pith. sign in

arxiv: 2605.03857 · v1 · submitted 2026-05-05 · 💻 cs.CV · cs.CR

A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert

Vedrana Krivoku\'ca Hahn , J\'er\'emy Maceiras , S\'ebastien Marcel This is my paper

Pith reviewed 2026-05-07 17:45 UTC · model grok-4.3

classification 💻 cs.CV cs.CR
keywords PolyProtectbiometric template protectionface recognitionirreversibilitytemplate inversionkey selectionoverlap parameter
0
0 comments X

The pith

A key selection algorithm makes PolyProtected face templates substantially harder to invert than random keys.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper analyzes the irreversibility of PolyProtect, which converts face embeddings into protected templates by applying subject-specific multivariate polynomials to overlapping segments of the embedding. It first demonstrates that a numerical solver using cosine distance inverts the templates more successfully than one using Euclidean distance. To address this, the authors develop a key selection algorithm that deliberately chooses the polynomial coefficients and exponents rather than selecting them at random. Experiments show the chosen keys produce templates with markedly higher reconstruction error under the cosine-distance attack and make irreversibility roughly the same across different overlap settings. This improves control over the known trade-off between irreversibility and recognition accuracy, while normalizing the embeddings before protection helps limit any accuracy drop.

Core claim

Replacing random key selection with a targeted algorithm that optimizes polynomial coefficients and exponents for higher reconstruction error under cosine-distance inversion yields PolyProtected templates that are significantly more resistant to inversion; the same algorithm also largely removes the dependence of irreversibility on the chosen overlap parameter.

What carries the argument

The key selection algorithm, which searches over possible coefficients and exponents to maximize the error achieved by a numerical solver minimizing cosine distance between an original embedding and its reconstruction from the protected template.

If this is right

  • Irreversibility improves without requiring changes to the overlap parameter.
  • The irreversibility-accuracy trade-off becomes easier to balance by choosing overlap values for reasons other than security.
  • Normalizing embeddings before applying PolyProtect reduces any loss in recognition accuracy caused by the protection step.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same key-selection principle could be tested on other polynomial or algebraic template protection schemes.
  • Real deployment would benefit from evaluating whether the selected keys remain robust when attackers have partial knowledge of the selection algorithm itself.

Load-bearing premise

That a numerical optimization attack minimizing cosine distance between original and reconstructed embeddings is a representative and strong model for real-world attempts to invert the protected templates.

What would settle it

An experiment in which an alternative inversion method, such as gradient-based optimization or a learned model trained on many protected templates, recovers the original embeddings from algorithm-selected keys with error rates comparable to those obtained from random keys.

Figures

Figures reproduced from arXiv: 2605.03857 by J\'er\'emy Maceiras, S\'ebastien Marcel, Vedrana Krivoku\'ca Hahn.

Figure 1
Figure 1. Figure 1: The focus of this work (highlighted in yellow) is on enhancing the view at source ↗
Figure 2
Figure 2. Figure 2: Mapping 512-dimensional V to P via PolyProtect, using C = [c1, c2, ..., c5] and E = [e1, e2, ..., e5], for different amounts of overlap. Within each set of embeddings, all possible pairs were com￾pared in terms of cosine distance, which resulted in: 3,150 genuine and 241,500 impostor scores for Multi-PIE; 15,165 genuine and 5,661,600 impostor scores for SOTERIA; and 1,194 genuine and 312,042 impostor score… view at source ↗
Figure 3
Figure 3. Figure 3: Detection Error Trade-off (DET) plots comparing the verification view at source ↗
Figure 4
Figure 4. Figure 4: Detection Error Trade-off (DET) plots comparing verification accuracy view at source ↗
Figure 6
Figure 6. Figure 6: Class (identity) separation provided by iResNet100 and EdgeFace face view at source ↗
Figure 5
Figure 5. Figure 5: Range of iResNet100 and EdgeFace template elements before and view at source ↗
Figure 7
Figure 7. Figure 7: Detection Error Trade-off (DET) plots comparing verification accuracy view at source ↗
Figure 8
Figure 8. Figure 8: Inversion scores for PolyProtected templates generated from normalized iResNet100 face embeddings using different amounts of overlap, when the view at source ↗
Figure 9
Figure 9. Figure 9: Inversion scores for PolyProtected templates generated from normalized iResNet100 face embeddings using different overlaps, when the keys ( view at source ↗
Figure 10
Figure 10. Figure 10: Detection Error Trade-off (DET) plots comparing verification accu view at source ↗
read the original abstract

This work presents a deeper analysis of the "irreversibility" property of PolyProtect, a biometric template protection method initially proposed for securing face embeddings. PolyProtect transforms embeddings into protected templates via multivariate polynomials, whose coefficients and exponents are distinct for each subject enrolled in the face recognition system. A polynomial is applied to consecutive sets of elements from a given embedding, where the amount of overlap between the sets is a tunable parameter. We begin our irreversibility analysis by demonstrating that PolyProtected templates are easier to invert using a numerical solver based on cosine distance, as opposed to Euclidean distance (used in the earlier PolyProtect work). To make this inversion more difficult, we then propose a "key selection algorithm", which tries to choose "keys" (coefficients and exponents of the PolyProtect polynomial) that enhance the irreversibility of PolyProtected templates, compared to when the keys are purely random. Our experiments show that this algorithm is effective at generating PolyProtected templates that are significantly more difficult to invert, and that it approximately equalises the irreversibility of PolyProtected templates generated using different "overlap" parameters. This allows for better control of the irreversibility versus accuracy trade-off, known to exist across different overlaps. We also show that accuracy in the PolyProtected domain can be affected by the range in which the embedding elements lie, but that this can be improved by normalizing the embeddings prior to applying PolyProtect. This work is reproducible using our open-source code.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

1 major / 1 minor

Summary. The paper analyzes irreversibility of PolyProtect, a polynomial-based transformation of face embeddings for template protection. It first demonstrates that a numerical solver using cosine distance inverts protected templates more successfully than the Euclidean-distance solver from prior work. It then introduces a key-selection algorithm to choose polynomial coefficients and exponents that reduce inversion success rates for the cosine solver and approximately equalize irreversibility across different overlap parameters. The work also notes that embedding normalization improves accuracy in the protected domain and provides open-source code for reproducibility.

Significance. If the key-selection method demonstrably increases resistance to inversion beyond the specific cosine-distance optimizer, the result would strengthen PolyProtect by improving control over the irreversibility-accuracy trade-off across overlap values. The open code is a clear strength for verification. However, because the irreversibility claims rest exclusively on success rates against one numerical solver, the practical significance for real-world template protection remains conditional on whether the improvement generalizes to other attack models.

major comments (1)
  1. [Experimental evaluation] The central claims that the key-selection algorithm produces templates that are 'significantly more difficult to invert' and 'approximately equalises the irreversibility' across overlap parameters are supported only by success rates of the cosine-distance numerical solver (see abstract and experimental results). No evaluations against gradient-based, evolutionary, or learned inversion attacks are reported; if a stronger or qualitatively different attack is unaffected by the heuristic, both claims become attack-specific rather than general irreversibility properties.
minor comments (1)
  1. [Method] The description of the key-selection algorithm would benefit from an explicit pseudocode or step-by-step procedure, including how candidate keys are generated and scored.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the constructive feedback on our manuscript. We address the major comment point by point below, acknowledging the scope of our evaluation while defending the contributions as presented.

read point-by-point responses

  1. Referee: The central claims that the key-selection algorithm produces templates that are 'significantly more difficult to invert' and 'approximately equalises the irreversibility' across overlap parameters are supported only by success rates of the cosine-distance numerical solver (see abstract and experimental results). No evaluations against gradient-based, evolutionary, or learned inversion attacks are reported; if a stronger or qualitatively different attack is unaffected by the heuristic, both claims become attack-specific rather than general irreversibility properties.

    Authors: We agree that the demonstrated improvements from the key-selection algorithm, including reduced inversion success rates and approximate equalization of irreversibility across overlap parameters, are evaluated exclusively against the cosine-distance numerical solver. This solver was selected because our analysis showed it inverts PolyProtected templates more effectively than the Euclidean-distance solver used in the original PolyProtect work. The key-selection heuristic is specifically designed to choose coefficients and exponents that increase the difficulty of this optimization-based inversion. The manuscript does not claim general irreversibility against all possible attacks (e.g., gradient-based, evolutionary, or learned methods), as such evaluations were beyond the scope of this focused analysis of the known numerical attack. We will revise the abstract, introduction, and conclusions to explicitly qualify the claims as applying to this attack model and add a discussion of this limitation along with suggestions for future work on broader attack evaluations. This partial revision clarifies the contribution without altering the experimental results. revision: partial

Circularity Check

0 steps flagged

No significant circularity in the paper's experimental claims

full rationale

The paper proposes a new key-selection algorithm and validates its effectiveness through direct empirical comparisons of inversion success rates (using a cosine-distance numerical solver) between selected keys and random keys, across different overlap parameters. These results are obtained from fresh experiments on normalized embeddings and do not reduce to any self-definitional equivalence, fitted parameters renamed as predictions, or load-bearing self-citations whose validity depends on the current work. The central claims about improved irreversibility and equalization are therefore independent empirical findings supported by the reported data and open-source code, rendering the derivation chain self-contained.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 0 invented entities

This is an applied empirical extension of prior PolyProtect work. No new mathematical derivations or postulated entities; relies on standard numerical optimization for inversion and biometric evaluation protocols.

free parameters (1)
  • overlap parameter
    Tunable value controlling the degree of overlap between consecutive sets of embedding elements when applying the polynomial.
axioms (1)
  • domain assumption Multivariate polynomials with subject-specific coefficients and exponents can provide a degree of irreversibility for biometric embeddings.
    Core premise inherited from the original PolyProtect method.

pith-pipeline@v0.9.0 · 5581 in / 1095 out tokens · 185402 ms · 2026-05-07T17:45:13.535555+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

33 extracted references · 33 canonical work pages

  1. [1]

    Biometric Template Protection: Why and How,

    C. Busch, M. Gomez-Barrero, and H. Otroshi Shahreza, “Biometric Template Protection: Why and How,” inHandbook of Biometric Tem- plate Protection: Motivation, Methods and Metrics, V . Krivoku ´ca Hahn, M. Gomez-Barrero, A. Ross, and S. Marcel, Eds. Springer, 2026, pp. 3–29

    work page 2026

  2. [2]

    Inverting face embeddings with convolutional neural networks

    A. Zhmoginov and M. Sandler, “Inverting face embeddings with con- volutional neural networks,”arXiv preprint arXiv:1606.04189, 2016

    work page Pith review arXiv 2016

  3. [3]

    Synthesizing Normalized Faces from Facial Identity Features,

    F. Cole, D. Belanger, D. Krishnan, A. Sarna, I. Mosseri, and W. T. Free- man, “Synthesizing Normalized Faces from Facial Identity Features,” in 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017, pp. 3386–3395

    work page 2017

  4. [4]

    On the Reconstruction of Face Images from Deep Face Templates,

    G. Mai, K. Cao, P. C. Yuen, and A. K. Jain, “On the Reconstruction of Face Images from Deep Face Templates,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 41, no. 5, pp. 1188–1202, 2019

    work page 2019

  5. [5]

    Face Recon- struction from Deep Facial Embeddings using a Convolutional Neural Network,

    H. Otroshi Shahreza, V . Krivoku ´ca Hahn, and S. Marcel, “Face Recon- struction from Deep Facial Embeddings using a Convolutional Neural Network,” in2022 IEEE International Conference on Image Processing (ICIP). IEEE, 2022, pp. 1211–1215

    work page 2022

  6. [6]

    De-anonymizing Facial Recognition Embeddings,

    I. F ´abi´an and G. G. Guly ´as, “De-anonymizing Facial Recognition Embeddings,”Infocommunications Journal, vol. 12, no. 2, pp. 50–56, 2020

    work page 2020

  7. [7]

    Beyond Identity: What Information Is Stored in Biometric Face Tem- plates?

    P. Terh ¨orst, D. F ¨ahrmann, N. Damer, F. Kirchbuchner, and A. Kuijper, “Beyond Identity: What Information Is Stored in Biometric Face Tem- plates?”arXiv preprint arXiv:2009.09918, 2020

    work page arXiv 2009

  8. [8]

    Biometric Template Protection for Neural-Network-Based Face Recognition Systems: A Survey of Methods and Evaluation Techniques,

    V . Krivoku ´ca Hahn and S. Marcel, “Biometric Template Protection for Neural-Network-Based Face Recognition Systems: A Survey of Methods and Evaluation Techniques,”IEEE Transactions on Information F orensics and Security, vol. 18, pp. 639–666, 2022

    work page 2022

  9. [9]

    Krivoku´ca Hahn, M

    V . Krivoku´ca Hahn, M. Gomez-Barrero, A. Ross, and S. Marcel, Eds., Handbook of Biometric Template Protection: Motivation, Methods and Metrics. Springer, 2026

    work page 2026

  10. [10]

    Feature Transformation-Based Biometrics Template Protection,

    X. Dong and A. B. J. Teoh, “Feature Transformation-Based Biometrics Template Protection,” inHandbook of Biometric Template Protection: Motivation, Methods and Metrics, V . Krivoku ´ca Hahn, M. Gomez- Barrero, A. Ross, and S. Marcel, Eds. Springer, 2026, pp. 79–106

    work page 2026

  11. [11]

    A Cancellable Face Template Scheme Based on Nonlinear Multi-Dimension Spectral Hash- ing,

    X. Dong, K. Wong, Z. Jin, and J. L. Dugelay, “A Cancellable Face Template Scheme Based on Nonlinear Multi-Dimension Spectral Hash- ing,” in2019 7th International Workshop on Biometrics and F orensics (IWBF), 2019, pp. 1–6

    work page 2019

  12. [12]

    Towards Protecting Face Embed- dings in Mobile Face Verification Scenarios,

    V . Krivoku ´ca Hahn and S. Marcel, “Towards Protecting Face Embed- dings in Mobile Face Verification Scenarios,”IEEE Transactions on Biometrics, Behavior , and Identity Science, vol. 4, no. 1, pp. 117–134, 2022

    work page 2022

  13. [13]

    Biometric Cryptosystems,

    C. Rathgeb, V . Fohr, and B. Tams, “Biometric Cryptosystems,” in Handbook of Biometric Template Protection: Motivation, Methods and Metrics, V . Krivoku´ca Hahn, M. Gomez-Barrero, A. Ross, and S. Marcel, Eds. Springer, 2026, pp. 107–132

    work page 2026

  14. [14]

    Euclidean-Distance Based Fuzzy Commitment Scheme for Biometric Template Security,

    B. P. Gilkalaye, A. Rattani, and R. Derakhshani, “Euclidean-Distance Based Fuzzy Commitment Scheme for Biometric Template Security,” in 2019 7th International Workshop on Biometrics and F orensics (IWBF), 2019, pp. 1–6

    work page 2019

  15. [15]

    Deep face fuzzy vault: Implementation and performance,

    C. Rathgeb, J. Merkle, J. Scholz, B. Tams, and V . Nesterowicz, “Deep face fuzzy vault: Implementation and performance,”Computers & Security, vol. 113, p. 102539, 2022

    work page 2022

  16. [16]

    Homomorphic Encryption for Biometric Template Protection,

    V . N. Boddeti, “Homomorphic Encryption for Biometric Template Protection,” inHandbook of Biometric Template Protection: Motivation, Methods and Metrics, V . Krivoku´ca Hahn, M. Gomez-Barrero, A. Ross, and S. Marcel, Eds. Springer, 2026, pp. 133–170

    work page 2026

  17. [17]

    A Secure Face-Verification Scheme Based on Homomorphic Encryption and Deep Neural Net- works,

    Y . Ma, L. Wu, X. Gu, J. He, and Z. Yang, “A Secure Face-Verification Scheme Based on Homomorphic Encryption and Deep Neural Net- works,”IEEE Access, vol. 5, pp. 16 532–16 538, 2017

    work page 2017

  18. [18]

    Secure Face Matching Using Fully Homomorphic Encryption,

    V . N. Boddeti, “Secure Face Matching Using Fully Homomorphic Encryption,” in2018 IEEE 9th International Conference on Biometrics Theory, Applications and Systems (BTAS), 2018, pp. 1–10

    work page 2018

  19. [19]

    HERS: Homomorphically Encrypted Representation Search,

    J. J. Engelsma, A. K. Jain, and V . N. Boddeti, “HERS: Homomorphically Encrypted Representation Search,”IEEE Transactions on Biometrics, Behavior , and Identity Science, vol. 4, no. 3, pp. 349–360, 2022

    work page 2022

  20. [20]

    Using Neural Networks to Learn Biometric Template Protection,

    V . Krivoku´ca Hahn, M. Valenti, V . Talreja, N. Nasrabadi, T. S. Ng, and A. B. J. Teoh, “Using Neural Networks to Learn Biometric Template Protection,” inHandbook of Biometric Template Protection: Motivation, Methods and Metrics, V . Krivoku´ca Hahn, M. Gomez-Barrero, A. Ross, and S. Marcel, Eds. Springer, 2026, pp. 171–201

    work page 2026

  21. [21]

    Deep Secure Encoding for Face Template Protection,

    R. K. Pandey, Y . Zhou, B. U. Kota, and V . Govindaraju, “Deep Secure Encoding for Face Template Protection,” in2016 IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 2016, pp. 77–83

    work page 2016

  22. [22]

    Face Template Protection Using Deep Convolutional Neural Network,

    A. K. Jindal, S. Chalamala, and S. K. Jami, “Face Template Protection Using Deep Convolutional Neural Network,” in2018 IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition Workshops (CVPRW), 2018, pp. 575–5758

    work page 2018

  23. [23]

    Zero-Shot Deep Hashing and Neural Network Based Error Correction for Face Template Protection,

    V . Talreja, M. C. Valenti, and N. M. Nasrabadi, “Zero-Shot Deep Hashing and Neural Network Based Error Correction for Face Template Protection,” in2019 IEEE 10th International Conference on Biometrics Theory, Applications and Systems (BTAS), 2019, pp. 1–10

    work page 2019

  24. [24]

    Secure Triplet Loss: Achieving Cancelability and Non-Linkability in End-to-End Deep Bio- metrics,

    J. R. Pinto, M. V . Correia, and J. S. Cardoso, “Secure Triplet Loss: Achieving Cancelability and Non-Linkability in End-to-End Deep Bio- metrics,”IEEE Transactions on Biometrics, Behavior , and Identity Science, vol. 3, no. 2, pp. 180–189, 2021

    work page 2021

  25. [25]

    SecureFace: Face Template Protection,

    G. Mai, K. Cao, X. Lan, and P. C. Yuen, “SecureFace: Face Template Protection,”IEEE Transactions on Information F orensics and Security, vol. 16, pp. 262–277, 2021

    work page 2021

  26. [26]

    Securing Face and Fingerprint Templates in Humanitarian Biometric Systems,

    G. Stragapede, S. Merrick, V . Krivoku ´ca Hahn, J. Sukaitis, and V . Graf Narbel, “Securing Face and Fingerprint Templates in Humanitarian Biometric Systems,” in2025 IEEE International Joint Conference on Biometrics (IJCB). IEEE, 2025, pp. 1–10

    work page 2025

  27. [27]

    A Novel and Responsible Dataset for Face Presentation Attack Detection on Mobile Devices,

    N. Ramoly, A. Komaty, V . K. Hahn, L. Younes, A.-M. Awal, and S. Marcel, “A Novel and Responsible Dataset for Face Presentation Attack Detection on Mobile Devices,” in2024 IEEE International Joint Conference on Biometrics (IJCB). IEEE, 2024, pp. 1–9

    work page 2024

  28. [28]

    Deep Residual Learning for Image Recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep Residual Learning for Image Recognition,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778

    work page 2016

  29. [29]

    ArcFace: Additive An- gular Margin Loss for Deep Face Recognition,

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “ArcFace: Additive An- gular Margin Loss for Deep Face Recognition,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp. 4690–4699

    work page 2019

  30. [30]

    Edgeface: Efficient face recognition model for edge devices,

    A. George, C. Ecabert, H. O. Shahreza, K. Kotwal, and S. Marcel, “Edgeface: Efficient face recognition model for edge devices,”IEEE Transactions on Biometrics, Behavior , and Identity Science, vol. 6, no. 2, pp. 158–168, 2024

    work page 2024

  31. [31]

    FaceNet: A Unified Embedding for Face Recognition and Clustering,

    F. Schroff, D. Kalenichenko, and J. Philbin, “FaceNet: A Unified Embedding for Face Recognition and Clustering,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2015, pp. 815–823

    work page 2015

  32. [32]

    Multi-PIE,

    R. Gross, I. Matthews, J. Cohn, T. Kanade, and S. Baker, “Multi-PIE,” Image and Vision Computing, vol. 28, no. 5, pp. 807–813, 2010

    work page 2010

  33. [33]

    in-Car Biometrics (iCarB) Datasets for Driver Recognition: Face, Fingerprint, and V oice,

    V . Krivoku ´ca Hahn, J. Maceiras, A. Komaty, P. Abbet, and S. Marcel, “in-Car Biometrics (iCarB) Datasets for Driver Recognition: Face, Fingerprint, and V oice,”arXiv preprint arXiv:2411.17305, 2024

    work page arXiv 2024