Mitigating Soft-Biometric Leakage in Face Embeddings via Cascaded Uplift and Information Routing

Face recognition systems commonly exchange compact embeddings rather than raw images, yet these representations can disclose sensitive soft-biometric attributes such as gender, age, and race, enabling unauthorized attribute inference. Existing representation-level methods often optimize attribute suppression and identity preservation within a shared pathway, making the two objectives difficult to reconcile. To alleviate this privacy--utility conflict, we propose the Cascaded Uplift and Privacy-aware Information Routing Network (CUPIR-Net), a representation-learning framework that couples coarse-to-fine evidence reduction with controlled information routing. The Cascaded Uplift for Residual Evidence Reduction (CURE) module attenuates group-shared attribute shifts in the original embedding space and suppresses instance-conditioned residual cues in an overcomplete lifted space. From the resulting uplifted embedding, CUPIR-Net derives functionally differentiated identity-preserving and attribute-related representations through two processing pathways and combines them through gated feature fusion during training. A sample-wise Bernoulli gate controls the attribute-related pathway, with its retention probability linearly annealed to zero to mitigate the mismatch between dual-pathway training and deployment based solely on the identity pathway. Experiments on five public datasets assess resistance to gender, age, and race inference using adaptive linear, neural, and tree-based attackers, transfer attacks, and paired white-box inversion attacks. CUPIR-Net attains the highest Privacy-Gain Identity-Loss Coefficient in 43 of 45 dataset--attribute--attacker configurations among the compared methods while preserving competitive verification utility at stringent false accept rates. Additional evaluations indicate the feasibility of jointly protecting two- and three-attribute combinations. These results support deployment-compatible soft-biometric privacy enhancement while indicating reduced residual attribute leakage under stronger attacks.