PaperlayerView exact revision on arXiv

Source-linked AI summary

Toward Sub-1 kB Identity-Preserving Face Compression: A Benchmark of Codecs, a Custom Learned Codec, and Studies of Resolution, Demographic Fairness, Recompression, and Adversarial Robustness

Petr Hurtik, Jakub Sochor

arXiv:2608.22866v1cs.CV

TL;DR

Sub-1 kB identity-preserving face compression is feasible, but codec choice must follow the byte budget because rankings change sharply between 1024 and 512 bytes. The paper benchmarks general and face-specific codecs, trains a byte-budgeted learned codec, and evaluates resolution, fairness, recompression, and adversarial robustness.

  • Problem

    Under fixed sub-kilobyte storage, the paper asks how to preserve the identity signal used by face-recognition models and compare codecs under a strict per-image budget.

  • Method

    The study benchmarks ten codecs across resolutions, byte budgets, datasets, and face matchers, then evaluates a custom identity-preserving codec alongside four additional studies.

  • Results

    At 1024 bytes modern codecs preserve identity well, while at 512 bytes codec rankings re-sort: WebP, JPEG-AI, and the learned codecs outperform AVIF, HEIF, JPEG XL, and legacy JPEG.

  • Takeaways & Limitations

    Codec deployment should be selected for the target byte budget rather than extrapolated from the 1024-byte ranking, with learned compression remaining competitive across the tested operating points.

  • Takeaways & Limitations

    The learned codec can emit over-budget frames when its frozen gain table cannot reach the target, including substantial overflow at some 512-byte and 224-pixel settings.

Abstract

from arXiv · show

Storing face images under a hard sub-kilobyte budget, as required for identity documents, smart-card biometrics and bandwidth-constrained verification, forces a codec to discard most of the signal while keeping what a face matcher actually reads: identity. Generic codecs optimize pixel fidelity, not the embedding distances that drive verification, so which codec, resolution and setting best preserve identity at 1024 bytes or less, and how that degrades at 512, is unclear. We benchmark ten general and face-specific codecs across resolutions, byte budgets, two datasets (controlled Color FERET, in-the-wild AI-Solutions-KK) and four anchor face matchers, with a fourteen-model ViT and CNN roster confirming the ranking is backbone-invariant. We then train a custom identity-preserving codec that hits the byte budget exactly via binary search over a frozen gain table, and run four studies: resolution, demographic fairness, recompression, and no-box adversarial robustness. Sub-kilobyte identity preservation is feasible, but which codec to deploy depends entirely on the budget. At 1024 bytes and the 112 px working resolution the problem is close to solved: modern codecs hold Color FERET equal-error rate under 0.35 percent on the ArcFace anchor. At 512 bytes the field re-sorts: AVIF, HEIF, JPEG XL and legacy JPEG collapse to 28 to 98 percent false-non-match rate at FMR 1e-4, while WebP, JPEG-AI and our byte-budgeted learned codecs stay out of that band, with 24.3 percent for WebP against 6.9 percent for our accurate variant in the wild. That re-sort, not the 1024-byte ranking, is the operational result: a codec chosen at 1 kB is not the codec to deploy at half that.

1 Introduction

The report targets face compression into a hard sub-kilobyte payload while preserving verification identity rather than perceptual appearance. It benchmarks codecs, develops an identity-preserving alternative, and studies deployment-relevant effects.

  • Scope: The codec comparison includes classical, learned, and face-specific methods under a single strict per-image budget.The paper frames the use case around credentials, barcodes, bandwidth-constrained verification, and storage-limited face references.
  • Problem statement: The task compresses an aligned face crop into at most B bytes so its decoded embedding still verifies against the same subject.Detection and alignment remain fixed and outside scope; EER is the primary metric, supported by FNMR at fixed operating points.
  • Benchmark: The study benchmarks ten off-the-shelf codecs at 1024 and 512 bytes across two datasets and four face-recognition models.The uniform protocol also evaluates resolution, color, quality settings, and statistical significance, with a fourteen-model roster testing backbone dependence.
  • Custom codec: A custom byte-budgeted identity-preserving codec is trained in FAST and ACCURATE variants alongside the benchmarked codecs.The custom variants differ in model size and architecture, including an identity side-stream and refinement head for Ours-ACCURATE.
  • Deployment studies: The report studies resolution, demographic fairness, recompression, and no-box adversarial perturbations as deployment-oriented effects.These studies examine facial position and resolution, demographic disparities, already-compressed inputs, and whether compression sanitizes attacks.

2 Background and Related Work

The background motivates identity-focused evaluation because perceptual quality and biometric utility diverge at extreme rates. It reviews transform and neural codecs, face-recognition embedders, no-box attacks, and practical deployment constraints.

  • Evaluation rationale: At extreme compression, perceptual quality can diverge from biometric utility, so identity cosine and verification EER are the decisive measures.PSNR, SSIM, LPIPS, and DISTS are reported for context, but the primary distortion criterion is embedding cosine similarity.
  • Codec background: Classical codecs transform, quantise, and entropy-code pixels, while neural codecs learn nonlinear transforms and entropy models jointly.The neural formulation optimizes a rate–distortion objective L = R+λD and includes learned priors and hyperpriors.
  • Prior findings: Modern codecs are favored over legacy JPEG at sub-kilobyte rates, and downsampling generally damages identity less than aggressive lossy compression.The cited compression-for-recognition literature directly motivates the protocol’s resolution and codec comparisons.
  • Variable-rate coding: A single learned model can cover multiple rates through gain units and binary search over a frozen gain table to satisfy a hard byte budget.The custom codec selects the highest-quality gain vector whose entropy-coded payload fits the budget.
  • Deployment constraints: Deployment comparisons must consider licensing, decoder availability, model footprint, and encode cost in addition to identity performance.Hard-budget encoders may require roughly six encode attempts, while learned decoders can require substantially larger model footprints.
  • Adversarial setting: No-box attacks assume no victim-model access or queries, so perturbations depend entirely on transferability from self-supplied proxy images.The study tests whether low-pass, requantising compression incidentally sanitizes such perturbations.

3 Datasets

The study uses two aligned face datasets that bracket clean and in-the-wild verification conditions, with shared framing across five resolutions. Demographic annotations and exhaustive pair enumeration support the verification and fairness analyses.

  • Color FERET: Color FERET provides a controlled, frontal benchmark with studio conditions and 11,335 aligned crops after landmark-based preparation.It serves as the clean reference where compression artefacts dominate identity loss.
  • AI-Solutions-KK: AI-Solutions-KK provides 17,534 aligned crops from 105 identities under varied pose, expression, illumination, background, and source-resolution conditions.Its protocol enumerates approximately 153.7 million unordered pairs, with all mated pairs scored and a fixed 5 M impostor sample.
  • Alignment and resolutions: Both datasets use the same canonical five-point template and five square resolutions—64, 96, 112, 168, and 224 px—with 112 px as the verification working resolution.Resolution is varied while framing is held constant.
  • Verification pairs: Verification enumerates all C(N,2) unordered pairs, labels same-identity and different-identity pairs, scores every mated pair, and samples at most 5×10^6 impostor pairs.The fixed seeded impostor sample is shared across codecs, budgets, and matchers.
  • Demographic attributes: AI-Solutions-KK carries Monk skin-tone, estimated age, and estimated gender attributes used for fairness analysis.The demographic labels are model-estimated, and the skin-tone distribution is strongly concentrated across identities.

4 Evaluation Protocol

The evaluation measures identity preservation and pixel reconstruction separately across codecs, matchers, resolutions, and strict byte budgets. Verification uses pairwise cosine scores and fixed operating-point metrics, while the custom codec's compliance is tracked explicitly.

  • Measurement framework: Every codec is evaluated on identity verification and pixel reconstruction across two byte budgets and five resolutions.The pipeline reports verification accuracy and reconstruction quality as separate axes against a lossless aligned reference.
  • Identity probes: Four anchor matchers from different architecture families are supported by a wider fourteen-model roster to test backbone dependence.The anchors are ArcFace-antelopev2, LVFace-L, TopoFR-R100, and EdgeFace-XS.
  • Verification metrics: Verification sweeps cosine-similarity thresholds over genuine and impostor pairs to produce EER, FNMR at fixed FMR values, and compression-induced ΔEER.The fixed-FMR FNMR values include 10^-2, 10^-3, and 10^-4, with 10^-4 the most demanding tail point.
  • Pair sampling: Impostor pairs use one seeded uniform sample capped at 5×10^6, reused across every codec, budget, and matcher.This makes comparisons use a common denominator while retaining all genuine pairs.
  • Operating points: The hard operating points are 1024 and 512 bytes, and achieved-size fit rates are reported because some encodes can exceed the ceiling.The custom codec uses a strict byte ceiling at tuned resolutions, while intermediate-resolution overshoot is quantified rather than hidden.

5 Benchmark of Existing Codecs

At 1024 bytes, several modern codecs preserve identity well at the 112 px working resolution, but halving the budget radically changes the ranking. At 512 bytes, learned and byte-budgeted codecs remain usable while many classical and block codecs collapse.

  • Rate–identity trade-off: At 1024 B and 224 px, JPEG-AI leads identity cosine at 0.958 on Color FERET, while Ours-ACCURATE is runner-up at 0.947.At 112 px, Ours-ACCURATE instead leads JPEG-AI, 0.948 versus 0.930 on Color FERET.
  • 1024 B benchmark: At 1024 B, modern block codecs and JPEG-AI keep Color FERET/ArcFace 112 px EER below 0.5%, while JPEG 2000 reaches 3.23%.WebP and AVIF are each 0.09%, JPEG XL is 0.19%, HEIF is 0.18%, JPEG-AI is 0.09%, and plain JPEG is 0.25%.
  • 512 B benchmark: At 512 B, JPEG reaches 33.35% and JPEG 2000 reaches 19.50% EER at 112 px on Color FERET/ArcFace, while WebP remains at 0.46% and JPEG-AI at 0.27%.The same degradation pattern appears at uniformly higher absolute EER on AI-Solutions-KK.
  • Operating-point accuracy: At 512 B and 112 px, Ours-ACCURATE is best on both datasets: 6.93% versus WebP’s 24.28% FNMR@10^-4 on AI-Solutions-KK and 1.83% versus JPEG-AI’s 2.86% on Color FERET.At 224 px/512 B, the ordering inverts and WebP leads.
  • Operating-point accuracy: At 512 B, AVIF, HEIF, JPEG XL, JPEG, and JPEG 2000 mostly fall into an approximately 28%–99% FNMR@10^-4 collapse band, unlike WebP and the learned codecs.WebP records 6.0% on Color FERET and 24.3% on AI-Solutions-KK, while JPEG-AI records 2.86% on Color FERET.

5.4 Operating points at the 224 px source resolution

At 224 px, the 1024-byte ranking remains favorable to modern codecs, but the 512-byte ordering changes sharply: Ours-ACCURATE loses its 112 px advantage, while several codecs fail budget compliance. Codec-specific resolution sweet spots show that learned codecs can exploit full resolution, whereas classical codecs require coarser operating points.

  • At 1024 B, Ours-ACCURATE is level with JPEG-AI on Color FERET, with FNMR@10^-4 of 0.30% versus 0.29% on ArcFace.
  • At 512 B, Ours-ACCURATE falls to fifth on Color FERET and becomes the worst budget-compliant modern codec on AI-Solutions-KK at 224 px.Its FNMR is 4.17% on Color FERET and 30.43% on AI-Solutions-KK, whereas WebP leads both comparisons.
  • At codec-specific optima, learned codecs lead both budgets: Ours-ACCURATE reaches 0.57% at 224 px and 1.83% at 112 px for 1024 B and 512 B, respectively.At 512 B, JPEG-AI is best at 168 px, while WebP, AVIF and JPEG XL require coarser trade-offs to become competitive.
  • The sub-1 kB error floor appears below roughly 800 B for classical codecs, whereas Ours-ACCURATE remains between 0.14% and 0.22% EER from 1024 B through 512 B.AVIF rises about 24× and JPEG about 120× from 960 B to 512 B on Color FERET.
  • Budget compliance becomes a separate deployment constraint: at 512 B, standard block codecs fit almost no AI-Solutions-KK crops, while JPEG-AI and learned codecs hold the budget reliably.The learned codec guarantees a parseable ≤B stream by construction, although Ours-FAST emits fallback frames more often at larger resolutions.

6 Reconstruction Quality

At 1024 B, codec rankings diverge across pixel, perceptual, and identity measures: JPEG-AI and WebP lead distortion metrics, while the learned codec leads LPIPS/DISTS despite lower PSNR/SSIM. At 512 B, perceptual metrics track identity more closely, and codec choice must be evaluated with verification measures.

  • Full-reference metric matrix: JPEG-AI and WebP lead distortion metrics at 1024 B, while the learned codec leads every codec on LPIPS/DISTS despite lower PSNR and SSIM.At 112 px and 1024 B, JPEG-AI records SSIM 0.920 and MS-SSIM 0.984, whereas Ours-ACCURATE records PSNR 28.63 dB and SSIM 0.834 but leads learned perceptual metrics.
  • Distortion does not predict identity: At 1024 B, PSNR and LPIPS do not significantly predict EER across all twelve codecs, while structural metrics predict it only weakly.The reported correlations are PSNR ρ=−0.45, p=0.14; LPIPS ρ=+0.37, p=0.24; SSIM ρ=−0.66, p=0.018; and MS-SSIM ρ=−0.62, p=0.031.
  • Distortion does not predict identity: At 512 B, perceptual metrics track EER most tightly, with DISTS ρ=+0.96 and LPIPS ρ=+0.94, compared with PSNR ρ=−0.74.All reported correlations are significant at p≤0.006, and the pattern remains similar after removing the two partial-coverage baselines.
  • Distortion does not predict identity: JPEG 2000 can rank mid-field on PSNR yet perform worst among standard codecs on identity, while Ours-ACCURATE gives up approximately 5 dB of PSNR but reaches 0.14% EER.These disagreements persist after excluding the partial-coverage neural baselines and illustrate why identity must be measured directly.
  • No-reference face-image quality: At 1024 B, face-image quality remains near the uncompressed level across codecs at 112 px, but 512 B exposes sharper codec-specific degradation.At 112 px, codecs remain within approximately 0.015 of the uncompressed FIQ of about 0.95; legacy JPEG falls from 0.95 to 0.80 at 512 B.
  • Visual reconstruction and budget degradation: The learned codec degrades smoothly to 512 B, with Ours-ACCURATE LPIPS changing from 0.014 to 0.022 on AI-Solutions-KK and from 0.012 to 0.019 on Color FERET.WebP’s AI-Solutions-KK LPIPS changes from 0.032 to 0.092 over the same budget reduction, while the learned reconstruction remains smooth and recognisable.

7 A Custom Identity-Preserving Codec

The paper develops two byte-budgeted learned face codecs and evaluates their identity preservation, budget compliance, cross-resolution behavior, and independent-matcher performance. Ours-ACCURATE is strongest at the harder 112 px/512 B operating point, while its side-stream introduces privacy and allocation trade-offs.

  • Codec design: Both variants enforce the hard byte budget with gain-controlled variable-rate encoding and binary-search budget targeting.A single model is trained across gain levels and resolution buckets.
  • Codec design: Ours-FAST uses a compact pixel-anchored network, whereas Ours-ACCURATE adds attention, an identity side-stream, and a refinement head.The default models contain approximately 1.35 M and 18.7 M parameters, respectively.
  • Trade-offs: The 90–175 B identity side-stream is a linkable biometric descriptor, while removing it reallocates those bytes to the spatial latent.This creates a privacy requirement and a design trade-off between side-stream conditioning and spatial capacity.
  • Results: At 224 px/1024 B, Ours-ACCURATE reaches identity cosine 0.947 on Color FERET, behind JPEG-AI’s 0.958 but ahead of AVIF’s 0.899 and WebP’s 0.893.On AI-Solutions-KK it reaches 0.934, behind JPEG-AI and Ours-FAST.
  • Results: At 112 px, Ours-ACCURATE reaches identity cosine 0.910 versus 0.797 at 224 px under 512 B, reversing its relative position with JPEG-AI.The fixed budget buys proportionally more of the lower-resolution crop.

8 Trivial and Difficult Samples: What Makes a Face Hard to Compress

Compression difficulty is driven modestly by fine detail on controlled Color FERET but not by the tested descriptors on in-the-wild AI-Solutions-KK. The learned codec preserves identity especially well among the hardest crops, where classical codecs degrade most.

  • What makes a crop hard: On Color FERET, Laplacian variance and luma contrast predict greater difficulty, while higher colourfulness predicts easier crops.The reported correlations are +0.39, +0.30, and −0.36, respectively, all with p<0.01.
  • What makes a crop hard: On AI-Solutions-KK, none of the eight codec-independent image descriptors reaches significance, with absolute correlations no larger than 0.10.The predictors are therefore dataset-specific.
  • Setup: Difficulty is defined as per-image identity loss, 1−id-cos, averaged across codecs on 300 crops per dataset.The analysis evaluates reconstructions at 112 px and both byte budgets.
  • Tail behavior: At 512 B, WebP’s hardest Color FERET crops score 0.42–0.52 id-cosine, whereas Ours-ACCURATE’s hardest five remain at 0.75–0.80.The two codecs agree only partly on which crops are difficult.
  • Cross-codec agreement: Difficulty ranks are only moderately shared across codecs, with mean pairwise Spearman correlations of 0.33 on Color FERET and 0.38 on AI-Solutions-KK.Agreement is higher among modern block codecs and the two learned variants, while legacy JPEG is an outlier.
  • Operational implication: A high-detail, high-contrast crop may warrant recapture or a larger budget on Color FERET, but this triage signal did not replicate on AI-Solutions-KK.Glasses and pose are not reliable drivers in the image-level analysis.

9 Ablations and Preprocessing

The studies identify 112 px as the working resolution and show that preprocessing must be judged after codec roundtripping. Chroma reduction is largely identity-neutral, spatial denoising is harmful, and background flattening remains anchor-dependent.

  • Resolution: 112 px retains nearly all identity content while giving the codec a more favorable bit allocation at fixed budgets.AC spectral energy stays above 0.999 and strong-matcher embedding cosine stays above 0.99, while LVFace-L is 0.899.
  • Resolution: Below 112 px, clean verification degrades; for ArcFace on KK, EER rises from 0.21% at 112 px to 0.39% at 64 px.The 112–224 px clean-resolution gap is small across anchor matchers.
  • Preprocessing: Chroma reduction is identity-neutral through the codec, while spatial denoising raises verification error across the tested anchors.The study applies preprocessing, compression, and decoding before measuring EER and reconstruction identity cosine.
  • Preprocessing: Ours-ACCURATE is the most preprocessing-robust tested codec: its worst operator costs +0.63 percentage points and A1 costs +0.38 points.The corresponding A1 penalty reaches up to +1.0 percentage point for WebP or AVIF.
  • Preprocessing: Background flattening has a strong ArcFace cost but only a mild EdgeFace-XS cost, so its effect does not generalize cleanly across anchors.The through-codec test used the weaker MediaPipe matting; a stronger BiRefNet rerun remains future work.
  • JPEG-FzT: Increasing JPEG-FzT’s decode radius from 1 to 2 reduces LPIPS from 0.188 to 0.117 at approximately the same byte size and PSNR.The larger radius is therefore used as the default at the 1 kB point.

10 The ISO/IEC 29794-5 Annex E/F parameter tables

The ISO/IEC 29794-5 Annex E/F tables optimize self-similarity through one-factor-at-a-time searches, but their choices often cannot distinguish verification performance near the optimum. Resolution matters most, interactions matter, and several prescribed settings fail to transfer consistently.

  • Objective and search: The annex configurations maximize same-image cosine under one matcher rather than verification metrics such as EER.The fitting loop contains no impostor pairs, mated pairs across captures, or EER evaluation.
  • Objective and search: The search varies one factor at a time at fixed 112 px and default preprocessing, so interactions among resolution, colour, and masking are not tested.The paper explicitly identifies these interactions as outside the annex search.
  • Transferability: At 1024 B, most modern-codec parameter choices are statistically indistinguishable, while JPEG 2000 and selected JPEG or WebP settings show meaningful differences.The result challenges the implied precision of normative parameter tables.
  • What matters: Resolution dominates the marginal effects: mean EER is 0.92% at 56 px versus 0.43% at 96–168 px.The annexes’ 56–64 px choices are therefore on the wrong side of the optimum for five of seven codecs.
  • What matters: Masking appears beneficial on selection data but transfers poorly, with only two of five per-codec winners carrying manipulation reproducing on held-out data.Rectangle_mean improves the averaged grid result, but that advantage is not consistently retained.
  • Colour and flags: Greyscale frees bytes mainly for JPEG 2000, while for modern codecs it can discard identity information without converting the saved space into lower EER.At fixed quality, greyscale frees 14–23% for JPEG and up to 66% for JPEG 2000, but only 5–17% for AVIF, JPEG XL, and HEIF.
  • Proxy quality: Self-similarity correlates strongly with EER overall at Spearman ρ=−0.77, yet it can select configurations up to 1.9× worse than the EER optimum.It separates poor from good settings but lacks resolution near the optimum.

11 Demographic Fairness

Compression generally preserves subgroup rankings but widens between-group error gaps, with JPEG 2000 producing the strongest fairness degradation. Pose remains the largest within-attribute disparity, while KK tone findings are exploratory because several subgroups are sparse or model-estimated.

  • Scope and reliability: KK fairness results are exploratory because the tone estimator is skin-tone-correlated and several subgroup identity counts are tiny.The sparsest cells are especially unreliable, whereas only MST6 and MST7 are well populated.
  • Subgroup equal-error rates: Compression raises subgroup EERs above the uncompressed baseline, with JPEG 2000 increasing them by an order of magnitude.Within every subgroup, strong codecs remain below a few percent EER, but the absolute errors rise after compression.
  • Skin tone: The KK tone ordering is non-monotone and compression preserves it: MST8 remains hardest while MST10 remains among the easiest across codecs.The paper therefore claims no clean darker-is-worse gradient from the model-estimated KK tones.
  • Pose, sex, and age: Sex and age effects remain comparatively stable under compression, with a small female-over-male EER gap and no age-bin reordering.The female-over-male ordering holds in 42 of 44 KK codec×anchor cells.
  • Pose, sex, and age: Pose is the largest non-codec driver of EER: profile faces are hardest at baseline and reach 5.18% EER under JPEG 2000, versus at most 0.03% for frontal faces with strong codecs.The profile-is-worst pattern also holds across the other anchor matchers.
  • Disparity summary: JPEG 2000 has by far the worst disparity on every attribute and both datasets, while WebP, AVIF, and HEIF stay closest to the uncompressed level.All three still widen the disparity relative to the uncompressed baseline.

12 Compressed-on-Compressed Recompression

Recompression is usually benign among modern codecs but exposes codec-pair failures that single-pass rankings miss. JPEG XL followed by HEIF or AVIF and any chain involving JPEG 2000 sharply degrade identity, whereas the learned codec behaves like the modern transform cluster.

  • Recompression matrix: Most same-codec and modern-to-modern chains lose less than about 1 percentage point of EER, but JPEG XL→HEIF, JPEG XL→AVIF, and JPEG 2000 chains are major exceptions.The full 8×8 source/second matrix makes these failure structures visible across datasets and budgets.
  • Failure modes: JPEG XL→HEIF reaches 17.14% EER on Color FERET and JPEG XL→AVIF reaches 8.00%, with delta-EER increases of +16.31 pp and +7.38 pp.These interactions arise despite benign single-pass behavior for the individual codecs.
  • Failure modes: Any chain involving JPEG 2000 remains poor, with entries near 6% when JPEG 2000 is second and roughly 5.2–5.9% when it is first.The paper attributes this additive penalty to information already discarded by JPEG 2000’s wavelet quantisation.
  • Deployment guidance: The recompression hazard is operationally important because per-codec rankings would miss codec-pair interactions, making recompression matrices necessary acceptance tests.The supported deployment guidance is to avoid JPEG XL→HEIF/AVIF and JPEG 2000, while favoring WebP, AVIF, or HEIF targets.
  • Learned codec: Ours-ACCURATE behaves like the modern transform cluster: its same-codec chain costs 0.66% EER on Color FERET and cross-pairs remain within about 1–2 pp of single-pass baselines.At 512 B, its same-codec chain is 1.09% on Color FERET, showing budget robustness.
  • Cross-dataset confirmation: On AI-Solutions-KK, JPEG XL→HEIF reaches 24.17% EER and JPEG XL→AVIF reaches 15.34%, reproducing the Color FERET failure pattern in the wild.Modern-to-modern chains remain benign despite higher absolute KK EER.

13 Adversarial Robustness and Sanitization

Lossy compression sanitizes no-box adversarial perturbations, especially at 512 bytes for classical codecs, but stronger sanitization trades off against clean identity preservation. The attack ordering is broadly stable, while the trained codecs are comparatively budget-independent and weaker sanitizers.

  • Threat model: The no-box threat model gives the attacker no access to the matcher’s architecture, parameters, training set, queries, or score feedback.HFC directly targets high-frequency content, the band most relevant to compression-based sanitization.
  • Attack comparison: The three attacks are ordered approximately Li-AE ≈ HFC > CLIP-transfer in surviving identity impact after compression.The two domain-informed attacks are indistinguishable within ≤0.014 identity-cosine at every ε and both exceed the generic foundation-model transfer.
  • Budget effect: At 512 B, classical codecs leave smaller adversarial residuals than at 1024 B, usually by a factor of two or more, while the two trained codecs are essentially tied across budgets.For JPEG at ε = 0.06, the residual falls from 0.261 at 1024 B to 0.056 at 512 B.
  • Quality–sanitization trade-off: JPEG 2000 is the strongest sanitizer, whereas Ours-ACCURATE is the weakest at the hard budget despite being strongest on clean identity.At ε=0.06/512 B, Ours-ACCURATE has residual 0.350 versus JPEG 2000’s 0.069 at ε=0.06/1024 B; the cited clean-identity comparison is EER 0.22% versus 19.5% at 112 px/512 B.
  • CLIP-transfer attack: CLIP-surrogate residuals are smaller than HFC residuals in every matched cell, and every classical codec is at or below approximately 0.17 residual at 512 B.The trained codecs reach approximately 0.26 in that setting.
  • Learned codecs: The trained codecs sanitize all three attacks but do not escape the sanitization-versus-quality trade-off: Ours-ACCURATE is consistently the weaker sanitizer than Ours-FAST.At 512 B with ε ≥ 0.06, both trained codecs are the weakest rows in the table.

14 Statistical Significance

Statistical testing supports a stable codec ranking across matchers while distinguishing operationally negligible modern-codec differences from the clear failures of JPEG 2000. However, pair-level significance is inflated by dependent trials, so subject-level uncertainty remains important.

  • Pairwise comparisons: At 112 px/1024 B, modern codecs form an operationally interchangeable cluster, while the aligned reference is significantly better and JPEG 2000 is significantly worse than the alternatives.The modern cluster includes AVIF, HEIF, JPEG XL, WebP, JPEG-AI, and Ours-ACCURATE.
  • Inference caveat: Pair-level McNemar and DeLong p-values are power-inflated because subjects recur across millions of dependent pairs and therefore should not be read as effect magnitudes.The paper prioritizes subject-level bootstrap confidence intervals and Cliff’s-δ effect sizes instead.
  • Learned variants: The accurate learned variant remains separable from the fast variant, with accuracy 0.9923 versus 0.9897 and χ2 = 1381.This difference is statistically solid after correction.
  • Cross-dataset testing: KK resolves modern-codec near-ties as significant because each cell aggregates 3,515,807 verification trials, while preserving the practical interpretation of negligible AUC gaps.AVIF versus WebP differs by only 0.8–4.0×10^-4 AUC on three side-stream-independent anchors.
  • Backbone invariance: Matcher rankings agree strongly, with Kendall’s concordance W = 0.85; mean ranks place JPEG-AI first, Ours-ACCURATE and WebP behind it, and JPEG 2000 near the bottom.The reported mean ranks are 1.86 for JPEG-AI, 3.07 for Ours-ACCURATE and WebP, and 11.93 for JPEG 2000.
  • Effect sizes: Ours-ACCURATE beats JPEG 2000 with Cliff’s δ = −1.00, beats Ours-FAST with δ = −0.49, and is statistically tied with WebP and AVIF.The reported ties are δ = +0.00 with WebP and δ = −0.03 with AVIF.

15 Discussion, Limitations, and Roadmap

The report consolidates a uniform sub-1 kB evaluation, confirms major codec findings, and distinguishes completed evidence from remaining coverage gaps and validity threats.

  • The uniform protocol compares identical crops, byte budgets, embeddings, and verification routines across codecs, reducing alignment and operating-point confounds.
  • At 1024 B, modern codecs preserve identity while legacy JPEG and JPEG 2000 collapse, establishing the benchmark’s central codec split.
  • The custom codec reaches exact on-disk budgets through binary search over a frozen gain table and remains competitive with JPEG-AI across key operating points.
  • Completed findings: JPEG-AI verification on AI-Solutions-KK is complete and is level with Ours-ACCURATE at the top of the in-the-wild 1024 B field.Mean FNMR@10−4 is 2.92% for JPEG-AI versus 2.93% for Ours-ACCURATE.
  • Remaining coverage: The wider matcher roster confirms stable codec ranking across backbone and resolution, although several non-anchor AI-Solutions-KK cells remain incomplete.
  • Limitations and roadmap: Validity boundaries include matcher and capture-condition scope, evaluator overlap for the learned codec, and unfinished follow-ups such as channel simulation and codec-aware attacks.

16 Conclusion

The conclusion finds that identity-preserving face compression below 1 kB is feasible, but deployment depends on codec, resolution, and budget. It combines the benchmark, custom codec, and auxiliary studies into concrete operating guidance.

  • Sub-1 kB identity-preserving compression is achievable, with modern transform and learned codecs retaining identity at 1024 B while legacy codecs fail under tighter conditions.
  • Resolution: At 112 px, downsampling retains 99.97% of AC spectral energy and over 0.99 embedding cosine for strong matchers, while freeing budget.
  • Budget: At 512 B, classical codecs cross a sharp error floor, whereas Ours-ACCURATE remains at 0.14–0.22% across the budget range.
  • Fairness: JPEG 2000 amplifies skin-tone disparity 11.2–20.0×, while every other codec, including the custom codec, adds at most 1.7 pp.
  • Deployment and scope: The report turns these findings into deployment recommendations while documenting incomplete AI-Solutions-KK non-anchor coverage and attack-study exceptions.

17 Artifacts

The artifacts section links generated report outputs to pipeline stages and explains how tables and figures can be traced to their underlying measurements.

  • The report is an index connecting body-text claims to machine-readable files rather than a manually transcribed record.
  • The master accuracy table stores verification metrics, pair counts, aligned-reference EER, and confidence intervals for anchor and held-out matchers.
  • Every table and figure is generated from indexed pipeline files or directly from committed embedding arrays for two preprocessing ablations.
Loading 2608.22866v1…