# Black-Box Face Recovery from Identity Features

arXiv: https://arxiv.org/abs/2007.13635 · HTML: https://mlsanity.com/paper/2007.13635/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Jul 2020.

## Built on by (most cited first, 20 of 20)

- [Arc2Face: A Foundation Model for ID-Consistent Human Faces](https://mlsanity.com/paper/2403.11641/) (2024)
- [Label-Only Model Inversion Attacks via Boundary Repulsion](https://mlsanity.com/paper/2203.01925/) (2022)
- [Privacy-preserving Adversarial Facial Features](https://mlsanity.com/paper/2305.05391/) (2023)
- [Controllable Inversion of Black-Box Face Recognition Models via Diffusion](https://mlsanity.com/paper/2303.13006/) (2023)
- [SlerpFace: Face Template Protection via Spherical Linear Interpolation](https://mlsanity.com/paper/2407.03043/) (2024)
- [Darker than Black-Box: Face Reconstruction from Similarity Queries](https://mlsanity.com/paper/2106.14290/) (2021)
- [Vec2Face-v2: Unveil Human Faces from their Blackbox Features via Attention-based Network in Face Recognition](https://mlsanity.com/paper/2209.04920/) (2022)
- [Distilling the Undistillable: Learning from a Nasty Teacher](https://mlsanity.com/paper/2210.11728/) (2022)
- [Emerging Threats in Deep Learning-Based Autonomous Driving: A Comprehensive Survey](https://mlsanity.com/paper/2210.11237/) (2022)
- [Face Reconstruction Transfer Attack as Out-of-Distribution Generalization](https://mlsanity.com/paper/2407.02403/) (2024)
- [Assessing Privacy Risks from Feature Vector Reconstruction Attacks](https://mlsanity.com/paper/2202.05760/) (2022)
- [Reconstruct Face from Features Using GAN Generator as a Distribution Constraint](https://mlsanity.com/paper/2206.04295/) (2022)
- [Scores Know Bobs Voice: Speaker Impersonation Attack](https://mlsanity.com/paper/2603.02781/) (2026)
- [ID2image: Leakage of non-ID information into face descriptors and inversion from descriptors to images](https://mlsanity.com/paper/2304.07522/) (2023)
- [Facial Expression Recognition with Controlled Privacy Preservation and Feature Compensation](https://mlsanity.com/paper/2412.00277/) (2024)
- [Inverting Black-Box Face Recognition Systems via Zero-Order Optimization in Eigenface Space](https://mlsanity.com/paper/2506.09777/) (2025)
- [Facial Data Minimization: Shallow Model as Your Privacy Filter](https://mlsanity.com/paper/2310.15590/) (2023)
- [Breaking the Black-Box: Confidence-Guided Model Inversion Attack for Distribution Shift](https://mlsanity.com/paper/2402.18027/) (2024)
- [StyleYourSmile: Cross-Domain Face Retargeting Without Paired Multi-Style Data](https://mlsanity.com/paper/2512.01895/) (2025)
- [Breaking High Confidence: Practical Face Impersonation under High-Security Thresholds](https://mlsanity.com/paper/2608.20884/) (2026)

## Abstract (arXiv)

In this work, we present a novel algorithm based on an it-erative sampling of random Gaussian blobs for black-box face recovery, given only an output feature vector of deep face recognition systems. We attack the state-of-the-art face recognition system (ArcFace) to test our algorithm. Another network with different architecture (FaceNet) is used as an independent critic showing that the target person can be identified with the reconstructed image even with no access to the attacked model. Furthermore, our algorithm requires a significantly less number of queries compared to the state-of-the-art solution.