Abstract
Facial recognition technology poses significant privacy risks, as it relies on biometric data that is inherently sensitive and immutable if compromised. To mitigate these concerns, face recognition systems convert raw images into embeddings, traditionally considered privacy-preserving. However, model inversion attacks pose a significant privacy threat by reconstructing these private facial images, making them a crucial tool for evaluating the privacy risks of face recognition systems. Existing methods usually require training individual generators for each target model, a computationally expensive process. In this paper, we propose DiffUMI, a training-free diffusion-driven universal model inversion attack for face recognition systems. DiffUMI is the first approach to apply a diffusion model for unconditional image generation in model inversion. Unlike other methods, DiffUMI is universal, eliminating the need for training target-specific generators. It operates within a fixed framework and pretrained diffusion model while seamlessly adapting to diverse target identities and models. DiffUMI breaches privacy-preserving face recognition systems with state-of-the-art success, demonstrating that an unconditional diffusion model, coupled with optimized adversarial search, enables efficient and high-fidelity facial reconstruction. Additionally, we introduce a novel application of out-of-domain detection (OODD), marking the first use of model inversion to distinguish non-face inputs from face inputs based solely on embeddings.
Abstract (translated)
面部识别技术带来了重大的隐私风险，因为它依赖于敏感且一旦泄露便无法更改的生物识别数据。为了减轻这些担忧，面部识别系统将原始图像转换为嵌入（embeddings），这通常被认为可以保护隐私。然而，模型逆向攻击通过重建这些私人的面部图像构成了一个重要的隐私威胁，并成为评估面部识别系统的隐私风险的关键工具。现有的方法通常需要针对每个目标模型训练专用的生成器，这是一个计算成本高昂的过程。 本文提出了一种名为DiffUMI的新技术，这是一种无需训练、基于扩散驱动的通用模型逆向攻击方法，专门用于面部识别系统。DiffUMI是首个在模型逆向过程中应用无条件图像生成扩散模型的方法。与其它方法不同的是，DiffUMI具备普适性，不需要针对特定目标进行训练，而是在固定的框架和预训练的扩散模型内运行，并能轻松适应各种不同的目标身份及模型。 DiffUMI能够有效破解隐私保护型面部识别系统，展示了无条件扩散模型结合优化后的对抗搜索技术可以实现高效且高保真度的人脸图像重建。此外，本文还提出了一种新颖的应用——领域外检测（OODD），这是首次利用模型逆向攻击仅凭嵌入来区分非人脸输入和人脸输入的方法。 总的来说，这项研究展示了如何使用先进的机器学习方法来评估并提升面部识别系统的隐私保护能力，并为未来的研究提供了新的方向。
URL
https://arxiv.org/abs/2504.18015
