从测量到缓解：用线性子空间移除量化并降低图像表征编码器中的身份泄露
From Measurement to Mitigation: Quantifying and Reducing Identity Leakage in Image Representation Encoders with Linear Subspace Removal
对使用 CLIP/DINOv2/SSCD 等冻结视觉嵌入做检索或完整性系统的人，这篇给出了一个可复用的审计流程（低误接受率下的开放集验证、基于扩散的模板反演检验、等面积扰动的人脸上下文归因）以及一个单样本线性投影器 ISP，可在几乎不损失非生物特征效用的前提下把身份线性可及性压到接近随机水平。
原文依据 a one-shot linear projector that removes an estimated identity subspace while preserving the complementary space needed for utility
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论冻结的视觉嵌入（如 CLIP、DINOv2/v3、SSCD）支撑着检索与完整性系统，但其在含人脸数据上的使用受制于未被量化的身份泄露以及缺乏可部署的缓解手段。我们采取攻击者感知的视角并做出如下贡献：(i) 一个视觉嵌入基准，报告低误接受率下的开放集验证、经校准的基于扩散的模板反演检验，以及采用等面积扰动的人脸上下文归因；(ii) 提出一个单样本线性投影器，在移除估计出的身份子空间的同时保留效用所需的补空间，为简洁起见我们将其称为身份净化投影 ISP。在 CelebA-20 与 VGGFace2 上，我们表明这些编码器在开放集线性探针下表现稳健，其中 CLIP 的泄露相对高于 DINOv2/v3 与 SSCD，对模板反演稳健，且以上下文为主导。此外，我们表明 ISP 使线性可及性降至接近随机水平，同时保留较高的非生物特征效用，并可跨数据集迁移且仅有轻微退化。我们的结果建立了首个针对非人脸识别编码器的、经攻击者校准的人脸隐私审计，并证明线性子空间移除在保持视觉搜索与检索效用的同时实现了强隐私保证。
英文原文摘要 1321 字符
Frozen visual embeddings (e.g., CLIP, DINOv2/v3, SSCD) power retrieval and integrity systems, yet their use on face-containing data is constrained by unmeasured identity leakage and a lack of deployable mitigations. We take an attacker-aware view and contribute: (i) a benchmark of visual embeddings that reports open-set verification at low false-accept rates, a calibrated diffusion-based template inversion check, and face-context attribution with equal-area perturbations; and (ii) propose a one-shot linear projector that removes an estimated identity subspace while preserving the complementary space needed for utility, which for brevity we denote as the identity sanitization projection ISP. Across CelebA-20 and VGGFace2, we show that these encoders are robust under open-set linear probes, with CLIP exhibiting relatively higher leakage than DINOv2/v3 and SSCD, robust to template inversion, and are context-dominant. In addition, we show that ISP drives linear access to near-chance while retaining high non-biometric utility, and transfers across datasets with minor degradation. Our results establish the first attacker-calibrated facial privacy audit of non-FR encoders and demonstrate that linear subspace removal achieves strong privacy guarantees while preserving utility for visual search and retrieval.