Research map / Federated learning and privacy / Privacy attacks and secure learning
Disguise without Disruption: Utility-Preserving Face De-identification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Disguise, a face-swapping-based de-identification method that replaces identity vectors with differentially private synthetic identities (MLP or VED transforms) and preserves utility via mixture-of-experts feature supervision.
Problem
Face de-identification that irreversibly hides identity while preserving utility attributes (landmarks, gaze, expression) needed for downstream tasks, with formal privacy guarantees.
Approach
Extract identity via an ensemble of face recognizers, transform it with a differentially private variational encoder-decoder (or MLP) into a synthetic identity far from the original, inject it into a SimSwap-based face swapper, and add a utility loss from mixture-of-experts gaze/emotion models on intermediate features.
Key results
- Ours (arc, mlp, eye) and VED variants reduce average TPR@FPR=1e-3 on LFW to 0.02% (vs 33.3% for Password and 4.9% for DeepPrivacy) with verification accuracy at 50%.
- Ours achieves SER-FIQ of 0.90 versus 0.77 for original images and 0.54-0.69 for baselines.
- On WFLW landmark training, the model trained on Disguise-anonymized data reaches NME .047 versus .039 for original data and .055-.058 for DeepPrivacy/CIAGAN.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use Disguise with VED identity transformation | Face de-identification on LFW · LFW | average TPR @ FPR=10^-3: 1.6 -> 0.02 | Helped |
| use Disguise with VED identity transformation | Face de-identification on LFW · LFW | SER-FIQ: 0.68 -> 0.90 | Helped |
| replace opposite-ID transformation with VED transformation (ablation) | Disguise (ArcFace identity expert) · LFW | TPR @ FPR=1e-3 (FaceNet, inverted): 67.03 -> 13.03 | Helped |
| replace VED identity transformation with MLP (ablation) | Disguise (ArcFace identity expert) · LFW | TPR @ FPR=1e-3 (FaceNet, inverted): 13.03 -> 52.90 | Hurt |
| increase MLP noise from β=0.0 to β=0.9 (ablation) | Disguise with MLP identity transformation · LFW | TPR @ FPR=1e-3 (FaceNet, swapped): 0.00 -> 5.90 | Hurt |
| increase MLP noise from β=0.0 to β=0.9 (ablation) | Disguise with MLP identity transformation · LFW | TPR @ FPR=1e-3 (FaceNet, inverted): 52.90 -> 3.07 | Helped |
| increase VED noise from α=1.0 to α=3.0 (ablation) | Disguise with VED identity transformation · LFW | TPR @ FPR=1e-3 (FaceNet, inverted): 13.03 -> 5.37 | Helped |
| increase VED noise from α=1.0 to α=3.0 (ablation) | Disguise with VED identity transformation · LFW | TPR @ FPR=1e-3 (FaceNet, swapped): 0.03 -> 0.37 | Hurt |
| replace VED identity transformation with MLP (ablation) | Disguise (ArcFace identity expert, gaze utility expert) · LFW | landmark L2 pixel distance (RetinaFace, all): 12.9 -> 17.3 | Hurt |
| use emotion utility experts instead of gaze utility experts (ablation) | Disguise (ArcFace identity expert, VED) · LFW | emotion accuracy (DAN): 46.2 -> 58.8 | Helped |
| use gaze utility experts instead of emotion utility experts (ablation) | Disguise (ArcFace identity expert, VED) · LFW | gaze MAE° (L2CS-Net pitch): 7.4 -> 6.8 | Helped |
| combine ArcFace and AdaFace identity experts instead of ArcFace alone (ablation) | Disguise with MLP transformation · LFW | TPR @ FPR=1e-3 (FaceNet, inverted): 52.90 -> 36.70 | Helped |
Surprising findings
- Using only Laplace noise on identity vectors yields barely obfuscated images, showing the learned transforms are necessary.
- AdaFace-only pipelines show higher re-identification rates than other ID extractors, and combining extractors mitigates this.
Limitations
- Tailored to face obfuscation and does not address other identity-revealing attributes such as glasses, haircuts, or backgrounds.
- Trade-off: stronger privacy noise lowers de-identification rate; multiple ID extractors slightly degrade utility accuracy.
- Sometimes struggles with out-of-distribution images such as poor lighting, causing utility loss.
Experimental setup
Datasets: VGGFace2 LFW CelebA-HQ WFLW
Benchmarks: LFW CelebA-HQ WFLW
Metrics: TPR @ FPR=1e-3 verification accuracy L2 pixel distance NME MAE emotion accuracy SER-FIQ
Baselines: DeepPrivacy DeepPrivacy2 CIAGAN Password RePaint
Builds on: SimSwap DeepPrivacy CIAGAN RiDDLE
Closest papers by meaning
- How Private is Private? A Comparative Study for Face De-Identification (NeurIPS 2026 · similarity 0.90)
- Privacy-Preserving Optics for Enhancing Protection in Face De-Identification (CVPR 2024 · similarity 0.88)
- Privacy-Preserving Face Recognition Using Trainable Feature Subtraction (CVPR 2024 · similarity 0.88)
- Balancing Privacy and Performance: A Many-in-One Approach for Image Anonymization (AAAI 2025 · similarity 0.86)
- Enhancing Facial Privacy Protection via Weakening Diffusion Purification (CVPR 2025 · similarity 0.86)
- $\text{ID}^3$: Identity-Preserving-yet-Diversified Diffusion Models for Synthetic Face Recognition (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.