# Model Inversion meets Cryptographic Fuzzy Extractors

arXiv: https://arxiv.org/abs/2510.25687 · HTML: https://mlsanity.com/paper/2510.25687/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 28 of its 83 references that are in the map.
- First posted on arXiv 29 Oct 2025.

## Builds on (most cited first, 28 of 28)

- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Diffusion Models Beat GANs on Image Synthesis](https://mlsanity.com/paper/2105.05233/) (2021)
- [Zero-Shot Text-to-Image Generation](https://mlsanity.com/paper/2102.12092/) (2021)
- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Retrieval-Augmented Generation for Large Language Models: A Survey](https://mlsanity.com/paper/2312.10997/) (2023)
- [Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning](https://mlsanity.com/paper/1602.07261/) (2016)
- [Deep Leakage from Gradients](https://mlsanity.com/paper/1906.08935/) (2019)
- [VGGFace2: A dataset for recognising faces across pose and age](https://mlsanity.com/paper/1710.08092/) (2017)
- [Learning Face Representation from Scratch](https://mlsanity.com/paper/1411.7923/) (2014)
- [The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks](https://mlsanity.com/paper/1911.07135/) (2019)
- [A Self-Supervised Descriptor for Image Copy Detection](https://mlsanity.com/paper/2202.10261/) (2022)
- [Arc2Face: A Foundation Model for ID-Consistent Human Faces](https://mlsanity.com/paper/2403.11641/) (2024)
- [Variational Model Inversion Attacks](https://mlsanity.com/paper/2201.10787/) (2022)
- [Knowledge-Enriched Distributional Model Inversion Attacks](https://mlsanity.com/paper/2010.04092/) (2020)
- [Improving Robustness to Model Inversion Attacks via Mutual Information Regularization](https://mlsanity.com/paper/2009.05241/) (2020)
- [Re-thinking Model Inversion Attacks Against Deep Neural Networks](https://mlsanity.com/paper/2304.01669/) (2023)
- [Text Revealer: Private Text Reconstruction via Model Inversion Attacks against Transformers](https://mlsanity.com/paper/2209.10505/) (2022)
- [Bilateral Dependency Optimization: Defending Against Model-inversion Attacks](https://mlsanity.com/paper/2206.05483/) (2022)
- [Pseudo Label-Guided Model Inversion Attack via Conditional Generative Adversarial Network](https://mlsanity.com/paper/2302.09814/) (2023)
- [Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash](https://mlsanity.com/paper/2111.06628/) (2021)
- [Controllable Inversion of Black-Box Face Recognition Models via Diffusion](https://mlsanity.com/paper/2303.13006/) (2023)
- [Ranking Based Locality Sensitive Hashing Enabled Cancelable Biometrics: Index-of-Max Hashing](https://mlsanity.com/paper/1703.05455/) (2017)
- [A Cryptanalysis of Two Cancelable Biometric Schemes based on Index-of-Max Hashing](https://mlsanity.com/paper/1910.01389/) (2019)
- [A Genetic Algorithm Enabled Similarity-Based Attack on Cancellable Biometrics](https://mlsanity.com/paper/1905.03021/) (2019)
- [Neural Fuzzy Extractors: A Secure Way to Use Artificial Neural Networks for Biometric User Authentication](https://mlsanity.com/paper/2003.08433/) (2020)
- [Bernoulli honeywords](https://mlsanity.com/paper/2212.12759/) (2022)
- [A New Biometric Template Protection using Random Orthonormal Projection and Fuzzy Commitment](https://mlsanity.com/paper/1904.00264/) (2019)

## Abstract (arXiv)

Model inversion attacks pose an open challenge to privacy-sensitive applications that use machine learning (ML) models. For example, face authentication systems use modern ML models to compute embedding vectors from face images of the enrolled users and store them. If leaked, inversion attacks can accurately reconstruct user faces from the leaked vectors. A fuzzy extractor (FE) is a cryptographic primitive with properties that can help defend against model inversion, offering attack-agnostic security without requiring any re-training of the ML model it protects. To date, no systematic cryptanalysis of existing FE schemes that tolerate ℓ2 noise, as needed in modern ML-based face recognition systems, has been conducted. We perform the first in-depth security analysis of existing ℓ2-FE schemes showing that they offer weak security. We also show end-to-end inversion attacks that achieve high success rates in recovering original faces that are meant to be protected by FE schemes. We then offer a simple but new candidate scheme and prove its security formally. Our construction offers the first design point that offers practical runtime, stronger security, and usable accuracy for use in commodity ML-based face authentication.