PaperlayerView exact revision on arXiv

Source-linked AI summary

Damnatio Memoriae: Adversarially and Selectively Forgetting Identities in the Embedding Space of Face Recognition Models

Ünsal Öztürk, Vedrana Krivokuća Hahn, Sushil Bhattacharjee, Sébastien Marcel

arXiv:2609.27115v1cs.CV

TL;DR

In open-set face recognition, retraining after removing a person’s images may still leave that person verifiable. This paper alters embedding geometry to forget selected identities while preserving recognition for others; the orthonormal frame achieves strong forgetting in the reported setting.

  • Problem

    Removing an identity’s training images and retraining does not ensure that the identity becomes unverifiable, because face recognition generalises to identities absent from training.

    Source: §I · p. 1

  • Method

    The paper proposes three losses that alter embedding geometry for selected identities, including per-image near-orthogonal targets, and fine-tunes them alongside classification.

    Source: §I · p. 2, C. Forget losses · p. 6

  • Results

    Only the orthonormal frame achieves strong forgetting, aligning mated-forget scores with non-mated scores where a forget-train image enters the comparison.

    Source: §VI · p. 14

  • Takeaways & Limitations

    The orthonormal frame is the paper’s choice when forgetting must extend to images on which the losses never operated, with reported costs in retain identification and footprint.

    Source: §VI · p. 14

    Results cover one margin loss on a 100,000-identity WebFace4M subset and forget sets of 1% and 5%; transfer to other losses, corpora, or larger scales remains open.

    Source: §VI · p. 14

Abstract

from arXiv · show

A face recognition model links two images of a person recorded on separate occasions when their embedding similarity exceeds an operating threshold. We consider making chosen identities unlinkable across separate occasions while the model remains in service for the rest of the population. Deleting their images and retraining does not achieve this, since the model recognises identities never observed in training. Therefore, the embedding space must be altered against these identities, the process of which we call open-set adversarial forgetting. We propose three loss functions, one that disperses an identity's embeddings from their centroid, and two that map each image onto its own near-orthogonal target, learnt with the classifier head or fixed in advance as an almost-orthonormal frame. Each is fine-tuned alongside the classification objective on a subset of each identity's images. We evaluate them against four methods from prior work in verification and identification, at two forget scales and three backbones. Every loss acting on the embedding geometry makes the forget identities nearly unidentifiable. The orthonormal frame alone achieves strong forgetting, which holds wherever an image of that subset enters the comparison and leaves distinct forget identities unlinkable. It also surpasses a concurrent unsupervised method at a higher retain rate.

I. INTRODUCTION

Face recognition links mated images when their embedding similarity exceeds an operating threshold, but conventional unlearning does not ensure that chosen, unseen identities become unverifiable. This paper instead targets degraded verification for selected identities while preserving recognition for others, and evaluates that goal in the open set.

I. INTRODUCTION

  • Because face recognition generalises to identities absent from training, removing a chosen identity’s images and retraining does not ensure that identity becomes unverifiable.The paper therefore defines adversarial forgetting as altering the embedding space against chosen identities while leaving the rest of the population intact.Source: §I · p. 1
  • The paper formulates open-set adversarial forgetting, proposes a protocol using capture-instance subsets, and introduces three losses compared with four prior-art baselines.It evaluates verification and identification across forget scales and backbones.Source: §I · p. 2

II. RELATED WORK

  • The surveyed unlearning literature assumes train-from-scratch equivalence, whereas this work adopts selective-performance removal as its operational target, making those methods not directly comparable.For face-identity unlearning, Zakharov uses pairwise dispersion and a hard-positive variant, CURE is unsupervised, and Choi and Na evaluate classification accuracy and membership inference; Nair et al. provide a complementary fine-tuning procedure.Source: §II · p. 2
  • Unlike adversarial forgetting, backdoor attacks make a system accept comparisons it should reject, while template inversion leaves the model untouched.Backdoors and forgetting both modify a model already in service, making detection of tampering a shared concern.Source: §II · p. 3
  • The paper frames forgetting as matching mated-forget scores to unrelated-identity scores and evaluates at calibrated operating points through verification and open-set identification.It contrasts these probes with retrieved-image rank and membership-inference checks.Source: §II · p. 4

III. METHODOLOGY

The method targets unlinkability across separate capture instances while keeping the rest of the population linkable. It defines weak and strong forgetting by how forget-pair scores relate to the operating threshold and to unrelated-identity scores.

A. Motivation

  • Forgetting is restricted to across-instance pairs because within-instance images are near-identical, readily trackable, and difficult to separate under Lipschitz continuity.The problem distinguishes capture instances, whose images vary in pose, expression, illumination, and scene, from images within one acquisition event.Source: A. Motivation · p. 4, B. Problem statement · pp. 4–5

B. Problem statement

  • The model trains on retain identities while forget and test identities are held out, making the setting open-set.Its normalized embeddings are compared using a threshold calibrated on a separate development set.Source: B. Problem statement · p. 4
  • Two images are linked when their embedding similarity reaches the fixed threshold, and forgetting aims to make chosen identities unlinkable across capture instances.The system also evaluates identification by whether a probe from a new appearance is assigned to the enrolled forget identity.Source: B. Problem statement · pp. 4–5
  • Strong forgetting brings mated-forget scores onto non-mated-retain scores while keeping mated-retain and non-mated-retain distributions close to their original forms.The formulation trades forgetting against preservation of retain distributions.Source: B. Problem statement · p. 5
  • Weak forgetting moves mated-forget scores below the threshold but leaves them above non-mated scores, so a distinctive forget-score subgroup remains.This subgroup may still be used to link forget identities.Source: B. Problem statement · p. 5, Figure 3 · p. 5

C. Forget losses

The forget losses either disperse an identity’s embeddings or map each image to its own approximately orthogonal target, while retaining the original CosFace objective. The proposed losses use a moving class head, a fixed target frame, or an identity centroid to implement these strategies.

C. Forget losses

  • The losses add a forget term to the CosFace retain loss and use either embedding dispersion or per-image near-orthogonal targets to reduce across-instance similarity.The retain head is warm-started from the original model and fine-tuned jointly with the backbone.Source: C. Forget losses · p. 5
  • Prior baselines include pairwise and hard dispersion, NegGrad+, and CURE, which respectively repel pairs, increase forget cross-entropy, or repel embeddings toward pseudo-label clusters.Pairwise and hard dispersion operate on embedding geometry without a classifier head.Source: C. Forget losses · pp. 5–6
  • The proposed centroid-push loss repels each embedding from its identity’s mean direction, with linear rather than quadratic cost in the number of images.The centroid is recomputed as embeddings move, and the method gives the same weak forgetting as pairwise dispersion.Source: C. Forget losses · p. 6
  • Extended CosFace assigns each forget image its own fake class, making same-identity pairs non-mated comparisons and spreading their embeddings toward near-orthogonal directions.Each fake-class row is added to the warm-started margin head.Source: C. Forget losses · p. 6
  • The orthonormal-frame loss aligns each forget image with its own fixed target, making same-identity embeddings near-orthogonal to one another and to retain rows by construction.Targets are selected to minimise their largest cosine similarity to retain rows and previously placed targets; the frame is almost-orthogonal because targets outnumber available orthogonal directions.Source: C. Forget losses · p. 6

IV. EXPERIMENTAL SETUP

The experimental setup covers the dataset and model, forgetting methods and training, data partitions, verification and identification protocols, and metric comparisons.

IV. EXPERIMENTAL SETUP

  • The setup specifies datasets and models, forgetting methods and training, partitions, verification and identification protocols, and how comparison metrics are computed.Source: §IV · p. 6
  • Table II reports identity counts and mated-comparison counts for the S1 and S2 protocols, with 1,000,000 non-mated pairs sampled per group.Source: Table II · p. 7
  • In Table II, TR→EV counts comparisons between averaged forget-train enrolment and single forget-eval probes.Source: Table II · p. 7

A. Dataset and face recognition model

The evaluation draws forget, test, development, and distractor identities from WebFace4M identities not used to train the face recognition model.

A. Dataset and face recognition model

  • WebFace4M contains 205,990 identities and about 4.2 million images; 100,000 identities form the retain set, while the remaining 105,990 are reserved for evaluation partitions.The remaining identities supply the forget set, test set, development set, and identification-gallery distractors.Source: A. Dataset and face recognition model · p. 7
  • The face recognition model is an iResNet-34 with a CosFace head and 512-dimensional embeddings, trained for 40 epochs using stochastic gradient descent.The trained backbone is the starting model for every altered model.Source: A. Dataset and face recognition model · p. 7

B. Forgetting methods and training

Altered models are fine-tuned from the original model using the retain objective and identity-balanced forget batches, with method-specific training settings and a fixed budget.

B. Forgetting methods and training

  • Every altered model is fine-tuned from the original model using the composite objective, with the retain term covering all 100,000 retain identities and 64-image identity-balanced forget batches.Source: B. Forgetting methods and training · p. 7
  • Forget identities are deduplicated to one image per capture instance because within-instance pairs remain highly similar and can contribute persistent destabilising gradients.Images are treated as the same capture instance when their intensity-normalised pixel-space ℓ2 distance is below 30.Source: B. Forgetting methods and training · p. 7
  • All methods use a fixed training budget and 40-epoch fine-tuning, but dispersion and centroid push use one GPU while extended CosFace and the orthonormal frame use four.The tables abbreviate pairwise/hard dispersion as PD/HD, NegGrad+ as NG+, centroid push as CP, extended CosFace as EC, and orthonormal frame as OF.Source: B. Forgetting methods and training · p. 7

C. Partitions

The protocol separates forget identities into training and held-out evaluation images to test whether forgetting transfers within an identity, and evaluates two forget-set scales.

C. Partitions

  • Identities enter the retain control, test set, or development set only when they have at least four images.Source: C. Partitions · p. 7
  • Each forget identity’s deduplicated images are split into 80% forget-train and 20% held-out forget-eval images.The split tests whether forgetting on one subset generalizes to the identity; partitions contain distinct capture instances.Source: C. Partitions · p. 7
  • The two forget sets contain 1,000 identities (1% of training) and 5,000 identities (5%), with S1 ⊂ S2.Source: C. Partitions · p. 7

D. Protocols

The protocols compare verification and open-set identification across retain, test, and forget identities, while distinguishing comparisons involving images seen during forgetting from those involving held-out images. Metrics track preserved performance on retain and test identities, forgetting on targeted identities, and linkability between distinct forget identities.

D. Protocols

  • Verification compares each probe with one claimed identity’s enrolled template; retain and test controls each contain 1,000 identities enrolled and probed on separate image halves.Forget identities use per-image enrolments and an averaged forget-train template, with probes from either partition.Source: D. Protocols · p. 7
  • Open-set identification searches probes against a gallery containing retain, test, forget, and 50,000 additional untrained distractor identities.A probe counts as identified when its highest-scoring template is its own identity and exceeds the threshold.Source: D. Protocols · p. 7
  • Forget-train and forget-eval gallery templates represent databases assembled before forgetting and through reenrolment after forgetting, respectively.Source: D. Protocols · p. 8

E. Comparisons and metrics

  • Non-mated-test scores, from untrained and untargeted identities, are the reference distribution for strong forgetting.Source: E. Comparisons and metrics · p. 8
  • Forget comparisons are grouped as Ftr–Ftr, Fev–Fev, and Ftr–Fev, distinguishing whether enrolment and probe images were present before or acquired after forgetting.Forget-eval comparisons test generalization to images on which the losses did not operate.Source: E. Comparisons and metrics · p. 8
  • Verification reports TMR at target FMR, while identification reports TPIR at target FPIR; high rates are desired for retain and test, but lower rates for forget partitions.Cross-forget FMR measures whether comparisons between distinct forget identities are accepted more often than the calibrated rate.Source: E. Comparisons and metrics · p. 8

V. RESULTS AND DISCUSSION

The results distinguish strong, domain-specific forgetting from generic unlearning baselines that either leave forget identities recognizable or substantially damage retain performance. Across the reported findings, forgetting strength and its costs depend on method and evaluation conditions.

A. Findings

  • The paper classifies dispersion and centroid-push losses as weak-forgetting confusers, and extended CosFace and orthonormal-frame losses as strong-forgetting manifold hiders.No single method is best for every requirement: the orthonormal frame gives stronger forgetting, while hard dispersion has lower cost and footprint.Source: A. Findings · p. 8

B. Performance of Generic Unlearning Baselines

  • NegGrad+ leaves forget-train TMR at 0.998 against 0.912 under f∗, while CURE reduces retain TMR to 0.895 and retain TPIR to 0.137 at 10^-4.On S1, every domain-specific method has lower forget TPIR than CURE, and all except centroid push have lower forget TMR.Source: B. Performance of Generic Unlearning… · p. 9
  • On S1, CURE’s mated and non-mated retain deformations are 0.313 and 0.943, versus at most 0.101 for every other method.CURE consequently no longer identifies most retain identities at FPIR = 10^-4.Source: B. Performance of Generic Unlearning… · p. 9, Table III · p. 9
  • NegGrad+ places forget-train scores farther from non-mated-test scores than f∗ does: W1 is 0.968 against 0.480.Its mated-forget distributions do not move toward non-mated scores, so the comparisons become more distinctive rather than less.Source: B. Performance of Generic Unlearning… · p. 9
  • The authors focus on the other losses because the generic baselines provide no further insight into forgetting mechanisms, while retaining their rates for comparison.Source: B. Performance of Generic Unlearning… · p. 9

C. Confusion and Manifold Hiding

Dispersion and centroid-push losses produce diffuse forget-score distributions, whereas extended CosFace and the orthonormal frame concentrate scores near the non-mated distribution. The manifold hiders approach strong forgetting on seen images, but this effect weakens on held-out images.

C. Confusion and Manifold Hiding

  • Dispersion and centroid-push losses spread forget scores broadly, while extended CosFace and the orthonormal frame form narrow peaks near the non-mated distribution with little mass above τ.The paper calls the former pattern confusion and the latter manifold hiding.Source: C. Confusion and Manifold Hiding · p. 9
  • Manifold hiders bring mated-forget scores nearly onto the non-mated distribution, making those comparisons nearly indistinguishable from unrelated-identity comparisons.Source: C. Confusion and Manifold Hiding · p. 9
  • The orthonormal frame reaches W1 = 0.006 on forget-train comparisons, versus 0.435 for centroid push, separating the strongest manifold hiders from the confusers.Source: C. Confusion and Manifold Hiding · p. 9
  • On S1 forget-train images, confusers raise cross-forget FMR above the calibrated rate, reaching 0.3 for centroid push against a calibrated 0.01; manifold hiders stay at or below it.This means confusers can leave distinct forget identities linkable.Source: C. Confusion and Manifold Hiding · p. 9
  • The method distinctions hold across the remaining experiments, except hard dispersion approaches manifold hiding on transformer backbones; dispersion losses are the strongest confusers and the orthonormal frame the stronger manifold hider.Source: C. Confusion and Manifold Hiding · p. 9

D. Limits of Strong Forgetting in Manifold Hiders

  • On forget-train comparisons, the orthonormal frame yields W1 = 0.006 and TMR of zero at FMR = 10^-4 and 0.002 at 10^-2 on S1.It also extends strong forgetting to Ftr–Fev comparisons, with W1 = 0.02; extended CosFace falls short, with forget-train TMR of 0.185 at FMR = 10^-2.Source: D. Limits of Strong Forgetting in… · p. 10, Figure 5 · p. 10
  • Strong forgetting does not generalize to forget-eval images: orthonormal-frame W1 rises from 0.006 on forget-train to 0.11 on forget-eval, and forget-eval TMR is 0.106 at FMR = 10^-4.Extended CosFace also has higher forget-eval than forget-train W1, 0.155 versus 0.058, and TMR of 0.232 versus 0.001 at that operating point.Source: D. Limits of Strong Forgetting in… · p. 10
  • Dispersion losses show similar weak forgetting on seen and unseen images, with hard-dispersion W1 values of 0.100 and 0.103 and pairwise-dispersion values of 0.162 and 0.153.The manifold hiders trade this uniformity for near-perfect forgetting of seen images.Source: D. Limits of Strong Forgetting in… · p. 10

E. Generalisation Within an Identity and Re-linking

Forget identities are harder to unlink on unseen images, and linking their images through an external oracle can partly restore identity information. Retention costs vary by method and task, while a large footprint can reveal that the model has been altered.

E. Generalisation Within an Identity and Re-linking

  • On S1, every method makes forget identities nearly unidentifiable, but forget-eval TMR remains above forget-train TMR at every operating point.Below FMR 10^-3, the orthonormal frame has the lowest forget-eval TMR; above it, hard dispersion does.Source: E. Generalisation Within an Identity… · p. 10, Table IV · p. 11, Figure 6 · p. 12
  • An oracle-built averaged template restores some above-threshold mated scores for every method, most for extended CosFace (0.12 to 0.95) and least for the orthonormal frame (0.01 to 0.27).The authors conclude that linked legacy gallery templates must also be deleted to prevent re-linking.Source: E. Generalisation Within an Identity… · p. 11

F. The Footprint and the Cost to the Retained Identities

  • Verification costs are negligible, but identification costs arise from raised open-set thresholds or broadened lower tails of mated retain scores.Centroid push raises the threshold; the orthonormal frame leaves it unaffected but broadens mated retain scores toward lower similarities.Source: F. The Footprint and the Cost to the… · p. 11
  • The footprint is smallest for hard dispersion (0.015 on S1) and largest for the orthonormal frame (0.10 on S1; 0.24 on S2), and measures movement rather than its direction.The orthonormal frame also gives the closest match of mated-forget scores to non-mated scores when a forget-train image enters the comparison.Source: F. The Footprint and the Cost to the… · p. 12, Figure 7 · p. 12
  • A large footprint can reveal that the in-service model was trained to behave differently, even when its recognition performance is preserved.An adversary who knows the original comparison-score distributions can measure this discrepancy.Source: F. The Footprint and the Cost to the… · p. 12

G. Scale and Backbones

Increasing the forget set from S1 to S2 affects methods differently: some incur greater retention costs, while the orthonormal frame maintains low forget-train TMR. Backbone choice also changes the retention-cost ordering between method groups.

G. Scale and Backbones

  • At FPIR = 10^-4, increasing the forget set from S1 to S2 lowers retain TPIR from 0.946 to 0.185 for pairwise dispersion, but only from 0.933 to 0.912 for hard dispersion.At S2, centroid push reduces cross-forget FMR between two forget-train images to 0.000, versus 0.265 at S1.Source: G. Scale and Backbones · p. 12
  • As the forget set grows fivefold, extended CosFace forget-train TMR rises from 0.001 to 0.153 at FMR = 10^-4, while orthonormal-frame TMR stays at 0.009.The orthonormal frame's retain TMR falls from 0.985 to 0.912 and TPIR from 0.694 to 0.447, as its footprint grows from 0.10 to 0.24.Source: G. Scale and Backbones · p. 12
  • Orthonormal-frame forget-train TMR is 0.000 on all three backbones, while hard-dispersion forget-eval TMR falls from 0.128 to 0.055 as backbone size increases.The methods were tested on iResNet-34, ViT-S, and ViT-B.Source: G. Scale and Backbones · pp. 12–13, Table V · p. 13
  • On ViT-B, orthonormal-frame retain TPIR rises to 0.982 from 0.694 on iResNet-34, while hard-dispersion retain TPIR falls from 0.933 to 0.875, reversing their retention-cost ordering.For orthonormal-frame and extended CosFace, forget-train-to-forget-eval TMR increases from 0.005 to 0.022 and from 0.044 to 0.110, respectively.Source: G. Scale and Backbones · p. 13

H. Cost, Trade-offs, and Recommendations

No single forgetting method is Pareto-optimal across the reported costs and goals. The orthonormal frame is recommended when forgetting must extend to unseen images, while hard dispersion is favored when unlinkability at the operating point suffices; the reported evidence has specific scope limits.

H. Cost, Trade-offs, and Recommendations

  • Four of five methods lie on the S1 weak-forgetting Pareto front, with at most 0.033 loss in test TMR; at S2, orthonormal frame is dominated by hard dispersion (losses 0.027 versus 0.013).Pairwise dispersion is dominated at both scales.Source: H. Cost, Trade-offs, and Recommendations · p. 13
  • The orthonormal frame is the only method that brings mated forget-train scores onto the non-mated-test distribution, with W1 distance 0.006 versus 0.100 for hard dispersion on S1.It pays a footprint of 0.10 versus 0.015 for that distance; the same ordering holds at S2.Source: H. Cost, Trade-offs, and Recommendations · p. 13
  • Use the orthonormal frame when forgetting must extend to unseen images; use hard dispersion when unlinkability at the operating point is enough, at an S1 footprint of 0.015 versus 0.10.The orthonormal-frame retention-identification cost appears on iResNet-34 but not the transformers, and its footprint grows with forget scale.Source: H. Cost, Trade-offs, and Recommendations · p. 13, §VI · p. 14

VI. CONCLUSIONS AND FUTURE WORK

  • Confusers provide weak forgetting at a test-TMR cost of at most 0.033, whereas only the orthonormal frame provides strong forgetting; linked legacy templates can still restore part of identity information.The conclusion also reports that NegGrad+ leaves forget-train TMR at 0.998 and CURE produces models that no longer identify retain identities.Source: §VI · p. 14
  • The evidence uses one margin loss on 100,000 WebFace4M identities and forget sets of 1% and 5%; behavior with other losses, corpora, or sets approaching half the population remains open.Reported orthonormal-frame retention costs also vary by backbone, from 0.208 on iResNet-34 to 0.018 on ViT-B at FPIR = 10^-4.Source: §VI · p. 14

Related papers

Loading 2609.27115v1…