FaceLinkGen：隐私保护人脸识别中身份信息泄露的反思与身份提取新思路

FaceLinkGen: Rethinking Identity Leakage in Privacy-Preserving Face Recognition with Identity Extraction

February 2, 2026

作者: Wenqi Guo, Shan Du

cs.AI

摘要

基于变换的隐私保护人脸识别（PPFR）旨在验证身份的同时，隐藏面部数据免受攻击者和恶意服务提供商的窥探。现有评估大多将隐私等同于抵抗像素级重建的能力，并以PSNR和SSIM作为衡量指标。我们证明这种以重建为中心的视角存在缺陷。本文提出FaceLinkGen攻击方法，能够直接从受保护的模板中执行身份关联/匹配及人脸再生，而无需恢复原始像素。在三种前沿PPFR系统上的实验表明，FaceLinkGen实现了超过98.5%的匹配准确率和96%以上的再生成功率，即使在近乎零知识的设定下仍保持92%的匹配准确率与94%的再生成功率。这些结果揭示了PPFR评估中广泛采用的像素失真指标与实际隐私保护效果之间的结构性差距。我们证明视觉混淆技术会使身份信息在外部入侵者和不可信服务提供商面前大面积暴露。

English

Transformation-based privacy-preserving face recognition (PPFR) aims to verify identities while hiding facial data from attackers and malicious service providers. Existing evaluations mostly treat privacy as resistance to pixel-level reconstruction, measured by PSNR and SSIM. We show that this reconstruction-centric view fails. We present FaceLinkGen, an identity extraction attack that performs linkage/matching and face regeneration directly from protected templates without recovering original pixels. On three recent PPFR systems, FaceLinkGen reaches over 98.5\% matching accuracy and above 96\% regeneration success, and still exceeds 92\% matching and 94\% regeneration in a near zero knowledge setting. These results expose a structural gap between pixel distortion metrics, which are widely used in PPFR evaluation, and real privacy. We show that visual obfuscation leaves identity information broadly exposed to both external intruders and untrusted service providers.