# IronMask: Modular Architecture for Protecting Deep Face Template

arXiv: https://arxiv.org/abs/2104.02239 · HTML: https://mlsanity.com/paper/2104.02239/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 44 references that are in the map.
- First posted on arXiv 6 Apr 2021.

## Builds on (most cited first, 13 of 13)

- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [CosFace: Large Margin Cosine Loss for Deep Face Recognition](https://mlsanity.com/paper/1801.09414/) (2018)
- [SphereFace: Deep Hypersphere Embedding for Face Recognition](https://mlsanity.com/paper/1704.08063/) (2017)
- [Large-Margin Softmax Loss for Convolutional Neural Networks](https://mlsanity.com/paper/1612.02295/) (2016)
- [Additive Margin Softmax for Face Verification](https://mlsanity.com/paper/1801.05599/) (2018)
- [NormFace: L2 Hypersphere Embedding for Face Verification](https://mlsanity.com/paper/1704.06369/) (2017)
- [L2-constrained Softmax Loss for Discriminative Face Verification](https://mlsanity.com/paper/1703.09507/) (2017)
- [AdaCos: Adaptively Scaling Cosine Logits for Effectively Learning Deep Face Representations](https://mlsanity.com/paper/1905.00292/) (2019)
- [On the Reconstruction of Face Images from Deep Face Templates](https://mlsanity.com/paper/1703.00832/) (2017)
- [Secure Face Matching Using Fully Homomorphic Encryption](https://mlsanity.com/paper/1805.00577/) (2018)
- [HERS: Homomorphically Encrypted Representation Search](https://mlsanity.com/paper/2003.12197/) (2020)
- [Rethinking Feature Discrimination and Polymerization for Large-scale Recognition](https://mlsanity.com/paper/1710.00870/) (2017)
- [Zero-Shot Deep Hashing and Neural Network Based Error Correction for Face Template Protection](https://mlsanity.com/paper/1908.02706/) (2019)

## Built on by (most cited first, 9 of 9)

- [Biometrics: Trust, but Verify](https://mlsanity.com/paper/2105.06625/) (2021)
- [Biometric Template Protection for Neural-Network-based Face Recognition Systems: A Survey of Methods and Evaluation Techniques](https://mlsanity.com/paper/2110.05044/) (2021)
- [SlerpFace: Face Template Protection via Spherical Linear Interpolation](https://mlsanity.com/paper/2407.03043/) (2024)
- [IDFace: Face Template Protection for Efficient and Secure Identification](https://mlsanity.com/paper/2507.12050/) (2025)
- [Towards Privacy-Preserving, Real-Time and Lossless Feature Matching](https://mlsanity.com/paper/2208.00214/) (2022)
- [Securing Face and Fingerprint Templates in Humanitarian Biometric Systems](https://mlsanity.com/paper/2508.18415/) (2025)
- [Hypersphere Secure Sketch Revisited: Probabilistic Linear Regression Attack on IronMask in Multiple Usage](https://mlsanity.com/paper/2409.12884/) (2024)
- [FaceCloak: Learning to Protect Face Templates](https://mlsanity.com/paper/2504.06131/) (2025)
- [Binding Biometrics with AI Agent Identifiers for Delegation of Authority](https://mlsanity.com/paper/2608.04292/) (2026)

## Abstract (arXiv)

Convolutional neural networks have made remarkable progress in the face recognition field. The more the technology of face recognition advances, the greater discriminative features into a face template. However, this increases the threat to user privacy in case the template is exposed. In this paper, we present a modular architecture for face template protection, called IronMask, that can be combined with any face recognition system using angular distance metric. We circumvent the need for binarization, which is the main cause of performance degradation in most existing face template protections, by proposing a new real-valued error-correcting-code that is compatible with real-valued templates and can therefore, minimize performance degradation. We evaluate the efficacy of IronMask by extensive experiments on two face recognitions, ArcFace and CosFace with three datasets, CMU-Multi-PIE, FEI, and Color-FERET. According to our experimental results, IronMask achieves a true accept rate (TAR) of 99.79% at a false accept rate (FAR) of 0.0005% when combined with ArcFace, and 95.78% TAR at 0% FAR with CosFace, while providing at least 115-bit security against known attacks.