PaperlayerView exact revision on arXiv

Source-linked AI summary

Walking the Embedding Space: Datastore Extraction from Multimodal RAG

Maria Carmen Jica, Ali Satvaty, Suzan Verberne, Fatih Turkmen

arXiv:2610.01871v1cs.CRcs.AI

TL;DR

Multimodal RAG brings new attack surfaces, while the scope of risks arising from its multimodal nature remains underexplored. imMRAG adaptively extracts datastore items by embedding instructions in input images and combining shadow images with previously recovered items. Across three application domains, it retrieves 1.8 to 5.6 times as many distinct datastore items as a non-adaptive baseline under the same budget.

  • Problem

    The attack surfaces and privacy risks arising from MRAG's multimodal nature remain underexplored.

    Source: §1 · p. 1

  • Method

    imMRAG embeds malicious instructions in a user-provided image and adaptively blends shadow images with images already recovered from the system.

    Source: §1 · p. 2

  • Results

    1.8 to 5.6 times as many distinct datastore items as a non-adaptive baseline under an identical budget across three application domains.

    Source: §11 · pp. 12–13

  • Takeaways & Limitations

    Several hundred verbatim radiology images or document scans can constitute substantial disclosure even without exhaustive datastore coverage.

    Source: §6.1.1 · p. 8

    The experiments attack systems constructed by the authors without production guardrails or output filters, and do not test whether image-channel instructions evade detectors.

    Source: §9 · p. 12

Abstract

from arXiv · show

Multimodal Retrieval-Augmented Generation (MRAG) has emerged as a reliable and cost-effective technique of grounding the generative capabilities of Multimodal Large Language Models (MLLMs) into relevant, up-to-date, external knowledge. Despite presenting several benefits, such as reducing hallucinatory behavior, they also introduce new attack surfaces, including leakage of private information and vulnerabilities against data extraction attacks. In this paper, we introduce $\immrag$, an adaptive and automatic data extraction attack procedure operating in a black box setting against \emph{image-returning} MRAG, a configuration in which the retrieved visual artifact is itself the response. Each query blends an attacker-held shadow image with an image already recovered from the system, and relevance-weighted resampling steers subsequent queries towards regions of the embedding space that still yield novel retrievals. Unlike current extraction attacks that aim to persuade the model towards data leakage by placing a malicious query as a textual prompt, $\immrag$ embeds the malicious instructions inside a user-given input image. We evaluate $\immrag$ on three plausible and distinct real-world scenarios: medical assistant, document-focused helper and general purpose tool. The experiments involve the study of the effectiveness of the attack on multiple CLIP-family retrievers, as well as the impact of various generators. A single 2500-query run reconstructs up to 611 distinct radiology images, 566 document scans and 416 general-purpose images under local-feature correspondence, and reaches up to $5.6\times$ as many distinct datastore items as a non-adaptive baseline. Our results show the urgent need for safeguards specifically designed for multimodal data.

1 Introduction

RAG grounds outputs in external evidence, but MRAG expands the attack surface and multimodal security risks remain underexplored. This paper introduces imMRAG, an adaptive extraction attack for image-returning MRAG that embeds instructions in the submitted image and blends shadow and recovered images.

1 Introduction

  • imMRAG introduces an image-returning MRAG threat model and an adaptive attack that embeds instructions in the input image and blends shadow with recovered images.It reaches up to 5.6× as many distinct items as a non-adaptive baseline.Source: §1 · p. 2

2.1 Retrieval-Augmented Generation and Privacy Attacks

  • Prior RAG extraction work included fixed-query attacks that could not adaptively explore hidden content and later methods that built follow-up queries from retrieved outputs.Other work targeted personally identifiable information or used relevance-based sampling of extracted topics [33].Source: §2.1 · p. 2

2.2 Privacy Attacks on MRAG Systems

  • MRAG attack studies had demonstrated multimodal data extraction and membership inference, including leakage of verbatim text, speech, image copies, or metadata.Source: §2.2 · p. 2

2.3 Instruction Injection through Visual Channels

  • Visual-injection research demonstrated ways to steer multimodal models, but its consequence for retrieval-corpus confidentiality remained unexamined.Unlike extraction attacks that assume arbitrary prompt instructions, imMRAG studies extraction under that more constrained channel.Source: §1 · p. 2, §2.3 · p. 3

3 Threat Model

The paper models image-returning MRAG as a black-box extraction target and presents an adaptive attack that uses image-carried instructions and blended queries to explore its datastore.

3.1 Multimodal Retrieval-Augmented Generation

  • Image-returning MRAG returns a retrieved visual artifact as the response, and imMRAG targets this configuration as an emerging deployment pattern with distinct privacy risks.The paper contrasts it with text-generating systems that retrieve visuals for description, question answering, or reasoning.Source: §3.1 · p. 3

3.2 Adversary Model

  • The adversary knows only the service domain, builds a disjoint domain-relevant shadow dataset, submits image–text pairs, and observes returned images without seeing internal retrievals.The textual instruction channel is assumed filtered, while the image channel is not equivalently inspected.Source: §3.2 · p. 3

4 Overall Attack Framework

  • The attack initializes a pool of recovered images, then repeatedly blends shadow and recovered images, embeds an instruction, removes duplicates, and updates candidate relevance scores until its budget or scores run out.The loop is driven by observed outputs and relevance scores.Source: §4 · p. 4

4.1 Adversarial Objective

  • Coverage and reconstruction fidelity are in tension: pushing into unexplored embedding regions can reduce faithful copying, so imMRAG uses duplicate outcomes to shift sampling toward productive candidates.The adversary cannot directly measure coverage or fidelity at query time; duplicate status is its observable adaptation signal.Source: §4.1 · p. 5

4.2 Initialization

  • Before the main loop, the attacker samples shadow images and collects a preset number of non-duplicate outputs to seed the candidate pool.The seed count should prevent unlucky early sampling or premature termination.Source: §4.2 · p. 5

4.3 Query Construction

  • Each query pixel-blends a domain-relevant shadow image with a relevance-weighted recovered image, then embeds a faint attack instruction before sending an innocuous text query.Opacity blending achieved the highest unique retrieval coverage on all three corpora among six alternatives in an idealized-generator comparison.Source: §4.3 · pp. 5–6

4.4 Deduplication

  • Outputs are compared with previously collected images using cosine similarity and a deduplication threshold; outputs below the threshold are added to the pool.This filters near-identical outputs before they expand the recovered set.Source: §4.4 · p. 6

4.5 Relevance Scoring

  • Each recovered-image candidate receives a relevance score that increases for novel retrievals and decreases for duplicates, steering later sampling toward candidates that continue to yield new items.Scores start at a common positive value and are clipped at a ceiling.Source: §4.5 · p. 6

5 Experimental Setup

The experiments use three public image corpora as structural surrogates for medical, document, and general-purpose assistants, and evaluate multiple retrievers and generators with retrieval and reconstruction metrics.

5.1 Datasets

  • The public structural-surrogate corpora model radiology (ROCOv2, 79,793 image-caption pairs), documents (DocVQA, 10,537 entries), and general images (CC, 14,154 entries).The radiology corpus comes from open-access literature, not patient records; evaluating on genuinely confidential corpora was not ethically available.Source: §5.1 · p. 7

5.2 MRAG Settings

  • The experiments use CLIP ViT-B/16, OpenCLIP ViT-L/14, and SigLIP retrievers, pair them with Lumina-MultiImage [25] or Gemini 2.5 Flash Image Preview [43], and retrieve k=1 image per query.The retrievers represent structurally different embedding models, while the generators differ in implementation characteristics and access levels.Source: §5.2 · p. 7

5.3 Evaluation

  • Evaluation reports URC, SIFT > 0.1, pHash ≤10, and PMR > 0.8; Zhang et al. is adapted as a single-shadow-image baseline because no directly comparable attack exists.URC measures distinct datastore items retrieved; the other three metrics assess similarity between retrieved and generated image pairs.Source: §5.3 · p. 7

6 Results

Across 2,500-query runs, reported URC differs across three corpora; normalized results distinguish datastore reach from reconstruction among reached items, and targeted reconstruction sometimes selects the wrong image.

6.1 Main Results

  • Across 2,500 queries, URC was 39.96% and 36.36% on ROCOv2, 36.92% and 41.72% on DocVQA, and 29.92% and 25.24% on CC.These exploration values are reported for the two generator models; the supplied passages do not specify which value belongs to which model for every corpus.Source: §6.1 · pp. 7–8, Table 2 · p. 8
  • The non-adaptive baseline's reconstruction runs were unfinished at submission, so its Table 2 entries are blank rather than estimated.The baseline adapts Zhang et al. [57] as independent, single-image shadow queries without blending or feedback from previous outputs.Source: §6.1 · p. 7, Table 2 · p. 8

6.1.1 Normalized extraction.

  • After 2,500 queries, the adversary reached 8.76%–9.90% of DocVQA and 4.46%–5.28% of CC, compared with 1.14%–1.25% of ROCOv2.URC/|D| measures the fraction of the private datastore reached.Source: Table 3 · p. 8, §6.1.1 · p. 8
  • Conditional reconstruction reached 65.9% under SIFT on CC and 65.2% under SIFT on ROCOv2, but SIFT-based rates are upper bounds because it flags some non-matching pairs.The other two leakage criteria are described as close to face value; Gemini results rest on firmer ground than Lumina results across applicable checks.Source: §6.1.1 · p. 8
  • Several hundred verbatim radiology images or document scans constitute substantial disclosure even without exhaustive datastore coverage.The passage frames this as a concern even when an adversary has no credentials or prior access to the data.Source: §6.1.1 · p. 8
  • By SIFT, Gemini outperformed Lumina in two of three scenarios, while Lumina led on radiology; pHash favored Gemini on ROCOv2 and CC.The reported comparisons indicate that the generators differ across reconstruction measures and datasets.Source: §6.1.1 · p. 9
  • Lumina's 1,421 pHash flags on DocVQA are treated as uninformative because page-like layouts can match without reproducing document content.The passage reports illegible text in Lumina's document outputs and recommends relying on SIFT and PMR for DocVQA.Source: §6.1.2 · p. 9

6.2 Analysis of Targeted Image Reconstruction

  • The attack can reproduce the wrong target, especially on DocVQA; Lumina favored the retrieved image in seven of eight admissible metric-dataset cells.For Gemini, several cases approach parity, and user-image copies exceed retrieved-image copies in DocVQA/PMR.Source: §6.2 · p. 9

7 Ablation Study

The ablations test retrieval across encoders, the effect of shadow-set size, and in-image versus in-prompt instruction placement. In-image placement retains near-parity extraction, while retrieval coverage varies with both retriever and shadow-set configuration.

7.1 Impact of Retriever

  • More than 200 unique documents were retrieved in 500 iterations under every tested retriever, with ROCOv2 coverage falling from 346 to 223 and 218 on larger encoders.Coverage varied by at most 13% across encoders on DocVQA and CC; the authors note that each configuration had a single run.Source: §7.1 · p. 9, Table 5 · p. 10

7.2 Impact of Shadow Dataset Size

  • Shadow sets produced incremental coverage gains, with the largest jump from 0 to 50 items (78.64%–200.37% improvement) and plateauing around 200 or 500 items.Beyond 500 shadow images, additional gains were marginal; small, diverse collections were generally sufficient.Source: §7.2 · pp. 9–10, Table 6 · p. 10, Figure 3 · p. 10

7.3 Impact of Attack Query Placement

  • 585 unique reconstructed images were recovered by in-image placement versus 607 by in-prompt placement, retaining 96.4% of extraction.In-image placement exceeded in-prompt placement on CC; the authors interpret the overall finding as parity, not a meaningful direction of small differences from one run.Source: §7.3 · p. 10

8 Discussion

The discussion finds substantial exploration of the hidden embedding space, but stresses that coverage depends on corpus and query budget. It also highlights metric disagreement, different generator leakage patterns, and the limits of what placement parity establishes.

Discussion

  • No single metric suffices to identify leakage: PMR misses cases, while distinctive image features can produce high SIFT signals not captured by other criteria.The discussion therefore calls for several varied metrics that target different aspects of exposure.Source: §8 · pp. 10–11
  • Transfer is reported across generators and knowledge databases, and retrieval reach across retriever architectures, but document reconstruction requires pixel-level precision that generators optimized for perceptual realism may not provide.The strict legibility requirement for document text is identified as the source of this challenge.Source: §8 · p. 11
  • Gemini excels at document pixel-level reconstruction (2× PMR), while Lumina’s 3× pHash advantage on that corpus is described as a metric artifact.The authors conclude that neither model is strictly better: Gemini has higher absolute leakage, while Lumina poses a distinct privacy challenge through structural preservation.Source: §8 · p. 11
  • In-image and in-prompt placement are comparable, but the evaluation establishes the image channel’s effectiveness, not its invisibility.A deployment that filters text but forwards images unexamined changes where an adversary places the instruction; whether images are unmonitored remains an assumption.Source: §8 · p. 11
  • Absolute datastore coverage after 2,500 queries ranges from roughly 1% of ROCOv2 to nearly 10% of DocVQA, while conditional reconstruction is high across the board.Coverage decelerates with longer runs, and corpus diversity affects exploration; small but varied shadow collections can be sufficient.Source: §8 · p. 11

9 Limitations

The authors qualify their leakage measurements, experimental scope, and realism of the tested setting. These constraints limit how broadly the reported results can be interpreted.

9 Limitations

  • SIFT leakage counts remain upper bounds because heuristic thresholds were calibrated against shadow-corpus rather than private-datastore nulls, leaving 5.2%–12.7% false positives.The calibration leaves pHash and PMR counts essentially undiscounted.Source: §9 · p. 11
  • Each configuration ran once at k=1; image-only scope, fixed jointly unswept parameters, and a single prior-attack comparison with differing assumptions limit broader conclusions.The comparison candidate also differs in threat model, modalities, and metrics.Source: §9 · p. 12
  • Experiments use author-built, undefended systems; instruction concealment and detection remain untested, and unverifiable shadow/private overlap could inflate coverage.The adversary is also assumed to know the deployment domain, and the effect of a misjudged domain is untested.Source: §9 · p. 12

10 Mitigations

The section proposes several defenses but evaluates none. It recommends combining output-side gating with query-stream monitoring, treating image-channel screening as an additional layer.

10 Mitigations

  • OCR screening can expose the attack’s plain-English image instructions, but document-assistant workloads may be entirely flagged and pixel-optimized instructions evade OCR.The latter evasion requires gradient access and falls outside the paper’s black-box model.Source: §10 · p. 12
  • Output gating compares generated images with retrieved items and suppresses high-similarity outputs, but pixel-level calibration can miss human-indistinguishable reconstructions.The gate should use complementary metrics; legitimate requests for comparable prior medical cases may also be suppressed.Source: §10 · p. 12
  • Query-stream monitoring can flag visible ghosting and embedding drift, while query caps exploit declining marginal yield but may be bypassed through third-party delivery.The ghosting and drift are detectable without reference to the embedded instruction.Source: §10 · p. 12
  • Training multimodal generators to separate instruction and data channels would undercut imMRAG and the broader class of visual injection attacks.The attack succeeds because the generator treats text inside an image as an instruction outranking its actual task.Source: §10 · p. 12
  • No single mechanism is both robust and cheap: image screening is inexpensive but domain-limited and evadable, while output gating taxes legitimate similarity-seeking queries.The proposed deployment for a sensitive corpus combines output-side gating built on complementary metrics with query-stream monitoring, using screening as an additional layer.Source: §10 · p. 12

11 Conclusion

The conclusion reports that imMRAG explores and reconstructs private datastores across varied settings, outperforming a non-adaptive baseline. The accompanying sections describe the study’s ethical scope, released materials, and AI-tool use.

11 Conclusion

  • 1.8–5.6 times as many distinct datastore items as an equal-budget non-adaptive baseline were reached by imMRAG’s adaptive query loop.Each query blends a shadow image with an image already recovered, and relevance-weighted resampling directs later queries toward regions yielding novel retrievals.Source: §11 · p. 12
  • The threat model studies image-returning MRAG and denies the adversary a textual input channel, requiring instructions inside the submitted image.The authors say this restriction is close to free for coverage of current defenses, not evidence of evasion.Source: §11 · pp. 12–13
  • Exploration and reconstruction held across three disjoint application domains, two generators, and three retriever architectures, but coverage decelerated and never exhausted the datastore.The authors report that conditional reconstruction remains high throughout a run.Source: §11 · p. 13

Ethical Considerations

  • Experiments used author-built systems and public datasets, involved no human subjects, and findings were shared with the commercial generator provider before publication.No third-party MRAG system or corpus was targeted.Source: Ethical Considerations · p. 13

Open Science

  • The authors released source code, experimental configurations, and reproduction instructions in an anonymous repository.The repository is identified in the paper as https://anonymous.4open.science/r/MRAG_privacy-8116/.Source: Open Science · p. 13

AI Use

  • AI tools supported pre-submission review, codebase verification, and code-structure improvements; the authors say they manually verified and take responsibility for the results.Source: AI Use · p. 13

A Evaluation Details

The appendix defines the evaluation metrics and describes spatial alignment applied to image pairs before metric computation. The metrics capture retrieval exploration and different forms of image correspondence or similarity.

A Evaluation Details

  • The appendix specifies evaluation metrics and applies spatial alignment to each image pair before computing them.Source: A Evaluation Details · p. 15

A.1 Unique Retrieval Coverage (URC)

  • URC(T) counts unique datastore items retrieved across T steps and quantifies the attack procedure’s exploratory potential.It is defined as the size of U_T.Source: §A.1 · p. 15

A.2 Scale-Invariant Feature Transform (SIFT)

  • SIFT compares image descriptors using Lowe’s ratio test; a higher match ratio indicates greater local structural correspondence.The paper uses a ratio threshold of ρ=0.75.Source: §A.2 · p. 15

A.3 Pixel-Match Rate (PMR)

  • PMR is the fraction of pixels whose RGB values fall within a tolerance across channels; higher scores indicate near pixel-identical images.Source: §A.3 · p. 15

A.4 Perceptual Hash Distance (pHash)

  • pHash compares image fingerprints based on low-frequency DCT content; lower Hamming distance indicates perceptual similarity and tolerates minor transformations and generation noise.The images are converted to grayscale and resized before the DCT and binary hash are computed.Source: §A.4 · pp. 15–16

A.5 Spatial Alignment

Spatial alignment compensates for generator size and placement differences before evaluation, using feature-based homography with template matching as a fallback. The appendices document the run configuration, generation failures, and the scope of the extended analyses.

A.5 Spatial Alignment

  • Feature-based homography aligns image pairs using SIFT correspondences and RANSAC; when reliable matches are unavailable, template matching provides a fallback.Template matching searches for the best normalized cross-correlation location and extracts a same-sized crop; it assumes primarily translation and minor color variation, not rotation or perspective change.Source: §A.5 · p. 16

B Experimental Configuration

B.1 Generation Failures and Effective Query Budget

  • Failed image generations consume queries but are excluded from reported counts, leaving runs with unequal effective budgets.Gemini fails on 13.6% of CC queries and 6.1% of DocVQA queries; its CC coverage of 631 items came from 2159 usable queries rather than 2500.Source: §B.1 · p. 16, Table 9 · p. 17

C Extended Analysis of the Main Runs

  • The appendix’s three analyses use per-iteration records from the 2,500-query runs in Section 6; they perform no additional MRAG querying and exclude iterations with failed image generation.Source: C Extended Analysis of the Main Runs · p. 16

C.1 Growth of Retrieval Coverage

The extended analyses show that retrieval coverage grows sublinearly, while reconstruction counts mostly survive target correction. They also find that leakage criteria differ in false-positive behavior and threshold sensitivity, with Gemini counts generally on firmer footing than Lumina counts.

C.1 Growth of Retrieval Coverage

  • Every run adds 273–356 distinct items in its first 500 queries and 50–131 in its last, showing sublinear coverage growth.CC under Gemini falls from 278 items in the first block to 50 in the last; none of the runs exhausts its datastore, so longer-run extrapolations should be sublinear.Source: §C.1 · p. 17, Figure 4 · p. 17, Table 10 · p. 18

C.2 Target-Corrected Reconstruction Counts

  • Between 85% and 100% of flagged reconstructions survive target correction; PMR removes at most one item per configuration, while SIFT removes 3%–15%.The largest SIFT reduction is on DocVQA under Lumina, already identified as the configuration where user-image copies outnumber retrieved-image copies; corrected counts leave the conclusions unchanged.Source: §C.2 · pp. 17–18, Table 11 · p. 18

C.3 Threshold Calibration

  • Across 6,000 non-matching pairs, pHash has one threshold-level false positive; PMR false-positive rates are 0.0% on CC, 0.1% on ROCOv2, and 1.7%–2.9% on DocVQA, while SIFT reaches 5.2%–12.7%.DocVQA under Lumina has a notable SIFT noise share; calibration uses shadow-corpus null images rather than private-datastore items and supports aggregate discounts, not per-item confidence judgments.Source: §C.3 · p. 18, Table 12 · p. 19

C.4 Threshold Placement and Sensitivity

  • Gemini’s SIFT distributions are bimodal around the 0.1 threshold, whereas Lumina’s distributions lack that separation and put the threshold near a peak or in a tail.Figure 5 shows the score distributions and threshold; tightening SIFT from 0.1 to 0.15 costs Gemini 7%–12% of flagged items, versus 40%–44% on Lumina runs.Source: §C.4 · pp. 18–19
  • Perceptual hash distance varies by at most a fifth across thresholds 6 to 14, while Lumina’s pixel-match flags on ROCOv2 fall by nine tenths when the threshold rises from 0.8 to 0.9.The authors conclude that Gemini results rest on firmer footing; Lumina counts are more sensitive to threshold choice, though this is not a reason to discard them.Source: §C.4 · p. 19

D Analysis of Image Blending Techniques

Under an idealized generator, opacity blending yields the highest unique retrieval coverage across the three datasets and grows near-linearly. Among tested attack queries, the best-performing wording is simple and direct, though the observed ranking is a weak preference.

D Analysis of Image Blending Techniques

  • Opacity blending finishes first on all three datasets, with 1005, 1104, and 665 unique retrieval coverage (URC), and shows near-linear growth under the idealized generator.Figure 6 depicts coverage by blending technique; the authors attribute opacity blending’s advantage to its continuous path through embedding space and finer-grained exploration.Source: D Analysis of Image Blending Techniques · pp. 19–20, Figure 6 · p. 20
  • Half concatenation and concatenation are meaningful alternatives but are less efficient than opacity blending; the authors associate their sharper visual boundaries with less semantically substantial retrievals.Half concatenation records 1087 and 655 URC on DocVQA and CC, while concatenation records 733 on ROCOv2 and 896 and 567 on the other datasets.Source: D Analysis of Image Blending Techniques · p. 20
  • Three-item blending yields 583, 532, and 449 URC on ROCOv2, DocVQA, and CC, respectively, and is consistently outperformed by simpler approaches.The authors suggest its compositions can be incoherent for the vision encoder; generative methods and the single-image baseline also rank among the lowest performers.Source: D Analysis of Image Blending Techniques · p. 20

E Attack Query Selection

  • The attack-query comparison spans ten candidates, but its 138–157 aggregate-score spread is comparable to run-to-run sampling noise, so the ordering is only a weak preference.Each query was tested once for 100 iterations.Source: E Attack Query Selection · p. 21
  • Query #1 is the best performer with 157 unique positive reconstruction flags, while queries #5 and #8 are the worst with 138 copied unique images across the three knowledge bases.The authors characterize stronger queries as simple, high-confidence instructions that leave little room for interpretation.Source: E Attack Query Selection · p. 21

F Examples of leakage

The examples show that generated outputs can preserve salient content despite geometric or textual imperfections. The case study also demonstrates that visual resemblance and individual pixel-based leakage metrics can disagree.

F Examples of leakage

  • ROCOv2 examples show both generators reproducing medical content with substantial likeness despite outputs that are not pixel-level identical.The case study’s Lumina samples contain spatial and geometric noise but retain composition, object placement, and similar color and texture distributions.Source: F Examples of leakage · p. 21, G Case Study · p. 21, Figure 7 · p. 24
  • For DocVQA, Gemini preserves textual contents, whereas Lumina’s text is an undecipherable pixel amalgamation and is not treated as a successfully leaked data point.The authors connect Lumina’s difficulty to generating discrete image tokens rather than Unicode characters or OCR tokens.Source: F Examples of leakage · p. 21
  • CC regenerated images have high visual similarity to originals across output dimensions, with alignment enabling detection of likeness.Source: F Examples of leakage · p. 21

G Case Study

  • The case study selects images across reconstruction-metric intervals only when at least one reported metric marks them as unsuccessful copying attempts.Figure 7 presents Lumina samples, and Figure 8 presents Gemini samples.Source: G Case Study · p. 21, Figure 7 · p. 24, Table 16 · p. 24
  • In the Gemini case study, some images that appear identical or preserve recognizable facial features are classified as unlikely copies by PMR.The examples show PMR failing to capture resemblance in structurally different scenes as well as facial details; the authors argue that multiple complementary scores are needed.Source: G Case Study · p. 22, Figure 8 · p. 25
Loading 2610.01871v1…