SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Hatef Otroshi Shahreza<sup>1,2</sup> and Sébastien Marcel<sup>1,3</sup>
<sup>1</sup>Idiap Research Institute, Martigny, Switzerland
École Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland
<sup>3</sup>Université de Lausanne (UNIL), Lausanne, Switzerland
{hatef.otoreshi,sebastien.marcel}@idiap.ch
Reconstructed
0.815
Figure 1: Sample face images from the FFHQ dataset and their corresponding reconstructed images using our template inversion method from ArcFace templates (used in a face recognition system). The values below each image show the cosine similarity between the corresponding templates of original and reconstructed face images.
In this paper, we focus on the template inversion attack against face recognition systems and propose a new method to reconstruct face images from facial templates. Within a generative adversarial network (GAN)-based framework, we learn a mapping from facial templates to the intermediate latent space of a pre-trained face generation network, from which we can generate high-resolution realistic reconstructed face images. We show that our proposed method can be applied in whitebox and blackbox attacks against face recognition systems. Furthermore, we evaluate the transferability of our attack when the adversary uses the reconstructed face image to impersonate the underlying subject in an attack against another face recognition system. Considering the adversary's knowledge and the target face recognition system, we define five different attacks and evaluate the vulnerability of state-of-the-art face recognition systems. Our experiments show that our proposed method achieves high success attack rates in whitebox and blackbox scenarios. Furthermore, the reconstructed face images are transferable and can be used to enter target face recognition systems with a different feature extractor model. We also explore important areas in the reconstructed face images that can fool the target face recognition system.
Face recognition (FR) systems tend toward ubiquity, and their applications, which range from cell phone unlock to national identity system, border control, etc., are growing rapidly. Typically, in such systems, a feature vector (called embedding or template) is extracted from each face image using a deep neural network, and is stored in the system's database during the enrollment stage. During the recognition stage, either verification or identification, the extracted feature vector is compared with the ones in the system's database to measure the similarity of identities. Among potential attacks against FR systems [Galbally et al., 2014, Biggio et al., 2015, Hadid et al., 2015, Mai et al., 2018, Marcel et al., 2023], the template inversion (TI) attack significantly jeopardizes the users' privacy. In a TI attack, the adversary gains access to templates stored in the FR system's database and aims to reconstruct the underlying face image. Then, the adversary not only achieves privacy-sensitive information (such as gender, ethnicity, etc.) of enrolled users, but also can use reconstructed face images to impersonate.
In this paper, we focus on the TI attack against FR systems and propose a novel method to reconstruct face images from facial templates (Figure 1 shows sample reconstructed face images using our proposed method). Within a generative adversarial network (GAN)-based framework, we learn a mapping from face templates to the intermediate latent space of StyleGAN3 [Karras et al., 2021], as a pre-trained face generation network. Then, using the synthesis part of StyleGAN3, we can generate high-resolution realistic face image. Our proposed method can be applied for whitebox and blackbox attacks against FR systems. In the whitebox scenario, the adversary knows the internal functioning of the feature extraction model and its parameters. However, in the blackbox scenario, the adversary does not know the internal functioning of the feature extraction model and can only use it to extract features from any arbitrary image. Instead, we assume that the adversary has a whitebox of another FR model, which can be used for training the face reconstruction network. We also evaluate the transferability of our attack by considering the case where the adversary uses the reconstructed face image to impersonate the underlying subject in an attack against another FR system (which has a different feature extraction model). Considering the adversary's knowledge and the target FR system, we define five different attacks, and evaluate the vulnerability of state-of-the-art (SOTA) FR systems. Figure 2 illustrates the general black diagram of our proposed template inversion attack.
To elaborate on the contributions of our paper, we list them hereunder:
- We propose a novel method to generate high-resolution realistic face images from facial templates. Within a GAN-based framework, we learn the mapping from facial templates to the latent space of a pre-trained face generation network.
- We propose our method for whitebox and blackbox scenarios. While our method is based on the whitebox knowledge of the FR model, we extend our attack blackbox scenario, using another FR model that the adversary has access to.
- We define five different attacks against FR systems (based on the adversary's knowledge and the target system), and evaluate the transferability of the reconstructed face images and vulnerability of SOTA FR models to TI attacks. We also explore important areas in the reconstructed face images. To our knowledge, this is the first work which comprehensively evaluates the transferability of the reconstructed face images in TI attacks.
The remainder of the paper is organized as follows: Section 2 introduces the problem formulation and our proposed face reconstruction method. Section 3 covers the related works in the literature and
Figure 2: Block diagram of our proposed template inversion attack
compares them with our proposed method. Section 4 presents our experiential results. Finally, the paper is concluded in Section 5.
2 Problem Definition and Proposed Method
In this paper, we consider a TI attack against a FR system based on the following threat model:
- Adversary's goal: The adversary aims to reconstruct a face image from a template, and use the reconstructed face image to enter the same or a different face recognition system, which we call the target FR system.
- Adversary's knowledge: The adversary knows a face template of a user enrolled in the FR system's database. The adversary also has either whitebox or blackbox knowledge of the feature extractor model in the same FR system.
- Adversary's capability: The adversary can present the reconstructed face image to the target FR system (e.g., using a printed photograph). However, for simplicity, we consider that adversary can inject the reconstructed face image as a query to the target FR system.
- Adversary's strategy: The adversary can train a face reconstruction model to invert facial templates and reconstruct underlying face images. Then, the adversary can use the reconstructed face images to inject as a query to the target FR system, to enter that system.
Let  $F(\cdot)$  denote a facial feature extraction model, which gets the face image  $I \in \mathcal{I}$  and extracts facial template  $\pmb{x} = F(I) \in \mathcal{X}$ . According to the threat model, the adversary has access to the target facial template  $\pmb{x}_{\mathrm{database}} = F_{\mathrm{database}}(I)$  and aims to generate a reconstructed face image  $\hat{I}$ . Then, the adversary can use the reconstructed face image  $\hat{I}$  to impersonate the corresponding subject and attack a target FR system with  $F_{\mathrm{target}}(\cdot)$ , which might be different from  $F_{\mathrm{database}}(\cdot)$ .
To train a face reconstruction model, we can use a dataset of face images  $\{I_i\}_{i=1}^N$  with  $N$  face images (no label is required), and generate a training dataset  $\{(x_i, I_i)\}_{i=1}^N$ , where  $x_i = F_{\text{database}}(I_i)$ . Then, a face reconstruction model  $G(.)$  can be trained to reconstruct face image  $\hat{I} = G(x)$  given each facial template  $x \in \mathcal{X}$ . To train such a face reconstruction model, we consider a multi-term face reconstruction loss function as follows:
$$
\mathcal {L} _ {\text {r e c}} = \mathcal {L} _ {\text {p i x e l}} + \mathcal {L} _ {\text {I D}}, \tag {1}
$$
where  $\mathcal{L}_{\mathrm{pixel}}$  and  $\mathcal{L}_{\mathrm{ID}}$  indicate pixel loss and ID losses, respectively, and are defined as:
$$
\mathcal {L} _ {\text {p i x e l}} = \mathbb {E} _ {\boldsymbol {x} \sim \mathcal {X}} \left[ \| \boldsymbol {I} - G (\boldsymbol {x}) \| _ {2} ^ {2} \right], \tag {2}
$$
$$
\mathcal {L} _ {\mathrm {I D}} = \mathbb {E} _ {\boldsymbol {x} \sim \mathcal {X}} [ \| F _ {\text {l o s s}} (\boldsymbol {I}) - F _ {\text {l o s s}} (G (\boldsymbol {x})) \| _ {2} ^ {2} ]. \tag {3}
$$
The pixel loss is used to minimize the pixel-level reconstruction error of the generated face image. The ID loss is also used to minimize the distance between facial templates extracted by  $F_{\mathrm{loss}}(.)$  from original and reconstructed face images. In Eq. 3,  $F_{\mathrm{loss}}(.)$  denotes a feature extraction model that the adversary is assumed to have complete knowledge of its parameters and internal functioning. Based on the adversary's knowledge of  $F_{\mathrm{database}}(.)$  (i.e., whitebox or blackbox scenarios),  $F_{\mathrm{loss}}(.)$  might be the same or different from  $F_{\mathrm{database}}(.)$ .
For the face reconstruction model, we consider StyleGAN3 [Karras et al., 2021], as a pre-trained face generation network<sup>1</sup>. The StyleGAN3 model is trained on a dataset of face images using a GAN-based framework that can generate high-resolution and realistic face images. The structure of StyleGAN3 is composed of two networks, mapping and synthesis networks. The mapping network  $M_{\text{StyleGAN}}(\cdot)$  gets a random noise  $z \in \mathcal{Z}$  and generates an intermediate latent code  $\boldsymbol{w} = M_{\text{StyleGAN}}(z) \in \mathcal{W}$ . Then, the latent code  $\boldsymbol{w}$  is given to the synthesis network  $S_{\text{StyleGAN}}(\cdot)$  to generate a face image. In our training process, we fix the synthetic network  $S_{\text{StyleGAN}}(\cdot)$  and train a new mapping  $M_{\text{rec}}(\cdot)$  to generate  $\hat{\boldsymbol{w}}$  corresponding to the given facial template  $\boldsymbol{x} \in \mathcal{X}$ . Then, the generated latent code  $\hat{\boldsymbol{w}}$  is given to the synthesis network  $S_{\text{StyleGAN}}(\cdot)$  to generate the reconstructed face image  $\hat{\boldsymbol{I}} = S_{\text{StyleGAN}}(\hat{\boldsymbol{w}})$ . We can
<sup>1</sup>While we use StyleGAN3 in our experiments, our method can also be used with other face generator networks. In our experiment in Section A.3 of the appendix, we use StyleSwin [Zhang et al., 2022] as the face generator network and Figure 7 of the appendix shows reconstructed face images of our method using StyleSwin.
train our new mapping  $M_{\mathrm{rec}}(.)$  using our reconstruction loss function as in Eq. 1. However, to obtain a realistic face image from the generated  $\hat{w}$  through the pre-trained synthetic network  $S_{\mathrm{StyleGAN}}(.)$ , the generated  $\hat{w}$  needs to be in the distribution  $\mathcal{W}$ ; otherwise, the output may not look like a real human face. Hence, to generate  $\hat{w}$  vectors such that they have the same distribution as StyleGAN's intermediate latent,  $\boldsymbol{w} \in \mathcal{W}$ , we use a GAN-based framework to learn the distribution  $\mathcal{W}$ . To this end, we use the Wasserstein GAN (WGAN) [Arjovsky et al., 2017] algorithm to train a critic network  $C(.)$  which critiques the generated  $\hat{w}$  vectors compared to the real StyleGAN's  $\boldsymbol{w} \in \mathcal{W}$  vectors, and simultaneously we optimize our mapping network to generate  $\hat{w}$  vectors with the same distribution as  $\mathcal{W}$ . Hence, we can consider our mapping network  $M_{\mathrm{rec}}(.)$  as a conditional generator in our WGAN framework, which generates  $\hat{w} = M_{\mathrm{rec}}([n, x])$  given a facial template  $x \in \mathcal{X}$  and a random noise vector  $n \in \mathcal{N}$ . Then, we can train our mapping network and critic network using the following loss functions:
$$
\mathcal {L} _ {C} ^ {\mathrm {W G A N}} = \mathbb {E} _ {\boldsymbol {w} \sim \mathcal {W}} [ C (\boldsymbol {w}) ] - \mathbb {E} _ {\hat {\boldsymbol {w}} \sim M _ {\mathrm {r e c}} ([ \boldsymbol {n}, \boldsymbol {x} ])} [ C (\hat {\boldsymbol {w}}) ] \tag {4}
$$
$$
\mathcal {L} _ {M _ {\mathrm {r e c}}} ^ {\mathrm {W G A N}} = \mathbb {E} _ {\hat {\boldsymbol {w}} \sim M _ {\mathrm {r e c}} ([ \boldsymbol {n}, \boldsymbol {x} ])} [ C (\hat {\boldsymbol {w}}) ] \tag {5}
$$
In a nutshell, we train a new mapping network  $M_{\mathrm{rec}}(\cdot)$  using our reconstruction loss function in Eq. 1, and also optimize  $M_{\mathrm{rec}}(\cdot)$  within our WGAN framework using Eq. 5. Simultaneously, we also train the critic network  $C(\cdot)$  within our WGAN training using Eq. 4 to learn the distribution of StyleGAN's intermediate latent space  $\mathcal{W}$  and help our mapping network  $M_{\mathrm{rec}}(\cdot)$  to generate vectors with the same distribution as  $\mathcal{W}$ . Figure 3 depicts the block diagram of the proposed method. We should note that our mapping network  $M_{\mathrm{rec}}(\cdot)$  has 2 fully connected layers with Leaky ReLU activation function.
Figure 3: Block diagram of our face reconstruction network.
In our problem formulation, we consider three different feature extraction models, including  $F_{\text{database}}(.), F_{\text{loss}}(.),$  and  $F_{\text{target}}(.).$  Hence, based on the adversary's knowledge and the target system, we can consider five different attacks:
- Attack 1: The adversary has whitebox knowledge of the system from which the template is leaked and wants to attack the same system (i.e.,  $F_{\text{database}} = F_{\text{loss}} = F_{\text{target}}$ ).
- Attack 2: The adversary has whitebox knowledge of the feature extractor of the system from which the template is leaked, but aims to attack to a different FR system (i.e.,  $F_{\text{database}} = F_{\text{loss}} \neq F_{\text{target}}$ ).
- Attack 3: The adversary wants to attack the same system from which the template is leaked, but has only blackbox access to the feature extractor of the system. Instead, we assume that the adversary has the whitebox knowledge of another FR model to use for training (i.e.,  $F_{\text{database}} = F_{\text{target}} \neq F_{\text{loss}}$ ).
- Attack 4: The adversary aims to attack a different FR system than the one from which the template is leaked. In addition, the adversary has whitebox knowledge of the feature extractor of the target system (i.e.,  $F_{\text{database}} \neq F_{\text{loss}} = F_{\text{target}}$ ).
- Attack 5: The adversary aims to attack a different FR system from which the template is leaked and has only blackbox knowledge of both the target system and the one from which the template is leaked. However, the adversary instead has the whitebox knowledge of another FR model to use for training (i.e.,  $F_{\text{database}} \neq F_{\text{loss}} \neq F_{\text{target}}$ ).
In the attack 1 and attack 2, the adversary has the whitebox knowledge of the system from which the template is leaked (i.e.,  $F_{\mathrm{database}}(.)$ ) and uses the same model as  $F_{\mathrm{loss}}(.)$  for training the reconstruction network. However, in attacks 3-5, the adversary has the blackbox knowledge of the system from which the template is leaked, and therefore uses another FR model as  $F_{\mathrm{loss}}(.)$ . Comparing the knowledge
Table 1: Comparison of different attacks in this paper.
Fdatabase	Floss	Evaluation	Adversary's Knowledge of Original and Target Systems	Difficulty of Attack
Attack 1	whitebox	Fdatabase	same system	whitebox knowledge of Fdatabase and Ftarget	very easy
Attack 2	whitebox	Fdatabase	different system (transferability)	whitebox knowledge of Fdatabase	easy
Attack 3	blackbox	adversary's own	same system	blackbox knowledge of Fdatabase and Ftarget	difficult
Attack 4	blackbox	Ftarget	different system (transferability)	blackbox knowledge of Fdatabase and whitebox knowledge of Ftarget	difficult
Attack 5	blackbox	adversary's own	different system (transferability)	only blackbox knowledge of Fdatabase	very difficult
of the adversary in these attacks, we expect that attack 1 be the easiest attack for the adversary and attack 5 be the most difficult one. Table 1 compares adversary's knowledge and difficulty of different attacks defined in this paper.
3 Related Works
Table 2 compares our proposed method with related works in the literature. Generally, the methods for TI attack against FR systems, can be categorized based on different aspects, including the resolution of generated face images (high/low resolution), the type of attack (whitebox/blackbox attack), and the basis of the method (optimization/learning-based).
Zhmoginov and Sandler [2016] proposed an optimization-based method and a learning-based method to generate low-resolution face images in the whitebox attack against FR systems. In their optimization-based attack, they used a gradient-descent-based approach to find an image that minimizes the distance of the face template as well as some regularization terms to generate a smooth image, including the total variation and Laplacian pyramid gradient normalization [Burt and Adelson, 1987] of the reconstructed face image. In their learning-based attack, they trained a convolutional neural network (CNN) with the same loss terms to generate face images from given facial templates.
Cole et al. [2017] proposed a learning-based attack to generate low-resolution images using a multi-layer perceptron (MLP) to estimate landmark coordinates and a CNN to generate face textures, and then reconstructed face images using a differentiable warping based on estimated landmarks and face texture. They trained their networks in an end-to-end fashion, and minimized the errors for landmark estimation and texture generation as well as the distance of face template as their loss function. To extend their method from the whitebox attack to the blackbox attack, they proposed not to minimize the distance of face templates in their loss function.
Mai et al. [2018] proposed a learning-based attack to generate low-resolution images in the blackbox attack against FR systems. They proposed new convolutional blocks, called neighborly deconvolution blocks A/B (shortly, NbBlock-A and NbBlock-B), and used these blocks to reconstruct face images. They trained their proposed networks using two loss functions, including pixel loss (i.e.,  $\ell_2$  norm of reconstruction pixel error) and perceptual loss (i.e.,  $\ell_2$  norm of distance for intermediate features of VGG-19 [Simonyan and Zisserman, 2014] given original and reconstructed face images). They
Table 2: Comparison with related works.
Reference	Resolution	Basis	White/Black-box	Transferability Eval.	Available code
Zhmoginov and Sandler [2016]	low	1) optimization 2) learning	whitebox	✘	✘
Cole et al. [2017]	low	learning	both*	✘	✘
Mai et al. [2018]	low	learning	blackbox	✘	✓
Duong et al. [2020]	low	learning	both**	✘	✘
Truong et al. [2022]	low	learning	both**	✘	✘
Ahmad et al. [2022]	low	learning	blackbox	✘	✘
Dong et al. [2021]	high	learning	blackbox	✘	✓
Vendrow and Vendrow [2021]	high	optimization	blackbox	✘	✓
Dong et al. [2023]	high	optimization	blackbox	✘	✓
Ours	high	learning	both***	✓	✓
*The method is based on the whitebox attack, and is extended to blackbox by removing a loss term that required the FR model.
\*\* The method is based on the whitebox attack, and the blackbox attack is performed by knowledge distillation of the FR model.
\*\*\* The method is based on the whitebox attack, and is extended to blackbox using a different FR model.
defined two types of attacks and compared the reconstructed face images with the same (type 1) or different (type 2) image of the same subject. However, they did not evaluate the transferability of reconstructed face images.
Duong et al. [2020] and Truong et al. [2022] used a same bijection learning framework and trained a GAN with a generator with structure of PO-GAN [Karras et al., 2017] and TransGAN [Jiang et al., 2021], respectively. While their method is based on the whitebox attack, they proposed to use knowledge distillation to extend to the blackbox attack. To this end, they trained a student network that mimics the target FR model. However, they did not provide any details (nor source code) about student network training, such as the structure of the student network, etc.
Ahmad et al. [2022] used a GAN-based face reconstruction network to generate low-resolution face images in the blackbox scenario. They focus on the size of training dataset and proposed a method to learn the reconstruction network with less training data. While using GAN-based approach, sample reconstructed face images in their paper do not look realistic and suffer from many artifacts.
Dong et al. [2021] used a pre-trained StyleGAN to generate high-resolution face images in the black-box attack against FR systems. They generated synthetic face images using pre-trained StyleGAN and extracted their templates. Then, they trained a fully connected network using mean squared error to map extracted templates to the corresponding noise in the input space  $\mathcal{Z}$  of StyleGAN. In contrast, Vendrow and Vendrow [2021], instead of a learning-based approach, used a grid search optimization using the simulated annealing [Van Laarhoven and Aarts, 1987] approach to find the noise  $z\in \mathcal{Z}$  in the input of StyleGAN, which generates an image that has the same template. As their iterative method has a large computation cost, they evaluated their method on 20 images only. Along the same lines, Dong et al. [2023] also tried to solve a similar optimization to [Vendrow and Vendrow, 2021] with a different approach. They used the genetic algorithm to find the noise  $z\in \mathcal{Z}$  in the input of StyleGAN that can generate an image with the same template.
Compared to most works in the literature that generate low-resolution face images, our proposed method generates high-resolution realistic face images. While low-resolution reconstructed images can be used for evaluating the vulnerability of FR systems under some assumptions, high-resolution images can lead to different types of presentation attacks against FR systems. Previous works in the literature for reconstructing high-resolution face images [Vendrow and Vendrow, 2021, Dong et al., 2021, 2023] tried to find an appropriate noise  $z \in \mathcal{Z}$  in the input of StyleGAN that can generate an image with a similar template. However, the input of StyleGAN  $z \in \mathcal{Z}$  is a noise and is difficult to control and optimize. In contrast, the intermediate latent space  $\mathcal{W}$ , which we use in our paper, is more controllable<sup>2</sup>. However, finding appropriate latent code  $w \in \mathcal{W}$  in the intermediate space of StyleGAN that can generate an image with a similar facial template is challenging for two reasons. First, for a learning-based approach, we do not have correct values of  $w \in \mathcal{W}$  for each real face image to directly use for training the mapping from face templates to the intermediate latent space  $\mathcal{W}$  of StyleGAN. Second, as described in Section 2, the mapped latent code should be in the same the intermediate latent space  $\mathcal{W}$  of StyleGAN, otherwise the generated image is not face-like.