Abstract
Transformation-based privacy-preserving face recognition (PPFR) aims to verify identities while hiding facial data from attackers and malicious service providers. Existing evaluations mostly treat privacy as resistance to pixel-level reconstruction, measured by PSNR and SSIM. We show that this reconstruction-centric view fails. We present FaceLinkGen, an identity extraction attack that performs linkage/matching and face regeneration directly from protected templates without recovering original pixels. On three recent PPFR systems, FaceLinkGen reaches over 98.5\% matching accuracy and above 96\% regeneration success, and still exceeds 92\% matching and 94\% regeneration in a near zero knowledge setting. These results expose a structural gap between pixel distortion metrics, which are widely used in PPFR evaluation, and real privacy. We show that visual obfuscation leaves identity information broadly exposed to both external intruders and untrusted service providers.
Abstract (translated)
基于变换的隐私保护面部识别（PPFR）旨在验证身份的同时隐藏面部数据，防止攻击者和服务提供者的恶意行为。现有的评估方法大多将隐私视为抵抗像素级重建的能力，并通过PSNR和SSIM等指标进行衡量。我们表明这种以重建为中心的观点是失败的。为此，我们提出了一种名为FaceLinkGen的身份提取攻击方法，这种方法可以直接从受保护的模板中执行链接/匹配和面部再生操作，而无需恢复原始像素信息。在三个最近的PPFR系统上测试发现，FaceLinkGen能够达到超过98.5%的匹配准确率以及高于96%的成功再生率，在几乎零知识的情况下仍然能实现超过92%的匹配成功率和94%以上的再生成功概率。这些结果揭示了像素失真度量与真实隐私需求之间的结构性差距，广泛应用于PPFR评估中的视觉混淆手段实际上使身份信息暴露于外部入侵者和服务提供者的恶意行为中。
URL
https://arxiv.org/abs/2602.02914
