Face Reconstruction from Facial Templates by Learning Latent Space of a Generator Network
Authors: Hatef Otroshi Shahreza
Sébastien Marcel
Venue: NeurIPS 2023 poster (2023)
Keywords: Face Recognition (FR)
Face reconstruction
Generative Adversarial Network (GAN)
Privacy
Security
Template Inversion (TI) attack
Transferability
TL;DR: A new method to reconstruct high-resolution face images from facial templates in template inversion attacks against face recognition systems with comprehensive transferability evaluation

Abstract: In this paper, we focus on the template inversion attack against face recognition systems and propose a new method to reconstruct face images from facial templates. Within a generative adversarial network (GAN)-based framework, we learn a mapping from facial templates to the intermediate latent space of a pre-trained face generation network, from which we can generate high-resolution realistic reconstructed face images. We show that our proposed method can be applied in whitebox and blackbox attacks against face recognition systems. Furthermore, we evaluate the transferability of our attack when the adversary uses the reconstructed face image to impersonate the underlying subject in an attack against another face recognition system. Considering the adversary's knowledge and the target face recognition system, we define five different attacks and evaluate the vulnerability of state-of-the-art face recognition systems. Our experiments show that our proposed method achieves high success attack rates in whitebox and blackbox scenarios. Furthermore, the reconstructed face images are transferable and can be used to enter target face recognition systems with a different feature extractor model. We also explore important areas in the reconstructed face images that can fool the target face recognition system.

Face Reconstruction from Facial Templates by Learning Latent Space of a Generator Network
Hatef Otroshi Shahreza' 1.2 and Sébastien Marcel 'diiap Research Institute, Martigny, Switzerland école Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland Universitéé de Lausanne (UNIL), Lausanne, Switzerland (hatef. otroshi, sebastieeeee. enn www.mmaaacceeeeeeeee @idiap..c ch
Original
Reconstructed
0.815
0.629
0.618
0.728
0.602
0.742
Figure 1: Sample face images from the FFHQ dataset and their corresponding reconstructed images using our template inversion method from ArcFace templates (used in a face recognition system). The values below each image show the cosine similarity between the corresponding templates of original and reconstructed face images.
Abstract
In this paper, we focus on the template inversion attack against face recognition systems and propose new method to reconstruct face images from facial templates. Within a generative adversarial network (GAN)-based framework, we learn a mapping from facial templates to the intermediate latent space of pre-trained face generation network, from which we can generate high-resolution realistic reconstructed face images. We show that our proposed method can be applied whitebox and blackbox attacks against face recognition systems. Furthermore, we evaluate the transferability of our attack when the adversary uses the reconstructed face image to impersonate the underlying subject in attack against another face recognition system. Considering the adversary's 's knowledge and the target face recognition system, define five different attacks and evaluate the vulnerability of state-of-the face recognition systems. Our experiments show that our proposed method achieves high success attack rates in whitebox and blackbox scenarios. Furthermore, the reconstructed face images are transferable and can be used to enter target face recognition systems with different feature extractor model. We also explore important areas in the reconstructed face images that can fool the target face recognition system.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Introduction
Face recognition (FR) systems tend toward ubiquity, and their applications, which range from cell phone unlock to national identity system, border control, etc., are growing rapidly. Typically, such systems, a feature vector (called embedding template) is extracted from each face image using deep neural network, and is stored in the system's 's database during the enrollment stage. During the recognition stage, either verification identification, the extracted feature vector is compared with the ones the system's 's database to measure the similarity of identities. Among potential attacks against FR systems Galbally et al.) 2014 Biggio et al., 2015 Hadid et al. 2015 Mai al. 2018 Marcel et al. 2.23]. the template inversion (TT) attack significantly jeopardizes the users' privacy.
In TI attack, the adversary gains access templates stored in the FR system's 's database and aims to reconstruct the underlying face image. Then, the adversary not only achieves privacy-sensitive information (such as gender, ethnicity, etc.) of enrolled users, but also can use reconstructed face images to impersonate.
In this paper, focus on the TI attack against FR systems and propose novel method to reconstruct face images from facial templates (Figure T shows sample reconstructed face images using our proposed method). Within a generative adversarial network (GAN) framework,
learn mapping from face templates to the intermediate latent space StyleGAN3 [Karras et al. [021]. as pre-trained face generation network. Then, using the synthesis part of StyleGAN3, we can generate high-resolution realistic face image. Our proposed method can be applied for whitebox and blackbox attacks against FR systems. In the whitebox scenario, the adversary knows the internal functioning of the feature extraction model and its parameters. However, in the blackbox scenario, the adversary does not know the internal functioning of the feature extraction model and can only use it extract features from any arbitrary image. Instead, we assume that the adversary has a whitebox of another FR model, which can be used for training the face reconstruction network. We also evaluate the transferability of our attack by considering the case where the adversary uses the reconstructed face image impersonate the underlying subject in an attack against another FR system (which has different feature extraction model). Considering the adversary's 's knowledge and the target FR system, we define five different attacks, and evaluate the vulnerability of state-of ofte-oof-hhears (SOTA) FR systems. Figure Niguree]illssteenn illlstraaes the general black diagram of our proposed template inversion attack.
To elaborate the contributions of our paper, list them hereunder:
We propose novel method to generate high-resolution realistic face images from facial templates. Within GAN-based framework, we learn the mapping from facial templates to the latent space of a pre-trained face generation network.
We propose method for whitebox and blackbox scenarios. While our method is based on the whitebox knowledge of the FR model, we extend our attack blackbox scenario, using another FR model that the adversary has access
We define five different attacks against FR systems (based on the adversary's 's knowledge and the target system), and evaluate the transferability of the reconstructed face images and vulnerability of SOTA FR models to TI attacks. We also explore important areas in the reconstructed face images. To our knowledge, this is the first work which comprehensively evaluates the transferability of the reconstructed face images in TI attacks.
The remainder of the paper is organized as follows: Section 2 introduces the problem formulation and our proposed face reconstruction method. Section 3 covers the related works in the literature and
FR system from which the lemplate leaked 1 F
Fooe Reconstraction Network (tmined using Fi..)
Target FR system (Feps)
Noose
Database
Festure Extraction Vamteee
Mapping Network
StyletAAN' Synthesis Netwurks
Feature Retraction
Databose
Template x0
(Furg)
Compart
Labent Space (al-Afuu (In
Roconstracted Face Image (1)
Recsgmizad
Lonked Template
Injecting the Reconstructed Face Image
Figure 2: Block diagram of our proposed template inversion attack

---

compares them with our proposed method. Section presents our experiential results. Finally, the paper concluded in Section [
2 Problem Definition and Proposed Method
In this paper, we consider a Tl attack against FR system based on the following threat model:
Adversary's goal: The adversary aims to reconstruct face image from template, and use the reconstructed face image to enter the same or a different face recognition system, which we call the target FR system.
Adversary's 's knowledge: The adversary knows face template of enrolled in the FR system's database. The adversary also has either whitebox or blackbox knowledge of the feature extractor model in the same FR system.
Adversary's capability: The adversary can present the reconstructed face image to the target FR system (c.g., using printed photograph). However, for simplicity, we consider that adversary inject the reconstructed face image query to the target FR system.
Adversary's 's strategy: The adversary can train face reconstruction model to invert fa- cial templates and reconstruct underlying face images. Then, the adversary can use the reconstructed face images to inject as query to the target FR system, to enter that system.
Let F(.) denote a facial feature extraction model. which gets the face image I and extracts facial template a F(I)= E X. According to the threat model, the adversary has access to the target facial template &database d'aatahase (I) and aims to generate a reconstructed face image Í. Then, the the reconstructed face image to impersonate the corresponding subject and attack a target FR system with (-), which might be different from Fdatabesc (-)-
adversary
To train face reconstruction model, we can use dataset of face images N { with face images (no label required), and generate a training dataset {(x,, I)); where x; Fastabase (I.). Then, a face reconstruction model G(.) can be trained to reconstruct face image = G(x) given each facial template E X. To train such a face reconstruction model, consider multi-term face reconstruction loss function as follows:
Lree Cpisel + LID:
where Lpisel and Lip indicate pixel loss and ID losses, respectively, and are defined as:
picel R ((
(2)
LD Exaxx Flass (I) Fisss (G()))
The pixel loss used to minimize the pixel-level reconstruction error of the generated face image. The ID loss is also used to minimize the distance between facial templates extracted by (.)ss.) from original and reconstructed face images. In Eq. Fioes (.) denotes a feature extraction model that the adversary is assumed to have complete knowledge of its parameters and internal functioning. Based on the adversary's knowledge of Fdatahase (-) (i.e., whitebox or blackbox scenarios), Floss (-) might be the same or different from dataabase (-)-
For the face reconstruction model, we consider StyleGAN3 Karras et al. 2021] as a pre-trained face generation network? The StyleGAN3 model is trained on a dataset of face images using a GAN-based framework that can generate high-resolution and realistic face images. The structure StyleGAN3 is composed of two networks, mapping and synthesis networks. The mapping network MSyLAGAN() gets a random noise z E Z and generates an intermediate latent code w = MSSyaUAN (2) E W. Then, the latent code is given to the synthesis network SSIyEGANN() to generate face image. In training process, we fix the synthetic network SSYyleGAN() and train a new mapping (-) to generate vè corresponding to the given facial template X. Then, the generated latent code úo given the synthesis network SSyylGAAN() to generate the reconstructed face image i SShyAGAAN (w). We can
While we use StyleGAN3 in our experiments, our method can also be used with other face generator networks. In our experiment in Section of the appendix, we use StyleSwin (Zhang et al. [022) as the face generator network and Figure of the appendix shows reconstructed face images of method using StyleSwin.

---

train our new mapping (.) using our reconstruction loss function as in Eq. However, to obtain realistic face image from the generated vo through the pre-trained synthetic network SSIyLeGAN the generated tü needs to be in the distribution W: otherwise, the output may not look like a real human face. Hence, to generate vectors such that they have the same distribution as StyleGAN's intermediate latent, w W. we use GAN-based framework to learn the distribution W. To this end, we use the Wasserstein GAN (WGAN) [Arjovsky et al. 2017) algorithm to train critic network C()) which critiques the generated ve vectors compared to the real StyleGAN's simultaneously we optimize our mapping network to generate v vectors with the same distribution as consider our mapping network (.e(.) (.) conditional generator in our WGAN
E W vectors, and
W. Hence, framework, which generates v0 Mas (12,, æ)) given a facial template x E X and a random noise vector N. Then, can train our mapping network and critic network using the following loss functions:
CWGANN Ewww(C(ww] Bin (nn (C(()))(( [C(w)) Le
(4)
CWGAN Eran ((n (n) [C(b))]
(5)
In a nutshell, we train a new map- ping network (.) using our re- construction loss function in Eq. [ and also optimize Mrec-) (-) within our WGAN framework using Eq. | Si- multaneously, also train the critic network C(.) within our WGAN train- ing using Eq. 4 to learn the distribu- tion of StyleGAN's intermediate la- tent space W and help our mapping network (.) to generate vectors with the same distribution as W. Fig- depictss the block diagram of the proposed method. We should note that our mapping network (.)e has 2 fully connected layers with Leaky ReLU activation function.
Space
(w-W)
Noise (# E 2)
StyleGAN's Mapping Network
Critic
C
WGAN
Network
L LGAAN
fake
Max
Noise W)
Mapping Network (Ours)
StyleGAN's Synthesis Network
Lyre
Template
(* X)
Latent Space (sio M. ([na())))))
Reconstructed Face Image (f)
Figure 3: Block diagram of our face reconstruction network.
In our problem formulation, we consider three different feature extraction models, including Fdntabaso (.), Frees( (.), and (.).ee()). Hence, based on the adversary's 's knowledge and the target system, we can consider five different attacks:
The adversary has whitebox knowledge of the system from which the template is leaked and wants to attack the same system (i.c., Fdatabase Flsss Fiarget).
Attack 1:
Attack 2: The adversary has whitebox knowledge of the feature extractor of the system from which the template is leaked, but aims to attack to different FR system (i.e., d'dttabas Flss # Fmnget)
Attack 3: The adversary wants attack the same system from which the template is leaked, but has only blackbox access to the feature extractor of the system. Instead, we assume that the adversary has the whitebox knowledge of another FR model to use for training (i.e.,
F Fastabuse = Furget + Fiuss).
Attack 4: The adversary aims to attack a different FR system than the one from which the template is leaked. In addition, the adversary has whitebox knowledge of the feature extractor of the target system (i.e., Fantabuse # Floss Furget)
Attack 5: The adversary aims to attack different FR system from which the template is leaked and has only blackbox knowledge of both the target system and the one from which the template leaked. However, the adversary instead has the whitebox knowledge of another FR model to use for training (i.e., Fdatabuue o Fines o Funget).
In the attack and attack 2, the adversary has the whitebox knowledge the system from which the template is leaked (i.e., (ittaaasee)) (-)) and uses the same model as Fross)) for training the reconstruction network. However, attacks 3-5, the adversary has the blackbox knowledge of the system from which the template is leaked, and therefore uses another FR model as Floss (.). Comparing the knowledge

---

Table 1: Comparison of different attacks in this paper.
Adversary's Knowledge of
F Fastabase
Fiess
Evaluation
Original and Target Systems
Difficulty of Attack
Attack
whitebox
P Panibase
same system
whitehox knowledge of Fantuse and Firger
very easy
different system
Attack 2
whitebox
Fanaiuse
(trnnferabilitt)
whitebox knowledge of Fánuinas
easy
Attack 3
blackhox
adversary's
system
blackbox knowledge of Fauatse and Farget
difficult
different system
blackbox knowledge of Frantuo and whitebox knowledge of Fieest
Attuck
blackbox
Funget
(trasferability)
difficult
different system (tranferabillity)
Attack 5
blackbox
adversury's own
only blackbox knowledge of Fanhue
very difficult
of the adversary in these attacks, expect that attack be the easiest attack for the adversary and attack be the most difficult one. Table Tobble/commpe comparee adversary's knowledge and difficulty different attacks defined in this paper.
3 Related Works
our proposed method with related works in the literature. Generally, the methods for TI attack against FR systems, can be categorized based on different aspects, including the resolution of generated face images (high/low resolution), the type of attack (whitebox//lacckoxx attack), and the basis of the method (optimization/lemming -bsedd.
Zhmoginov and Sandler [2016] proposed an optimization-based method and a learning-based method to generate low-resolution face images in the whitebox attack against FR systems. In their optimization-base attack, they used gradient-descent-base
approach to find an image that minimizes the distance the face template as well as some regularization terms generate smooth image, including the total variation and Laplacian pyramid gradient normalization [Burt and Adelson 1987] of the reconstructed face image. In their learning-basse bbased attack, they trained a convolutional neural network (CNN) with the same loss terms to generate face images from given facial templates.
Cole al. 2017] proposed a learning- based attack to generate low-resolution images using multi- layer perceptron (MLP) to estimate landmark coordinates and a CNN to generate face textures, and then reconstructed face images using differentiable warping based estimated landmarks and face texture. They trained their networks in an end-to-end fashion, and minimized the errors for landmark estimation and texture generation as well as the distance of face template their loss function. To extend their method from the whitebox attack to the blackbox attack, they proposed not to minimize the distance of face templates their loss function.
Mai et al. 2018 proposed a learning- attack against FR systems. They proposed new convolutional blocks, called neighborly deconvolution blocks A/B (shortly, NbBlock-A and NbBlock-B) -B), and used these blocks to reconstruct face images. They trained their proposed networks using two loss functions, including pixel loss (i.e., & norm of reconstruction pixel error) and perceptual loss (i.e., &2 norm of distance for intermediate features of VGG-19 (Simonyan and Zisserman 2014 given original and reconstructed face images). They
attack to generate low-resolution images in the blackbox
Table 2: Comparison with related works.
Reference
Resolution Basis
White/Black-box Transferability Eval. Available code
1) optimization
Zhmoginov Sandler 2016
low
whitebox
2) learning
Cole ct al.
2017
low
learning
both"
Mai ct al.
2018
low
learning
blackbox
Duong al.
2020
low
learning
both"*
Truong et
2022
low learning
both"*
Ahmad et
2022
low learning
blackbox
Dong al.
2021
high learning high optimization blackbox
blackbox
Dong Vendrow 2021
Vendrow
high optimization
blackbox
Ours
high learning
both ***
The method is based on the whitebox attack, and is extended to blackbox by removing loss term that required the FR model. The method hased whitebox attack, and blarkbox attack is performed knowledge distillation model. ww* The method based on the whitebor attack, and extended to blackbos using different FR model.
5

---

defined two types of attacks and compared the reconstructed face images with the same (type 1) or different (type 2) image of the same subject. However, they did not evaluate the transferability of reconstructed face images.
Duong al. 2020 and and (Tuong al. 2022) used same bijection learning framework and trained a GAN with a generator with structure of PO-GAN [Krraas et al., 2017] and TransGAN [Jiang al. 2021]. respectively. While their method is based on the whitebox attack, they proposed to use knowledg distillation to extend to the blackbox attack. To this end, they trained a student network that mimics the target FR model. However, they did not provide any details (nor source code) about student network training, such as the structure of the student network, etc.
Ahmad et al. 2022] used -asN- face reconstruction network to generate low- now-resolution face images in the blackbox scenario. They focus on the size of training dataset and proposed a method to learn the reconstruction network with less training data. While using GAN-based approach, sample reconstructed face images in their paper do not look realistic and suffer from many artifacts.
Dong al. 202 used a pre-trained StyleGAN to generate high-resolution face images in the black- box attack against FR systems. They generated synthetic face images using pre-trained StyleGAN and extracted their templates. Then, they trained fully connected network using mean squared error to map extracted templates to the corresponding noise in the input space Z of StyleGAN. In contrast, Vendrow and Vendrow [2021], instead of learning- based approach, used a grid search optimization using the simulated annealing (Van Laarhoven and Aarts 1987] approach to find the noise & E Z in the input of StyleGAN, which generates an image that has the same template. As their iterative method has a large computation cost, they evaluated their method on 20 images only. Along the same lines, Dong al. [2023] also tried to solve a similar optimization to [Vendrow and Vendrow 2021 with a different approach. They used the genetic algorithm to find the noise z E Z in the input of StyleGAN that can generate an image with the same template.
Compared to most works in the literature that generate low-resolution face images, our proposed method generates high-resolution realistic face images. While resoluttntion reconstructed images can be used for evaluating the vulnerability of FR systems under some assumptions, nigh-resolution images can lead to different types of presentation attacks against FR systems. Previous works in the literature for reconstructing high-resolution face images /Vendrow and Vendrow] [2021] Dong et al., 2021 2023) tried to find an appropriate noise z E 2 in the input of StyleGAN that can generate an image with a similar template. However, the input of StyleGAN z E 2 is a noise and is difficult to control and optimize. In contrast, the intermediate latent space W, which
in our paper, is more controllable However, finding appropriate latent code w E W in the intermediate space of StyleGAN that can generate an image with a similar facial template is challenging for two reasons. First, for a learning-based approach, we do not have correct values of w E W for each real face image to directly use for training the mapping from face templates to the intermediate latent space W of StyleGAN, Second, as described in Section 2 the mapped latent code should be in the same the intermediate latent space W of StyleGAN, otherwise the generated image is not face-like.
We should also note that, unlike most works in the literature, we propose our method for both whitebox and blackbox scenarios and evaluate the transferability of our attack. Similar to (Cole et al. 2017 Duong et al.] [020 Truong et al.) 2022), our method is based on the whitebox knowledge of FR model, however our approach for extending our method to the blackbox attack using another FR model has not been used in TI attacks. Last but not least, we define five different attacks against FR systems and evaluate the vulnerability of SOTA FR models our attacks. To our knowledge, this is the first paper in which the transferability of reconstructed face images in TI attacks has been investigated.
4 Experiments
In this section, we present our experiments and discuss our results. First, in Section experimental setup. Then, we present our experimental results in Section 4.2 and discuss our findings.
4.1 we describe
Several papers in the literature used the intermediate latent space W of StyleGAN for image editing Roich al. 2022 Alaluf et al. 2022 Hu al. 2022

---

4.1 Experimental Setup
To evaluate the performance of our method,
Table 3: Recognition performance of face recognition models used in experiments in terms of true match rate (TMR) at the thresholds correspond to false match rates (FMRs) of 10-2 and 10-3 evaluated on the MO- BIO and LFW datasets. The values are in percentage.
we consider two SOTA FR model in-
cluding ArcFace [Deng et al. 2019), Elas- ticFace [Boutros et al.) 2022 the mod- els from which templates are lcaked (i.c., F. For transferability evaluation, we also use three different FR models with SOTA backbones from FaceX-Zoo [Wang]
MOBIO
LFW
model
FMR=10
FMR=10
FMR=10
FMR-10
et al. 2021], including HRNet ( [Wang et al.
ArcFace
100.00
99.98
97.60
96.40
2020), AttentionNet [Wang al.] 2017].
ElasticFace
100.00
100.00
96.87
94.70
HRNet
98.98
98.23
89.30
78.43
and Swin [iu et al. 2021]. J. for the target
AttentionNet
99.71
97.73
84.27
72.77
FR system (i.e., Fiurget). The recognition performance of these models are reported in Table 3 All these models are trained on MS-CelebIM M dataset [Guo et al.) 2016]. We assume that the adversary does not have access to the FR training dataset, and therefore we use another dataset for training our face reconstruction models. To this end, we use the Flickr-Faces HQ (FFHQ) dataset [Karras et al. [211)). which consists of 70,000
Swin
99.75
98.98
91.70
87.83
nigh-resolution (i.e., 1024 x 1024) face images (without identity labels) crawled from the internet. We use 90% random portion of this dataset for training, and the remaining 10% for validation.
To evaluate different attacks against FR systems, we consider two other face image datasets with iden- tity labels, including the MOBIO [McCool et al. [2133] and Labeled Faces in the Wild (LFW) [Huang al. 2007] datasets. The MOBIO dataset consists of bi-modal (face and voice) data captured using mobile devices from 150 people in 12 sessions (6-1 samples in each session). The LFW dataset includes 13,233 face images of 5,749 people collected from the internet, where 1,680 people have two or more images.
For each of the attacks described in Section 2 we build one or two separate FR systems with two SOTA FR models based on the attack type. If the target system is the same as the system from which the template is leaked, have only one FR system. Otherwise, if the target system is different the system from which the template is leaked, we have two FR systems with two different feature extractors. In each case, we use one of evaluation datasets (i.e., MOBIO and LFW) build both FR systems (so that the subject with the leaked template be enrolled in the target system too). In each evaluation, we assume that the target FR system is configured at the threshold corresponding to false match rate (FMR) of 10-3, and we evaluate the adversary 's success attack rate (SAR) in entering that system.
We should note that the templates extracted by the aforementioned FR models have 512 dimensions. The input noise standard normal distribution and has 512 dimensions. The input noise n E W to our mapping network Mna(-) is with dimension of 8 and also from the standard normal distribution. We also use Adam Kingma and Ba 2015) optimizer to train our mapping network
Z to the mapping network of StyleGAN's pre-trained network is from the
4.2 Analysis
In this section, we consider SOTA FR models and evaluate the performance of our face reconstruction method in five different attacks described in Section 2 We also explore the effect of our WGAN training as well as effect of loss terms as our ablation study. In addition, explore important areas in the reconstructed face images that lead to success TI attack. Finally, we discuss limitations of our face reconstruction model.
Whitebox Knowledge of Fdatabase For attacks 1-2, the adversary is assumed to have whitebox knowledge of the system from which the template is leaked (i.c., Fdatabase) and use the same feature extraction model for training (i.e., Fress), thus in such cases Floss Faatabase- We considered AreFace
'hiile use three different face recognition models in our problem formulation, since these models applied in separate stages, as our experiments Section Section[A.4] of appendix shows. there no issue the inputs and outputs (e.g., pre-processing steps or dimensions) he different in each of these face recognition models. 'ource code of our experiment is available at: httpgiiilaa.diiiccb//bbbeeeeeeee pap.. __cee___________
7

---

Table 4: Evaluation of attacks with whitebox knowledge of the system from which the template is leaked (i.e., Finss d against SOTA FR models in terms of adversary's 's success attack rate (SAR) using our proposed method on the MOBIO and LFW datasets. The values are in percentage and correspond to the threshold where the target system has FMR = 10-3. Cells are color coded
according the type of attack as defined in Section 2 for attack ( lighht gray and attack 2 ( dark gray
MOBIO
LFW
F Fdatabuse
ArcFace ElasticFace HRNet AttentionNet Swin
ArcFace ElasticFace HRNet AttentionNet Swin
ArcFace 92.38
81.90
71.43
70.48
74.29
86.82
74.20
36.57
36.40
58.86
FlasticFace
78.10
87.62
64.29
64.76
69.05
78.25
82.52
41.80
40.25
61. .9
Table 5: Evaluation of attacks (with blackbox knowledge of the system from which the template is leaked i.e., (databasee) against SOTA FR models in terms of adversary's success attack rate (SAR) using different methods on the MOBIO and LFF datasets. The values are in percentage and correspond to
the threshold where the target system has FMR- = 10 MI: NbNetB-M [Mai et al., 2018). M2:
NbNetB-P [Mai et al. 2018 M3: [Dong et al., 2021]. M4: [Vendrow and Vendrow 2021] and M5:
[Dong et al. 2023]. Cells are color coded according the type of attack as defined in Section for
attack 3 ( lightest gray ), attack 4 ( middle dark gray ), and attack 5 darkest gray )
MOBIO
LFW
F Faacahase
Piess
Furget
M1
M2
M3
M4
M5
Ours
M1
M2
M3
M4
M5
Ours
AreFace
1.90 15.24
2.38
28.10
58.57
81,90
10.68
40.25
12.91
58.88
75.31
77.16
ElasticFace
1.43 11.43
4.29
15.24
37.61
73.81
8.36
34.39
6.35
29.10
50.17
68.06
ArcFace
ElasticFace
HRNet
0.95 6.19
2.86
10.00
30.48
57.14
1.30
7.78
1.75
9.20
24.72
28.45
AttentionNet
6.67
3.33
4.29
26.67
54.29
1.33
7.17
2.29
9.17
24.16
28.87
Swin
1,43 13.33
3.81
10.95
40.00
67.14
4.27
23.85
5.97
21.75
41.27
48.28
AreFace
2.38 18.57
2,86
16.19
48.09
87.14
15.33
48.67
11.81
37.45
65.40
83.20
ElasticFace
3.81
43.81
4.76
43.33
72.38
89.05
21.44
58.16
11.59
52.88
74.08
83.43
ElasticFace
ArcFace
HRNett
0.48
20.00
1.43
10.48
42.
86
73.81
3.46
18.36
2.74
11.82
32.99
49.02
AttentionNet
1.90
18.10
3.33
9.05
40.00
71.90
2.89
16.31
2.91
10.95
31.15
46.63
Swin
0.95 26.19
2.86
15.24
46.67
75.24
9.22
38.79
8.26
24.62
51.20
66.89
and ElasticFace models and reconstructed face images from the templates extracted by these models in attacks against different FR systems. Table 4 reports the vulnerability of different target systems to our attack 5 1-2 in terms of adversary's 's SAR at the system's 's FMR of 10-3, Similar results for the system's is FMR of 10-2 are reported in Table of the appendix. According to these tables, our method achieves considerable SAR against ArcFace and ElasticFace target systems in attack 1. In attack 2, we observe that there is a degradation in SAR with respect to attack 1. However, the reconstructed face images can still be used to enter another target system. Meanwhile, the FR model with a higher recognition accuracy is generally more vulnerable to attack 2. For instance, when ArcFace is considered as Fdatabase. observe that ElasticFace and Swin have the highest SAR as target systems, while there is the same order for their recognition performance in Table
Blackbox Knowledge of Fdatabase For attacks 3-5, the adversary is assumed to have blackbox knowledge of the system from which the template is leaked (i.e., Fddaabaas) and use another feature extraction model for training (i.e.. Fisss). therefore in such cases Fooss + Fdatabaase. Table 5 compares the performance of our method with blackbox method in the literature [Mai et al., 2018 Dong et al.
2021 Vendrow and Vendrow 2021 Dong et al. 2023 for attacks 3-5 in terms of adversary' 's SAR at
system's 's FMR of 10 Similar results for the FMR of 10 are available in Table 8 of the appendix.
As these tables show, our proposed method achieves the highest SAR compared to Mai et al. 2018 Dong al. 2021 Vendrow and Vendrow 2 Dong et al. 2023 against FR systems on the MOBIO and LFW datasets. In particular, in attack 5 which is the hardest attack, where Fattauuee Fives and Forger are different, the results show that the target FR system is still vulnerable to our attack. The results of our method for attack 5 also show transfcrability of our attack to different FR systems. Similar to attack 2, we can also observe that in attack 5, the FR model with a higher recognition accuracy is generally more vulnerable to our attack.
'We should highlight that the whitebox methods reported in Table we could not compare our method with whitebox methods Table 2 'The other blackbox methods in the literature do not have available source code and we could not reproduce their results.
2 do not have available source code, and
8

---

Figure Jlsso shows sample face images from the LFW dataset and the reconstructed images using our proposed method from ArcFace templates in different attacks. We should highlight that as show in Figure 4 the reconstructed face images in attack and attack 2 are the same, but they are used to enter different target FR system. The same holds for the reconstructed face images attacks 3-5.
Original
Attacks 1-2
Ablation Study To evaluate the effect of WGAN in training our mapping network and the effect of each term in our loss function (i.e., Eq.
0.723
0.682
0.704
П}. we consider the ArcFace model the white- box scenario and train different face reconstruc- tion networks with different loss functions. Then, we attack system with the ArcFace model a feature extractor (i.e., attack 1) and compare the SARs as reported in Table 6 According these results, the proposed adversarial training has significant effect our face reconstruction method. Because we fix the synthesis network of StyleGAN, the mapped latent codes need to be of the same distribution as W. Otherwise, the generated image is not face-like and training fails to converge. The WGAN training in our method helps our mapping network learn the distribution of StyleGAN's intermediate latent space, and thus the synthesis network generates face-like images. When we use the WGAN training and based on the results in Table 6 the ID loss has high impact on the performance of the template inversion model. While the pixel loss Tose by itself does not achieve good performance, it improves the performance of ID loss in our reconstruction loss function in Eq. [ This table confirms that the proposed WGAN training and our reconstruction loss function lead to more successful attack. More experiments for ablation study on the effect of different elements in our proposed method are presented in the appendix.
Attacks
0.702
0.650
0.662
Figure 4: Sample face images from the LFW dataset (first raw) and their corresponding re- constructed images using our template inversion method from ArcFace templates different at- tacks, attacks 1-2 (second raw) and attacks 3-5 (second raw, using ElasticFace for Floas). The val- ues below each image show the cosine similarity between the corresponding ArcFace templates of original and reconstructed face images.
Table 6: Evaluating the effect of each loss term in our loss function in attack I against ArcFace in terms of SAR in the system with FMRs of 10-2 and 10-3 evaluated on the MOBIO and LFW datasets. The values are in percentage.
WGAN training
Reconstruction
MOBIO
LFW
(Eqs. and 5
Loss Function
FMR=10-2
FMR-10-3
FMR=10-2
F0R-10-3
Lix Eginel + LID
100.00
92.38
93.64
86.82
Ln LiD
98.10
82.38
90.56
80.74
L Epinel
0
0
0.65
0.07
Live Lpinel + LiD
0
0
0.32
0.02
Lis LTD
0
0.14
0.02
Lns Ppieel
0
0
0.44
0.09
Important Areas in the Reconstructed Face Images As another experiment, we explore important areas in the reconstructed face images. Finding these areas help us to investigate what features between the original template and synthetic images fool the face recognition system, and therefore we can understand what information is encoded in the facial templates. To this end, we apply the Grad-Can [Selvaraju et al., 2017] algorithm using the face recognition model on the reconstructed face images to see which areas of the reconstructed face images are important and cause the facial templates of our reconstructed face images to be close results of applying the Grad-Cam algorithm on sample reconstructed face images using our proposed method. As the results this figure show, important areas that cause the reconstructed face images to have similar templates to the original ones correspond to areas such eyes, nose, lips, etc. In
original facial templates. Figure shows

---

0.773
0.738
0.661
0.768
0.695
Figure 5: Sample face images from the FFHQ dataset and the corresponding important areas in the reconstructed face images using the Grad-Cam algorithm. The reconstructed face images are generated from ArcFace templates. In each example, the top image is the output of the Grid-Cam algorithm, and the bottom images are real (right) and reconstructed (left) images. The value below each sample is the cosine similarity between the templates of original and reconstructed face images.
particular, the area around the eyes seems to be the most important part in most of the reconstructed face images. These results also show that the general shape of the face (e.g., thin or chubby face), hairs, textures, etc., are not often necessarily important in the reconstructed face images, and thus, we can also conclude that these attributes are not well-encoded the templates extracted by face recognition models.
Limitations Despite the significant perfor- mance of our method in terms of success attack rate in all types of attacks reported in Table B the reconstructed face images fail to ter the system in some cases. Figure 6 illustrates sample failure cases in the attack 3 against Ar- cFace (using ElasticFace for Flo.s) on the LFW dataset. From the failure cases, can conclude that there is a bias in the face reconstruction for specific demographies, like elderly dark skin people. Indeed, such kind of bias in the recon- structed face images is caused by inherent biases in datasets used to train FR model, the Style- GAN model, and our mapping network in our face reconstruction mode
Original
Reconstructed
0.098
0.126
0.163
Figure 6: Sample failure cases images from the LFW dataset and their corresponding recon- structed images using our template inversion method from ArcFace templates in the attack (using ElasticFace for Floss). The values below each image show the cosine similarity between the corresponding templates of original and recon- structed face images.
5 Conclusion
In this paper, we proposed a new method to re- construct high-resolution realistic face images from facial templates in FR system. We used pre-trained StyleGAN3 network and learned a map- ping from facial templates intermediate latent space of StyleGAN within a GAN-based framework. We proposed method for whitebox and blackbox scenarios. In the whitebox scenario, the adversary can use the feature extraction model for training the face reconstruction network; however, in the blackbox scenario, we assume that the adversary has access to another feature extraction model. In addition, we consider the threat model where the adversary might impersonate in the same or another (i.c.. transferable attack) FR system. Based on the adversary's knowledge of the feature extraction model and the target FR system, we defined five different attacks and evaluated the vulnerability of SOTA FR systems to proposed method. Our experiments showed that the reconstructed face images by our proposed method not only can achieve a high SAR in whitebox and blackbox scenarios, but also transferable and can be used enter target FR systems with different FR model.
'The biases for different demographies in verification task for ArcFace model are studied in (de Freitas Percira and Marcel 2021]. Similarly, biases in StyleGAN generated images and also the FFHQ dataset (i.e., our training dataset) investigated in [Karakas et al. 2022 Tan al. 2020 Balakrishnan al. 2020
10

---

Acknowledgment
This research is based upon work supported by the H2020 TRcSPASS-ETN Marie Skfrdowska-Curie early training network (grant agreement 860813).
References
Javier Galbally, Sébastien Marcel, and Julian Fierrez. Biometric antispoofing methods: A survey in face recognition. IEEE Access, 111530--552, 2014.
Battista Biggio, Paolo Russu, Luca Didaci, Fabio Roli, et al. Adversarial biometric recognition: review on biometric system security from the adversarial machine-leaming perspective. IEEE Signal Processing Magazine, 32(5):31-41 2015.
Abdenour Hadid, Nicholas Evans, Sebastien Marcel, and Julian Fierrez. Biometrics systems under spoofing attack: an evaluation methodology and lessons learned. IEEE Signal Processing Magazine, 32(5):20-30, 2015.
Guangcan Mai, Kai Cao, Pong C Yuen, and Anil K Jain. On the reconstruction of face images from deep face templates. IEEE Transactions Pattern Analysis and Machine Intelligence. 41(5): 1202, 2018.
Sébastien Marcel, Julian Fierrez, and Nicholas Evans. Handbook of Biometric Anti-Spoofing: Presentation Attack Detection and Vulnerability Assessment. Springer, 2023.
Tero Karras, Miika Aittala, Samuli Laine, Erik Härkönen, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Alias-free generative adversarial networks. Advances in Neural Information Processing Systems, 34, 2021.
Bowen Zhang, Shuyang Gu, Bo Zhang, Jianmin Bao, Dong Chen, Fang Wen, Yong Wang, and Baining Guo. Styleswin: Transformer-basse gan for high-resolution image generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11304-11314, 2022.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In International conference on machine learning, pages 214-223. PMLR, 2017.
Andrey Zhmoginov and Mark Sandler. Inverting face embeddings with convolutional neural networks. arXiv preprint arXiv: 04189, 2016.
Forrester Cole, David Belanger, Dilip Krishnan, Aaron Sarna, Inbar Mosseri, and William Freeman. Synthesizing normalized faces from facial identity features. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3703-3712, 2017.
Chi Nhan Duong, Thanh-Dat Truong, Khoa Luu, Kha Gia Quach, Hung Bui, and Kaushik Roy. Vec2face: Unveil human faces from their blackbox features in face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages
2020.
Thanh-Dat Truong, Chi Nhan Duong, Ngan Le, Marios Savvides, and Khoa Luu. Vec2face-v2: Unveil human faces from their blackbox features via attention-based network in face recognition, 2022. URL http:httt:/// ///a://////xiii/ org/ absp///9..222 04920
Sohaib Ahmad, Kaleel Mahmood, and Benjamin Fuller. Inverting biometric models with fewer samples: Incorporating the output of multiple models. In 2022 IEEE International Joint Conference on Biometries (IJCB, pages 1-11. IEEE, 2022.
Xingbo Dong, Zhe Jin, Zhenhua Guo, and Andrew Beng Jin Teoh. Towards generating high definition face images from deep templates. In 2021 International Conference of the Biometrics Special Interest Group (BIOSIG), pages 1-11. IEEF, 2021.
Edward Vendrow and Joshua Vendrow. Realistic face reconstruction from deep embeddings. In NeurIPS 2021 Workshop Privacy in Machine Learning, 2021.
11

---

Xingbo Dong, Zhihui Miao, Lan Ma, Jiajun Shen, Zhe Jin, Zhenhua Guo, and Andrew Beng Jin Teoh. Reconstruct face from features based on genetic algorithm using gan generator as a distribution constraint. Computers & Security, 125:103026, 2023.
Peter J Burt and Edward H Adelson. The laplacian pyramid as a compact image code. In Readings in computer vision, pages 671-679 Elsevier, 1987.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 14Xxv:1409.1566 2014.
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv: /0196, 2017.
Yifan Jiang, Shiyu Chang, and Zhangyang Wang. Transgan: Two pure transformers can make one strong gan, and that can scale up. Advances in Neural Information Processing Systems, 34: 14758, 2021.
Peter JM Van Laarhoven and Emile HL Aarts. Simulated annealing. In Simulated annealing: Theory and applications, pages 7-15. Springer. 1987.
Daniel Roich, Ron Mokady, Amit Bermano, and Daniel Cohen-Or. Pivotal tuning for latent-based editing of real images. ACM Transactions on Graphics (TOG), 42(1):1-13, 2022.
Yuval Alaluf, Omer Tov, Ron Mokady, Rinon Gal, and Amit Bermano. Hyperstyle: Stylegan inversion with hypernetworks for real image editing. In Proceedings of the IEEE/CVF conference computer Vision and patlern recognition, pages 18511-18521, 2022.
Xueqi Hu, Qiusheng Huang, Zhengyi Shi, Siyuan Li, Changxin Gao, Li Sun, and Qingli Li. Style transformer for image inversion and editing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11337-11344 11346, 2022.
Jiankang Deng, Jia Guo, Xue Niannan, and Stefanos Zafeiriou. Areface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2019.
Fadi Boutros, Naser Damer, Florian Kirchbuchner, and Arjan Kuijper. Elasticface: Elastic margin loss for deep face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 1578-15888 2022.
Jun Wang, Yinglu Liu, Yibo Hu, Hailin Shi, and Tao Mei. Facex-zoo: A pytorch toolbox for face recognition. In Proceedings of the 29th ACM international conference Multimedia, 2021.
Jingdong Wang, Ke Sun, Tianheng Cheng, Borui Jiang, Chaorui Deng, Yang Zhao, Dong Liu, Yadong Mu, Mingkui Tan, Xinggang Wang, et al. Deep high-resolution representation learning for visual recognition. IEEE transactions on pattern analysis and machine intelligence, 2020.
Fei Wang, Mengqing Jiang, Chen Qian, Shuo Yang. Cheng Li, Honggang Zhang, Xiaogang Wang, and Xiaoou Tang. Residual attention network for image classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 31 3156-3164, 2017.
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. arXiv preprint arXiv:2103.14030, 2021.
Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao. Ms-celeb-Img A dataset and benchmark for large-scale face recognition. In European conference on computer vision, pages 87-102. Springer, 2016.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEÉ/CVF conference on computer vision and pattern recognition, pages 4401-4410, 2019.
Chris McCool, Roy Wallace, Mitchell McLaren, Laurent El Shafey, and Sébastien Marcel. Session variability modelling for face authentication. IET Biometrics, 2(3):177-129, September 2013. ISSN 2047-4938. doi:
12

---

Gary B. Huang, Manu Ramesh, Tamara Berg, and Erik Learned -Mille.. Labeled faces in the wild: A database for studying face recognition in unconstrained environments. Technical Report 07-49, University of Massachusetts, Amherst, October 2007.
Diederik Kingma and Jimmy Ba. Adam: method for stochastic optimization. In Proceedings of the International Conference Learning Representations (ICLR), San Diego, California., USA, May 2015.
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-base localiza- tion. In Proceedings of the IEEE international conference on computer vision, pages 618-626, 2017.
Tiago de Freitas Pereira and Sébastien Marcel. Faimess in biometries: figure of merit to assess biometric verification systems. IEEE Transactions on Biometrics, Behavior, and Identity Science, 4(1):19-29, 2021.
Cemre Efe Karakas, Alara Dirik, Eylül Yalııkkaya, and Pinar Yanardag. Fairstyle: Debiasing stylegan2 with style channel manipulations. In Proceedings of the European Conference on Computer Vision (ECCV), pages 570-586. Springer, 2022.
Shuhan Tan, Yujun Shen, and Bolei Zhou. Improving the fairness of deep generative models without retraining. arXiv preprint arXiv:2012.04842. 2020.
Guha Balakrishnan, Yuanjun Xiong, Wei Xia, and Pietro Perona. Towards causal benchmarking of bias in face analysis algorithms. In Proceedings of the European Conference on Computer Vision (ECCV), pages 547-563. Springer, 2020.
Omkar Parkhi, Andrea Vedaldi, and Andrew Zisserman. Deep face recognition. In BMVC 2015- Proceedings of the British Machine Vision Conference 2015. British Machine Vision Association, 2015.
European Council. Regulation of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (general data protection regulation), April 2016.
Karthik Nandakumar and Anil K Jain. Biometric template protection: Bridging the performance gap
between theory and practice. IEEE Signal Processing Magazine, 32(5):88-100, 2015.
Mulagala Sandhya and Munaga VNK Prasad. Biometric template protection: A systematic literature review of approaches and modalities. In Biometric Security and Privacy, pages 323-370. Springer, 2017.
Prabhjot Kaur, Nitin Kumar, and Maheep Singh. Biometric cryptosystems: a comprehensive survey. Multimedia Tools and Applications, pages 1-56, 2022.
Nitin Kumar et al. Cancelable biometrics: comprehensive survey. Artificial Intelligence Review, 53 (5):3403-3446, 2020.
Hatef Otroshi Shahreza, Christian Rathgeb, Dailé Osorio-Roig, Vedrana Krivokuća Hahn, Sébastien Marcel, and Christoph Busch. Hybrid protection biometric templates by combining homo- morphic encryption and cancelable biometrics. In Proceedings of the IEFE International Joint Conference on Biometrics (IJCB), pages 1-10. IEEE, 2022.
Hatef Otroshi Shahreza, Vedrana Krivokuća Hahn, and Sébastien Marcel. Mlp-hash: Protecting face templates via hashing of randomized multi-layer perceptron. In Proceedings of the 31st European Signal Processing Conference (EUSIPCO). IEEE, 2023.
A. Anjos, L.
El Shafey, R. Wallace, M. Günther, C. McCool, and S. Marcel. Bob: a free signal processing and machine learning toolbox for researchers. In Proceedings of the 20th ACM Conference on Multimedia Systems (ACMMM), Oct. 2012.
A. Anjos, M. Günther, de Freitas Pereira, P. Korshunov, A. Mohammadi, and Marcel. Con- tinuously reproducing toolchains in pattern recognition and machine learning experiments. In ICML 2017 Reproducibility in Machine Learning Workshop, pages 1-8, 2017. URL hhtpps //openreview
13

---

A More Analyses
A.1 Evaluation of Whitebox and Blackbox Attacks at FMR 10
Table 7 and Table of this appendix report the evaluation of attacks with whitebox and blackbox knowledge, respectively, of the system from which the template is leaked (i.e., Fless Fdatabose) against SOTA FR models at FMR= 10 2 in terms of adversary's success attack rate (SAR) using proposed method on the MOBIO and LFW datasets. As the results in these tables show, our method outperforms previous methods in the literature.
Table 7: Evaluation of attacks with whitebox knowledge of the system from which the template is leaked (i.e., Floss )d against SOTA FR models in terms of adversary' 's success attack rate (SAR) using our proposed method on the MOBIO and LFW datasets. The values are in percentage and correspond to the threshold where the target system has FMR= 10 10-2 Cells are color coded
according the type of attack as defined in Section of the paper for attack light gray ) and attack
dark gray
MOBIO
LFW ArcFace FlasticFace HRNet AttentionNet Swin
dataabss
ArcFace FlasticFace HRNet AttentionNet Swin
ArcFace 100.00
93.81
80.00
81.90
85.24
93.64
90.89
68.08
62.75
76.24
ElastieFace
90.95
93.33
78.57
83.81
84.29
87.88
92.80
71.82
64.24
75.70
Table Evaluation of attacks (with blackbox knowledge of the system from which the template is
leaked i.e., P'aatabase) against SOTA FR models in terms of adversary's success attack rate (SAR) using
different methods on the MOBIO and LFW datasets. The values are in percentage and correspond to
the threshold where the target system has FMR= 10tH 2 M1: NbNetB-M -M [Mai et al., 2018). M2:
NbNetB-P Mai et al. [2018). M3: [Dong et al., 2021]. M4: (Vendrow and Vendrow] [202]] and M5:
[Dong al. 2023). Cells are color coded according the type of attack defined in Section 2 of the
paper for attack 3 lightest gray ), attack 4 middle dark gray ), and attack 5 darkest gray
MOBIO
LFW
F Fdatahase
F Flsss
F Furget
M1
M2
M3
M4
M5
Ours
M1
M2
M3
M4
M5
Ours
AreFace
26.67
49.05
20.48
67.14
85.71
89.52
26.66
61.66
28.31
76.98
87.25
87.85
FlasticFace
11,90
49.52
16.19
34.29
60.95
86.67
32.42
66.61
57.84
74.31
87.43
ArcFace
ElasticFace
HRNet
10.48
24.76
10.00
26.19
54.28
79.05
18.69
43.21
17.37
33.55
50.22
60.93
AttentionNet
11.43
38.10
18.10
24.29
54.76
80.48
10.84
31.88
13.31
26.73
44.99
53.86
Swin
10.48 45.24
10.95
29.52
58.09
82.86
14.79
45.80
16.98
38.03
57.71
67.80
ArcFace
17.14
49.05
20.95
47.14
79.91
95.24
33.08
67.89
26.35
57.48
73.80
91.23
FlasticFace
30.00
70.95
25.7
75.24
88.80
94.76
52.99
81.74
33.53
79.62
88,
80
93.34
ElusticFace ArcFace
HRNet
8.10
47.14
15.24
31.43
67.14
83.81
29.27
60.34
34
23.22
39.06
62.01
76.68
AttentionNet
12.86
47.14
23.43
40.95
66.19
87.14
18.53
46.36
17.78
31.53
55.29
69.45
Swin
10.00
54.76
13.81
37.14
68.57
89.05
24.50
60.19
21.40
41.13
65.82
80.15
A.2 Ablation Study
Ablation Study on the Effeet of Feature Ex- tractor in the ID loss To evaluate the effect
Table 9: Evaluating the effect of ID) loss term in our loss function in attack 3 against HRNet in terms of SAR in the system with FMRs of 10-2 and 10-3 evaluated on the MOBIO and LFW datasets. The values are in percentage.
of feature extractor in our loss function, we consider attack on HRNet templates and use ArcFace and ElasticFace for Fiss(() in our loss function. Table of this appendix reports the result of this ablation study. Com- paring the results of different face recognition models used as (-) in our loss function, we can see that the mapping which is trained using ArcFace achieves higher SAR that the mapping that is trained with ElasticFace.
Fixe ID loss
MOBIO
LFW
FMR=10
PMR=10
FMR=10
FMR=10
91,90
86.19
48.22
ElasticFace
86.71
82.38
72.59
43.71
14

---

Moreover, comparing these results with the recognition performances of ArcFace and ElasticFace reported in Table 2 of the paper, we can conclude that face recognition method with a higher recognition performance can lead to a better reconstruction when used as Fioes in the blackbox attack using our proposed method.
Ablation Study on the Effect of Noise in our WGAN Training To evaluate the effect of noise used our GAN training, we implement another ablation with the same configuration used for our ablation study in the paper (i.e., attack 1 against ArcFace), and we train two networks with and without noise in the input of the mapping network. Table 10 this appendix reports the result of our ablation study. As this table shows, using noise in our WGAN training improves the performance of our face reconstruction method.
It is noteworthy that generally, in training GANs (even in conditional GANs) a noise (e.g., from Gaussian distribution) is used in the input of the generator network. The sam- ples of noise in the input help the generator to learn the distribution of the output space, and therefore help the generator network to generate outputs from the same distribution of real data. The discriminator (or critic in WGAN) network tries to distinguish if the sample output is from the distribution of real data or not. In other words, adding random noise in the input makes the training stochastic which is suitable for learning distribution. In our problem, it is very important that the generated latent code is from the same distribution as the intermediate latent space W of StyleGAN. In particular, if the generated latent code is not in the same distribution of W, it can easily lead non-face-like image at the output of StyleGAN.
Table 10: Evaluating the effect of using noise in our method in attack 1 against ArcFace in terms of SAR in the system with FMRs of 10-2 and 10 3 evaluated on the MOBIO and LFW datasets. The values are in percentage.
MOBIO
LFW
FMR=10
FMR=10
FMR-10
FMR-10
with noise
100.00
92.38
93.64
86.82
without noise
97.14
74.76
89.19
77.72
Ablation Study on the Mapping Space To evaluate the effect of the mapping space in our proposed method, we consider attack on against ArcFace model, and train mapping to input latent space Z and the intermediate latent space W of StyleGAN. Table [1 this appendix reports the result of our ablation study.
Table 11: Evaluating the effect of mapping space in our method in attack 1 against AreFace in terms of SAR in the system with FMRs of 10-2 and 10-3 evaluated the MOBIO and LFW datasets. The values are in percentage.
Mapping
MOBIO
LFW
Space FMR=10
FMR=10
FMR=10
FMR=10
W
100.00
92.38
93.64
86.82
As the results this table show, mapping to the intermediate latent space W leads to higher performance. This is because the intermediate latent space has more information and is more controllable than input space 2, which originally of Gaussian distribution for noise in StyleGAN. This ablation study highlights the importance of mapping to the intermediate latent space W of StyleGAN, which has not been proposed in the literature for template inversion.
2
71.42
41.42
75.94
57.18
A.3 Using a Different Face Generator Network
In our experiments, we used StyleGAN which is one of the most popular face generator models in the literature. However, our method can also be used with other face generator networks, As another experiment, we use StyleSwin [Zhang et al., 2022]. which is another face generator model based on transformers. F this appendix shows the reconstructed face images from ArcFace templates using StyleSwin in our method instead of StyleGAN. We used a similar mapping network and learned a mapping from facial templates to the intermediate latent space of StyleSwin. As these results show, our method can also be used with other face generator networks.
A.4 Application of Our Method for Face Recognition Models with Different Inputs/Outpute
While we use three different face recognition models our problem formulation, since these models applied in separate stages, there is no issue if the inputs and outputs (c.g., pre-processing steps
15

---

Reconstructed Original
0.759
0.626
0.627
0.624
0.611
0.614
0.645
Figure 7: Sample face images from the FFHQ dataset and their corresponding reconstructed images from ArcFace templates using our template inversion method with StyleSwin (Zhang et al. [022] as the face generator model. The values below each image show the cosine similarity between the corresponding templates of original and reconstructed face images.
dimensions) be different in each of these face recognition models. For differences in inputs (face images), because each of these models is applied independently on the given face image, the required rre-processing be considered within the function of the face recognition model in problem formulation. For differences in outputs (face templates), since the facial templates extracted by each model are compared to facial templates extracted by the same model, there is no conflict in the dimensions. The only point to be noted that the input of our mapping network should have the same dimension the templates of.
Let us consider the complete pipeline of our problem formulation as depicted in Figure 2 of the paper. The first face recognition model (i.e., l uses its own pre-process and extracts facial templates from face images captured by the camera of the face recognition system (from which the template is leaked). These facial templates (extracted from Fdatabase) are then used as input to our face reconstruction model. Therefore, the input of our mapping should have the same dimension as templates of F ddatabase- In any case, the output of the face reconstruction network is high- high-resolution (1024 x 1024) face image, regardless of the dimension of the input facial template. During training, the generated high-resoluttin face image is first rrepprcessedd required by Flous (i.e., normalised, resized and aligned based on coordinates required by Fios),, and the extracted templates are compared with templates of the original image extracted from Fiess (with the required pre-processing for Flos). During inference (i.e., attacking the target FR system), however, the generated high-resolution face image is pre-processed required by Furget. Therefore, there is conflict in the inputs/outputs in our pipeline.
In experiments reported in the paper, all face recognition models except Swin take in- put with 112 112 resolution. However, the Swin model takes input with 224 x 224 res- olution. The dimensions of facial templates extracted by all other face recognition models (in Table of the paper) in our experiments are similar and equal to 512. To show that our method also be used in case of different dimensions of facial templates and to show- case another face recognition model with dif- ferent pre-processing, as new experiment, we use new model, VGGFace [Parkhi al. 2015), with a different dimension of facial templates -048-ddmmn)soo) and different in- put image resolution (224 x 224) which has a different normalization as well as different
Table 12:
Evaluation of success attack rate for TI attack using VGGFace templates (as Fdinabuse) ) using ArcFace Floss in attack against FR systems with different models (as Farges). Note that pre-processing (normalization and alignment coordinates) of VG- GFace is different than all target models and its input resolution is 224 x 224. The input resolution for Are- Face (used as Floss) and ElasticFace is 112 x 112 but for Swin 224 224. The templates extracted by VGGFace has 2048 dimensions, while templates of ArcFace, ElasticPace, and VGGFace have 512 dimen- sion.
ArcFace ElasticFace Swin
FMR 10 2
92.92
93.10
83,97
FMR 10
86.61
82.39
72.89
landmark coordinates for face alignment. We use ArcFace our Ross and evaluate the reconstructed face images attacks against different face recognition systems (as Furget) on the LFW dataset. The results in Table 12 of this appendix show that proposed method can be applied in the case
16

---

where the inputs/outputs of face recognition models in our problem formulation (F (Faatabuse. Floss, and Furget) are different, and still achieves high success attack rates against face recognition systems with different inputs/outputs.
B Ethics Statement
The proposed face reconstruction method is presented with the motivation of showing vulnerabilityy of face recognition systems template inversion attacks. We hope this work encourages researchers of the community to investigate the next generation of safe and robust face recognition systems and to develop the project on which the work has been conducted has passed an Institutional Ethical Review Board (IRB).
Motivations
algorithms to protect existing systems. In addition, should note that
Ethics Considerations While the proposed method might pose social threat against unprotected systems, do not condone using our work with the intent of attacking real face recognition system or other malicious purposes. We should, however, note that for the next generation of safe face recognition systems, any kind of potential attacks should be completely studied by the researchers; and then based upon such vulnerability studies, new protection and defense algorithms will be proposed by the research community in the future. To facilitate future studies, we publish source code of our work as described in Section[ooo this appendix.
Mitigation of such Attacks This paper demonstrates an important privacy and security threat to the state-of-the-art unprotected face recognition systems, Along the same lines, data protection frameworks, such as the European Union General Data Protection Regulation (EU-GDPR) [European Council 2016), put legal obligations to protect biometric data as sensitive information. To this end and to prevent such attacks face recognition systems, several biometric template protection algorithms are proposed in the literature Nandakumar and Jain 2015 Sandhya and Prasad 2017
Kaur et al. 2022
Kumar al. 2020 Shahreza et al. 2022 2023
C Reproducibility Statement
In our experiments, StyleSwin to generate high-resolution face images. We train our mapping network for 16 epochs with initial learning rate of 0.1 using Adam optimizer (Kingma and Ba 2015] and divide the learning rate by 2 every three epochs. Training our mapping network using our proposed method takes around two days face recognition pipelines using Bob (Anjos et af. 2012 2017) toolbox [00] The source code of our experiments is publicly available to help reproduce results.
PyTorch package and the pre-trained model of StyleGAN: and
system equipped with NVIDIA GeForce RTXTM 3090. We build
D Licenses and Copyright Permissions
Datasets We have signed the licenses (GDPR compliance) to use from the data controller of any of the datasets used in this paper (i.e., MOBIO, LFW, and FFHQ) and followed the terms of use of these datasets in this paper. We have also cited the corresponding paper for each dataset.
Models We used pretrained models following deep neural networks and followed the license of each one in implementing our experiments:
ArcFace, FlasticFace, and VGGFace face recognition models implemented in Bob Anjos
ct al. 2012 2017 toolbox (under BSD 3-Clause License)
HRNet, AttentionNet. and Swin face recognition models implemented in FaceX-Zoo Wang et 2021 toolbox (under Apache License, Version 2.0)
Available at httppp::/ggtabb..oo/////aaaa/aat
Available http://////.hiioo.oc/ooooooo//o/
Available at http::////w...aaappp//////tattaa
Available http:::://iiiaab.daiaate http:////waappppooopoooooo..///0
paper
17

---

StyleGAN3 (official) model published under Nvidia Source Code Licens P StyleSwin (official) model published under MIT License.
Available http:r//thhhhcooo/////////ssssss
18


Reviews:
[{"review_id": "58tZRNfaP3", "reviewer": "Reviewer_S2tQ", "summary": "In this work, the authors propose a new method to execute the template inversion attack against face recognition systems. By simply having access to the feature vectors (latent representations) of the original faces, the adversary can reconstruct a face like the original, therefore showing that face recognition systems can be compromised. The method used comprises a StyleGAN3 network, split such that a new Mapping network attempts to synthesize a correct embedding given random noise and the victim template vector, and a critic network discriminates between that output and StyleGAN’s own mapping network with the WGAN algorithm. \nThe authors further test their method in whitebox and blackbox scenarios, using a combination of several models for template vector leaking and transferability of reconstructing a face to attack a face recognition system. In the end, for the five attacks defined, the novel method achieves high attack success rates. ", "questions": "1. Is there a particular reason why a model like StyleGAN3 was chosen? (Code availability, SOTA, etc.). \n2. (Related to Weakness section) Is it reasonable to think that the template vectors would be stored “raw” and not in an encrypted form? I do not think a database concerned with security would store the raw information. \n3. It seems in many, if not all, images shown, the face subjects have smooth faces (this is somewhat related to elderly subjects reconstructing poor results). Do facial features (e.g., wrinkles, pores, moles, etc.) have any influence on the system recognition succeeding or failing? Perhaps this could be attributed to StyleGAN synthesis of images. \n4. The paper should provide an insightful comparison of the attack scenarios, i.e. what scenario A has but B does not have, and vice versa. It looks like the evaluation of the blackbox scenario is enough since it covers all of the others.", "limitations": "The authors have addressed the limitations of the work and its biases and have stated which data they have used for experiments (and how the data influences the outcomes presented). ", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "While the problem is not new, the paper takes a clever spin on existing methods and combines them to tackle five attack scenarios. Even in the most difficult attack scenario, the novel method achieves significantly higher attack success rates, but even more so, the better recognition models actually suffer the most. \n\nIt is interesting and reasonable to propose face template matching via the GAN-base framework.\n\nThe paper provides sufficient evaluation results for five attack scenarios, as the paper defined.", "weaknesses": "The paper contains grammatical errors throughout, but they should be fixable. For instance, in line 108, I believe you meant to say “critique” the generated omega-hat vectors. For Section 4.2, I believe it should be titled “Analysis”. \n\nThe five attack scenarios as defined in the paper seem incremental so they do not show the broad of the method application.\n\nThe synthesized images themselves in the sense that the authors are not trying to answer the question of *what* features between the template and synthetic images fool the recognition system. I think having that aspect of the attack would both boost the novelty of the attack and provide an excellent visualization as to why (and literally where) the attack works. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their valuable comments. Below, we tried to address the concerns raised by the reviewer:\n\n### Reply to Weaknesses\n**Reply to Weakness 1:** We acknowledge the reviewer's comment and apologize for the typos as well as grammatical errors. We will fix these errors and will carefully revise the paper for any typos/errors.\n\n**Reply to Weakness 2:** We define five different attacks against face recognition systems (based on the adversary's knowledge and the target system) to provide a comprehensive vulnerability evaluation. In particular, we evaluate the transferability of the reconstructed face images in template inversion attacks, which has not been investigated in the literature. \n\n**Reply to Weakness 3:** \nWe appreciate the reviewer for valuable comment and interesting suggestion. We conducted a new experiment to gain a more in-depth insight of the reconstructed face images. Please kindly check our new experiment described in the `general response`.\n\n***\n### Reply to Questions\n**Reply to Questions 1:** \nStyleGAN is one of the most popular face generator models in the literature. It has available source code (and pretrained models) and several works have been using StyleGAN in different research problems. \nHowever, our method can also be used with other face generator networks. As a new experiment, we used StyleSwin (CVPR, 2022) which is another face generator model. As the results (reported in the `general response`) show, our method can be used with this face generator networks too. \n\n**Reply to Questions 2:** \nData protection regulations consider biometric data as sensitive information that should be protected. However, many such regulations are issued recently and there are still many face recognition systems which store raw facial templates in their databases. We should note that using typical encryption schemes (such as hashing) cannot be used to protect facial templates. Because biometric templates of the same subject are not exactly the same due to variations in measurements (eg light change, pose change, etc), and thus exact matching (as used in hashing) cannot be used in practice for face recognition systems. Hence, protection of biometric templates is still a challenging problem and there are several standards (eg, ISO/IEC 24745) defining the requirements of template protection schemes. In our Ethics Statement, we cited some works on biometric template protection in the literature. \n\n**Reply to Questions 3:** \nTo answer the question of `Do facial features have any influence on the system recognition succeeding or failing [of the reconstructed face images]?`, we first need to answer the question that `Do face recognition models encode such facial features?` or in other words  `Do facial features (e.g., wrinkles etc) are useful for face recognition models to identify different subjects?`. \nTo have a solid answer to these questions, we need to have access to a rich dataset of facial features and investigate the effect of facial features on the performance of face recognition models and our face reconstruction method. Unfortunately, we could not find any large-scale dataset with labels of such facial features. However, we would like to consider aging as a special case of causing facial features in people and investigate the effect of aging on the performance of face recognition models and our face reconstruction method. For instance, wrinkles often appear more (or strengthen) in elderly people, while the same person does not have (or has less) wrinkles in his/her younger images (as shown in Figure 3 of our rebuttal pdf file). \nTo this end, we consider the AgeDB dataset, which contains 16,488 images of various famous people (a total of 568 distinct\nsubjects). Every image is annotated with respect to the identity and includes age attributes. \nThe minimum and maximum age is 1 and 101, respectively, and the average age range for each subject is 50.3 years.\nThis dataset has four different protocols, where in each protocol, the age difference of each pair’s faces is equal to a fixed, predefined value, i.e., 5, 10, 20 and 30 years. As a new experiment, we consider attack 1 (ie, whitebox against the same model) against ArcFace and evaluate the performance of the face recognition model (in terms of true match rate)  and our face reconstruction method (in terms of success attack rate) for different age protocols in this dataset (at FMR=1%):\n\n|  | AgeDB-5 | AgeDB-10 |  AgeDB-20 | AgeDB-30 |\n|---|---|---|---|---|\n| Face recognition (TMR) | 98.33 | 98.43 | 97.30 | 97.00 |\n| Our face reconstruction (SAR) | 75.80 | 76.26 | 80.63 | 75.98 |\n\nAs the results on this dataset show, the performance of the face recognition model and also our face reconstruction method is comparable for different age protocols in the AgeDB dataset. Therefore, it is reasonable to assume that facial attributes such as wrinkles may not be completely encoded in the facial templates, or even if there is some level of information, changing these attributes does not significantly change the facial templates. \n\n**Reply to Questions 4:** \nFollowing the reviewer's suggestion, we prepared a table in our `general response` and further described the adversary's knowledge and difficulty of each attack scenario. We will include this table in the final version of the paper. \nWe would like to also mention that in research on the security and attacks against AI systems, evaluations are not often limited to whitebox/blackbox scenarios (against the same system), and the transferability of attack needs to be investigated to evaluate the robustness of generated samples by an adversary. However, to our knowledge, the transferability of the reconstructed face images in template inversion attacks has not been investigated in the literature. As a matter of fact, the transferability of reconstructed face images can lead to a critical threat where the adversary can use the reconstructed face image to enter another system."}, {"review_id": "KNa9eufUka", "reviewer": "Reviewer_T7AV", "summary": "The paper proposes a high-resolution face reconstruction method for template inversion attacks. They make use of a GAN-based framework, StyleGAN3, by learning a mapping from facial templates to its intermediate latent space. They evaluate their method on 5 different attacks in whitebox and blackbox scenarios.", "questions": "Please see the weakness.", "limitations": "Yes, the limitations are addressed. ", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The method is evaluated in a wide range of TI attack scenarios.\n\nThe method, its motivation and evaluation setting is described clearly and is easy to understand.\n", "weaknesses": "The novelty of the proposed method mainly lies in the introduction of the facial template mapping network which is somewhat incremental.\n\nIt would be helpful to understand the rationale behind selecting StyleGAN as the synthesis model. Additionally, exploring alternative synthesis networks could provide insights into how much of the success and limitations depend on the synthesis network. Also, it would be beneficial to explore the effect of fine-tuning the synthesis network of StyleGAN. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their time in reviewing our paper and for their valuable comments. We are happy that the reviewer found our paper clear and easy to understand. Below, we tried to address the concerns raised by the reviewer:\n\n> The novelty of the proposed method mainly lies in the introduction of the facial template mapping network which is somewhat incremental.\n\nWe acknowledge the reviewer's comment that we eventually aim to train one mapping network in our proposed method to map the facial templates to the intermediate latent space of StyleGAN. However, as shown in our experiments (especially our ablation study), training such a mapping network is not straightforward. In particular, using a WGAN learning approach, we simultaneously train a critic network to help our mapping network to learn the distribution of the intermediate latent space $\\mathcal{W}$ of StyleGAN.  In addition to adversarial training in our proposed method to learn the mapping, we also train our mapping network with a multi-term loss function, including an identity loss on the generated images to preserve the identity of the reconstructed face images. Therefore, our proposed face reconstruction method is not a mere trivial combination of existing techniques. Even more, the proposed method achieves state-of-the-art results in template inversion attacks against five state-of-the-art face recognition systems on different face recognition datasets, which is not trivial either. \n\nMoreover, we define five different attacks against face recognition systems (based on the adversary's knowledge and the target system), and evaluate the transferability of the reconstructed face images and vulnerability of state-of-the-art face recognition models to template inversion attacks. To our knowledge, this is the first work that comprehensively evaluates the transferability of the reconstructed face images in template inversion attacks.\n\n> It would be helpful to understand the rationale behind selecting StyleGAN as the synthesis model. Additionally, exploring alternative synthesis networks could provide insights into how much of the success and limitations depend on the synthesis network. \n\nStyleGAN is one of the most popular face generator models in the literature. It has available source code (and pretrained models), and several works have been using StyleGAN in different research problems. However, our method can also be used with other face generator networks. As a new experiment, we used StyleSwin (CVPR, 2022), which is another face generator model. As the results (reported in the `general response`) show, our method can be used with this face generator networks too. \n\n> Also, it would be beneficial to explore the effect of fine-tuning the synthesis network of StyleGAN.\n\nWe fix the parameters of the synthesis network of the face generator network (StyleGAN) and do not update it during training. If we update the synthesis network of SyleGAN, we need to apply adversarial training on the generated images too, which makes the training more complicated. That means we need to learn again the distribution of real images, which is more difficult than learning the distribution of intermediate latent space of pretrained StyleGAN."}, {"review_id": "gGAs2qeR2K", "reviewer": "Reviewer_RLF3", "summary": "In this paper, the authors introduce a new method for reconstructing high-resolution realistic face images from facial templates within a face recognition (FR) system. They employ a pre-trained StyleGAN3 network and train a mapping from facial templates to the intermediate latent space of StyleGAN using a GAN-based framework. In particular, the proposed method is designed to work in both white-box and black-box under different adversary attack scenarios.  The vulnerability of state-of-the-art (SOTA) FR systems to the proposed method is evaluated. Experimental results demonstrate that the reconstructed face images using the proposed method achieves the highest success rates in both white-box and black-box scenarios and its transferability has been validated.", "questions": "NA.", "limitations": "As mentioned by the authors, there exists a bias in reconstructing faces of certain demographic groups, such as elderly individuals or people with dark skin. This bias in the reconstructed face images can be attributed to the inherent biases present in the datasets used to train the face recognition (FR) model, the StyleGAN model, and the mapping network in our face reconstruction model.\n", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ Overall the paper is well organized and easy to read.\n+ The idea of training a critic network to ensure the same distribution between $w \\in W$ and ${\\hat w} \\in W$ is interesting.\n+ Deep dive into five different template inversion (TI) attacks, and evaluate the transferability of reconstructed face images in TI attacks.\n+ Solid experiment validation based on StyleGAN with better performance than the SOTA methods.\n", "weaknesses": "- The investigation on face reconstruction is insufficient. The authors didn’t mention any work related to Transformer and diffusion works, e.g, Face-Transformer (2023 Arxiv April), and VQ-DDM (CVPR’22).\n\n- The template inversion (TI) attack is a too specific adversarial attack. I would like to suggest the authors experimentally verify whether it is possible to extend the idea (e.g., critic network) to other kinds of attacks.\n\n- The current paper is heavily dependent on the StyleGAN3, which is not SOTA when considering the more advanced Transformer and diffusion models. Therefore I would like to suggest the authors to switch the current StyleGAN3 to the both Transformer and diffusion models to validate the claims made in the current paper.\n\n- Typo: miss the table number in line 287, 300.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their valuable comments. We are happy that the reviewer found our paper well-organized and easy to read. We appreciate the reviewer's comments on the strengths of our work. \nBelow, we tried to address the concerns raised by the reviewer:\n\n\n> The investigation on face reconstruction is insufficient. The authors didn’t mention any work related to Transformer and diffusion works, e.g, Face-Transformer (2023 Arxiv April), and VQ-DDM (CVPR’22).\n\nWe used StyleGAN since it is one of the most popular face generator models in the literature. \nHowever, our method can also be used with other face generator networks. As a new experiment, we used StyleSwin (CVPR, 2022), which is another face generator model based on transformers. As the results (reported in our `general response`) show, our method can also be used with this face generator networks too. \n\nWe should note that considering the NeurIPS guideline, papers appearing less than two months before the submission deadline are considered contemporaneous to NeurIPS submissions. Therefore, Face-Transformer (2023 Arxiv April), which was published on arxiv less than one month before NeurIPS submissions, is considered contemporaneous following the NeurIPS guidelines. In addition, according to the NeurIPS guideline, authors are also excused for not knowing about works published on arxiv.\nIn any case, our new experiment shows that our method can be used with recent face generator models based on transformers too.\n\nWe would like to also highlight that we have considered five different face recognition models in our experiments. One of the face recognition models in our experiments is based on the Swin backbone, which is a transformer-based network. Our experiment shows that the Swin face recognition model is also vulnerable to our attacks.\n\n> The template inversion (TI) attack is a too specific adversarial attack. I would like to suggest the authors experimentally verify whether it is possible to extend the idea (e.g., critic network) to other kinds of attacks.\n\nWe appreciate the reviewer's comment and will consider it as our future work. In fact, our method can be extended to any type of attack in which we would like to find/modify the intermediate latent codes but ensure that the new latent codes are on the original distribution of the intermediate latent space.\n\n> The current paper is heavily dependent on the StyleGAN3, which is not SOTA when considering the more advanced Transformer and diffusion models. Therefore I would like to suggest the authors to switch the current StyleGAN3 to the both Transformer and diffusion models to validate the claims made in the current paper.\n\nAs described in our reply to the earlier point raised by the reviewer and following the reviewer's suggestion, as a new experiment, we used StyleSwin (CVPR, 2022), which is another face generator model based on transformers. The results reported in the `general response` show that our method can also be used with this face generator network too. We will add these results to the final version of the paper. \n\nWe should not that since our proposed method maps to the intermediate latent space of face generator model, it can be applied to different face generator models. During rebuttal period, we could investigate and showcase the application of our method with StyleSwin (which is a state-of-the-art face generator model based on transformers). Further experiments with other face generator networks can be explored in future works.\n\n\n> Typo: miss the table number in line 287, 300.\n\nWe apologize for this error caused in our compilation before submission. We will fix these errors and will carefully revise the paper for any typos/errors."}, {"review_id": "SDihXGSOPh", "reviewer": "Reviewer_pmB2", "summary": "The paper studies the template inversion attack on FR systems. The paper involves both white- and black-box attacks. Moreover, five different attacks are considered. ", "questions": "See the Weakness. ", "limitations": "See the Weakness. ", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "This paper poses a potential threat to FR systems in that attackers can reconstruct victim's facial images with the features stored in the database. Comprehensive attack situations are considered with five different attacks. ", "weaknesses": "- My main concern is about the limited application of the proposed method. The quality of the face images highly depends on the power of the generator, i.e. StyleGAN3. Therefore, the bias of it, such as resolution, gender, race, and head pose biases make the attack hardly generalize to other face images. For example, including the failure Fig. 5, if the features stored in the database are from low-resolution images, or non-frontal faces, or faces aligned with other alignment methods, the proposed method may also fail as these also are the biases/domain gap of the generator. It would be good if the authors analyzed more in this aspect that there is a large domain gap between the database and that in the generator. From the current setting, I have not seen any specific handle for this issue but a simple critic network. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their valuable comments. We are happy that the reviewer found our paper easy to follow. We appreciate the reviewer's comments on the strengths of our work. Below, we tried to address the concerns raised by the reviewer:\n\n> My main concern is about the limited application of the proposed method. The quality of the face images highly depends on the power of the generator, i.e. StyleGAN3. Therefore, the bias of it, such as resolution, gender, race, and head pose biases make the attack hardly generalize to other face images. For example, including the failure Fig. 5, if the features stored in the database are from low-resolution images, or non-frontal faces, or faces aligned with other alignment methods, the proposed method may also fail as these also are the biases/domain gap of the generator. It would be good if the authors analyzed more in this aspect that there is a large domain gap between the database and that in the generator. From the current setting, I have not seen any specific handle for this issue but a simple critic network.\n\nIn our experiments, we tried to consider the gap between our training dataset and our evaluation dataset. For training our face reconstruction network, we used the FFHQ dataset, which includes high-quality images. In contrast, for evaluation, we used MOBIO and LFW datasets. The MOBIO dataset is collected with mobile devices, and LFW is an unconstrained dataset collected from the internet. Therefore, the quality of images in these two datasets is considerably different from the FFHQ dataset, which is used for our training.\nAs a new experiment, we consider the IARPA Janus Benchmark C (IJB-C) dataset, which is one of the most challenging face recognition benchmarking datasets. The following table compares the performance of our method with previous methods in the literature (compared in Table 4 of the paper) in attack 3 (i.e., blackbox attack against same system) using ArcFace as $F_{loss}$ against different state-of-the-art face recognition models on the IJB-C dataset:\n\n|  | M1 | M2 | M3 | M4 | M5 | Ours |\n|---|---|---|---|---|---|---|\n| ElasticFace | 0.32 | 4.1 | 0.13 | 5.41 | 16.90 | **35.91** |\n| HRNet | 0.05 | 1.12 | 0.09 | 2.17 | 4.36 | **24.38** |\n| AttentionNet | 0.13 | 1.27 | 0.21 | 2.86 | 4.82 | **26.35** |\n| Swin | 2.40 | 15.11 | 2.45 | 20.73 | 30.91 | **45.00** |\n\n(Note: M1, M2, M3, M4, and M5 are defined in the caption of Table 4 of the paper.)\n\nAs the results in this table show, our method still achieve superior performance than all face reconstruction methods in the literature. We should also note that we observe a drop in the performance of all methods in this table. It is particularly because the IJB-C dataset is a very difficult benchmarking dataset. To elaborate on this, we would like to compare the recognition performance of ArcFace (as an example) face recognition model on IJB-C with the performance on MOBIO and LFW datasets as reported in the following table:\n\n|  | MOBIO | LFW | IJB-C |\n|---|---|---|---|\n| ${FMR}=10^{-2}\\%$ | 100.00 | 97.60 | 95.29 |\n| ${FMR}=10^{-3}\\%$ | 99.98 | 96.40 | 90.90 |\n\nAs the values in this table show, IJB-C is a more challenging dataset, and the face recognition systems also suffer from the degradation in the recognition performance on this dataset.\n\n> Flag For Ethics Review: Ethics review needed: Inappropriate Potential Applications & Impact  (e.g., human rights concerns)\n\nWe have already included a section in the supplementary material for the \"Ethics Statement\" and discussed different ethical aspects of our paper."}, {"review_id": "WGn6XPXSqt", "reviewer": "Reviewer_dWCe", "summary": "The paper presents a method to reconstruct high resolution face images from feature vectors extracted from a face recognition (FR) system. The reconstructed face images can be used to attack FR systems to gain access under whitebox and blackbox scenarios\nThe paper also introduce five different scenarios that one can use to attack FR systems. The authors raised awareness to protect template feature vectors stored in FR systems' databases to avoid possible adversary attacks.", "questions": "See above weakness.", "limitations": "The authors addressed one limitation of the reconstruction model. However, the authors should address some other limitation mentioned in the weakness section above.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "The paper evaluates various attack scenarios with five different face recognition models. \nThe reconstructed face images have high quality. Some of them have similar IDs with the original images.", "weaknesses": "1. The novelty in the proposed framework is limited. Most of the components are based on the existing works, e.g. StyleGAN3 and WGAN.\n2. The proposed attack scenarios are straightforward as a combination of three possible feature extraction models. The authors should also rate the practical of the scenarios in addition to the level of difficulty since some scenarios cannot achieve in practice.\n3. In their problem formulation, the authors consider three different feature extraction models. However, there is an implicit assumption that the input and output of those models are the same. The authors should analyze cases when the input and output are different, e.g. handling various output dimension, various pre-processing steps.\n4. There are some errors in referring to tables in the paper, e.g. line 281, 287 and 300.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their time in reviewing our paper and for the comments. \nBelow, we tried to address the concerns raised by the reviewer:\n\n> The novelty in the proposed framework is limited. Most of the components are based on the existing works, e.g. StyleGAN3 and WGAN.\n\nWe acknowledge the reviewer's comment that our method leverages WGAN training to learn a mapping network that maps the facial templates to the intermediate latent space of StyleGAN. However, as shown in our experiments (especially our ablation study), training such a mapping network is not straightforward, and each part of our proposed method contributes to the performance of our method. \nTherefore, our proposed face reconstruction method is not a mere trivial combination of existing techniques. Even more, the proposed method achieves state-of-the-art results in template inversion attacks against five state-of-the-art face recognition systems on different face recognition datasets, which is not trivial either. \n\n> The proposed attack scenarios are straightforward as a combination of three possible feature extraction models. The authors should also rate the practical of the scenarios in addition to the level of difficulty since some scenarios cannot achieve in practice.\n\nFollowing the reviewer's suggestion, we prepared a table in our `general response` and further described the adversary's knowledge and difficulty of each attack scenario. We will include this table in the final version of the paper. We would like to highlight that we define five different attacks against face recognition systems (based on the adversary's knowledge and the target system). In particular, we evaluate the transferability of the reconstructed face images and the vulnerability of SOTA face recognition models to template inversion attacks, which have not been investigated in the literature. To our knowledge, this is the first work that comprehensively evaluates the transferability of the reconstructed face images in template inversion attacks.\n\n> In their problem formulation, the authors consider three different feature extraction models. However, there is an implicit assumption that the input and output of those models are the same. The authors should analyze cases when the input and output are different, e.g. handling various output dimension, various pre-processing steps.\n\nWhile we use three different face recognition models in our problem formulation, there is no issue if the pre-processing steps or dimensions be different in each of these face recognition models. \nFor differences in inputs (face images), because each of these models is performing independently on the given face image, the required pre-processing can be considered in the function of the face recognition model in our problem formulation. For differences in outputs (face templates), since the facial templates extracted by each model are compared to facial templates extracted by the same model, there is no conflict in the dimensions. The only point to be noted is that the input of our mapping network should have the same dimension as the templates of $F_{databse}$.\n\nLet us consider the complete pipeline of our problem formulation as depicted in Figure 2 of the paper. The first face recognition model $F_\\{database}$ uses its own pre-process and extracts facial templates from face images captured by the camera of face recognition system. These facial templates (extracted from $F_\\{database}$) are then used as input to our face reconstruction model. Therefore, the input of our mapping should have the same dimension as templates of $F_\\{database}$. In any case, the output of the face reconstruction network is a high-resolution face image. During training, this high-resolution face image is first pre-processed as required by $F_\\{loss}$ and the extracted templates are compared with templates of the original image extracted from $F_\\{loss}$. During inference, the generated high-resolution face image is pre-processed as required by $F_\\{target}$. Therefore, there is no conflict in the input/outputs in our pipeline.\n\nIn our experiments reported in the paper, all face recognition models except Swin take input with  $112\\times112$ resolution. However, the Swin model takes input with  $224\\times224$ resolution. \nHowever, we acknowledge that the dimensions of facial templates extracted by all face recognition models in our experiments are similar and equal to 512. \nTo show that our method can be used in case of different dimensions of facial templates and to showcase another face recognition model with different pre-processing, as a new experiment, we used a new model (VGGFace) with **different dimension of facial templates** (2048-dimension) and **different input image resolution** ($224\\times224$) which has a **different normalisation** as well as **different landmark coordinates for face alignment**. We used ArcFace as our $F_\\text{loss}$ and evaluated the reconstructed face images in attacks against different face recognition systems (as $F_{target}$) on the LFW dataset:\n\n|  | ArcFace | ElasticFace| Swin |\n|---|---|---|---|\n| $\\text{FMR}=10^{-2}\\%$ | 92.92 | 93.10 | 83.97 |\n| $\\text{FMR}=10^{-2}\\%$ | 86.61 | 82.39 | 72.89 |\n\nAs the results in this table show, our proposed method can be applied in the case that the input/output of face recognition models in our problem formulation ($F_{database}$, $F_{loss}$, $F_{target}$) are different.\n\n> There are some errors in referring to tables in the paper, e.g. line 281, 287 and 300.\n\nWe apologize for this error caused in our compilation before submission. We will fix these errors and will carefully revise the paper for any typos/errors.\n\n\n> Flag For Ethics Review\n\nWe have already included a section in the supplementary material and discussed different ethical aspects. \nRegarding the used datasets, we have also included a section in our supplementary material and discussed the licenses."}]

Author rebuttal:
We thank all reviewers for their time and valuable comments. 
We tried to address point-by-point the concerns raised by the reviewers in individual responses. 
For simplicity, we use the following numbers to refer to each reviewer in our responses:
- R1: Reviewer S2tQ 
- R2: Reviewer T7AV 
- R3: Reviewer RLF3 
- R4: Reviewer pmB2
- R5: Reviewer dWCe

There are also some common comments between reviewers, which we reply to in this general response and refer to it in individual responses:

**Comparison of the Attack Scenarios:**
R1 and R5 suggested providing a comparison of the attack scenarios defined in our paper. 
Following the reviewers' suggestion, we prepared Table 1 reported in our rebuttal pdf (attached) to further describe the adversary's knowledge and difficulty of each attack scenario. We will include this table in the final version and provide more descriptions to compare different attacks defined in our paper.
We would like to highlight that, to our knowledge, this is the first work that comprehensively evaluates the transferability of the reconstructed face images in template inversion attacks.
As a matter of fact, the transferability of reconstructed face images can lead to a critical threat where the adversary can use the reconstructed face image to enter another system in which the same user is enrolled.
However, to our knowledge, the transferability of the reconstructed face images in template inversion attacks has not been investigated in the literature.


**Using a Different Face Generator Network:**
R1, R2, R3, and R5 asked regarding the rationale behind the choice of StyleGAN and suggested exploring alternative synthesis networks.
StyleGAN is one of the most popular face generator models in the literature. It has available source code (and pretrained models), and several works have been using StyleGAN in different research problems. 
However, our method can also be used with other face generator networks. As a new experiment, we use StyleSwin (CVPR, 2022), which is another face generator model based on transformers. Figure 1 in our rebuttal pdf (attached) shows the reconstructed face images from ArcFace templates using StyleSwin in our method instead of StyleGAN. We used a similar mapping network and learned a mapping from facial templates to the intermediate latent space of StyleSwin. As these results show, our method can also be used with other face generator networks. We will add these results to the final version of the paper too.

[StyleSwin] Zhang et al., "StyleSwin: Transformer-based gan for high-resolution image generation." CVPR 2022. 

**Analysis of the Important Features in the Reconstructed Face Images:**
R1 raised the question of *what features between the template and synthetic images fool the recognition system* and suggested providing an  analysis with visualization to investigate why (and where) the attack works.
To answer this question raised by R1, we conducted a new experiment to explore what important information is encoded in the facial templates, and what features between the template and synthetic images fool the face recognition system. To this end, we applied the Grad-Cam algorithm using the face recognition model on the reconstructed face images to see which areas of the reconstructed face images are important and cause the facial templates of our reconstructed face images to be close to the original facial templates. Sample results of applying the Grad-Cam algorithm on our reconstructed face images are shown in Figure 2 of our rebuttal pdf file. As the results in this figure show, important areas that cause the reconstructed face images to have similar templates to the original ones correspond to areas such as eyes, nose, lips, etc. In particular, the area around the eyes seems to be the most important part in most of the reconstructed face images. These results also show that the general shape of the face (e.g., thin or chubby face), hairs, textures, etc., are not often necessarily important in the reconstructed face images, and thus, we can also conclude that these attributes are not well-encoded in the templates extracted by face recognition models. We will add this analysis to the final version too.

[Grad-Cam] Selvaraju, et al. "Grad-cam: Visual explanations from deep networks via gradient-based localization", ICCV 2017.


Finally, we would like to kindly invite all reviewers to further discussions should they still have any doubts or concerns.

Meta-review: This submission proposes a method for realistic face image reconstruction from facial templates within a face recognition system. The advantage of this method is designed to work in both white-box and black-box cases. The submission received four borderline accepts and one borderline reject. The AC noticed that the negative comment from T7AV is very short and without details on weakness of this submission while the other four reviewers reach a consensus of acceptance. After reading the submission, comments, and rebuttals, the AC recognized the merits of this submission, and noticed that the minor weaknesses are well addressed. Therefore, the AC suggests accepting this submission.
Decision: Accept (poster)