Reversing Deep Face Embeddings with Probable Privacy Protection
Daile Osorio-Roig Paul A. Gerlitz Christian Rathgeb Christoph Busch
Generally, privacy-enhancing face recognition systems are designed to offer
permanent protection of face embeddings. Recently, so-called soft-biometric
privacy-enhancement approaches have been introduced with the aim of canceling
soft-biometric attributes. These methods limit the amount of soft-biometric
information (gender or skin-colour) that can be inferred from face embeddings.
Previous work has underlined the need for research into rigorous evaluations
and standardised evaluation protocols when assessing privacy protection
capabilities. Motivated by this fact, this paper explores to what extent the
non-invertibility requirement can be met by methods that claim to provide
soft-biometric privacy protection. Additionally, a detailed vulnerability
assessment of state-of-the-art face embedding extractors is analysed in terms
of the transformation complexity used for privacy protection. In this context,
a well-known state-of-the-art face image reconstruction approach has been
evaluated on protected face embeddings to break soft biometric privacy
protection. Experimental results show that biometric privacy-enhanced face
embeddings can be reconstructed with an accuracy of up to approximately 98%,
depending on the complexity of the protection algorithm.