Casting the Net! Revisiting MasterFace Impersonation Attacks

arXiv:2608.06952v1 [cs.CR] 7 Aug 2026

Casting the Net! Revisiting MasterFace Impersonation Attacks Seunghun Paik∗†

Sunpill Kim∗†

Hanyang University Seoul, Republic of Korea whitesoonguh@hanyang.ac.kr

Hanyang University Seoul, Republic of Korea ksp0352@hanyang.ac.kr

Chanwoo Hwang∗

Jae Hong Seo∗‡

Hanyang University Seoul, Republic of Korea aa5568@hanyang.ac.kr

Hanyang University Seoul, Republic of Korea jaehongseo@hanyang.ac.kr

Abstract

CCS Concepts

Impersonation is a fundamental security threat in face recognition systems (FRSs). While the security of FRSs has been challenged by various attack vectors, under realistic adversarial capabilities, e.g., a limited number of decision-only authentication trials and no internal system knowledge, most attack techniques become infeasible. As a result, impersonation by zero-effort impostors, characterized by false match rate (FMR), is commonly regarded as a standalone baseline. A few years ago, impersonation attacks based on MasterFaces— which exploit non-uniformity in biometric distribution—emerged as a notable security threat that could break the barrier of the FMRbased baseline under such realistic constraints. However, they were believed not to yield impersonation above the standard FMR in modern FRSs, as discussed by multiple follow-up studies. In this paper, we demonstrate that even legitimate access to public commercial APIs allows an adversary to amplify impersonation rates through MasterFaces, resulting in a non-trivial impersonation attack beyond FMR on downstream applications built on top of these APIs. We observe that several real-world FRS deployments are implemented using commercial APIs, and that the backend service provider is publicly disclosed or trivially inferable. As a result, the adversary can purchase these pay-as-you-go API services without requiring any additional privilege over the target FRS. Motivated by this observation, we formalize the MasterFaces attack as a maximum coverage problem over the biometric representation space, which we call a net, and show that the adversary can construct an API-tailored net by leveraging the geometric structure of the representation space. Through experiments, we demonstrate that our attack amplifies the impersonation rates of several open-source and commercial API-based FRSs by up to 9.5× within at most 30 authentication trials, compared to those expected from the standard FMR. Overall, we revive the MasterFaces attack as posing a potential vulnerability against real-world FRSs.

• Security and privacy → Biometrics.

∗ Department of Mathematics & Research Institute for Natural Sciences † Equally Contributed ‡ Corresponding Author

This work is licensed under a Creative Commons Attribution 4.0 International License. CCS ’26, The Hague, Netherlands. © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2871-6/2026/11 https://doi.org/10.1145/XXXXXX.XXXXXX

Keywords Face Recognition System; Impersonation Attack; MasterFaces ACM Reference Format: Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo. 2026. Casting the Net! Revisiting MasterFace Impersonation Attacks . In Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS ’26), November 15–19, 2026, The Hague, Netherlands. ACM, New York, NY, USA, 18 pages. https://doi.org/10.1145/XXXXXX.XXXXXX

1

Introduction

Face recognition systems (FRSs) [16, 75, 95] have been widely adopted in real-world applications for seamless and user-friendly authentication, such as access control in buildings [85] or airports [81], and identity verification in financial services [3]. In many such deployments, FRSs are implemented using commercial API services, e.g., AWS Rekognition [1] and Tencent Cloud [2], which serve as a backbone of large-scale real-world systems [77, 82]. Standards for FRSs have also been well established, including ISO/IEC documents for how to evaluate and analyze these systems in various scenarios [35, 37, 38], as well as benchmarks [69]. The security of FRSs has been challenged by a wide range of attacks under various threat models [4, 12, 13, 21, 28, 40, 52, 53, 57, 78, 79]. Among these threats, the fundamental adversarial goal as an authentication system is impersonation, where an adversary aims to be accepted as a victim identity enrolled in the system. The risk against impersonation is typically captured by false match rate (FMR) [30], a standard evaluation metric that quantifies the probability that two facial images from different users are incorrectly accepted as a match. This reflects the zero-effort imposter, which assumes no deliberate attempt at impersonation and thus represents the weakest adversary, serving as the foundational security baseline for FRSs. Accordingly, several standards and benchmarks place a heavy emphasis on measuring and reporting FMR, and often discuss typical operating points for different application contexts [30]. In realistic FRS deployments, the adversarial capability is highly constrained due to operational and security considerations. Adversaries typically have no access to internal system information, e.g., model parameters or prior knowledge of the enrolled identity. In addition, only a highly restricted form of interaction with the system is permitted, such as obtaining decisions from a small, fixed number

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

of authentication trials. These constraints substantially limit many attack strategies, which rely on high-fidelity information from the system through rich interaction [4, 28, 40, 53, 61, 78, 79] or privileged access to the target identity or enrollment [12, 13, 21, 52, 57]. As a result, under such a restrictive setting, the aforementioned zero-effort impostors have served as a baseline, and they are widely regarded as capturing the practical security level of modern FRS deployments, as well as biometric authentication systems and derived security protocols [6, 8, 47]. A few years ago, MasterFace-based impersonation attacks [68, 80] challenged this conventional understanding by exploiting nonuniformity in biometric distributions. They demonstrated that carefully synthesized faces—called MasterFaces—can be matched with multiple identities and exploited for impersonation by facilitating false matches. Although these attacks received considerable attention at that time, multiple follow-up studies showed that they were effective for outdated FRSs only; for recent state-of-the-art FRSs under a realistic threat model, they could not achieve impersonation success rates beyond the FMR [25, 67, 83]. Thus, zero-effort impostors have remained the de facto baseline adversary, and to the best of our knowledge, it remains open whether it is possible to design a non-trivial impersonation attack under this setting.

1.1

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

API-based FRSs. When the authentication trial budgets range from 5 to 30, reflecting typical rate limits in real-world deployments, our attack shows consistently higher impersonation rates compared to the baseline zero-effort impostor by 2.03×–8.17× and 1.75×– 9.50× for the FMR of 10−4 and 10−5 , respectively. Note that the adversary can launch our attack within a realistic API usage budget, spending at most $100 according to their pricing policy. Our results highlight that MasterFaces-based impersonation attacks can be revived through the legitimate exploitation of publicly available information about backend API usage, underscoring the need for greater caution in system-level information disclosure. We summarize our contribution as follows: • We present a non-trivial impersonation attack beyond the standard FMR baseline, showing that MasterFaces become effective when the adversary can legitimately purchase the same public commercial APIs as the target FRS. • We formalize MasterFaces by constructing a net, which allows for reducing the attack to the maximum coverage problem, leveraging the geometry of the template space. • We show how to construct an API-tailored net from legitimate API score queries, whose corresponding faces can be recovered from existing score-based reconstruction attacks. • We implement our attack against multiple open-source and commercial API-based FRSs, demonstrating consistently higher impersonation rates compared to the zero-effort impostor baseline under authentication trials ranging from 5 to 30. • We provide our source code on the Zenodo archive https: //zenodo.org/records/20765343 for reproducibility. To avoid potential misuse, we release only a minimal part of the code.

Our Contribution

In this paper, we show that the adversary can legitimately leverage public commercial APIs to amplify the impersonation capability of MasterFaces, thereby enabling a non-trivial impersonation attack beyond the zero-effort impostor baseline under the same authentication trial budget. Here, “legitimately” means that the adversary purchases the public API and issues queries to obtain similarity scores between each pair of chosen facial images, without requiring any additional privilege on the target FRS or auxiliary information on the enrolled identity. We observe that several FRS services utilize commercial APIs as a backend, such as Amazon Rekognition [1] or Tencent Cloud [2], and it is typically publicly disclosed which backend API was used [77, 82]. As a result, the adversary can purchase the same pay-as-you-go API1 with the target FRS. Motivated by this observation, we design a novel algorithm to find MasterFaces tailored to a target FRS. We formalize MasterFaces as the samples whose corresponding templates—i.e., feature embeddings extracted by an FRS—collectively maximize coverage over the face template distribution. We call this set of templates a net2 . This formalization allows us to exploit geometric properties of the template space, including isometries, and reduces net construction to a maximum coverage problem (MCP), a classical combinatorial optimization problem whose polynomial-time approximation is well-known [66]. Furthermore, we show that the adversary can obtain templates of chosen facial images from a public API up to an unknown isometry. We find that these transformed features suffice to construct an API-tailored net, and more importantly, faces corresponding to net can be reconstructed using existing score-based reconstruction attacks [53] as a subroutine. We implement our attack and conduct extensive experimental analyses against various open-source and Amazon Rekognition 1 https://aws.amazon.com/rekognition/pricing/ 2 This is an analogy to casting the net at the best plausible spot for fishing.

1.2

Technical Overview

MasterFace attacks aim to find a face that can be identified as many different identities as possible, expecting that such a face would be likely to succeed in impersonation as an unknown target identity. However, previous methods search MasterFaces over the latent space of the generative models [45], which often results in suboptimal solutions. Subsequent studies further showed that such MasterFaces heavily rely on the FRS and would not be effective for modern sophisticated FRSs [25, 67, 83]. Consequently, against unknown modern FRSs, their MasterFaces were barely effective, i.e., no better than the zero-effort impostor baseline [83]. To address these limitations, our attack consists of two core ingredients: net-based formulation of MasterFaces and exploiting legitimate API queries for crafting API-tailored MasterFaces. We visualize an overview of our attack’s pipeline in Fig. 1. Revisiting MasterFaces over Template Space. Instead of directly finding MasterFaces over the face image space, we consider the template space, where we can leverage its geometric structure. From this perspective, we can observe that the corresponding templates of MasterFaces should maximize the coverage of the face templates from the given dataset. We focus on finding such a set of vectors over the template space, which we define as a net. Finding a net is equivalent to solving the MCP, and this net would serve a role as the optimal MasterFaces over the template space.

Casting the Net! Revisiting MasterFace Impersonation Attacks

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Figure 1: Overview of our attack pipeline. Left: The adversary obtains rotated templates via the Gram Decomposition. Middle: The adversary can obtain a rotated net due to its rotation invariance. Right: The adversary finally recovers MasterFaces from the found net via a score-based reconstruction method. White regions are not accessible to the adversary. Best viewed in color. Exploiting Legitimate API Queries. To proceed with the impersonation attack via net, the adversary must recover the corresponding facial images. Notably, net itself still heavily relies on the template space, so faces corresponding to net may not be effective in an unknown target FRS. We observe that, if the adversary can purchase the backend API of the target FRS, it becomes possible to construct an API-tailored net and recover corresponding MasterFaces, thereby addressing all these issues. Such APIs typically return a confidence score for a pair of queried facial images, and prior studies [52, 53, 55] have shown that the corresponding cosine similarity, i.e., an inner product value between unit vectors, can be inferred by the adversary. From this setting, our key observation is that the adversary can decompose the score matrix, which consists of the inner product values of the templates. More precisely, if we denote 𝑆 as the score matrix, then 𝑆 = 𝐴𝑇 𝐴 for the matrix 𝐴 whose columns consist of templates extracted by the API. By applying the Gram decomposition, the adversary obtains 𝐿 such that 𝐴𝑇 𝐴 = 𝐿𝑇 𝐿. A classical linear algebra theory ensures that 𝐿 = 𝑅𝐴 for some unknown rotation matrix 𝑅. This further allows the adversary to obtain a rotated template of the chosen facial image, because for the template 𝑧 extracted by the API, the adversary can obtain 𝑧𝑇 𝐴 through queries and 𝑧𝑇 𝐴 = (𝑅𝑧)𝑇 (𝑅𝐴) holds; we can deduce that 𝑅𝑧 = (𝑧𝑇 𝐴 · 𝐿 −1 )𝑇 . Note that the adversary does not know the exact template because the rotation is unknown. Nevertheless, finding MasterFaces is still possible because the coverage is invariant under isometries. That is, the found net from rotated templates is equal to rotating the net from the original templates by the same amount. Hence, when applying the Gram decomposition technique again, the adversary can obtain the score between the MasterFaces corresponding to net and any chosen facial image. This directly enables the adversary to apply score-based attacks on net, which reconstruct the face image from score queries with it. We remark that all these processes remain within our threat model because no further privilege or interaction with the target identity is required.

2

System and Threat Model

We first clarify the system and the threat model we are considering. To this end, we briefly introduce the FRS and the impersonation

attack, and then formalize our problem setting with justifications in real-world deployment scenarios. Notation. For a set X and the metric function 𝑑 X : X × X → R ≥0 , we denote (X, 𝑑 X ) as the metric space. For a distribution D, we denote 𝑥 ← D as the random sampling. In particular, for a finite $

set S, we denote 𝑥 ← − S as the random uniform sampling over S. We denote R𝑑 −1 and S𝑑 −1 as 𝑑-dimensional Euclidean space and (𝑑 − 1)-dimensional hypersphere embedded into R𝑑 , respectively. We denote ⟨·, ·⟩ as a standard inner product over R𝑑 . We denote a vector as a column-wise, i.e., 𝑑 × 1 matrix.

2.1

Backgrounds on FRSs

Face Recognition Systems. Let B be the set of faces and (X, 𝑑 X ) be a metric space. We denote a function 𝐹 : B → X as a template extractor. In this context, we call each element of X a face template. We expect that 𝐹 preserves the implicit similarity between faces, i.e., facial images from the same identity are mapped to close templates, or vice versa. With a template extractor 𝐹 , we define a face recognition system (FRS) as a pair of algorithms (Enroll, Auth) corresponding to enrollment and authentication, respectively. Each algorithm has the following functionality: • Enroll takes a facial image 𝔟 ∈ B and returns a corresponding template 𝑡 := 𝐹 (𝔟). Later, the FRS stores 𝑡 in its database. • Auth takes a facial image 𝔟′ ∈ B and the stored template 𝑡, returning a decision 0/1 corresponding to “reject” and “accept”. For a pre-determined threshold 𝜏 > 0, this is typically implemented by 1(𝑑 X (𝐹 (𝔟′ ), 𝑡) < 𝜏). For the ease of explanation, at this moment, we consider the FRS as a 1:1 verification system. Our analysis can be naturally extended to a 1:N identification system, which will be discussed in Section 4.2. We note that many state-of-the-art FRSs [14, 16, 50, 51, 75] utilize X = S𝑑 −1 and 𝑑 X as the cosine distance, which is defined by 𝑑 cos (𝑥, 𝑦) := 1 − ⟨𝑥, 𝑦⟩ for 𝑥, 𝑦 ∈ S𝑑 −1 . Since our primary focus is on such FRSs, we consider the template space (X, 𝑑 X ) as (S𝑑 −1, 𝑑 cos ) in later sections. False Match Rate and Impersonation Attack. Informally speaking, the FMR of the given FRS refers to the probability that a pair

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

of biometrics from different identities is determined as the same identity. Since the authentication algorithm is parametrized by the threshold 𝜏, so is FMR; a smaller 𝜏 gives a smaller FMR. In standard benchmarks like IJB-C testsuite [63], FMR at the threshold 𝜏 Í is measured by FMR(𝜏) := | P1 | (𝔟,𝔟′ ) ∈ P 1(𝑑 X (𝐹 (𝔟), 𝐹 (𝔟′ )) < 𝜏), where P consists of pairs of biometrics from different identities in the benchmark set. For the stored template 𝑡, we consider the impersonation attack as the problem of finding a facial image 𝔟′ such that Auth(𝔟′, 𝑡) = 1, without knowing the stored template 𝑡. The capability of the adversary depends on the attack scenarios; in usual real-world applications, the adversary does not know either the template extractor of the target FRS or the enrolled facial image of the target identity. In this setting, we can consider a simple impersonation attack that solely relies on FMR, so-called the zero-effort impostor mentioned in standards [30, 35]. To impersonate the enrolled identity in the target FRS, the adversary selects one of the facial images and tries to authenticate with this sample. Provided that the threshold used for the benchmark dataset well represents the whole population, as commonly assumed in the standards [63], the adversary’s attack success rate is the same as FMR. FRS with Commercial API. Several real-world FRSs leverage 3rd party API services, e.g., Amazon Rekognition [1] or Tencent Cloud [2], in the place of the template extractor. When querying two facial images to these services, they return a confidence score that represents the similarity of the queried pairs in terms of a value between 0 and 1. Note that the formula for confidence scores is not publicly available, but the API services provide preset thresholds for the confidence score. In addition to this, these services allow storing the user’s faces on their own cloud server, and only an authorized entity (e.g., FRS service provider) can access the server to obtain a confidence score between the queried faces and the enrolled ones.

2.2

Problem Formulation

System Model. We consider two entities: a user and the FRS service provider. We assume that the user has already enrolled in the FRS service, and the service provider stores the template in its storage. The functionalities of each party are as follows: • The user queries a facial image to the service provider, receiving a decision “accept”or “reject”. • The service provider runs FRS.Auth on the queried facial image and the enrolled template, and return the decision result to the user. As documented in NIST and ISO/IEC standards [30, 35], we assume that there is a maximum number of queries made by the user. In usual real-world deployments, the maximum number of allowed authentication trials is often strictly limited (e.g., to a small number such as tens of attempts), and the query limit can be refreshed periodically or upon successful authentication. Threat Model. From the above setting, we consider an adversary that serves the role of the user, aiming to retrieve “accept” from the service provider within a limited number of queries. We assume that the adversary has no prior knowledge of both the target system and the enrolled identity. The adversary cannot gain access to any internal information, such as architecture, training dataset, and

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

the parameters of the template extractor, the enrolled template stored in the database, and the decision threshold. Nevertheless, we assume that the adversary can exploit some public face datasets, such as usual datasets for training template extractors [18, 44, 97]. In particular, when the target FRS utilizes a commercial thirdparty API, regulatory requirements often mandate transparency regarding face data handling practices and, in some cases, the involvement of third-party service providers [89]. In addition, the adversary could infer which third-party service is used by referring to publicly available use-cases of these services [77, 82]. Hence, the adversary can purchase the same API used by the target FRS and query pairs of its own facial images without knowing the target identity. These API services are pay-as-you-go, hence the adversary can make many more queries to the API service than direct authentication trials to the FRS. Importantly, we note that access to such APIs does not grant any additional privileges over the target FRS. To reflect the real-world application scenarios as an end user, we only consider adversaries with such a restricted capability. As we briefly mentioned earlier, this setting renders existing attack methods inapplicable, as they require query capabilities beyond decision [10, 28, 53, 79] or prior knowledge of the enrolled identity [13, 21, 52]. In such a strong adversarial capability, the adversary is often assumed as the insider of the system, such as a service developer, who can silently query the backbone template extractor or API to obtain decision scores. Furthermore, several reconstruction attacks require the knowledge of the template, assuming that the adversary can obtain an unprotected template through hacking or a data breach [61, 70, 78]. However, insider access to score outputs or direct exposure of face templates is often considered an unrealistic capability according to the operational scenario assumptions documented in NIST and ISO/IEC standards [30, 36, 39]. In summary, these representative lines of work fundamentally rely on capabilities beyond the end-user adversary, except for the baseline zero-effort imposter based on FMR [30]. This motivates the need for new techniques under this constrained yet realistic setting.

3

Our Attack

We now present our impersonation attack. We first briefly introduce MasterFace-based impersonation attacks and our viewpoint on understanding them as the problem of finding a net, i.e., maximum coverage over the template space. We then show that the legitimate API queries allow the adversary to build a net that reflects the template distribution of the target FRS, whose corresponding faces can further be recovered by score-based reconstruction attacks. MasterFaces: A Brief Overview. MasterFaces [25, 67, 68, 80, 83], a special case of the wolf attack [71, 86] for faces, aim to find a face that could be identified as many other identities as possible. More formally, for a database DB of facial images, the Masterface for a template extractor 𝐹 with a threshold 𝜏 is defined as follows: ∑︁ 𝔟MF := arg max𝔟∈ B 1(𝑑 X (𝐹 (𝔟), 𝐹 (𝔳)) < 𝜏). (1) 𝔳∈DB

After finding the MasterFaces from Eq. (1), the adversary conducts an impersonation attack by querying the MasterFace to the target FRS; if multiple attempts are allowed, then the adversary finds other MasterFaces, excluding the previously tried ones.

Casting the Net! Revisiting MasterFace Impersonation Attacks

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Despite its clear formulation, MasterFaces from prior studies exhibit several limitations, rendering impersonation attacks based on them no better than the FMR-based baseline. First, to solve Eq. (1), all prior studies [68, 80, 83] relied on evolutionary algorithms over the latent space of the generative models, e.g., the latent space evolution algorithm [7, 32] with StyleGAN [45, 46]. Furthermore, several studies have shown that the MasterFaces are too sensitive to the choice of 𝐹 [25, 67, 83], hence they are barely transferable, i.e., MasterFaces from the adversary’s own template extractor 𝐹 are no longer effective to the unknown template extractor of the target FRS. More importantly, Terhöst et al. [83] pointed out that several works reported results on outdated FRSs even at that time; finding MasterFaces from the prior heuristic-based algorithms was no longer effective for modern state-of-the-art FRSs [9, 64, 84]. For these reasons, impersonation attacks based on prior MasterFaces do not pose a serious security threat against modern FRSs.

3.1

MasterFace Impersonation Attack via net

Let us denote 𝔟 the target identity’s facial image enrolled into the target FRS. Instead of directly searching over B, we turn our attention to the template space (X, 𝑑 X ), and consider the following problem: finding 𝑄 templates where at least one of them is sufficiently close to the template 𝑡 of 𝔟. To simplify the problem, likewise to previous MasterFaces, we assume that the distribution D of templates is publicly known, and the adversary knows the template extractor 𝐹 . We formalize the above problem as follows: Definition 1. For the template extractor 𝐹 of FRS, let D be the distribution defined over X of templates extracted from 𝐹 . We consider the following search problem for 𝑡 ← D: • [Instance] The template extractor 𝐹 , the threshold 𝜏 > 0, and an integer 𝑄 ∈ N. • [Problem] Find a set {𝑧 1, . . . , 𝑧𝑄 } satisfying ∃𝑖 ∈ [𝑄] such that 𝑑 X (𝑧𝑖 , 𝑡) < 𝜏. Note that solving the above problem per se does not imply the success of the impersonation attack in our threat model because (i) finding such a template does not imply obtaining the corresponding faces, and (ii) the template extractor 𝐹 is unknown to the adversary. At this moment, we put these issues aside and focus on solving the simplified problem; we will address them in later sections. Finding net from Maximum Likelihood Strategy. To solve the problem in Definition 1, our key strategy is to maximize the likelihood that the target template 𝑡 belongs to at least one of the 𝜏-neighborhoods of 𝑧𝑖 over X. That is, we aim to find the best 𝑄 plausible covering ∪𝑖=1 B X (𝑧𝑖 ; 𝜏) to capture 𝑡, where B X (𝑧; 𝜏) := {𝑤 ∈ X : 𝑑 X (𝑤, 𝑧) < 𝜏 } for 𝑧 ∈ X. We call the centers {𝑧 1, . . . , 𝑧𝑄 } of this covering net, and finding such a net can be written as the following optimization problem:

Directly solving Eq. (2) would be cumbersome because the distribution D cannot be expressed in a closed form. To address this, we adopt a Monte-Carlo-style approximation to estimate the probability in Eq. (2). More precisely, for the set of biometrics DB of size 𝑀 sampled from B, the adversary can regard the following quantity as the objective function in Eq. (2): 1 𝑄 {𝔟 ∈ DB : 𝐹 (𝔟) ∈ ∪𝑖=1 B X (𝑧𝑖 ; 𝜏)} (3) 𝑀 That is, for the set 𝐹 (DB) := {𝐹 (𝔟) : 𝔟 ∈ DB}, finding net, i.e., 𝑧 1, . . . 𝑧𝑄 , in Eq. (2), can be viewed as finding 𝑄 elements of X whose 𝜏-neighborhoods maximally cover 𝐹 (DB). This is a special instance of the maximum coverage problem (MCP) [66], a famous classical problem in combinatorial optimization. Solving Maximum Coverage Problem. Exactly solving the MCP is known to be NP-hard. Nevertheless, its polynomial-time approximations, such as greedy-based [66], have been proposed. We design a hybrid algorithm that clusters the templates first and then applies the greedy algorithm. In the first layer of the algorithm, the adversary runs a clustering algorithm, such as K-Means [19, 59], obtaining 𝜅𝑄 candidate clustering centers for some 𝜅 > 1. Then, for some candidate threshold 𝜏, the adversary selects 𝑄 final centers whose 𝜏-neighborhood balls contain the largest number of templates via greedy search. Although the latter process would not give an optimal solution, the submodularity of the objective function of the MCP guarantees that this approach gives (1 − 𝑒 −1 )-approximated solution in polynomial time [66]. We provide a complete description of the algorithm in Appendix D. Remark on the Threshold 𝜏. At this moment, for the ease of explanation, we assume that the adversary uses the threshold parameter 𝜏 when constructing a net. In our threat model, however, 𝜏 is unknown to the adversary and will be treated as an additional tunable hyperparameter.

3.2

Exploiting Public API Queries

We now show how to legitimately leverage the commercial API queries of the target FRS, addressing assumptions we admitted for the ease of explanation, i.e., (i) finding representative facial images corresponding to the found net, and (ii) getting rid of the dependence of net on 𝐹 . Note that the adversary can obtain the confidence scores from pairs of its own chosen faces only; this does not grant any access to the target FRS, its internal decision scores, or the enrolled identity. For the ease of explanation, we assume that commercial APIs return the cosine similarity, i.e., the inner product between (normalized) feature vectors, instead of the confidence score. Several studies showed that such confidence scores can be approximated as a function of the cosine similarity, e.g., a logistic function [52, 53]. We provide a detailed explanation in Section 4.1.

𝑄

Maximize

Pr[𝑡 ∈ ∪𝑖=1 B X (𝑧𝑖 ; 𝜏) | 𝑡 ← D]

(2)

s.t. 𝑧 1, . . . , 𝑧𝑄 ∈ X This strategy implicitly leverages the fact that biometric templates are not uniformly distributed in practice, sharing the same insight as MasterFaces. Hence, carefully chosen centers 𝑧𝑖 cover significantly more mass than naïve independent trials or just sampling nonoverlapping balls.

Gram Decomposition of Scores. For a positive semi-definite matrix 𝑃 ∈ R𝑑 ×𝑑 , Gram decomposition aims to find a matrix 𝐿 ∈ R𝑑 ×𝑑 such that 𝑃 = 𝐿𝑇 𝐿. Special cases of Gram decompositions are well-known, e.g., Cholesky decomposition or matrix square root derived from spectral decomposition. In addition, if we obtain two decompositions 𝑃 = 𝐿𝑇 𝐿 = 𝑀𝑇 𝑀, then it is well-known that there always exists a unitary matrix 𝑅 ∈ R𝑑 ×𝑑 such that 𝐿 = 𝑅𝑀.

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

Keeping in mind these mathematical facts, our key observation is that the adversary can construct a score matrix 𝑆 ∈ R𝑑 ×𝑑 from score queries whose entries consist of the pairwise cosine similarity between the queried biometric samples. Since the cosine similarity is equivalent to the inner product between two unit vectors, we can write 𝑆 = 𝐴𝑇 𝐴 where 𝐴 ∈ R𝑑 ×𝑑 consists of the feature vector of queried biometric samples extracted from the API3 . Hence, 𝑆 is positive semi-definite, and the adversary can apply the Gram decomposition on 𝑆 to obtain 𝑆 = 𝐿𝑇 𝐿, which guarantees that 𝐿 = 𝑅𝐴 for some unitary matrix 𝑅 ∈ R𝑑 ×𝑑 . Although the adversary does not know both 𝐴 and 𝑅, since 𝑅 can be viewed as the isometry, i.e., distance-preserving mapping, the adversary can learn the geometric structure of feature vectors up to a global isometry. To be precise, let DB𝑃 := {𝔟1, . . . , 𝔟𝑑 } be a set of facial images. The adversary can obtain scores via queries of pairs of facial images in DB𝑃 , namely, {𝑑 X (𝐹𝑇 (𝔟𝑖 ), 𝐹𝑇 (𝔟 𝑗 ))}𝑖≠𝑗 , where 𝐹𝑇 is the template extractor of the target API. The adversary then constructs a score matrix 𝑆 = 𝐴𝑇 𝐴 where 𝐴 is the matrix whose 𝑖 th column consists of 𝐹𝑇 (𝔟𝑖 ). Finally, the adversary computes the Gram decomposition on 𝑆, obtaining 𝐿 = 𝑅𝐴 for some unitary matrix 𝑅. Once obtaining 𝐿, the adversary can obtain 𝑅 · 𝐹𝑇 (𝔟∗ ) for any 𝔳 with score queries for {𝑑 X (𝐹𝑇 (𝔳), 𝐹𝑇 (𝔟𝑖 ))}𝑑𝑖=1 . More precisely, let 𝐷 be a set of biometrics the adversary wishes to obtain DB𝑁 := {𝔳𝑖 }𝑖=1 the features of the form 𝑅 · 𝐹𝑇 (𝔳𝑖 ). By exploiting score queries, the adversary can construct a matrix 𝑆 𝐵 = 𝐵𝑇 𝐴 ∈ R𝐷 ×𝑑 , where 𝐵 ∈ R𝑑 ×𝐷 is a matrix whose 𝑖 th column vector is 𝐹𝑇 (𝔟𝑖∗ ). Along with the fact that 𝐼 = 𝑅𝑇 𝑅, we can observe that 𝑆 𝐵 · 𝐿 −1 = 𝐵𝑇 (𝑅𝑇 𝑅)𝐴 · (𝑅𝐴) −1 = (𝑅𝐵)𝑇

(4)

That is, 𝑅𝐵 = (𝑆 𝐵 · 𝐿 −1 )𝑇 ∈ R𝑑 ×𝐷 , provided that 𝐿 is full-rank4 . To sum up, for some unknown unitary matrix 𝑅, the adversary can obtain the rotated feature vectors by 𝑅 extracted from the API. Since all these obtained features share the same isometry 𝑅, the adversary can leverage these rotated features to extract distributional traits of the target API’s template extractor.

Figure 2: Isometry invariance of net (Yellow stars) from samples (Orange dots) over the template space. the template 𝐹𝑇 (𝔳) of any arbitrary biometric samples 𝔳 through additional API queries, namely, ⟨𝑧𝑖∗, 𝐹𝑇 (𝔳)⟩ = ⟨𝑅𝑧𝑖∗, 𝑅 · 𝐹𝑇 (𝔳)⟩ = ⟨𝑅𝑧𝑖∗, ((𝐹𝑇 (𝔳)𝑇 · 𝐴) ·𝐿 −1 )𝑇 ⟩ | {z } From API queries

The last equality comes from Eq. (4). This equality implies that the adversary can launch score-based reconstruction attacks [43, 53, 73, 87], which aim to reconstruct a facial image corresponding to the target identity through direct score queries to the target FRS. Although these attacks per se are not applicable for impersonation in our threat model, in our attack pipeline, we can utilize them as a subroutine to recover representative biometric samples corresponding to net by implicitly constructing a score oracle according to Eq. (5). As a result, both simplifying assumptions introduced for the ease of explanation, namely, access to the template extractor and direct instantiation of net centers, are fully eliminated without granting any additional privilege over the target BAS or the enrolled identity.

3.3 Isometry Invariance of net. With the rotated features by 𝑅, the adversary can still exploit our net-based attack strategy because 𝑅 preserves the geometric structure up to a global isometry in X = S𝑑 −1 . In particular, MCP instances are invariant under isometry. More precisely, let 𝜙 : X → X be an isometry, i.e., 𝜙 (𝑥) = 𝑅𝑥. Then we can observe that 𝑄

𝑄

𝐹 (𝔟) ∈ ∪𝑖=1 B X (𝑧𝑖 ; 𝜏) ⇐⇒ 𝜙 (𝐹 (𝔟)) ∈ ∪𝑖=1 B X (𝜙 (𝑧𝑖 ); 𝜏) as 𝜙 preserves the distance relationship. That is, if 𝑧 1∗, . . . , 𝑧𝑄∗ is the solution over the set {𝐹 (𝔟) : 𝔟 ∈ B ∗ }, then 𝜙 (𝑧 1∗ ), . . . , 𝜙 (𝑧𝑄∗ ) is the solution over {𝜙 (𝐹 (𝔟)) : 𝔟 ∈ B ∗ }. Therefore, if the adversary finds a net from rotated features by 𝑅, then it should be the rotated net derived from the original features. To help understand, we illustrate the above observation in Fig. 2. Recovering Faces from net. Finally, the adversary obtains the rotated net {𝑅𝑧 1∗, . . . , 𝑅𝑧𝑄∗ } after solving the MCP. Although the actual net without rotation is still unknown, we observe that the adversary can obtain the cosine similarity between net and 3 Of course, the dimension of templates in the API is unknown to adversary. We will

carefully handle this issue in Section 4.1. 4We will show how to handle this condition in Section 4.1.

(5)

Full Pipeline of the Attack

With the above-mentioned ideas, we present the full pipeline of the proposed impersonation attack based on net. Before starting the attack, the adversary first prepares public sets of biometrics DB𝑃 and DB𝑁 . The adversary can leverage public training datasets or their refinements, which would broadly reflect the population distribution. With this dataset, the adversary first collects the rotated features via the Gram decomposition idea and API queries (Step 1), and then finds a net by solving the MCP over the rotated features (Step 2). Afterwards, the adversary now reconstructs the corresponding biometric samples through score-based attacks and submits them to the target FRS (Step 3). We describe the full pipeline in Fig. 3. We will provide detailed explanations for each attack component in the next section. API Query Cost. In our attack, the adversary makes API queries for (Step 1) and (Step 3). For the former, constructing 𝑆 and {® 𝑧𝔳 : 𝔳 ∈ DB𝑁 } require 𝑑 (𝑑2−1) and |DB𝑁 | · 𝑑 queries, respectively. On the other hand, the number of required queries in the latter depends on the choice of the score-based attack. As the adversary purchases the API as an end user, reducing API queries primarily affects the financial cost of the attack.

Casting the Net! Revisiting MasterFace Impersonation Attacks

net-based MasterFace Impersonation Attack Parameter: The number of trials 𝑄 ∈ N. Inputs: • API API(𝔟, 𝔳) → ⟨𝐹𝑇 (𝔟), 𝐹𝑇 (𝔳)⟩ purchased by the adversary. • Face datasets DB𝑃 = {𝔟1, . . . , 𝔟𝑑 } and DB𝑁 . • MCP solver MCP with a threshold 𝜏MCP > 0. • Score-based attack SBAttack with a query budget 𝑄 SB . Output: A set of facial images {𝔟1∗, . . . , 𝔟𝑄∗ } ⊂ B. Step 1. Collect Rotated Features (1) Construct 𝑆 = (𝑆𝑖,𝑗 ) ∈ R𝑑 ×𝑑 , where 𝑆𝑖,𝑗 ← API(𝔟𝑖 , 𝔟 𝑗 ). (2) Find 𝐿 ∈ R𝑑 ×𝑑 such that 𝑆 = 𝐿𝑇 𝐿 via Gram decomposition. 𝑑 and (3) For each 𝔳 ∈ DB𝑁 , construct 𝑢®𝔳 ← (API(𝔳, 𝔟𝑖 ))𝑖=1 𝑇 −1 𝑇 compute 𝑧®𝔳 ← (𝑢®𝔳 · 𝐿 ) Step 2. Find a net and Construct Score Oracles (1) Find {𝑤 1, . . . , 𝑤𝑄 } ← MCP({® 𝑧 𝔳 : 𝔳 ∈ DB𝑁 }, 𝜏MCP ). (2) For each 𝑤𝑖 , construct a score oracle O𝑤𝑖 : X → R defined as O𝑤𝑖 (𝔟) := {® 𝑧 𝔟 ← (𝑢®𝑇𝔟 · 𝐿 −1 )𝑇 ; return ⟨® 𝑧 𝔟 , 𝑤𝑖 ⟩}, where 𝑑 for 𝔟 ∈ B. 𝑢®𝔟 = (API(𝔟, 𝔟𝑖 ))𝑖=1

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

rank-deficient because of highly correlated feature vectors among queried samples. To compensate for this, we clamp the eigenvalue of the score matrix to be larger than 𝜖 = 10−8 . In addition, to minimize the numerical error, we use the eigendecomposition of a symmetric matrix 𝑆; more precisely, we decompose 𝑆 = 𝑉 Σ𝑉 𝑇 and set 𝐿 = Σ1/2𝑉 𝑇 . We confirmed that the maximum error between 𝑆 and 𝐿𝑇 𝐿 is less than 10−7 in double precision. Unknown Dimensionality and Its Reduction. In practice, the adversary does not know the true feature dimensionality of the API. In particular, if the adversary uses a smaller dimensionality, say 𝑘 < 𝑑, then the information loss would occur from the Gram decomposition, and the strict isometry invariance property of net no longer holds5 . Nevertheless, we observe that a similar argument in Section 3.2 still holds, discovering the relationship between the found net and the facial images DB𝑃 used for constructing 𝑆. The key observation is that, if we consider the singular value decomposition of 𝐴 = 𝑈 Σ𝑉 𝑇 ∈ R𝑑 ×𝑘 for some 𝑘 < 𝑑, where 𝑈 ∈ R𝑑 ×𝑘 and Σ, 𝑉 ∈ R𝑘 ×𝑘 , then 𝐴𝑇 𝐴 ∈ R𝑘 ×𝑘 can be written as (Σ𝑉 𝑇 )𝑇 (Σ𝑉 𝑇 ). Note that Σ𝑉 𝑇 = 𝑈 𝑇 𝐴. Hence, if we apply Gram decomposition on 𝐴𝑇 𝐴, obtaining 𝐿 ∈ R𝑘 ×𝑘 such that 𝐴𝑇 𝐴 = 𝐿𝑇 𝐿, 𝐿 can be written as 𝑅𝑈 𝑇 𝐴 for some unitary matrix 𝑅 ∈ R𝑘 ×𝑘 . Such a decomposition satisfies the following properties6 . • For 𝑧 ∈ R𝑑 , 𝑅𝑈 𝑇 𝑧 = (𝑧𝑇 𝐴 · 𝐿 −1 )𝑇 . In particular, 𝑧𝑇 𝐴 = (𝑅𝑈 𝑇 𝑧)𝑇 𝐿.

Step 3. Recover Biometrics via a Score-based Attack (1) For each 𝑤𝑖 , recover 𝔟𝑖∗ ← SBAttack(O𝑤𝑖 (·), 𝑄 SB ) . (2) Return {𝔟1∗, . . . , 𝔟𝑄∗ }. Figure 3: Full Pipeline of the Proposed Attack

4

Implementation Techniques and Extensions

We present implementation-level details and extensions of the proposed net-based impersonation attack. First, we provide several details in our attack that we have postponed, including the rank deficiency of the score matrix 𝑆, handling unknown dimensionality of the templates, and the choice of the score-based attack. In addition, we extend our attack to identification scenarios where many identities are enrolled in the system.

4.1

Additional Techniques and Details

From Confidence Scores to Cosine Similarity. Many real-world API return confidence scores, and the adversary should convert them to cosine similarity values in order to conduct our attack. More formally, for 𝑥, 𝑦 ∈ X and an unknown confidence score function 𝑔 : X×X → [0, 1], the adversary needs to find an invertible function ℎ : R → [0, 1] such that ℎ(⟨𝑥, 𝑦⟩) = 𝑔(𝑥, 𝑦). To this end, recent studies [52, 53, 55] model ℎ as a logistic function, namely, ℎ(𝑠) = 𝐿 + 𝑏 for learnable parameters 𝐿, 𝑘, 𝑏, 𝑑 0 , and fit these 1+𝑒 −𝑘 · (𝑠 −𝑑0 ) parameters via the DOGBOX algorithm [88] with pairs of facial images from widely-used benchmark datasets, e.g., LFW [33, 76] or CFP-FP. As demonstrated by score-based attacks [52, 53], this method was enough for launching their attack on commercial APIs, e.g., Amazon Rekognition [1]. We directly use the numbers provided in the open-source implementation of Kim et al. [53]. Handling Rank Deficiency of 𝑆. Recall that our attack is welldefined only when 𝑆 has a full rank. However, in practice, 𝑆 is often

𝐴𝐴† 𝑦

𝑅𝑈 𝑇 𝑦

• For 𝑥, 𝑦 ∈ R𝑑 , ⟨𝑅𝑈 𝑇 𝑥, ∥𝑅𝑈 𝑇 𝑦 ∥ ⟩ = ⟨𝑥, ∥𝐴𝐴† 𝑦 ∥ ⟩, 2

2

where 𝐴† is the pseudoinverse of 𝐴. The former property tells us that the adversary can obtain feature vectors from the API transformed by 𝑅𝑈 𝑇 , analogous to rotated features in Section 3.2. On the other hand, the latter property implies that, when finding a net over the transformed set {𝑅𝑈 𝑇 · 𝐹𝑇 (𝔟) : 𝔟 ∈ DB𝑁 }, with a constraint that each clustered point {𝑧 1, . . . , 𝑧𝑄 } ⊂ R𝑘 has a norm of 1, then it maximizes (  ) 𝑄 Ø 𝐴𝐴†𝑦𝑖 ;𝜏 ; 𝑦𝑖 = 𝑈 𝑅𝑇 𝑧𝑖 . 𝔟 ∈ DB𝑁 : 𝐹𝑇 (𝔟) ∈ BX ∥𝐴𝐴†𝑦𝑖 ∥ 2 𝑖=1 That is, the found net lies in the column space of 𝐴, corresponding to the subspace spanned by DB𝑃 . In summary, even under dimensionality reduction, the adversary can still construct an effective net aligned with the template space of the API’s template extractor. Score-based Reconstruction Attack. The adversary should recover precise face images corresponding to the found net to reduce the error from the mismatch between templates and recovered faces. To this end, we utilize a score-based reconstruction attack by Kim et al. [53], which can be processed without adaptive score queries. In particular, thanks to non-adaptiveness, their attack can be seamlessly incorporated into our attack without requiring additional API queries, as we can reuse rotated templates from previous queries. Furthermore, we utilize a black-box optimization algorithm as a post-processing step, setting the reconstructed faces from Kim et al.’s attack as a starting point. More precisely, we apply natural evolution strategy (NES) [92], a widely adopted method in black-box adversarial attacks [10, 34]. We provide detailed explanations of Kim et al.’s attack and the NES postprocessing in Appendix B. 5We do not consider 𝑘 ≥ 𝑑 because there will be no information loss. 6We provide the detailed proofs in Appendix C.

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

4.2

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

Table 1: Description of FRSs and the local inverse model.

Extension to Face Identification Systems

Throughout the paper, we mainly considered the verification scenario, where only one identity is enrolled in the system. In contrast, face identification scenarios are also widely adopted in practical application scenarios of FRS deployments, where several identities are enrolled in the system, and for the given query, the system determines whether the corresponding identity is already enrolled in the system or not, such as the access control scenarios [81, 85]. The identification scenario for 1:N matching is also included in the NIST FRVT benchmark [69]. The standard evaluation metric analogous to FMR in this setting is false positive identification rate (FPIR) [35, 69], which is the probability that the system incorrectly determines an unauthorized identity as one of the enrolled ones. We can naturally extend our attack to analyze FRSs in these identification scenarios. The core idea is that we can view the matching test with each enrolled identity as checking whether it is covered by net or not. Analogous to Definition 1, let us consider the following search problem for the identification scenario: Definition 2. For the template extractor 𝐹 of FRS, let D be the distribution defined over X of templates extracted from 𝐹 . We consider the following search problem for i.i.d. samples 𝑡 1, . . . , 𝑡 𝑁 ← D: • [Instance] The template extractor 𝐹 , the threshold 𝜏 > 0, and integers 𝑄, 𝑁 ∈ N. • [Problem] Find a set {𝑡 1, . . . , 𝑡𝑄 } satisfying ∃𝑖 ∈ [𝑄], 𝑗 ∈ [𝑁 ] such that 𝑑 X (𝑧𝑖 , 𝑡 𝑗 ) < 𝜏. 𝑄

If we denote 𝜌 := Pr[𝑡 ∈ ∪𝑖=1 B X (𝑧𝑖 ; 𝜏) | 𝑡 ← D] for the found net {𝑧 1, . . . , 𝑧𝑄 } from Section 3.1, by the pairwise independence of 𝑡 1, . . . , 𝑡 𝑁 , we can deduce the following equality: Pr[∃𝑖 ∈ [𝑄], 𝑗 ∈ [𝑁 ] s.t. 𝑑 X (𝑧𝑖 , 𝑡 𝑗 ) < 𝜏] = 1 − (1 − 𝜌) 𝑁 .

(6)

This corresponds to the probability where at least one of the facial images corresponds to net wrongly identified as the enrolled member to the target system. Since 1 − 𝑥 ≤ 𝑒 −𝑥 , the L.H.S. of the above Eq. (6) is at least 1 − 𝑒 −𝑁 𝜌 . That is, once 𝜌 is obtained and the desired level of FPIR, say 𝜉, is given, then we can estimate the upper bound of the maximum number of identities handled by the 1 system as 𝑁 ≤ 𝜌 −1 ln( 1−𝜉 ).

Open-source FRS / Inverse Model Notation Architecture Loss 𝐹1 𝐹 1−1 𝐹2 𝐹3 𝐹4 𝐹A

Train Dataset Name

ResNet-100 ArcFace [16] Glint360k [5] NbNet-B Perceptual [61] MS1MV3 [17] ResNet-100 ElasticFace [9] MS1MV2 [16] IResNet-101 ArcFace [16] WebFace4m [97] Vit-KPRPE [51] AdaFace [50] WebFace12m [97] AWS CompareFaces API [1]

similarity score of every pair of images and select the threshold such that the proportion of pairs exceeding the threshold matches the target FMR. This procedure follows standard evaluation practices, e.g., NIST FRVT benchmark [69]. In addition, considering typical rate-limiting scenarios, we set the maximum number of authentication trials as 𝑄 = 5, 10, and 30. Throughout experiments, we evaluate the impersonation rate (IR) of the adversary by measuring the number of successful authentications via one of 𝑄 facial images chosen by the adversary. More precisely, if the adversary selects 𝑄 facial images {𝔳1, . . . , 𝔳𝑄 }, for target face dataset {𝔟1, . . . , 𝔟𝑛 } and the decision threshold 𝜏 of the target FRS 𝐹𝑇 , we measure |{𝔟𝑖 : ∃𝑗 s.t. ⟨𝐹𝑇 (𝔟𝑖 ), 𝐹𝑇 (𝔳 𝑗 )⟩ > 𝜏 }| . 𝑛 As a baseline, we consider the zero-effort impostor, as prior studies have shown that no existing MasterFaces-based attacks showed better impersonation rate than such an adversary under our threat model [25, 67, 83]. This adversary randomly samples 𝑄 facial images from the public facial dataset DB. Note that, in this case, the upper bound of the impersonation rate can be roughly estimated by 𝑄 · FMR(𝜏), where FMR(𝜏) is the FMR of the target FRS at the threshold 𝜏. Hence, we report both the exact IR and its estimation from the baseline adversary. IR :=

Evaluation Criteria and Baseline Setup. To reflect realistic operational parameters of FRS deployments, we consider the following FMR levels: 10−3 , 10−4 , and 10−5 . For each FRS, we determine the decision threshold for each FMR level as follows: given a dataset consisting of facial images from distinct identities, we compute the

Face Datasets and Target FRSs. We select various open-source and commercial FRSs as targets. For open-source models, we adopt recent sophisticated FRS, including ElasticFace [9] (𝐹 2 ), ArcFace [16] (𝐹 3 ), and AdaFace [50] (𝐹 4 ). Their implementations and pre-trained parameters are all publicly available; for ElasticFace, we refer to their GitHub repository8 , and we utilize insightface [31] and CVLFace [49] libraries for ArcFace and AdaFace, respectively. On the other hand, for the commercial API, we select the CompareFaces API [1], a part of the Amazon Rekognition API that provides the confidence score between 0 and 100 for a pair of queried faces. We note that, to instantiate Kim et al.’s attack [53], the adversary needs to select its own FRS (𝐹 1 ), along with its inverse model (𝐹 1−1 ). We select such an FRS from insightface, ensuring that at least two of the architecture, loss, and dataset are different from the target FRSs 𝐹 2 –𝐹 4 . We use the NbNet [61] as an inverse model, following Kim et al. [53]. We summarize these target FRSs in Table 1. When constructing a net (DB𝑁 ), we use a subset of the MS1MV3 dataset [18] by sampling the first image over 93,431 identities in total. For the facial images corresponding to those of the target enrolled identities, we select two datasets: LFW [33] and CASIAWebFace [93]. More precisely, for LFW, we use the faces in their verification suite, excluding redundant images. For CASIA-WebFace,

7 https://zenodo.org/records/20765343

8 https://github.com/fdbtrs/ElasticFace

5

Experimental Results

We present experimental results of the proposed attack. All the source code is written in PyTorch and NumPy. For reproducibility, we publicly release our source code7 . Given the potential for misuse, we deliberately release only a minimal yet essential part of our attack pipeline, including the MCP solver, score-based attack pipeline, and the overall attack pipeline. The released implementation is not sufficient for directly attacking real-world FRSs, and we did not attempt to conduct the attack against real-world deployments.

5.1

Experimental Settings

Casting the Net! Revisiting MasterFace Impersonation Attacks

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Table 2: IR (%) results on 𝐹 2 at various FMR levels. For Ours, the second row in each cell, highlighted as bold, indicates the improvement factor over the baseline.

Table 3: IR (%) results on 𝐹 A at various FMR levels. For Ours, the second row in each cell, highlighted as bold, indicates the improvement factor over the baseline.

Target Dataset 𝑄

Method 𝑄 · FMR Baseline

5 Ours 𝑄 · FMR Baseline 10 Ours 𝑄 · FMR Baseline 30 Ours

10−3

LFW 10−4

10−5

10−3

0.5 0.522 2.743 ×5.25 1 1.041 4.741 ×4.55 3 3.090 12.13 ×3.92

0.05 0.054 0.441 ×8.17 0.1 0.109 0.550 ×5.05 0.3 0.325 1.685 ×5.18

0.005 0.008 0.076 ×9.50 0.01 0.017 0.049 ×2.88 0.03 0.050 0.211 ×4.22

0.5 0.514 2.936 ×5.71 1 1.025 5.210 ×5.08 3 3.042 12.52 ×4.12

Target Dataset CASIA-WebFace 10−4 10−5 0.05 0.055 0.445 ×8.09 0.1 0.111 0.788 ×7.10 0.3 0.331 2.197 ×6.64

0.005 0.010 0.040 ×4.00 0.01 0.021 0.112 ×5.33 0.03 0.062 0.285 ×4.60

we select the first image of each identity, hence 10,572 images in total. For DB𝑃 , we use the facial images from the inverse model output of PCA components of the WebFace42M dataset [97]. We provide the detailed specifications of target FRSs and face datasets, including the measured thresholds of target FRSs for each FMR level, in Appendix A. Instantiation of Our Attack. As we mentioned in Section 4.1, we utilize score-based attacks to recover faces corresponding to net. We utilize Kim et al.’s attack [53] based on their official implementation9 , and we manually implement a latent space search variant of NES. We provide the detailed pseudocodes for each attack algorithm and detailed parameter settings in Appendix B. Recall that our MCP solver is comprised of a combination of the K-Means and greedy algorithms. To implement the K-Means, we use the faiss library [22] with GPU acceleration10 , finding 𝜅𝑄 candidates of net for some multiplier 𝜅 > 1. After that, we apply the greedy search to obtain 𝑄 centers whose 𝜏MCP -neighborhoods maximally cover the given dataset. Detailed pseudocode of the MCP solver is provided in Appendix D.

5.2

Attack Evaluation Results

We present the IR results according to the settings mentioned above. For the hyperparameters, 𝜏MCP and 𝜅, we use the values that yield the best IR results, as described in the following paragraphs. Open-Source FRS. We first report IR results from our attack compared with the baseline. We use the Gram decomposition dimension 𝑘 = 400, and enable the NES postprocessing. We empirically found that 𝜏MCP = 0.2 and 𝜅 = 10 shows the best results. Due to space constraints, we only provide the IR results for 𝐹 2 ; the other opensource FRSs (𝐹 3 , 𝐹 4 ) show a similar trend as 𝐹 2 , and we provide the full experimental results in Appendix A. The results are provided in Table 2. From this table, we can observe that ours consistently achieves higher IRs across all the settings we considered, compared to those from the baseline and estimated from the FMR. More precisely, when FMR is 10−3 , 10−4 , and 10−5 , ours achieve 3.92×–5.71×, 5.05×–8.17×, and 2.88×–9.50× improvements, respectively, compared to the baseline. Notably, we can observe that the relative IR increases for relatively small

𝑄

Method 𝑄 · FMR Baseline

5 Ours 𝑄 · FMR Baseline 10 Ours 𝑄 · FMR Baseline 30 Ours

10−3

LFW 10−4

10−5

10−3

0.5 0.493 1.365 ×2.77 1 0.984 2.219 ×2.26 3 2.920 5.218 ×1.79

0.05 0.049 0.143 ×2.92 0.1 0.098 0.199 ×2.03 0.3 0.294 0.817 ×2.78

0.005 0.007 0.046 ×6.57 0.01 0.014 0.059 ×4.21 0.03 0.041 0.114 ×2.78

0.5 0.558 1.764 ×3.16 1 1.111 3.097 ×2.79 3 3.290 7.441 ×2.26

0.05 0.055 0.158 ×2.87 0.1 0.111 0.328 ×2.95 0.3 0.332 1.039 ×3.13

0.005 0.008 0.014 ×1.75 0.01 0.015 0.051 ×3.40 0.03 0.045 0.153 ×3.40

query budgets 𝑄 = 5, 10 and strict FMR levels 10−4, 10−5 , while the baseline shows almost similar results as those estimated from 𝑄 · FMR. These results indicate that our attack becomes far more effective under realistic yet restrictive operational settings. AWS CompareFace API. Before reporting the IR results, we briefly summarize the pricing policy of AWS Recognition API11 . For each query or image enrollment, AWS CompareFace charges $0.001 per API call. As described in Section 3.3, the adversary needs to query 𝑘 (𝑘 −1) + 𝑘 · |DB𝑁 | pairs of facial images to construct a net, where 2 𝑘 is the dimension of the rotated templates obtained from the Gram decomposition. AWS CompareFace supports batched score queries up to 4,096 images at the same cost as a single query. This allows 𝑁| reducing the total query cost to (𝑘 − 1) + 𝑘 · |DB 4096 , in addition to enrolling 𝑘 + |DB𝑁 | facial images. Based on the pricing policy above, we select 𝑘 = 200 and turn off the NES postprocessing, although NES could improve the attack performance. Under this setting, the total API cost for obtaining all rotated templates is approximately $100. We do not apply NES post-processing due to the budget constraint; enabling this step would like further improve the IR. Importantly, the cost of $100 is incurred only once; after the rotated features are obtained, the adversary can construct the net locally using the MCP solver for arbitrary authentication trial budgets, without further API queries. We conduct our attack with hyperparameters 𝜏MCP = 0.3 and 𝜅 = 10, and the results are provided in Table 3. Consistent with the behavior of open-source FRSs, the IRs from our attack consistently exceed those from the baseline, and the gap increases for small authentication trial budgets and strict FMR levels. We observe that the IR gain from attacking AWS CompareFace is smaller than that observed for open-source FRSs, achieving 1.75×–6.57× across the experimental settings. We attribute this phenomenon to the approximation error introduced by converting confidence scores to cosine similarities; the exact relationship between them is unknown in public. Nevertheless, the adversary may further improve the FMR via additional API queries and NES-based postprocessing. Implication on Identification Scenarios. As discussed in Section 4.2, our attack can be naturally extended to identification scenarios. For the IR value 𝜌 at a verification threshold 𝜏, the FPIR

9 https://github.com/Cryptology-Algorithm-Lab/Scores_Tell_Everything_about_Bob 10 https://github.com/facebookresearch/faiss

CASIA-WebFace 10−4 10−5

11 https://aws.amazon.com/rekognition/pricing/

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

Table 4: IRs (%) against FRSs 𝐹 1 –𝐹 4 and 𝐹 A from the adversary exploiting MasterFaces crafted from 𝐹 1 . Target Dataset 𝑄 𝐹𝑇 LFW CASIA-WebFace 10−3 10−4 10−5 10−3 10−4 10−5

5

10

30

𝐹1 𝐹2 𝐹3 𝐹4 𝐹A 𝐹1 𝐹2 𝐹3 𝐹4 𝐹A 𝐹1 𝐹2 𝐹3 𝐹4 𝐹A

1.929 1.042 1.351 0.875 0.429 5.055 3.344 4.270 2.662 1.247 11.81 7.897 9.029 7.460 3.685

0.322 0.090 0.180 0.090 0.039 0.733 0.347 0.733 0.270 0.091 2.071 1.183 1.415 1.080 0.468

0.013 0 0 0.026 0 0.154 0.013 0.090 0.051 0.026 0.257 0.206 0.180 0.193 0.065

2.766 1.506 1.478 1.288 1.097 6.924 3.628 5.001 3.561 1.750 15.34 9.945 11.78 8.591 5.032

0.369 0.171 0.256 0.180 0.189 1.250 0.673 1.099 0.616 0.265 3.021 1.639 1.856 1.658 0.568

0.038 0.019 0.038 0.019 0.009 0.218 0.161 0.123 0.066 0.047 0.417 0.284 0.322 0.189 0.057

among 𝑁 enrolled identities can be estimated by 1 − (1 − 𝜌) 𝑁 ≈ 1 − 𝑒 −𝜌𝑁 . This relationship implies that the maximum number of identities safely handled by the system is inversely proportional to 𝜌. Accordingly, the results in Table 2 and 3 can be interpreted as the 𝜌 values at different thresholds and FMR levels, which directly determine the system’s vulnerability in identification deployments.

5.3

Ablation Study

We present ablation studies on the core components of our attack, including the comparison of IRs from MasterFaces generated from a white-box surrogate model and the Gram decomposition dimension according to our analysis in Section 4.1. Effect of Leveraging API Queries. To quantify the IR gains from the exposition of API queries, we measure the IRs from the adversary who directly crafts MasterFaces on its surrogate model and uses them for conducting an impersonation attack against the target FRSs. We set 𝐹 1 as the surrogate model, attacking the remaining FRSs as targets. In addition, we also report the IR for attacking 𝐹 1 itself, which corresponds to the white-box attack scenario, i.e., the adversary has full knowledge of the target FRS’s template extractor. The results are provided in Table 4. When conducting the attack against 𝐹 2 –𝐹 4 and 𝐹 A , the MasterFaces from 𝐹 1 show IR values in the middle between those of the baseline and our attack. On the other hand, the IR values from attacking the same 𝐹 1 serve as the upper bound of the IRs achieved by our attack, as this setting corresponds to the white-box attack. This indicates that the Gram decomposition technique indeed contributes to crafting API-tailored net. Effect of Gram Decomposition Dimensionality. As discussed in Section 4.1, the dimensionality for the Gram decomposition determines the solution space of the net in analogy with PCAbased dimensionality reduction. Increasing the dimension enlarges the solution space where the net can lie, thereby resulting in more coverage over the template space by the constructed net. To examine this, we sweep the decomposition dimension from 100

Figure 4: IRs (%) with various Gram decomposition dimensionality. The colored area depicts the difference in IRs (%) incurred by the NES postprocessing, and the error bars indicate the standard deviation. to 450 and evaluate the IR values from our attack with the NES postprocessing. We fixed 𝜏MCP = 0.2 and 𝜅 = 10, and set 𝑄 = 5 and the FMR as 10−4 . Since the NES is disabled when attacking 𝐹 A , we report the results from 𝐹 1 –𝐹 4 only. To account for the randomness of the NES, we report the mean IR over 30 independent runs, with error bars indicating the standard deviation. The results are visualized in Fig. 4. As the dimension grows, we can observe that the IRs from our attack with NES postprocessing improve while those from turning off NES remain largely unchanged. This behavior arises because Kim et al.’s reconstruction attack recovers faces from templates that lie in some low-dimensional subspace (see Appendix B for a detailed explanation). Consequently, although increasing the Gram decomposition dimension broadens the solution space for net, the reconstructed faces themselves remain confined to the same subspace. NES postprocessing bridges this mismatch by adapting the reconstructed faces to the expanded solution space.

5.4

What Do Our MasterFaces Look Like?

We discuss MasterFaces crafted from our attack, providing their visualizations and the faces they cover. Visualization of MasterFaces. In our attack, the visual quality of the MasterFaces depends on the score-based reconstruction attack subroutine. The NbNet used by Kim et al.’s attack [53] reconstructs faces of 128×128 resolution. Since their attack can be combined with other inverse models, we also provide the visualization results from replacing the NbNet with Arc2Face [72] that produces 512 × 512 resolution face images. Fig. 5 shows MasterFaces obtained from attacking AWS CompareFace API (𝐹 A ). Which Faces are Covered by MasterFaces? Surprisingly, although the reconstructed MasterFaces in Fig. 5 appear as faces of white males in the pixel space, they successfully cover target faces across diverse demographic groups. In Fig. 6, we visualize the covered facial images by MasterFaces in Fig. 5 on 𝐹 A when the FMR is set to 10−4 . From this figure, we observe that MasterFaces, despite their white male appearance, cover faces from a wide range of demographic groups, including females and non-white individuals. This observation is seemingly counterintuitive, but it highlights

Casting the Net! Revisiting MasterFace Impersonation Attacks

Figure 5: MasterFaces from our attack against 𝐹 A with NbNet (top) and Arc2Face (bottom). We set 𝑄 = 5.

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

former enables finding the maximum coverage of the known template distribution, while the latter provides such a distribution from the API’s template extractor through queries. From this viewpoint, one possible countermeasure to our attack is to interrupt the latter phase, e.g., add random noise to the query response. This significantly hinders the adversary’s capability to construct an accurate net, which is sensitive to even small distribution shifts. This effect is further supported by our experimental observations: when attacking commercial APIs, the error derived from converting the confidence score to the cosine similarity makes it challenging to construct a net. We expect that differential privacy techniques on hyperspheres, e.g., directional differential privacy mechanism [91], may provide a principled framework for formalizing and quantifying the effectiveness of such defenses in terms of the resulting quality of the net. We leave such an investigation as future work. Physical Realization of Our Attack. When attacking real-world FRSs, the adversary may need to physically present facial images to the camera, e.g., 2D printing or 3D masks [4, 58, 79]. Nevertheless, we evaluated the digital MasterFaces produced from the proposed attack, as our main focus was to investigate and exploit the nonuniformity of face templates through API queries. This is also the reason why we report FMR, which characterizes matcher-level behavior, instead of the false acceptance rate that incorporates system-level failures. Specifically, the above-mentioned realization strongly depends on how to craft physical faces, which lies in the realm of face spoofing, and thus is orthogonal to our approach. We leave assessing the vulnerability of real-world systems against our attack with spoofing as an important future direction.

Figure 6: Faces covered by MasterFace against AWS at an FMR of 10−4 in Fig. 5, sampled from LFW and CASIA-WebFace. Each number represents the corresponding MasterFace. that the effectiveness of MasterFaces is governed by their coverage over the template space rather than the pixel space. This behavior is consistent with the net-based formulation of our attack, which explicitly targets non-uniformity in the template space. In fact, this behavior is a direct consequence of the intrinsic properties of Kim et al.’s attack. Recent studies [52, 56] have demonstrated that facial images of the same attributes, e.g., race or gender, form a subspace over the template space. Kim et al.’s attack finds a projection of the target template onto the subspace spanned by the queried faces, which is DB𝑃 in our attack instantiation. The selected facial images to launch Kim et al.’s attack correspond to the PCA components of WebFace42M [97], a large-scale web-crawled face dataset. More generally, web-scraped face datasets have been widely reported to exhibit demographic imbalances, often favoring white and male subjects [29, 90]. Hence, the recovered faces from Kim et al.’s attack are likely to be the projection of the ground truth net onto the subspace correlated to the faces of white males.

6

Discussion

Potential Countermeasure. We first recall that our attack consists of two core ingredients: net and Gram decomposition. The

Applicability to Other Biometric Modalities. Along with faces, various biometric traits have been widely used for authentication, e.g., fingerprints, voices, and irises, with various template representations. Since rotation is still an isometry over the Euclidean space with ℓ2 distance, our pipeline is still applicable when the distance between templates is calculated over such a space. Furthermore, our attack can even be extended to the Hamming distance with the following idea: for 𝑑-dimensional binary vectors 𝑥, 𝑦 ∈ {0, 1}𝑑 , let us ˆ 𝑦ˆ ∈ {− √1 , √1 }𝑑 by mapping 0 ↦→ − √1 encode them to vectors 𝑥, 𝑑

𝑑

𝑑

and 1 ↦→ √1 for each component. Then ∥b 𝑥 ∥ 2 = ∥b 𝑦 ∥ 2 = 1 and 𝑑 ˆ 𝑦⟩ ˆ 1−⟨𝑥,

HD(𝑥, 𝑦) = 𝑑 · 2 holds, where HD denotes the Hamming distance. As a result, we can recover the cosine similarity between encoded features from the Hamming distance score queries. Thus, with appropriate score-based attacks, our attack can be applied to biometric modalities using Euclidean or Hamming distances as a distance metric, including iris recognition based on IrisCode [15] or deep learning-based speaker recognition [42]. Connection with Intrinsic Entropy of Biometrics. Conceptually, FMR is linked to the intrinsic entropy of the biometric traits, which the template extractor aims to capture. From an informationtheoretic perspective, fuzzy extractors [20] formalize this connection by relating intrinsic entropy to statistical security guarantees, quantifying how many bits of nearly uniform randomness can be extracted from some random source. In particular, fuzzy min entropy [27] refines this idea by measuring this entropy as the probability mass of a metric ball, which is closely related to the FMR.

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Capturing such non-uniformity yields a non-negligible FMR, as opposed to the fact that spherical caps occupy negligible area over the high-dimensional hypersphere. Our net-based attack can be viewed as drawing a multi-query analogy of fuzzy min entropy, in the sense that net corresponds to the metric balls whose union concentrates a large probability mass under the template distribution. Notably, our experimental results suggest that such a construction captures non-trivial structure beyond that implied by fuzzy min entropy alone, as evidenced by attack success rates exceeding FMR. This observation points to a potential connection between net and existing impossibility results in fuzzy extractors based on fuzzy min entropy [26, 27]. We believe that this viewpoint would deepen our understanding of the intrinsic entropy of biometrics, leaving its formal investigation as an interesting direction for future work.

7

Related Work

We survey existing attacks against FRSs in terms of adversarial goals and capabilities, highlighting why their adversarial settings do not align with the target scenarios considered in this work. Adversarial Attacks. Adversarial attacks aim to maliciously modify the input to induce the machine learning model to make wrong decisions. Such a modified input is referred to as an adversarial example. In particular, adversarial attacks against FRSs have been actively studied, targeting commercial APIs. Some studies focused on crafting adversarial examples by leveraging the score [52] or decision [11, 21, 96] results of two submitted biometric samples. Some attacks require direct score queries to the enrolled identity [10, 23, 79], utilizing zeroth-order optimization algorithms to find adversarial examples. Another line of work [41, 57, 74] utilizes surrogate models, relying on the transferability of adversarial examples. However, these attacks require that the adversary can either (i) choose which biometric sample to be enrolled [21, 41, 52, 57, 74, 96] or (ii) obtain a similarity score between enrolled and queried samples [10, 23]. Although their adversarial models are well-justified and considered feasible in various scenarios, e.g., generating fraudulent identities for romance scams [52], from the perspective of impersonation attacks, their strong adversarial capabilities are not applicable in practical impersonation scenarios. Reconstruction Attacks. Reconstruction attacks focus on extracting the biometric characteristics of the enrolled identity through interactions with the target FRS. Some methods model the attack as an optimization problem where the adversary can directly obtain the scores between the enrolled identity and queried samples in the target FRS. To address this, several attack methods aim to design corresponding solvers, such as the hill-climbing algorithm [43, 73, 87], or utilize the geometric structure of the template space [53]. In contrast, some attacks tried to directly train a neural network that reconstructs the face corresponding to the input template, assuming that the adversary can query faces to obtain the corresponding template extracted from the target FRS [24, 60, 61, 78]. Afterwards, if the adversary compromises the target FRS’s database to obtain the target template, such as via a data breach, the adversary can reconstruct the target identity’s face. In our attack, we can leverage score-based attacks to recover faces corresponding to net. Remark that we utilized the Kim et

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

al. [53] attack as a sub-routine to find an initial point of the subsequent score-based attack that utilizes a latent space search algorithm [43, 87]. However, similar to adversarial attacks, these attacks per se are not applicable in our threat model as they require powerful adversarial capabilities, e.g., direct score or template queries, or require obtaining the target template stored in the target FRS. Morphing Attack and MasterFaces. Morphing attacks [12, 13] and Wolf attacks [71, 86] aim to construct biometric samples that are accepted as two or more distinct identities. MasterFaces [25, 67, 68, 80, 83] instantiate the Wolf attack paradigm in the face recognition domain. Such faces effectively act as a backdoor in the target FRS; once enrolled, all identities contributed to crafting such faces can be successfully authenticated. However, from the perspective of impersonation attacks, these attacks are not directly applicable, as they do not target a victim identity enrolled in the target system. Several studies have explored the use of MasterFaces for impersonation, from the intuition that they are more plausible to impersonate the target identity than randomly sampled faces. However, as we summarized in Section 3, these attacks are ineffective against modern FRSs due to their heavy reliance on the template extraction pipeline and suboptimality of their algorithm, and thus they are believed not to pose a serious threat against modern FRSs. The proposed attack shares the same intuition as MasterFaces, but overcomes their limitations by introducing a new net-based formulation and Gram decomposition technique that enables the adversary to effectively exploit API queries legitimately. From this perspective, our method repositions MasterFace impersonation attacks as a potential security threat when the adversary can purchase and utilize pay-as-you-go commercial API services. Other Related Attacks. Alongside the above classes of attacks, other attacks also reveal various vulnerabilities of the target FRS. Some studies attempted to directly launch an impersonation attack through a hill-climbing algorithm via score queries [4, 28, 40, 62]. Likewise, score-based attacks in adversarial and reconstruction attacks, their adversarial assumptions do not align with the practical constraints. Mimicry attacks or replay attacks have also been considered [48, 54, 94], which submit the recorded biometric signals of the enrolled users, exploiting physical or sensor-level vulnerabilities. Takeaway. While several attacks against FRSs have been proposed from various approaches and attack surfaces, under the threat model where highly restricted forms of interactions with the target FRS are permitted, most of these attacks become inapplicable or fail to achieve a non-trivial impersonation rate. This is the reason why the zero-effort impostor remains a standalone baseline; in contrast, our attack demonstrates that the adversary can surpass this barrier by purchasing a publicly disclosed commercial API.

8

Conclusion

This work demonstrates that an adversary’s legitimate API queries enable a non-trivial impersonation attack beyond the zero-effort impostor baseline, even under a realistic-yet-constrained threat model in which almost all existing attack techniques are inapplicable. This result is enabled by our two core ingredients: net-based formulation and Gram decomposition technique, which effectively overcome the limitations of MasterFaces-based attacks, and thus

Casting the Net! Revisiting MasterFace Impersonation Attacks

revive them as a potential security threat against real-world FRS deployments. Specifically, we expect that our Gram decomposition technique will serve as a useful tool for discovering other types of vulnerabilities where the adversary aims to extract non-trivial information about the unknown FRS itself through interactions, such as membership inference or model extraction attacks. We believe that our findings open new directions for assessing the security risks associated with the public disclosure of commercial APIs.

Ethical Statement We attest that we thoroughly read the ethics discussions in the conference call for papers, the detailed submission instructions, and the ethics guidelines. We attest that the research team considered the ethics of this research, that the authors believe the research was done ethically, and that the team’s next step plans are ethical. More precisely, we utilized public benchmark datasets for experiments; no private or sensitive data was collected by the authors. We provide details about the public datasets we used, including (i) how each dataset was collected, (ii) how each dataset was processed for evaluation, and (iii) how to obtain these datasets. Since only public data were used, IRB approval was not required. We attest that we discovered and investigated the proposed attack for research only, and do not conduct an actual attack against real-world systems. To mitigate potential misuse, we will release only the minimal code necessary for reproducing results.

Open Sciences We provide the source code through the Zenodo archive: https: //zenodo.org/records/20765343. Given the potential societal harm, we only provide the minimal attack pipeline enough to validate the correctness, and the released implementation is not sufficient for directly attacking real-world systems. We also note that our artifact contains how to obtain real-world datasets and open-source FRSs we used during the experiments, each of which is publicly available.

Acknowledgments We thank the anonymous reviewers for their helpful comments and feedback. This work was supported in part by the Institute of Information and Communications Technology Planning and Evaluation (IITP), grant funded by the Korea Government (MSIT) (RS-2021-II210727), and the Culture, Sports and Tourism Research and Development Program through Korea Creative Content Agency Grant funded by the Ministry of Culture, Sports and Tourism, under Grant RS-2024-00332210.

References [1] [n. d.]. Amazon Rekognition. https://aws.amazon.com/rekognition/ Accessed: 2025-09-12. [2] [n. d.]. Tencent Cloud. https://www.tencentcloud.com/ Accessed: 2025-09-12. [3] FIDO Alliance. [n. d.]. FIDO. https://fidoalliance.org Accessed: 2025-09-12. [4] Shengwei An, Yuan Yao, Qiuling Xu, Shiqing Ma, Guanhong Tao, Siyuan Cheng, Kaiyuan Zhang, Yingqi Liu, Guangyu Shen, Ian Kelk, et al. 2023. Imu: Physical impersonating attack for face recognition system with natural style changes. In S&P. IEEE, 899–916. [5] Xiang An, Xuhan Zhu, Yuan Gao, Yang Xiao, Yongle Zhao, Ziyong Feng, Lan Wu, Bin Qin, Ming Zhang, Debing Zhang, et al. 2021. Partial fc: Training 10 million identities on a single machine. In ICCV. 1445–1449. [6] Pia Bauspieß, Tjerand Silde, Matej Poljuha, Alexandre Tullot, Anamaria Costache, Christian Rathgeb, Jascha Kolberg, and Christoph Busch. 2024. BRAKE: Biometric resilient authenticated key exchange. IEEE Access 12 (2024), 46596–46615.

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

[7] Piotr Bojanowski, Armand Joulin, David Lopez-Pas, and Arthur Szlam. 2018. Optimizing the Latent Space of Generative Networks. In ICML. PMLR, 600–609. [8] Alexandra Boldyreva, Deep Inder Mohan, and Tianxin Tang. 2025. May the Force Not Be With You: Brute-Force Resistant Biometric Authentication and Key Reconstruction. In ACM CCS. 3620–3634. [9] Fadi Boutros, Naser Damer, Florian Kirchbuchner, and Arjan Kuijper. 2022. Elasticface: Elastic margin loss for deep face recognition. In CVPRW. 1578–1587. [10] Guangke Chen, Sen Chenb, Lingling Fan, Xiaoning Du, Zhe Zhao, Fu Song, and Yang Liu. 2021. Who is real bob? adversarial attacks on speaker recognition systems. In S&P. IEEE, 694–711. [11] Weilun Chen, Zhaoxiang Zhang, Xiaolin Hu, and Baoyuan Wu. 2020. Boosting decision-based black-box adversarial attacks with random sign flip. In ECCV. Springer, 276–293. [12] Laurent Colbois, Hatef Otroshi Shahreza, and Sébastien Marcel. 2023. Approximating optimal morphing attacks using template inversion. In IJCB. IEEE, 1–9. [13] Naser Damer, Alexandra Mosegui Saladie, Andreas Braun, and Arjan Kuijper. 2018. Morgan: Recognition vulnerability and attack detectability of face morphing attacks created by generative adversarial network. In 2018 IEEE 9th international conference on biometrics theory, applications and systems (BTAS). IEEE, 1–10. [14] Jun Dan, Yang Liu, Jiankang Deng, Haoyu Xie, Siyuan Li, Baigui Sun, and Shan Luo. 2024. Topofr: A closer look at topology alignment on face recognition. NeurIPS 37 (2024), 37213–37240. [15] John Daugman. 2009. How iris recognition works. In The essential guide to image processing. Elsevier, 715–739. [16] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. 2019. Arcface: Additive angular margin loss for deep face recognition. In CVPR. 4690–4699. [17] Jiankang Deng, Jia Guo, Debing Zhang, Yafeng Deng, Xiangju Lu, and Song Shi. 2019. Lightweight Face Recognition Challenge. In ICCV Workshops. IEEE, 2638–2646. doi:10.1109/ICCVW.2019.00322 [18] Jiankang Deng, Jia Guo, Yuxiang Zhou, Jinke Yu, Irene Kotsia, and Stefanos Zafeiriou. 2019. RetinaFace: Single-stage Dense Face Localisation in the Wild. arXiv preprint arXiv:1905.00641 (2019). [19] Inderjit S Dhillon and Dharmendra S Modha. 2001. Concept decompositions for large sparse text data using clustering. Machine learning 42, 1 (2001), 143–175. [20] Yevgeniy Dodis, Leonid Reyzin, and Adam Smith. 2004. Fuzzy extractors: How to generate strong keys from biometrics and other noisy data. In EUROCRYPT. Springer, 523–540. [21] Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. 2019. Efficient decision-based black-box adversarial attacks on face recognition. In CVPR. 7714–7722. [22] Matthijs Douze, Alexandr Guzhva, Chengqi Deng, Jeff Johnson, Gergely Szilvasy, Pierre-Emmanuel Mazaré, Maria Lomeli, Lucas Hosseini, and Hervé Jégou. 2025. The faiss library. IEEE Transactions on Big Data (2025). [23] Tianyu Du, Shouling Ji, Jinfeng Li, Qinchen Gu, Ting Wang, and Raheem Beyah. 2020. Sirenattack: Generating adversarial audio for end-to-end acoustic systems. In ACM CCS. 357–369. [24] Chi Nhan Duong, Thanh-Dat Truong, Khoa Luu, Kha Gia Quach, Hung Bui, and Kaushik Roy. 2020. Vec2face: Unveil human faces from their blackbox features in face recognition. In CVPR. 6132–6141. [25] Tomer Friedlander, Ron Shmelkin, and Lior Wolf. 2022. Generating 2-D and 3-D Master Faces for Dictionary Attacks With a Network-Assisted Latent Space Evolution. IEEE TBIOM 5, 3 (2022), 385–399. [26] Benjamin Fuller. 2024. Impossibility of efficient information-theoretic fuzzy extraction. Designs, Codes and Cryptography 92, 7 (2024), 1983–2009. [27] Benjamin Fuller, Leonid Reyzin, and Adam Smith. 2016. When Are Fuzzy Extractors Possible?. In ASIACRYPT. Springer, 277–306. [28] Javier Galbally, Chris McCool, Julian Fierrez, Sebastien Marcel, and Javier OrtegaGarcia. 2010. On the vulnerability of face verification systems to hill-climbing attacks. Pattern Recognition 43, 3 (2010), 1027–1038. [29] Patrick Grother, Mei Ngan, and Kayee Hanaoka. 2019. Face recognition vendor test (fvrt): Part 3, demographic effects. National Institute of Standards and Technology Gaithersburg, MD. [30] Patrick Grother, Wayne Salamon, Ramaswamy Chandramouli, et al. 2013. Biometric specifications for personal identity verification. NIST Special Publication 800 (2013), 76–2. [31] Jia Guo, Jiangkang Deng, Xiang An, Jack Yu, and Baris Gecer. [n. d.]. InsightFace: 2D and 3D Face Analysis Project. https://github.com/deepinsight/insightface accessed: 2026-01-14. [32] Nikolaus Hansen, Sibylle D Müller, and Petros Koumoutsakos. 2003. Reducing the time complexity of the derandomized evolution strategy with covariance matrix adaptation (CMA-ES). Evolutionary computation 11, 1 (2003), 1–18. [33] Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller. 2008. Labeled faces in the wild: A database for Studying face recognition in unconstrained environments. In ECCVW. [34] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box adversarial attacks with limited queries and information. In ICML. PMLR, 2137– 2146.

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

[35] ISO. 2021. ISO/IEC 19795-1:2021. Information technology–biometric performance testing and reporting–Part 1: principles and framework. [36] ISO. 2022. ISO/IEC 24745:2022. Information security, cybersecurity and privacy protection–Biometric information protection. [37] ISO. 2023. ISO/IEC 30107-1:2023. Information technology–Biometric presentation attack detection–Part 1: Framework. [38] ISO. 2024. ISO/IEC 24741:2024. Information technology–Biometrics–Overview and application. [39] ISO. 2025. ISO/IEC 19792:2025. Information security, cybersecurity and privacy protection–General principles, requirements and guidance for security evaluation of biometric systems. [40] Bora Jeong, Sunpill Kim, Seunghun Paik, and Jae Hong Seo. 2022. Analysis on Secure Triplet Loss. IEEE Access 10 (2022), 124355–124362. [41] Shuai Jia, Bangjie Yin, Taiping Yao, Shouhong Ding, Chunhua Shen, Xiaokang Yang, and Chao Ma. 2022. Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition. NeurIPS 35 (2022), 34136–34147. [42] Jee-weon Jung, You Jin Kim, Hee-Soo Heo, Bong-Jin Lee, Youngki Kwon, and Joon Son Chung. 2022. Pushing the limits of raw waveform speaker recognition. Interspeech (2022). [43] Yoon Gyo Jung, Jaewoo Park, Xingbo Dong, Hojin Park, Andrew Beng Jin Teoh, and Octavia Camps. 2024. Face Reconstruction Transfer Attack as Out-ofDistribution Generalization. In ECCV. Springer, 396–413. [44] Kimmo Karkkainen and Jungseock Joo. 2021. Fairface: Face attribute dataset for balanced race, gender, and age for bias measurement and mitigation. In WACV. 1548–1558. [45] Tero Karras, Samuli Laine, and Timo Aila. 2019. A style-based generator architecture for generative adversarial networks. In CVPR. 4401–4410. [46] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. 2020. Analyzing and improving the image quality of stylegan. In CVPR. 8110–8119. [47] Shuichi Katsumata, Takahiro Matsuda, Wataru Nakamura, Kazuma Ohara, and Kenta Takahashi. 2021. Revisiting fuzzy signatures: Towards a more risk-free cryptographic authentication system based on biometrics. In ACM CCS. 2046– 2065. [48] Hassan Khan, Urs Hengartner, and Daniel Vogel. 2020. Mimicry attacks on smartphone keystroke authentication. ACM TOPS 23, 1 (2020), 1–34. [49] Minchul Kim. [n. d.]. CVLFace: High-Performance Face Recognition All-in-One Toolkit. https://github.com/mk-minchul/CVLface accessed: 2026-01-14. [50] Minchul Kim, Anil K Jain, and Xiaoming Liu. 2022. Adaface: Quality adaptive margin for face recognition. In CVPR. 18750–18759. [51] Minchul Kim, Yiyang Su, Feng Liu, Anil Jain, and Xiaoming Liu. 2024. Keypoint relative position encoding for face recognition. In CVPR. 244–255. [52] Sunpill Kim, Seunghun Paik, Chanwoo Hwang, Minsu Kim, and Jae Hong Seo. 2025. Non-adaptive adversarial face generation. NeurIPS 38 (2025), 37315–37354. [53] Sunpill Kim, Yong Kiam Tan, Bora Jeong, Soumik Mondal, Khin Mi Mi Aung, and Jae Hong Seo. 2024. Scores tell everything about Bob: Non-adaptive face reconstruction on face recognition systems. In S&P. IEEE, 1684–1702. [54] Tomi Kinnunen, Rosa González Hautamäki, Ville Vestman, and Md Sahidullah. 2019. Can we use speaker recognition technology to attack itself? enhancing mimicry attacks using automatic target speaker selection. In ICASSP. IEEE, 6146– 6150. [55] Martin Knoche, Torben Teepe, Stefan Hörmann, and Gerhard Rigoll. 2023. Explainable model-agnostic similarity and confidence in face verification. In WACV. 711–718. [56] Pierrick Leroy, Antonio Mastropietro, Marco Nurisso, and Francesco Vaccarino. 2025. Attributes Shape the Embedding Space of Face Recognition Models. In ICML. PMLR, 33960–33983. [57] Zexin Li, Bangjie Yin, Taiping Yao, Junfeng Guo, Shouhong Ding, Simin Chen, and Cong Liu. 2023. Sibling-attack: Rethinking transferable adversarial attacks against face recognition. In CVPR. 24626–24637. [58] Yuanwei Liu, Hui Wei, Chengyu Jia, Ruqi Xiao, Weijian Ruan, Xingxing Wei, Joey Tianyi Zhou, and Zheng Wang. 2025. ProjAttacker: A Configurable Physical Adversarial Attack for Face Recognition via Projector. In CVPR. 21248–21257. [59] Stuart Lloyd. 1982. Least squares quantization in PCM. IEEE transactions on information theory 28, 2 (1982), 129–137. [60] Panpan Lu, Qi Li, Hui Zhu, Giuliano Sovernigo, and Xiaodong Lin. 2021. Voxstructor: Voice reconstruction from voiceprint. In International Conference on Information Security. Springer, 374–397. [61] Guangcan Mai, Kai Cao, Pong C Yuen, and Anil K Jain. 2018. On the reconstruction of face images from deep face templates. IEEE TPAMI 41, 5 (2018), 1188–1202. [62] Emanuele Maiorana, Gabriel Emile Hine, and Patrizio Campisi. 2014. Hillclimbing attacks on multibiometrics recognition systems. IEEE TIFS 10, 5 (2014), 900–915. [63] Brianna Maze, Jocelyn Adams, James A Duncan, Nathan Kalka, Tim Miller, Charles Otto, Anil K Jain, W Tyler Niggel, Janet Anderson, Jordan Cheney, et al. 2018. Iarpa janus benchmark-c: Face dataset and protocol. In IEEE ICB. IEEE, 158–165.

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

[64] Qiang Meng, Shichao Zhao, Zhida Huang, and Feng Zhou. 2021. Magface: A universal representation for face recognition and quality assessment. In CVPR. 14225–14234. [65] Stylianos Moschoglou, Athanasios Papaioannou, Christos Sagonas, Jiankang Deng, Irene Kotsia, and Stefanos Zafeiriou. 2017. Agedb: the first manually collected, in-the-wild age database. In CVPRW. 51–59. [66] George L Nemhauser, Laurence A Wolsey, and Marshall L Fisher. 1978. An analysis of approximations for maximizing submodular set functions—I. Mathematical programming 14, 1 (1978), 265–294. [67] Huy H Nguyen, Sébastien Marcel, Junichi Yamagishi, and Isao Echizen. 2022. Master face attacks on face recognition systems. IEEE TBIOM 4, 3 (2022), 398–411. [68] Huy H Nguyen, Junichi Yamagishi, Isao Echizen, and Sébastien Marcel. 2020. Generating master faces for use in performing wolf attacks on face recognition systems. In IJCB. IEEE, 1–10. [69] NIST. 2025. Face Recognition Technology Evaluation (FRTE), Part 1: Verification. https://pages.nist.gov/frvt/reports/11/frvt_11_report.pdf Accessed: 2025-09-12. [70] Hatef Otroshi Shahreza and Sébastien Marcel. 2023. Face reconstruction from facial templates by learning latent space of a generator network. NeurIPS 36 (2023), 12703–12720. [71] Akira Otsuka. 2013. Wolf attack: Algorithmic vulnerability in biometric authentication systems. In 2013 International Conference on Biometrics and Kansei Engineering. IEEE, 309–313. [72] Foivos Paraperas Papantoniou, Alexandros Lattas, Stylianos Moschoglou, Jiankang Deng, Bernhard Kainz, and Stefanos Zafeiriou. 2024. Arc2face: A foundation model for id-consistent human faces. In ECCV. Springer, 241–261. [73] Anton Razzhigaev, Klim Kireev, Igor Udovichenko, and Aleksandr Petiushko. 2021. Darker than black-box: Face reconstruction from similarity queries. arXiv preprint arXiv:2106.14290 (2021). [74] Ali Salar, Qing Liu, Yingli Tian, and Guoying Zhao. 2025. Enhancing Facial Privacy Protection via Weakening Diffusion Purification. In CVPR. 8235–8244. [75] Florian Schroff, Dmitry Kalenichenko, and James Philbin. 2015. Facenet: A unified embedding for face recognition and clustering. In CVPR. 815–823. [76] Soumyadip Sengupta, Jun-Cheng Chen, Carlos Castillo, Vishal M Patel, Rama Chellappa, and David W Jacobs. 2016. Frontal to profile face verification in the wild. In WACV. IEEE, 1–9. [77] Amazon Web Service. [n. d.]. Amazon Rekognition Customers. https://aws. amazon.com/rekognition/customers/ Accessed: 2026-01-02. [78] Hatef Otroshi Shahreza, Vedrana Krivokuća Hahn, and Sébastien Marcel. 2024. Vulnerability of state-of-the-art face recognition models to template inversion attack. IEEE TIFS 19 (2024), 4585–4600. [79] Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. 2016. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In ACM CCS. 1528–1540. [80] Ron Shmelkin, Tomer Friedlander, and Lior Wolf. 2021. Generating master faces for dictionary attacks with a network-assisted latent space evolution. In FG. IEEE, 01–08. [81] Star Alliance. [n. d.]. Star Alliance Biometrics: Enabling Contactless Travel Experiences at Airports. https://www.staralliance.com/en/biometrics Accessed: 2025-07-27. [82] Tencent. [n. d.]. Customer Success Stories. https://www.tencentcloud.com/ customers Accessed: 2026-01-02. [83] Philipp Terhörst, Florian Bierbaum, Marco Huber, Naser Damer, Florian Kirchbuchner, Kiran Raja, and Arjan Kuijper. 2022. On the (limited) generalization of masterface attacks and its relation to the capacity of face representations. In IJCB. IEEE, 1–9. [84] Philipp Terhörst, Malte Ihlefeld, Marco Huber, Naser Damer, Florian Kirchbuchner, Kiran Raja, and Arjan Kuijper. 2023. Qmagface: Simple and accurate qualityaware face recognition. In WACV. 3484–3494. [85] DHS Transportation Security Laboratory. [n. d.]. Privacy Impact Assessment for the Biometrics Access Control System at the Transportation Security Lab. https: //www.dhs.gov/xlibrary/assets/privacy/privacy-pia-st-tsl-bacs.pdf Accessed: 2025-09-12. [86] Masashi Une, Akira Otsuka, and Hideki Imai. 2007. Wolf attack probability: A new security measure in biometric authentication systems. In ICB. Springer, 396–406. [87] Edward Vendrow and Joshua Vendrow. 2021. Realistic face reconstruction from deep embeddings. In NeurIPS 2021 Workshop Privacy in Machine Learning. [88] C Voglis and IE Lagaris. 2004. A rectangular trust region dogleg approach for unconstrained and bound constrained nonlinear optimization. In WSEAS International Conference on Applied Mathematics, Vol. 7. 9780429081385–138. [89] Paul Voigt and Axel Von dem Bussche. 2017. The eu general data protection regulation (gdpr). A practical guide, 1st ed., Cham: Springer International Publishing 10, 3152676 (2017), 10–5555. [90] Mei Wang, Weihong Deng, Jiani Hu, Xunqiang Tao, and Yaohai Huang. 2019. Racial faces in the wild: Reducing racial bias by information maximization adaptation network. In ICCV. 692–702. [91] Benjamin Weggenmann and Florian Kerschbaum. 2021. Differential privacy for directional data. In ACM CCS. 1205–1222.

Casting the Net! Revisiting MasterFace Impersonation Attacks

[92] Daan Wierstra, Tom Schaul, Tobias Glasmachers, Yi Sun, Jan Peters, and Jürgen Schmidhuber. 2014. Natural evolution strategies. JMLR 15, 1 (2014), 949–980. [93] Dong Yi, Zhen Lei, Shengcai Liao, and Stan Z Li. 2014. Learning face representation from scratch. arXiv preprint arXiv:1411.7923 (2014). [94] Sung-Hyun Yoon, Min-Sung Koh, Jae-Han Park, and Ha-Jin Yu. 2020. A new replay attack against automatic speaker verification systems. IEEE Access 8 (2020), 36080–36088. [95] Wenyi Zhao, Rama Chellappa, P Jonathon Phillips, and Azriel Rosenfeld. 2003. Face recognition: A literature survey. Comput. Surveys 35, 4 (2003), 399–458. [96] Baolin Zheng, Peipei Jiang, Qian Wang, Qi Li, Chao Shen, Cong Wang, Yunjie Ge, Qingyang Teng, and Shenyi Zhang. 2021. Black-box adversarial attacks on commercial speech platforms with minimal information. In ACM CCS. 86–107. [97] Zheng Zhu, Guan Huang, Jiankang Deng, Yun Ye, Junjie Huang, Xinze Chen, Jiagang Zhu, Tian Yang, Jiwen Lu, Dalong Du, et al. 2021. Webface260m: A benchmark unveiling the power of million-scale deep face recognition. In CVPR. 10492–10502.

A

Detailed Settings and Additional Results

Dataset Selection Rationale. As summarized in Table 5, we select datasets by jointly considering the number of facial images and the number of identities, depending on their roles in our evaluation. For constructing the net, we choose MS1MV3 [17], which is one of the largest publicly available face datasets and contains both a massive number of images and a sufficiently large number of identities. This choice enables the net to effectively cover a broad region of the template space. As target datasets, we select CASIA-WebFace [93] and LFW [33], which are smaller than MS1MV3 but still include a sufficiently large number of identities to support reliable impersonation evaluation. In contrast, AgeDB-30 [65] and CFP-FP [76] are commonly used as verification benchmarks in face recognition. However, due to their relatively small numbers of identities, they are not well-suited for our fitting and coverage analysis, as the results could be overly optimistic, pessimistic, or biased. Therefore, we do not include them as primary target datasets in the main experiments. Instead, they are used for additional performance evaluation of the proposed and baseline models, together with LFW, to assess generalization across standard verification benchmarks. More Details on Open-sourced Models. We provide detailed information about open-source FRSs and AWS CompareFace API, including the decision thresholds for each FMR level and the verification benchmark results. We measure the threshold by following the procedure in Section 5.1 using the MS1MV3 dataset. Specifically, for the AWS CompareFace, we randomly select 8,192 identities and determine the threshold by querying all pairs of the corresponding faces. Note that AWS CompareFace provides confidence scores ranging from 0 to 100; a higher score means the given pair of images is similar. For this reason, we report the decision threshold in terms of those scores. The thresholds are provided in Tab. 6. In addition to this, we also provide the verification benchmark results, including LFW, AgeDB-30, and CFP-FP, for the threshold determined above. More precisely, we regard the true acceptance

Table 5: Summary of face datasets used for constructing the net, target enrolled identities, and additional evaluations. Dataset # Images # Ids

net MS1MV3 5,179,510 93,431

Target CASIA-WebFace 490,623 10,572

LFW 13,233 5,749

Additional AgeDB-30 CFP-FP 16,488 7,000 568 500

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Table 6: Thresholds of FRSs for FMR level FMR 10−3 10−4 10−5 𝐹1 𝐹2 𝐹3 𝐹4 𝐹A

0.1881 0.1818 0.1852 0.2258 22.8715

0.2413 0.2313 0.2406 0.2856 45.0380

0.2995 0.2857 0.3008 0.3434 68.7471

Table 7: Verification performance (TAR and FAR) at operational FMR levels on three benchmarks. For each FRS, the decision threshold is set to match the target FMR, and the resulting TAR(%)/FAR(%) are reported on each dataset. LFW AgeDB-30 CFP-FP FRS TAR FAR TAR FAR TAR FAR

𝐹1 𝐹2 𝐹3 𝐹4 𝐹A

99.7 99.7 99.733 99.7 99.7

𝐹1 𝐹2 𝐹3 𝐹4 𝐹A

99.7 99.7 99.667 99.667 99.7

𝐹1 𝐹2 𝐹3 𝐹4 𝐹A

99.633 99.6 99.467 99.667 99.667

FMR = 10−3 0.167 97.267 0.767 0.2 96.933 0.367 0.133 96.933 0.8 0.133 96.833 0.833 0.233 97.1 0.367 FMR = 10−4 0.033 96.0 0.033 0.033 95.867 0.1 0.033 94.767 0.033 0 95.533 0.167 0.033 95.6 0 FMR = 10−5 0 93.967 0 0 93.667 0 0 90.833 0 0 92.933 0 0.033 93.667 0

98.771 97.429 98.714 98.743 99.171

0.171 0.2 0.171 0.143 0.086

98.457 95.343 97.857 98.2 98.4

0 0.057 0 0 0.029

97.514 91.657 95.8 97.0 96.857

0 0 0 0 0

rate (TAR) and false acceptance rate (FAR)12 as the evaluation metrics and measure them at the threshold per FMR level. The results are provided in Tab. 7. We can observe that, because of the distributional discrepancy between MS1MV3 and each benchmark dataset, the FAR at each benchmark is slightly different from the FMR value corresponding to each threshold. Nevertheless, for tighter thresholds corresponding to FMR= 10−4 or 10−5 , we obtain almost the same result as expected. Additional Experimental Results. We provide additional experimental results on measuring IRs for open-source FRSs 𝐹 3 and 𝐹 4 , which were omitted in the main text due to space constraints. The results are provided in Tab. 8 and Tab. 9, respectively. Consistent with the results in 𝐹 2 and 𝐹 A , the obtained IR values from our attack consistently exceed those from both the zero-effort imposter baseline and those estimated from FMR. Particularly, as we briefly mentioned in the main text, they exhibit a similar behavior as those measured from 𝐹 2 in Tab. 2, i.e., our attack becomes (relatively) more effective than the baseline for smaller authentication trial budgets and stricter FMR levels. 12 Note that these quantities originally consider system-level failures, e.g., rejections

from anti-spoofing methods, according to the standards [30]. Nevertheless, we will use these terms in the same meaning of true match rate and false match rate, following the convention based on the LFW’s standard evaluation protocol [33].

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

Table 8: IR (%) results on 𝐹 3 at various FMR levels. For Ours, the second row in each cell, highlighted as bold, indicates the improvement factor over the baseline. Target Dataset 𝑄

Method 𝑄 · FMR Baseline

5 Ours 𝑄 · FMR Baseline 10 Ours 𝑄 · FMR Baseline 30 Ours

10−3

LFW 10−4

10−5

10−3

CASIA-WebFace 10−4 10−5

0.5 0.495 2.901 ×5.86 1 0.986 4.730 ×4.80 3 2.928 10.74 ×3.67

0.05 0.048 0.388 ×8.08 0.1 0.095 0.646 ×6.80 0.3 0.286 1.510 ×5.28

0.005 0.007 0.035 ×5.00 0.01 0.013 0.043 ×3.31 0.03 0.039 0.157 ×4.03

0.5 0.495 2.803 ×5.66 1 0.988 5.091 ×5.15 3 2.933 12.29 ×4.19

0.05 0.048 0.408 ×5.66 0.1 0.096 0.794 ×8.27 0.3 0.288 2.225 ×7.73

0.005 0.007 0.019 ×2.71 0.01 0.014 0.070 ×5.00 0.03 0.040 0.309 ×7.73

Table 9: IR (%) results on 𝐹 4 at various FMR levels. For Ours, the second row in each cell, highlighted as bold, indicates the improvement factor over the baseline. Target Dataset 𝑄

Method 𝑄 · FMR Baseline

5 Ours 𝑄 · FMR Baseline 10 Ours 𝑄 · FMR Baseline 30 Ours

B

10−3

LFW 10−4

10−5

10−3

CASIA-WebFace 10−4 10−5

0.5 0.468 1.428 ×3.05 1 0.934 2.843 ×3.04 3 2.773 7.242 ×2.61

0.05 0.046 0.175 ×3.80 0.1 0.091 0.324 ×3.56 0.3 0.273 0.897 ×3.29

0.005 0.007 0.014 ×2.00 0.01 0.013 0.024 ×1.85 0.03 0.040 0.065 ×1.63

0.5 0.526 2.086 ×3.97 1 1.049 3.615 ×3.45 3 3.111 9.130 ×2.94

0.05 0.058 0.373 ×6.43 0.1 0.116 0.686 ×5.91 0.3 0.348 1.619 ×4.65

0.005 0.010 0.051 ×5.10 0.01 0.022 0.100 ×4.55 0.03 0.064 0.202 ×3.16

Details on Score-based Attacks

We provide details of the score-based attacks we used in our experiments, which were omitted in the main text. Kim et al.’s Attack [53]. The core idea of their attack stems from the observation that well-trained FRSs act like almost isometries, i.e., the distance relationship between templates from facial images is largely preserved across the template extractors. This motivates the adversary to view the score between the queried faces and the enrolled one in the system as a proxy for the location of the corresponding template over the target model’s template space. Specifically, thanks to the observation mentioned above, the adversary can estimate the location of the target face’s template over the template space of its local surrogate model. More formally, for the target face 𝔟 and the queried ones 𝔳1, . . . , 𝔳𝑄 , let us denote 𝐹𝑇 and 𝐹𝐿 as the template extractors of the target FRS and the adversary’s surrogate model, respectively. Then their observation tells us that

Algorithm 1 Kim et al.’s Reconstruction Attack Require: Score oracle O (·), OFS {𝔳1, . . . , 𝑣𝑄 }, local surrogate template extractor 𝐹𝐿 and its inverse model 𝐹𝐿† . Ensure: A facial image 𝔟 ∈ B 1: Compute a matrix 𝐴 whose 𝑖 th column vector is 𝐹 𝐿 (𝔳𝑖 ). 𝑄 2: Obtain a score vector 𝑠® = (O (𝔳𝑖 ))𝑖=1 from oracle queries. † † 3: Compute 𝑧 ← 𝐴 𝑠®, where 𝐴 is the pseudoinverse of 𝐴. † 𝑧 4: return 𝔟 ← 𝐹 𝐿 ( ∥𝑧 ∥ ). 2

solution to 𝐹𝐿 (𝔟). In particular, to reduce the effect of the error in 𝑄 the score, they make the templates {𝐹𝐿 (𝔳𝑖 )}𝑖=1 of the queried faces as close to orthogonal as possible. They call such a set of faces an orthogonal face set (OFS), along with providing an algorithm to find an OFS. Finally, the candidate face template from least squares is fed to the inverse model 𝐹𝐿† of 𝐹𝐿 held by the adversary, which reconstructs the corresponding faces to the given template. We provide the detailed algorithm of this attack in Algorithm 1. We remark that their attack is non-adaptive, in the sense that the queried faces (OFS) are not updated during the query. Particularly, the choice of the OFS depends on the adversary’s surrogate model only. For this reason, when employing Kim et al.’s attack in our attack framework, we can directly select DB𝑝 as such an OFS, and utilize their rotated templates to recover the faces corresponding to the rotated net. NES-based Post-Processing. After recovering faces from Kim et al.’s attack, we apply a post-processing optimization algorithm based on natural evolution strategy (NES) [92] to recover more accurate MasterFaces. Since the initial point found by Kim et al.’s attack aligns with the latent space of their inverse model, we use the latent search variant of the NES. In particular, we utilize a hypersphere variant of the NES during gradient estimation as the latent space of the inverse model is also defined as S𝑑 −1 . For the given initial point 𝑧 0 ∈ S𝑑 −1 , the algorithm is processed as follows: first, the adversary samples random vectors, say 𝑢 1, . . . , 𝑢𝑛𝑖𝑡 , from the uniform distribution over the hypersphere U (S𝑑 −1 ), where 𝑛𝑖𝑡 denotes the number of random samples for the gradient estimation. The adversary then project each 𝑢𝑖 to its tangent space by computing 𝑢𝑖 ← 𝑢𝑖 − ⟨𝑢𝑖 , 𝑧 0 ⟩𝑧 0 and 𝑢˜𝑖 ← ∥𝑢𝑢𝑖𝑖∥ 2 For the step size 𝜃 , the gradient estimation is processed by perturbing 𝑧 0 from the direction of 𝑢𝑖 by 𝜃 following the geodesic line over S𝑑 −1 . More precisely, the adversary computes 𝑧𝑖+ = cos 𝜃 · 𝑧 0 + sin 𝜃 · 𝑢˜𝑖 ,

𝑧𝑖− = cos 𝜃 · 𝑧 0 − sin 𝜃 · 𝑢˜𝑖 .

Here, computing both 𝑧𝑖+ and 𝑧𝑖− corresponds to the standard antithetic sampling, which reduces the variance of the estimated gradient. Finally, the adversary obtains the estimated gradient through 2 · 𝑛𝑖𝑡 calls of the score oracle O (·), namely,

⟨𝐹𝑇 (𝔳𝔦 ), 𝐹𝑇 (𝔟)⟩ ≈ ⟨𝐹𝐿 (𝔳𝑖 ), 𝐹𝐿 (𝔟)⟩ for 𝑖 = 1, . . . , 𝑄. That is, if we denote 𝐴 as a matrix whose 𝑖 th column vector is 𝐹𝐿 (𝔳𝑖 ), we obtain that 𝑄

𝐴𝑇 𝐹𝐿 (𝔟) ≈ (⟨𝐹𝑇 (𝔳𝔦 ), 𝐹𝑇 (𝔟)⟩)𝑖=1 . Although the above linear system is underdetermined, utilizing the least-squares solver, i.e., pseudoinverse, gives a sufficiently close

𝑖𝑡 𝑠𝑖+ − 𝑠𝑖− 1 ∑︁ 𝑢˜𝑖 . 𝑛𝑖𝑡 𝑖=1 2 sin 𝜃

𝑛

𝑠𝑖+ ← O (𝐹 † (𝑧𝑖+ )),

𝑠𝑖− ← O (𝐹 † (𝑧𝑖− )),

𝑔←

The final 𝑔 is used for applying the gradient descent on 𝑧 0 , namely, for the learning rate 𝜂, 𝑧 0 is updated to 𝑧 0 + 𝜂 · 𝑔, i.e., the direction that maximizes the confidence score. Note that the adversary can apply a momentum-based approach to the gradient to stabilize the

Casting the Net! Revisiting MasterFace Impersonation Attacks

Algorithm 2 Hypersphere NES Require: Score oracle O (·), initial point 𝑧 0 ∈ S𝑑 −1 , # of samples 𝑛𝑖𝑡 for gradient estimation, learning rate 𝜂, search step 𝜃 , the inverse model 𝐹 † Ensure: Updated point 𝑧 ∈ S𝑑 −1 . 1: for 𝑖 from 1 to 𝑛𝑖𝑡 do 2: Sample 𝑢𝑖 ← U (S𝑑 −1 ) 3: Compute 𝑢𝑖 ← 𝑢𝑖 − ⟨𝑢𝑖 , 𝑧 0 ⟩𝑧 0 and 𝑢˜𝑖 ← ∥𝑢𝑢𝑖𝑖∥ 2 4: Compute 𝑧𝑖+ ← 𝑧 0 cos 𝜃 + 𝑢˜𝑖 sin 𝜃 , 𝑧𝑖− ← 𝑧 0 cos 𝜃 − 𝑢˜𝑖 sin 𝜃 . Obtain 𝑠𝑖+ ← O (𝐹 † (𝑧𝑖+ )) and 𝑠𝑖− ← O (𝐹 † (𝑧𝑖− )) from queries. 5: 6: end for + − 1 Í𝑛𝑖𝑡 𝑠𝑖 −𝑠𝑖 7: Compute 𝑔 ← 𝑛 𝑖=1 2 sin 𝜃 𝑢𝑖 . 𝑖𝑡 𝑧 8: Compute 𝑧 ← 𝑧 0 + 𝜂 · 𝑔 and return 𝑧 ← ∥𝑧 ∥ 2

optimization trajectory. We provide the algorithm for the singlestep update explained above in Algorithm 2. Full Attack Parameters. We provide the full parameters for the score-based attacks used in our experiments. • Kim et al.’s Attack – By following the subsequent work [52], we construct the OFS as the faces corresponding to the top 100 principal components of the templates in the WebFace42M dataset [97]. We use the first image for each identity to run the PCA. – We use the same inverse model, modified NbNet [53]. • Hyperspherical NES – We use 𝑛𝑖𝑡 = 1 as it provides stable convergence when combined with momentum of ratio 0.1. – We dynamically update 𝜃 as follows: for 𝜃 0 = 0.05, we set 𝜃0 𝜃 = 1+∥𝑔 ∥ 2 and clamp it between 0.01 and 0.15. – The total number of updates depends on the query budget; we set 𝑘 · 200 as the maximum budget.

C

Omitted Proofs

We provide the omitted proofs of our arguments, especially for the dimensionality reduction on the Gram decomposition in Section 4.1. We first present the following lemma, a toolbox to analyze the transformed templates obtained from the Gram decomposition. Lemma C.1. Let 𝐴 ∈ R𝑑 ×𝑘 be a matrix whose singular value decomposition is 𝑈 Σ𝑉 𝑇 for 𝑈 ∈ R𝑑 ×𝑘 and Σ, 𝑉 ∈ R𝑘 ×𝑘 , and 𝐿 ∈ R𝑘 ×𝑘 be a Gram decomposition of 𝐴𝑇 𝐴, i.e., 𝐿𝑇 𝐿 = 𝐴𝑇 𝐴. Then the following properties hold: • There exists an unitary matrix 𝑅 ∈ R𝑘 ×𝑘 such that 𝐿 = 𝑅𝑈 𝑇 𝐴.

• For 𝑧 ∈ R𝑑 , 𝑅𝑈 𝑇 𝑧 = (𝑧𝑇 𝐴 · 𝐿 −1 )𝑇 . In particular, 𝑧𝑇 𝐴 = (𝑅𝑈 𝑇 𝑧)𝑇 𝐿. 𝐴𝐴† 𝑦

𝑅𝑈 𝑇 𝑦

• For 𝑥, 𝑦 ∈ R𝑑 , ⟨𝑅𝑈 𝑇 𝑥, ∥𝑅𝑈 𝑇 𝑦 ∥ ⟩ = ⟨𝑥, ∥𝐴𝐴† 𝑦 ∥ ⟩, 2

2

where 𝐴† is the pseudoinverse of 𝐴. Proof. Observe that 𝐴𝑇 𝐴 = 𝑉 Σ𝑇 𝑈 𝑇 𝑈 Σ𝑉 𝑇 . Since 𝑈 𝑇 𝑈 = 𝐼𝑘 and Σ𝑇 = Σ, we can deduce that 𝐿𝑇 𝐿 = 𝐴𝑇 𝐴 = (Σ𝑉 )𝑇 (Σ𝑉 ) for Σ𝑉 𝑇 ∈ R𝑘 ×𝑘 That is, the unitary ambiguity of Gram decomposition ensures the existence of the unitary matrix 𝑅 ∈ R𝑘 ×𝑘 such that 𝐿 = 𝑅Σ𝑉 𝑇 . Finally, since 𝑈 𝑇 𝐴 = (𝑈 𝑇 𝑈 )Σ𝑉 𝑇 = Σ𝑉 𝑇 , we finally obtain 𝐿 = 𝑅𝑈 𝑇 𝐴, thereby showing the first property.

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

For the second property, we first note that 𝑈𝑈 𝑇 corresponds to the projection matrix onto the 𝐴’s column space. That is, 𝑈 𝑈 𝑇 𝐴 = 𝐴 holds. From this observation, we can deduce that 𝑧𝑇 𝐴 = 𝑧𝑇 𝑈𝑈 𝑇 𝐴 = 𝑧𝑇 𝑈 𝑅𝑇 𝑅𝑈 𝑇 𝐴 = (𝑅𝑈 𝑇 𝑧)𝑇 (𝑅𝑈 𝑇 𝐴). Hence, provided that 𝐿 = 𝑅𝑈 𝑇 𝐴 is invertible, we finally obtain  𝑇 𝑅𝑈 𝑇 𝑧 = (𝑧𝑇 𝐴) · (𝑅𝑈 𝑇 𝐴) −1 = (𝑧𝑇 𝐴 · 𝐿 −1 )𝑇 . This proves the second property. To show the third property, we first observe that the following equality holds ⟨𝑅𝑈 𝑇 𝑥, 𝑅𝑈 𝑇 𝑦⟩ = ⟨𝑈 𝑇 𝑥, 𝑈 𝑇 𝑦⟩ = ⟨𝑥, 𝑈𝑈 𝑇 𝑦⟩, because 𝑅 is an isometry over R𝑘 . Here, 𝐴𝐴† = 𝑈 Σ𝑉 𝑇 𝑉 Σ −1𝑈 𝑇 = 𝐴𝐴† further gives ⟨𝑅𝑈 𝑇 𝑥, 𝑅𝑈 𝑇 𝑦⟩ = ⟨𝑥, 𝐴𝐴†𝑦⟩. By following a similar argument as above, we can show that ∥𝑅𝑈 𝑇 𝑦 ∥ 2 = ∥𝑈𝑈 𝑇 𝑦 ∥ 2 = ∥𝐴𝐴†𝑦 ∥ 2 , namely, ∥𝑅𝑈 𝑇 𝑦∥ 22 = ⟨𝑅𝑈 𝑇 𝑦, 𝑅𝑈 𝑇 𝑦⟩ = ⟨𝑈 𝑇 𝑦, 𝑈 𝑇 𝑦⟩ = ⟨𝑈𝑈 𝑇 𝑦, 𝑈 𝑈 𝑇 𝑦⟩, where the last equality holds because 𝑈 𝑇 𝑈 = 𝐼𝑘 . Therefore, we finally obtain the claimed equality ⟨𝑅𝑈 𝑇 𝑥,

𝑅𝑈 𝑇 𝑦 𝐴𝐴†𝑦 ⟩ = ⟨𝑥, ⟩ 𝑇 ∥𝑅𝑈 𝑦∥ 2 ∥𝐴𝐴†𝑦 ∥ 2

which completes the proof.

□

By using the result of Lemma C.1, we prove the following statement, which tells us the relationship between the effect of the dimensionality reduction in the Gram decomposition process and the found net. Proposition C.2. Let DB𝑁 be a set of facial images and 𝐹 be a template extractor. For the matrices 𝐴, 𝑈 ∈ R𝑑 ×𝑘 and an unitary matrix 𝑅 ∈ R𝑘 ×𝑘 defined as Lemma C.1, let us denote {𝑧 1, . . . , 𝑧𝑄 } ⊂ R𝑘 as the solution of the MCP over the set {𝑅𝑈 𝑇 𝑧 : 𝑧 = 𝐹𝑇 (𝔟); 𝔟 ∈ DB𝑁 } with a constraint that ∥𝑧𝑖 ∥ 2 = 1 for 𝑖 = 1, . . . , 𝑄. Then the set net := {𝑦1, . . . , 𝑦𝑄 } ⊂ R𝑑 defined as 𝑦𝑖 = 𝑈 𝑅𝑇 𝑧𝑖 maximizes (  ) 𝑄 Ø 𝐴𝐴†𝑦𝑖 𝔟 ∈ DB𝑁 : 𝐹𝑇 (𝔟) ∈ BX ; 𝜏 . ∥𝐴𝐴†𝑦𝑖 ∥ 2 𝑖=1 That is, net corresponds to the maximum coverage of 𝐹𝑇 (DB𝑁 ) when the solution space is constrained over the column space of 𝐴. Proof. We first observe that 𝑈 has the full row rank; this implies that for any 𝑧 ∈ R𝑘 , we can find 𝑦 ∈ R𝑑 such that 𝑧 = 𝑅𝑈 𝑇 𝑦, or explicitly, 𝑦 = 𝑈 𝑅𝑇 𝑧. Then we focus on the metric ball over R𝑘 . From the result of Lemma C.1, we can observe that, for 𝑧 ∈ R𝑘 and 𝑦 = 𝑈 𝑅𝑇 𝑧 ⟨𝑅𝑈 𝑇 𝑥,

𝐴𝐴†𝑦 𝑧 ⟩ > 1 − 𝜏. ⟩ > 1 − 𝜏 ⇐⇒ ⟨𝑥, ∥𝑧∥ 2 ∥𝐴𝐴†𝑦∥ 2

That is, if we consider the following optimization problem, whose solution is {𝑧 1, . . . , 𝑧𝑄 } ⊂ R𝑘 , Maximize |{𝔟 ∈ DB𝑁 : ∃𝑖 s.t. ⟨𝑅𝑈 𝑇 𝐹𝑇 (𝑏), 𝑧⟩ > 1 − 𝜏 }| s.t. ∥𝑧𝑖 ∥ 2 = 1 for 𝑖 = 1, . . . , 𝑄,

CCS ’26, November 15–19, 2026, The Hague, Netherlands.

Algorithm 3 K-Means-Greedy Hybrid MCP Solver Require: A set of points DB ⊂ S𝑑 −1 , the size of centroids 𝑄, threshold 𝜏, multiplier 𝜅, maximum iteration 𝑛𝐾𝑀 of K-Means. Ensure: A set of points {𝑧 1, . . . , 𝑧𝑄 } ⊂ S𝑑 −1 . 1: Find 𝜅𝑄 points {𝑤 1 , . . . , 𝑤𝜅𝑄 } ← KMeans(DB, 𝜅𝑄, 𝑛𝐾𝑀 ). 2: Initialize an index set I ← ∅ 3: while |I| < 𝑄 do 4: Find 𝑖 ← arg max 𝑗 ∈ {1,...,𝜅𝑄 }\I |DB ∩ BS𝑑 −1 (𝑤 𝑗 ; 𝜏)| 5: Append I ← I ∪ {𝑖} and update DB ← DB\BS𝑑 −1 (𝑤𝑖 ; 𝜏) 6: end while 7: return {𝑧𝑖 : 𝑖 ∈ I}. we can deduce that the corresponding net := {𝑦1, · · · , 𝑦𝑄 } ⊂ R𝑑 such that 𝑦𝑖 = 𝑈 𝑅𝑇 𝑧𝑖 , 𝑖 = 1, . . . , 𝑄 becomes the solution of Maximize |{𝔟 ∈ DB𝑁 : ∃𝑖 s.t. ⟨𝐹𝑇 (𝑏),

𝐴𝐴†𝑦𝑖 ⟩ > 1 − 𝜏 }| ∥𝐴𝐴†𝑦𝑖 ∥ 2

s.t. ∥𝑦𝑖 ∥ 2 = 1 for 𝑖 = 1, . . . , 𝑄.

Seunghun Paik, Sunpill Kim, Chanwoo Hwang, and Jae Hong Seo

∥𝑧 ∥ 22 is the constant, and ∥𝑅𝑈 𝑇 𝑥 ∥ 22 is independent of the choice of 𝑧. That is, minimizing ∥𝑅𝑈 𝑇 𝑥 − 𝑧 ∥ 22 is equivalent to maximizing ⟨𝑅𝑈 𝑇 𝑥, 𝑧⟩, which coincides with our analysis.

D

K-Means-Greedy Hybrid MCP Solver

We provide the MCP solver we used during experiments. Our MCP solver consists of two steps: the K-Means algorithm to find the candidates, and the Greedy algorithm to select the top 𝑄 centers. The motivation of such a hybrid approach stems from the difficulty of directly running the Greedy algorithm over the continuous space. The candidates from K-Means serve as the discretization of the continuous space in terms of the local density, thus we can efficiently run the Greedy algorithm over the candidates. For the K-Means algorithm, we utilize the ℓ2 distance objective function. More precisely, for the given data points DB and the cenÍ𝐾 Í troids {𝑐 1, . . . , 𝑐 𝐾 }, the algorithm aims to minimize 𝑖=1 𝑥 ∈𝐶𝑖 ∥𝑥 − 𝑐𝑖 ∥ 22 , where 𝐶𝑖 denotes the cluster corresponding to 𝑐𝑖 , i.e., 𝐶𝑖 = {𝑥 ∈ DB : arg min {∥𝑥 − 𝑐𝑖 ∥ 2 } = 𝑖}. 𝑖=1,...,𝐾

Note that the constraints in the latter problem automatically holds in our choice of 𝑦𝑖 because ∥𝑦𝑖 ∥ 22 = ⟨𝑈 𝑅𝑇 𝑧𝑖 , 𝑈 𝑅𝑇 𝑧𝑖 ⟩ = ∥𝑧𝑖 ∥ 2 . Therefore, if we rewrite the above results in terms of the metric ball, then we finally obtain that net maximizes (  ) 𝑄 Ø 𝐴𝐴†𝑦𝑖 𝔟 ∈ DB𝑁 : 𝐹𝑇 (𝔟) ∈ BX . ; 𝜏 ∥𝐴𝐴†𝑦𝑖 ∥ 2 𝑖=1 Since 𝐴𝐴† = 𝑈 𝑈 𝑇 is the projection operator onto the column space 𝐴𝐴† 𝑦

of 𝐴, the final center ∥𝐴𝐴† 𝑦 𝑖∥ also lies within the column space of 𝑖 2 𝐴, thus completing the proof. □ We remark that, since 𝑅𝑈 𝑇 𝑥 may not be a unit vector, the MCP solver over the S𝑑 −1 would not be well-defined. Nevertheless, we observe that clustering-based methods that leverage the ℓ2 distancebased objective function, e.g., KMeans, provide the same solution to the given problem because ∥𝑅𝑈 𝑇 𝑥 − 𝑧∥ 22 = ∥𝑅𝑈 𝑇 𝑥 ∥ 22 + ∥𝑧 ∥ 22 − 2⟨𝑅𝑈 𝑇 𝑥, 𝑧⟩,

Once the cluster is determined, we can minimize the objective Í function by selecting 𝑐𝑖 = |𝐶1𝑖 | 𝑥 ∈𝐶𝑖 𝑥. We repeat the process of determining the cluster and updating centers until convergence, or up to a fixed number of iterations. Note that, if both DB and {𝑐 1, . . . , 𝑐 𝐾 } are sets of unit vectors, then the objective function is equivalent to minimizing cosine distance. By running K-Means algorithm, we first find 𝜅𝑄 candidates {𝑤 1, . . . , 𝑤𝜅𝑄 } for some 𝜅 > 1, which is a hyperparameter. Among them, we select the final 𝑄 centers to maximize the coverage of the given set DB in a greedy manner. To this end, for each step, we first find a candidate 𝑤𝑖 such that its 𝜏-neighborhood BS𝑑 −1 (𝑤𝑖 ; 𝜏) maximally covers the points of DB that was not covered by previous candidates. This can be realized by subtracting BS𝑑 −1 (𝑤𝑖 ; 𝜏) to DB for each selection of 𝑤𝑖 . We repeat this process until we find all 𝑄 candidates. We describe the algorithm in Algorithm 3.

Related documents

• Breaking High Confidence: Practical Face Impersonation under High-Security Thresholds#662076
• Breaking High Confidence: Practical Face Impersonation under High-Security Thresholds#661026
• HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation#627616
• ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools#618522
• Understanding and Mitigating Prompt Leaking Attacks in Real-World LLM-Based Applications#287061