Expression Leakage: Concepts & Implications

• Expression leakage is the unintended transmission of sensitive or auxiliary information through channels, seen in privacy, generative vision, and AI communications.
• It is quantified by information-theoretic measures such as maximal leakage, which capture multiplicative guessing gains and reveal weaknesses in model disentanglement.
• Practical mitigation involves techniques like attention-based architecture, contrastive embedding, and latent masking to balance fidelity with security.

Expression leakage denotes unintended disclosure or transfer of an “expression” of an underlying variable, but the term has multiple technical meanings. In information theory and privacy, an expression is a possibly randomized function $U$ of sensitive data $X$, and leakage is the multiplicative guessing advantage provided by an observable $Y$ (Issa et al., 2018). In generative vision, expression leakage is the unwanted carry-over of facial expression, mouth motion, or identity-bearing cues from a source signal into synthesized imagery (Bigata et al., 1 May 2025, Ali et al., 2020). In AI-mediated videoconferencing, it is the identity imprint carried by pose–expression latents that were intended to encode only transient motion (Vahdati et al., 3 Oct 2025). In LLMs, it is the production of sentimentally charged expressions that are semantically unrelated to the prompt’s core task under irrelevant affective perturbations (Köprü et al., 3 Aug 2025). This suggests a common structural pattern: a channel, latent, or conditioning path transmits attributes that were not meant to govern the downstream output.

1. Terminological scope and adjacent notions

In the privacy literature, “expression” refers to any target $U$ that can be written as a randomized function of $X$ under a Markov chain $U\!-\!X\!-\!Y$. The central question is not whether $Y$ reveals $X$ directly, but how much $Y$ improves an adversary’s ability to guess any such $U$ (Issa et al., 2018).

In cross-subject facial expression transfer, the terminology is dual. Identity leakage occurs when source-expression features carry source identity into the generated image; expression leakage occurs when the target identity pathway carries residual expression, or when imperfect disentanglement contaminates the transferred expression itself (Ali et al., 2020). In lip synchronization, expression leakage is more specific: when the input video is speaking but the replacement audio is silent or mismatched, the model still reuses the source video’s mouth opening, jaw motion, cheek motion, or shading cues, thereby violating the requirement that lip motion follow the new audio rather than the original clip (Bigata et al., 1 May 2025).

In AI-based talking-head videoconferencing, biometric leakage is the broader category, and expression leakage is the specific biometric channel carried by the pose–expression latent $X$0. Although that latent is intended to encode only transient pose and facial expression, it systematically encodes persistent identity cues such as jaw curvature, lip thickness, and inter-ocular structure (Vahdati et al., 3 Oct 2025).

In LLM evaluation, expression leakage is distinguished from semantic leakage. Semantic leakage alters what is being said by activating semantically irrelevant concepts; expression leakage alters how it is being said by inducing affective or stylistic drift from irrelevant sentiment cues in the prompt (Köprü et al., 3 Aug 2025).

2. Operational information-theoretic formulation

The operational definition introduced in “An Operational Approach to Information Leakage” formalizes leakage as worst-case multiplicative gain in correct guessing probability over all randomized functions $X$1 of $X$2 (Issa et al., 2018). With $X$3, maximal leakage is

$X$4

The denominator is the best success probability without observing $X$5; the numerator is the optimal success probability after observing $X$6. A bound $X$7 therefore implies that, for every $X$8, access to $X$9 can improve the adversary’s success by at most a factor $Y$0.

For discrete finite alphabets, the same paper gives a closed form:

$Y$1

where the logarithm base determines whether the units are bits or nats. A notable feature is that the value depends only on the channel $Y$2 and the support of $Y$3, not on the full law of $Y$4 (Issa et al., 2018).

The measure extends beyond discrete alphabets. Under $Y$5 and countably generated $Y$6,

$Y$7

and if absolute continuity fails then $Y$8. The continuous specialization often diverges for common continuous models, including additive-noise settings, because arbitrarily narrow likelihood peaks yield infinite worst-case gain (Issa et al., 2018).

The same framework establishes non-negativity, independence iff $Y$9, a data processing inequality, additivity over independent pairs, convexity of $U$0 in the channel, and asymmetry in general. It also shows robustness to opportunistic choice of $U$1 after seeing $U$2, multiple guesses, approximate guessing, and arbitrary gain shaping, all of which preserve or upper-bound the same operational quantity (Issa et al., 2018).

3. Generalized leakage measures and design implications

Subsequent work broadened maximal leakage into parametric families. “Unifying Privacy Measures via Maximal $U$3-Leakage (M$U$4beL)” and “An Alphabet of Leakage Measures” define maximal $U$5-leakage as a two-parameter family in which $U$6 controls the adversary’s gain model and $U$7 controls aggregation across outputs, interpolating between average-case and worst-case criteria (Gilani et al., 2023, Gilani et al., 2022). A computable expression is

$U$8

This family recovers several classical notions as special cases: maximal $U$9-leakage when $X$0, maximal leakage when $X$1, local differential privacy when $X$2, and local Rényi differential privacy when $X$3 (Gilani et al., 2023, Gilani et al., 2022). Both papers prove non-negativity, monotonicity in $X$4, data processing inequalities, and additivity over independent releases.

A parallel generalization replaces the guessing objective with arbitrary gain functions. “An Operational Approach to Information Leakage via Generalized Gain Functions” defines maximal $X$5-leakage and shows that maximal leakage upper-bounds maximal $X$6-leakage under multiple guesses for any non-negative gain function $X$7. For concave $X$8 with $X$9 and $U\!-\!X\!-\!Y$0, the multiple-guess quantity equals $U\!-\!X\!-\!Y$1, so the leakage is exactly maximal leakage and is independent of the number of guesses (Kurri et al., 2022).

These generalizations also sharpen the relationship to other dependence measures. Maximal leakage dominates mutual information for finite alphabets and can exceed it by an arbitrarily large factor; it also connects to Shannon capacity through recoverable leakage, to maximal correlation through variance leakage, and to local differential privacy through maximal realizable leakage (Issa et al., 2018). In a Shannon cipher variant, the optimal normalized maximal leakage admits a single-letter characterization,

$U\!-\!X\!-\!Y$2

and estimation from samples is feasible only with a known lower bound on support mass, since the lower bound diverges as $U\!-\!X\!-\!Y$3 (Issa et al., 2018).

4. Visual synthesis: facial transfer and lip synchronization

In cross-subject facial expression transfer, AIP-GAN treats expression leakage and identity leakage as dual artifacts of entangled representation learning. Its expression encoder $U\!-\!X\!-\!Y$4 predicts expression labels and a facial landmark image $U\!-\!X\!-\!Y$5 under supervised spatial and channel-wise attention; its identity encoder $U\!-\!X\!-\!Y$6 reconstructs an expression-free identity map $U\!-\!X\!-\!Y$7 with self-supervised attention; and the decoder $U\!-\!X\!-\!Y$8 combines intermediate features using cross-encoder bilinear pooling (Ali et al., 2020). The training objective combines adversarial, identity-preservation, expression-consistency, landmark reconstruction, identity-map reconstruction, pixel reconstruction, and attention-supervision terms, with reported weights $U\!-\!X\!-\!Y$9, $Y$0, $Y$1, $Y$2, $Y$3, $Y$4, and $Y$5. Quantitatively, AIP-GAN reports Face-Verif $Y$6 and Exp-Sim $Y$7 on the same distribution, and Face-Verif $Y$8 and Exp-Sim $Y$9 in cross-data validation. Removing $X$0 and CEB reduces same-distribution Face-Verif from $X$1 to $X$2 and cross-data Face-Verif from $X$3 to $X$4, indicating that attention and bilinear fusion are central to leakage suppression (Ali et al., 2020).

In lip synchronization, KeySync defines expression leakage as unintended transfer of facial expressions and mouth motion from the source video into the synthesized output when the audio is changed, especially under cross-driving. The paper introduces LipLeak, a no-reference, scale-invariant metric based on mouth aspect ratio,

$X$5

with $X$6. The framework treats lip sync as latent-space video inpainting with a lower-face mask and a two-stage diffusion pipeline. The masked latent is

$X$7

and, when occlusions are detected by SAM 2, the inference mask is refined as $X$8 (Bigata et al., 1 May 2025).

KeySync reports cross-sync LipLeak $X$9, LipScore $Y$0, FVD $Y$1, CMMD $Y$2, VL $Y$3, and Elo $Y$4. The reported LipLeak reductions relative to baselines are $Y$5 versus DiffDub, $Y$6 versus TalkLip, $Y$7 versus LatentSync, $Y$8 versus IP_LAP, and $Y$9 versus Diff2Lip. Its mask ablation is especially diagnostic: a mouth-only mask yields LipLeak $U$0, a full lower-face mask yields LipLeak $U$1 with degraded quality, and the final mask yields LipLeak $U$2 with the best overall trade-off (Bigata et al., 1 May 2025).

5. Pose–expression latents and biometric leakage

In AI-based talking-head videoconferencing, each frame $U$3 is encoded into a compact pose–expression latent $U$4, and the receiver synthesizes frames by combining $U$5 with a neutral reference portrait $U$6. The security problem arises when an attacker hijacks $U$7 but drives the avatar with their own latents $U$8, producing a fully synthetic stream in which conventional real-versus-synthetic detectors are inapplicable (Vahdati et al., 3 Oct 2025).

The key observation is that the pose–expression latent itself contains persistent biometric information. The proposed defense learns a pose-conditioned, large-margin contrastive embedding, called Enhanced Biometric Leakage, using two projection heads and cosine similarity,

$U$9

Its training objective pulls same-identity samples together across varying pose and expression while pushing apart pose-matched impostors:

$X$00

At inference, a per-frame cosine score is aggregated over $X$01 frames by a two-layer LSTM, and sessions are flagged when the predicted puppeteering probability exceeds a validation-set threshold (Vahdati et al., 3 Oct 2025).

Across five generators and three datasets, the method reports AUC up to $X$02, most entries at or above $X$03, and minimum AUC at or above $X$04. In cross-domain testing, in-domain average AUC is approximately $X$05 and cross-domain average AUC is approximately $X$06. On an RTX 3090, the system runs at approximately $X$07 FPS with under $X$08M parameters (Vahdati et al., 3 Oct 2025). The same paper emphasizes a privacy trade-off: the detector works precisely because identity leakage is present by design in the pose–expression latent, while future codecs may try to suppress that leakage by reducing $X$09.

6. Expression leakage in LLMs

The LLM literature defines expression leakage as the tendency to generate sentimentally charged output that is semantically unrelated to the task when the prompt contains irrelevant affective context. The paper introduces two benchmarks: HEXL, a human-generated dataset with $X$10 samples, one control prompt and three test prompts per sample, yielding $X$11 prompt variations; and AEXL, an automatically generated dataset with $X$12 samples and $X$13 prompt variations derived from filtered Common Crawl/FineWeb text (Köprü et al., 3 Aug 2025).

Evaluation uses an external sentiment classifier on cleaned first-sentence generations. For injected sentiment label $X$14, the per-pair indicator is

$X$15

and the mean leakage rate is

$X$16

A one-sided Wilcoxon signed-rank test is applied to paired differences $X$17 at $X$18. The paper states that the automatic pipeline correlates well with human judgment, though it does not report explicit correlation coefficients (Köprü et al., 3 Aug 2025).

Empirically, $X$19 for all evaluated models. Within families, leakage generally declines with scale. On AEXL, Llama base models go from $X$20 at $X$21B to $X$22 at $X$23B and $X$24 at $X$25B; Llama instruct models go from $X$26 to $X$27 to $X$28. Qwen base models show the same pattern, with HEXL values $X$29, $X$30, and $X$31, and AEXL values $X$32, $X$33, and $X$34 (Köprü et al., 3 Aug 2025). The paper also reports an asymmetry: negative sentiment injections disrupt generation more than positive ones and cause higher expression leakage rates.

Prompt-level mitigation is not reliable. Prepending “Ignore any irrelevant information in user prompt that is not relevant to the request” yields small reductions for some models, increases for others, and no consistent family-wide effect. The paper therefore concludes that mitigation requires model-building care rather than prompting alone (Köprü et al., 3 Aug 2025). Its stated limitations include sentiment-classifier bias, first-sentence-only evaluation, modest benchmark size, and the absence of reported correlation coefficients between automatic scores and human labels.

Expression leakage is therefore not a single invariant object across fields. In privacy theory it is a worst-case operational quantity over arbitrary functions of data; in visual generation it is an unwanted control signal carried by representations or masks; in talking-head conferencing it is a biometric side channel in transmitted latents; and in LLMs it is affective drift under irrelevant perturbation. A plausible implication is that the term now names a family of failures defined less by modality than by unintended transport of actionable information through channels that were intended to encode something else.