# This Face Does Not Exist ... But It Might Be Yours! Identity Leakage in Generative Models

arXiv: https://arxiv.org/abs/2101.05084 · HTML: https://mlsanity.com/paper/2101.05084/

## Key facts

- Cited by 33 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Dec 2020.

## Built on by (most cited first, 30 of 33)

- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Extracting Training Data from Diffusion Models](https://mlsanity.com/paper/2301.13188/) (2023)
- [GAUDI: A Neural Architect for Immersive 3D Scene Generation](https://mlsanity.com/paper/2207.13751/) (2022)
- [Collaborative Diffusion for Multi-Modal Face Generation and Editing](https://mlsanity.com/paper/2304.10530/) (2023)
- [ReVersion: Diffusion-Based Relation Inversion from Images](https://mlsanity.com/paper/2303.13495/) (2023)
- [Biometrics: Trust, but Verify](https://mlsanity.com/paper/2105.06625/) (2021)
- [Synthetic Data for Face Recognition: Current State and Future Prospects](https://mlsanity.com/paper/2305.01021/) (2023)
- [When do GANs replicate? On the choice of dataset size](https://mlsanity.com/paper/2202.11765/) (2022)
- [PrintsGAN: Synthetic Fingerprint Generator](https://mlsanity.com/paper/2201.03674/) (2022)
- [Synthetic Data in Human Analysis: A Survey](https://mlsanity.com/paper/2208.09191/) (2022)
- [Diffusion Probabilistic Fields](https://mlsanity.com/paper/2303.00165/) (2023)
- [Unsupervised Face Recognition using Unlabeled Synthetic Data](https://mlsanity.com/paper/2211.07371/) (2022)
- [Deep Learning for Iris Recognition: A Survey](https://mlsanity.com/paper/2210.05866/) (2022)
- [Exploring Local Memorization in Diffusion Models via Bright Ending Attention](https://mlsanity.com/paper/2410.21665/) (2024)
- [DDMI: Domain-Agnostic Latent Diffusion Models for Synthesizing High-Quality Implicit Neural Representations](https://mlsanity.com/paper/2401.12517/) (2024)
- [Challenges and Remedies to Privacy and Security in AIGC: Exploring the Potential of Privacy Computing, Blockchain, and Beyond](https://mlsanity.com/paper/2306.00419/) (2023)
- [From Specificity to Generality: Revisiting Generalizable Artifacts in Detecting Face Deepfakes](https://mlsanity.com/paper/2504.04827/) (2025)
- [Demographic Fairness in Biometric Systems: What do the Experts say?](https://mlsanity.com/paper/2105.14844/) (2021)
- [Manifold Diffusion Fields](https://mlsanity.com/paper/2305.15586/) (2023)
- [Beyond Real Faces: Synthetic Datasets Can Achieve Reliable Recognition Performance without Privacy Compromise](https://mlsanity.com/paper/2510.17372/) (2025)
- [Haven't I Seen You Before? Assessing Identity Leakage in Synthetic Irises](https://mlsanity.com/paper/2211.05629/) (2022)
- [Privacy-Safe Iris Presentation Attack Detection](https://mlsanity.com/paper/2408.02750/) (2024)
- [Enhancing Privacy-Utility Trade-offs to Mitigate Memorization in Diffusion Models](https://mlsanity.com/paper/2504.18032/) (2025)
- [Adversarial Robustness in Unsupervised Machine Learning: A Systematic Review](https://mlsanity.com/paper/2306.00687/) (2023)
- [Unveiling Synthetic Faces: How Synthetic Datasets Can Expose Real Identities](https://mlsanity.com/paper/2410.24015/) (2024)
- [Quantifying the Privacy Implications of High-Fidelity Synthetic Network Traffic](https://mlsanity.com/paper/2511.20497/) (2025)
- [Regulating Multifunctionality](https://mlsanity.com/paper/2502.15715/) (2025)
- [Analyzing the Impact of Shape & Context on the Face Recognition Performance of Deep Networks](https://mlsanity.com/paper/2208.02991/) (2022)
- [Synthetic Iris Image Databases and Identity Leakage: Risks and Mitigation Strategies](https://mlsanity.com/paper/2506.02626/) (2025)
- [Improving Model's Focus Improves Performance of Deep Learning-Based Synthetic Face Detectors](https://mlsanity.com/paper/2303.00818/) (2023)

## Abstract (arXiv)

Generative adversarial networks (GANs) are able to generate high resolution photo-realistic images of objects that "do not exist." These synthetic images are rather difficult to detect as fake. However, the manner in which these generative models are trained hints at a potential for information leakage from the supplied training data, especially in the context of synthetic faces. This paper presents experiments suggesting that identity information in face images can flow from the training corpus into synthetic samples without any adversarial actions when building or using the existing model. This raises privacy-related questions, but also stimulates discussions of (a) the face manifold's characteristics in the feature space and (b) how to create generative models that do not inadvertently reveal identity information of real subjects whose images were used for training. We used five different face matchers (face_recognition, FaceNet, ArcFace, SphereFace and Neurotechnology MegaMatcher) and the StyleGAN2 synthesis model, and show that this identity leakage does exist for some, but not all methods. So, can we say that these synthetically generated faces truly do not exist? Databases of real and synthetically generated faces are made available with this paper to allow full replicability of the results discussed in this work.