# Reversing Deep Face Embeddings with Probable Privacy Protection

arXiv: https://arxiv.org/abs/2310.03005 · HTML: https://mlsanity.com/paper/2310.03005/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 27 references that are in the map.
- First posted on arXiv 4 Oct 2023.

## Builds on (most cited first, 10 of 10)

- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [ElasticFace: Elastic Margin Loss for Deep Face Recognition](https://mlsanity.com/paper/2109.09416/) (2021)
- [SER-FIQ: Unsupervised Estimation of Face Image Quality Based on Stochastic Embedding Robustness](https://mlsanity.com/paper/2003.09373/) (2020)
- [On the Reconstruction of Face Images from Deep Face Templates](https://mlsanity.com/paper/1703.00832/) (2017)
- [PrivacyNet: Semi-Adversarial Networks for Multi-attribute Face Privacy](https://mlsanity.com/paper/2001.00561/) (2020)
- [An Overview of Privacy-enhancing Technologies in Biometric Recognition](https://mlsanity.com/paper/2206.10465/) (2022)
- [Bottlenecks CLUB: Unifying Information-Theoretic Trade-offs Among Complexity, Leakage, and Utility](https://mlsanity.com/paper/2207.04895/) (2022)
- [An Attack on Facial Soft-biometric Privacy Enhancement](https://mlsanity.com/paper/2111.12405/) (2021)
- [Unsupervised Enhancement of Soft-biometric Privacy with Negative Face Recognition](https://mlsanity.com/paper/2002.09181/) (2020)
- [Reconstruct Face from Features Using GAN Generator as a Distribution Constraint](https://mlsanity.com/paper/2206.04295/) (2022)

## Built on by (most cited first, 1 of 1)

- [FaceLinkGen: A Re-evaluation of Identity Leakage in Privacy-Preserving Face Recognition and Face Anonymization Systems Using Simple Distillation](https://mlsanity.com/paper/2602.02914/) (2026)

## Abstract (arXiv)

Generally, privacy-enhancing face recognition systems are designed to offer permanent protection of face embeddings. Recently, so-called soft-biometric privacy-enhancement approaches have been introduced with the aim of canceling soft-biometric attributes. These methods limit the amount of soft-biometric information (gender or skin-colour) that can be inferred from face embeddings. Previous work has underlined the need for research into rigorous evaluations and standardised evaluation protocols when assessing privacy protection capabilities. Motivated by this fact, this paper explores to what extent the non-invertibility requirement can be met by methods that claim to provide soft-biometric privacy protection. Additionally, a detailed vulnerability assessment of state-of-the-art face embedding extractors is analysed in terms of the transformation complexity used for privacy protection. In this context, a well-known state-of-the-art face image reconstruction approach has been evaluated on protected face embeddings to break soft biometric privacy protection. Experimental results show that biometric privacy-enhanced face embeddings can be reconstructed with an accuracy of up to approximately 98%, depending on the complexity of the protection algorithm.