A protected image can still carry an identity. FaceLinkGen shows how simple distillation recovers the signal that facial privacy systems leave behind.
Facial privacy systems preserve useful information. That same information can give an adaptive attacker a path back to identity.
Keyless PPFR preserves machine-readable identity so a server can verify a person. FaceLinkGen learns to extract that signal and regenerate a recognizable face.
Perception-preserving De-ID retains a face's human recognizability. FaceLinkGen adapts the recognizer to recover identity linkage from those remaining cues.
One frozen teacher. One trainable student. Paired original and protected images.
The student learns to map protected inputs into the teacher's identity embedding space. For PPFR, Arc2Face turns those embeddings into faces. For De-ID, the adapted model links identities across images.
Cross-image identity distillation strengthens linkage across photos. An original-domain-preserving loss maintains recognition of unprotected faces.
PROTECTION
METHODS TESTED
Face++ and Amazon are independent verifiers, not attack targets. Direct U-Net reconstruction succeeds on MinusFace and PartialFace; distillation also recovers identity from DecoyFace.
Direct reconstruction can recover a decoy. Distillation follows the retained identity signal.
DecoyFace: U-Net reconstructs a different identity. The distillation attack regenerates a face resembling the original identity.
The few-sample experiments use 256-8,192 identities for PPFR and 32-1,024 for De-ID, with two images per identity. Effectiveness varies by protection method and sample count.
FaceLinkGen: A Re-evaluation of Identity Leakage in Privacy-Preserving Face Recognition and Face Anonymization Systems Using Simple Distillation
READ THE FULL PAPER (PDF, opens in a new tab)@unpublished{guo2026facelinkgen,
title = {FaceLinkGen: A Re-evaluation of Identity Leakage in Privacy-Preserving Face Recognition and Face Anonymization Systems Using Simple Distillation},
author = {Guo, Wenqi and Shehata, Mohamed S. and Du, Shan},
year = {2026},
note = {Research manuscript, University of British Columbia}
}