FaceLinkGen: Rethinking Identity Leakage in Privacy-Preserving Face Recognition with Identity Extraction

TL;DR

FaceLinkGen demonstrates that pixel-level distortion metrics used in privacy-preserving face recognition do not reflect true identity leakage. By distilling identity embeddings from protected templates and regenerating identity-consistent faces via diffusion, the authors show strong linkage and regeneration capabilities across multiple SOTA PPFR methods, even under near-zero-knowledge scenarios. This reveals a structural gap between visual distortions and actual privacy, advocating an identity-centric evaluation standard and practical defenses such as secret-key or cryptographic approaches. The work underscores the real-world privacy risks posed by PPFR templates and motivates a reevaluation of privacy guarantees in face recognition systems.

Abstract

Transformation-based privacy-preserving face recognition (PPFR) aims to verify identities while hiding facial data from attackers and malicious service providers. Existing evaluations mostly treat privacy as resistance to pixel-level reconstruction, measured by PSNR and SSIM. We show that this reconstruction-centric view fails. We present FaceLinkGen, an identity extraction attack that performs linkage/matching and face regeneration directly from protected templates without recovering original pixels. On three recent PPFR systems, FaceLinkGen reaches over 98.5\% matching accuracy and above 96\% regeneration success, and still exceeds 92\% matching and 94\% regeneration in a near zero knowledge setting. These results expose a structural gap between pixel distortion metrics, which are widely used in PPFR evaluation, and real privacy. We show that visual obfuscation leaves identity information broadly exposed to both external intruders and untrusted service providers.

Figures (6)

• Figure 1: Regeneration attack results. In each subplot, the left is the original image and the right is the regenerated image from the protected template. Each row shows examples from one PPFR method, in the order of PartialFace, MinusFace, and FracFace.
• Figure 2: SSIM and PSNR are not always correlated with identity correlation.
• Figure 3: Using pixel-level loss or StyleGAN will yield unsuccessful reconstruction compared to our ID-guided method.
• Figure 4: After our model is trained, two main attack vectors can be performed: linkage and re-generation.
• Figure 5: Controlled generation examples. The top left image is the image used to register, the top right image is produced by Arc2Face, and the bottom image is generated by DreamO based on the top right image. All images are prompted with "a person playing guitar in the street" and all are verified by Face++ with a FAR of 1e-5. Even with blurry register images, our method still works.