Is it Possible to Generate Irreversible PolyProtected Templates from Face Embeddings using System-Specific Keys?

Vedrana Krivokuća Hahn; Jérémy Maceiras; Sébastien Marcel

cs.CROct 1, 2026

Is it Possible to Generate Irreversible PolyProtected Templates from Face Embeddings using System-Specific Keys?

Authors: Vedrana Krivokuća Hahn, Jérémy Maceiras, Sébastien Marcel

Organizations: Idiap Research Institute in Martigny, Switzerland

Abstract

This work aims to answer the question of whether it is possible to generate irreversible protected templates when the PolyProtect biometric template protection method is applied to face embeddings using system-specific keys (i.e., the same C and E parameters, which define the transform, are applied to all subjects' face embeddings), instead of the traditional subject-specific keys (i.e., each subject has their own C and E parameters). This is important for determining whether we can perform de-duplication of face identities in the PolyProtected domain, which is not possible in the subject-specific key scenario due to the clash with PolyProtect's unlinkability property (i.e., one could generate multiple protected templates belonging to the same identity, using different C and E parameters, such that those templates cannot be linked to each other). We present experiments (reproducible using our open-source code) to prove that there exist at least three ways of systematically selecting system-specific keys that produce irreversible PolyProtected templates: (i) from pre-selected subject-specific keys, (ii) by applying a previously proposed key selection algorithm to random vectors, and (iii) by approximating a "good" C/E pair distribution from which system-specific keys can be constructed. Our findings thus point to the conclusion that it is, indeed, possible to safely operate PolyProtect in the system-specific key scenario without degrading the template protection potential. This opens up the possibility for identity de-duplication in the PolyProtected domain.

Figures & tables

Fig. 1: We investigate the selection of system -specific keys ( $C$ , $E$ ) for the PolyProtect BTP method, such that the protected templates ( $P_{1}$ , …, $P_{N}$ ), generated from the face embeddings ( $E_{1}$ , …, $E_{N}$ ) of all identities enrolled in the face recognition system ( $I_{1}$ , …, $I_{N}$ ) are irreversible , i.e., it is impossible to recover $E_{i}$ from its corresponding $P_{i}$ . (Face images from SOTERIA [ 26 ] .)

Fig. 2: Mapping 512-dimensional $V$ to $P$ via PolyProtect, using $C=[c_{1},c_{2},...,c_{5}]$ and $E=[e_{1},e_{2},...,e_{5}]$ , for different amounts of overlap.

Panel of Figure 3 — Fig. 3: Verification accuracy across unprotected face templates (embeddings) generated using five different face recognition models on three face datasets.

Panel of Figure 4 — Fig. 4: Accuracy of template matching in the PolyProtected domain, for protected templates created from EdgeFace and iResNet100 face embeddings in two scenarios: (i) System -specific keys used for PolyProtect (i.e., the same $C$ and $E$ parameters used for all face embeddings across all identities), and (ii) Sample -specific keys used for PolyProtect (i.e., different $C$ and $E$ parameters used for each face embedding, including different embeddings from the same identity). Accuracy for unprotected embeddings is shown as the baseline.

Panel of Figure 5 — Fig. 5: Inversion scores for PolyProtected templates generated from EdgeFace and iResNet100 face embeddings when the keys ( $C$ , $E$ ) were: system-specific + random (gray histogram), subject-specific + selected using the key selection algorithm from [ 24 ] (cyan histogram), and system-specific + selected at random from the subject-specific keys (blue histogram). Our main focus is the blue histogram. The inversion was performed using the cosine-based numerical solver from [ 24 ] . The two vertical black lines represent different thresholds at which the inversion success rate (ISR) was computed for Table I .

Model	Dataset	ISR (%)
		@ 0.1% FMR			@ 0.01% FMR
		Sb.	Sy.	R-Sy.	Sb.	Sy.	R-Sy.
EdgeFace	Multi-PIE	0.5	0.8	100	0	0	99.2
	SOTERIA	0	0.6	91.3	0	0	90.1
	iCarB-Face	1.1	1.3	91.6	0.2	0	89.7
iResNet100	Multi-PIE	0.5	0.5	100	0	0	99.4

TABLE I: Inversion success rate (ISR) for Fig. 5 at the two FMR thresholds, for EdgeFace and iResNet100 face embeddings protected via PolyProtect when the keys (

C

E

) were: subject-specific + selected using the key selection algorithm from [ 24 ] ( Sb. ) VS system-specific + selected from the subject-specific keys ( Sy. ) VS system-specific + random ( R-Sy. ).

Panel of Figure 7 — Fig. 6: Inversion scores for PolyProtected templates generated from EdgeFace and iResNet100 face embeddings when the keys ( $C$ , $E$ ) were system-specific and: selected by applying the key selection algorithm from [ 24 ] to random vectors (purple histogram) versus chosen at random from subject-specific keys selected by applying the same key selection algorithm to face embeddings (blue histogram, from Fig. 5 ). Our main focus is the purple histogram. The inversion was performed using the numerical solver from [ 24 ] . The two vertical black lines represent different thresholds at which the inversion success rate (ISR) was computed for Table II .

Model	Dataset	ISR (%)
		@ 0.1% FMR		@ 0.01% FMR
		RV	SK	RV	SK
EdgeFace	Multi-PIE	0.3	0.8	0	0
	SOTERIA	0.2	0.6	0	0
	iCarB-Face	0.3	1.3	0	0
iResNet100	Multi-PIE	0.1	0.5	0	0

TABLE II: Inversion success rate (ISR) for Fig. 6 at the two FMR thresholds, for EdgeFace and iResNet100 face embeddings protected via PolyProtect when the keys (

C

E

) were: system-specific + selected using the key selection algorithm from [ 24 ] applied to random vectors ( RV ) VS system-specific + chosen from subject-specific keys selected for individual face embeddings ( SK – corresp. to Sy. in Table I ).

Fig. 7: Left column: Distribution of ( $C_{i}$ , $E_{i}$ ) pairs from “good” keys selected by the key selection algorithm [ 24 ] , when it was applied to random vectors and when different thresholds (negative cosine distance) were used to define irreversibility. Right column: Spearman’s rank correlation coefficient matrix, showing weak monotonic correlations across the different ( $C_{i}$ , $E_{i}$ ) pairs.

Panel of Figure 10 — Fig. 8: Inversion scores for PolyProtected templates generated from EdgeFace and iResNet100 face embeddings when the keys ( $C$ , $E$ ) were system-specific and based on applying the key selection algorithm from [ 24 ] to random vectors. The sequences of 5 corresponding $C$ and $E$ parameter pairs were: constructed by choosing samples from a “good” ( $C_{i}$ , $E_{i}$ ) pair distribution (orange histogram) versus chosen directly from a list of pre-determined sequences (purple histogram, from Fig. 6 ). Our main focus is the orange histogram. The inversion was performed using the numerical solver from [ 24 ] . The two vertical black lines represent different thresholds at which the inversion success rate (ISR) was computed for Table III .

Model	Dataset	ISR (%)
		@ 0.1% FMR		@ 0.01% FMR
		Dis.	Seq.	Dis.	Seq.
EdgeFace	Multi-PIE	2.1	0.3	0.1	0
	SOTERIA	2.6	0.2	0.2	0
	iCarB-Face	3.3	0.3	0.2	0
iResNet100	Multi-PIE	3.7	0.1	0.2	0

TABLE III: Inversion success rate (ISR) for Fig. 8 at the two FMR thresholds, for EdgeFace and iResNet100 face embeddings protected via PolyProtect when the keys (based on applying the key selection algorithm [ 24 ] to random vectors) were system-specific and: selected from a “good” (

C_{i}

E_{i}

) pair distribution ( Dis. ) VS chosen from a list of pre-selected (

C

E

) sequences ( Seq. – corresp. to RV in Table II ).

Panel of Figure 12 — Fig. 9: Recognition accuracy for PolyProtected templates when the keys ( $C$ , $E$ ) were generated randomly versus using the key selection algorithm from [ 24 ] . In the latter scenario, the keys were either subject-specific, or system-specific and selected using the three methods from Sections III-C – III-E : from subject-specific keys, from random vectors, or from a $C$ / $E$ distribution. Unprotected template accuracy is shown as a baseline.

Explore similar work

A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert
May 5, 2026Vedrana Krivokuća Hahn, Jérémy Maceiras, Sébastien MarcelBiometrics Inverse Design
All authors are with Idiap Research Institute in Martigny, Switzerland.
LBFTI: Layer-Based Facial Template Inversion for Identity-Preserving Fine-Grained Face Reconstruction
Apr 20, 2026Zixuan Shen, Zhihua Xia, Kaikai Gan +1Face Recognition Model
College of Cyber Security, Jinan University · Guangzhou, Guangdong, China
FaceLinkGen: A Re-evaluation of Identity Leakage in Privacy-Preserving Face Recognition and Face Anonymization Systems Using Simple Distillation
Feb 2, 2026Wenqi Guo, Qingyun Qian, Mohamed Shehata +1Face Recognition Model Facial Images
Department of Computer Science, Mathematics, Physics and Statistics University of British Columbia, Kelowna, BC, Canada

May 5, 2026, cs.CVJ/K move · Enter open · S save

A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert

Vedrana Krivokuća Hahn, Jérémy Maceiras, Sébastien Marcel

All authors are with Idiap Research Institute in Martigny, Switzerland.

Biometrics Inverse Design Irreversibility Polynomials

Open paper AskPDF arXiv

This work presents a deeper analysis of the "irreversibility" property of PolyProtect, a biometric template protection method initially proposed for securing face embeddings. PolyProtect transforms embeddings into protected templates via multivariate polynomials, whose coefficients and exponents are distinct for each subject enrolled in the face recognition system. A polynomial is applied to consecutive sets of elements from a given embedding, where the amount of overlap between the sets is a tunable parameter. We begin our irreversibility analysis by demonstrating that PolyProtected templates are easier to invert using a numerical solver based on cosine distance, as opposed to Euclidean distance (used in the earlier PolyProtect work). To make this inversion more difficult, we then propose a "key selection algorithm", which tries to choose "keys" (coefficients and exponents of the PolyProtect polynomial) that enhance the irreversibility of PolyProtected templates, compared to when the keys are purely random. Our experiments show that this algorithm is effective at generating PolyProtected templates that are significantly more difficult to invert, and that it approximately equalises the irreversibility of PolyProtected templates generated using different "overlap" parameters. This allows for better control of the irreversibility versus accuracy trade-off, known to exist across different overlaps. We also show that accuracy in the PolyProtected domain can be affected by the range in which the embedding elements lie, but that this can be improved by normalizing the embeddings prior to applying PolyProtect. This work is reproducible using our open-source code.

Abstract

Explore similar work

A Deeper Dive into the Irreversibility of PolyProtect: Making Protected Face Templates Harder to Invert

LBFTI: Layer-Based Facial Template Inversion for Identity-Preserving Fine-Grained Face Reconstruction

FaceLinkGen: A Re-evaluation of Identity Leakage in Privacy-Preserving Face Recognition and Face Anonymization Systems Using Simple Distillation