PaperlayerView exact revision on arXiv

Source-linked AI summary

GhostFaceMPC: Privacy-Preserving Face Recognition with Multi-Party Computation

Davide Carnemolla, Dario Catalano, Mario Di Raimondo

arXiv:2610.29987v1cs.CR

TL;DR

Many cryptographic face-recognition systems protect matching but leave feature extraction outside the protected computation. GhostFaceMPC secret-shares the aligned face among three servers for protected feature extraction, matching, and thresholding, using a model fine-tuned to reproduce MPC ring arithmetic. The resulting model halves communication per element and stays within 0.32 percentage points of the original accuracy on five benchmarks.

  • Problem

    Many cryptographic face-recognition systems protect matching but leave feature extraction outside the protected computation.

    Source: A. Contributions of our work · p. 1

  • Method

    GhostFaceMPC secret-shares the aligned face among three servers for protected feature extraction, matching, and thresholding, using a model fine-tuned to reproduce MPC ring arithmetic.

    Source: A. Contributions of our work · p. 1, B. Model · p. 5

  • Results

    The resulting model halves communication per element and stays within 0.32 percentage points of the original accuracy on five benchmarks.

    Source: A. Contributions of our work · p. 1

  • Takeaways & Limitations

    With a public model, secure inference cost is set by fixed-point roundings rather than multiplications, making model-and-circuit co-design important for performance.

    Source: §VII · p. 8

    Wide-area latency is the main limitation, dominated by about 1,400 rounds per inference.

    Source: §VII · p. 8

Abstract

from arXiv · show

Facial recognition has become central to modern authentication systems, security frameworks, and personalized services. However, its widespread adoption is hindered by severe privacy risks, particularly surrounding unauthorized access to sensitive biometric data. To address these challenges, this paper presents GhostFaceMPC, the first end-to-end, privacy-preserving face recognition system to evaluate a deep convolutional neural network extractor and matching under secure multi-party computation. GhostFaceMPC enables secure processing of facial data across all stages of a face recognition process, from feature extraction and storage to matching, without exposing raw images or biometric embeddings at any stage. We introduce a multi-party computation-friendly quantization of the GhostFaceNet model and circuit optimizations that make face recognition under multi-party computation practical. The code is available at https://github.com/crypto-unict/GhostFaceMPC.

I. INTRODUCTION

Face recognition relies on sensitive, immutable biometric data, making privacy protection important. GhostFaceMPC protects extraction and matching under MPC through a quantized model and circuit optimizations, with an implementation evaluated on standard benchmarks.

I. INTRODUCTION

  • Biometric data exposure can enable privacy violations, identity theft, and unauthorized surveillance; unlike traditional credentials, compromised biometric traits cannot be revoked or reset.A standard face-recognition pipeline uses a probe image, feature extractor, and reference database; it can support verification or identification.Source: §I · p. 1

A. Contributions of our work

  • GhostFaceMPC protects feature extraction, matching, and thresholding under MPC: three servers process shares of the aligned image, and only the client reconstructs the match decision.No single server learns the image, feature vector, enrolled templates, or result; the model remains undisclosed to the client.Source: A. Contributions of our work · p. 1
  • The MPC-friendly quantized model halves communication per element while staying within 0.32 percentage points of the original accuracy on five benchmarks.Naively encoding the floating-point model in the narrower ring loses over 30 percentage points; fine-tuning instead simulates the fixed-point arithmetic and rounding used by the servers.Source: A. Contributions of our work · p. 1
  • Circuit optimizations to reduce rounding count and cost lower online communication by 70%, rounds by 96%, and latency by 95% relative to direct MP-SPDZ.They combine batch-normalization folding, deferred roundings where held-out-face bounds indicate no overflow, exact two-summand rounding, and layer vectorization.Source: A. Contributions of our work · pp. 1–2
  • In the semi-honest setting, verification takes 2.4 s and 312 MB of online communication on one machine, or 3.8 s on a LAN.With security with abort, the online phase takes 5.5 s on one machine; the implementation also supports closed-set identification.Source: A. Contributions of our work · p. 2

B. Organization of this paper

The paper outlines its organization and reviews privacy-preserving face-recognition approaches. It distinguishes systems that protect only matching from those that also perform feature extraction on protected data.

B. Organization of this paper

  • The paper proceeds from related work and preliminaries to architecture and threat model, then solution and optimizations, evaluation, and conclusions..Source: B. Organization of this paper · p. 2

II. RELATED WORK

  • The related-work review focuses on cryptographic approaches and compares whether secure feature extraction is included, unlike non-cryptographic transformations whose protection is assessed empirically and still expose server-side features.The comparison also covers participating parties, interaction, verification, and identification.Source: §II · p. 2

A. Secure matching over pre-computed features

  • Many cryptographic systems protect matching over client-computed features; examples include SCiFI, Boddeti, HERS, Blind-Match, CryptoMask, and Funshade.These approaches use techniques including homomorphic encryption, oblivious transfer, and function secret sharing; Funshade requires a trusted preprocessing dealer.Source: A. Secure matching over pre-computed… · p. 2

B. Secure feature extraction

  • CryptoFace performs deep extraction, matching, and thresholding on protected data, using a shallow patch-based backbone and reporting about 20 minutes per image on CPU.GhostFaceMPC instead assumes an honest majority among three non-colluding servers and evaluates a standard lightweight backbone in 2.43 s (Co-Host), 3.82 s (LAN), and 87.93 s (WAN); the latency figures use different hardware and are indicative only.Source: B. Secure feature extraction · p. 2

A. Notation.

The preliminaries define notation and secret sharing, then describe MPC as secure joint computation over private inputs. These concepts provide the framework for the paper’s protected model evaluation.

A. Notation.

  • The notation defines Z, Z+, and R, uses [t] for the first t positive integers and Z2k for the k-bit integer ring, and specifies rounding, inner product, and Euclidean norm..Source: A. Notation · p. 2

A secret-sharing

  • Table I compares privacy-preserving face-recognition systems by parties, interaction, secure extraction, verification, and identification..Source: Table I · p. 3
  • An (n,t)-linear secret-sharing scheme distributes a secret into n shares so at most t reveal no information and any t + 1 can reconstruct it.The paper adopts replicated secret sharing, in which parties hold subsets of subshares to simplify reconstruction and enable efficient non-interactive local operations.Source: A secret-sharing · pp. 2–3

C. Secure Multiparty Computation.

  • MPC lets mutually distrustful parties compute a public function on private inputs while revealing no information beyond what the function output reveals.Here the function is represented as a gate circuit, with parties converting secret-shared gate inputs into secret-shared outputs through secure protocols.Source: C. Secure Multiparty Computation · p. 3
  • The described MPC protocols distinguish honest-but-curious adversaries, who follow the protocol but try to infer inputs, from malicious adversaries, who may deviate to compromise privacy or alter results..Source: C. Secure Multiparty Computation · p. 3

D. Fixed-point Arithmetic.

Fixed-point arithmetic represents real values as scaled integers in a finite-bitwidth ring. Face verification extracts embeddings from two images and tests their similarity against a threshold.

D. Fixed-point Arithmetic.

  • Finite-bitwidth computers cannot exactly represent real numbers with infinite representations, such as irrationals..Source: D. Fixed-point Arithmetic · p. 3
  • Fixed-point encoding scales a real value by 2^f and rounds it into the ring Z2k, using bitwidth k and f fractional bits.The corresponding real value is obtained by scaling the integer representation by 2^-f.Source: D. Fixed-point Arithmetic · p. 3

A. Face Recognition

  • The described verification workflow enrolls a reference image and identity, then compares a probe image against that reference using feature representations from the same network..Source: A. Face Recognition · p. 3
  • The paper focuses on verification with enrollment features precomputed by a trusted provider; it extracts each image embedding with a CNN and classifies the pair as the same identity when cosine similarity meets threshold T.The cosine test is equivalent to thresholding squared distance between normalized features, with the inequality direction reversed.Source: A. Face Recognition · pp. 3–4

B. Architecture

GhostFaceMPC distributes enrollment, feature extraction, and matching across a client, three servers, and an enrollment-only trusted provider. Servers process secret-shared probe and template data and return a single match bit to the client.

B. Architecture

  • Enrollment shares each L2-normalized template among the servers, after which the trusted provider may go offline.Normalizing templates at enrollment removes the decision rule’s square root from secure computation.Source: B. Architecture · p. 4
  • The client locally detects and aligns the probe, then sends additive shares of its encoded image to the servers without transmitting the image itself.The claimed identity and database row index are sent in cleartext.Source: B. Architecture · p. 4
  • Servers evaluate the network on the shared probe and compute two unopened inner products for the declared template row.Because the row index is public, each request touches one row and matching cost does not depend on gallery size N.Source: B. Architecture · p. 4
  • The servers evaluate the match decision without computing a division under MPC, using squaring and a public constant.The decision rule compares the inner-product values against the public threshold.Source: B. Architecture · p. 4
  • The servers return shares of one match bit, which the client reconstructs; the malicious profile verifies pending multiplications before returning the output.The client learns one bit per request.Source: B. Architecture · p. 4

C. Threat Model

The threat model allows at most one statically corrupted server and assumes the other servers do not collude with it. It distinguishes an honest-but-curious profile from a malicious profile that provides security with abort.

C. Threat Model

  • The model assumes static corruption of at most one server, an honest trusted provider during enrollment, and non-collusion among servers.Any two servers together can reconstruct the probe, feature, and database from their shares.Source: C. Threat Model · p. 4
  • The client follows the protocol but may try to infer information from what it receives; malicious clients submitting malformed inputs are outside the model.The trusted provider is assumed honest and may go offline after enrollment.Source: C. Threat Model · p. 4
  • In the honest-but-curious profile, a corrupted server follows the protocol but tries to infer secrets from its state and transcript.The server’s view can be simulated without secret knowledge, and it learns neither the decision bit nor the protected biometric data.Source: C. Threat Model · p. 5
  • In the malicious profile, deviations are detected except with probability 2^-40, and any decision received by the client is correct.A corrupted server can always force an abort, so output delivery is not guaranteed.Source: C. Threat Model · p. 5

V. GHOSTFACEMPC

GhostFaceMPC is implemented using MP-SPDZ and adapts GhostFaceNet for fixed-point computation under MPC. Its model design addresses the accuracy loss of naive quantization while reducing the ring width used for communication.

A. Implementation.

  • The implementation uses MP-SPDZ with replicated-ring MPC for honest-but-curious security and ps-rep-ring with post-sacrifice verification for malicious security with abort.The replicated-ring protocol uses the secret-sharing scheme of Araki et al., extended to Z2k in ABY3, with rounding optimizations from Dalskov et al..Source: A. Implementation · p. 5

B. Model.

  • The baseline is GhostFaceNetV1-1, trained on MS1MV3, with width 1.3, stride 1, an ArcFace head, and a 512-dimensional embedding.It maps an aligned 112×112×3 input to the embedding.Source: B. Model · p. 5
  • Naively quantizing the floating-point model to a 32-bit ring with f = 6 loses over 30 percentage points of verification accuracy because rounding errors accumulate across layers.The 64-bit, f = 16 starting configuration costs twice as much per communicated element as a 32-bit ring, making ring narrowing a major bandwidth lever.Source: B. Model · p. 5
  • A distilled student is fine-tuned to reproduce teacher embeddings using a differentiable forward pass that simulates the MPC program’s integer ring arithmetic.Training combines cosine distance, embedding mean squared error, intermediate feature matching, and an accumulator-overflow penalty; checkpoint selection uses mean embedding distance on 512 held-out faces.Source: B. Model · pp. 5–6
  • The resulting profile uses a 32-bit ring with activation precision f = 6, weight precision fw = 9, and declared rounding length r = 15.Weights retain finer precision without communication cost because the kernels are public; linear outputs are rounded back to the activation grid.Source: B. Model · p. 6

C. General Techniques and Optimizations.

GhostFaceMPC’s inference cost is dominated by interaction: rounding and sign extraction account for 93% of bytes in the first experiments. The section reduces that cost through local linear computation, layer and rounding fusion, and more efficient bit operations.

C. General Techniques and Optimizations.

  • Rounding accounts for 74% and sign extraction 19% of inference bytes in the first experiments; together, they account for 93%.The remaining secret-by-secret products contribute the rest.Source: C. General Techniques and Optimizations · p. 6
  • Public weights make linear-layer products local, leaving one communicating rescaling per output rather than per multiply-accumulate.Secret-by-secret products occur in squeeze-and-excitation gates, PReLU slope selection, and matching.Source: C. General Techniques and Optimizations · p. 6
  • Folding batch normalization into the preceding convolution removes one layer and one rounding per element when its output has no other consumer.Twenty of 21 batch normalizations qualify; one remains separate because the convolution output feeds a second branch.Source: C. General Techniques and Optimizations · p. 7
  • Bit extraction uses binary secret sharing and daBits to handle rounding carries and activation sign tests that cannot be computed locally.The daBits are generated in an offline phase for online use.Source: C. General Techniques and Optimizations · p. 7
  • Rounding fusion postpones scale reductions across operations so one interactive rounding can replace two, provided the unreduced value fits the ring.The paper applies this to convolution followed by PReLU, squeeze-and-excitation followed by convolution, and residual additions.Source: C. General Techniques and Optimizations · p. 7
  • Two-summand rounding uses the replicated shares to reduce carry-bit injections while preserving exact rounding without opening the value.With two addends, each carry is 0 or 1 and requires one injection.Source: C. General Techniques and Optimizations · pp. 7–8

VI. EXPERIMENTS

Experiments use four network environments with different bandwidth and latency conditions. They were run on a single 32-core virtual machine with 24 GB of RAM.

VI. EXPERIMENTS

  • Experiments cover LAN (1 Gbps, 0.1 ms RTT), WAN (100 Mbps, 100 ms RTT), Fast-WAN (1 Gbps, 10 ms RTT), and Co-Host without traffic shaping.The network settings were emulated with Linux traffic control.Source: §VI · p. 8
  • Co-Host denotes the setting where all three parties run on the same machine without traffic shaping.Source: §VI · p. 8
  • All experiments ran on a single 32-core virtual machine with 24 GB of RAM, backed by four Intel Xeon Gold 6238R sockets at 2.20 GHz.Source: §VI · p. 8

A. Test Datasets.

The evaluation uses five standard face-recognition benchmarks, with all images processed at 112 × 112 resolution. CFP-FP has more image pairs than each of the other four datasets.

A. Test Datasets.

  • The five benchmarks are LFW, AgeDB, CALFW, CPLFW, and CFP-FP.The evaluation follows AdaFace.Source: A. Test Datasets · p. 8
  • All benchmark images are processed at 112 × 112 resolution.Source: A. Test Datasets · p. 8
  • CFP-FP contains 7,000 image pairs (14,000 face images), while each of the other datasets contains 6,000 pairs (12,000 face images).Source: A. Test Datasets · p. 8

B. Baselines.

Because no prior system evaluates a deep CNN extractor and matching under MPC, the authors compare against naive MP-SPDZ and EzPC/Porthos implementations. A single-party TensorFlow float32 run provides the plaintext floor.

B. Baselines.

  • The baselines are naive MP-SPDZ and EzPC using Porthos, both running the same checkpoint on the same secret input.The paper states that no prior face-recognition system evaluates a deep CNN extractor and matching under MPC.Source: B. Baselines · p. 8
  • The naive MP-SPDZ baseline uses scalar kernels, one rounding per linear output, no fusion or graph rewriting, and a 64-bit ring with f = 20.Source: B. Baselines · p. 8
  • A single-party TensorFlow float32 run is the plaintext floor; 64-bit baseline rows reproduce float-model decisions, while GhostFaceMPC’s quantized model is at most 0.32 percentage points below the float teacher on CPLFW.Source: B. Baselines · p. 8

C. Optimizations Analysis

GhostFaceMPC’s optimizations sharply reduce verification costs, while 1:128 identification remains close to verification cost. The conclusion attributes practical secure inference to co-designing the model and circuit, while identifying wide-area latency as the main limitation.

C. Optimizations Analysis

  • 70.3% lower online bandwidth, 96.7% fewer rounds, and 94.6% lower wall time overall versus the naive baseline.The comparison covers one HbC verification request in a Co-Host environment with 8 threads per party; Table II’s final row reports GhostFaceMPC relative to the naive baseline.Source: C. Optimizations Analysis · p. 8, Table II · p. 9

D. Face Identification.

  • For 1:128 closed-set rank retrieval, identification costs close to verification because probe feature extraction runs once and matching adds overhead linear in gallery size.Identification evaluates N matching functions instead of one.Source: D. Face Identification · p. 8

VII. CONCLUSION

  • GhostFaceMPC secret-shares aligned faces among three non-colluding servers and returns only the decision; wide-area latency, dominated by about 1,400 rounds per inference, is its main limitation.The conclusion calls for reducing truncation and comparison rounds, alongside enrollment under MPC and large-gallery identification.Source: §VII · p. 8
Loading 2610.29987v1…