# Towards Protecting Face Embeddings in Mobile Face Verification Scenarios

arXiv: https://arxiv.org/abs/2110.00434 · HTML: https://mlsanity.com/paper/2110.00434/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 30 references that are in the map.
- First posted on arXiv 1 Oct 2021.

## Builds on (most cited first, 7 of 7)

- [On the Reconstruction of Face Images from Deep Face Templates](https://mlsanity.com/paper/1703.00832/) (2017)
- [Synthesizing Normalized Faces from Facial Identity Features](https://mlsanity.com/paper/1701.04851/) (2017)
- [Secure Face Matching Using Fully Homomorphic Encryption](https://mlsanity.com/paper/1805.00577/) (2018)
- [Beyond Identity: What Information Is Stored in Biometric Face Templates?](https://mlsanity.com/paper/2009.09918/) (2020)
- [Inverting face embeddings with convolutional neural networks](https://mlsanity.com/paper/1606.04189/) (2016)
- [Deep Face Fuzzy Vault: Implementation and Performance](https://mlsanity.com/paper/2102.02458/) (2021)
- [Zero-Shot Deep Hashing and Neural Network Based Error Correction for Face Template Protection](https://mlsanity.com/paper/1908.02706/) (2019)

## Built on by (most cited first, 14 of 14)

- [An Overview of Privacy-enhancing Technologies in Biometric Recognition](https://mlsanity.com/paper/2206.10465/) (2022)
- [Biometric Template Protection for Neural-Network-based Face Recognition Systems: A Survey of Methods and Evaluation Techniques](https://mlsanity.com/paper/2110.05044/) (2021)
- [SlerpFace: Face Template Protection via Spherical Linear Interpolation](https://mlsanity.com/paper/2407.03043/) (2024)
- [MLP-Hash: Protecting Face Templates via Hashing of Randomized Multi-Layer Perceptron](https://mlsanity.com/paper/2204.11054/) (2022)
- [Enhancing Privacy in Face Analytics Using Fully Homomorphic Encryption](https://mlsanity.com/paper/2404.16255/) (2024)
- [Privacy-Preserving Face Recognition in Hybrid Frequency-Color Domain](https://mlsanity.com/paper/2401.13386/) (2024)
- [Securing Face and Fingerprint Templates in Humanitarian Biometric Systems](https://mlsanity.com/paper/2508.18415/) (2025)
- [Seeing is not Believing: An Identity Hider for Human Vision Privacy Protection](https://mlsanity.com/paper/2307.00481/) (2023)
- [A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert](https://mlsanity.com/paper/2605.03857/) (2026)
- [Robust Skin Color Driven Privacy Preserving Face Recognition via Function Secret Sharing](https://mlsanity.com/paper/2407.05045/) (2024)
- [FaceCloak: Learning to Protect Face Templates](https://mlsanity.com/paper/2504.06131/) (2025)
- [Secure and Scalable Face Retrieval via Cancelable Product Quantization](https://mlsanity.com/paper/2509.00781/) (2025)
- [Realistic Face Reconstruction from Facial Embeddings via Diffusion Models](https://mlsanity.com/paper/2602.13168/) (2026)
- [Is it Possible to Generate Irreversible PolyProtected Templates from Face Embeddings using System-Specific Keys?](https://mlsanity.com/paper/2610.01385/) (2026)

## Abstract (arXiv)

This paper proposes PolyProtect, a method for protecting the sensitive face embeddings that are used to represent people's faces in neural-network-based face verification systems. PolyProtect transforms a face embedding to a more secure template, using a mapping based on multivariate polynomials parameterised by user-specific coefficients and exponents. In this work, PolyProtect is evaluated on two open-source face recognition systems in a cooperative-user mobile face verification context, under the toughest threat model that assumes a fully-informed attacker with complete knowledge of the system and all its parameters. Results indicate that PolyProtect can be tuned to achieve a satisfactory trade-off between the recognition accuracy of the PolyProtected face verification system and the irreversibility of the PolyProtected templates. Furthermore, PolyProtected templates are shown to be effectively unlinkable, especially if the user-specific parameters employed in the PolyProtect mapping are selected in a non-naive manner. The evaluation is conducted using practical methodologies with tangible results, to present realistic insight into the method's robustness as a face embedding protection scheme in practice. This work is fully reproducible using the publicly available code at: https://gitlab.idiap.ch/bob/bob.paper.polyprotect_2021.