Pith. sign in

REVIEW 5 major objections 6 minor 28 references

Inverting Black-Box Face Recognition Systems via Zero-Order Optimization in Eigenface Space

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read With access limited to the cosine similarity score returned by a face recognition system, DarkerBB reconstructs color face images that are still recognized by state-of-the-art verification models.

desk verdict Score-only face inversion via PCA prior and zero-order optimization is real and worth refereeing, but the SOTA comparison needs protocol-matched baselines and error bars. read the letter →

arxiv 2506.09777 v1 pith:XNUCMA5R submitted 2025-06-11 cs.CV cs.AI

Anton Razzhigaev , Matvey Mikhalchuk , Klim Kireev , Igor Udovichenko , Andrey Kuznetsov , Aleksandr Petiushko This is my paper · ORCID
classification cs.CVcs.AI
keywords facereconstructionmodelinversionblack-boxattackzero-orderoptimizationeigenfacespacePCApriorcosinesimilarityprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether a black-box face recognition service that returns nothing but a similarity score between a query image and a target identity can be turned into an oracle for reconstructing that identity's face. It answers yes: DarkerBB maximizes the score by optimizing in a 1024-dimensional eigenface space built from PCA, using a zero-order gradient estimate from two queries per step. On LFW, AgeDB-30, and CFP-FP, reconstructed faces replace one half of positive verification pairs and still pass at accuracies close to the real-image upper bound, e.g., 99.78% on LFW when ArcFace is the target and evaluator. The result matters because online services exposing fine-grained similarity scores would inherit a privacy risk that does not require leaking embeddings.

What carries the argument

The mechanism is the combination of a PCA eigenface basis and a 2-point zero-order gradient estimator. Eigenfaces give a k=1024 linear latent space in which coordinates are normalized to unit variance and any point renders a plausible face, acting as a strong prior that keeps the search in face-like territory. The gradient estimator samples a spherically symmetric Gaussian direction u, queries the black-box similarity score at c(t)+u and c(t)-u, and computes G = k (s2-s1)/(2σ) u, which is then used in a stochastic gradient ascent step. The multi-start strategy runs short optimizations from several initializations and keeps the best one for a longer main phase. The central-difference estimate is the bridge that converts scalar cosine outputs into a usable ascent direction without any access to embeddings or gradients.

What would settle it

Run DarkerBB against a black-box recognizer whose returned similarity scores are quantized to a few decimal digits (or coarser, e.g., rounded to 0.01), keeping the PCA prior and all hyperparameters fixed; a collapse in verification accuracy of the reconstructed faces would confirm the dependence on fine-grained smooth scores, while unchanged accuracy would refute it.

Watch

Extended reading notes

Core claim

The central claim is that the cosine-similarity score returned by a black-box recognizer is a smooth enough signal to guide gradient-free ascent in a PCA eigenface space, yielding faces that pass verification. The prior is the PCA eigenface space trained on FFHQ; any candidate face is rendered as the mean face plus a linear combination of 1024 eigenfaces. Each optimization step samples one random Gaussian direction, queries the recognizer at the two perturbed points, forms a central-difference estimate of the directional derivative, and moves the PCA coordinates along that direction. A multi-start phase selects the most promising trajectory. With roughly 20,000 optimization steps (40,000 queries), the reconstructed color face is identifiable not only by the target model (ArcFace or FaceNet) but often by an independent verification model, reaching verification accuracies within a few points of real images and outperforming prior similarity-score-only methods.

Load-bearing premise

The attack works only if the similarity score is smooth enough in the 1024-dimensional eigenface space that one two-point central-difference estimate from a single random direction reliably points uphill; a recognizer with a jumpy or noisy score surface would defeat it.

Editorial extensions

If this is right

  • A face recognition service that returns fine-grained cosine similarity scores for a queried identity is exposed to identity reconstruction even when it never exposes embeddings, gradients, or class probabilities.
  • Reconstructions transfer across recognizers: faces optimized against ArcFace are accepted by FaceNet at 92.23% on LFW, showing the attack generalizes beyond the exact target model.
  • The attack's cost is about 40,000 queries per face, which is practical for a determined adversary but can be throttled by rate limits or by returning only coarse feedback (both limitations the paper acknowledges).
  • On the benchmark protocol, replacing one image in a positive pair with the reconstruction keeps verification accuracy close to the real-image upper bound (99.78% vs 99.83% on LFW with ArcFace), which is the paper's state-of-the-art claim in the similarity-only setting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Any service that returns a smooth scalar match score for a probe against an enrolled identity, such as reverse image search or look-alike finders, could in principle be attacked with the same zero-order recipe; the paper demonstrates this only for face recognition, but the mechanism is generic to smooth score functions.
  • Replacing the PCA eigenface prior with a stronger generative prior, such as a StyleGAN or diffusion latent space, would likely raise photorealistic fidelity and cross-model transfer, at the cost of additional infrastructure and hyperparameters; the paper's ablation shows the linear prior is already sufficient for verification.
  • Because the central-difference estimator relies on fine-grained score differences, simple defenses such as quantizing the output score, adding calibrated noise, or limiting query rates should break or severely slow the attack; testing this defense is a natural next step.
  • The same eigenface-plus-zero-order idea may apply to inverting other black-box perceptual similarity models, such as voice, gait, or object appearance, wherever a low-dimensional linear prior over plausible signals exists.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes DarkerBB, a method for reconstructing color face images from a black-box face recognition system using only cosine similarity scores. The method performs zero-order (derivative-free) optimization in a 1024-dimensional PCA eigenface space derived from FFHQ, using a two-point central-difference estimate of the gradient along random Gaussian directions, with a multi-start strategy and roughly 40,000 similarity queries per reconstruction. Experiments on LFW, AgeDB-30, and CFP-FP report verification accuracies when one image in a positive pair is replaced by the reconstruction, evaluated with both ArcFace and FaceNet. The paper claims state-of-the-art verification accuracy in the similarity-only setting and competitive query efficiency.

Significance. If the claims hold, the paper demonstrates a practical privacy threat: a face recognition service that exposes only a similarity score can be inverted into a recognizable color face, and the reconstructed faces transfer to independent recognition systems. The method is simple, the PCA-based search space is an interesting low-cost prior, the code is promised on GitHub, and the FaceNet-transfer columns in Table 2 provide credible independent evidence that the reconstructions preserve identity beyond the exact model used for optimization. However, the same-model ArcFace columns are partly forced by the optimization objective, the comparison to prior work is not protocol-matched, hyperparameters are selected on LFW and then LFW is reported as a result, and no variance or convergence analysis is provided. These gaps do not refute the central capability, but they substantially weaken the 'state-of-the-art' claim and the reproducibility of the method.

major comments (5)
  1. [Section 3.2, Algorithm 1] The learning rate eta is a free parameter of the method but its value is never reported. Algorithm 1 lists eta as an input, and the update c_current <- c_current + eta G depends critically on its magnitude, yet no default, schedule, or tuning method appears anywhere in the paper. Since the gradient estimate G is scaled by k and sigma (on average by k*sigma), the effective step size is unknown, making the experiments irreproducible and the convergence behavior impossible to assess.
  2. [Section 3.2] The two-point gradient estimator is used without any analysis of its variance or convergence. In the k=1024-dimensional PCA space, G is a single sample along one random Gaussian direction; the paper calls this the 'full gradient estimate' without quantifying the estimation error. The similarity surface over PCA coordinates is never characterized, and no variance reduction or multiple-direction averaging is used. Without an empirical variance estimate over iterations, a convergence plot for multiple seeds, or a formal smoothness/convergence argument, the central claim that 40,000 queries suffice to reach a recognizable face is not fully supported.
  3. [Section 5, Table 2] The 'state-of-the-art in the similarity-only setting' claim is not established by the experimental design. The prior-art baselines in Table 2 (NbNet, Vec2Face, ID3PM, StyleGAN search) require full embedding access, not similarity scores; Gaussian Blobs additionally requires the embedding norm; and no query-budget-matched comparison is provided for any baseline. The paper should compare against score-only baselines under identical alignment, flip-concatenation, PCA/prior data, and query budgets, and should report the query count for every method. Without this, the comparison does not isolate the contribution of the similarity-only setting.
  4. [Section 6, Table 3 and Section 4.2] The headline results lack variance information, and the LFW result is in-sample for hyperparameter selection. The ablations in Table 3 select k=1024, sigma=0.30, N_restarts=10, and 20,000 iterations based on FaceNet accuracy on LFW, and Table 2 then reports LFW as the first benchmark row. No standard deviations, confidence intervals, number of reconstructed identities, or per-fold results are given. Please report error bars and perform hyperparameter selection on a validation split that is not also reported as a test result, or explicitly justify that the ablations do not bias the LFW numbers.
  5. [Table 2, DarkerBB (ArcFace target) rows] The ArcFace↑ columns for the DarkerBB (ArcFace target) rows use the same cosine similarity that the optimization directly maximizes, so those numbers are partly forced by the objective and are not independent evidence of identity preservation. The FaceNet↑ columns are the meaningful transfer evidence and should be presented as the primary support for the claims, with the same-model columns clearly labeled as an optimization sanity check rather than as evidence of generalization.
minor comments (6)
  1. [Section 3.2] The perturbation variable u is sampled from N(0, sigma^2 I), but the text says 'a small perturbation scalar sigma > 0' and the queries use c +/- u. Please clarify whether the perturbation is u or sigma*u, and state the relationship to the 2*sigma denominator in the central-difference estimate.
  2. [Algorithm 1] All restarts initialize c_current to 0, while the comment 'Or other random initialization' suggests alternatives that are not used or described. Please clarify whether initialization diversity is actually exploited and, if so, how.
  3. [Figure 4] The plot does not state which dataset or identity is shown or whether it is a single run. Please provide this information and, ideally, show multiple seeds with variance bands so the reader can assess the variability of the optimization trajectory.
  4. [Table 3] The FaceNet differences between k=1024 (92.23%) and k=2048 (92.22%), and between sigma=0.15 (91.42%) and sigma=0.30 (92.23%), are small and likely within noise. Without error bars, the ablation-based hyperparameter choices appear fragile.
  5. [Section 4.2] Please state how many positive pairs are reconstructed per dataset and whether the same reconstruction protocol (including alignment and flip-concatenation) is applied to all baseline methods in Table 2.
  6. [References] There are several formatting glitches, e.g., 'V ec2Face' in Section 2 and inconsistent capitalization in the reference list. Please proofread the manuscript and reference formatting.

Circularity Check

2 steps flagged · score 4.0 of 10

Same-model verification columns in Table 2 are the optimization objective by construction; FaceNet transfer columns and out-of-sample benchmarks provide independent support.

  1. self definitional [Section 3.2, Algorithm 1; Section 4.2-4.3; Table 2]
    "The core of DarkerBB is an iterative optimization process to find the PCA coordinates c that generate a face image I(c) maximizing the similarity score S(I(c), idtarget) with respect to a target identity idtarget, as provided by the black-box face recognition model. ... When testing reconstructed images in positive pairs, the first photo of the pair is replaced by the version reconstructed by DarkerBB. The similarity score is then computed between the reconstructed image and the original second image of the pair."

    For the 'DarkerBB (ArcFace target)' rows, the ArcFace↑ evaluation column uses the same cosine similarity S and the same ArcFace model that Algorithm 1 explicitly maximizes; the reconstructed image is selected precisely to make this score large. High verification accuracy on that column is therefore forced by the optimization objective rather than being an independent test of identity disclosure. The same holds for 'DarkerBB (FaceNet target)' in the FaceNet↑ column. Only the cross-model columns, where the target model differs from the evaluator, provide externally informative evidence.

  2. fitted input called prediction [Section 6, Table 3; Section 5, Table 2 (LFW row)]
    "All ablation studies were conducted on the LFW dataset, using ArcFace as the target face recognition system for optimization and FaceNet for evaluating generalization... Based on this observation, and to balance reconstruction quality with generalization, we selected 20,000 optimization iterations for all main experiments reported in this paper."

    The LFW FaceNet accuracy of 92.23% reported in Table 2 is the same LFW/FaceNet value used in Section 6 to select k=1024, sigma=0.30, Nrestarts=10, and 20,000 iterations. The headline LFW FaceNet result is thus an in-sample selected value, not an out-of-sample prediction for LFW. The AgeDB-30 and CFP-FP results remain out-of-sample and are not affected by this tuning step.

full rationale

The paper is an empirical attack paper rather than a theorem derivation, and its central claim is not wholly circular: the FaceNet transfer columns (e.g., ArcFace-target reconstructions scoring 92.23% on LFW, 82.00% on AgeDB-30, and 83.23% on CFP-FP with FaceNet) use an evaluator different from the optimization target and therefore provide genuine external evidence that the reconstructed images carry identity information. The main circular component is that, for same-model rows in Table 2, the evaluation metric is exactly the cosine similarity that Algorithm 1 maximizes; those columns report the value of the objective rather than an independent prediction. A second, milder issue is that Section 6 selects all key hyperparameters on LFW, and the resulting LFW FaceNet number is then presented as a headline result, making that row partially in-sample. The self-citation to Gaussian Blobs (Razzhigaev et al. 2020) is not load-bearing, and the zero-order estimator is attributed to an external reference (Gasnikov et al. 2023), so no self-citation chain forces the result. Overall the paper has genuine independent support, but the same-model evaluation columns should be read as optimization outcomes, not as predictions.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central method relies on a hand-picked linear prior (FFHQ PCA) and several hyperparameters selected by ablation on the LFW benchmark; no new entities are postulated. The target-model verification columns partly measure the same function being optimized, which is why the FaceNet transfer column carries the independent evidence.

free parameters (6)
  • PCA dimensionality k = 1024
    Selected via ablation on LFW (Table 3) balancing ArcFace accuracy and FaceNet generalization.
  • noise scale sigma = 0.3
    Selected via ablation on LFW (Table 3); 0.3 gives best FaceNet generalization.
  • number of restarts N_restarts = 10
    Selected via ablation on LFW (Table 3); improves FaceNet generalization over 3 restarts.
  • main iterations N_main_iter = 15000
    Together with 500 restart iterations gives 20,000 steps, chosen from Figure 4 where FaceNet similarity saturates; the paper states this choice explicitly in Section 6.
  • restart iterations N_restart_iter = 500
    Chosen as part of the total 20,000-iteration budget described in Section 3.3.
  • learning rate eta = not reported
    The gradient ascent update in Algorithm 1 uses eta, but its value is never stated in the paper, which blocks independent replication.
assumptions (4)
  • domain assumption PCA eigenface space from FFHQ provides an expressive linear prior for faces such that maximizing similarity over this space finds recognizable reconstructions.
    Section 3.1 defines the latent space; the entire method depends on this prior being sufficient.
  • domain assumption The black-box similarity function is sufficiently Lipschitz-smooth for a 2-point zero-order gradient estimate with sigma=0.3 to give useful ascent directions.
    Section 3.2 and Algorithm 1; no smoothness or variance analysis is provided.
  • domain assumption The recognition system returns fine-grained cosine similarity scores and tolerates about 40,000 queries per identity without rate limiting.
    Section 8 acknowledges this as a limitation; the method does not work with coarse or binary feedback.
  • standard math Standard PCA and Gaussian random direction properties (central limit, concentration) are valid for the 1024-dimensional space.
    Background used throughout Section 3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Inverting Black-Box Face Recognition Systems via Zero-Order Optimization in Eigenface Space." pith.science (2026). https://pith.science/paper/XNUCMA5R

@misc{pith2026250609777,
  author       = {Pith},
  title        = {Pith review of: Inverting Black-Box Face Recognition Systems via Zero-Order Optimization in Eigenface Space},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XNUCMA5R}},
  note         = {Machine review of arXiv:2506.09777}
}
read the original abstract

Reconstructing facial images from black-box recognition models poses a significant privacy threat. While many methods require access to embeddings, we address the more challenging scenario of model inversion using only similarity scores. This paper introduces DarkerBB, a novel approach that reconstructs color faces by performing zero-order optimization within a PCA-derived eigenface space. Despite this highly limited information, experiments on LFW, AgeDB-30, and CFP-FP benchmarks demonstrate that DarkerBB achieves state-of-the-art verification accuracies in the similarity-only setting, with competitive query efficiency.

Figures

Figures reproduced from arXiv: 2506.09777 by the authors.

Figure 1
Figure 1. Diagram illustrating face recovery from similarity queries to the face recognition system. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Multi-start strategy leads to higher final similarity scores by selecting better initialization [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Examples of recovered faces from LFW dataset and corresponding similarities from Arcface [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Cosine similarity during optimization. Left: similarity measured by the target ArcFace [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Reconstruction of a real image using varying numbers of PCA components [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 23 canonical work pages

  1. [1]

    Arcface: Additive angular margin loss for deep face recognition, 2019

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition, 2019

    work page 2019

  2. [2]

    Vec2face: Unveil human faces from their blackbox features in face recognition

    Chi Nhan Duong, Thanh-Dat Truong, Khoa Luu, Kha Gia Quach, Hung Bui, and Kaushik Roy. Vec2face: Unveil human faces from their blackbox features in face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6132--6141, 2020

    work page 2020

  3. [3]

    Model inversion attacks that exploit confidence information and basic countermeasures

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 1322--1333, 2015

    work page 2015

  4. [4]

    On the vulnerability of face verification systems to hill-climbing attacks

    Javier Galbally, Chris McCool, Julian Fierrez, S \'e bastien Marcel, and Javier Ortega-Garcia. On the vulnerability of face verification systems to hill-climbing attacks. Pattern Recognition, 43 0 (3): 0 1027--1038, 2010

    work page 2010

  5. [5]

    Randomized gradient-free methods in convex optimization

    Alexander Gasnikov, Darina Dvinskikh, Pavel Dvurechensky, Eduard Gorbunov, Aleksandr Beznosikov, and Alexander Lobanov. Randomized gradient-free methods in convex optimization. In Encyclopedia of Optimization, pages 1--15. Springer, 2023

    work page 2023

  6. [6]

    Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller

    Gary B. Huang, Manu Ramesh, Tamara Berg, and Erik Learned-Miller. Labeled faces in the wild: A database for studying face recognition in unconstrained environments. Technical Report 07-49, University of Massachusetts, Amherst, October 2007

    work page 2007

  7. [7]

    Controllable inversion of black-box face recognition models via diffusion

    Michal Kansy, Alexandre Ra \"e l, Gabriele Mignone, Jakub Naruniec, Christopher Schroers, Markus Gross, and Roger M Weber. Controllable inversion of black-box face recognition models via diffusion. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops, pages 3167--3177, 2023

    work page 2023

  8. [8]

    A style-based generator architecture for generative adversarial networks

    Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4401--4410, 2019

    2019

Show all 28 references
  1. [9]

    Model inversion attack by integration of deep generative models: Privacy-sensitive face generation from a face recognition system

    Mohammad Hossein Khosravy, Keigo Nakamura, Yasuhiro Hirose, Norihisa Nitta, and Noboru Babaguchi. Model inversion attack by integration of deep generative models: Privacy-sensitive face generation from a face recognition system. IEEE Transactions on Information Forensics and S...

    2022

  2. [10]

    Understanding deep image representations by inverting them

    Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 5188--5196, 2015

    2015

  3. [11]

    On the reconstruction of face images from deep face templates

    Guangcan Mai, Kai Cao, Pong C Yuen, and Anil K Jain. On the reconstruction of face images from deep face templates. IEEE transactions on pattern analysis and machine intelligence, 41 0 (5): 0 1188--1202, 2018

    2018

  4. [12]

    Agedb: the first manually collected, in-the-wild age database

    Stylianos Moschoglou, Athanasios Papaioannou, Christos Sagonas, Jiankang Deng, Irene Kotsia, and Stefanos Zafeiriou. Agedb: the first manually collected, in-the-wild age database. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshop, volume...

    2017

  5. [13]

    Label-only model inversion attacks via knowledge transfer

    Bach-Nga Nguyen, Keshigeyan Chandrasegaran, Mehdi Abdollahzadeh, and Ngai-Man Cheung. Label-only model inversion attacks via knowledge transfer. In Advances in Neural Information Processing Systems (NeurIPS), volume 36, 2023

    2023

  6. [14]

    Blackbox face reconstruction from deep facial embeddings using a different face recognition model

    Hadi Otroshi-Shahreza and S \'e bastien Marcel. Blackbox face reconstruction from deep facial embeddings using a different face recognition model. In Proceedings of the IEEE International Conference on Image Processing (ICIP), pages 2435--2439, 2023 a

    2023

  7. [15]

    Face reconstruction from facial templates by learning latent space of a generator network

    Hadi Otroshi-Shahreza and S \'e bastien Marcel. Face reconstruction from facial templates by learning latent space of a generator network. In Advances in Neural Information Processing Systems (NeurIPS), volume 36, 2023 b

    2023

  8. [16]

    Comprehensive vulnerability evaluation of face recognition systems to template inversion attacks via 3d face reconstruction

    Hadi Otroshi-Shahreza and S \'e bastien Marcel. Comprehensive vulnerability evaluation of face recognition systems to template inversion attacks via 3d face reconstruction. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023 c . Early Access

    2023

  9. [17]

    Face reconstruction from partially leaked facial embeddings

    Hadi Otroshi-Shahreza and S \'e bastien Marcel. Face reconstruction from partially leaked facial embeddings. In Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1--5, 2024

    2024

  10. [18]

    Face reconstruction from face embeddings using adapter to a face foundation model

    Hadi Otroshi-Shahreza, Annie George, and S \'e bastien Marcel. Face reconstruction from face embeddings using adapter to a face foundation model. arXiv preprint arXiv:2411.03960, 2024

    2024 arXiv

  11. [19]

    Arc2Face : A foundation model of human faces

    Filippos Papantoniou, Alexandros Lattas, Spyridon Moschoglou, Jiankang Deng, Bernhard Kainz, and Stefanos Zafeiriou. Arc2Face : A foundation model of human faces. arXiv preprint arXiv:2403.11641, 2024

    2024 arXiv

  12. [20]

    A closer look at GAN priors: Exploiting intermediate features for enhanced model inversion attacks

    Yiliang Qiu, Hao Fang, Hongtao Yu, Bo Chen, Ming Qiu, and Shu-Tao Xia. A closer look at GAN priors: Exploiting intermediate features for enhanced model inversion attacks. In European Conference on Computer Vision (ECCV), pages 109--126, 2024

    2024

  13. [21]

    Black-box face recovery from identity features, 2020

    Anton Razzhigaev, Klim Kireev, Edgar Kaziakhmedov, Nurislam Tursynbek, and Aleksandr Petiushko. Black-box face recovery from identity features, 2020

    2020

  14. [22]

    Facenet: A unified embedding for face recognition and clustering

    Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Jun 2015. doi:10.1109/cvpr.2015.7298682. URL http://dx.doi.org/10.1109/CVPR.2015.7298682

    2015

  15. [23]

    Sengupta, J

    S. Sengupta, J. Cheng, C. Castillo, V. Patel, R. Chellappa, and D. Jacobs. Frontal to profile face verification in the wild. In IEEE Conference on Applications of Computer Vision, February 2016

    2016

  16. [24]

    Plug & Play attacks: Towards robust and flexible model inversion attacks

    Lukas Struppek, David Hintersdorf, Adilson Dias Alves Correia, Amos Adler, and Kristian Kersting. Plug & Play attacks: Towards robust and flexible model inversion attacks. In Proceedings of the 39th International Conference on Machine Learning (ICML), pages 20522--20545, 2022

    2022

  17. [25]

    Realistic face reconstruction from deep embeddings

    Edward Vendrow and Joshua Vendrow. Realistic face reconstruction from deep embeddings. In NeurIPS 2021 Workshop Privacy in Machine Learning, 2021

    2021

  18. [26]

    Diffusion-driven universal model inversion attack for face recognition

    Hao Wang, Shuo Wang, Chun-Shien Lu, and Isao Echizen. Diffusion-driven universal model inversion attack for face recognition. arXiv preprint arXiv:2504.18015, 2025

    2025 arXiv

  19. [27]

    Label-only model inversion attacks: Adaptive boundary exclusion for limited queries

    Jiayi Wu, Cheng Wan, Hao Chen, Zheng Zheng, and Yu Sun. Label-only model inversion attacks: Adaptive boundary exclusion for limited queries. Neurocomputing, 2025

    2025

  20. [28]

    The secret revealer: Generative model-inversion attacks against deep neural networks

    Yuheng Zhang, Rui Jia, Hongge Pei, Weiyue Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 253--261, 2020

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.