In deep neural networks for facial recognition, feature vectors are numerical representations that capture the unique features of a given face. While it is known that a version of the original face can be recovered via "feature reconstruction," we lack an understanding of the end-to-end privacy risks produced by these attacks. In this work, we address this shortcoming by developing metrics that meaningfully capture the threat of reconstructed face images. Using end-to-end experiments and user studies, we show that reconstructed face images enable re-identification by both commercial facial recognition systems and humans, at a rate that is at worst, a factor of four times higher than randomized baselines. Our results confirm that feature vectors should be recognized as Personal Identifiable Information (PII) in order to protect user privacy.

翻译：在面部识别的深层神经网络中,特质矢量是反映特定面孔独特特征的数字表达方式。虽然已知原始面孔的版本可以通过“功能重建”来恢复,但我们对这些袭击产生的端到端隐私风险缺乏了解。 在这项工作中,我们通过开发能有意义地捕捉面部图像重建威胁的度量来弥补这一缺陷。通过端到端实验和用户研究,我们显示,经过重建的面部图像能够让商业面部识别系统和人类重新识别,其速度最差的是,比随机基线高出四倍。我们的结果证实,特征矢量应被确认为个人识别信息(PII),以保护用户隐私。