- Training-set size dominates. The number of training identities has the largest effect on member/non-member separability, while backbone architecture and loss head contribute far less. Training on more identities is the only design choice we tested that substantially reduces the geometric membership signal.
- Cross-domain benchmarks inflate the signal. Non-member benchmarks that differ in pose, quality, age, or ethnicity conflate domain shift with training-attributable differences and overstate the apparent membership signal; privacy audits should use a same-domain held-out reference.
- Fusion recovers more. Even at high identity counts, where individual statistics are weak, fusing all four statistics with a learned classifier recovers additional membership information beyond the best single statistic.
- A lower bound. Because these statistics capture only cluster geometry, the measured separability is a lower bound on the membership information available from the embeddings.
Quantifying Training Membership Information in the Hyperspherical Embedding Geometry of Face Recognition Models
Abstract
Face recognition models represent each face as an embedding vector on the unit hypersphere by clustering embeddings of the same identity while pushing different identities apart through angular-margin losses. Because these losses act only on training identities, non-member identities may form clusters with different geometric properties. In this paper, we quantify the magnitude of this difference and what training-time factors control it. We compute four statistics based on cluster geometry across 180 face recognition models in a factorial design over IResNet backbone size, loss head, training duration, and the number of training identities, and evaluate each configuration on nine benchmarks. Our results indicate that the number of training identities has the largest effect on member/non-member separability, while backbone and loss head contribute far less, and that, on a same-domain held-out reference, the geometric membership signal decreases monotonically as more identities are added to training. We provide an analysis of cross-domain (pose, age, quality, ethnicity) non-member benchmarks and report that these inflate the apparent membership signal. Finally, we fuse all four statistics with a learned classifier to reveal additional membership information beyond the best individual statistic.
Key findings
Method
We treat membership inference as a measurement problem. An auditor queries a face recognition model \(f\) with \(k \geq 2\) probe images of a target identity and obtains the \(\ell_2\)-normalised embeddings. From the resulting cluster we compute four per-identity geometric statistics, each capturing a different aspect of cluster shape:
Pairwise cosine similarity (PairCos). The mean cosine similarity over pairs of embeddings within the identity, \[ \bar{s} = \binom{k}{2}^{-1} \sum_{i \lt j} \cos(e_i, e_j). \] Higher values indicate a more coherent cluster.
vMF concentration (\(\kappa\)). We model the per-identity embedding distribution as a von Mises–Fisher distribution on the unit hypersphere and estimate the concentration \(\kappa\) via the closed-form approximation of Banerjee et al., \[ \hat{\kappa}_0 = \frac{\bar{R}\,(d - \bar{R}^2)}{1 - \bar{R}^2}, \qquad \bar{R} = \left\| \tfrac{1}{k}\sum_{i=1}^{k} e_i \right\|, \] where \(d = 512\) is the embedding dimensionality and \(\bar{R}\) is the mean resultant length. Higher \(\hat{\kappa}\) corresponds to greater directional concentration.
Penalised logit (PenLogit). A leave-one-out estimate of the margin-penalised logit the training loss would assign. For each embedding \(e_i\), the prototype \(\hat{w}_{\backslash i}\) is the \(\ell_2\)-normalised mean of the remaining \(k-1\) embeddings, and \[ \ell_i = s \cdot g\!\left(\cos\angle(e_i, \hat{w}_{\backslash i}),\, m\right), \qquad \bar{\ell} = \tfrac{1}{k}\sum_i \ell_i, \] where \(s\) and \(m\) are the loss-head scale and margin and \(g\) is the head-specific penalisation (e.g. \(g(\cos\theta, m) = \cos(\theta + m)\) for ArcFace).
Prototype softmax cross-entropy (ProtoCE). A surrogate of the training loss. Each identity is given a class prototype \(\hat{w}_y = \mu/\|\mu\|\) and all other identities are treated as negatives, \[ \mathcal{L}_y = -\log \frac{\exp\!\big(s\,g(\cos\theta_y, m)\big)} {\exp\!\big(s\,g(\cos\theta_y, m)\big) + \sum_{j \neq y} \exp(s\cos\theta_j)}, \] and we report \(-\mathcal{L}_y\) so that higher values indicate membership.
PairCos and vMF-\(\kappa\) require only the embeddings (black-box access); PenLogit and ProtoCE additionally use the loss scale \(s\) and margin \(m\) (grey-box access). For each statistic we quantify member/non-member separability by the AUC of a threshold classifier — the probability that a randomly chosen member scores higher than a randomly chosen non-member — as our primary measure of the membership information a statistic carries. We compute these statistics across 180 models trained on WebFace4M in a factorial design over IResNet backbone size, angular-margin loss head, training duration, and number of training identities, and evaluate each configuration on nine benchmarks, including a same-domain held-out reference.
Main results
Verification performance and membership separability at epoch 40. Sub-rows: E = EER; C = PairCos, \(\kappa\) = vMF-\(\kappa\), L = PenLogit, S = ProtoCE (AUC). Green = low EER / high AUC, red = high EER / low AUC; cyan = \(n_\mathrm{ids}{=}\)all AUC \(\geq 0.8\); bold = best per backbone. Lower EER means better recognition, and higher AUC means more membership leakage. The bottom block (ViT-T) is a cross-architecture generality check.
Score distributions
(a) IR-100 / MagFace / 100K identities.
(b) IR-100 / MagFace / 1K identities.
(c) IR-100 / MagFace / epoch 40.
PairCos (\(\bar{s}\)) kernel density estimates. The bold black curve (with shading) shows member identities (present in the training set). All other curves show non-member identities — the eight thin solid lines correspond to cross-distribution benchmarks whose domain differs from the training data (one colour per dataset, see legend), while the dashed line (“Within-dist”) shows non-members from the held-out WebFace4M split, which shares the training domain (no domain shift). (a, b) vary training epochs at fixed \(n_\mathrm{ids}\); (c) varies \(n_\mathrm{ids}\) at epoch 40.
BibTeX
@misc{ozturk2026quantifying,
title = {Quantifying Training Membership Information in the Hyperspherical
Embedding Geometry of Face Recognition Models},
author = {{\"O}zt{\"u}rk, {\"U}nsal and Marcel, S{\'e}bastien},
year = {2026},
eprint = {2607.15084},
archivePrefix = {arXiv},
primaryClass = {cs.CV},
url = {https://arxiv.org/abs/2607.15084}
}