# Inverting face embeddings with convolutional neural networks

arXiv: https://arxiv.org/abs/1606.04189 · HTML: https://mlsanity.com/paper/1606.04189/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jun 2016.

## Built on by (most cited first, 22 of 22)

- [Privacy-preserving Adversarial Facial Features](https://mlsanity.com/paper/2305.05391/) (2023)
- [Controllable Inversion of Black-Box Face Recognition Models via Diffusion](https://mlsanity.com/paper/2303.13006/) (2023)
- [DeepfakeUCL: Deepfake Detection via Unsupervised Contrastive Learning](https://mlsanity.com/paper/2104.11507/) (2021)
- [Towards Protecting Face Embeddings in Mobile Face Verification Scenarios](https://mlsanity.com/paper/2110.00434/) (2021)
- [Biometric Template Protection for Neural-Network-based Face Recognition Systems: A Survey of Methods and Evaluation Techniques](https://mlsanity.com/paper/2110.05044/) (2021)
- [Tackling Dynamics in Federated Incremental Learning with Variational Embedding Rehearsal](https://mlsanity.com/paper/2110.09695/) (2021)
- [SlerpFace: Face Template Protection via Spherical Linear Interpolation](https://mlsanity.com/paper/2407.03043/) (2024)
- [HINNPerf: Hierarchical Interaction Neural Network for Performance Prediction of Configurable Systems](https://mlsanity.com/paper/2204.03931/) (2022)
- [Vec2Face-v2: Unveil Human Faces from their Blackbox Features via Attention-based Network in Face Recognition](https://mlsanity.com/paper/2209.04920/) (2022)
- [Reversing the Irreversible: A Survey on Inverse Biometrics](https://mlsanity.com/paper/2401.02861/) (2024)
- [Assessing Privacy Risks from Feature Vector Reconstruction Attacks](https://mlsanity.com/paper/2202.05760/) (2022)
- [Reconstruct Face from Features Using GAN Generator as a Distribution Constraint](https://mlsanity.com/paper/2206.04295/) (2022)
- [Approximating Optimal Morphing Attacks using Template Inversion](https://mlsanity.com/paper/2402.00695/) (2024)
- [PixelFade: Privacy-preserving Person Re-identification with Noise-guided Progressive Replacement](https://mlsanity.com/paper/2408.05543/) (2024)
- [Fingerprint Template Invertibility: Minutiae vs. Deep Templates](https://mlsanity.com/paper/2205.03809/) (2022)
- [Deepfake Detection via Joint Unsupervised Reconstruction and Supervised Classification](https://mlsanity.com/paper/2211.13424/) (2022)
- [A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert](https://mlsanity.com/paper/2605.03857/) (2026)
- [Facial Data Minimization: Shallow Model as Your Privacy Filter](https://mlsanity.com/paper/2310.15590/) (2023)
- [Unrecognizable Yet Identifiable: Image Distortion with Preserved Embeddings](https://mlsanity.com/paper/2401.15048/) (2024)
- [Embedding Non-Distortive Cancelable Face Template Generation](https://mlsanity.com/paper/2402.02540/) (2024)
- [PEEL the Layers and Find Yourself: Revisiting Inference-time Data Leakage for Residual Neural Networks](https://mlsanity.com/paper/2504.06410/) (2025)
- [Is it Possible to Generate Irreversible PolyProtected Templates from Face Embeddings using System-Specific Keys?](https://mlsanity.com/paper/2610.01385/) (2026)

## Abstract (arXiv)

Deep neural networks have dramatically advanced the state of the art for many areas of machine learning. Recently they have been shown to have a remarkable ability to generate highly complex visual artifacts such as images and text rather than simply recognize them. In this work we use neural networks to effectively invert low-dimensional face embeddings while producing realistically looking consistent images. Our contribution is twofold, first we show that a gradient ascent style approaches can be used to reproduce consistent images, with a help of a guiding image. Second, we demonstrate that we can train a separate neural network to effectively solve the minimization problem in one pass, and generate images in real-time. We then evaluate the loss imposed by using a neural network instead of the gradient descent by comparing the final values of the minimized loss function.