Research map / Architectures and efficiency / Attention and transformers
Facial Identity Anonymization via Intrinsic and Extrinsic Attention Distraction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a face anonymization method that distracts intrinsic identity attention (CAM-based feature-space distraction of a face classifier) and extrinsic attention (instance-level probabilistic delegate sampling for appearance and geometry), then synthesizes faces with a conditional GAN.
Problem
Face anonymization methods either change identity-independent attributes excessively or protect identity insufficiently, failing to achieve a good privacy-utility tradeoff.
Approach
Anonymize identity in feature space by distracting CAM-based identity attention of a pretrained face classifier, and anonymize visual clues (appearance and geometry) by sampling instance-level delegates via a differential-privacy-style probabilistic sampler, so the generator only needs to synthesize high-utility images.
Key results
- Ours achieves ReID 0.0% (ArcFace cos>0.30) and 0.1% (FaceNet l2<0.9) with IDS 34.9% for FaceNet l2<1.0 versus PIFD 58.6%, while keeping attribute preservation around 76.8% average.
- Top-1 distraction removes over 75% of identity information according to the ablation curves, and K between 2 and 4 is recommended.
- On VggFace2 and LFW, Ours reports the best attribute preservation (75.6 and 80.9) and LPIPS/SSIM among compared methods in the authors' tables, while maintaining low ReID.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| remove IFA (ablation) | Ours · CelebA-HQ test | ReID rate (ArcFace, cos >0.30): 0.1 -> 45.5 | Hurt |
| remove IFA (ablation) | Ours · CelebA-HQ test | Attribute preservation: 76.8 -> 88.0 | Helped |
| remove VAA (ablation) | Ours · CelebA-HQ test | Attribute preservation: 76.8 -> 77.2 | Hurt |
| remove GSA (ablation) | Ours · CelebA-HQ test | Attribute preservation: 78.2 -> 76.8 | Helped |
| remove GSA (ablation) | Ours · CelebA-HQ test | ReID rate (ArcFace, cos >0.30): 0.1 -> 0.2 | No clear effect |
| remove VAA (ablation) | Ours · CelebA-HQ test | ReID rate (ArcFace, cos >0.30): 0.1 -> 0.2 | No clear effect |
| replace IFA with random delegate (ablation) | IFA · CelebA-HQ test | Attribute preservation: 79.1 -> 79.7 | Mixed |
| replace IFA with k-th farthest neighbor (ablation) | IFA · CelebA-HQ test | Attribute preservation: 79.1 -> 79.2 | No clear effect |
| replace GSA with random delegate (ablation) | GSA · CelebA-HQ test | Attribute preservation: 86.6 -> 79.9 | Hurt |
| replace GSA with k-farthest neighbor (ablation) | GSA · CelebA-HQ test | Attribute preservation: 86.6 -> 80.2 | Hurt |
| remove appearance utility function ua (ablation) | Ours · CelebA-HQ test | Attribute preservation: 76.8 -> 72.3 | Hurt |
| remove geometry utility function ug (ablation) | Ours · CelebA-HQ test | Attribute preservation: 76.8 -> 77.7 | Hurt |
Surprising findings
- Pixelation and blurring are reported as easily identifiable as protected because the content destruction signals protection to observers.
- Generative methods show high IDS rates (over 45%) in the human study, suggesting identity intrusion remains a problem.
Limitations
- Struggles to preserve some attributes such as ethnic and eye gaze direction.
- Identity intrusion (IDS) rates remain notable, e.g. 34.9% to 58.6% depending on the verifier and threshold.
- Increasing K can change expression or age, reducing data utility.
Experimental setup
Datasets: CelebA-HQ VggFace2 LFW
Benchmarks: CelebA-HQ VggFace2 LFW
Metrics: ReID rate IDS rate attribute preservation accuracy LPIPS SSIM face detection rate human ReID and IDS rate
Baselines: CIAGAN PIFD DeepPrivacy DeepPrivacy2 LDFA FALCO Riddle Blurring Pixelation IdentityDP
Builds on: Grad-CAM FaceShifter DeepPrivacy StyleGAN-style conditional generation (pix2pixHD-style GAN) differential privacy exponential mechanism
Closest papers by meaning
- PerceptAnon: Exploring the Human Perception of Image Anonymization Beyond Pseudonymization for GDPR (ICML 2024 · similarity 0.80)
- Towards a Simultaneous and Granular Identity-Expression Control in Personalized Face Generation (CVPR 2024 · similarity 0.79)
- Foundation Cures Personalization: Improving Personalized Models’ Prompt Consistency via Hidden Foundation Knowledge (NeurIPS 2025 · similarity 0.79)
- DreamSalon: A Staged Diffusion Framework for Preserving Identity-Context in Editable Face Generation (CVPR 2024 · similarity 0.79)
- Disguise without Disruption: Utility-Preserving Face De-identification (AAAI 2024 · similarity 0.79)
- ReGenHuman: Re-Generating Human Appearances for Realistic Full-Body Video Anonymization (NeurIPS 2026 · similarity 0.79)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.