FaceCloak: Learning to Protect Face Templates

TL;DR

FaceCloak tackles template inversion in face recognition by learning a renewable binary hash of length $d=64$ that combines a single unprotected template with positive and negative disruptors. It trains a shallow network with losses $L_{id}$, $L_{bin}$, and $L_{div}$ to produce a binary cloak $h \in {-1,+1}^d$ that preserves biometric utility while being difficult to invert. Empirical results on LFW and CFP with ArcFace and FaceNet show minimal biometric loss after cloaking, strong irreversibility (SAR often 0), and high unlinkability, with a tiny footprint and fast inference ($0.28$ ms). The approach is keyless and renewable, capable of suppressing demographic attributes like gender and generalizing to new extractors, making it practical as an add-on with low overhead.

Abstract

Generative models can reconstruct face images from encoded representations (templates) bearing remarkable likeness to the original face, raising security and privacy concerns. We present \textsc{FaceCloak}, a neural network framework that protects face templates by generating smart, renewable binary cloaks. Our method proactively thwarts inversion attacks by cloaking face templates with unique disruptors synthesized from a single face template on the fly while provably retaining biometric utility and unlinkability. Our cloaked templates can suppress sensitive attributes while generalizing to novel feature extraction schemes and outperform leading baselines in terms of biometric matching and resiliency to reconstruction attacks. \textsc{FaceCloak}-based matching is extremely fast (inference time =0.28 ms) and light (0.57 MB). We have released our \href{https://github.com/sudban3089/FaceCloak.git}{code} for reproducible research.

Figures (1)

• Figure 1: (a)FaceCloak framework. For an input image, a pre-trained face template extractor produces the unprotected face template. During enrollment, we first produce $k$positive and $k$negative disruptors from the single face template and then train our lightweight network with the $2k+1$ (including the original template) inputs supervised using biometric identity, binarization and diversity loses resulting in protected enrolled template. During verification, we pass the query template through the trained FaceCloak and compare with the enrolled template using Hamming distance (HD). Our method does not require user-specific seed or keys and can produce renewable disruptors, resulting in an automatically secure randomized network with biometric retention. (b) Examples of original images from the LFW dataset, the inverted outputs of their respective unprotected templates and the corresponding inverted outputs of positive (noise and mask), and negative (orthogonalization and synthetic) disruptors used in FaceCloak. We used Arc2Face Arc2face to perform the inversion.