# Semi-Adversarial Networks: Convolutional Autoencoders for Imparting Privacy to Face Images

arXiv: https://arxiv.org/abs/1712.00321 · HTML: https://mlsanity.com/paper/1712.00321/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Dec 2017.

## Built on by (most cited first, 20 of 20)

- [Meta Balanced Network for Fair Face Recognition](https://mlsanity.com/paper/2205.06548/) (2022)
- [Privacy-Preserving Face Recognition Using Trainable Feature Subtraction](https://mlsanity.com/paper/2403.12457/) (2024)
- [DuetFace: Collaborative Privacy-Preserving Face Recognition via Channel Splitting in the Frequency Domain](https://mlsanity.com/paper/2207.07340/) (2022)
- [Shake to Leak: Fine-tuning Diffusion Models Can Amplify the Generative Privacy Risk](https://mlsanity.com/paper/2403.09450/) (2024)
- [Fair Representation: Guaranteeing Approximate Multiple Group Fairness for Unknown Tasks](https://mlsanity.com/paper/2109.00545/) (2021)
- [Generative Adversarial Networks: A Survey Towards Private and Secure Applications](https://mlsanity.com/paper/2106.03785/) (2021)
- [Privacy-Preserving Face Recognition Using Random Frequency Components](https://mlsanity.com/paper/2308.10461/) (2023)
- [Privacy-Preserving Image Acquisition Using Trainable Optical Kernel](https://mlsanity.com/paper/2106.14577/) (2021)
- [Memory Defense: More Robust Classification via a Memory-Masking Autoencoder](https://mlsanity.com/paper/2202.02595/) (2022)
- [Hide and Seek: How Does Watermarking Impact Face Recognition?](https://mlsanity.com/paper/2404.18890/) (2024)
- [Proactive Schemes: A Survey of Adversarial Attacks for Social Good](https://mlsanity.com/paper/2409.16491/) (2024)
- [Is Face Recognition Safe from Realizable Attacks?](https://mlsanity.com/paper/2210.08178/) (2022)
- [Generative Adversarial Networks for Malware Detection: a Survey](https://mlsanity.com/paper/2302.08558/) (2023)
- [Deep Learning in the Field of Biometric Template Protection: An Overview](https://mlsanity.com/paper/2303.02715/) (2023)
- [ID2image: Leakage of non-ID information into face descriptors and inversion from descriptors to images](https://mlsanity.com/paper/2304.07522/) (2023)
- [SemDP: Semantic-level Differential Privacy Protection for Face Datasets](https://mlsanity.com/paper/2412.15590/) (2024)
- [PrivacyProber: Assessment and Detection of Soft-Biometric Privacy-Enhancing Techniques](https://mlsanity.com/paper/2211.08864/) (2022)
- [Privacy Enhancement for Gaze Data Using a Noise-Infused Autoencoder](https://mlsanity.com/paper/2508.10918/) (2025)
- [Face anonymization preserving facial expressions and photometric realism](https://mlsanity.com/paper/2603.17567/) (2026)
- [Protecting and Preserving Protest Dynamics for Responsible Analysis](https://mlsanity.com/paper/2604.05256/) (2026)

## Abstract (arXiv)

In this paper, we design and evaluate a convolutional autoencoder that perturbs an input face image to impart privacy to a subject. Specifically, the proposed autoencoder transforms an input face image such that the transformed image can be successfully used for face recognition but not for gender classification. In order to train this autoencoder, we propose a novel training scheme, referred to as semi-adversarial training in this work. The training is facilitated by attaching a semi-adversarial module consisting of a pseudo gender classifier and a pseudo face matcher to the autoencoder. The objective function utilized for training this network has three terms: one to ensure that the perturbed image is a realistic face image; another to ensure that the gender attributes of the face are confounded; and a third to ensure that biometric recognition performance due to the perturbed image is not impacted. Extensive experiments confirm the efficacy of the proposed architecture in extending gender privacy to face images.