Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The authors of this paper propose  new method to reconstruct high-resolution realistic face images from
facial templates in a FR system. They focus on the template inversion attack against face recognition systems.
strength_and_weaknesses: 
Strength
- The motivation is very clear.
-  It is well written and the experimentation seems correct.
- Five different attacks and evaluated the vulnerability of SOTA FR systems to the proposed method are defined.

clarity,_quality,_novelty_and_reproducibility: - The novelty and scope appear limited and incremental. The main contribution in the paper is in using results in StyleGAN in  FR systems.
- The authors promise to make publicly available the experimentation code.

summary_of_the_review: The paper is clearly written and easy to read and understand. But the novelty and scope appear limited.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper studies the template inversion attack against face recognition (FR) systems. It uses results in the literature to train an encoder that generates the latent representation of StyleGAN and, using StyleGAN decoder, produces a realistic face, that is subsequently used to attack a FR system.

strength_and_weaknesses: Strength.

The paper addresses a relevant problem and proves an important vulnerability of present FR systems. It is well written and the experimentation seems correct.

Weaknesses.

My main complain is the title of the paper, that, in my opinion, is misleading. The main contribution in the paper is using results in the literature to engineer of a set of attacks of an inrceasing degree of difficulty proving in all of them the vulnerability of present FR systems. 

The face generation part is also relevant, but I would attribute the excellent performance of the attacks to StyleGAN's merits. From the experimentation in the paper it is not clear what is the contribution of the adversarial training. In your ablation you only analyze the contribution of (2) and (3), what about (4) and (5)?

clarity,_quality,_novelty_and_reproducibility: The paper is well written. The results are new, relevant and they can be reproduced. The authors promise to make publicly available the experimentation code.
summary_of_the_review: The paper proves how vulnerable are present FR systems to the template inversion attack even if the intruder does not know the model used to produce the template nor the FR algorithm.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In this paper, they focus on the template inversion attack against face recognition systems. Within a generative adversarial network (GAN)-based framework,  learn a mapping from facial templates to the intermediate latent space of a pre-trained face generation network. their proposed method achieves high success attack rates in white box and black box scenarios.
strength_and_weaknesses: Strength
1.using a pre-trained StyleGAN3 network and learned a mapping from facial templates to intermediate latent space of StyleGAN within a GAN-based framework
2. proposed method for whitebox and blackbox scenarios
3. defined five different attacks and evaluated the vulnerability of SOTA FR systems to our proposed method.

Weaknesses
1. More details about the method
2. More details about the attacks
3. More analysis on white and black box

clarity,_quality,_novelty_and_reproducibility: Clarity
Low

Quality
Good

Novelty 
Medium

Reproducibility
Medium
summary_of_the_review: The paper presented a method for better resolution using Style GAN.
Its structure and methods looks good and novel, however, more details in mythology and presentation is needed.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper focuses on template inversion attack against face recognition systems and proposes a method to reconstruct face images from facial templates. In a GAN-based framework, a mapping from facial templates to the intermediate latent space of a pre-trained face generation network is learned, from which high-resolution reconstructed face images can be generated. The proposed method can be
applied in whitebox and blackbox attacks against face recognition systems. 

strength_and_weaknesses: The main contributions of the paper are:
-	A method to generate high-resolution realistic face images from facial templates. Within a GAN-based framework, the mapping from facial templates to the latent space of a pre-trained face generation network is learned.
-	The method is proposed for whitebox and blackbox attack scenarios. The method is based on the whitebox knowledge of the face recognition model, and it then extended to an attack blackbox scenario, using another face recognition model that the adversary has access to.

There are some aspects in the paper that need clarification:
-	In my opinion the novelty of the paper is limited. The proposed method mainly relies on StyleGAN3 for face reconstruction. 
-	Due to the social security and ethical implications of this works, authors could have described possible solutions to mitigate the effect of the proposed attacks.  
-	Authors did not discuss the results in a good way. It is not clear which are the limitations of the method, and which are the case some reconstructions are not well recognized. No examples are given of such cases. 

clarity,_quality,_novelty_and_reproducibility: The paper is clearly writen and easy to read and understand. 

The technical novelty is limited in my opinion because the proposed method mainly relies on StyleGAN3 for face reconstruction. 

Details for reproducibility are given.
summary_of_the_review: The paper is clearly written and easy to read and understand. 

In my evalaution I weighted more the weaknesses and the fact the actual novelty contribution is limited.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: # Summary of Contribution

This paper describes an approach to template-inversion attach against face recognition systems. The authors propose a generative model to reconstruct face images from facial templates. Using a pre-trained StyleGAN, whose encoder space is aligned with facial template images, and the StyleGAN encoder, the proposed system reconstructs face images that are able to fool trained facial recognition systems with high accuracy. The authors show through experimental results how the approach can be applied in blackbox and whitebox scenarios.

# Strengths

+ **Generality**: The main strength of the paper lies in its methodical consideration of a range of application attack scenarios. The authors define five different scenarios that depend on the knowledge of the face recognition system available to the attacker.

+ **Empirical Evaluation**: The experimental results provide convincing evidence that the proposed approach is effective in blackbox and whitebox scenarios.

# Weaknesses

+ **Novelty**: The novelty of the approach is quite limited as it is largely based on StyleGAN for face generation, with the addition of latent space alignment with facial template images (something which has become standard practice in the broader learning literature using GANs). The *application* is novel, but the overall approach is incremental with respect to the existing literature.

+ **Focus of Contribution**: Related to the previous point, the main contribution of this work is on the adversarial attack application and not so much on the representation learning. To be clear, the application is novel and the empirical evaluation is convincing, however given the focus of the contribution it seems somewhat out of place at ICLR.

+ **Limited Comparisons**: The four compared techniques from the literature (Table 2) are somewhat limited, in particular the more recent reported results of Duong et al. (2020) and Truong et al. (2022) are significantly better than the included baselines and are comparable (at least on LFW) to the proposed approach. While it is understandably limiting the lack of published code, a discussion of them (and even qualified inclusion in the table) along with a critical comparison with proposed approach is in order.

# Summary

There was a lively discussion among the reviewers and area chair about this paper. The reviewers and AC were all in agreement about the quality of the submitted paper, however they were equally unanimous in their opinion that the main contribution  of the work is primarily focused on the adversarial attack application scenarios and that the technical/theoretical contributions to representation learning are incremental and limited. 

Finally, there is additional related literature that should be carefully considered, for example:

      Yang, Lu, Qing Song, and Yingqi Wu. "Attacks on state-of-the-art
      face recognition using attentional adversarial attack generative
      network." Multimedia tools and applications 80.1 (2021):
      855-875.

which uses an attentional VAE, and:

      Li, Dongze, et al. "Exploring adversarial fake images on face
      manifold." Proceedings of the IEEE/CVF Conference on Computer
      Vision and Pattern Recognition. 2021.

which takes StyleGAN latent-space approach similar to that proposed in this paper (although the specific goal is not adversarial attacks on FR systems).

In summary, while the paper makes the empirical case for the proposed approach, it does not contain enough novel contribution to meet the bar for acceptance at ICLR.

justification_for_why_not_higher_score: Despite the net positive evaluations by the reviewers, the relatively small and incremental contribution of the work makes it fall short of the bar for acceptance to ICLR. The positive opinions of the reviewers were mostly based on the application and the considered application scenarios (amply clarified during the reviewer-AC teleconference).
Decision: Reject