Research map / Federated learning and privacy / Privacy attacks and secure learning
Visual privacy and face de-identification
Obfuscate faces and private content in images while keeping utility.
39 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Privacy attacks and secure learning, keyword cluster “preserving · vfl · encryption”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
10 papers in 2023–24 and 15 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 7.6% to 10.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · Privacy-CNH: A Framework to Detect Photo Privacy with Convolutional Neural Network using Hierarchical Features (AAAI 2016 · 63 citations)
- 2018 · Connecting Pixels to Privacy and Utility: Automatic Redaction of Private Information in Images (CVPR 2018 · 87 citations)
- 2019 · VizWiz-Priv: A Dataset for Recognizing the Presence and Purpose of Private Visual Information in Images Taken by Blind People (CVPR 2019 · 101 citations)
- 2020 · Overlearning Reveals Sensitive Attributes (ICLR 2020 · 79 citations)
- 2021 · Perceptual Indistinguishability-Net (PI-Net): Facial Image Obfuscation With Manipulable Semantics (CVPR 2021 · 44 citations)
- 2022 · Privacy Preserving Partial Localization (CVPR 2022 · 10 citations)
- 2023 · PateGail: A Privacy-Preserving Mobility Trajectory Generator with Imitation Learning (AAAI 2023 · 25 citations)
- 2024 · Privacy-Preserving Face Recognition Using Trainable Feature Subtraction (CVPR 2024 · 33 citations)
- 2025 · BrainGuard: Privacy-Preserving Multisubject Image Reconstructions from Brain Activities (AAAI 2025 · 9 citations)
- 2026 · Protego: User-Centric Pose-Invariant Privacy Protection Against Face Recognition-Induced Digital Footprint Exposure (CVPR 2026 · 1 citation)
Earliest papers here
- Privacy-CNH: A Framework to Detect Photo Privacy with Convolutional Neural Network using Hierarchical Features (AAAI 2016 · 63 citations)
- Connecting Pixels to Privacy and Utility: Automatic Redaction of Private Information in Images (CVPR 2018 · 87 citations)
- VizWiz-Priv: A Dataset for Recognizing the Presence and Purpose of Private Visual Information in Images Taken by Blind People (CVPR 2019 · 101 citations)
What has been tried
28 papers here report 316 measured changes (a component added, removed or swapped, compared with a baseline): helped 62%, no clear effect 5%, hurt 30%, mixed 2%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add high-dimensional residue r as the recognition model input instead of decoded spatial residue R′ | CFP-FP · accuracy | 53.85 -> 98.27 | Helped | Privacy-Preserving Face Recognition Using Trainable Feature Subtraction (CVPR 2024 · 33 citations) |
| replace opposite-ID transformation with VED transformation | LFW · TPR @ FPR=1e-3 (FaceNet, inverted) | 67.03 -> 13.03 | Helped | Disguise without Disruption: Utility-Preserving Face De-identification (AAAI 2024 · 22 citations) |
| Add the face heatmap to the framework | CelebA-HQ · DIS (FR) | 0.851 -> 0.847 | No clear effect | Privacy-Preserving Optics for Enhancing Protection in Face De-Identification (CVPR 2024 · 14 citations) |
| Add PSC | LFW · PSI | 97.34 -> 97.55 | Helped | Validating Privacy-Preserving Face Recognition under a Minimum Assumption (CVPR 2024 · 10 citations) |
| use the complete hybrid synchronization strategy rather than no synchronization | NSD test · PixCorr | .163 -> .313 | Helped | BrainGuard: Privacy-Preserving Multisubject Image Reconstructions from Brain Activities (AAAI 2025 · 9 citations) |
| Add data and learning-efficiency contributions to gradient contribution | PDFE · accuracy | 96.89 -> 98.35 | Helped | Breaking Data Silos in Parkinson’s Disease Diagnosis: An Adaptive Federated Learning Approach for Privacy-Preserving Facial Expression Analysis (AAAI 2025 · 7 citations) |
| add channel augmentation (CA) | SYSU-MM01 CI · rank-1 | 27.51 -> 39.47 | Helped | From Laboratory to Real World: A New Benchmark Towards Privacy-Preserved Visible-Infrared Person Re-Identification (CVPR 2025 · 7 citations) |
| add Hilbert Transform data augmentation | CIFAR-100, Places365, and DomainNet-Cl 5-shot · accuracy | 80.37 -> 81.98; 35.27 -> 35.31; 64.59 -> 65.03 | Helped | Split Adaptation for Pre-trained Vision Transformers (CVPR 2025 · 2 citations) |
| Use FRO with ResNet-101 rather than ResNet-50 | Market-1501 · mAP | 61.8 -> 65.7 | Helped | Balancing Privacy and Performance: A Many-in-One Approach for Image Anonymization (AAAI 2025 · 1 citation) |
| add PLDA feature domain adaptation | DAIR-V2X DS · AP0.5 | 68.0 -> 81.5 | Helped | Privacy-Preserving V2X Collaborative Perception Integrating Unknown Collaborators (AAAI 2025 · 1 citation) |
What reviewers will expect
Datasets and baselines named in the 11 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Baselines
- FedAvg · 2 of 11 papers
- FedProx · 2 of 11 papers
- MOON · 2 of 11 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 25 papers; from OpenAlex and the papers' affiliations).
- Tsinghua University · 3 papers
- Nanyang Technological University · 2 papers
- Zhejiang University · 2 papers
- University of Oulu · 2 papers
Use it
Download BibTeX of 34 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Encryption-based private learning (105 papers)
- Private federated aggregation (50 papers)
Elsewhere in the topic
- Defending federated learning against poisoning (76 papers)
- Gradient inversion attacks (47 papers)
- Membership inference and auditing (47 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).