PaperlayerView exact revision on arXiv

Source-linked AI summary

Is it Possible to Generate Irreversible PolyProtected Templates from Face Embeddings using System-Specific Keys?

Vedrana Krivokuća Hahn, Jérémy Maceiras, Sébastien Marcel

arXiv:2610.01385v1cs.CRcs.CV

TL;DR

Face embeddings can expose private face information, and subject-specific PolyProtect keys conflict with de-duplication because unlinkability permits unlinked templates for the same identity. This paper tests three ways to select shared system-specific keys and finds that they can produce irreversible templates, supporting the possibility of de-duplication in the protected domain.

  • Problem

    The paper asks whether PolyProtect can use one shared key to produce irreversible templates for all subjects, since subject-specific keys conflict with protected-domain de-duplication under unlinkability.

    Source: §I · p. 2, B. Key selection algorithm · p. 4

  • Method

    The experiments test system-specific key selection from previously selected subject-specific keys, from random vectors, and from a distribution of C/E pairs.

    Source: §I · pp. 2–3

  • Results

    System-specific keys selected from subject-specific keys or random vectors produce inversion scores approximately as low as their comparison settings, and random-vector selection does not depend on face-embedding structure.

    Source: C. System-specific key selection #1:… · p. 7, D. System-specific key selection #2:… · p. 9

  • Takeaways & Limitations

    The findings support using PolyProtect with system-specific keys, making protected-domain de-duplication of enrolled face identities possible while keeping underlying face data protected.

    Source: D. System-specific key selection #2:… · p. 9

Abstract

from arXiv · show

This work aims to answer the question of whether it is possible to generate irreversible protected templates when the PolyProtect biometric template protection method is applied to face embeddings using system-specific keys (i.e., the same C and E parameters, which define the transform, are applied to all subjects' face embeddings), instead of the traditional subject-specific keys (i.e., each subject has their own C and E parameters). This is important for determining whether we can perform de-duplication of face identities in the PolyProtected domain, which is not possible in the subject-specific key scenario due to the clash with PolyProtect's unlinkability property (i.e., one could generate multiple protected templates belonging to the same identity, using different C and E parameters, such that those templates cannot be linked to each other). We present experiments (reproducible using our open-source code) to prove that there exist at least three ways of systematically selecting system-specific keys that produce irreversible PolyProtected templates: (i) from pre-selected subject-specific keys, (ii) by applying a previously proposed key selection algorithm to random vectors, and (iii) by approximating a "good" C/E pair distribution from which system-specific keys can be constructed. Our findings thus point to the conclusion that it is, indeed, possible to safely operate PolyProtect in the system-specific key scenario without degrading the template protection potential. This opens up the possibility for identity de-duplication in the PolyProtected domain.

I. INTRODUCTION

Face embeddings can expose face information, so biometric template protection is needed to preserve privacy. This paper asks whether PolyProtect keys can be selected once for all subjects while keeping templates irreversible, enabling protected-domain de-duplication, and investigates three key-selection approaches.

I. INTRODUCTION

  • PolyProtect protects face embeddings with multivariate polynomials whose coefficients C and exponents E are external parameters.The paper focuses on this handcrafted method because it is lightweight, modular, and has explicit BTP properties.Source: §I · p. 1
  • Subject-specific keys conflict with protected-domain de-duplication because unlinkability lets one identity produce unlinked templates using different keys.The paper therefore investigates using the same C and E parameters for every subject.Source: §I · p. 2
  • The study tests whether PolyProtect’s key-selection algorithm generalizes from subject-specific to system-specific keys while preserving irreversibility for all enrolled subjects.The motivating prior work found that randomly chosen keys may produce reversible templates, while its selection algorithm was studied only with subject-specific keys.Source: §I · p. 2
  • The paper examines three approaches: reusing keys selected for specific subjects, selecting keys using random vectors, and constructing keys from a distribution of C/E pairs.The introduction describes each approach as a way to select system-specific keys that produce irreversible templates.Source: §I · pp. 2–3

II. BACKGROUND

This section introduces PolyProtect and the key-selection algorithm from prior work that the paper evaluates with system-specific keys. The evaluation shifts that algorithm from its earlier subject-specific setting toward the goal of protected-domain identity de-duplication.

II. BACKGROUND

  • The paper evaluates the key-selection algorithm from [24] in a system-specific setting, unlike its subject-specific use in that prior work.The algorithm selects C and E parameters intended to make protected templates irreversible under a cosine-distance numerical solver.Source: §II · p. 3
  • The background covers PolyProtect [10] and the key-selection algorithm proposed to address worst-case inversion.The algorithm is assessed as a step toward identity de-duplication in the protected domain.Source: §II · p. 3
  • The section frames the evaluation as a move from subject-specific keys toward system-specific keys for protected-domain identity de-duplication.This is the new context in which the paper tests the algorithm’s efficacy.Source: §II · p. 3

A. PolyProtect

PolyProtect maps consecutive groups of embedding elements to a shorter protected template using multivariate polynomials. The number of elements in each group and the overlap between groups determine the mapping and the size of the output.

A. PolyProtect

  • PolyProtect maps sets of m consecutive elements from an n-dimensional embedding V to elements of a shorter protected template P using coefficients C and exponents E.The number of output elements depends on the chosen group overlap, and an incomplete final group is zero-padded.Source: A. PolyProtect · p. 3
  • The first m embedding elements are transformed into p1 by the polynomial defined by the coefficients and exponents.The subsequent elements of P are generated in the same manner using the selected overlap between groups.Source: A. PolyProtect · p. 3
  • For 512-dimensional embeddings, greater overlap produces a larger P, while smaller overlaps have been associated with more irreversible templates.The prior key-selection algorithm [24] was reported to mitigate much of the irreversibility difference across overlaps.Source: A. PolyProtect · p. 3, Figure 2 · p. 3
  • With m = 5, the evaluations use five-element groups, unique exponents from 1 to 5, and five unique non-zero coefficients from -50 to 50.The paper follows the m = 5 setting of and does not use larger m because larger exponents may obliterate small embedding elements.Source: A. PolyProtect · pp. 3–4

B. Key selection algorithm

The key-selection algorithm searches for C and E parameters that resist a cosine-distance inversion attack, but was initially evaluated with subject-specific keys. The paper motivates testing one shared key across subjects as a way to support de-duplication without abandoning irreversibility.

B. Key selection algorithm

  • The algorithm repeatedly samples C and E, transforms a reference template, and tests whether a cosine-distance solver can invert it; successful inversions trigger another key attempt.It uses a deliberately loose inversion-success threshold, such as 20% FMR, so failure there is expected to imply failure at stricter practical thresholds.Source: B. Key selection algorithm · p. 4
  • The algorithm was first proposed for subject-specific keys, with a separate C and E selection for each subject’s reference embedding.That setup followed PolyProtect’s original design.Source: B. Key selection algorithm · p. 4
  • Unlinkability allows multiple protected templates from one identity, made with different keys, to remain unlinked and evade a duplication check.The paper therefore explores system-specific keys instead of subject-specific keys.Source: B. Key selection algorithm · p. 4
  • System-specific keys apply the same C and E to every subject, making protected-domain duplication checks feasible, but the key must preserve irreversibility for all subjects.The paper tests whether the algorithm from [24] can select such a shared key.Source: B. Key selection algorithm · p. 4

III. GENERATING IRREVERSIBLE PROTECTED TEMPLATES USING SYSTEM-SPECIFIC KEYS

The experiments test whether the PolyProtect key-selection algorithm can produce irreversible templates with system-specific keys. They examine keys transferred from subjects, keys selected using random vectors, and keys drawn from an approximated good-key distribution.

III. Generating irreversible protected templates using system-specific keys

  • Three experiments test system-specific key selection: transferring subject-selected keys, selecting keys from random vectors, and constructing keys from a good C/E-pair distribution.The section also covers experimental setup, the limits of subject-specific keys for de-duplication, and the effect of selected keys on recognition accuracy.Source: §III · p. 5

III-C. System-specific key selection #1: From subject-specific keys

  • The first experiment tests whether keys selected for particular subjects can generate irreversible templates for other subjects.It assesses whether the key-selection algorithm generalizes from subject-specific to system-specific use.Source: §III · p. 5

III-D–III-F. Random-vector selection, key distributions, and recognition accuracy

  • The second and third experiments test selecting system-specific keys from random vectors and from a good C/E-pair distribution derived from those keys.The final experiment examines how selected keys affect recognition accuracy.Source: §III · p. 5

A. Set-up: Face recognition models and datasets

The study evaluates five face-recognition models on three datasets, then uses the two highest-accuracy models for its PolyProtect experiments. Those experiments use normalized embeddings and focus on overlap = 3, with similar observations reported across overlap settings.

Models and datasets

  • The study extracts 512-dimensional embeddings with five models and evaluates them on Multi-PIE, SOTERIA, and iCarB-Face.The datasets represent controlled multi-camera capture, mobile-phone video under varied lighting, and in-car NIR video, respectively.Source: A. Set-up: Face recognition models and… · p. 5

Dataset sampling

  • The datasets contribute 3,370 Multi-PIE images, 700 SOTERIA frames, and 788 iCarB-Face frames.The study randomly selects 10 images per Multi-PIE and SOTERIA subject and four frames per iCarB-Face subject.Source: A. Set-up: Face recognition models and… · p. 5

Model selection

PolyProtect configuration

  • Results focus on overlap = 3 and normalized embeddings; the authors report similar observations and global conclusions across all overlap settings.Overlap = 3 was recommended for the best irreversibility/accuracy trade-off in [24].Source: A. Set-up: Face recognition models and… · p. 5

B. Why use system-specific keys?

Using different keys for different samples can make same-identity protected templates difficult to match, undermining de-duplication. With system-specific keys, the Non-Match Rate is much lower and about as low as for unprotected templates.

Motivation

  • Different subject-specific keys can yield unlinkable templates for repeated enrollments, preventing reliable de-duplication in the protected domain.System-specific keys are investigated as an alternative for protected-domain de-duplication.Source: B. Why use system-specific keys? · pp. 5–6

Experimental comparison

Observed matching accuracy

  • Around 90% of same-identity templates fail to match with sample-specific keys at FMRs of 0.01%, 0.1%, and 1%, while system-specific-key performance is approximately the unprotected baseline.This comparison is shown for EdgeFace and iResNet100 embeddings; the figure contrasts both key scenarios with unprotected embeddings.Source: Figure 4 · p. 6, B. Why use system-specific keys? · p. 6

C. System-specific key selection #1: From subject-specific keys

Keys selected for individual subjects using the algorithm in [24] generalize to system-specific use: they produce irreversible templates at rates broadly comparable to subject-specific keys. Randomly generated system-specific keys are more likely to produce invertible templates.

Experimental method

  • The experiment applies 10 randomly chosen subject-selected keys across all subjects, then tests the resulting templates with the cosine-solver inversion attack from [24].For each template, the attack runs 10 times from different initial guesses; ISR is the proportion of templates whose inversion score falls below a threshold.Source: C. System-specific key selection #1:… · pp. 6–7

Results

  • Algorithm-selected system-specific keys have significantly lower ISR than purely random system-specific keys across both models and all three datasets.The table reports ISR at 0.1% and 0.01% FMR thresholds; the authors advise against purely random C and E selection in favor of the algorithm from [24].Source: Table I · p. 7, C. System-specific key selection #1:… · p. 7
  • System-specific keys sampled from algorithm-selected subject-specific keys are approximately as effective as subject-specific keys at producing irreversible templates.At 0.1% FMR, Sy. ISR is slightly higher in some cases, but the authors report that all Sb. and Sy. ISR values are very low, especially at 0.01% FMR.Source: C. System-specific key selection #1:… · p. 7, Table I · p. 7

Scope of generalization

  • The authors attribute occasional higher Sy. ISR to keys selected for particular subjects not working equally well for every subject in a system-specific setting.They describe differences between Sb. and Sy. as fairly insignificant relative to the difference between either algorithm-selected scenario and R-Sy.Source: C. System-specific key selection #1:… · p. 7

D. System-specific key selection #2: From random vectors

The key-selection algorithm from [24] can select system-specific keys from random vectors, producing irreversible PolyProtected templates without relying on the structure of the target face embeddings. Their irreversibility is approximately the same as for system-specific keys drawn from subject-specific keys.

D. System-specific key selection #2: From random vectors

  • The key-selection algorithm from [24] was run on random vectors for 48 hours, and ten keys were randomly selected from those judged irreversible by an inversion attack.The vectors had the same value range as normalized EdgeFace and iResNet100 embeddings; separate key sets were selected for each model and dataset.Source: D. System-specific key selection #2:… · pp. 7–8
  • The experiment tested whether keys selected independently of face embeddings generalize across subjects, feature extractors, and datasets.The comparison was between system-specific keys selected from random vectors and keys selected from subject-specific keys.Source: D. System-specific key selection #2:… · pp. 7–8, Figure 6 · p. 9
  • The random-vector and subject-key approaches produce nearly overlapping inversion-score histograms, with similar ISR especially at the stricter 0.01% FMR threshold.At 0.1% FMR, the random-vector approach has consistently lower ISR; both approaches have low ISR.Source: Table II · p. 8, Figure 6 · p. 9, D. System-specific key selection #2:… · p. 9
  • The findings support using system-specific PolyProtect keys selected from random vectors and suggest the possibility of de-duplicating enrolled identities while face data remains protected.The authors describe random-vector key generation as the more practical of the two approaches compared.Source: D. System-specific key selection #2:… · p. 9

E. System-specific key selection #3: From a C/E distribution

Sampling individual pairs from a “good” C/E distribution produces system-specific keys that are almost as effective as pre-generated sequences at generating irreversible PolyProtected templates.

E. System-specific key selection #3: From a C/E distribution

F. How do system-specific keys affect recognition accuracy?

Recognition accuracy was approximately consistent across the three system-specific key-selection methods, but selected keys performed worse than randomly generated keys; the authors describe this as a trade-off against improved irreversibility.

F. How do system-specific keys affect recognition accuracy?

  • System-specific key selection produced approximately the same protected-domain recognition accuracy across all three methods.Fig. 9 compares the methods alongside randomly generated keys and an unprotected-template baseline.Source: Figure 9 · p. 12, F. How do system-specific keys affect… · p. 12
  • Selected system-specific keys had slightly lower accuracy than selected subject-specific keys, while the drop was described as not large.The authors attribute the difference to subject-specific parameters acting as an extra identity-separation factor.Source: F. How do system-specific keys affect… · p. 12
  • Key selection reduced protected-domain accuracy relative to random key generation for both system-specific and subject-specific keys.The authors frame this compromise against the improvement in irreversibility and identify accuracy boosting as a next step for de-duplication.Source: F. How do system-specific keys affect… · p. 12

IV. CONCLUSIONS AND FUTURE WORK

The paper concludes that at least three key-selection strategies can produce irreversible PolyProtected face templates with system-specific keys, supporting protected-domain identity de-duplication. It identifies the accuracy–irreversibility balance as a focus for future work.

IV. CONCLUSIONS AND FUTURE WORK

  • Three experiments established system-specific key selection from subject-specific keys, random vectors, or a “good” C/E pair distribution as routes to irreversible templates.The conclusion says this makes protected-domain identity de-duplication a legitimate avenue.Source: §IV · p. 12
  • Recognition accuracy was lower than with randomly generated keys, but the authors judged the improvement in irreversibility more significant and the trade-off acceptable.They identify sufficient protected-template recognition accuracy as necessary for effective duplicate detection.Source: §IV · p. 12
  • Future work will tune the accuracy–irreversibility balance, add multimodal information, or combine PolyProtect with another BTP method.The proposed options aim to improve protected-identity separation or alleviate the trade-off.Source: §IV · p. 13

Related papers

Loading 2610.01385v1…