Reversing Deep Face Embeddings with Probable Privacy Protection

TL;DR

This paper critically evaluates the effectiveness of privacy-enhancing face embeddings, revealing that state-of-the-art methods can be reversed with high accuracy, thus challenging their claimed privacy protections.

Contribution

It provides a comprehensive analysis of the non-invertibility of privacy-protected face embeddings and demonstrates the vulnerability of current methods to reconstruction attacks.

Findings

Biometric privacy-enhanced face embeddings can be reconstructed with up to 98% accuracy.

Current privacy protection methods are vulnerable to reconstruction attacks.

Evaluation protocols for privacy protection in face embeddings need standardization.

Abstract

Generally, privacy-enhancing face recognition systems are designed to offer permanent protection of face embeddings. Recently, so-called soft-biometric privacy-enhancement approaches have been introduced with the aim of canceling soft-biometric attributes. These methods limit the amount of soft-biometric information (gender or skin-colour) that can be inferred from face embeddings. Previous work has underlined the need for research into rigorous evaluations and standardised evaluation protocols when assessing privacy protection capabilities. Motivated by this fact, this paper explores to what extent the non-invertibility requirement can be met by methods that claim to provide soft-biometric privacy protection. Additionally, a detailed vulnerability assessment of state-of-the-art face embedding extractors is analysed in terms of the transformation complexity used for privacy protection. In this context, a well-known state-of-the-art face image reconstruction approach has been evaluated on protected face embeddings to break soft biometric privacy protection. Experimental results show that biometric privacy-enhanced face embeddings can be reconstructed with an accuracy of up to approximately 98%, depending on the complexity of the protection algorithm.