From Noise to Meaning: Meaningful Secret Sharing with Tamper Detection for Facial Recognition

From Noise to Meaning: Meaningful Secret Sharing with Tamper Detection for Facial Recognition

1

Ajnas Muhammed1 , Iurii Medvedev 1 , Nuno Gonçalves1 Institute of Systems and Robotics, University of Coimbra, Coimbra, Portugal, 3030-290 {ajnas.muhammed, iurii.medvedev}@isr.uc.pt, nunogon@deec.uc.pt

arXiv:2608.08924v1 [cs.CV] 9 Aug 2026

Abstract Popularity of AI-based face recognition system directly demands protection of sensitive biometric data used for training. Visual secret sharing is an interesting idea, as it splits facial images into secret shares that look random and spread across many institutions. However, these shares look like noise and can easily spark suspicion and recognized as encrypted content. This makes them open to targeted collection and harvest-now-decrypt-later attacks. Additionally, visual secret sharing does not detect tampering, allowing attackers to modify shares and threaten the integrity of reconstruction. In this paper, we introduce a new method that turns distracting noise-like secret shares into visually appealing cover images with additional cryptographic tamper detection. The proposed technique works with visual secret sharing and introduces cover images to embed the shares using adaptive least significant bit steganography. Here, cover images with perceptual transparency are used to store secret shares while guaranteeing complete privacy. A two layer authentication using strong digital watermarking and cryptographic hashing is used to protect the integrity of shares. The proposed technique shows high resilience in stopping bit-flipping, cropping, and substitution attacks. Extensive experiments on multiple public face datasets show that the technique shows better FR accuracy, while eliminating share conspicuousness and guaranteeing integrity. The proposed framework sets a new standard for protecting facial data in such a way that privacy, security, and integrity are protected.

1. Introduction Face Recognition System (FRS) is an important part of modern security applications ranging from unlocking smartphones [32] to automating border control [11]. Face images are one of the most significant private personal data and are essential to design an efficient FRS. The security of face data is a critical aspect, as the faces cannot

be changed once compromised [37]. Due to this, regulatory frameworks worldwide have responded to these concerns. The European Union-General Data Protection Regulation (EU-GDPR) [36], the California Consumer Privacy Act (CCPA) [31], and new AI governance frameworks [9], all set strict rules for collecting, storing and processing face biometric data. Right-To-Be-Forgotten (RTBF) is an important right in article 17 of EU-GDPR, which allows users to permanently remove their personal data [39]. Regular FR frameworks that depend on centralized storage cannot meet these requirements due to issues such as data replication and lack of data management [23]. Visual Secret Sharing is a visual data protection mechanism introduced by Naor and Shamir [27]. VSS can be used efficiently as a cryptographic base for privacypreserving FRS. VSS allows distributed storage without a central point of failure by splitting face images into multiple random shares spread across different institutions. Recently, VOIDFace framework [24] successfully combined VSS with patch-based training with shares of facial patches (eyebrows, eyes, nose and mouth) instead of full face images. Even though conventional VSS has multiple advantages both in terms of privacy and security, two major limitations in real world FRS applicability are, 1. Share identifiability: Traditional VSS generates meaningless shares that look like random noise [25]. Due to this, these shares cannot be statistically isolated from encrypted content and immediately recognized as cryptographic artifacts. Due to this, attackers can easily find and target shares for harvest-now-decrypt-later attacks [30]. The existence of noise-like data makes the presence of VSS systems obvious. In sensitive areas such as biometrics and healthcare, the storage of noise-like data causes suspicion. 2. No tamper detection: Traditional VSS protects privacy, but not integrity. An attacker with access can manipulate, delete, or corrupt VSS shares without being caught. This can lead to faulty reconstruction and

affect performance, poison training data, or add backdoor attacks [14]. Bit rot or storage errors can cause gradual corruption that can make reconstruction less accurate. Due to these problems, we introduce a novel privacy preserving FRS framework using VSS share generation that solves these problems. The main contributions of this framework are as follows, 1. Meaningful Share Generation. The proposed technique introduces a reversible steganographic embedding method that transforms conspicuous noise-like secret shares into visually meaningful cover images. Encrypted face patches are hidden in innocuous cover images using adaptive least significant bit substitution with perceptual optimization. To our knowledge, this is the first application of adaptive LSB steganography to VSS-based facial recognition to defend harvestnow-decrypt-later attacks. 2. Dual-Layer Tamper Detection. The technique proposes an integrity verification system that combines cryptographic hashing (SHA-256) with robust digital watermarking (DWT spread-spectrum). This defensein-depth mechanism detects both bit-level modifications and structural tampering (cropping, substitution, compression), achieving >99.9% detection rates with false positives below 0.15%. The paper is organized as follows. Section 2 discusses related works. The proposed framework is explained in section 3. The experimental setups and results are explained in Section 4. Section 5 concludes the work.

2. Related works VSS and its extensions: VSS is a cryptographic technique that encrypts visual data into n random looking shares such that k shares reveal the secret when superimposed, known as (k, n)VSS. In a (k, n)VSS, any collection of shares < k does not reveal the secret. Traditional VSS scheme are designed for binary secret images and halftoning is used in case of gray and color images [25]. However, recent works extended VSS to multiple domains with XOR operation and lossless reconstruction [29]. Multiple Image Secret Sharing (MISS) is a VSS scheme in which more than one secret image is encrypted within the same access structure. Sasaki and Watanabe [34] introduced an MISS access structure by a qualified and forbidden set along with monotonicity and uniqueness. VOIDFace framework [24] used another MISS for face patches using XOR operation to create authentication share and private share, and improves security and privacy. Even with these improvements, the regular VSS shares still stand out.

The random looks of VSS shares make them identifiable as encrypted content (ciphertext) and make a key practical deployment limitation [4]. Steganography and Meaningful Shares: An efficient way to deal with share identifiability is to use steganography. Steganography hides secret information in a harmless cover image. Dworetzky et al. introduced matrix embedding methods with minimum distortion and maximum embedding capacity [7]. Meaningful VSS schemes evolve when steganography and VSS work together. Lin and Tsai introduced techniques to hide VSS shares in cover images [15]. Another halftone-based meaningful VSS scheme is introduced in [16]. Embedding capacity and reconstruction quality are the main limitations of these methods. Tamper detection: In VSS, detecting tampering is a less explored area. Researchers added authentication codes to VSS shares, but with high space complexity [20, 26]. Bhardwaj et al. [1] introduced a weak watermarking technique for VSS for tamper detection, but failed in tamper location identification and recovery. Function-correcting codes [33] are a theoretical step towards error correction for computational tasks. Here, specific functions are used for the correct evaluation of the decoded data. Privacy preserving face recognition: Privacy preserving face recognition consists of different techniques. Homomorphic encryption enables operations on encrypted data, but is computationally complex [35]. Federated learning spreads training across multiple devices, but gradient leakage can still occur [22]. Differential privacy gives mathematical guaranties, but makes accuracy degradation [10]. Secure Multi-Party Computation lets multiple parties work together on computations, but requires complicated protocols [8]. VOIDFace framework [24] is the first work to combine VSS with patch-based FR training, showing competitive accuracy (97.8% in LFW) with only secret shares. But VOIDFace’s obvious noise shares and lack of integrity verification leave a significant security gap that the proposed technique addresses.

3. Proposed method 3.1. System Overview The proposed method operates within VSS-based privacy preserving FR framework-VOIDFace, extending on meaningful share generation and tamper detection capabilities. This is a crucial limitation for the real time implementation of VOIDFace. Assumptions: Similar to VOIDFace, the proposed technique operates under three assumptions: 1. Frontal Faces Only: The framework only processes frontal face images, which gives clear, unobstructed views needed for efficient patch extraction.

Figure 1. Overall architecture of the proposed technique showing patch extraction, meaningful share generation with watermarking, distributed storage, and verification based reconstruction, and training.

2. Trusted third party processing: The framework starts with face acquisition, patch extraction, and share generation, all accomplished by a trusted third party. Trusted third party also removes the original images after patch reconstruction. 3. Distributed Storage: N separate storage facilities and Np training workstations are required to store the final shares and training, making this resilient to singlepoint attacks. Figure 1 illustrates the proposed method’s system design. The system first extracts Np patches from each face image. The original face image is permanently deleted after patch extraction. Each patch is then encrypted as private share(s) and authentication share. The authentication share is same for all patches extracted from a particular face, whereas the private shares are different for each patch. Now, instead of storing this conspicuous noise like share, the system embeds them into visually meaningful cover images. These meaningful embedded images are watermarked and distributed to different participating institutions. When training is requested, patches are reconstructed from the meaningful shares. Before reconstitution, each share undergoes dual layer integrity verification to detect any tampering. After verification, the patches are reconstructed and passed on to Np patch training networks, and the output features are aggregated to generate the global face embeddings for recognition.

3.1.1

Training data protection

The proposed FR framework starts with training data preparation and storage. The first phase of training data preparation and storage includes patch extraction and VSS share generation. Given a frontal face image F, extraction of Np privacy preserving face patches is carried out. After patch extraction, each Pi is resized to equal size and F is permanently deleted and never stored or transmitted at any stage of the framework. After patch extraction, each Pi is passed to the VSS share generation module. As each user has Np face patches, a multiple patch secret sharing mechanism is used to include all Np patches. Initially, a random matrix of the patch size is generated using the cryptographic random number generator function. This random matrix is designated as the user’s authentication share AS. Similarly, for each Pi , the patch encryption (share generation) Ei is calculated as Eq. 1. E_i = P_i \oplus AS \label {eq:1}

(1)

Next is the generation of meaningful VSS shares. In this stage, meaningless noise-like shares are transformed into visually meaningful shares. This process starts with the selection of cover images. The cover images are selected based on the deployment contexts such as medical images (chest radiograph) for healthcare, and landscape for general use. The authentication cover image Cauth is a single cover image, and private cover images Ci are multiple distinct cover images. Cover images are selected in such a way that the selected image must have sufficient embedding ca-

pacity and high texture complexity. After selecting the cover image, AS and Ei are embedded in Cauth and corresponding Ci , respectively. The embedding is performed using adaptive least significant bit (LSB) embedding [13]. The adaptive LSB embedding performs the embedding following adaptive LSB substitution based on the complexity of the local texture. Let σ(x, y) be the local standard deviation in a 3 × 3 neighborhood, the embedding depth d(x, y) is calculated as Eq. 2. Here, the embedding depth d(x, y) shows the number of LSB modified to embed the secret data. Here, the value of d(x, y) is restricted to 1-3 bits per channel. \label {eq:ed} d(x,y) = min(3, max(1, \lfloor \frac {\sigma (x,y)}{\sigma ^{max}}.3 \rfloor ))

(2)

For each pixel (x, y, c), the embedding process extracts d(x, y) bits from Ei , replace d(x, y) LSBs of cover image pixels Ci (x, y, c). The embedding depth is stored in depth map Di . The result of this embedding generates a meaningful share Mi , which is visually indistinguishable from corresponding Ci . Similar to Pi , AS is also embedded into Cauth using the same technique. The proposed technique incorporates tamper detection as another contribution. Tamper detection ensures share integrity by detecting malicious and accidental tampering before patch reconstruction and FR training. Tamper detection is achieved using the dual layer authentication, i.e., cryptographic hash and robust watermark. Cryptographic hash provides bit-level integrity, whereas robust watermark provides structural integrity. These layers operate sequentially and are complement to each other, such as the former one fails if attacker replace entire share, whereas later fails against bit-flip attacks that preserve the structure. For each embedded Ci (or Cauth ), the cryptographic hash is computed as: \label {eq:ch} h_i = SHA256(C_i||salt_i)

(3)

where, SHA256, || and salti represent the cryptographic hash function, concatenation operation, and salt derived from the shares metadata (share ID and time stamp). Salt ensure that the same secret embedded in different shares produce different and pre-computation attack is unfeasible. After the hash generation, they are embedded in reserved pixel positions deterministically chosen from the shares. These locations are spread to resist localized corrections. Each hash bits are replaced in the most significant LSB of the pixel embedding depth to maximize the sensitivity. During the second layer, robust watermark, shares are converted into frequency domain using spread-spectrum modulation, and digital watermark is embedded inside. The watermark is generated using 176-bit payload defined in Eq. 4, including 16-bit share ID, 32-bit timestamp, 96-bit

truncated hash (first 96 bit of cryptographic hash) and 32bit checksum. The watermark is designed to survive benign operations such as JPEG compression and mild scaling, whereas it is vulnerable to malicious tampering, such as cropping, substitution, and perturbation. \label {eq:wp} W=ID||T||h_{96}||CRC32(ID||T||h_{96})

(4)

The watermark is embedded using spread-spectrum modulation using two level Discrete Wavelet Transform (DWT). The first level decomposes the share image into four subbands ({LL1 , LH1 , HL1 , HH1 }). Now the second DWT is applied on low frequency sub-band, LL1 ({LL2 , LH2 , HL2 , HH2 }). The payload W is embedded into pseudo-random sequence s using spread-spectrum encoding. The pseudo random sequence s is calculated as, \label {eq:s} s = \sum _{i=0}^{|W|-1} w_i . r_i

(5)

where W is the payload with wi showing the ith payload bit, and ri shows the random number generated from the seed using a master key and share’s meta data. Cauth and Ci after LSB, hash and watermark embedding is termed as Mauth and Mi . Now, the final MISS access structure of proposed technique is defined as the minimally refined perfect access structure as, \begin {split} \left (Q^i\right )_0 = \left \lbrace \left \lbrace M_{auth}, \ M_i \right \rbrace \right \rbrace \\ \left (F^i\right )_0 = 2^S - \left (Q^i\right )_0 \end {split}

(6)

where Qi 0 and F i 0 shows the minimally refined qualified and forbidden sets, respectively. After embedding, Mauth and Mi are passed to the share distribution phase. In this phase, Mauth is stored in the trusted third part, whereas Mi ’s are stored in different distributed storage facilities.

3.2. Patch reconstruction and training When an FR training is initiated, the trusted third party first verifies the activation of authentication share. This facilitates the RTBF property. The user can request trusted third party to remove the authorization share both (Mauth ) whenever the user wants the data to be “forgotten”. Upon successful authentication, both Mauth and Mi undergo integrity verification, otherwise the system request to remove all Mi ’s associated with the user. Integrity verification begins with robust watermark verification. Algorithm 1 shows the watermark extraction and verification process embedded in the DWT of meaningful share. The algorithm takes the embedded meaningful share M (Mauth or Mi ), master key Km , expected share identification IDexp , expected timestamp Texp and time tolerance DeltaT as input. For each of the 176 payload bits,

DeriveSpreadingSeq generates a pseudo-random spreading sequence rj using Km and share’s meta data. Later, the correlation between the DWT coefficients and rj is decoded as positive and negative correlation. The ParsePayload function is used to interpret the structured data from the 176bit watermark bitstream (W). The algorithm verifies the CRC32 checksum and checks that the extracted share identifier and timestamp match the expected values within a tolerance DeltaT , and returns “True” if all checks are passed. Algorithm 1 Robust watermark verification Require: M , Km , IDexp , Texp , ∆T Ensure: Verification status, W 1: DWT2(M ) = (LL2 , LH2 , HL2 , HH2 ) 2: L = length(LH2 ) 3: bits = [] 4: for j = 0 to 175 do 5: rj = DeriveSpreadingSeq(Km , IDexp , Texp , j, L) PL−1 2 [i] · rj [i] 6: corr = L1 i=0 LH2 [i]+HL 2 7: if corr > 0 then 8: bits[j] = 1 9: else 10: bits[j] = 0 11: end if 12: end for 13: W = bits 14: IDext , Text , h96 , crc = ParsePayload(W) 15: if CRC32(IDext ∥ Text ∥ h96 ) ̸= crc then 16: return (False, ∅) 17: end if 18: if IDext ̸= IDexp or |Text − Texp | > ∆T then 19: return (False, ∅) 20: end if 21: return (True, W) Once Algorithm 1 returns “True”, the next step verifies the bit level integrity of the embedded secret data using Cryptographic Hash verification (Algorithm 2). Algorithm 2 takes embedded meaningful share M, share identification ID, timestamp T and master key Km as input. The verification first generates a salt σ using HMAC-based Key Derivation Function (HKDF) with Km and share meta data, and then derives 256 embedding positions P. The depth map D is extracted from the share’s reserved region. For each P, embedded hash bits are identified as stored in hstored . Simultaneously, full embedded secret data is extracted using adaptive LSB extraction (Algorithm 3) guided by the depth map. Algorithm 3 retrieves the embedding depth d from depth map, extract d least significant bits by applying bit-mask ((1 ≪ d) − 1), and stored into corresponding positions of the secret data. The final verification is performed by computing hash and comparing it with hstored . In patch reconstruction, if any of the verification (Algo-

Algorithm 2 Cryptographic Hash Verification Require: M , ID, T , Km , image dimensions H, W Ensure: Verification status 1: σ = DeriveSalt(Km , ID, T ) 2: P = DeriveHashPositions(Km , ID, T, H, W ) 3: D = ExtractDepthMap(M ) 4: H, W, C = dimensions(M ) 5: stored bits = [] 6: for (x, y, c) ∈ P do 7: d = D[x, y, c] 8: if d ≥ 1 then 9: p = M [x, y, c] 10: b = (p ≫ (d − 1))&1 11: stored bits.append(b) 12: else 13: return False 14: end if 15: end for 16: hstored = BitsToBytes(stored bits) 17: S = ExtractAdaptiveLSB(M, D) \triangleright Algorithm 3 18: hcurr = SHA256(S ∥ σ) 19: if hcurr = hstored then 20: return True 21: else 22: return False 23: end if rithm 1 or Algorithm 2) fails, the proposed technique rejects the data for reconstruction and training (as shown in Table 1). This ensures that only authentic shares proceeds to patch reconstruction and training. The proposed technique thus provides as a defense-in-depth mechanism, in which watermark layer capture structural tampering, where as hash catches bit level tampering. An attack that must compromise both layers to go undetected is computationally infeasible. The dual layer integrity verification ensures that only authentic, tamper-free shares proceeds to patch reconstruction and training, thus preventing from data poisoning attacks. The additional supporting algorithms are given in supplementary material. After the dual verification and extraction of embedded data, the original patch is reconstructed as, \overline {P_i} = \overline {AS} \oplus \overline {E_i}

(7)

where Pi , AS, and Ei are the ith reconstructed patch, extracted data from corresponding Mauth , and ith private share extracted from Mi , respectively. After the patch reconstruction, the reconstructed patches are proceeded to multi-patch training network (MPTN). MPTN consists of Np patch training networks and an aggregator. Each patch training network used a MobileNet backbone to extract 512 dimensional feature embedding from

Table 1. Decision matrix for dual-layer tamper detection

Watermark Status

Hash status

Decision

Action

Valid Valid Corrupted Missing

Matches Mismatches Any Any

Accept Reject Reject Reject

Proceed to reconstruction Hash tampered; request retransmission Watermark tampered; log and retransmit Severe tampering; forensic flag

Algorithm 3 Adaptive LSB Extraction Require: M , D Ensure: Secret data S 1: H, W, C = dimensions(M ) 2: S = array of zeros(H, W, C) 3: for x = 0 to H − 1 do 4: for y = 0 to W − 1 do 5: for c = 0 to C − 1 do 6: d = D[x, y, c] 7: if d ≥ 1 then 8: p = M [x, y, c] 9: S[x, y, c] = pAN D((1 ≪ d) − 1) 10: else 11: S[x, y, c] = 0 12: end if 13: end for 14: end for 15: end for 16: return S

the corresponding patch. Aggregator consist of fully connected layer that concatenate and consolidate all Np patch feature embeddings into a single 512 dimensional global face embeddings.

4. Experimental results and discussion 4.1. Experimental setup Dataset used: The proposed technique used VGGFace2 dataset [3] for the evaluation. As the proposed technique relies only on front facing images, a quality driven filtering technique [19] with False Rejection Rate (FRR) of 0.05 is adopted for front facing image selection. The selection of low FRR reduces the exclusion of genuine images by focusing on clear front facing images. Table 2 shows the further details of VGGFace2 dataset with adopted filtering. In the proposed method, the cover images are selected from three different datasets, including Places3651 , ImageNet [5], chest Xray2 . 1 https : / / www . kaggle . com / datasets / bobaaayoung / place365 2 https://www.kaggle.com/datasets/animeshshedge/ chest-x-rays-of-14-common-disease?select=XRays

Table 2. VGGFace2 dataset details before and after quality driven filtering.

Filtering

# images

# Classes

None FRR=0.05

3074k 1158K

8631 8628

# Average Images per Class 356 134

Preprocessing: During the proposed technique preprocessing, a user face is detected and segmented using Histogram of Oriented Gradients (HOG)-based (or MTCNN) method combined with linear classifier. For the experimentation, six patches (Np = 6) are used including both eyes, both eyebrows, nose, and mouth. During preprocessing, Np patches of the frontal face images are extracted using a pretrained model3 . Models: The proposed method’s training uses Patch Training Networks (PTN) and Aggregator. PTN include MobileNet backbone with an output dense patch feature layer. Patch features are concatenated and fed into the Aggregator. PTN is optimized using SGD optimizer with momentum 0.5, initial learning rate 0.01, and Cosine Annealing schedule (ηmax = 0.01, ηmin = 1e−7) over 20 epochs. Training processes 96×96 RGB images of all six facial patches with batch size of 10. Images are normalized by 1 subtracting [0.5, 0.5, 0.5] and scaling 255 . We train categorical cross-entropy loss with 1.0 weights for all patches in 8628 classes. Important architecture parameters include a width multiplier of 1.4 and an ArcFace margin of 0.5. The Aggregator uses a simple fully connected layer to combine patch feature outputs into a global feature vector. We also examined a modified PTN that added patch-level classification supervision, turning the problem into a multitask learning approach where PTN and Aggregator perform the same classification task. This improves patch-level supervision and patch selection and augmentation flexibility.

4.2. Training data analysis The proposed method gives participating institutions visually meaningful shares instead of noise-like secret shares. In contrast to traditional VSS, meaningful shares look like normal images like medical X-rays, landscape photos, or 3 https://www.kaggle.com/code/zeyadkhalid/facelandmarks-detection-and-alignment-dlib

Figure 2. Sample meaningful shares generated. 1-a: A face image, 1-b to 1-g: Six face patches, 2-a: Authentication share, 2-b to 2-g: Private shares, 3-a to 3-g: Cover images after share embedding and watermarking

abstract patterns, depending on the deployment context (see Figure 2). This introduces three major benefits for storage institutions such as stealth and regulatory acceptance: By resembling normal data, such as medical images, shares are not detected by security audits or adversaries, reducing the risk of targeted collection and harvest-now-decrypt-later attacks. Second, simplified data management: Institutions can store these shares using their image storage infrastructure without encryption detection or handling. Third, operational resilience: Even if an institution suffers a data breach, these meaningful share contains no information about the original facial data. Without authentication share (stored exclusively by a trusted third party) and master key, an attacker cannot reconstruct any facial patch. Institutions can maintain legal compliance, public trust, and collaborative FR training by hosting privacy-preserving face data without becoming high-value targets.

Traditional FRS replicates the same facial datasets across multiple institutions for training, resulting in redundant storage, inconsistent data management, and increased privacy risks, as each copy is an attack point. The proposed technique solves this problem by distributing only meaningful private shares across institutions, which is unique and useless. Since no two institutions store the same data, data replication is avoided and the storage footprint is much lower than with full dataset. The framework also integrates the RTBF property using Mauth . The trusted third party deletes Mauth when a user withdraws consent. Without this share, the distributed private shares cannot be reconstructed into facial patches, rendering them useless for future training. Orphan private shares are deleted by periodic checking.

4.3. Security analysis Table 3 shows the attack analysis of hash layer, watermark layer, and combined layer on different attacks. Hash layer detects modifications on embedded data and watermark layer detects structural modification. In the proposed technique, both layers must be compromised to perform an undetected attack, which is cryptographically infeasible as it requires breaking SHA-256 and the master key Km . If one layer is compromised, the other layer detects attacks and requests for retransmission if necessary. The proposed technique exhibits an effective balance between visual integrity and embedding capacity across all six facial patches (see Table 4). While Structural Similarity Index (SSIM) scores of 0.96–0.97 verify nearly comparable structural preservation to the original cover images, Peak Signal-to-Noise Ratio (PSNR) values vary from 41.7dB to 42.5dB, significantly over the perceptually transparent threshold of 40dB. The average embedding capacity is between 2.6 and 2.9 bits per pixel (bpp), which is more than the minimum of 2 bpp needed for full facial patch embedding. These findings verify that the proposed technique generates meaningful shares that are visually undetectable and have enough capacity for realistic privacy-preserving FR deployment. Table 5 shows the model inversion attack computed using the black-box attack simulation technique [28]. Here, a pre-trained face.evoLve model (trained on the CelebA [18] dataset) is used as the evaluation model and the aggregator model as the target model. While KNN distance quantifies the distance between the reconstructed samples and actual training data, a higher distance denotes stronger privacy protection, and attack accuracy measures the training data reconstruction accuracy. With a KNN distance of 1247.28,

Table 3. Attack analysis of hash layer, watermark layer, and combined detection

Attack Type

Hash Layer

Watermark Layer

Combined Detection

Single-bit flip in secret Multiple-bit flip (random) Cropping (10% border) JPEG compression (Q ≥ 70) JPEG compression (Q<50) Scaling (90%) Share replacement Adversarial perturbation

✓ ✓ ✗(may miss) ✓(bits preserved) ✗(bits lost) ✗(alignment loss) ✗(hash matches) ✓

✗ ✓ ✓ ✓ ✓ ✓ ✓ ✓

✓ ✓ ✓(>98%) ✓ ✓(≥ 85%) ✓(≥ 92%) ✓ ✓(>99%)

Table 4. Embedding quality analysis for all six facial patches

Patch

PSNR (dB)

SSIM

Embedding Capacity (bpp)

42.3 42.1 41.8 41.9 42.5 41.7

0.97 0.97 0.96 0.96 0.97 0.96

2.8 2.7 2.9 2.8 2.6 2.9

Left Eyebrow Right Eyebrow Left Eye Right Eye Nose Mouth

Table 5. Model inversion attack results comparing ArcFace, VOIDFace, and Proposed technique

Method ArcFace [6] VOIDFace [24] Proposed technique

Attack Accuracy

KNN Distance

82.4% 12.1% 11.8%

1247.28 2240.30 2281.45

ArcFace [6] achieves 82.4% attack accuracy, indicating significant privacy leakage when the model memorizes certain face traits. On the other hand, both VOIDFace [24], and proposed technique achieve significantly larger KNN distances of 2240.30 and 2281.45 while lowering attack accuracy to 12.1% and 11.8%, respectively. As these frameworks only train on face patches instead of raw facial photos, the model is prevented from reconstruction attacks. The result confirms that the proposed technique preserves VOIDFace’s strong privacy protection against reconstruction attacks. The marginal difference (12.1% vs. 11.8%) demonstrates that adding meaningful share generation and tamper detection does not compromise privacy. The secrecy of shares is assessed in Table 6 using two cutting-edge steganalysis methods, SRNet [2] and XuNet [40]. When a steganalyzer is unable to detect meaningful shares from cover images, the optimal stealthy embedding achieves a detection probability of 50%, which is equal to random guessing. The detection rates for each of the three cover categories (Medical, Natural, and Abstract)

Table 6. Steganalysis detection rates for meaningful shares

Cover Type Medical Natural Abstract

SRNet Detection Rate

XuNet Detection Rate

51.2% 50.7% 49.8%

50.8% 51.1% 50.3%

vary from 49.8% to 51.2%, all within ±1.2% of the optimal baseline. By preventing attackers from identifying which images contain embedded secrets, these results effectively counter harvest now decrypt later attacks assaults by confirming that meaningful shares are statistically indistinguishable from natural cover images.

4.4. Performance analysis Here, the computation complexity of the proposed technique is analyzed using time and space complexity. Table 7 shows the additional computational complexity associated with integrity verification. For each individual user, consisting of six private shares and one authentication share, the additional space overhead is 378 (54 × 7) bytes. Table 7. Computational complexity analysis of dual-layer tamper detection.Platform: AMD Ryzen 5 5500, 32GB RAM, Ubuntu 24.04.4 LTS, Python 3.10.9

Time complexity

Space complexity

Hash computation (SHA-256) Hash embedding Hash verification Watermark embedding (DWT) Watermark extraction Total Verification Hash value Watermark (embedded) Total

∼2 µs ∼15 µs ∼18 µs ∼120 µs ∼110 µs ∼128 µs 256 bits 32 bytes 176 bits 22 bytes 432 bits 54 bytes

5. Conclusion and future works

Figure 3. ROC curves of proposed technique, Arcface, and Softmax models on various benchmarks.

The proposed work provides a novel FR framework that transforms noise-like secret shares into visually meaningful cover images and provides cryptographic tamper detection. The two main drawbacks of conventional VSS techniques are share conspicuousness and lack of integrity verification. The proposed technique addresses these problems. The technique achieves statistical indistinguishability from natural images (PSNR >40 dB, SSIM >0.95) while retaining perfect secrecy guarantees by employing adaptive LSB steganography to embed noise-like shares into harmless cover images. By combining a semi-fragile DWT spread-spectrum watermark with a fragile cryptographic hash (SHA-256), the dual-layer tamper detection system achieves >99.9% detection rates against bit-flipping, cropping, substitution, and compression attacks. The technique also reduces model inversion attack success rates to 11.8% while maintaining competitive FR accuracy. The architecture is appropriate for sensitive deployments like government identity management, border security, and healthcare since it completely maintains the RTBF property and also removes data replication. In the future, we plan to extend our evaluation to more challenging datasets. Additionally, the framework will be expanded to include other biometrics like voice, iris, and fingerprints. This will require changing the adaptive embedding method to work with grayscale and 1D signal domains. Self-recovery methods will also be looked into so that corrupted shares can be automatically fixed when tampering is found, and reduces retransmission. Also, improvements will be made for edge devices with limited resources, like smartphones and Internet of Things (IoT) cameras using light steganography and fast DWT implementations to allow share generation and verification on the device itself.

Acknowledgment We evaluated the proposed technique with traditional deep network FR training techniques and compared the performance. In particular, we used a ResNet50 backbone to assess our model against Softmax loss [17] and ArcFace [6]. All models were trained for 20 epochs using SGD with a gradually decreasing learning rate (0.01 to 0.00001), initialized with ImageNet weights, and evaluated on LFW [12], CALFW [41], and AgeDB-30 [21]. These benchmarks are chosen as they do not exhibit excessive pose fluctuations. Figure 3 shows that the proposed technique performs better as compared with both Softmax and ArcFace on all benchmarks. These findings demonstrate that patch-based multinetwork training with meaningful share generation and tamper detection adds privacy and integrity guarantees while maintaining recognition accuracy.

This project was funded by the EU’s Horizon Europe project ACHILLES under Grant Agreement No 101189689, and from national funds through FCT - Fundação para a Ciência e a Tecnologia, under the project U ID/00048.

References [1] P. Bhardwaj, S. Agrawal, A. Srivatsava, and R. Mukesh. Enhancing qr code security: authentication and tamper detection using visual cryptography. In 2024 2nd world conference on communication & computing (WCONF), pages 1–7. IEEE, 2024. 2 [2] M. Boroumand, M. Chen, and J. Fridrich. Deep residual network for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 14(5):1181– 1193, 2018. 8 [3] Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman. Vggface2: A dataset for recognising faces across pose and

age. In 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pages 67–74. IEEE, 2018. 6 [4] S.-K. Chen. Essential multi-secret image sharing for sensor images. Journal of Imaging, 11(7):228, 2025. 2 [5] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. FeiFei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 6 [6] J. Deng, J. Guo, N. Xue, and S. Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4690–4699, 2019. 8, 9 [7] E. Dworetzky, E. Kaziakhmedov, and J. Fridrich. Improving steganographic security with source biasing. In Proceedings of the 2024 ACM Workshop on Information Hiding and Multimedia Security, pages 19–30, 2024. 2 [8] M. Elfares, P. Reisert, Z. Hu, W. Tang, R. Küsters, and A. Bulling. Privateyes: appearance-based gaze estimation using federated secure multi-party computation. Proceedings of the ACM on Human-Computer Interaction, 8(ETRA):1–23, 2024. 2 [9] A. Ghosh, A. Saini, and H. Barad. Artificial intelligence in governance: recent trends, risks, challenges, innovative frameworks and future directions. AI & SOCIETY, 40(7):5685–5707, 2025. 1 [10] X. He, M. Zhu, D. Chen, N. Wang, and X. Gao. Diffprivacy: Diffusion-based face privacy protection. IEEE Transactions on Circuits and Systems for Video Technology, 34(12):13164–13176, 2024. 2 [11] F. Hidayat, U. Elviani, G. B. G. Situmorang, M. Z. Ramadhan, F. A. Alunjati, and R. F. Sucipto. Face recognition for automatic border control: a systematic literature review. IEEE Access, 12:37288–37309, 2024. 1 [12] G. B. Huang and E. Learned-Miller. Labeled Faces in the Wild: Updates and New Reporting Procedures. Technical Report UM-CS-2014-003, University of Massachusetts, Amherst, May 2014. 9, 15 [13] M. Hussain, Q. Riaz, S. Saleem, A. Ghafoor, and K.-H. Jung. Enhanced adaptive data hiding method using lsb and pixel value differencing. Multimedia Tools and Applications, 80(13):20381–20401, 2021. 4 [14] Q. Le Roux, E. Bourbao, Y. Teglia, and K. Kallas. A comprehensive survey on backdoor attacks and their defenses in face recognition systems. IEEE Access, 12:47433–47468, 2024. 2 [15] J. Lin, C.-W. Tsai, C.-W. Yang, and K.-H. Liu. A large payload data hiding scheme using scalable secret reference matrix. Symmetry, 14(4):828, 2022. 2 [16] T. Liu, Y. Wang, X. Yan, Y. Huo, and C. Lu. A meaningful (n, n)-threshold visual secret sharing scheme based on qr codes and information hiding. Mathematics, 14(3):405, 2026. 2 [17] W. Liu, Y. Wen, Z. Yu, and M. Yang. Large-margin softmax loss for convolutional neural networks. arXiv preprint arXiv:1612.02295, 2016. 9 [18] Z. Liu, P. Luo, X. Wang, and X. Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pages 3730–3738, 2015. 7

[19] I. Medvedev and N. Gonçalves. Improving performance of facial biometrics with quality-driven dataset filtering. In 2023 IEEE 17th International Conference on Automatic Face and Gesture Recognition (FG), pages 1–8. IEEE, 2023. 6 [20] A. Mohammed and P. Samundiswary. Tamper detection and self-recovery in a visual secret sharing based security mechanism for medical records. IEEE Journal of Biomedical and Health Informatics, 2024. 2 [21] S. Moschoglou, A. Papaioannou, C. Sagonas, J. Deng, I. Kotsia, and S. Zafeiriou. Agedb: The first manually collected, in-the-wild age database. In 2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 1997–2005, 2017. 9, 15 [22] A. Muhammed, J. Marcos, and N. Gonçalves. Federated learning for secure and privacy-preserving facial recognition: Advances, challenges, and research directions. In Iberian Conference on Pattern Recognition and Image Analysis, pages 199–213. Springer, 2025. 2 [23] A. Muhammed, I. Medvedev, and N. Gonçalves. Voidface: A privacy-preserving multi-network face recognition with enhanced security. arXiv preprint arXiv:2508.07960, 2025. 1 [24] A. Muhammed, I. Medvedev, and N. Gonçalves. Voidface: Towards an effective face training data storage and protection with right-to-be-forgotten property. In 2025 IEEE International Joint Conference on Biometrics (IJCB), pages 1–10. IEEE, 2025. 1, 2, 8, 13, 14 [25] A. Muhammed and A. R. Pais. A novel cancelable fingerprint template generation mechanism using visual secret sharing. In International Conference on Pattern Recognition and Machine Intelligence, pages 357–365. Springer, 2021. 1, 2 [26] A. Muhammed and A. R. Pais. Secure latent fingerprint storage and self-recovered reconstruction using pob number system. Pattern Recognition Letters, 167:107–114, 2023. 2 [27] M. Naor and A. Shamir. Visual cryptography. In Workshop on the Theory and Application of of Cryptographic Techniques, pages 1–12. Springer, 1994. 1 [28] N.-B. Nguyen, K. Chandrasegaran, M. Abdollahzadeh, and N.-M. Cheung. Re-thinking model inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16384–16393, 2023. 7 [29] F. Nujumudeen, D. M. N. Mubarak, and T. Hussain. Lightweight xor-based visual cryptography using random shares for secure colour image sharing with minimal shares. Scientific Reports, 15(1):42868, 2025. 2 [30] A. T. Olutimehin, S. Joseph, A. J. Ajayi, O. C. Metibemu, A. Y. Balogun, and O. O. Olaniyi. Future-proofing data: Assessing the feasibility of post-quantum cryptographic algorithms to mitigate ‘harvest now, decrypt later’attacks. Decrypt Later’Attacks (February 17, 2025), 2025. 1 [31] S. L. Pardau. The california consumer privacy act: Towards a european-style privacy regime in the united states. J. Tech. L. & Pol’y, 23:68, 2018. 1 [32] K. Patel, H. Han, and A. K. Jain. Secure face unlock: Spoof detection on smartphones. IEEE transactions on information forensics and security, 11(10):2268–2283, 2016. 1

[33] R. Premlal and B. S. Rajan. On function-correcting codes. IEEE Transactions on Information Theory, 2025. 2 [34] M. Sasaki and Y. Watanabe. Visual secret sharing schemes encrypting multiple images. IEEE Transactions on Information Forensics and Security, 13(2):356–365, 2017. 2 [35] Z. Song, G. Wang, W. Yang, Y. Li, Y. Yu, Z. Wang, X. Zheng, and Y. Yang. Privacy-preserving method for face recognition based on homomorphic encryption. PloS one, 20(2):e0314656, 2025. 2 [36] P. Voigt and A. Von dem Bussche. The eu general data protection regulation (gdpr). A practical guide, 1st ed., Cham: Springer International Publishing, 10(3152676):10– 5555, 2017. 1 [37] J. Wang, R. Xin, O. Alfarraj, A. Tolba, and Q. Tang. Privacy preserving security using multi-key homomorphic encryption for face recognition. Expert Systems, 42(2):e13645, 2025. 1 [38] A. Woubie, E. Solomon, and J. Attieh. Maintaining privacy in face recognition using federated learning method. IEEE Access, 12:39603–39613, 2024. 13 [39] H. Yaish. Forget me, forget me not: Elements of erasure to determine the sufficiency of a gdpr article 17 request. Case W. Res. JL Tech. & Internet, 10:iv, 2019. 1 [40] S. Yang, X. Jia, F. Zou, Y. Zhang, and C. Yuan. A novel hybrid network model for image steganalysis. Journal of Visual Communication and Image Representation, 103:104251, 2024. 8 [41] T. Zheng, W. Deng, and J. Hu. Cross-Age LFW: A Database for Studying Cross-Age Face Recognition in Unconstrained Environments. CoRR, abs/1708.08197, 2017. 9, 15

Supplementary Material – “From Noise to Meaning: Meaningful Secret Sharing with Tamper Detection for Facial Recognition” This supplementary material contains four sections, including the algorithms used, additional security experiments, attack scenarios and interception, and performance analysis. These experiments are conducted to reinforce the effectiveness of the proposed framework.

6. Additional supporting algorithms used Algorithm 4 Salt Derivation using HKDF Require: Master key Km (256 bits), share identifier ID, timestamp T Ensure: Salt σ (128 bits) 1: function D ERIVE S ALT(Km , ID, T ) 2: info = “hash salt” ∥ ID ∥ T 3: σ = HKDF(Km , info, length = 16) 4: return σ 5: end function

Algorithm 5 Hash Position Derivation Require: Master key Km , share identifier ID, timestamp T , image height H, image width W Ensure: Set of 256 positions P = {(xk , yk , ck )}255 k=0 1: function D ERIVE H ASH P OSITIONS( Km , ID, T, H, W ) 2: info = ”hash positions” ∥ ID ∥ T 3: seed = HKDF(Km , info, length = 32) 4: prng = CSPRNG(seed) 5: P=∅ 6: for k = 0 to 255 do 7: x = prng.next() mod H 8: y = prng.next() mod W 9: c = prng.next() mod 3 10: P = P ∪ {(x, y, c)} 11: end for 12: return P 13: end function The Algorithm 4 shows the steps to produce unique 128bit cryptographic salt σ using HMAC-based Key Derivation Function (HKDF) on the master key Km . The algorithm first calculates an info string that combines the string “hash salt”, the share identifier ID, and the timestamp T. This deterministic construction allows the trusted third part or training institutions to reconstruct the identical salt during verification. This is used in the cryptographic hash verification, where it concatenated with secret data S (Algorithm 2 in main document). The salt σ guarantees that identical secret data produce different hashes and protect from

pre-computation attacks and cross-share correlation. Algorithm 6 Depth Map Extraction Require: Meaningful share M (size H × W × C) Ensure: Depth map D (size H × W × C) 1: function E XTRACT D EPTH M AP(M ) 2: H, W, C = dimensions(M ) 3: D = array of zeros(H, W, C) \triangleright Depth map stored in first 2 rows (fixed depth 1) 4: for x = 0 to 1 do 5: for y = 0 to W − 1 do 6: for c = 0 to C − 1 do 7: p = M [x, y, c] 8: D[x, y, c] = p&0x03 \triangleright Extract 2 bits for depth (1-3) 9: D[x, y, c] = D[x, y, c] + 1 10: end for 11: end for 12: end for \triangleright Rest of depth map stored in remaining rows 13: pos = 2 14: for x = 2 to H − 1 do 15: for y = 0 to W − 1 do 16: for c = 0 to C − 1 do 17: if pos < H then 18: p = M [pos, y, c] 19: D[x, y, c] = p&0x03 20: D[x, y, c] = D[x, y, c] + 1 21: end if 22: end for 23: end for 24: pos = pos + 1 25: end for 26: return D 27: end function Algorithm 5 generates 256 positions in each meaningful shares where hash bits are embedded. Here, the info string concatinates “hash positions”, the share identifier ID, and the timestamp T. The algorithm produces 256 bit seed by applying HKDF with the master key Km . This seed generates a cryptographically secure pseudo-random number generator (CSPRNG) produce 256 random triplets. Each triplet with modulo H, W and 3 calculated the coordinates x, y, z. As these positions are uniformly distributed across the shares, makes it hard for an intruder to locate and corrupt the hash without the master key Km . This algorithm also used in Cryptographic Hash Verification (Algorithm 2 in th main paper) to regenerate the same hash embedded

positions. Algorithm 6 calculates the adaptive LSB depth map from the meaningful shares. Here, the deapth maps are stored in the deterministic positions. The algorithm first extract the depth information from first two rows. The remianing depth values are extracted from subsequent rows following a sequential layout. This algorithm is used in both Cryptographic Hash Verification (Algorithm 2) and Adaptive LSB Extraction (Algorithm 3) in the main paper.

7. Additional Security analysis Table 8. Dual-layer tamper detection performance against different attack types

Attack Type

Det. Rate

FPR

Random Bit Flips (1%) Random Bit Flips (5%) Cropping (10% border) Share Substitution JPEG Compression (Q=70) Gaussian Blur (σ=1.0) Adversarial Optimization

99.97% 100.00% 98.3% 100.00% 95.2% 91.8% 94.5%

0.02% 0.02% 0.05% 0.01% 0.10% 0.15% 0.08%

Proof 2 As the embedding procedure is reservable, and with successful dual verification, the extracted Ēi = Ei and ¯ = AS. At XOR reconstruction, P̄i = Ei ⊕ AS = (Pi ⊕ AS AS) ⊕ AS) = Pi Table 9. NPCR values (%) for 1000 distinct shares generated per patch

Left eyebrow 98.89

Right eyebrow 98.87

Left eye 98.60

Right eye 98.79

Nose

Mouth

98.64

98.87

Table 9 shows Number of Pixel Change Rate (NPCR) for 1000 unique VSS shares (meaningless) produced for each facial patch. NPCR values above 98% shows strong encryption resilience, which calculates the pixel-wise difference between two randomly generated shares from the same patch. With NPCR values ranging from 98.60% to 98.89%, all six patches show strong and secure encryption. These findings verify that the proposed technique offers a strong defense against statistical and differential attacks by producing highly randomized shares.

8. Attack scenario and interception The proposed dual-layer tamper detection system shows strong efficacy towards various attack scenarios. Table 8 shows the tamper detection analysis on proposed technique in various attack types. Detection rates for bit-flipping attacks show 99.97–100.00%, accompanied by a small 0.02% false positive rate (FPR). This shows that the cryptographic hash layer effectively detects any bit-level alterations to the embedded secret data. Structural attacks, including share substitution, are identified with complete accuracy, whereas cropping 10% of the image border results in a 98.3% detection rate showing the robust spread-spectrum watermark. Even with JPEG compression (Q=70) and Gaussian blur, detection accuracy exceeds 91%, with false positives remaining below 0.15%. The proposed dual-layer mechanism achieves over 99.9% for direct tampering and over 91% for compression-based attacks, show the possibility of practical deployment. Few significant security therms derived from the proposed technique includes, Theorem 1 Tamper detection: Any tampering to Ei by modifying Mi can be detected with probability 1 − 2−256 . Proof 1 In the proposed technique, the embedded hash hi is deterministic. Any tampering to Ei changes hi and the collision probability is 2−256 . When combines with watermark verification (layer 2), detection probability approaches 1. Theorem 2 Reconstruction fidelity: Any shares that passes the integrity verification, the reconstructed patch P̄i will be identical to original patch Pi

Figure 4 shows the extensive attack scenarios of a distributed FRS, such as VOIDFace [24], Federated learning [38] and proposed technique. The vulnerabilities include at storage institutions (data poisoning and backdoor injection), training workstations (Byzantine attacks, model skewing, backdoor injection, model replacement, and gradient manipulation), and the aggregator (model inversion and membership inference attacks). As VOIDFace lacks integrity verification, a tampered share might lead to a faulty patch reconstruction. This allows corrupted patches to get into training pipeline undetected. This can lead to local model poisoning, gradient skewness, and global model compromise through backdoor or accuracy degradation. The proposed dual layer tamper detection intercepts data poisoning before patch reconstruction. The shares failed in these verification never get into training pipeline while the verified patches contribute to training. Additionally, advanced attacks such as model skewing, backdoor injection, replacement, precision truncation, delayed attacks, and gradient manipulation are to an extend ineffective as a training node without verified shares cannot create a coherent local model. The proposed dual layer verification confirms that the training excludes only the corrupted patch rather than discarding the user sample or incorporating malicious data. Due to this, proposed technique provides a defense in depth (share-level tamper detection, selective patch exclusion during reconstruction, and broken attack chains across the distributed pipeline), as compared to VOIDFace framework.

Figure 4. Attack surface of distributed multi-patch FR data storage and training

9. Additional performance analysis The proposed multi-patch-network framework comprises two principal components: the Patch Training Network (PTN) and the Aggregator. This framework allocates the FR task across patches and subsequently integrates their learned representations into a global embedding. The framework employs six patches thus requires six distinct PTN, each dedicated to analyzing a particular patch. Each PTN consists of a MobileNet backbone CNN that derives distinctive feature embeddings from the corresponding reconstructed patch. These CNNs function concurrently, allowing the model to autonomously acquire region-specific facial characteristics. The outputs of the six PTN (512dimensional feature vectors) are subsequently transmitted to the Aggregator. The Aggregator is executed as a basic fully connected layer, designed to consolidate the patchlevel embeddings into a singular global feature representation of the complete face. This final embedding, also 512dimensional, aims to learn identity-related information by integrating both local and global facial features. In the experiments, we examine two architectural variations of the multi-patch-network framework. Version 1 (V1) employs a single-task learning methodology in which only the Aggregator generates a class prediction and PTN function solely as feature extractors, with supervision of the final integrated embedding occurring exclusively through classification loss. Whereas, Version 2 (V2) implements a multi-task learning framework by incorporating classification heads at the output of each PTN, overseeing both the individual patches and the Aggregator for the identical identity classification task. This patch-level supervision

enhances local discriminative feature learning and delivers more robust training results. Both V1 and V2 schematics are shown in Figure 5. The important advantages of proposed technique in comparison with VOIDFace [24] is the ability to identify tampered patches and omit this for training. In VOIDFace, the patch reconstruction is performed without authentication check, and a tampered share can corrupt a patch. Using such corrupted patch for training causes backpropagation gradient errors, model accuracy loss, unstable convergence, and even targeted backdoor injection. In this experiment, to replicate a realistic tampering scenario, we evaluated the effects of excluding specific patches during inference. This simulate the identification and dismissal of a compromised share after integrity verification. Figure 6 and Figure 7 show the single patch tamper analysis on different benchmark using architecture V1 and V2, respectively. These figures shows that the proposed technique can detect the tampered share using dual layer tamper detection (cryptographic hash and robust watermark) and exclude the tampered patch from training process. This exclusion safeguards the global model from contaminated data while retaining all the other untempered face patch information. This experiment also shows an exclusive analysis on the significant of each patches and illustrates the practical advantage of the proposed technique.

Figure 5. Multi-Patch Training Network architectures. (a) Version 1 (V1) with supervision only on Aggregator. (b) Version 2 (V2) with supervision on both individual PTN and Aggregator.

Figure 6. ROC curves of single patch models on AgeDB-30 [21], LFW [12], and CALFW [41] datasets with architecture V1

Figure 7. ROC curves of single patch models on AgeDB-30 [21], LFW [12], and CALFW [41]datasets with architecture V2

Related documents

• Recognising faces: family, friends and photo-ID#311204
• IMFD: End-to-end Multi-Face Forgery Detection through Instruction-based Large Vision-Language Models#1014281
• Official Review · NEURIPS 2024#787081
• The view-tolerance of human identity recognition depends on horizontal face information.#29829
• Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal#684447