Face Template Inversion Attack on LFW (Type-I TAR)
100Type-I TAROriginal
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| OriginalTarget Model=FaceNet2025.04 | 100 | — | — | — | — | 98.6 | 0.99 | |
| OriginalTarget Model=ArcFace2025.04 | 100 | — | — | — | — | 99.62 | 0.99 | |
| OriginalTarget Model=DCTDP2025.04 | 100 | — | — | — | — | 99.47 | 0.98 | |
| OriginalTarget Model=PartialFace2025.04 | 100 | — | — | — | — | 98.89 | 0.98 | |
| CLIP-FTIF_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=ArcFace, FAR (False Acceptance Rate)=10^-32025.12 | 99.37 | — | — | — | — | — | — | |
| DiffMITarget Model=ArcFace2025.04 | 98.55 | — | — | — | — | 94.72 | 0.9834 | |
| DiffMITarget Model=DCTDP2025.04 | 98.55 | — | — | — | — | 92.87 | 0.9774 | |
| DiffMITarget Model=PartialFace2025.04 | 96.45 | — | — | — | — | 84.42 | 0.9794 | |
| Otroshi et al.F_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=ArcFace, FAR (False Acceptance Rate)=10^-32025.12 | 96.41 | — | — | — | — | — | — | |
| CLIP-FTIF_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=ArcFace, FAR (False Acceptance Rate)=10^-32025.12 | 96.2 | — | — | — | — | — | — | |
| Otroshi et al.F_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=ArcFace, FAR (False Acceptance Rate)=10^-32025.12 | 95.1 | — | — | — | — | — | — | |
| Otroshi et al.F_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=ElasticFace, FAR (False Acceptance Rate)=10^-32025.12 | 94.86 | — | — | — | — | — | — | |
| CLIP-FTIF_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=ElasticFace, FAR (False Acceptance Rate)=10^-32025.12 | 94.35 | — | — | — | — | — | — | |
| MAP2VTarget Model=DCTDP2025.04 | 92.5 | — | — | — | — | 83.05 | 0.7787 | |
| CLIP-FTIF_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=ElasticFace, FAR (False Acceptance Rate)=10^-32025.12 | 91.62 | — | — | — | — | — | — | |
| MAP2VTarget Model=PartialFace2025.04 | 90.54 | — | — | — | — | 80.41 | 0.7636 | |
| DiffMITarget Model=FaceNet2025.04 | 90.3 | — | — | — | — | 74.51 | 0.9917 | |
| MAP2VTarget Model=FaceNet2025.04 | 90.05 | — | — | — | — | 73.14 | 0.9337 | |
| MAP2VTarget Model=ArcFace2025.04 | 88.98 | — | — | — | — | 79.22 | 0.7723 | |
| Otroshi et al.F_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=ElasticFace, FAR (False Acceptance Rate)=10^-32025.12 | 83.9 | — | — | — | — | — | — | |
| CLIP-FTIF_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=HRNet, FAR (False Acceptance Rate)=10^-32025.12 | 77.88 | — | — | — | — | — | — | |
| Otroshi et al.F_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=HRNet, FAR (False Acceptance Rate)=10^-32025.12 | 77.35 | — | — | — | — | — | — | |
| CLIP-FTIF_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=HRNet, FAR (False Acceptance Rate)=10^-32025.12 | 65.23 | — | — | — | — | — | — | |
| CLIP-FTIF_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=AttentionNet, FAR (False Acceptance Rate)=10^-32025.12 | 52.54 | — | — | — | — | — | — | |
| Otroshi et al.F_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=AttentionNet, FAR (False Acceptance Rate)=10^-32025.12 | 52.18 | — | — | — | — | — | — | |
| Otroshi et al.F_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=HRNet, FAR (False Acceptance Rate)=10^-32025.12 | 51.63 | — | — | — | — | — | — | |
| CLIP-FTIF_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=AttentionNet, FAR (False Acceptance Rate)=10^-32025.12 | 43.56 | — | — | — | — | — | — | |
| CLIP-FTIF_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=GhostNet, FAR (False Acceptance Rate)=10^-32025.12 | 38.92 | — | — | — | — | — | — | |
| Otroshi et al.F_database (Leaked Backbone)=ElasticFace, F_loss (Surrogate Backbone)=ArcFace, F_target (Target Backbone)=GhostNet, FAR (False Acceptance Rate)=10^-32025.12 | 38.58 | — | — | — | — | — | — | |
| Otroshi et al.F_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=AttentionNet, FAR (False Acceptance Rate)=10^-32025.12 | 33.99 | — | — | — | — | — | — | |
| CLIP-FTIF_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=GhostNet, FAR (False Acceptance Rate)=10^-32025.12 | 27.58 | — | — | — | — | — | — | |
| Otroshi et al.F_database (Leaked Backbone)=ArcFace, F_loss (Surrogate Backbone)=ElasticFace, F_target (Target Backbone)=GhostNet, FAR (False Acceptance Rate)=10^-32025.12 | 18.72 | — | — | — | — | — | — | |
| RandomTarget Model=FaceNet2025.04 | 0.7 | — | — | — | — | 0.91 | 0.0154 | |
| RandomTarget Model=PartialFace2025.04 | 0.5 | — | — | — | — | 0.54 | 0.0568 | |
| RandomTarget Model=DCTDP2025.04 | 0.2 | — | — | — | — | 0.09 | 0.0129 | |
| RandomTarget Model=ArcFace2025.04 | 0 | — | — | — | — | 0.06 | 0.0046 | |
| CLIP-FTIF_database=ArcFace, F_loss=ElasticFace2025.12 | — | 99.37 | 81.74 | 99.95 | 95.48 | — | — | |
| CLIP-FTIF_database=ElasticFace, F_loss=ArcFace2025.12 | — | 94.35 | 59.56 | 98.89 | 85.17 | — | — | |
| Otroshi et al.F_database=ArcFace, F_loss=ElasticFace2025.12 | — | 95.01 | 46.55 | 99.33 | 81.25 | — | — | |
| Otroshi et al.F_database=ElasticFace, F_loss=ArcFace2025.12 | — | 94.86 | 58.61 | 98.93 | 83.36 | — | — |