Privacy-Preserving Face Recognition Using Trainable Feature Subtraction

Privacy-Preserving Face Recognition Using Trainable Feature Subtraction

19 Mar 2024 | Yuxi Mi, Zhizhou Zhong, Yuge Huang, Jiazen Ji, Jianqing Xu, Jun Wang, Shaoming Wang, Shouhong Ding, Shuigeng Zhou
This paper introduces MinusFace, a novel privacy-preserving face recognition method that effectively protects face images from viewing and recovery attacks. Inspired by image compression, MinusFace generates a visually uninformative face image through feature subtraction between an original face and its model-produced regeneration. Recognizable identity features are preserved by co-training a recognition model on its high-dimensional feature representation. To enhance privacy, the high-dimensional representation is crafted through random channel shuffling, resulting in randomized recognizable images devoid of attacker-leverageable texture details. MinusFace achieves high recognition accuracy and effective privacy protection, as demonstrated through experiments. The method involves three key contributions: (1) introducing feature subtraction as a new methodology to generate protective face representations by capturing residue between an original image and its regeneration; (2) proposing two specific techniques, high-dimensional mapping and random channel shuffling, to ensure recognizability and accuracy for the residue; and (3) presenting a novel PPFR method, MinusFace, which achieves high recognition accuracy and superior privacy protection compared to state-of-the-art methods. MinusFace works by first generating a visually uninformative residue representation through feature subtraction. This residue is then mapped to high-dimensional feature channels to preserve identity features. Random channel shuffling is applied to further enhance privacy by obscuring facial texture signals and increasing randomness, making recovery attacks difficult. The final protective representation is obtained by decoding the shuffled high-dimensional residue into a spatial image. Experiments show that MinusFace outperforms existing privacy-preserving face recognition methods in terms of both recognition accuracy and privacy protection. It achieves on-par performance with the best frequency-based methods and significantly outperforms others. MinusFace is also efficient and compatible with different face recognition backbones and training objectives, making it a practical solution for privacy-preserving face recognition.This paper introduces MinusFace, a novel privacy-preserving face recognition method that effectively protects face images from viewing and recovery attacks. Inspired by image compression, MinusFace generates a visually uninformative face image through feature subtraction between an original face and its model-produced regeneration. Recognizable identity features are preserved by co-training a recognition model on its high-dimensional feature representation. To enhance privacy, the high-dimensional representation is crafted through random channel shuffling, resulting in randomized recognizable images devoid of attacker-leverageable texture details. MinusFace achieves high recognition accuracy and effective privacy protection, as demonstrated through experiments. The method involves three key contributions: (1) introducing feature subtraction as a new methodology to generate protective face representations by capturing residue between an original image and its regeneration; (2) proposing two specific techniques, high-dimensional mapping and random channel shuffling, to ensure recognizability and accuracy for the residue; and (3) presenting a novel PPFR method, MinusFace, which achieves high recognition accuracy and superior privacy protection compared to state-of-the-art methods. MinusFace works by first generating a visually uninformative residue representation through feature subtraction. This residue is then mapped to high-dimensional feature channels to preserve identity features. Random channel shuffling is applied to further enhance privacy by obscuring facial texture signals and increasing randomness, making recovery attacks difficult. The final protective representation is obtained by decoding the shuffled high-dimensional residue into a spatial image. Experiments show that MinusFace outperforms existing privacy-preserving face recognition methods in terms of both recognition accuracy and privacy protection. It achieves on-par performance with the best frequency-based methods and significantly outperforms others. MinusFace is also efficient and compatible with different face recognition backbones and training objectives, making it a practical solution for privacy-preserving face recognition.
Reach us at info@study.space