A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert

TL;DR

This paper analyzes the irreversibility of PolyProtect face templates, demonstrating that they are easier to invert with cosine distance and proposing a key selection algorithm to enhance security while maintaining recognition accuracy.

Contribution

It introduces a key selection algorithm that improves the irreversibility of PolyProtect templates and provides insights into the trade-offs between security and accuracy.

Findings

PolyProtected templates are easier to invert with cosine distance.

The key selection algorithm significantly increases template irreversibility.

Normalization of embeddings improves PolyProtect recognition accuracy.

Abstract

This work presents a deeper analysis of the "irreversibility" property of PolyProtect, a biometric template protection method initially proposed for securing face embeddings. PolyProtect transforms embeddings into protected templates via multivariate polynomials, whose coefficients and exponents are distinct for each subject enrolled in the face recognition system. A polynomial is applied to consecutive sets of elements from a given embedding, where the amount of overlap between the sets is a tunable parameter. We begin our irreversibility analysis by demonstrating that PolyProtected templates are easier to invert using a numerical solver based on cosine distance, as opposed to Euclidean distance (used in the earlier PolyProtect work). To make this inversion more difficult, we then propose a "key selection algorithm", which tries to choose "keys" (coefficients and exponents of the PolyProtect polynomial) that enhance the irreversibility of PolyProtected templates, compared to when the keys are purely random. Our experiments show that this algorithm is effective at generating PolyProtected templates that are significantly more difficult to invert, and that it approximately equalises the irreversibility of PolyProtected templates generated using different "overlap" parameters. This allows for better control of the irreversibility versus accuracy trade-off, known to exist across different overlaps. We also show that accuracy in the PolyProtected domain can be affected by the range in which the embedding elements lie, but that this can be improved by normalizing the embeddings prior to applying PolyProtect. This work is reproducible using our open-source code.