Have I Seen You? Embedding Behavior Signals Synthetic Face Dataset Membership

Technical Summary: "Have I Seen You? Embedding Behavior Signals Synthetic Face Dataset Membership"

Problem Statement
Synthetic face datasets are increasingly adopted in biometric recognition to mitigate privacy risks and data access constraints associated with real-world identity data. However, a critical privacy gap remains: the generative models (GANs or diffusion-based) that produce these synthetic datasets are trained on real facial images. Consequently, the generated distribution may retain traces of its source data. While prior research has focused on identity-level leakage—retrieving real samples that are unusually similar to synthetic ones—this approach assumes the attacker already knows which synthetic dataset trained the recognizer. The paper addresses the preceding and more fundamental question: can an attacker determine which synthetic dataset was used to train a face recognizer, and further, can they infer the real dataset used to train the generator itself?

Methodology
The authors propose a dataset-level Membership Inference Attack (MIA) designed for a black-box scenario where an adversary has query access to a model's embeddings. The attack operates on two levels: identifying the synthetic training dataset and, subsequently, the real source dataset of the generator.

The core of the methodology (Algorithm 1) relies on the assumption that a model trained on a specific dataset will yield the best separation of similarity scores for non-mated images (distinct identities) from that specific dataset compared to others. The attack proceeds in three steps:

1. Centroid Computation: For each candidate dataset, the model computes embeddings for a set of random gallery identities and probe identities. It calculates the L2-normalized centroid of the gallery embeddings.
2. Similarity Scoring: The mean cosine similarity between the probe embeddings and the gallery centroid is computed for each candidate dataset.
3. Robust Z-Score Ranking: To identify the training dataset, the algorithm computes a robust z-score for each target dataset. This score is derived by taking the difference between the target dataset's median similarity score and the median of all other datasets' scores, normalized by the Median Absolute Deviation (MAD) of the remaining datasets.

The hypothesis is that the true training dataset (synthetic or real) will exhibit the lowest robust z-score, indicating the strongest statistical alignment with the model's learned decision boundaries.

Experimental Setup
The evaluation involved:

• 11 Face Recognition Models: Trained individually on 11 different synthetic datasets using an iResNet50 backbone.
• 11 Synthetic Datasets: Including SynFace, IDiff-Face, SFace2, DCFace, and others.
• 7 Real Datasets: Including FFHQ, CASIA-WebFace, LFW, CPLFW, CALFW, CFP-FP, and AgeDB-30.
• Attack Scope: The attack was tested to recover the synthetic training dataset and, given the synthetic-trained model, to infer the generator's source dataset.

Key Results

• Synthetic Dataset Recovery: The attack successfully identified the specific synthetic dataset used to train the face recognizer in 100% of cases. The synthetic training datasets consistently achieved the lowest robust z-score values (often below -2), making them virtually certain to be identified by an observer.
• Real Source Dataset Inference: The attack extended upstream to identify the real dataset used to train the generator. It successfully identified the source dataset in 54.5% of cases (6 out of 11).
  • Failures were partially attributed to scenarios involving multi-dataset training sets (e.g., Digi2Real trained on FFHQ, CelebA, and WebFace42M), where sample overlaps caused the source dataset to receive a lower score than the evaluated training set.
  • Despite these failures, the results indicate that source datasets generally achieve lower scores than other real datasets, confirming the existence of a secondary leakage signal.

Significance and Claims
The paper claims that synthetic data is not a complete privacy solution, as it retains dataset-level traces of the real training data used by its generator. The significance of this work lies in:

1. Exposing a New Attack Vector: Demonstrating that an adversary can deduce the provenance of a deployed model without prior knowledge of the synthetic dataset used, effectively bridging the gap from a deployed recognizer back to the real identities that influenced the generator.
2. End-to-End Pipeline Risk: When combined with prior identity-level retrieval work, this dataset-level inference facilitates an end-to-end pipeline from a deployed recognizer to real identities, undermining the privacy guarantees of synthetic data.
3. Call for Stronger Mitigation: The authors conclude that privacy-preserving deployment of synthetic biometric data requires stronger leakage mitigation strategies, as current synthetic datasets are insufficient to fully obscure the provenance of the underlying real data.

The authors maintain a modest tone regarding the real dataset inference (54.5% success), acknowledging limitations in multi-source training scenarios, but emphasize that the risk is non-negligible and warrants further investigation into protective measures.