How to identify faces in the cloud without exposing biometric data

Biometric information isn't like a password. You can't reset your face if a server gets breached. Once someone has the mathematical signature of your facial features, they have it forever.

AccioPix uses homomorphic encryption to identify faces in photos without ever seeing your biometric data. This is a walk through what that phrase means, how a computer can match two faces while both stay scrambled, and what the approach costs in exchange for the privacy it buys.

What is homomorphic encryption?

Homomorphic encryption lets you perform calculations on encrypted data without decrypting it first. The concept was first proposed by Craig Gentry in 2009 and has since evolved into practical implementations. It's like reaching into a locked box to perform a task without ever seeing the contents. The result remains encrypted until the final decision is made.

Normal encryption is all-or-nothing. To do anything useful with a value that has been scrambled, you decrypt it, work on the plaintext, and encrypt it again. Homomorphic encryption breaks that rule. Certain math operations you run on the ciphertext map cleanly onto the same operations on the hidden plaintext, so when you finally decrypt the answer, it matches what you would have gotten by working on the raw numbers directly.

There are a few flavours, and the difference matters. Partially homomorphic schemes support one kind of operation without limit. Paillier, for instance, lets you add encrypted numbers but not multiply them freely. Somewhat homomorphic schemes handle both addition and multiplication, but only for a limited number of steps before the result degrades. Fully homomorphic encryption, the class Gentry cracked open, supports arbitrary combinations of both. Modern lattice-based schemes such as BFV, BGV, and CKKS sit in this family, and CKKS is built for approximate arithmetic on real numbers, which is exactly the shape of a machine-learning vector.

The security rests on lattice problems, specifically a hardness assumption called Ring Learning With Errors. In plain terms, each ciphertext carries a small amount of deliberate noise, and recovering the plaintext without the secret key means solving a lattice problem that stays computationally infeasible at the sizes these schemes use. That noise is also the catch, and it comes back when we talk about cost.

Why this matters for biometric data

Standard encryption protects your data at rest and in transit. But the moment a system needs to compare two faces, traditional approaches must decrypt the data first. That decryption window, even if it lasts milliseconds, creates a vulnerability. If an attacker compromises the server during processing, they get raw biometric data.

Homomorphic encryption removes this window. The comparison happens while the data stays encrypted. The server never sees the actual face embeddings. It computes a similarity score on ciphertext and returns the result. This is different from the "encryption at rest" that most photo platforms advertise, which still exposes plaintext the instant real work needs to happen.

How face matching runs on encrypted embeddings

To see why this works for faces specifically, it helps to know what a face becomes inside these systems. A face-recognition model turns each face into an embedding: a long list of numbers, often 128 or 512 of them, that describes the geometry of that face as a single point in space. Two photos of the same person produce embeddings that sit close together; two different people sit far apart. We cover that step in detail in how face recognition actually works.

Matching two faces, then, is measuring the distance or angle between two of these number lists. The common measure is cosine similarity, and underneath it is a dot product: multiply the two vectors element by element, then add up the results. Multiplication and addition are precisely the two operations a fully homomorphic scheme can run on ciphertext. That is the whole trick. Because the similarity score is built from adds and multiplies, the server can compute it on encrypted embeddings and never touch a plaintext face.

Key management is what makes this private rather than just clever. You hold the secret key. Your device encrypts your selfie's embedding and sends only the ciphertext. The server holds a separate evaluation key that lets it do arithmetic on encrypted values but cannot decrypt them. It runs the comparison, produces an encrypted similarity score, and sends that back. Only the holder of the secret key can read the final number, so at no point does a readable face vector exist on the server.

The AccioPix workflow

1. Extraction: We detect faces and generate embeddings (mathematical maps).
2. Encryption: Embeddings are immediately encrypted using homomorphic schemes (BFV/Paillier).
3. Storage: Only encrypted data hits our database. Raw embeddings are discarded.
4. Matching: When you send a selfie, we compare it to stored data while both are encrypted.

What happens if the server is breached?

This is the question that separates homomorphic encryption from standard security practices. With traditional face recognition platforms, a server breach exposes readable biometric data: face embeddings that can be used to identify individuals across any other system that uses the same kind of model. The damage is permanent because you can't change your face the way you reset a password.

With AccioPix's homomorphic approach, an attacker who compromises the database gets encrypted ciphertext, essentially random numbers that are computationally infeasible to reverse. Without the decryption keys, which never reside on the same server, the stolen data is worthless. Zero usable biometric information leaks.

The trade-offs of encrypted matching

None of this is free, and pretending otherwise would be dishonest. Homomorphic encryption is slow. Running a computation on ciphertext is commonly hundreds to thousands of times heavier than the same computation on plaintext, because every operation is really a chunk of lattice arithmetic on large polynomials. A dot product a normal server would finish in microseconds takes meaningfully longer once both inputs are encrypted.

The data gets bigger too. A ciphertext is far larger than the plaintext it hides, so an encrypted embedding takes more memory and more bandwidth to move around than the raw vector would. That expansion is the price of carrying the noise and structure that keep the scheme secure.

Then there is the noise budget. Each homomorphic operation adds a little more noise to the ciphertext, and once it crosses a threshold the result can no longer be decrypted correctly. Schemes handle this by limiting how many operations you can chain, or by running an expensive step called bootstrapping that resets the noise so computation can continue. Bootstrapping is powerful and also one of the most compute-hungry parts of the whole field. Approximate schemes like CKKS add another wrinkle: they trade exact answers for close-enough ones, so precision has to be managed carefully to keep a similarity score trustworthy.

The reason to accept all of this is narrow but real. For most data, standard encryption plus careful access control is enough, and homomorphic encryption would be overkill. Biometric data is the exception. It is permanent, it identifies you across every system that uses the same kind of model, and a single breach of readable embeddings cannot be undone. Spending extra compute so those numbers never sit in the clear is a reasonable trade when the alternative is a leak you can never take back.

The compliance advantage

India's Digital Personal Data Protection Act (DPDPA) 2023 classifies biometric data as sensitive personal data requiring heightened protection. The EU's GDPR takes a similar stance under Article 9. For event photographers serving corporate clients, particularly multinational companies, being able to show that biometric data is never exposed during processing is more than a nice-to-have. It is a requirement many traditional platforms cannot meet, because their pipelines decrypt embeddings to compare them.

The point is not speed for its own sake. When a platform can find your photos without ever holding a readable copy of your face, privacy stops being a promise in a policy document and becomes a property of the system itself. That is the difference worth paying for.

If you're the photographer covering the event

For the photographer, none of this cryptography is something you operate. You upload the gallery once and AccioPix handles the matching and delivery. Guests send a selfie, the encrypted comparison runs, and each person receives only the photos they appear in, at full resolution. That removes the slow part of the job: the "can you send me just my photos?" messages that trickle in for weeks, and the hours lost sorting a shared folder by hand.

The business case is simple. Faster delivery and self-serve galleries mean happier clients and more referrals, and every guest who pulls their own photos sees your name on the delivery. Pricing is credit-based rather than a monthly subscription, so a 500-photo event runs about ₹100 in credits, which you only spend on events you actually shoot. There is a fuller breakdown of how photographers turn this into repeat work in our guide to growing a photography business, and the workflow specifics live on our photography page.

Homomorphic encryption FAQs

What is homomorphic encryption in simple terms?

It is a form of encryption that lets a computer do math on scrambled data without unscrambling it first. You lock your numbers, send them off, and the server can add and multiply them while they stay locked. When you decrypt the result, it matches what you would have gotten from the original numbers. For face matching, that means a similarity score can be calculated without the server ever seeing your actual face data.

Can facial recognition run on encrypted data?

Yes. A face becomes a vector of numbers, and comparing two faces comes down to multiplying and adding those numbers to get a similarity score. Fully homomorphic encryption supports exactly those operations on ciphertext, so the comparison can run on encrypted embeddings. The server computes an encrypted score and returns it, and only the holder of the secret key can read the final result.

Why is homomorphic encryption slower than standard encryption?

Because every operation on encrypted data is really heavy lattice arithmetic on large values, and each step adds noise that eventually has to be cleared with an expensive process called bootstrapping. Encrypted values are also much larger than the plaintext they hide, so they take more memory and bandwidth. The result is computation that can be hundreds of times slower than working on plaintext, which is why it is reserved for data that genuinely needs it.

Is my biometric data safe if AccioPix gets breached?

An attacker who reaches the database finds encrypted ciphertext, not readable face vectors. Without the decryption keys, which do not live on the same server, that data is computationally infeasible to reverse and effectively worthless. Because the embeddings are never stored in plaintext, a breach leaks no usable biometric information.