Have I Seen You? Embedding Behavior Signals Synthetic Face Dataset Membership

2026-07-31

AI Summary

This work addresses the privacy risks inherent in synthetic facial data, which, despite being designed to protect identities, may inadvertently leak information about the real datasets used to train their generators. The authors propose a dataset-level membership inference attack that first identifies the synthetic dataset employed to train a facial recognition model and then infers the underlying real source dataset. This approach reveals, for the first time, that synthetic face data retains identifiable traces of its original training data at the dataset level. By leveraging behavioral signal embeddings and conducting multi-model empirical analysis, the study systematically evaluates cross-model and cross-dataset privacy leakage. Experiments across 11 model–dataset combinations achieve 100% accuracy in identifying synthetic datasets and 54.5% accuracy in inferring their real source datasets.

Abstract

Synthetic face datasets are increasingly used to reduce privacy exposure and data access constraints in biometric recognition. Yet the generators that produce these datasets are trained on real faces, so synthetic data may still reveal their real source data. We study this risk through a dataset-level membership inference attack that first identifies the synthetic dataset used to train a face recognizer and then infers the real dataset used to train the generator. Across 11 face recognition models, 11 synthetic datasets, and 7 real datasets, the attack recovers the synthetic training dataset in 100% of cases and identifies the generator's source dataset in 54.5% of cases. These results show that synthetic data can retain dataset-level traces of real training data and that privacy-preserving deployment requires stronger leakage mitigation.

Problem

• synthetic face dataset
• membership inference
• privacy leakage
• biometric recognition
• dataset-level trace

Innovation

• membership inference attack
• synthetic face dataset
• privacy leakage
• face recognition
• dataset-level tracing