DualPath-CEM

Research code and audited experiment records for Dual-Path Conditional Entropy Defence for Collaborative Face Inference.

DualPath-CEM keeps the protected Slot-CEM spatial encoder developed in the dissertation and adds a compact semantic path. The client releases two noised representations: a 16 x 16 x 16 spatial feature and a 256-dimensional pooled semantic token. The server combines calibrated logits from the two paths. Every reported inversion attacker observes both transmitted tensors.

Reported FaceScrub results

Higher accuracy is better. Higher reconstruction MSE means that inversion is less successful and is therefore better for privacy.

Method	Top-1 accuracy	Decoder MSE, training/inference	GAN MSE, training/inference
Published Noise_ARL+CEM	80.33%	0.0182 / 0.0211	0.0212 / 0.0231
DualPath-CEM	81.96%	0.0265 / 0.0371	0.0310 / 0.0404

The DualPath-CEM row is the mean over target seeds 126-130. Decoder and GAN results use attacker seeds 10125, 20125 and 30125; the adaptive decoder uses a pre-specified single seed. Evaluation covers the training-knowledge and inference-knowledge protocols from CEM. The published comparison values come from Table 3 of Xia et al., CVPR 2025.

The complete machine-readable records are under results/. They contain 70 main attack runs, 15 repeated utility evaluations, 96 supplementary attack runs, the matched-capacity control, and the ResNet-18 backbone control. Raw JSON records are retained so that the aggregates can be recomputed directly.

Repository layout

Path	Contents
src/publication_cem/	Dual-path model, semantic backbones, joint-path attacker, metrics, and reproducibility helpers.
scripts/	Target training, attack training, evaluation, aggregation, and recoverable main/supplementary pipelines.
checkpoints/slot_cem_facescrub/	Frozen Slot-CEM base weights used by every DualPath-CEM run.
results/	Audited summaries, per-target utility records, and per-attacker metrics.
environment/	Frozen Python, PyTorch, torchvision, and CUDA environment.
third_party/	Minimal legacy VGG model definition and the upstream CEM licence.
tests/	Unit and protocol regression tests for the released implementation.

Environment

The formal campaign used Ubuntu, Python 3.11, PyTorch 2.2.2, torchvision 0.17.2, and CUDA 12.1.

conda env create -f environment/conda-linux-64.yml
conda activate publication-cem
python scripts/prefetch_evaluation_assets.py
python scripts/verify_release.py

The verification command checks checkpoint hashes, all machine-readable result files, the five pre-specified comparisons, run counts, and tests. GPU training is not required for this audit.

Data preparation

FaceScrub images are not redistributed. Obtain the dataset separately and prepare the split used by CEM:

python scripts/prepare_cem_facescrub.py \
  --source /path/to/CEM/datasets/facescrub \
  --output data/facescrub

The output must contain train/<identity>/*.jpg and val/<identity>/*.jpg. See DATA.md for the exact released manifest and dataset caveats.

Reproduce the formal campaign

Run the main campaign first:

python scripts/run_dual_path_publication_pipeline.py \
  --data-root data/facescrub \
  --legacy-checkpoint-dir checkpoints/slot_cem_facescrub \
  --stage all --attempts 3 --retry-seconds 60

Then run the matched-capacity and ResNet-18 controls:

python scripts/run_dual_path_supplementary_pipeline.py \
  --data-root data/facescrub \
  --legacy-checkpoint-dir checkpoints/slot_cem_facescrub \
  --stage all --attempts 3 --retry-seconds 60

New runs are written to outputs/; the tracked evidence in results/ is never used as a resume target. Jobs are restartable and their completion state is stored under outputs/state/.

Checkpoints and licensing

The three included Slot-CEM base checkpoints are required to initialise the released experiments. Generated DualPath-CEM and attacker checkpoints are not tracked because they occupy several gigabytes; the code trains them from the included base weights.

New project code is released for academic review and reproducibility under the terms in LICENSE. Third-party notices are listed in THIRD_PARTY_NOTICES.md. FaceScrub remains subject to its own dataset terms.

Citation

Use the software-release metadata in CITATION.cff. Publication metadata can be added after an associated article is accepted.