# An Attack on Facial Soft-biometric Privacy Enhancement

arXiv: https://arxiv.org/abs/2111.12405 · HTML: https://mlsanity.com/paper/2111.12405/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 36 references that are in the map.
- First posted on arXiv 24 Nov 2021.

## Builds on (most cited first, 7 of 7)

- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [VGGFace2: A dataset for recognising faces across pose and age](https://mlsanity.com/paper/1710.08092/) (2017)
- [On the Reconstruction of Face Images from Deep Face Templates](https://mlsanity.com/paper/1703.00832/) (2017)
- [Beyond Identity: What Information Is Stored in Biometric Face Templates?](https://mlsanity.com/paper/2009.09918/) (2020)
- [Quantifying the Extent to Which Race and Gender Features Determine Identity in Commercial Face Recognition Algorithms](https://mlsanity.com/paper/2010.07979/) (2020)
- [Unsupervised Enhancement of Soft-biometric Privacy with Negative Face Recognition](https://mlsanity.com/paper/2002.09181/) (2020)

## Built on by (most cited first, 5 of 5)

- [An Overview of Privacy-enhancing Technologies in Biometric Recognition](https://mlsanity.com/paper/2206.10465/) (2022)
- [Deep Learning in the Field of Biometric Template Protection: An Overview](https://mlsanity.com/paper/2303.02715/) (2023)
- [Reversing Deep Face Embeddings with Probable Privacy Protection](https://mlsanity.com/paper/2310.03005/) (2023)
- [A Responsible Face Recognition Approach for Small and Mid-Scale Systems Through Personalized Neural Networks](https://mlsanity.com/paper/2505.19920/) (2025)
- [Variational Latent Entropy Estimation Disentanglement: Controlled Attribute Leakage for Face Recognition](https://mlsanity.com/paper/2604.11250/) (2026)

## Abstract (arXiv)

In the recent past, different researchers have proposed privacy-enhancing face recognition systems designed to conceal soft-biometric attributes at feature level. These works have reported impressive results, but generally did not consider specific attacks in their analysis of privacy protection. We introduce an attack on said schemes based on two observations: (1) highly similar facial representations usually originate from face images with similar soft-biometric attributes; (2) to achieve high recognition accuracy, robustness against intra-class variations within facial representations has to be retained in their privacy-enhanced versions. The presented attack only requires the privacy-enhancing algorithm as a black-box and a relatively small database of face images with annotated soft-biometric attributes. Firstly, an intercepted privacy-enhanced face representation is compared against the attacker's database. Subsequently, the unknown attribute is inferred from the attributes associated with the highest obtained similarity scores. In the experiments, the attack is applied against two state-of-the-art approaches. The attack is shown to circumvent the privacy enhancement to a considerable degree and is able to correctly classify gender with an accuracy of up to approximately 90%. Future works on privacy-enhancing face recognition are encouraged to include the proposed attack in evaluations on the privacy protection.