# Haven't I Seen You Before? Assessing Identity Leakage in Synthetic Irises

arXiv: https://arxiv.org/abs/2211.05629 · HTML: https://mlsanity.com/paper/2211.05629/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 38 references that are in the map.
- First posted on arXiv 3 Nov 2022.

## Builds on (most cited first, 18 of 18)

- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [Large Scale GAN Training for High Fidelity Natural Image Synthesis](https://mlsanity.com/paper/1809.11096/) (2018)
- [Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks](https://mlsanity.com/paper/1511.06434/) (2015)
- [Alias-Free Generative Adversarial Networks](https://mlsanity.com/paper/2106.12423/) (2021)
- [StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translation](https://mlsanity.com/paper/1711.09020/) (2017)
- [Unpaired Image-to-Image Translation using Cycle-Consistent Adversarial Networks](https://mlsanity.com/paper/1703.10593/) (2017)
- [Machine Learning Models that Remember Too Much](https://mlsanity.com/paper/1709.07886/) (2017)
- [GAN Memory with No Forgetting](https://mlsanity.com/paper/2006.07543/) (2020)
- [Detecting Overfitting of Deep Generative Networks via Latent Recovery](https://mlsanity.com/paper/1901.03396/) (2019)
- [Biometrics: Trust, but Verify](https://mlsanity.com/paper/2105.06625/) (2021)
- [When do GANs replicate? On the choice of dataset size](https://mlsanity.com/paper/2202.11765/) (2022)
- [This Face Does Not Exist ... But It Might Be Yours! Identity Leakage in Generative Models](https://mlsanity.com/paper/2101.05084/) (2020)
- [Post-mortem Iris Recognition with Deep-Learning-based Image Segmentation](https://mlsanity.com/paper/1901.01708/) (2019)
- [Domain-Specific Human-Inspired Binarized Statistical Image Features for Iris Recognition](https://mlsanity.com/paper/1807.05248/) (2018)
- [Iris-GAN: Learning to Generate Realistic Iris Images Using Convolutional GAN](https://mlsanity.com/paper/1812.04822/) (2018)
- [Learning-Free Iris Segmentation Revisited: A First Step Toward Fast Volumetric Operation Over Video Samples](https://mlsanity.com/paper/1901.01575/) (2019)

## Built on by (most cited first, 6 of 6)

- [Privacy-Safe Iris Presentation Attack Detection](https://mlsanity.com/paper/2408.02750/) (2024)
- [iWarpGAN: Disentangling Identity and Style to Generate Synthetic Iris Images](https://mlsanity.com/paper/2305.12596/) (2023)
- [EyePreserve: Identity-Preserving Iris Synthesis](https://mlsanity.com/paper/2312.12028/) (2023)
- [A Multi-domain Image Translative Diffusion StyleGAN for Iris Presentation Attack Detection](https://mlsanity.com/paper/2510.14314/) (2025)
- [Improving Model's Focus Improves Performance of Deep Learning-Based Synthetic Face Detectors](https://mlsanity.com/paper/2303.00818/) (2023)
- [Sampling From Autoencoders' Latent Space via Quantization And Probability Mass Function Concepts](https://mlsanity.com/paper/2308.10704/) (2023)

## Abstract (arXiv)

Generative Adversarial Networks (GANs) have proven to be a preferred method of synthesizing fake images of objects, such as faces, animals, and automobiles. It is not surprising these models can also generate ISO-compliant, yet synthetic iris images, which can be used to augment training data for iris matchers and liveness detectors. In this work, we trained one of the most recent GAN models (StyleGAN3) to generate fake iris images with two primary goals: (i) to understand the GAN's ability to produce "never-before-seen" irises, and (ii) to investigate the phenomenon of identity leakage as a function of the GAN's training time. Previous work has shown that personal biometric data can inadvertently flow from training data into synthetic samples, raising a privacy concern for subjects who accidentally appear in the training dataset. This paper presents analysis for three different iris matchers at varying points in the GAN training process to diagnose where and when authentic training samples are in jeopardy of leaking through the generative process. Our results show that while most synthetic samples do not show signs of identity leakage, a handful of generated samples match authentic (training) samples nearly perfectly, with consensus across all matchers. In order to prioritize privacy, security, and trust in the machine learning model development process, the research community must strike a delicate balance between the benefits of using synthetic data and the corresponding threats against privacy from potential identity leakage.