Vec2Face: Vector-to-Face Synthesis in Recognition

• Vec2Face is a family of methods that convert facial feature vectors into realistic images, either by inverting black-box embeddings or generating synthetic identities.
• The inversion approach employs bijective metric learning and distillation to reconstruct identity-consistent images from face-recognition embeddings with state-of-the-art accuracy.
• The synthetic dataset generation branch uses feature-masked autoencoders and controlled perturbations to create large-scale, privacy-preserving facial datasets for robust training.

Vec2Face denotes a family of vector-to-face synthesis methods in face recognition, but the literature uses the name for two distinct problem settings. The earlier line studies inversion of face-recognition embeddings: given a high-level feature vector extracted by a black-box matcher, it reconstructs a realistic face image that preserves identity. The later line studies synthetic dataset generation: given sampled or perturbed facial feature vectors, it generates images of non-existent identities with controlled inter-class separation and intra-class variation. The name therefore spans DiBiGAN in the original black-box inversion work, DAB-GAN in Vec2Face-v2, the feature-masked-autoencoder-based dataset generator introduced in 2024, and the subsequent Vec2Face+ extension for VFace dataset construction (Duong et al., 2020, Truong et al., 2022, Wu et al., 2024, Wu et al., 23 Jul 2025).

1. Nomenclature and research scope

One common source of confusion is that Vec2Face is not a single static architecture. In the literature, the name is attached to multiple systems that share a vector-conditioned face-synthesis premise but optimize for different end goals. In the inversion setting, the vector is a facial representation produced by a black-box face-recognition engine, and the task is to recover a realistic face consistent with that representation. In the dataset-generation setting, the vector is sampled or perturbed to represent a synthetic identity, and the task is to generate many controllable images suitable for training face-recognition models (Duong et al., 2020, Wu et al., 2024).

Paper	Primary task	Characteristic components
Vec2Face / DiBiGAN (Duong et al., 2020)	Reconstruct faces from black-box FR features	Bijective metric, distillation, feature-conditional progressive GAN
Vec2Face-v2 / DAB-GAN (Truong et al., 2022)	Reconstruct faces from black-box FR features	Attention-based generator, bijective metric, global distillation
Vec2Face (Wu et al., 2024)	Generate synthetic FR training data from sampled vectors	fMAE, image decoder, loosely constrained vectors, AttrOP
Vec2Face+ (Wu et al., 23 Jul 2025)	Generate controlled synthetic datasets	Feature expansion, fMAE, decoder, AttrOP, LoRA-based pose control

This split is substantive rather than terminological. The inversion papers frame Vec2Face as a privacy and security problem for deployed face-recognition systems, whereas the later papers frame it as a method for building large-scale synthetic datasets without relying on class labels or text prompts (Truong et al., 2022, Wu et al., 2024).

2. DiBiGAN and the black-box feature reconstruction problem

The original Vec2Face paper formulates feature reconstruction under a black-box face-recognition engine composed of a feature extractor $F:I\to F$, with images $I\in\mathbb{R}^{W\times H\times C}$ and extracted features $f=F(I)\in\mathbb{R}^M$, and optionally a classifier $C:F\to Y$. The task is: given only the feature vector $f=F(I)$ of some unknown face $I$, synthesize an image $\tilde I$ that looks realistic and shares the same identity as $I$. The generator $G_\theta:F\to I$ is trained through

$$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$

with the explicit constraint that the matcher $I\in\mathbb{R}^{W\times H\times C}$0 is treated as a black box and cannot be back-propagated through (Duong et al., 2020).

To address that constraint, the paper introduces Bijective Generative Adversarial Networks in a Distillation framework, or DiBiGAN. Its first defining element is bijective metric learning. A one-to-one mapping $I\in\mathbb{R}^{W\times H\times C}$1, with $I\in\mathbb{R}^{W\times H\times C}$2, is learned so that distances in image space can be expressed in the latent space $I\in\mathbb{R}^{W\times H\times C}$3. The latent metric is defined as the $I\in\mathbb{R}^{W\times H\times C}$4-Wasserstein distance between Gaussians,

$I\in\mathbb{R}^{W\times H\times C}$5

and an identity-margin variant is imposed to separate different identities while pulling same-identity samples together. In practice, $I\in\mathbb{R}^{W\times H\times C}$6 is implemented as a Real-NVP / coupling-layer network trained with a supervised log-likelihood plus ID-aware Gaussian priors (Duong et al., 2020).

The second element is distillation. Because the original matcher is inaccessible, a white-box student network $I\in\mathbb{R}^{W\times H\times C}$7 is trained to mimic it by minimizing

$I\in\mathbb{R}^{W\times H\times C}$8

The generator is then supervised not only through the final embedding but also through intermediate feature maps,

$I\in\mathbb{R}^{W\times H\times C}$9

This distillation term is intended to maximize the information exploited from the black-box engine and to preserve identity in the reconstructed image (Duong et al., 2020).

The third element is the generator design. DiBiGAN uses a progressive-GAN-style generator with five up-sampling convolutional blocks, a separate feature-conditional branch of 8 fully connected layers that ingest the 512-dimensional feature $f=F(I)\in\mathbb{R}^M$0, AdaIN-based conditional injection at each convolutional block, and a random latent $f=F(I)\in\mathbb{R}^M$1 as the main input. The complete generator objective combines bijective metric, distillation, adversarial, and pixel $f=F(I)\in\mathbb{R}^M$2 reconstruction losses,

$f=F(I)\in\mathbb{R}^M$3

with exponentially scheduled weights across progressive resolutions (Duong et al., 2020).

3. Vec2Face-v2 and the transition to DAB-GAN

Vec2Face-v2 retains the black-box inversion formulation but replaces the CNN-centric generator with an attention-based architecture called DAB-GAN, short for Attention-based Bijective Generative Adversarial Networks in a Distillation framework. The paper preserves the central premises of the original work—bijective metric learning, student-network distillation, WGAN-GP adversarial training, and $f=F(I)\in\mathbb{R}^M$4 reconstruction—but argues that a pure Transformer generator is better suited to capturing global facial structure (Truong et al., 2022).

In DAB-GAN, the generator contains five resolution blocks, each composed of grid-self-attention for long-range context, cross-attention that injects the identity feature $f=F(I)\in\mathbb{R}^M$5 at every scale, and MLP up-projection followed by upsampling. The generator contains no convolutional layers. The discriminator is a multi-scale CNN with five convolutional blocks and minibatch-stddev. At the block level, with patch-sequence input $f=F(I)\in\mathbb{R}^M$6 and identity feature $f=F(I)\in\mathbb{R}^M$7, the model computes

$f=F(I)\in\mathbb{R}^M$8

$f=F(I)\in\mathbb{R}^M$9

$C:F\to Y$0

followed by residual addition, LayerNorm, and MLP refinement. This makes the conditioning signal explicitly available at every resolution rather than only through AdaIN-style modulation (Truong et al., 2022).

The empirical results reported for DAB-GAN are framed as consistent state-of-the-art performance on CelebA, LFW, CFP-FP, CPLFW, AgeDB, and CA-LFW. At $C:F\to Y$1 in black-box reconstruction, DAB-GAN $C:F\to Y$2 distill $C:F\to Y$3 biject achieves MS-SSIM $C:F\to Y$4, Inception Score $C:F\to Y$5, LFW $C:F\to Y$6, CFP-FP $C:F\to Y$7, CPLFW $C:F\to Y$8, AgeDB $C:F\to Y$9, and CA-LFW $f=F(I)$0. In white-box reconstruction, the same configuration yields LFW $f=F(I)$1, CFP-FP $f=F(I)$2, CPLFW $f=F(I)$3, AgeDB $f=F(I)$4, and CA-LFW $f=F(I)$5. The paper also reports cross-matcher evaluation in black-box mode on ArcFace, FaceNet, SphereFace+, MagFace, SCF-ArcFace, and AdaFace, and states that DAB-GAN closes $f=F(I)$6 of the gap to real-face verification accuracy; on ArcFace, for example, real faces obtain $f=F(I)$7 and DAB-GAN reconstructions obtain $f=F(I)$8 (Truong et al., 2022).

These results are significant because they establish that the inversion attack generalizes beyond the training matcher and remains effective under in-the-wild pose, expression, and occlusion variation. The paper therefore treats Vec2Face-v2 not only as a reconstruction method but also as evidence that deployed face-recognition embeddings are vulnerable to inversion, motivating work on private or secure embeddings (Truong et al., 2022).

4. Vec2Face as large-scale synthetic identity generation

The 2024 paper reuses the name Vec2Face for a different objective: synthesizing face images of non-existent persons to create a dataset for training face-recognition models. The paper identifies three goals as essential: realistic face images, a large number of distinct identities for inter-class separation, and proper variation in appearance for each identity as intra-class variation. The method is described as a holistic model that uses only a sampled vector as input and can flexibly generate and control the identity of face images and their attributes (Wu et al., 2024).

Architecturally, the model is composed of a feature masked autoencoder and an image decoder. During training, a frozen pretrained FR network, ArcFace-R100, maps a real face image $f=F(I)$9 to a 512-dimensional feature $I$0. That feature is linearly expanded into a two-dimensional map, randomly row-masked, processed by the fMAE encoder and decoder, and then converted by a lightweight image decoder into a reconstructed image $I$1. The training losses are pixel-wise MSE reconstruction,

$I$2

identity consistency,

$I$3

LPIPS perceptual loss,

$I$4

and an adversarial loss $I$5 from a patch-based discriminator, enabled only after $I$6k epochs. The total loss is

$I$7

At inference, the method skips the FR-and-mask steps and maps a random $I$8-D vector directly through the learned stack to produce a face image (Wu et al., 2024).

Inter-class separation is enforced by sampling identity vectors in PCA space fitted on $I$9-D FR vectors from MS1MV2. Candidates are drawn as

$\tilde I$0

with the constraint

$\tilde I$1

The paper states that in $\tilde I$2-D most random draws already satisfy this constraint, and only $\tilde I$3 are rejected when aiming for $\tilde I$4k identities. Intra-class variation is generated by Gaussian perturbation,

$\tilde I$5

using a mixture in the largest-scale experiments such that $\tilde I$6 of the images use $\tilde I$7, $\tilde I$8 use $\tilde I$9, and $I$0 use $I$1, while maintaining $I$2 (Wu et al., 2024).

The paper also introduces AttrOP, a gradient-descent attribute-control procedure. Starting from an initial vector $I$3, with generated image $I$4, it optimizes

$I$5

and updates $I$6 for $I$7–$I$8 steps. This provides targeted control of pose and quality while preserving identity (Wu et al., 2024).

The scaling claims are central to the paper. Vec2Face is reported to synthesize as many as $I$9K identities, whereas $G_\theta:F\to I$0K is stated as the largest number of identities created in previous works. With $G_\theta:F\to I$1 perturbations per identity, this yields $G_\theta:F\to I$2M total images. The training cost is reported as $G_\theta:F\to I$3 weeks on $G_\theta:F\to I$4 RTX6000 GPUs using $G_\theta:F\to I$5M real images from $G_\theta:F\to I$6k IDs, while inference on a single Titan-Xp runs at $G_\theta:F\to I$7 FPS versus Arc2Face’s $G_\theta:F\to I$8 FPS, with model size $G_\theta:F\to I$9 GB instead of $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$0 GB. On five standard in-the-wild benchmarks, the reported average accuracy rises from $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$1 for HSFace10K to $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$2 for HSFace300K; the scale-up sequence is $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$3, $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$4, $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$5, $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$6, and $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$7 for $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$8k, $$\tilde x = G(F(x);\theta), \qquad \theta^* = \arg\min_\theta E_{x\sim p_I}\bigl[L^x_G(G(F(x);\theta),x)\bigr],$$9k, $I\in\mathbb{R}^{W\times H\times C}$00k, $I\in\mathbb{R}^{W\times H\times C}$01k, and $I\in\mathbb{R}^{W\times H\times C}$02k identities, respectively (Wu et al., 2024).

5. Vec2Face+ and the VFace datasets

Vec2Face+ extends the dataset-generation line by emphasizing identity consistency under increased intra-class variation. It is described as a two-stage, feature-to-image generator trained on face-recognition embedding vectors rather than class labels. At inference, it performs identity sampling, perturbation for intra-class variation, image generation through a trained main model, and optional post-processing via AttrOP or LoRA-based pose control (Wu et al., 23 Jul 2025).

The training objective removes the GAN discriminator and treats the model purely as an image reconstructor: $I\in\mathbb{R}^{W\times H\times C}$03 Here

$I\in\mathbb{R}^{W\times H\times C}$04

$I\in\mathbb{R}^{W\times H\times C}$05

with $I\in\mathbb{R}^{W\times H\times C}$06 a $I\in\mathbb{R}^{W\times H\times C}$07-D ArcFace embedding, and

$I\in\mathbb{R}^{W\times H\times C}$08

where $I\in\mathbb{R}^{W\times H\times C}$09 are VGG features and $I\in\mathbb{R}^{W\times H\times C}$10 are learned channel weights. The paper explicitly states that no adversarial, inter-class separability, or intra-class consistency losses are used; the latter two are enforced by sampling and dataset construction (Wu et al., 23 Jul 2025).

The main model uses feature expansion, fMAE, and a decoder. Its input is a $I\in\mathbb{R}^{W\times H\times C}$11-D feature vector $I\in\mathbb{R}^{W\times H\times C}$12. Feature expansion applies a linear layer $I\in\mathbb{R}^{W\times H\times C}$13, then $I\in\mathbb{R}^{W\times H\times C}$14, producing a $I\in\mathbb{R}^{W\times H\times C}$15-token patch sequence of dimension $I\in\mathbb{R}^{W\times H\times C}$16. The feature-masked autoencoder is based on MAE (ViT-B) with row-wise masking, randomly dropping $I\in\mathbb{R}^{W\times H\times C}$17 of rows, with $I\in\mathbb{R}^{W\times H\times C}$18, and filling them via cross-attention. The image decoder contains four ConvTranspose2d layers that upsample from $I\in\mathbb{R}^{W\times H\times C}$19 to $I\in\mathbb{R}^{W\times H\times C}$20, with channel dimensions $I\in\mathbb{R}^{W\times H\times C}$21, ReLU activations, and final Tanh or sigmoid (Wu et al., 23 Jul 2025).

Identity sampling in Vec2Face+ draws $I\in\mathbb{R}^{W\times H\times C}$22-dimensional vectors $I\in\mathbb{R}^{W\times H\times C}$23 from a zero-mean unit-variance Gaussian and accepts a new sample only if $I\in\mathbb{R}^{W\times H\times C}$24, with $I\in\mathbb{R}^{W\times H\times C}$25. The paper states that in $I\in\mathbb{R}^{W\times H\times C}$26-D space most random draws satisfy this “hollow-sphere” condition, so $I\in\mathbb{R}^{W\times H\times C}$27M identities can be sampled easily. Intra-class variation is then generated by normalized perturbation,

$I\in\mathbb{R}^{W\times H\times C}$28

subject to $I\in\mathbb{R}^{W\times H\times C}$29 (Wu et al., 23 Jul 2025).

The paper retains AttrOP and introduces LoRA-based pose control for profile faces. A $I\in\mathbb{R}^{W\times H\times C}$30-layer CNN encodes a $I\in\mathbb{R}^{W\times H\times C}$31-point landmark map into a $I\in\mathbb{R}^{W\times H\times C}$32 feature map, while low-rank adapters with $I\in\mathbb{R}^{W\times H\times C}$33, where $I\in\mathbb{R}^{W\times H\times C}$34, $I\in\mathbb{R}^{W\times H\times C}$35, and $I\in\mathbb{R}^{W\times H\times C}$36, are inserted into each transformer block’s attention weights. Only $I\in\mathbb{R}^{W\times H\times C}$37 are learned on a small profile-pose dataset, and the original weights remain frozen. At inference, any pair of identity feature and landmark feature yields single-pass generation of profile faces with yaw up to $I\in\mathbb{R}^{W\times H\times C}$38, while the paper states that this preserves identity better than AttrOP and gives generation throughput $I\in\mathbb{R}^{W\times H\times C}$39 faster than AttrOP (Wu et al., 23 Jul 2025).

Quantitatively, Vec2Face+ is used to construct VFace10K, VFace100K, and VFace300K. On the standard five-test average over LFW, CFP-FP, CPLFW, AgeDB-30, and CALFW, the reported average accuracies are $I\in\mathbb{R}^{W\times H\times C}$40 for VFace10K, $I\in\mathbb{R}^{W\times H\times C}$41 for VFace100K, and $I\in\mathbb{R}^{W\times H\times C}$42 for VFace300K, compared with $I\in\mathbb{R}^{W\times H\times C}$43 for CASIA-WebFace. The paper states that this is the first time a synthetic dataset beats the CASIA-WebFace in average accuracy. At the same time, it reports that only $I\in\mathbb{R}^{W\times H\times C}$44 out of $I\in\mathbb{R}^{W\times H\times C}$45 synthetic datasets outperforms random guessing, that is $I\in\mathbb{R}^{W\times H\times C}$46, in twin verification, and that models trained with synthetic identities are more biased than those trained with real identities (Wu et al., 23 Jul 2025).

6. Privacy, bias, and downstream uses

The inversion and dataset-generation branches of Vec2Face sit on opposite sides of the privacy question. The inversion papers show that face-recognition embeddings can be sufficiently informative to support realistic face recovery from black-box features, which the authors explicitly describe as a vulnerability of deployed face-recognition engines and a reason to study embedding-level defenses such as noise, encryption, or partial release (Truong et al., 2022). By contrast, the later synthetic-data papers position vector-conditioned generation as a privacy-preserving alternative to training on real faces, while still acknowledging unresolved issues in leakage, bias, and difficult identity distinctions (Wu et al., 2024, Wu et al., 23 Jul 2025, Borsukiewicz et al., 20 Oct 2025).

The 2025 survey and empirical evaluation of synthetic facial datasets provides a concentrated account of Vec2Face’s privacy and biometric properties. It describes Vec2Face as a public release with $I\in\mathbb{R}^{W\times H\times C}$47 million images of $I\in\mathbb{R}^{W\times H\times C}$48k synthetic identities at $I\in\mathbb{R}^{W\times H\times C}$49 px, and reports that the method discards any generated sample whose maximum cosine similarity to the nearest real image exceeds a threshold $I\in\mathbb{R}^{W\times H\times C}$50; only $I\in\mathbb{R}^{W\times H\times C}$51 of initial samples are reported as removed. In additional experiments against CASIA-WebFace, the bulk of synthetic–real similarities lie below $I\in\mathbb{R}^{W\times H\times C}$52, with a long tail of $I\in\mathbb{R}^{W\times H\times C}$53 outliers above $I\in\mathbb{R}^{W\times H\times C}$54, which the paper states are manually filterable. For intra-class variability and separability, the survey reports genuine mean $I\in\mathbb{R}^{W\times H\times C}$55 std $I\in\mathbb{R}^{W\times H\times C}$56, impostor mean $I\in\mathbb{R}^{W\times H\times C}$57 std $I\in\mathbb{R}^{W\times H\times C}$58, Equal Error Rate $I\in\mathbb{R}^{W\times H\times C}$59, FMR100 $I\in\mathbb{R}^{W\times H\times C}$60, FMR1000 $I\in\mathbb{R}^{W\times H\times C}$61, and FDR $I\in\mathbb{R}^{W\times H\times C}$62. On RFW, the same source reports verification accuracies of $I\in\mathbb{R}^{W\times H\times C}$63 for African, $I\in\mathbb{R}^{W\times H\times C}$64 for Asian, $I\in\mathbb{R}^{W\times H\times C}$65 for Caucasian, $I\in\mathbb{R}^{W\times H\times C}$66 for Indian, and $I\in\mathbb{R}^{W\times H\times C}$67 overall, and notes that Vec2Face does not include explicit demographic balancing at generation time (Borsukiewicz et al., 20 Oct 2025).

A related downstream use appears in a hybrid generative fusion system for competition data construction. There, Stable Diffusion XL produces one reference portrait per synthetic identity, and the cropped reference image is fed to Vec2Face, described as a lightweight decoder that rapidly generates $I\in\mathbb{R}^{W\times H\times C}$68 identity-consistent variants exhibiting controlled changes in pose, illumination, and facial expression while preserving core identity features. This two-stage identity generation yields $I\in\mathbb{R}^{W\times H\times C}$69 images per identity and was part of a first-place solution in the DataCV ICCV Challenge (Li et al., 14 Aug 2025).

Taken together, these works suggest a dual legacy for Vec2Face. In one line, it is a sequence of inversion methods—DiBiGAN and DAB-GAN—that reveal how much identity information can be recovered from black-box face embeddings. In the other, it is a sequence of synthetic-data generators—Vec2Face and Vec2Face+—that use sampled or perturbed feature vectors to construct large-scale face-recognition training sets with controllable identity structure. The shared technical motif is vector-conditioned facial synthesis; the differing significance lies in whether that synthesis is used to invert a representation or to replace real training data with synthetic identities (Duong et al., 2020, Truong et al., 2022, Wu et al., 2024, Wu et al., 23 Jul 2025).