as distinct routes from embedding observations to ε estimates or lower bounds.GAUSSMECH uses per-identity mean distances and residual scale; KDE-LR composes per-dimension kernel-density log-ratios; MMD-TV derives a pure-DP lower bound through total variation; ROC-HT uses an out-of-fold classifier ROC.
Comparative framework: The study makes each method’s assumptions, hyperparameter dependence, informativeness regime, formal lower-bound status, and finite-sample limitations explicit.All four methods are evaluated on a shared audit task across ArcFace and FaceNet, VGGFace2 and CelebA, and FaceFusion and InstantID.
Empirical findings: The four audits consistently reveal substantial identity distinguishability across eight encoder × dataset × generator conditions.A reserved-test protocol certifies positive ε lower bounds for all 20 selected VGGFace2 pairs, with 15 exceeding ε = 1; reduced power on CelebA exposes finite-sample costs.
Interpretation: Because the audited regime is already highly distinguishable, method-specific assumptions, endpoint behavior, and looseness prevent reliable ranking of the four methods.None of the evaluated off-the-shelf generators combines a known identity-level guarantee under the stated threat model with tunable, intermediate distinguishability.

2. Background and Threat Model

The paper audits identity-level differential privacy over a distributional channel whose adjacency relation treats every pair of distinct identities as adjacent. The threat model gives an adversary one generated embedding to test the producing identity, while limiting guarantees to the sampled channel rather than arbitrary fixed photographs or released batches.

Differential privacy definition: Smaller ε means stronger privacy, with δ = 0 corresponding to pure ε-DP; adjacency is complete over distinct identity labels, not visual similarity.The adjacency relation is application-defined, and here every two different identity labels must satisfy the privacy inequality.
Testing characterization: Hypothesis testing characterizes DP through error-rate inequalities, and ROC-HT directly instantiates this characterization for distinguishing outputs from adjacent identities.For every test, FPR + e^ε(1−TPR) ≥ 1−δ and (1−TPR) + e^εFPR ≥ 1−δ.
MMD-TV assumptions: MMD-TV uses a one-directional chain from total variation to pure-DP bounds: pure DP implies a TV upper bound, but a TV bound alone does not imply DP.Accordingly, an empirical MMD plug-in estimate is a point estimate rather than a certified population lower bound without a one-sided confidence argument.
Distributional mechanism: The audited channel samples identity-conditioned images before generation: InstantID uses reference images, whereas FaceFusion uses target images with one fixed donor.Each CelebA identity contributes 26–35 usable generated embeddings and each VGGFace2 identity contributes 90–100.
Threat-model limitation: The channel does not guarantee privacy for an arbitrary fixed user-selected photograph, because deployment conditions on one image rather than averaging over an identity-conditioned population.The operational model represents one query whose image is drawn from the stated identity-conditioned population.
Adversary: The adversary observes one generated 512-dimensional embedding and tests which of two identity distributions produced it; repeated outputs estimate this single-draw channel, not group privacy for a released batch.For FaceFusion, the donor is identical across pairwise tests, so target separation cannot be caused by changing the donor.

3. Four Audit Methods

The four audits convert identity-embedding observations into privacy diagnostics through distinct Gaussian, marginal-density, MMD–TV, and ROC hypothesis-testing constructions. Their assumptions and finite-sample treatments determine whether the resulting values are interpretable as bounds, diagnostics, or empirical separation signals.

GaussMech: GaussMech uses Gaussian calibration of per-identity mean displacement against residual scale, but its assumptions fail empirically and inverted scores extrapolate beyond the stated ε ∈(0, 1) regime.Residual Gaussianity is rejected at p < 10−3 on 509 of 512 dimensions in the canonical condition and on most dimensions across all eight conditions.
KDE-LR: KDE-LR sums finite-grid per-dimension marginal log-ratio maxima, producing a product-of-marginals diagnostic rather than a joint-mechanism DP bound.Basic composition does not apply to fitted marginals of one release, and marginal factorization can miss dependence-only leakage or overstate coordinate-wise differences.
KDE-LR: KDE-LR’s composed ε is in the thousands across all eight conditions, while increasing α from 0 to 10−2 decreases it by approximately fivefold.The values reflect the looseness of the per-dimension framing, and α lacks a principled internal selection criterion.
MMD-TV: MMD-TV derives a population-level pure-DP lower bound on ε by combining MMD ≤2dTV for bounded-diagonal kernels with the total-variation characterization of pure DP.The bound is generally loose because MMD ≤2dTV can itself be loose, and empirical evaluation uses sample MMD without one-sided confidence correction.
ROC-HT: ROC-HT can report +∞ when an observed ROC has TPR = 1 with FPR < 1 or FPR = 0 with TPR > 0, without implying exact zero-error separation.This endpoint value is sample-dependent; a larger audit could reveal overlap and move operating points away from zero-denominator endpoints.

4. Comparative Experimental Evaluation

Across FaceFusion and InstantID conditions, the audits consistently find strong identity distinguishability, but their epsilon-related outputs differ because each method relies on distinct assumptions and finite-sample treatments. The experiments therefore do not support ranking the methods, especially outside partially private regimes.

Comparative results: Every raw OOF ROC estimate is +∞ because empirical ROC curves contain a zero-denominator endpoint, making this an endpoint-sensitive result rather than a population certificate.The same issue occurs across all 200 ROC-tested pairs per condition.
Confidence-certified ROC-HT: Every one of the 20 VGGFace2 pairs certifies a positive pure-DP lower bound, with 15 certifying ε > 1; FaceNet+VGGFace2+InstantID bounds range from 0.685 to 0.925.These certificates hold simultaneously with at least 95% confidence for the 40 development-selected pairs under the iid interpretation.
Finite-sample limitations: CelebA’s high AUC can coexist with εLB = 0 at n = 10 per class, illustrating that finite test samples can prevent exact-DP certification despite strong empirical ordering.Under the same correction, εLB rises to 0.454 at n = 15 and 1.277 at n = 30.
Method assumptions: GAUSSMECH’s Gaussian residual assumption is frequently rejected, with p < 10−3 in 296/512 to 512/512 dimensions across conditions.Rejections exceed 300/512 on seven of eight conditions, limiting the Gaussian-mechanism interpretation.
Interpretation: The methods cannot be ranked because their numerical scales reflect method-specific assumptions and finite-sample treatments rather than relative tightness at intermediate privacy levels.The authors identify partially private mechanisms as the natural setting for a controlled comparison.

5. Discussion

The four audits have different formal statuses and assumptions, so their Table 1 magnitudes should not determine a universal method ranking. Method choice should instead reflect each audit’s requirements, while future comparisons should use mechanisms with known privacy guarantees and controllable distinguishability.

Which Method to Use When: Table 1 numbers have different formal status: MMD-TV is an uncertified sample estimate, ROC-HT’s broad OOF estimate diverges at ROC endpoints, and GAUSSMECH and KDE-LR depend on modeling or aggregation assumptions.Table 2 separately provides certified selected-pair ROC-HT bounds.
Benchmark: The cleanest comparison would use a per-query benchmark with a known privacy guarantee and controllable distinguishability.A proposed construction adds calibrated isotropic Gaussian noise to normalized encoder outputs, whose unit-sphere geometry gives L2 sensitivity ∆2 ≤2 for the calibrated mean-shift mechanism.
Which Method to Use When: The four audits are not interchangeable: GAUSSMECH is a Gaussian-noise diagnostic, KDE-LR aggregates coordinate-level marginal differences without a joint-DP guarantee, MMD-TV is a classifier-free population lower-bound route, and ROC-HT uses strong distinguishers.MMD-TV requires one-sided finite-sample treatment, while ROC-HT can become a finite-sample certificate through an independently evaluated reserved test and simultaneous confidence correction.
Which Method to Use When: ROC-HT’s finite-sample certification improves inferential validity but reduces power on small test sets, so these requirements—not Table 1 magnitudes—should determine audit choice.The protocol uses a fixed, independently evaluated test with simultaneous confidence correction.

6. Related Work

Prior DP-auditing studies use hypothesis tests to lower-bound effective privacy parameters, but they target training algorithms under record-level changes rather than this paper’s inference-time, identity-indexed distribution.

Jagielski, Ullman, and Oprea audit DP-SGD using membership-inference attacks.
Nasr et al. instantiate strong canary adversaries, while Steinke, Nasr, and Jagielski develop single-run auditing.
These studies use hypothesis tests to lower-bound effective privacy parameters, auditing training algorithms under record-level changes rather than inference-time distributions indexed by identity labels.

7. Ethics and Dual Use

The study addresses sensitive biometric data and dual-use risks while evaluating identity leakage defensively. It limits exposure by reporting aggregate results, withholding generated faces and attack artifacts, and using only existing public data and precomputed outputs.

Ethics and Dual Use: The work measures identity leakage in face-generation systems, involving sensitive biometric data and dual-use risk.
Ethics and Dual Use: Its intended use is defensive privacy evaluation, but the methods could also support identity recognition.
Ethics and Dual Use: The study reports aggregate embedding-level results and does not release generated faces or identity-specific attack artifacts.
Ethics and Dual Use: It uses selected subsets of public face datasets and precomputed outputs, collecting no new participant data and conducting no user study.
Ethics and Dual Use: The study does not attempt to re-identify unnamed individuals, while acknowledging that public availability does not remove concerns.

8. Limitations and Future Work

The study is limited to precomputed outputs from selected identities and defines privacy per query rather than for releasing full generated batches. Multiple observations from one identity can compose evidence beyond the reported per-query audit.

Generators, data, and provenance: The comparison uses precomputed FaceFusion and InstantID outputs from selected VGGFace2 and CelebA identities, limiting the scope of the evaluation.After filtering missing and zero-norm vectors, two FaceFusion conditions each retain one duplicated vector.
Generators, data, and provenance: The FaceFusion protocol fixes one donor and varies target images by dataset identity, so stored labels represent target identities.
Per-query versus multi-query privacy: The privacy definition is per-query: N images per identity estimate one generated embedding’s per-identity output distribution, not a group-privacy guarantee for releasing a full batch.
Per-query versus multi-query privacy: Many independent outputs from the same identity can compose evidence across queries, and translating the per-query audit numbers to a multi-query setting remains unresolved.

9. Conclusion

The paper compares four black-box differential privacy audits for image-to-image face generators, making their assumptions and finite-sample treatments explicit. Across evaluated conditions, the audits reveal substantial identity-distinguishing signal, motivating comparison on partially private mechanisms.

Conclusion: The study compares GAUSSMECH, KDE-LR, MMD-TV, and ROC-HT as empirical audits for pre-trained, black-box image-to-image face generators.For each audit, it specifies the definition, assumptions, hyperparameter dependence, finite-sample status, and route from embedding-space measurements to an ε diagnostic or population lower bound.
Conclusion: Across eight encoder × dataset × generator conditions, classifiers and two-sample tests reveal substantial identity-distinguishing signal.The finite-sample ROC protocol reserves an untouched test split per identity for one fixed evaluation after development-only pair selection, classifier fitting, and threshold selection.
Conclusion: The ROC protocol certifies positive selected-pair ε lower bounds for all 20 evaluated cases.The cited passage states this result for the reserved test split under the described finite-sample protocol.
Conclusion: Comparing calibration and tightness requires a partially private regime in which FPR = 0 is avoided and the hypothesis-testing plug-in returns finite values.The passage identifies this as the necessary next step because the observed endpoint divergences prevent such comparison here.