1. Introduction

Facial-recognition technology has become trivially accessible. Through open-source libraries such as InsightFace (ArcFace) and the Hugging Face model hub (ViT), a single developer can integrate state-of-the-art face embeddings into a product in an afternoon. That accessibility democratizes a powerful capability — and simultaneously distributes its risks to teams that may have neither the resources nor the awareness to audit what these models encode.

The central concern of this project is demographic leakage: the degree to which a model's embedding vector — a numeric fingerprint of a face — carries recoverable information about a sensitive attribute such as race, even when the model was never trained to represent it. Leakage matters because embeddings rarely stay put. They are stored, compared, clustered, and shipped between services. If race is recoverable from an embedding, then any system that retains those vectors is, in effect, processing racial data — frequently without the operator realizing it, documenting it, or obtaining consent for it.

These are not abstract risks. Face embeddings increasingly underpin consequential systems across sectors:

• Finance: Know-Your-Customer (KYC) and identity verification, where disparate error rates can translate into unlawful profiling or denied access.
• Healthcare: patient-intake kiosks, where misidentification can cause privacy breaches or clinical errors.
• Retail & customer service: camera-based loyalty programs and "smart" kiosks that may entrench discriminatory treatment.
• Energy, manufacturing & agriculture: site access and operator verification, where systematic failures can disadvantage specific groups.

This study has two goals: (1) to quantify and visualize demographic bias in the embeddings of two leading open-source models, and (2) to translate those measurements into practical, regulation-aware guidance for the small teams most likely to deploy them without a dedicated fairness review.

2. Background: ArcFace (CNN) vs. ViT (Transformer)

The two models embed faces into high-dimensional vector spaces using fundamentally different architectures and training objectives.

ArcFace is a convolutional network trained specifically for face recognition with an additive angular-margin loss that maximizes the angular separation between identities. Because its entire objective is to tell individuals apart, ArcFace embeddings strongly encode identity — and, as a by-product, often carry demographic signal. I use the buffalo_l checkpoint shipped with InsightFace, which produces 512-dimensional unit-norm embeddings.

ViT-Base is a Vision Transformer pretrained on ImageNet-21k for general image understanding, not faces. It divides an image into patches and attends over them, learning broad visual features with no identity- or demographic-specific objective. I take the [CLS] token of vit-base-patch16-224-in21k as a 768-dimensional embedding and L2-normalize it so cosine geometry is comparable to ArcFace.

The contrast is the point: one model is purpose-built for faces and explicitly optimized to separate people; the other is a generic feature extractor that has never seen a face-recognition label. Comparing their leakage isolates how much demographic encoding is intrinsic to learned visual representations versus introduced by face-specific training.

3. Data & Methodology

3.1 Dataset

I use a race-balanced subset of FairFace (Kärkkäinen & Joo, 2021), a dataset explicitly constructed for balanced representation across race, gender, and age. Streaming the dataset, I retain the first 1,000 images for each of its seven race categories — Black, East Asian, Indian, Latino Hispanic, Middle Eastern, Southeast Asian, and White — for 7,000 images total. The balance is deliberate: it removes sample-size confounds so that any measured separability reflects the embeddings, not skewed class priors.

FairFace's seven categories are a coarse social construct, not ground truth about individuals. The object of study here is leakage of a labeled, sensitive attribute, not an endorsement of these categories as natural kinds.

3.2 Pipeline

Each image is aligned and cropped to 112×112 with MTCNN, then embedded twice — once by ArcFace and once by ViT. Of 7,000 images, MTCNN successfully aligned 6,821. From the resulting embeddings I compute three families of measurements:

• Directional leakage — the cosine gap (mean within-race similarity minus mean between-race similarity), 5-nearest-neighbor race-recovery accuracy, and a full-data linear-probe AUC.
• Held-out separability — a stratified 70/30 split with a cross-validated L2-regularized one-vs-rest logistic probe, scored on unseen data. This is the most honest measure of how reliably race can be inferred.
• Geometry & detector fairness — per-group within-race cosine similarity, 2-D UMAP projections, and the MTCNN alignment keep-rate per group (a fairness check on the pipeline itself, not just the models).

4. Results & Discussion

4.1 Race is linearly recoverable from both embeddings

The headline result is unambiguous: a simple linear probe recovers race from both embedding spaces with high reliability on held-out data. Per-group one-vs-rest AUC ranges from 0.73 to 0.95, with macro averages of 0.85 (ArcFace) and 0.90 (ViT) against a 0.5 chance baseline.

Two findings deserve emphasis. First, the general-purpose ViT leaks more than the face-specialized ArcFace on every group but one. A model never trained on faces, never given an identity label, still encodes race more legibly than a model engineered specifically to distinguish people. This suggests that demographic structure is woven into generic visual features themselves, not merely introduced by face-recognition training. Second, leakage is uneven across groups: some demographics (e.g., Black, East Asian) are far more inferable than others (e.g., Latino Hispanic), meaning the privacy and disparate-impact risk is itself unequally distributed.

4.2 Directional leakage and embedding geometry

A telling difference appears in within-race cosine similarity. ViT clusters same-group faces tightly (0.27–0.34), while ArcFace spreads them apart (0.07–0.09). This is exactly what ArcFace's angular-margin training is designed to do — push individual identities away from one another — yet race remains linearly recoverable from ArcFace at 0.85 AUC despite that dispersion. The demographic signal is not a side effect of faces simply being close together; it is encoded along specific, learnable directions. The UMAP projections (Figure 3) make the structure visible: both spaces show demographic organization, with ViT showing notably more coherent group regions.

4.3 Detector and alignment fairness

MTCNN's alignment keep-rate stayed in a tight band of 0.965–0.984 across all seven groups, so the upstream face detector is not a major source of disparity in this study — the leakage lives in the embeddings, not in who gets detected. Even so, in a large-scale deployment, sub-percentage differences in detection success compound into materially different failure rates across groups, and would themselves warrant monitoring under anti-discrimination obligations.

4.4 A corrected input-normalization bug

The lesson generalizes beyond this project: preprocessing bugs can silently weaken a model's apparent behavior, and a fairness audit is only as trustworthy as the inputs feeding it. Reproducing and inspecting the data path is part of the audit, not a preliminary to it.

5. Regulatory & Compliance Implications

The demonstrated presence of recoverable demographic signal in both embedding families has direct consequences for any regulated deployment:

• GDPR (EU), Article 9. Racial or ethnic origin is special-category data whose processing is restricted absent explicit consent or a specific legal basis. Embeddings from which race is recoverable at 0.85–0.90 AUC can pull a system into this scope even if race is never explicitly collected, potentially triggering a Data Protection Impact Assessment (Art. 35).
• CCPA (California). Biometric information and the inferences drawn from it must be disclosed, minimized, and made subject to opt-out. Demographic inferences derivable from stored embeddings should be documented and governed accordingly.
• NIST AI Risk Management Framework. The AI-RMF calls for measuring, mapping, and managing fairness risk before deployment. The metrics in this report are an example of exactly the kind of measurement the framework expects — and of the bias it expects teams to surface.

6. Recommendations for Small Teams

1. Measure leakage before shipping. A held-out linear probe over a balanced sample is cheap and decisive; make it a standard pre-deployment gate.
2. Treat embeddings as sensitive data. "We don't store race" is not a defense when the vectors you do store make race recoverable. Apply the same retention, access, and disclosure controls you would to explicit demographic data.
3. Prefer the least-capable model that meets the need. A general-purpose backbone is not automatically "safer" than a task-specific one — here the generic ViT leaked more. Evaluate, don't assume.
4. Audit the whole pipeline, not just the model. Preprocessing and detection steps carry their own fairness and correctness risks (Section 4.4).

7. Limitations

• "Race" is FairFace's coarse 7-way annotation, not a measurement of identity; results describe leakage of that label, nothing more.
• 1,000 images per group is sufficient to demonstrate clear effects but is not a population sample; absolute magnitudes will shift with more data.
• The probes here are linear. Non-linear attacks would likely extract more, so these figures are best read as a lower bound on recoverability.
• Findings characterize two specific checkpoints; other models and versions will differ and should be measured individually.

8. Conclusion

Both a face-specialized CNN and a general-purpose transformer encode race in their embeddings strongly enough that a trivial linear model recovers it on unseen data — at 0.85 and 0.90 AUC respectively, with the general-purpose model leaking more. Demographic information is more intrinsic to learned visual representations, and more easily extracted, than a casual integrator would assume. As these freely available tools spread into finance, healthcare, retail, and industrial settings, explicit bias measurement should become a standard, documented step before deployment — both to meet the expectations of GDPR, CCPA, and the NIST AI-RMF, and simply to use this technology responsibly. The tools are excellent; the obligation is to handle what they quietly encode with care.

References