{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T16:25:50Z","timestamp":1783787150236,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":75,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,12,6]],"date-time":"2021-12-06T00:00:00Z","timestamp":1638748800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61802068"],"award-info":[{"award-number":["61802068"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,12,6]]},"DOI":"10.1145\/3485832.3485840","type":"proceedings-article","created":{"date-parts":[[2021,12,6]],"date-time":"2021-12-06T13:42:32Z","timestamp":1638798152000},"page":"17-30","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["The Many-faced God: Attacking Face Verification System with Embedding and Image Recovery"],"prefix":"10.1145","author":[{"given":"Mingtian","family":"Tan","sequence":"first","affiliation":[{"name":"Fudan University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhe","family":"Zhou","sequence":"additional","affiliation":[{"name":"Fudan University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhou","family":"Li","sequence":"additional","affiliation":[{"name":"University of California, Irvine"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,12,6]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2020. Wide Resnet Git. https:\/\/github.com\/szagoruyko\/wide-residual-networks. https:\/\/github.com\/szagoruyko\/wide-residual-networks Accessed: 2020-01-10."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"crossref","unstructured":"AMGTime. [n.d.]. Face Recognition Fingerprint Proximity Cards 4 in 1 Biometric Time Attendance Package. https:\/\/amgtime.com\/hardware-facial-recognition-technology-rfid-time-attendance. Accessed: 2019-12-20.","DOI":"10.17485\/ijst\/2019\/v12i48\/145821"},{"key":"e_1_3_2_1_3_1","unstructured":"Brandon Amos Bartosz Ludwiczuk and Mahadev Satyanarayanan. 2016. OpenFace: A general-purpose face recognition library with mobile applications. Technical Report. CMU-CS-16-118 CMU School of Computer Science."},{"key":"e_1_3_2_1_4_1","unstructured":"Apple. [n.d.]. About Face ID advanced technology. https:\/\/support.apple.com\/en-us\/HT208108. Accessed: 2019-12-20."},{"key":"e_1_3_2_1_5_1","unstructured":"Martin Arjovsky Soumith Chintala and L\u00e9on Bottou. 2017. Wasserstein gan. arXiv preprint arXiv:1701.07875(2017)."},{"key":"e_1_3_2_1_6_1","volume-title":"Segnet: A deep convolutional encoder-decoder architecture for image segmentation","author":"Badrinarayanan Vijay","year":"2017","unstructured":"Vijay Badrinarayanan, Alex Kendall, and Roberto Cipolla. 2017. Segnet: A deep convolutional encoder-decoder architecture for image segmentation. IEEE transactions on pattern analysis and machine intelligence 39, 12(2017), 2481\u20132495."},{"key":"e_1_3_2_1_7_1","volume-title":"CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel. In 28th USENIX Security Symposium (USENIX Security 19)","author":"Batina Lejla","year":"2019","unstructured":"Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. 2019. CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 515\u2013532. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/batina"},{"key":"e_1_3_2_1_8_1","unstructured":"Matthew Braga. [n.d.]. Facial recognition technology is coming to Canadian airports this spring. https:\/\/www.cbc.ca\/news\/technology\/cbsa-canada-airports-facial-recognition-kiosk-biometrics-1.4007344. Accessed: 2019-12-20."},{"key":"e_1_3_2_1_9_1","volume-title":"Exploring Connections Between Active Learning and Model Extraction. In 29th USENIX Security Symposium (USENIX Security 20)","author":"Chandrasekaran Varun","year":"2020","unstructured":"Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. 2020. Exploring Connections Between Active Learning and Model Extraction. In 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Boston, MA."},{"key":"e_1_3_2_1_10_1","unstructured":"Clarifai. 2019. Clarifai Face Embedding. https:\/\/www.clarifai.com\/models\/face-embedding-image-recognition-model-d02b4508df58432fbb84e800597b8959."},{"key":"e_1_3_2_1_11_1","unstructured":"Clarifai. 2020. Computer Vision AI Technology Case Studies. https:\/\/www.clarifai.com\/customers. Accessed: 2020-04-10."},{"key":"e_1_3_2_1_12_1","unstructured":"Intel Corporation Willow Garage and Itseez. [n.d.]. OpenCV. https:\/\/opencv.org\/. Accessed: 2019-01-20."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"e_1_3_2_1_14_1","unstructured":"DERMALOG. 2020. DERMALOG Home Page. https:\/\/www.dermalog.com\/products\/software\/face-recognition\/. Accessed: 2020-01-10."},{"key":"e_1_3_2_1_15_1","unstructured":"Vasisht Duddu Debasis Samanta D.\u00a0Vijay Rao and Valentina\u00a0E. Balas. 2018. Stealing Neural Networks via Timing Side Channels. CoRR abs\/1812.11720(2018). arxiv:1812.11720http:\/\/arxiv.org\/abs\/1812.11720"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2014.2322255"},{"key":"e_1_3_2_1_17_1","unstructured":"Australian\u00a0Border Force. [n.d.]. Smartgates. https:\/\/www.abf.gov.au\/entering-and-leaving-australia\/smartgates\/arrivals. Accessed: 2019-12-20."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"e_1_3_2_1_19_1","volume-title":"USENIX Security Symposium. 17\u201332","author":"Fredrikson Matthew","year":"2014","unstructured":"Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014. Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.. In USENIX Security Symposium. 17\u201332."},{"key":"e_1_3_2_1_20_1","volume-title":"Winter semester","author":"Gauthier Jon","year":"2014","unstructured":"Jon Gauthier. 2014. Conditional generative adversarial nets for convolutional face generation. Class Project for Stanford CS231N: Convolutional Neural Networks for Visual Recognition, Winter semester 2014, 5 (2014), 2."},{"key":"e_1_3_2_1_21_1","unstructured":"Aristides Gionis Piotr Indyk Rajeev Motwani 1999. Similarity search in high dimensions via hashing. In Vldb Vol.\u00a099. 518\u2013529."},{"key":"e_1_3_2_1_22_1","unstructured":"Ian Goodfellow Jean Pouget-Abadie Mehdi Mirza Bing Xu David Warde-Farley Sherjil Ozair Aaron Courville and Yoshua Bengio. 2014. Generative adversarial nets. In Advances in neural information processing systems. 2672\u20132680."},{"key":"e_1_3_2_1_23_1","unstructured":"Ishaan Gulrajani Faruk Ahmed Martin Arjovsky Vincent Dumoulin and Aaron\u00a0C Courville. 2017. Improved training of wasserstein gans. In Advances in neural information processing systems. 5767\u20135777."},{"key":"e_1_3_2_1_24_1","unstructured":"Jamie Hayes Luca Melis George Danezis and Emiliano De\u00a0Cristofaro. 2017. LOGAN: evaluating privacy leakage of generative models using generative adversarial networks. arXiv preprint arXiv:1705.07663(2017)."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_1_26_1","unstructured":"Sanghyun Hong Michael Davinroy Yi\u01e7itcan Kaya Stuart\u00a0Nevans Locke Ian Rackow Kevin Kulda Dana Dachman-Soled and Tudor Dumitra\u015f. 2018. Security analysis of deep neural networks operating in the presence of cache side-channel attacks. arXiv preprint arXiv:1810.03487(2018)."},{"key":"e_1_3_2_1_27_1","unstructured":"Xing Hu Ling Liang Lei Deng Shuangchen Li Xinfeng Xie Yu Ji Yufei Ding Chang Liu Timothy Sherwood and Yuan Xie. 2019. Neural Network Model Extraction Attacks in Edge Devices by Hearing Architectural Hints. CoRR abs\/1903.03916(2019). arxiv:1903.03916http:\/\/arxiv.org\/abs\/1903.03916"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3195970.3196105"},{"key":"e_1_3_2_1_29_1","unstructured":"Idency. [n.d.]. Facial Recognition Time and Attendance Machines. https:\/\/idency.com\/product-category\/authentication\/time-and-attendance\/biometric-time-and-attendance-systems\/facial-time-attendance\/. Accessed: 2019-12-20."},{"key":"e_1_3_2_1_30_1","volume-title":"Image-to-Image Translation with Conditional Adversarial Networks. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 5967\u20135976","author":"Isola Phillip","year":"2017","unstructured":"Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei\u00a0A Efros. 2017. Image-to-Image Translation with Conditional Adversarial Networks. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 5967\u20135976."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363201"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"e_1_3_2_1_33_1","volume-title":"dlib C++ library","author":"King E.","unstructured":"Davis\u00a0E. King. [n.d.]. dlib C++ library. http:\/\/dlib.net\/. Accessed: 2019-01-20."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/IWBF.2013.6547310"},{"key":"e_1_3_2_1_35_1","unstructured":"Gary B. Huang\u00a0Erik Learned-Miller. 2014. Labeled Faces in the Wild: Updates and New Reporting Procedures. Technical Report UM-CS-2014-003. University of Massachusetts Amherst."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813612"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/2590296.2590315"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"e_1_3_2_1_39_1","unstructured":"Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl\u00a0A. Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. CoRR abs\/1802.04889(2018)."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Jaime Lorenzo-Trueba Fuming Fang Xin Wang Isao Echizen Junichi Yamagishi and Tomi Kinnunen. 2018. Can we steal your vocal identity from the Internet?: Initial investigation of cloning Obama\u2019s voice using GAN WaveNet and low-quality found data. arXiv preprint arXiv:1803.00860(2018).","DOI":"10.21437\/Odyssey.2018-34"},{"key":"e_1_3_2_1_41_1","unstructured":"Xiaojiao Mao Chunhua Shen and Yu-Bin Yang. 2016. Image restoration using very deep convolutional encoder-decoder networks with symmetric skip connections. In Advances in neural information processing systems. 2802\u20132810."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243831"},{"key":"e_1_3_2_1_44_1","unstructured":"NPR. [n.d.]. Police Facial Recognition Databases Log About Half Of Americans. https:\/\/www.npr.org\/2016\/10\/23\/499042369\/police-facial-recognition-databases-log-about-half-of-americans. Accessed: 2019-12-20."},{"key":"e_1_3_2_1_45_1","unstructured":"Seong\u00a0Joon Oh Max Augustin Bernt Schiele and Mario Fritz. 2017. Towards reverse-engineering black-box neural networks. arXiv preprint arXiv:1711.01768(2017)."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_1_47_1","unstructured":"Jeff\u00a0John Roberts. [n.d.]. Here\u2019s How Many Adult Faces Are Scanned From Facial Recognition Databases by Cops. https:\/\/fortune.com\/2016\/10\/18\/facial-recognition-database\/. Accessed: 2019-12-20."},{"key":"e_1_3_2_1_48_1","volume-title":"Lipschitz Function","author":"Rowland Todd","unstructured":"Todd Rowland and Eric\u00a0W Weisstein. [n.d.]. Lipschitz Function. http:\/\/mathworld.wolfram.com\/LipschitzFunction.html. Accessed: 2020-01-02."},{"key":"e_1_3_2_1_49_1","volume-title":"Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246(2018).","author":"Salem Ahmed","year":"2018","unstructured":"Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2018. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246(2018)."},{"key":"e_1_3_2_1_50_1","unstructured":"Samsung. [n.d.]. How does Face recognition work on Galaxy Note10 Galaxy Note10+ and Galaxy Fold?https:\/\/www.samsung.com\/global\/galaxy\/what-is\/face-recognition\/. Accessed: 2019-12-20."},{"key":"e_1_3_2_1_51_1","unstructured":"David Sandberg. 2019. The most popular facenet implementation and pre-trained model.https:\/\/github.com\/davidsandberg\/facenet. Accessed: 2019-01-20."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSPCT.2014.6884911"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.5555\/2627435.2670313"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23176"},{"key":"e_1_3_2_1_58_1","volume-title":"USENIX Security Symposium. 601\u2013618","author":"Tram\u00e8r Florian","year":"2016","unstructured":"Florian Tram\u00e8r, Fan Zhang, Ari Juels, Michael\u00a0K Reiter, and Thomas Ristenpart. 2016. Stealing Machine Learning Models via Prediction APIs.. In USENIX Security Symposium. 601\u2013618."},{"key":"e_1_3_2_1_59_1","volume-title":"Irfan Essa, and Wenke Lee.","author":"Uzun Erkam","year":"2018","unstructured":"Erkam Uzun, Simon Pak\u00a0Ho Chung, Irfan Essa, and Wenke Lee. 2018. rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System.. In NDSS."},{"key":"e_1_3_2_1_60_1","volume-title":"Stealing Hyperparameters in Machine Learning. In 2018 IEEE Symposium on Security and Privacy, SP 2018","author":"Wang Binghui","year":"2018","unstructured":"Binghui Wang and Neil\u00a0Zhenqiang Gong. 2018. Stealing Hyperparameters in Machine Learning. In 2018 IEEE Symposium on Security and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA. 36\u201352."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274696"},{"key":"e_1_3_2_1_62_1","unstructured":"Wolfram. [n.d.]. Pseudoinverse. http:\/\/mathworld.wolfram.com\/Pseudoinverse.html. Accessed: 2019-01-20."},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01249-6_11"},{"key":"e_1_3_2_1_64_1","volume-title":"25th {USENIX} Security Symposium ({USENIX} Security 16). 497\u2013512.","author":"Xu Yi","unstructured":"Yi Xu, True Price, Jan-Michael Frahm, and Fabian Monrose. 2016. Virtual u: Defeating face liveness detection by building virtual models from your public photos. In 25th {USENIX} Security Symposium ({USENIX} Security 16). 497\u2013512."},{"key":"e_1_3_2_1_65_1","unstructured":"Mengjia Yan Christopher Fletcher and Josep Torrellas. 2018. Cache telepathy: Leveraging shared resource attacks to learn DNN architectures. arXiv preprint arXiv:1808.04761(2018)."},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-020-09604-z"},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354261"},{"key":"e_1_3_2_1_68_1","unstructured":"Dong Yi Zhen Lei Shengcai Liao and Stan\u00a0Z. Li. 2014. Learning Face Representation from Scratch. CoRR abs\/1411.7923(2014). arxiv:1411.7923http:\/\/arxiv.org\/abs\/1411.7923"},{"key":"e_1_3_2_1_69_1","unstructured":"Honggang Yu Kaichen Yang Teng Zhang Yun-Yun Tsai Tsung-Yi Ho and Yier Jin. 2020. CloudLeak: Large-Scale Deep Learning Models Stealing Through Adversarial Examples. In NDSS."},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"crossref","unstructured":"Sergey Zagoruyko and Nikos Komodakis. 2016. Wide residual networks. arXiv preprint arXiv:1605.07146(2016).","DOI":"10.5244\/C.30.87"},{"key":"e_1_3_2_1_71_1","unstructured":"Han Zhang Ian Goodfellow Dimitris Metaxas and Augustus Odena. 2018. Self-attention generative adversarial networks. arXiv preprint arXiv:1805.08318(2018)."},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.5555\/3305890.3306095"},{"key":"e_1_3_2_1_73_1","unstructured":"Andrey Zhmoginov and Mark Sandler. 2016. Inverting face embeddings with convolutional neural networks. arXiv preprint arXiv:1606.04189(2016)."},{"key":"e_1_3_2_1_74_1","unstructured":"Zhe Zhou Di Tang Xiaofeng Wang Weili Han Xiangyu Liu and Kehuan Zhang. 2018. Invisible mask: Practical attacks on face recognition with infrared. arXiv preprint arXiv:1803.04683(2018)."},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.244"}],"event":{"name":"ACSAC '21: Annual Computer Security Applications Conference","location":"Virtual Event USA","acronym":"ACSAC '21"},"container-title":["Annual Computer Security Applications Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3485832.3485840","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3485832.3485840","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T19:13:49Z","timestamp":1755890029000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3485832.3485840"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,12,6]]},"references-count":75,"alternative-id":["10.1145\/3485832.3485840","10.1145\/3485832"],"URL":"https:\/\/doi.org\/10.1145\/3485832.3485840","relation":{},"subject":[],"published":{"date-parts":[[2021,12,6]]},"assertion":[{"value":"2021-12-06","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}