From Measurement to Mitigation: Quantifying and Reducing Identity Leakage in Image Representation Encoders with Linear Subspace Removal

This paper introduces a comprehensive privacy audit framework for frozen visual encoders and proposes a one-shot linear projector, Identity Sanitization Projection (ISP), that effectively mitigates identity leakage in face-containing images while preserving utility for non-biometric tasks like retrieval and search.

The Gist

Imagine you have a super-smart camera that doesn't just take pictures, but turns every photo into a unique digital fingerprint (a list of numbers). This fingerprint is used to find similar photos, check if a document is real, or organize your photo library.

The problem? Even though this camera was built to understand objects (like cars, trees, or cats), it accidentally learned to recognize people too. If you hand this fingerprint to a hacker, they might be able to figure out exactly who is in the photo, even if you didn't want them to know. This is called Identity Leakage.

This paper is like a team of digital security experts who asked: "How much of a person's identity is hiding in these fingerprints, and can we scrub it out without ruining the camera's ability to do its job?"

Here is the breakdown of their work using some everyday analogies:

1. The Problem: The "Over-Attentive" Librarian

Imagine a librarian (the AI) who is hired to organize books by genre. But, because she's so smart, she also memorizes the author's face on every cover.

• The Risk: If you ask her, "Find me a book by this author," she can do it instantly. But if you just wanted to find "Science Fiction," she might accidentally reveal the author's identity just by how she sorts the books.
• The Reality: Modern AI models (like CLIP or DINO) are like this librarian. They are great at finding similar images, but they accidentally keep a "face file" inside their data.

2. The Investigation: The "Privacy Audit"

Before fixing the problem, the team needed to measure how bad it was. They didn't just guess; they acted like hackers to test the system.

• The "Low-False-Alarm" Test: They tried to identify people in photos but set the rules so strict that they would only accept a match if they were 99.99% sure.
  • Result: The "Face Recognition" models (designed to know faces) were obvious. But the "General" models (designed for objects) were surprisingly good at it too, especially CLIP. It was like finding out the librarian was secretly keeping a photo album of every author.
• The "Face Reconstruction" Test: They tried to use the digital fingerprint to draw the person's face back from scratch using AI.
  • Result: For the dedicated face models, they could draw a perfect face. For the general models, the drawings came out as blurry, unrecognizable blobs. This was good news! It meant the "face file" wasn't very strong to begin with.

3. The Solution: The "Identity Eraser" (ISP)

The team invented a tool called Identity Sanitization Projection (ISP). Think of this as a digital sieve or a privacy filter.

• How it works:
  Imagine the digital fingerprint is a giant, complex smoothie made of many ingredients (colors, shapes, faces, backgrounds).

  1. The team analyzes the smoothie and realizes that the "face flavor" is concentrated in just a few specific ingredients (a small subspace).
  2. They build a filter (the ISP projector) that removes only those specific "face ingredients."
  3. Crucially: They leave all the other ingredients (the background, the lighting, the object shapes) exactly as they are.

• The Result:

  • Privacy: If you try to use the "face ingredients" to identify the person now, the sieve has removed them. The hacker gets a "chance" result (like guessing a name out of a hat).
  • Utility: The smoothie still tastes the same for everything else! You can still find similar cars, detect copy-pasted images, or organize photos by scene. The "face" is gone, but the "utility" remains.

4. The "Universal Filter" Discovery

One of the coolest findings was that this filter is portable.

• They built the filter using photos of people from Dataset A (like a celebrity database).
• They then applied that exact same filter to Dataset B (a different set of people).
• The Magic: It worked almost perfectly! This means the "face part" of the AI's brain is universal. You don't need to build a new filter for every new group of people; one filter can sanitize data for everyone.

5. Why This Matters

In the real world, companies (like banks or social media) need to check if a photo is real or if two photos are the same, but they often cannot use facial recognition because of strict privacy laws (like GDPR).

• Before this paper: They were stuck. They couldn't use powerful AI tools because they were afraid of accidentally leaking private face data.
• After this paper: They can use these powerful tools, run them through the ISP filter, and be confident that the "face" has been mathematically removed, while the tool still works great for its intended job.

Summary Analogy

Think of the AI model as a high-tech security guard.

• The Problem: The guard is so good at spotting faces that he can't stop himself from whispering the person's name to anyone who asks, even when you just wanted to know if they were wearing a red shirt.
• The Fix: The team put a muzzle on the guard (the ISP filter). The guard can no longer whisper names (identity), but he can still perfectly spot red shirts, check for fake IDs, and organize the crowd. He is still useful, but he is now safe to use in a private environment.

This paper proves that we can have our cake (powerful AI) and eat it too (privacy), as long as we know how to slice off the dangerous parts.

Technical Summary

1. Problem Statement

Frozen visual encoders (e.g., CLIP, DINOv2/v3, SSCD) are widely used for retrieval, integrity checks, and duplicate detection. However, when applied to face-containing data, these models inadvertently encode biometric identity information, creating privacy risks.

• The Gap: While Face Recognition (FR) systems are designed to be biometric, non-FR encoders are not. Current privacy audits for these encoders are insufficient because they often rely on closed-set accuracy or qualitative saliency maps rather than attacker-calibrated, open-set metrics at low False Accept Rates (FAR).
• The Risk: Operators lack a certified way to determine if these embeddings are "safe" to use under strict privacy regulations (e.g., GDPR, CCPA) without explicit biometric consent. There is a need to quantify identity leakage at operational thresholds (e.g., $FAR \approx 10^{-4}$) and provide a deployable mitigation that preserves utility.

2. Methodology

The authors propose a two-pronged approach: a comprehensive measurement suite to quantify leakage and a mitigation technique to remove identity information.

A. Measurement Suite (Attacker-Aware Audit)

The paper introduces a benchmark designed to simulate realistic adversarial scenarios:

1. Open-Set Verification at Low FAR: Uses linear probes (Ridge regression) and projection-only MLPs to measure True Acceptance Rate (TAR) at very low FAR ($10^{-4}$) on unseen identities. This tests if identity is linearly accessible in the embedding space.
2. Calibrated Template Inversion: Evaluates whether an attacker can reconstruct a face from an embedding using diffusion priors (DiffMI) or other generative attacks (Bob, Vec2Face, ALSUV). Success is judged via cross-model FR verification.
3. Face–Context Attribution: To understand where identity lives, the authors introduce three diagnostics with Face Coverage Ratio (FCR) normalization to ensure fair comparison across different image crops:
   • FII (Face Importance Index): Measures the difference in similarity drop when occluding the face vs. the background.
   • CPI (Context Preference Index): Tracks how often a blurred face prefers a context-matched image over an identity-matched one.
   • $B^*$ (Background Revelation Threshold): Determines how much background must be revealed for context to override identity.

B. Mitigation: Identity Sanitization Projection (ISP)

The authors propose ISP, a lightweight, one-shot, post-hoc projector that removes the estimated identity subspace while preserving the complementary space needed for utility.

• Mechanism:
  1. Compute the mean embedding for each identity ($\mu_i$) and the global mean ($\mu_C$).
  2. Construct the centered mean matrix $M = [\mu_1 - \mu_C, \dots, \mu_m - \mu_C]$.
  3. Perform Singular Value Decomposition (SVD) on $M$ to identify the top-$r$ singular vectors ($U_r$) representing the identity subspace.
  4. Project embeddings onto the orthogonal complement: $P = I - U_r U_r^\top$.
  5. The sanitized embedding is $\tilde{z} = Pz / \|Pz\|_2$.
• Advantages: It is a closed-form, moment-based method (no iterative adversarial training), numerically stable, and produces a fixed matrix $P$ that can be exported to any pipeline with sub-millisecond latency.

3. Key Contributions

1. First Attacker-Calibrated Audit: Provides the first open-set, low-FAR evaluation of DINOv2, DINOv3, and SSCD alongside CLIP, moving beyond closed-set accuracy.
2. ISP (Identity Sanitization Projection): A novel, one-shot linear projector that effectively removes identity subspaces without retraining the encoder.
3. Empirical Evidence of Transferability: Demonstrates that the estimated identity subspace is compact and transferable across datasets (e.g., a projector trained on CelebA works on VGGFace2).
4. Comprehensive Diagnostics: Introduces FCR-normalized attribution metrics (FII, CPI, $B^*$) to distinguish between face-dominant (FR) and context-dominant (non-FR) encoders.

4. Key Results

A. Leakage Quantification

• Linear Accessibility: In raw embeddings, non-FR encoders (DINOv2/v3, SSCD) exhibit low but non-zero linear identity accessibility at low FAR. CLIP shows relatively higher leakage.
• Template Inversion: Non-FR encoders fail to reconstruct faces via diffusion or other generative attacks (verification rates near 0%), whereas FR encoders (ArcFace) achieve 67–100% success. This suggests identity signals in non-FR encoders are too weak for current generative priors to exploit.
• Context Dominance: Non-FR encoders are found to be context-dominant under stress tests (background information often outweighs facial features), whereas FR models are strictly face-dominant.

B. Mitigation Effectiveness (ISP)

• Privacy: ISP drives linear access (TAR) to near-chance levels (often <1% or 0%) across all non-FR encoders at $FAR=10^{-4}$.
• Transferability: A projector trained on one dataset (e.g., CelebA) retains high efficacy when applied to another (e.g., VGGFace2), confirming the identity subspace is dataset-agnostic.
• Utility Retention: ISP preserves downstream utility. On ImageNet classification and DISC2021 copy detection, performance drops are minimal (often <1-2%), comparable to or better than existing methods like LEACE.
• Non-Linear Robustness: Even after ISP, non-linear (MLP) probes fail to recover identity, suggesting the removed subspace contained the bulk of the signal accessible to moderate attackers.

5. Significance and Impact

• Privacy-Utility Trade-off: The paper demonstrates that it is possible to achieve strong privacy guarantees (linear identity removal) without sacrificing the utility of visual embeddings for tasks like search and duplicate detection.
• Regulatory Compliance: Provides a concrete, auditable method for organizations to deploy frozen encoders on face-containing data while complying with strict privacy regulations that prohibit biometric processing.
• Deployment Readiness: ISP is computationally cheap (single SVD, fixed matrix multiplication) and does not require retraining, making it immediately applicable to existing production pipelines.
• New Standard for Auditing: The proposed metrics (Open-set TAR@low-FAR, calibrated inversion, FCR-normalized attribution) set a new standard for evaluating privacy in general-purpose vision models, moving beyond the limitations of closed-set accuracy.

In conclusion, the paper establishes that while frozen visual encoders do leak identity information, this leakage is concentrated in a compact linear subspace. By applying the proposed Identity Sanitization Projection (ISP), operators can effectively "sanitize" these embeddings, enabling their safe use in privacy-sensitive applications.