PaperlayerView exact revision on arXiv

Source-linked AI summary

Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images

Arman Zareian Jahromi, Vishnu Bondalakunta, Mohammad Akbar Bin Shah, Naimul Haque, Shuangqing Wei, George T. Amariucai

arXiv:2608.17147v1cs.CRcs.LG

TL;DR

Visual dissimilarity is sometimes treated as privacy evidence, but formal identity-level auditing requires ways to translate embedding observations into ε estimates or bounds. This paper compares four audits for black-box face generators and finds substantial identity distinguishability without a reliable method ranking in the tested high-distinguishability regime.

  • Problem

    Whether identity survives image-to-image face generation requires measurement, since visual dissimilarity is sometimes treated as informal evidence of privacy.

    Source: §1 · p. 1

  • Method

    The paper compares GaussMech, KDE-LR, MMD-TV, and ROC-HT in a shared identity-substitution audit, distinguishing formal ε lower bounds from finite-sample diagnostics.

    Source: §1 · p. 2, §9 · p. 13

  • Results

    15 of 20 selected VGGFace2 pairs exceeded ε=1 under reserved-test ROC-HT; all 20 had positive lower bounds, while the audits found substantial distinguishability but no reliable method ranking.

    Source: §1 · p. 2, §9 · p. 13

  • Takeaways & Limitations

    A controlled benchmark with adjustable distinguishability is needed to compare audit calibration and sensitivity as ROC observations move beyond endpoint regimes.

    Source: §5.2 · p. 11

    The reported ε values are per-query identity-level audits, not guarantees for releasing an identity’s full batch; multi-query privacy requires a specified composition model and query count.

    Source: §8 · p. 13

Abstract

from arXiv · show

Image-to-image face generators are widely used, and visual dissimilarity between their outputs and source images is sometimes treated as evidence of privacy. Auditing whether these systems satisfy formal identity-level (epsilon, delta)-differential privacy requires choosing among several distinct routes for converting embedding-space observations into estimates or bounds on the differential privacy parameter epsilon. We present a comparative study of four such audits applicable to pre-trained, black-box face generators: a Gaussian-mechanism reading of per-identity sensitivity (GaussMech); a per-dimension kernel-density log-ratio aggregated by basic composition (KDE-LR); an analytical population-level lower bound on pure-DP epsilon derived from the maximum mean discrepancy via the total variation distance (MMD-TV); and a hypothesis-testing evaluation of a cross-validated classifier's out-of-fold ROC (ROC-HT). For each method we make explicit its assumptions, hyperparameter dependence, finite-sample limitations, and the regime in which its epsilon estimate is informative. Applied to FaceFusion and InstantID across multiple identity encoders and reference datasets, the audits consistently reveal substantial identity distinguishability while reporting markedly different epsilon estimates that reflect each method's distinct assumptions and finite-sample treatment. In this high-distinguishability regime, the experiments do not support a reliable ranking of the four methods. Their relative trade-offs should be evaluated on partially private mechanisms, which we identify as the natural next study. The resulting framework places these audits in a shared identity-level audit setting and clarifies how their assumptions and finite-sample treatments shape the resulting differential privacy estimates.

1. Introduction

The paper frames privacy in image-to-image face generation as an identity-level measurement problem: visual dissimilarity is only informal evidence, and formal audits use distinct routes to estimate or bound ε.

1. Introduction

  • FaceFusion and InstantID serve as high-distinguishability stress tests because identity may survive generation even when outputs look visually different.InstantID is designed to preserve its reference identity; the FaceFusion setup fixes one donor while varying target images to test whether target identity remains detectable.Source: §1 · p. 1
  • The audit treats the private input as an identity label under complete identity adjacency, making it a distributional local-DP condition with per-identity output distributions.Sampling an image from an identity’s reference distribution is part of the channel’s randomness; this secret-indexed view is related to Pufferfish privacy.Source: §1 · p. 1
  • The four routes are GaussMech’s sensitivity-based diagnostic, KDE-LR’s composed marginal log-ratios, MMD-TV’s pure-DP lower bound, and ROC-HT’s classifier-based hypothesis test.GaussMech is not a formal lower bound for arbitrary generated outputs, and KDE-LR’s coordinate sum is not a joint-mechanism guarantee.Source: §1 · pp. 1–2
  • The comparison applies all four methods to a shared identity-substitution task using two encoders, two reference datasets, and two generators across eight conditions.The framework uses a shared per-condition pair list and common 100-pair summary to distinguish formal ε lower bounds from finite-sample diagnostics.Source: §1 · p. 2
  • MMD-TV specializes the pure-DP chain MMD ≤ 2 dTV and the total-variation characterization,,, and is compared with the tighter Hockey-Stick result,.The paper states the population and finite-sample limits of this bound.Source: §1 · pp. 1–2
  • ROC-HT separates pair and threshold selection from evaluation: adaptive choices use development data, while fixed classifiers and thresholds are tested once on untouched data for 40 vertex-disjoint pairs.The protocol uses simultaneous one-sided exact confidence bounds; the paper proposes a calibrated-noise benchmark because these generators lack tunable intermediate distinguishability under the threat model.Source: §1 · p. 2
  • All four audits find substantial identity distinguishability; ROC-HT certifies positive ε lower bounds for all 20 selected VGGFace2 pairs, 15 above ε = 1, but the methods cannot be reliably ranked.ROC-HT loses power on CelebA, exposing the sample cost of finite-sample certification; the reported scales depend on method-specific assumptions, endpoint behavior, or looseness.Source: §1 · p. 2

2. Background and Threat Model

The section defines privacy over identity labels and frames auditing as testing whether generated embeddings distinguish identity distributions. It also specifies how representation and sampling choices constrain what an encoder audit can establish.

2.1. Differential Privacy

  • Smaller ε means stronger privacy, δ=0 is pure ε-DP, and the equivalent testing characterization underlies ROC-HT,.In this audit, any two distinct identity labels are adjacent, regardless of visual or semantic similarity.Source: §2.1 · p. 2

2.2. Total Variation and Differential Privacy

  • Pure ε-DP upper-bounds total variation by tanh(ε/2), enabling MMD-TV’s analytical lower-bound direction, but a total-variation bound alone does not imply DP.The bound is for pure DP (δ=0).Source: §2.2 · pp. 2–3

2.3. Face Identity Encoders and Generators

  • Audits use L2-normalized 512-dimensional ArcFace/InsightFace, and FaceNet embeddings as fixed, imperfect representations across FaceFusion and InstantID [2].FaceFusion outputs are grouped by target identity with one donor fixed; InstantID outputs are grouped by reference identity, and the missing generation manifest prevents verifying whether its default encoder overlaps the ArcFace/InsightFace audit.Source: §2.3 · p. 3

2.4. Maximum Mean Discrepancy

  • With a characteristic RBF kernel, MMD is a distribution metric, but sample estimates are point estimates rather than certified population lower bounds absent one-sided confidence arguments.The squared MMD estimator is unbiased for population MMD² and supports a permutation test under the null that the distributions are equal.Source: §2.4 · p. 3

2.5. Threat Model

  • The adversary tests one generated embedding to distinguish identity distributions, and the channel averages over identity-conditioned images rather than guaranteeing privacy for a fixed user-selected photograph.CelebA contributes 26–35 usable embeddings per identity and VGGFace2 contributes 90–100; these repeated observations estimate a single-draw channel, not batch-release privacy.Source: §2.5 · pp. 3–4
  • Complete adjacency requires every pair of distinct identities to satisfy the privacy inequality; deterministic encoding preserves image-level guarantees, but passing an encoder audit does not prove image privacy.A confidence-certified violation for the encoded channel refutes the same proposed guarantee for the image channel.Source: §2.5 · p. 4

3. Four Audit Methods

The four audits convert embedding-space observations into different diagnostic scores or bounds, each with distinct assumptions and finite-sample limitations. Their interpretations depend on how each method handles distributional structure, composition, and sampling.

3.1. GAUSSMECH: Gaussian Calibration Diagnostic

  • GAUSSMECH is only a Gaussian signal-to-noise diagnostic: its noise, sensitivity, and ε-regime assumptions fail for these generators.The textbook calibration assumes additive, input-independent isotropic Gaussian noise, global sensitivity, and ε ∈ (0, 1); Gaussianity is rejected on 509 of 512 dimensions in the canonical condition and on a majority in all eight conditions.Source: §3.1 · p. 4

3.2. KDE-LR: Per-Dimension KDE Log-Ratio (Basic-Composition Sum)

  • Thousands: KDE-LR’s composed ε is operationally large but is a product-of-marginals diagnostic, not a bound on joint-mechanism ε.Increasing smoothing α from 0 to 10^-2 decreases the composed ε by approximately fivefold; the diagnostic also depends on bandwidth, grid, and density-floor choices.Source: §3.2 · p. 5

3.3. MMD-TV: Analytical Lower Bound via Total Variation

  • MMD-TV derives a population-level pure-DP ε lower bound from MMD ≤ 2dTV and the pure-DP total-variation characterization,.The audit substitutes an unbiased sample MMD estimate without a one-sided confidence correction, so its reported value is a point estimate, not a high-probability lower bound; reported estimates are below one.Source: §3.3 · pp. 5–6

3.4. ROC-HT: Hypothesis-Testing Bound from a Classifier’s ROC

  • ROC-HT applies the pure-DP hypothesis-testing characterization, to pooled out-of-fold classifier ROC points, but its empirical value is a diagnostic, not a certificate.An ROC endpoint can make the raw value infinite without proving exact zero-error separation; a larger audit may reveal overlap, while certification uses a separate reserved-test protocol.Source: §3.4 · p. 7

4. Comparative Experimental Evaluation

Across the audited conditions, the methods show substantial identity distinguishability but produce different epsilon estimates shaped by their assumptions and finite-sample treatment. The experiments do not support ranking the methods in this high-distinguishability regime.

4.1. Setup

  • The evaluation uses eight precomputed embedding files across FaceFusion and InstantID, with 399–400 identities per condition and shared first-100-pair comparisons.Generation metadata such as exact revisions, prompts, seeds, checkpoint hashes, and the donor asset identifier are unavailable; filtering can also leave different retained images across encoders.Source: §4.1 · pp. 7–8

4.2. Comparative Audit Across Eight Conditions

  • Median AUC is 0.921–1.000 and median MMD-TV is 0.217–0.475; every raw OOF ROC estimate is +∞ because of a zero-denominator endpoint.The +∞ result also holds across all 200 ROC-tested pairs per condition and is endpoint-sensitive, not a population certificate.Source: §4.2 · p. 8, Table 1 · p. 9

4.3. Finite-Sample ROC Certificates on Reserved Test Data

  • With simultaneous 95% coverage, all 20 selected VGGFace2 pairs certify positive pure-DP lower bounds, and 15 certify ε > 1.All five FaceNet+VGGFace2+InstantID pairs are positive, with bounds from 0.685 to 0.925; selected pairs are stress tests, not leakage-prevalence estimates or a supremum over identity pairs.Source: §4.3 · pp. 8–9, Table 2 · p. 10
  • CelebA’s small test sets prevent positive certification: under the global 40-pair correction, zero-error tests yield εLB = 0 at 10 samples per class, 0.454 at 15, and 1.277 at 30.Eleven of 20 selected CelebA pairs have no test errors, yet their corrected upper error bounds are at least 0.522 with 10 test samples per class.Source: §4.3 · p. 8

4.4. Per-Method Sensitivity

  • Gaussian residuals are unsupported in most conditions, with Shapiro–Wilk rejection in over 300 of 512 dimensions in seven of eight conditions.The rejection range is 296/512 to 512/512 dimensions; KDE-LR’s α = 0 and α = 10^-2 diagnostics differ by ratios of 4.8–6.4, with α = 10^-2 smaller.Source: §4.4 · p. 9
  • MMD-TV maximum estimates vary with bandwidth, peaking at 0.75σ⋆ for both generators and remaining positive across the sweep.On ArcFace+VGGFace2, estimates span 0.374–0.724 for FaceFusion and 0.244–0.448 for InstantID. The classifier-threshold mean b_dTV,h/(MMD/2) ranges from 4.39× to 7.52× across conditions, but this sample gap does not isolate population-bound slack.Source: §4.4 · p. 10
  • Random-forest and logistic-regression mean AUCs agree within 0.013 in every condition, while inter-identity MMD tests reject equality on 799/800 pairs.Same-identity split-half MMD tests reject 16/400 controls at α = 0.05, and split-half ROC controls are near chance with no exact (0, 1) corners; these checks reduce but do not eliminate possible dataset or generation artifacts.Source: §4.4 · p. 10

4.5. Honest Comparison

  • The experiments cannot rank the methods: their numerical scales differ for method-specific reasons and do not establish relative tightness at intermediate privacy levels.A controlled benchmark with a known privacy guarantee and non-endpoint behavior is needed for that comparison.Source: §4.5 · p. 10

5. Discussion

The discussion concludes that the four audits cannot be ranked on the highly distinguishable generators studied. Their assumptions and finite-sample requirements should guide audit choice, while a controlled benchmark is needed to compare calibration.

5.1. Why the Four Methods Cannot Be Ranked Here

  • Thousands for KDE-LR, tens for GAUSSMECH, below one for MMD-TV, and endpoint-divergent raw OOF values for ROC-HT make the eight highly distinguishable conditions unsuitable for ranking the audits.MMD-TV is a population pure-DP lower-bound route evaluated with an uncertified sample estimate; Table 2 separately reports certified selected-pair ROC-HT bounds, while GAUSSMECH and KDE-LR depend on modeling and aggregation assumptions.Source: §5.1 · p. 11

5.2. A Benchmark on Which the Four Methods Could Differ

  • A controlled benchmark would add calibrated isotropic Gaussian noise to normalized encoder outputs, vary ν, and use Balle and Wang’s fixed-nonzero-δ guarantee with per-pair sensitivity Δ2 ≤ 2 as a reference.This would test calibration and sensitivity as distinguishability changes, not certify the original black-box generators; the evaluated generators lack both a known identity-channel guarantee and tunable intermediate distinguishability.Source: §5.2 · p. 11

5.3. Which Method to Use When

  • Audit choice should follow method fit: GAUSSMECH suits additive-Gaussian mechanisms, KDE-LR exposes marginals but its sum is not joint DP, MMD-TV needs one-sided finite-sample treatment, and ROC-HT can exploit strong distinguishers.A reserved-test protocol with a fixed, independently evaluated test and simultaneous confidence correction makes ROC-HT a finite-sample certificate, but reduces power on small test sets.Source: §5.3 · pp. 11–12

6. Related Work

Prior work addresses training-record privacy, image-mechanism guarantees, and mathematical tools for DP auditing, while this study compares four routes for inference-time identity-level audits. Its contribution is the assumption-matched comparison, not the underlying hypothesis-testing conversion or mathematical components.

DP auditing

  • Earlier DP audits use hypothesis tests for training algorithms under record-level changes, whereas this work compares that conversion with three embedding-space routes for inference-time identity labels.The hypothesis-testing conversion itself is not claimed as a contribution.Source: §6 · p. 12

Training-data privacy in generative models

  • Training-data extraction and membership-inference studies ask whether records are memorized or identifiable; this audit instead tests distinguishability across input identity labels, a complementary threat model.Carlini et al. study extraction of memorized diffusion examples, while Hu and Pang [32] study membership inference against denoising diffusion models.Source: §6 · p. 12

DP for image and generative mechanisms

  • DP-SGD and calibrated-noise image mechanisms answer different questions, and retrospective GaussMech or KDE-LR estimates do not inherit their guarantees for arbitrary black-box outputs.The cited image and representation mechanisms add calibrated noise before subsequent processing.Source: §6 · p. 12

MMD, total variation, and the hypothesis-testing characterization of DP

  • MMD-TV combines pre-existing MMD, total-variation, and DP hypothesis-testing results; its contribution is their explicit pure-DP specialization and assumption-matched comparison with three identity-level audit routes.The cited foundations include Gretton et al., Sriperumbudur et al., Kairouz, Oh, and Viswanath, Ghazi and Issa, and Dong, Roth, and Su; prior kernel-based DP auditors include Domingo-Enrich and Mroueh [14], DP-Auditorium, and Gonz´alez et al..Source: §6 · p. 12

7. Ethics and Dual Use

The study audits identity leakage using sensitive biometric data and recognizes dual-use risk. It limits releases to aggregate embedding-level results and excludes generated faces and identity-specific attack artifacts.

7. Ethics and Dual Use

  • The audit is intended for defensive privacy evaluation, but its methods could also support identity recognition.The authors report aggregate embedding-level results and do not release generated faces or identity-specific attack artifacts.Source: §7 · p. 12
  • The study uses selected public-dataset subsets and precomputed outputs, collects no new participant data, and does not attempt re-identification.Public availability does not resolve consent or downstream-misuse concerns; missing metadata also prevents subgroup analysis of encoder performance and limits fairness conclusions. Recommended artifact safeguards include excluding face images, minimizing identity-linked metadata, documenting licenses and model terms, and stating defensive intent.Source: §7 · p. 12

8. Limitations and Future Work

The reported privacy estimates are conditional on specific precomputed generators, identity representations, and per-query sampling choices. Because the audited generators are highly distinguishable, the comparison cannot establish which method is tighter at intermediate privacy levels.

High-distinguishability regime

  • Because the audited generators are already highly distinguishable, results cannot establish which audit is tighter at intermediate privacy levels.A calibrated-noise mechanism could enable comparison of non-endpoint ε values across a noise-scale sweep.Source: §8 · p. 12

Generators, data, and provenance

  • The study covers precomputed FaceFusion and InstantID outputs for selected VGGFace2 and CelebA identities; missing versioned manifests prevent reproducing generation or attributing effects to a specific revision.Other generators, data, donors, or preprocessing may produce different results; the FaceFusion donor is fixed, and stored labels represent target identities.Source: §8 · p. 12

Encoder and representation dependence

  • The audits treat each identity encoder as a fixed proxy: ArcFace and FaceNet preserve the qualitative verdict but shift numerical values, and two encoders do not capture all pixel-level identity information.ArcFace overlap with InstantID’s conditioning representation may affect that result; FaceNet is the cleaner cross-encoder check, while checkpoint identifiers are unavailable.Source: §8 · pp. 12–13

Per-query versus multi-query privacy

  • The guarantee is per-query for one generated embedding, not for an identity’s full batch; translating estimates to multiple queries requires a composition model and query count, so ε is not scaled by N.N images per identity estimate the per-identity output distribution; the paper makes no group-privacy claim for batch release.Source: §8 · p. 13

Finite-sample certification

  • Population MMD and hypothesis-testing inequalities are valid, but reported MMD-TV and broad out-of-fold ROC estimates are not confidence-certified lower bounds.A separate reserved-test ROC evaluation uses simultaneous exact confidence treatment for five development-selected vertex-disjoint pairs per condition; its guarantees are conditional on iid sampling, and global 40-pair correction removes power on smaller CelebA test sets. One-sided MMD concentration or sequential treatment remains future work.Source: §8 · p. 13

Neighborhood and deployment choices

  • The identity-sampling neighborhood does not establish privacy for a fixed user-selected photograph, multiple outputs, or a changing FaceFusion donor; these settings require new definitions and analyses.Per-image, prompt, variable-donor, and dataset-level neighborhoods may require different sampling and sensitivity analyses, so current numerical results do not transfer automatically.Source: §8 · p. 13

9. Conclusion

The study compares four black-box identity-level privacy audits, making their assumptions and finite-sample treatments explicit. The audits reveal substantial identity distinguishability, but their differing estimates do not support a reliable ranking; calibration and tightness require a known-privacy benchmark.

9. Conclusion

  • GAUSSMECH, KDE-LR, MMD-TV, and ROC-HT audits clarify distinct routes from embedding measurements to ε diagnostics or population lower bounds, with their assumptions and finite-sample status made explicit.The comparison aligns methods on common identity pairs and adds an MMD-TV pure-DP specialization and a development-selected, reserved-test ROC-HT certificate with simultaneous exact confidence control.Source: §9 · p. 13
  • 15 of 20 VGGFace2 stress-test pairs exceed ε = 1 among the positive selected-pair lower bounds certified under one simultaneous 95% confidence family.The reserved-test ROC protocol selects pairs, fits classifiers, and selects thresholds using only development data, then evaluates once on untouched test data; it cannot certify much smaller CelebA test sets despite high AUC.Source: §9 · p. 13
  • Across eight encoder × dataset × generator conditions, classifier and two-sample tests reveal substantial identity-distinguishing signal, but differing numerical estimates do not identify a tightest audit.The differences reflect assumptions, aggregation, finite-sample treatment, and ROC endpoint behavior.Source: §9 · p. 13
  • GAUSSMECH and KDE-LR are not formal joint-mechanism lower bounds, while MMD-TV and broad out-of-fold ROC-HT values remain uncertified sample estimates; reserved-test ROC-HT values are certified.A known-privacy benchmark whose audited ROC stays strictly inside the unit square is needed to compare calibration and tightness without endpoint divergences.Source: §9 · p. 13

Related papers

Loading 2608.17147v1…