Paper deep dive
Have I Seen You? Embedding Behavior Signals Synthetic Face Dataset Membership
Paweł Borsukiewicz, Daniele Lunghi, Wendkûuni C. Ouédraogo, Jacques Klein, Tegawendé F. Bissyandé
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 8/3/2026, 2:40:41 AM
Summary
The paper investigates dataset-level membership inference attacks (MIAs) on synthetic face datasets used for biometric recognition. It demonstrates that synthetic data retains traces of the real source datasets used to train generative models. An attack algorithm successfully identifies the synthetic training dataset in 100% of cases and the underlying real source dataset in 54.5% of cases across 11 models, 11 synthetic datasets, and 7 real datasets, highlighting significant privacy risks in synthetic data deployment.
Entities (11)
Relation Signals (9)
Membership Inference Attack (MIA) → identifies → Synthetic Face Datasets
confidence 98% · the attack recovers the synthetic training dataset in 100% of cases
Membership Inference Attack (MIA) → infers → Real Source Datasets
confidence 95% · identifies the generator’s source dataset in 54.5% of cases
Synthetic Face Datasets → usedtotrain → Face Recognition Models
confidence 92% · trained eleven face recognition models with synthetic datasets (Table I) as their training sets
FFHQ → sourcefor → SynFace
confidence 90% · SynFace, IDiff-Face, SynMulti-PIE, Langevin-Disco FFHQ
CASIA-WebFace → sourcefor → IDNet
confidence 90% · IDNet, CemiFace, SFace2, Sface CASIA-WebFace
Synthetic Face Datasets → trainedon → Real Source Datasets
confidence 90% · generators that produce these datasets are trained on real faces
Digi2Real → trainedon → WebFace42M
confidence 85% · Digi2Real FFHQ + CelebA + WebFace42M
Digi2Real → trainedon → FFHQ
confidence 85% · Digi2Real FFHQ + CelebA + WebFace42M
Digi2Real → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Synthetic face datasets are increasingly used to reduce privacy exposure and data access constraints in biometric recognition. Yet the generators that produce these datasets are trained on real faces, so synthetic data may still reveal their real source data. We study this risk through a dataset-level membership inference attack that first identifies the synthetic dataset used to train a face recognizer and then infers the real dataset used to train the generator. Across 11 face recognition models, 11 synthetic datasets, and 7 real datasets, the attack recovers the synthetic training dataset in 100% of cases and identifies the generator's source dataset in 54.5% of cases. These results show that synthetic data can retain dataset-level traces of real training data and that privacy-preserving deployment requires stronger leakage mitigation.
Tags
Links
- Source: https://arxiv.org/abs/2607.29144v1
- Canonical: https://arxiv.org/abs/2607.29144v1
Trouble viewing inline? Open PDF directly →
Full Text
9,754 characters extracted from source content.
Expand or collapse full text
Have I Seen You? Embedding Behavior Signals Synthetic Face Dataset Membership Paweł Borsukiewicz, Daniele Lunghi, Wendkûuni C. Ouédraogo, Jacques Klein, Tegawendé F. Bissyandé University of Luxembourg, Luxembourg pawel.borsukiewicz, daniele.lunghi, wendkuuni.ouedraogo, jacques.klein, tegawende.bissyande@uni.lu Abstract Synthetic face datasets are increasingly used to reduce privacy exposure and data access constraints in biometric recognition. Yet the generators that produce these datasets are trained on real faces, so synthetic data may still reveal their real source data. We study this risk through a dataset-level membership inference attack that first identifies the synthetic dataset used to train a face recognizer and then infers the real dataset used to train the generator. Across 11 face recognition models, 11 synthetic datasets, and 7 real datasets, the attack recovers the synthetic training dataset in 100% of cases and identifies the generator’s source dataset in 54.5% of cases. These results show that synthetic data can retain dataset-level traces of real training data and that privacy-preserving deployment requires stronger leakage mitigation. I Introduction & Background Face recognition has become ubiquitous in security and consumer applications, yet it relies on large biometric datasets whose collection and sharing raise persistent privacy and compliance concerns. Lately, synthetic face datasets have emerged as an attractive alternative, reducing direct exposure of real identities and easing data access constraints. Recent work shows that synthetic training data can support recognition performance comparable to, and in some cases better than, models trained on real data [1]. That progress makes synthetic data a practical option for biometric model development. However, the privacy benefit is incomplete. Both GAN- and diffusion-based generators are trained on real facial images, which means that traces of the source data may survive in the generated distribution. Membership inference attacks (MIAs) exploit such traces by asking whether specific data contributed to model training [3]. In the biometric setting, successful inference could reveal sensitive information about individuals or about the hidden provenance of a deployed model. Prior work on synthetic face leakage studied identity-level exposure by retrieving real samples that are unusually similar to synthetic ones [2]. That setting is important, but it assumes that the attacker already knows which synthetic dataset trained the recognizer, and the leakage signal itself is concentrated in a small fraction of images [1]. In this paper, we address the prior question, namely, which synthetic datasets were used to train the model, and then extend the attack one step further upstream to the real dataset used to train the generator. Across eleven synthetic datasets, 7 real datasets, and 11 face recognition models, our attack recovers the synthetic training dataset in every case and reveals the generator’s source dataset in 54.5% of cases. Combined with [2], this facilitates an end-to-end pipeline from a deployed recognizer to real identities. Figure 1: Outlier score per dataset. Synthetic data used in training (TRAIN) is indicated on the y-axis. Input: Trained model f, candidate datasets =D1,…,DKD=\D_1,…,D_K\, N=500N=500 Output: Robust z-score z~i z_i ranking for each dataset DiD_i 1 2Step 1: Compute mean probe-to-centroid similarity for each dataset; 3 for each Dk∈D_k do 4 Sample N random gallery identities ℐkI_k and N random probe identities kP_k (disjoint); 5 Compute L2-normalized gallery centroid kc_k: k←1N∑i∈ℐkf(i)c_k← 1N _i _kf(i), k←k/‖k‖c_k _k/\|c_k\|; 6 Find mean probe-to-centroid cosine similarity xkx_k: xk←1N∑j∈kf(j)⋅k‖f(j)‖x_k← 1N _j _k f(j)·c_k\|f(j)\| 7 end for 8 9Step 2: Compute robust z-score for target dataset xtx_t; 10 for each Dt∈D_t do 11 x~←median(xii≠t) x (\x_i\_i≠ t) ; 12 MAD←median(|xi−x~|)i≠tMAD (|x_i- x|)_i≠ t; 13 z~t←0.6745∗(xt−x~)MAD z_t← 0.6745*(x_t- x)MAD; 14 15 end for 16 17Step 3: Rank z-scores; Algorithm 1 Membership Inference Attack I Methodology We aim to connect a deployed recognition model to its data on two levels: (i) identify which synthetic dataset was used to train the model, and (i) given a synthetic-trained model, identify which real dataset was used to train the generator that produced the synthetic data. To do so, we propose a simple attack (Algorithm 1), based on one assumption and one hypothesis. First, in line with previous works on loss function optimization [4], we assume that each model should yield the best separation of similarity scores between non-mated images (of distinct identities) for its training data, thereby resulting in the lowest robust z-score values, defined as the difference between the target dataset’s median score and the median of the remaining datasets’ scores, divided by the Median Absolute Deviation (MAD) of the remaining datasets’ scores. Second, we hypothesize that because synthetic data inherits the distribution of the generator’s training data, this property may carry over to the real source data, producing a secondary leakage signal. To make the attack realistic, we assume a black-box adversary with query access to the model’s embeddings. For our attack, we have selected the iResNet50 backbone and trained eleven face recognition models with synthetic datasets (Table I) as their training sets, one dataset per model. For each face recognizer, we have computed embeddings across all synthetic and seven real datasets. We have selected FFHQ and CASIA-WebFace due to their common use in training synthetic dataset generators, and LFW, CPLFW, CALFW, CFP-FP, and AgeDB-30 to enable a baseline comparison on unseen data. TABLE I: Synthetic datasets and their deep generative models’ training datasets. Synthetic dataset Generator training data (Source dataset) SynFace, IDiff-Face, SynMulti-PIE, Langevin-Disco FFHQ IDNet, CemiFace, SFace2, Sface CASIA-WebFace DCFace FFHQ + CASIA-WebFace HyperFace FFHQ + CelebA + WebFace4M Digi2Real FFHQ + CelebA + WebFace42M I Results & Discussion Synthetic training datasets: Our results (Figure 1) show that the synthetic training datasets consistently achieve by far the lowest robust z-score values, clearly revealing the training data. Consequently, any potential attacker who observed a value less than -2 in our setting would be virtually certain that a given model was trained on particular data. As our algorithm is compatible with a black-box scenario, where API access exposes the sample’s embedding, one could use this information to retrain their own model and leverage white-box access for any further analysis. Real source datasets: We evaluated whether the fact that the synthetic data follows the distribution of its underlying real dataset is sufficient to deduce its use during generator training. For that matter, we could see (Figure 1) that the source datasets are, on average, achieving lower scores than other real datasets. Analyzing the lowest scores across the real datasets has revealed a training set 6 out of 11 times. Some of the failures could be attributed to the multi-dataset training set, e.g., Digi2Real, where the overlap of samples among CelebA, WebFace42M, and CASIA-WebFace could have resulted in CASIA-WebFace receiving a lower score than the evaluated training set, FFHQ (-0.41 vs. -0.29). Ultimately, our attack demonstrates that real data is at risk and that training the model on synthetic data requires additional safeguards to prevent leakage of the real dataset. IV Conclusion & Future Work This paper highlights the privacy risks posed by attacks against synthetic facial recognition datasets. Using the novel MIA algorithm, we showcase that a potential adversary can easily identify the synthetic dataset used in training and has a relatively high chance of deducing the generator’s real data. Future work spans two dimensions. Firstly, we will search for suitable measures to prevent identity and dataset leakage. Secondly, to better assess protective techniques, more sophisticated algorithms could be explored to address currently limited efficiency against the underlying real datasets. Acknowledgments • This research was funded by the Luxembourg Army. • The authors acknowledge the use of AI-based tools to correct typographical errors and improve clarity. References [1] P. Borsukiewicz, F. Boutros, I. E. Olatunji, C. Beumier, W. C. Ouédraogo, J. Klein, and T. F. Bissyandé (2026) Beyond real faces: synthetic datasets can achieve reliable recognition performance without privacy compromise. npj Artificial Intelligence. Cited by: §I, §I. [2] H. O. Shahreza and S. Marcel (2024) Unveiling synthetic faces: how synthetic datasets can expose real identities. In The Third Workshop on New Frontiers in Adversarial Machine Learning, Cited by: §I. [3] R. Shokri, M. Stronati, C. Song, and V. Shmatikov (2017) Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), p. 3–18. Cited by: §I. [4] H. Wang, Y. Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu (2018) Cosface: large margin cosine loss for deep face recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, p. 5265–5274. Cited by: §I.