From Measurement to Mitigation: Quantifying and Reducing Identity Leakage in Image Representation Encoders with Linear Subspace Removal

• URL: http://arxiv.org/abs/2604.05296v1
• Date: Tue, 07 Apr 2026 01:03:51 GMT
• Title: From Measurement to Mitigation: Quantifying and Reducing Identity Leakage in Image Representation Encoders with Linear Subspace Removal
• Abstract summary: We propose a benchmark of visual embeddings that reports open-set verification at low false-accept rates and a one-shot linear projector that removes an estimated identity subspace.<n>Across CelebA-20 and VGGFace2, we show that these encoders are robust under open-set linear probes.<n>Our results establish the first attacker-calibrated facial privacy audit of non-FR encoders.
• Score: 9.492715910999749
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Frozen visual embeddings (e.g., CLIP, DINOv2/v3, SSCD) power retrieval and integrity systems, yet their use on face-containing data is constrained by unmeasured identity leakage and a lack of deployable mitigations. We take an attacker-aware view and contribute: (i) a benchmark of visual embeddings that reports open-set verification at low false-accept rates, a calibrated diffusion-based template inversion check, and face-context attribution with equal-area perturbations; and (ii) propose a one-shot linear projector that removes an estimated identity subspace while preserving the complementary space needed for utility, which for brevity we denote as the identity sanitization projection ISP. Across CelebA-20 and VGGFace2, we show that these encoders are robust under open-set linear probes, with CLIP exhibiting relatively higher leakage than DINOv2/v3 and SSCD, robust to template inversion, and are context-dominant. In addition, we show that ISP drives linear access to near-chance while retaining high non-biometric utility, and transfers across datasets with minor degradation. Our results establish the first attacker-calibrated facial privacy audit of non-FR encoders and demonstrate that linear subspace removal achieves strong privacy guarantees while preserving utility for visual search and retrieval.

Related papers

• Open-Set Visual Text Forensics via Sparse-Constraint Rectified Flow [11.434432702589868]
  Generative AI enables sophisticated visual text manipulations that increasingly evade current forensic detectors.<n>We propose a generative detector that localizes tampering by estimating the local restoration cost required to align a query image with authentic visual-text statistics.<n>Our method achieves state-of-the-art performance, surpassing the runner-up by 3.2 and 4.8 percentage points in F1 and IoU, respectively.
  arXiv  Detail & Related papers  (2026-08-03T14:03:27Z)
• REAL-OW: Rehearsal-free Open World Object Detection with Low-Rank Adaptation and Dual-Stage Objectness Modeling [56.888597798431704]
  Open-World Object Detection (OWOD) requires detectors to identify previously unseen objects as unknown and incrementally incorporate them into the set of known categories.<n>Existing frameworks rely heavily on exemplar replay to mitigate catastrophic forgetting, but in some real applications, storing raw data conflicts with data access restrictions and leads to data exposure risks.<n>We propose REAL-OW, a novel rehearsal-free framework that decouples incremental knowledge through a collaborative adapter architecture.
  arXiv  Detail & Related papers  (2026-07-03T06:38:54Z)
• SA-LIVO: Efficient LiDAR-Inertial-Visual Odometry with Subspace-Aware Degeneracy Handling [23.881618454598122]
  Tightly coupled LiDAR-visual-inertial odometry (LIVO) fuses precise geometric depth with complementary visual measurements.<n>Existing countermeasures operate at the modality level and leave the direction-dependent structure of the joint information matrix unaddressed.<n>We propose SA-LIVO, a LiDAR-inertial-visual odometry system addressing these limitations through direction-selective fusion and information-efficient processing.
  arXiv  Detail & Related papers  (2026-06-24T11:13:58Z)
• Where to Refine, When to Stop: Rethinking Redundancy via Latent Discrepancy for Efficient Visual Autoregressive Generation [50.139984798361375]
  We propose a training-free framework that removes redundancy via latent discrepancy.<n> LD-Pruning substantially reduces inference while maintaining high generation quality, achieving up to 2.35x speedup on Infinity-8B.
  arXiv  Detail & Related papers  (2026-05-29T19:34:39Z)
• LightSplit: Practical Privacy-Preserving Split Learning via Orthogonal Projections [54.51153206716027]
  Split learning (SL) enables collaborative training by partitioning a neural network across clients and a central server.<n>We propose LightSplit, which limits information exposure and reduces communication overhead by applying a lightweight fixed random projection at the cut layer.<n>Our results show that the method retains more than 95% of the baseline accuracy at up to 32x reduction in transmitted dimensionality.
  arXiv  Detail & Related papers  (2026-05-13T09:45:49Z)
• Privacy-Aware Video Anomaly Detection through Orthogonal Subspace Projection [14.631956899935721]
  Video anomaly detection (VAD) systems often prioritize accuracy while overlooking privacy concerns, limiting their suitability for real-world deployment.<n>We propose the Orthogonal Projection Layer (OPL), a lightweight module that removes task-irrelevant variations to produce representations focused on anomaly-relevant cues.<n>To address privacy risks in human-centered scenarios, we introduce Guided OPL (G-OPL), which suppresses facial attributes using weak supervision from face-presence signals while preserving non-identifying features such as pose and motion.
  arXiv  Detail & Related papers  (2026-05-09T03:46:39Z)
• Causal Bootstrapped Alignment for Unsupervised Video-Based Visible-Infrared Person Re-Identification [52.784239635604735]
  VVI-ReID is a critical technique for all-day surveillance, where temporal information provides additional cues beyond static images.<n>Existing approaches rely heavily on fully supervised learning with expensive cross-modality annotations, limiting scalability.<n>We propose a Causal Bootstrapped Alignment framework that explicitly exploits inherent video priors.
  arXiv  Detail & Related papers  (2026-04-17T02:15:59Z)
• LACE: Loss-Adaptive Capacity Expansion for Continual Learning [0.0]
  LACE (Loss-Adaptive Capacity Expansion) is an online mechanism that expands a model's representational capacity during training.<n>LACE requires no labels, no replay buffers, and no external controllers, making it suitable for on-device continual learning under resource constraints.
  arXiv  Detail & Related papers  (2026-03-30T15:58:33Z)
• Only Whats Necessary: Pareto Optimal Data Minimization for Privacy Preserving Video Anomaly Detection [28.081614331006477]
  Video anomaly detection (VAD) systems are increasingly deployed in critical safety environments and require a large amount of data for accurate detection.<n>However, data may contain personally identifiable information (PII), including facial cues and sensitive demographic attributes.<n>Only What's Necessary is a privacy-by-design framework for VAD that explicitly controls amount and type of visual information exposed to the detection pipeline.
  arXiv  Detail & Related papers  (2026-03-27T12:26:56Z)
• DELTA: Variational Disentangled Learning for Privacy-Preserving Data Reprogramming [20.87548031005583]
  We propose DELTA, a two-phase variational disentangled generative learning framework.<n>Phase I uses policy-guided reinforcement learning to discover feature transformations with downstream task utility, without any regard to privacy inferability.<n>Phase II employs a variational LSTM seq2seq encoder-decoder with a utility-privacy disentangled latent space design and adversarial-causal disentanglement regularization to suppress privacy signals.
  arXiv  Detail & Related papers  (2025-08-31T04:18:42Z)
• Backdoor Cleaning without External Guidance in MLLM Fine-tuning [76.82121084745785]
  Believe Your Eyes (BYE) is a data filtering framework that leverages attention entropy patterns as self-supervised signals to identify and filter backdoor samples.<n>It achieves near-zero attack success rates while maintaining clean-task performance.
  arXiv  Detail & Related papers  (2025-05-22T17:11:58Z)
• UGMAE: A Unified Framework for Graph Masked Autoencoders [67.75493040186859]
  We propose UGMAE, a unified framework for graph masked autoencoders. We first develop an adaptive feature mask generator to account for the unique significance of nodes. We then design a ranking-based structure reconstruction objective joint with feature reconstruction to capture holistic graph information.
  arXiv  Detail & Related papers  (2024-02-12T19:39:26Z)
• TeD-SPAD: Temporal Distinctiveness for Self-supervised Privacy-preservation for video Anomaly Detection [59.04634695294402]
  Video anomaly detection (VAD) without human monitoring is a complex computer vision task. Privacy leakage in VAD allows models to pick up and amplify unnecessary biases related to people's personal information. We propose TeD-SPAD, a privacy-aware video anomaly detection framework that destroys visual private information in a self-supervised manner.
  arXiv  Detail & Related papers  (2023-08-21T22:42:55Z)
• Small Object Detection via Coarse-to-fine Proposal Generation and Imitation Learning [52.06176253457522]
  We propose a two-stage framework tailored for small object detection based on the Coarse-to-fine pipeline and Feature Imitation learning. CFINet achieves state-of-the-art performance on the large-scale small object detection benchmarks, SODA-D and SODA-A.
  arXiv  Detail & Related papers  (2023-08-18T13:13:09Z)
• RARE: Robust Masked Graph Autoencoder [45.485891794905946]
  Masked graph autoencoder (MGAE) has emerged as a promising self-supervised graph pre-training (SGP) paradigm. We propose a novel SGP method termed Robust mAsked gRaph autoEncoder (RARE) to improve the certainty in inferring masked data.
  arXiv  Detail & Related papers  (2023-04-04T03:35:29Z)
• Over-the-Air Federated Learning with Privacy Protection via Correlated Additive Perturbations [57.20885629270732]
  We consider privacy aspects of wireless federated learning with Over-the-Air (OtA) transmission of gradient updates from multiple users/agents to an edge server. Traditional perturbation-based methods provide privacy protection while sacrificing the training accuracy. In this work, we aim at minimizing privacy leakage to the adversary and the degradation of model accuracy at the edge server.
  arXiv  Detail & Related papers  (2022-10-05T13:13:35Z)
• Dual Spoof Disentanglement Generation for Face Anti-spoofing with Depth Uncertainty Learning [54.15303628138665]
  Face anti-spoofing (FAS) plays a vital role in preventing face recognition systems from presentation attacks. Existing face anti-spoofing datasets lack diversity due to the insufficient identity and insignificant variance. We propose Dual Spoof Disentanglement Generation framework to tackle this challenge by "anti-spoofing via generation"
  arXiv  Detail & Related papers  (2021-12-01T15:36:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.