FaceCloak: Learning to Protect Face Templates

2025-04-08

AI Summary

Face templates are vulnerable to inversion attacks by generative models, leading to severe privacy leakage. To address this, we propose a template-level learnable binary “mask” mechanism that dynamically generates unique, reproducible binary perturbations in the feature space—ensuring both high recognition accuracy and cross-domain unlinkability. Our method employs a lightweight neural network to generate binary masks online, jointly optimizing template perturbation under privacy–utility constraints. It supports sensitive attribute suppression and generalizes to unseen feature extractors. Theoretically, we establish formal guarantees on unlinkability and recognition utility. Experiments demonstrate superior matching accuracy over state-of-the-art baselines and significantly enhanced robustness against template reconstruction attacks. The method incurs only 0.28 ms latency per inference and requires just 0.57 MB model storage.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Generation

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Generative models can reconstruct face images from encoded representations (templates) bearing remarkable likeness to the original face raising security and privacy concerns. We present FaceCloak, a neural network framework that protects face templates by generating smart, renewable binary cloaks. Our method proactively thwarts inversion attacks by cloaking face templates with unique disruptors synthesized from a single face template on the fly while provably retaining biometric utility and unlinkability. Our cloaked templates can suppress sensitive attributes while generalizing to novel feature extraction schemes and outperforms leading baselines in terms of biometric matching and resiliency to reconstruction attacks. FaceCloak-based matching is extremely fast (inference time cost=0.28ms) and light-weight (0.57MB).

Problem

• Protect face templates from reconstruction attacks
• Generate renewable binary cloaks for security
• Maintain biometric utility while suppressing sensitive attributes

Innovation

• Generates renewable binary cloaks for templates
• Proactively thwarts inversion attacks dynamically
• Ensures fast lightweight biometric matching