A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert

• URL: http://arxiv.org/abs/2605.03857v1
• Date: Tue, 05 May 2026 15:20:38 GMT
• Title: A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert
• Abstract summary: This work presents a deeper analysis of the "irreversibility" of PolyProtect.<n>PolyProtect transforms embeddings into protected face embeddings.<n>We show that accuracy in the PolyProtected domain can be affected by the range in which the embedding elements lie.
• Score: 26.452129129071405
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: This work presents a deeper analysis of the "irreversibility" property of PolyProtect, a biometric template protection method initially proposed for securing face embeddings. PolyProtect transforms embeddings into protected templates via multivariate polynomials, whose coefficients and exponents are distinct for each subject enrolled in the face recognition system. A polynomial is applied to consecutive sets of elements from a given embedding, where the amount of overlap between the sets is a tunable parameter. We begin our irreversibility analysis by demonstrating that PolyProtected templates are easier to invert using a numerical solver based on cosine distance, as opposed to Euclidean distance (used in the earlier PolyProtect work). To make this inversion more difficult, we then propose a "key selection algorithm", which tries to choose "keys" (coefficients and exponents of the PolyProtect polynomial) that enhance the irreversibility of PolyProtected templates, compared to when the keys are purely random. Our experiments show that this algorithm is effective at generating PolyProtected templates that are significantly more difficult to invert, and that it approximately equalises the irreversibility of PolyProtected templates generated using different "overlap" parameters. This allows for better control of the irreversibility versus accuracy trade-off, known to exist across different overlaps. We also show that accuracy in the PolyProtected domain can be affected by the range in which the embedding elements lie, but that this can be improved by normalizing the embeddings prior to applying PolyProtect. This work is reproducible using our open-source code.

Related papers

• MIBP-Cert: Certified Training against Data Perturbations with Mixed-Integer Bilinear Programs [50.41998220099097]
  Data errors, corruptions, and poisoning attacks during training pose a major threat to the reliability of modern AI systems.<n>We introduce MIBP-Cert, a novel certification method based on mixed-integer bilinear programming (MIBP)<n>By computing the set of parameters reachable through perturbed or manipulated data, we can predict all possible outcomes and guarantee robustness.
  arXiv  Detail & Related papers  (2024-12-13T14:56:39Z)
• Power-Softmax: Towards Secure LLM Inference over Encrypted Data [2.4576879793338913]
  Homomorphic Encryption (HE) requires cryptographic methods to have an encrypted form. Previous approaches have either directly approximated pre-trained models with large-degrees over tenfold. We present a new variant of self-attention that offers a stable form for training and is easy to approximate with training.
  arXiv  Detail & Related papers  (2024-10-12T09:32:42Z)
• Enhancing Privacy in Face Analytics Using Fully Homomorphic Encryption [8.742970921484371]
  We propose a novel technique that combines Fully Homomorphic Encryption (FHE) with an existing template protection scheme known as PolyProtect. Our proposed approach ensures irreversibility and unlinkability, effectively preventing the leakage of soft biometric embeddings.
  arXiv  Detail & Related papers  (2024-04-24T23:56:03Z)
• A secure and private ensemble matcher using multi-vault obfuscated templates [1.3518297878940662]
  Generative AI has revolutionized modern machine learning by providing unprecedented realism, diversity, and efficiency in data generation. Biometric template security and secure matching are among the most sought-after features of modern biometric systems. This paper proposes a novel obfuscation method using Generative AI to enhance biometric template security.
  arXiv  Detail & Related papers  (2024-04-08T05:18:39Z)
• Homomorphic Polynomial Public Key Cryptography for Quantum-secure Digital Signature [0.7864304771129751]
  In their 2022 study, Kuang et al. introduced Multivariable Polynomial Public Key (MPPK) cryptography. They extended MPPK into Homomorphic Polynomial Public Key (HPPK), employing homomorphic encryption for large hidden ring operations.
  arXiv  Detail & Related papers  (2023-11-15T13:54:23Z)
• BoxPolyp:Boost Generalized Polyp Segmentation Using Extra Coarse Bounding Box Annotations [79.17754846553866]
  We propose a boosted BoxPolyp model to make full use of both accurate mask and extra coarse box annotations. In practice, box annotations are applied to alleviate the over-fitting issue of previous polyp segmentation models. Our proposed model outperforms previous state-of-the-art methods by a large margin.
  arXiv  Detail & Related papers  (2022-12-07T07:45:50Z)
• THE-X: Privacy-Preserving Transformer Inference with Homomorphic Encryption [112.02441503951297]
  Privacy-preserving inference of transformer models is on the demand of cloud service users. We introduce $textitTHE-X$, an approximation approach for transformers, which enables privacy-preserving inference of pre-trained models.
  arXiv  Detail & Related papers  (2022-06-01T03:49:18Z)
• Towards Protecting Face Embeddings in Mobile Face Verification Scenarios [0.0]
  PolyProtect is a method for protecting the sensitive face embeddings that are used to represent people's faces in neural-network-based face verification systems. PolyProtect is evaluated on two open-source face verification systems in a mobile application context. Results indicate that PolyProtect can be tuned to achieve a satisfactory trade-off between the recognition accuracy of the PolyProtected face verification system and the irreversibility of the PolyProtected templates.
  arXiv  Detail & Related papers  (2021-10-01T14:13:23Z)
• A Reinforcement Learning Environment for Polyhedral Optimizations [68.8204255655161]
  We propose a shape-agnostic formulation for the space of legal transformations in the polyhedral model as a Markov Decision Process (MDP) Instead of using transformations, the formulation is based on an abstract space of possible schedules. Our generic MDP formulation enables using reinforcement learning to learn optimization policies over a wide range of loops.
  arXiv  Detail & Related papers  (2021-04-28T12:41:52Z)
• Orthogonalizing Convolutional Layers with the Cayley Transform [83.73855414030646]
  We propose and evaluate an alternative approach to parameterize convolutional layers that are constrained to be orthogonal. We show that our method indeed preserves orthogonality to a high degree even for large convolutions.
  arXiv  Detail & Related papers  (2021-04-14T23:54:55Z)
• Computational Barriers to Estimation from Low-Degree Polynomials [81.67886161671379]
  We study the power of low-degrees for the task of detecting the presence of hidden structures. For a large class of "signal plus noise" problems, we give a user-friendly lower bound for the best possible mean squared error achievable by any degree. As applications, we give a tight characterization of the low-degree minimum mean squared error for the planted submatrix and planted dense subgraph problems.
  arXiv  Detail & Related papers  (2020-08-05T17:52:10Z)
• Preventing Imitation Learning with Adversarial Policy Ensembles [79.81807680370677]
  Imitation learning can reproduce policies by observing experts, which poses a problem regarding policy privacy. How can we protect against external observers cloning our proprietary policies? We introduce a new reinforcement learning framework, where we train an ensemble of near-optimal policies.
  arXiv  Detail & Related papers  (2020-01-31T01:57:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.