Compositional Non-Face Re-Identification Pressure

The gap

Privacy is audited one release at a time. Identity is not released one piece at a time.

A dataset ships, a checkpoint ships, an index ships. Each is assessed on its own, and each passes. But every one of them is extra side information about the same people, and side information composes.

We model a deployment as a sequence of releases $Z_1, Z_2, \dots, Z_T$ about a fixed identity universe $\mathcal{U}$. On Market-1501 that sequence is concrete:

R₁an encoder $E_1$ trained on sparse exposure
R₂exposure expansion — add $E_2$ trained on full exposure; state $[E_1,\lambda_2 E_2]$
R₃add a generic public representation $E_3$ (ImageNet ResNet-50)
R₄publish derived artifacts — an identity prototype bank and a $k$NN graph

Nothing here is a privacy failure in the ordinary sense. No release contains a face: every image is masked over its top 20%, removing the head region outright. The identities stay linkable anyway, through clothing, body shape, gait and scene context.

The leaky bucket

Single-release compliance does not bound ecosystem-level risk. The question a vision team should be able to answer is not "is this release safe?" but "how much anonymity has everything we have published, taken together, already cost?"

The metric

Vision Re-Identification Pressure Index

Let $U$ be the identity of a subject, uniform over $N$ identities, and $Z_{1:T}$ everything released so far. vRPI is the anonymity that the release sequence has consumed, measured with Arimoto conditional Rényi entropy:

$$\mathrm{vRPI}_\alpha(T) \;=\; \log N \;-\; H_\alpha\!\left(U \mid Z_{1:T}\right), \qquad H_\alpha(U\mid Z)=\frac{\alpha}{1-\alpha}\log \Phi_\alpha(U\mid Z)$$

where $\Phi_\alpha(U\mid Z) = \mathbb{E}_z\big[\|\Pr(U=\cdot\mid Z=z)\|_\alpha\big]$. It reads in nats: $0$ means the releases told an adversary nothing; $\log N$ means they pinned the identity down. Two properties make it usable rather than merely definable — it cannot go down as you publish more, and it bounds an actual attack.

α = 2

The recommended default. A stable, interpretable collision-style order, not dominated by a single extreme posterior entry.

α = 5, 10

Worst-case auditing. More sensitive to posterior sharpness, so report calibration diagnostics alongside.

The measure is defined on the true posterior induced by the releases, so it is attacker-independent. In practice it is estimated by plugging in a concrete attacker's posterior $\widehat{p}_T(\cdot \mid z_{1:T})$ over the fixed identity set — which makes every measured value a lower bound on the pressure a better adversary could realise.

Non-uniform priors

If identities are not equally likely, $\log N$ is the wrong normaliser, and the prior-normalised index $\mathrm{vRPI}^{\pi}_\alpha(T) = H_\alpha(U) - H_\alpha(U\mid Z_{1:T})$ takes its place. Under a long tail there is simply less anonymity to erode — quantified with a Zipf sweep below.

Theory

Three results that make the index mean something

1. Monotonicity — pressure only rises

For $\alpha > 1$ and any jointly distributed side information, $H_\alpha(U \mid Z, W) \le H_\alpha(U \mid Z)$, so

$$\mathrm{vRPI}_\alpha(T{+}1) \;\ge\; \mathrm{vRPI}_\alpha(T).$$

The proof is a convexity argument on the $\alpha$-norm of the posterior mixture. No independence assumption is needed: a new release can never restore anonymity, whatever its correlation with the ones before it. This is the formal version of the leaky bucket.

2. An exact bridge to guessing probability

$$P_{\mathrm{guess}}(U \mid Z) \;\le\; \Phi_\alpha(U\mid Z) \;=\; \exp\!\left(\tfrac{1-\alpha}{\alpha}H_\alpha(U\mid Z)\right)$$

An information-theoretic quantity is only useful to a practitioner if it says something about what an adversary can do. This one does, directly: pressure upper-bounds the Bayes-optimal single-guess success rate.

3. Additivity holds only in an ideal benchmark — and the gap is measurable

Under conditional independence of the releases given the identity, pressure decomposes additively. Real releases are not conditionally independent, and the shortfall is itself a diagnostic:

$$\Delta_{\mathrm{corr},\alpha} \;=\; \sum_t \widehat{\mathrm{vRPI}}_\alpha(Z_t) \;-\; \widehat{\mathrm{vRPI}}_\alpha(Z_{1:T})$$

A positive $\Delta$ says the releases overlap — summing per-release audits overstates joint pressure, so per-release accounting is not conservative in the direction people assume. Measured on Market: $\Delta_{\mathrm{corr},2} = 0.304$.

Main result

Exposure expansion dominates everything else

The NFLeak protocol runs the release ladder R₁–R₄ against an attacker ladder on Market-1501-Tau — all $N=751$ training identities, closed-world, top-20% masked. Every attacker outputs a posterior over the same 751 identities, so every number below is computed over the same label space, matching the theory.

A₀black-box retrieval — cosine to gallery, log-sum-exp per identity, temperature-scaled softmax
A₁linear probe on frozen release-state features
A₂prototype-index specialist — R₄ only, retrieval against the released bank
A₃MLP probe on frozen features
A₄white-box fine-tuning of the released backbone — R₁–R₃ only

Mean ± std over 3 seeds on **Market-1501-Tau** ($N=751$). R₂ and R₃ use validation-tuned fusion weights and temperature calibration. R₄ introduces released artifacts — a prototype bank and a $k$NN graph — exploited by A₂ and A₀-Graph. Missing rows are missing, not zero: A₂ and A₀-Graph have no artifact to attack before R₄, and A₄ has no trainable backbone at R₄.
Release	Attacker	P_guess	vRPI_1.5	vRPI₂	vRPI₅	vRPI₁₀
R₁	A₀	0.2883 ±.0222	3.9180	4.3319	4.9667	5.1327
R₁	A₁	0.1600 ±.0086	1.2348	1.6561	2.7437	3.1123
R₁	A₃	0.4073 ±.0173	4.3074	4.7231	5.2798	5.4163
R₁	A₄	0.5073 ±.0252	4.6916	5.0912	5.5685	5.6779
R₂	A₀	0.7491 ±.0087	6.1250	6.2119	6.3269	6.3561
R₂	A₁	0.5375 ±.0051	4.5612	4.9997	5.5132	5.6292
R₂	A₃	0.7063 ±.0026	5.7696	5.9402	6.1457	6.1943
R₂	A₄	0.7304 ±.0056	5.8421	6.0133	6.2039	6.2471
R₃	A₀	0.7529 ±.0071	5.7669	5.9271	6.1305	6.1801
R₃	A₁	0.5372 ±.0043	4.5504	4.9917	5.5080	5.6245
R₃	A₃	0.7092 ±.0043	5.7660	5.9368	6.1430	6.1918
R₃	A₄	0.7238 ±.0039	5.8319	6.0060	6.1992	6.2429
R₄	A₀-Graph	0.7366 ±.0076	5.4553	5.6697	5.9486	6.0168
R₄	A₂	0.7519 ±.0070	6.3071	6.3572	6.4274	6.4461

A₀ retrieval A₁ linear A₃ MLP A₄ white-box A₂ prototype index (R₄) A₀-Graph (R₄)

Both quantities move together, and both move almost entirely at one step. R₁→R₂ is exposure expansion; R₂→R₃ adds a generic public encoder and changes little; R₄ adds no new features at all, only published artifacts.

R₁ → R₂ · exposure expansion

Every attacker jumps. The black-box retrieval adversary — the weakest realistic one, needing nothing but the released encoder and the gallery — goes from $P_{\mathrm{guess}} = 0.2883$ to $0.7491$, and vRPI₂ from 4.3319 to 6.2119 against a ceiling of $\log 751 = 6.62$. Simply training the next checkpoint on more of the same people is the single largest privacy event in the sequence.

R₂ → R₃ · the generic channel is stable under calibrated fusion

Adding an ImageNet ResNet-50 leaves attackers flat or marginally better (A₀: 0.7491 → 0.7529; A₃: 0.7063 → 0.7092). With validation-tuned fusion weights and posterior temperatures, appending a generic representation avoids the brittle regressions naive concatenation produces — it neither helps the adversary much nor rescues anyone.

R₄ · artifacts leak on their own terms

R₄ changes no feature state. It only publishes what R₃ already computed. Generic attackers are therefore unchanged — and the specialists those artifacts enable are not: the prototype-index attacker A₂ reaches $P_{\mathrm{guess}} = 0.7519$ at vRPI₂ = 6.3572, the highest value anywhere in the study, and the graph-exploiting A₀-Graph reaches 0.7366. Shipping a derived index is its own disclosure.

Replication

The R₁→R₂ effect is not one dataset and not one protocol

An independent, lighter-weight paired protocol — score-level fusion, a reduced training budget, and a min_imgs_per_id=4 filter so every identity yields a valid exposure/gallery/query triple — reruns the exposure-expansion step on Market and on CUHK03-Tau.

**Absolute magnitudes are not comparable to the main table.** Different fusion, different training budget, different identity filter — hence $N=736$ and $N=700$ rather than 751. The claim this table makes is only the within-protocol paired R₁→R₂ increase, which is positive for both attackers on both datasets.
Dataset	Attacker	N	R₁ P_guess	R₂ P_guess	R₁ vRPI₂	R₂ vRPI₂
Market-1501-Tau	A₀	736	.197	.547	.873	4.966
Market-1501-Tau	A₃	736	.368	.691	5.198	5.943
CUHK03-Tau	A₀	700	.226	.399	.530	3.325
CUHK03-Tau	A₃	700	.313	.502	4.549	4.977

The pattern is the same one, and it is largest exactly where the main experiment says it should be: the black-box retrieval attacker, at the exposure-expansion step, on both datasets.

Diagnostics

Four ways the result could have been an artifact of the setup

Masking more of the head does not help

Sweeping the mask from $\tau = 0$ to 40% of image height — well past the head — barely moves anything. At R₂ the retrieval attacker's vRPI₂ stays within [4.874, 4.909] and the MLP probe's within [5.832, 5.882]; $P_{\mathrm{guess}}$ stays above 0.50 for A₀ and 0.63 for A₃ even at 40%. Removing the face is not a mitigation, because the face was never carrying the signal.

Masking ablation on Market-1501-Tau at R₂, vRPI₂. Removing 40% of every image — twice the head region — leaves the measured pressure essentially unchanged.
Mask τ	0%	10%	20%	30%	40%
A₀ vRPI₂	4.901	4.888	4.909	4.874	4.883
A₃ vRPI₂	5.882	5.832	5.856	5.861	5.879

The effect is not a temperature artifact

Posterior sharpness is a real lever on any Rényi quantity, so the softmax temperature is swept over $\theta \in \{.025, .05, .1, .2, .5, 1.0\}$. The exposure-expansion increase $\Delta\mathrm{vRPI}_2(R_2 - R_1)$ is positive at every temperature — ranging over [0.781, 4.100] for A₀ and [0.567, 0.677] for A₃. The magnitude is calibration-dependent; the sign is not.

The releases overlap, and per-release audits overstate the total

Marginal pressures of $E_1, E_2, E_3$ are 0.884, 4.159 and 0.629; the joint is 5.368, not their sum of 5.672. So $\Delta_{\mathrm{corr},2} = 0.304 > 0$. Summing independent per-release audits is not a conservative approximation of ecosystem risk — it is a different, larger number, and the theory says exactly why.

Long-tailed priors leave less to erode

Under a Zipf($s$) identity prior the available anonymity budget $H_\alpha(U)$ shrinks, and with it the prior-normalised increase: $\Delta\mathrm{vRPI}^{\pi}_2$ falls from 3.818 at $s=0$ (uniform) to 0.123 at $s=1.5$. This is a real caveat on deployment, not a weakness in the measure — when a few identities dominate the prior, an adversary already knew most of what a release could tell them.

Code

Reproduce it

Two notebooks, both run on Kaggle, plus the CSVs behind every published table:

git clone https://github.com/tirth5828/nfleak-eccv2026
cd nfleak-eccv2026

code/01_main_market1501_tau.ipynb          # main table: N=751, R1-R4, A0-A4, 3 seeds
code/02_replication_and_diagnostics.ipynb  # CUHK03 replication + all four diagnostics

You will need Market-1501 and CUHK03 mounted, and to repoint the /kaggle/input/... paths. results/ holds the run the paper reports — the replication table, the masking sweep, the temperature sweep, the dependence-overlap diagnostic and the Zipf normalisation — and supplementary/ holds the extended proofs.

Two runs exist — read this before using `results/`

The experiments were downloaded twice and the folder ended up with two runs side by side, with genuinely different numbers, and the original run_summary.json pointed at the earlier one. Every file now in results/ was checked value by value against the published tables — all sixteen replication values and all four diagnostics match to the last printed digit. The superseded run is preserved under results/superseded-earlier-run/ rather than deleted, so the provenance stays visible.

One gap, stated plainly: the main $N=751$ table is not in results/ at all. Notebook 01 wrote its CSVs inside the Kaggle session and they were never saved out; only the notebook's own cell outputs have them. Reproducing the main table means re-running notebook 01.

2 datasets, 2 protocols
Market-1501-Tau (N = 751 and 736), CUHK03-Tau (N = 700)

4 releases × 5 attackers
R₁–R₄ against A₀, A₁, A₂, A₃, A₄, at α ∈ {1.5, 2, 5, 10}

Compositional Non-Face Re-Identification Pressure

Privacy is audited one release at a time. Identity is not released one piece at a time.

The leaky bucket

Vision Re-Identification Pressure Index

Non-uniform priors

Three results that make the index mean something

1. Monotonicity — pressure only rises

2. An exact bridge to guessing probability

3. Additivity holds only in an ideal benchmark — and the gap is measurable

Exposure expansion dominates everything else

R₁ → R₂ · exposure expansion

R₂ → R₃ · the generic channel is stable under calibrated fusion

R₄ · artifacts leak on their own terms

The R₁→R₂ effect is not one dataset and not one protocol

Four ways the result could have been an artifact of the setup

Masking more of the head does not help

The effect is not a temperature artifact

The releases overlap, and per-release audits overstate the total

Long-tailed priors leave less to erode

Reproduce it

Two runs exist — read this before using `results/`

ECCV 2026, Malmö

BibTeX

Privacy is audited one release at a time. Identity is not released one piece at a time.

The leaky bucket

Vision Re-Identification Pressure Index

Non-uniform priors

Three results that make the index mean something

1. Monotonicity — pressure only rises

2. An exact bridge to guessing probability

3. Additivity holds only in an ideal benchmark — and the gap is measurable

Exposure expansion dominates everything else

R₁ → R₂ · exposure expansion

R₂ → R₃ · the generic channel is stable under calibrated fusion

R₄ · artifacts leak on their own terms

The R₁→R₂ effect is not one dataset and not one protocol

Four ways the result could have been an artifact of the setup

Masking more of the head does not help

The effect is not a temperature artifact

The releases overlap, and per-release audits overstate the total

Long-tailed priors leave less to erode

Reproduce it

Two runs exist — read this before using results/

ECCV 2026, Malmö

BibTeX

Two runs exist — read this before using `results/`