Organizations: Elmore Family School of Electrical and Computer Engineering, Purdue University, West Lafayette, 47907, Indiana, USA · Electrical and Computer Engineering, University of Michigan, Ann Arbor, 48109, Michigan, USA · Edwardson School of Industrial Engineering and the Department of Computer Science, Purdue University, West Lafayette, 47907, Indiana, USA
Recent advances in generative image editing have enabled transformative applications, from professional head shot generation to avatar stylization. However, these systems often require uploading high-fidelity facial images to third-party models, raising concerns around biometric privacy, data misuse, and user consent. We propose a privacy-preserving pipeline that supports high-quality editing while keeping users in control over their biometric data in face-centric use cases. Our approach separates identity-sensitive regions from editable image context using on-device segmentation and masking, enabling secure, user-controlled editing without modifying third-party generative models. Unlike traditional cloud-based tools, PRIVATEEDIT enforces privacy by default: biometric data is never exposed or transmitted. This design requires no access to or retraining of third-party models, making it compatible with a wide range of commercial APIs. By treating privacy as a core design constraint, our system supports responsible generative AI centered on user autonomy and trust. The pipeline includes a tunable masking mechanism that lets users control how much facial information is concealed, allowing them to balance privacy and output fidelity based on trust level or use case. We demonstrate its applicability in professional and creative workflows and provide a user interface for selective anonymization. By advocating privacy-by-design in generative AI, our work offers both technical feasibility and normative guidance for protecting digital identity. The source code is available at https://github.com/Dipeshtamboli/PrivateEdit-Privacy-Preserving-GenAI.
Figures & tables
Fig. 1: Quantification of privacy gains. (A) Overview of our pipeline; (B) Conceptual depiction of privacy threat and masking; (C) Attribute classification performance on masked versus unmasked images, using Gemini, Grok, and LLaMA. Metrics include accuracy, precision, recall, and F1-score. Error bars denote standard deviation across models.
Method
Face‐FID
Cosine
CLIP
Privacy
Input
0.00
1.00
0.25
NA
GPT (No Privacy)
517.05
0.39
0.30
✗
GPT Reconstructed
683.04
0.12
0.30
✓
Ours
226.50
0.77
0.29
✓
TABLE I: Quantitative comparison of Face‐FID, Cosine similarity, and CLIP alignment. Lower Face‐FID and higher Cosine indicate better facial similarity; higher CLIP reflects better alignment with the “studio headshot” prompt. “Privacy” indicates biometric preservation (✓), not preserved (✗), or NA.
Mask Ratio
Face-FID
Cosine
CLIP
Age
Mustache
Beard
Brown Eyes
Gender
0.60
198.40
0.83
0.31
0.71
0.62
0.66
0.58
0.89
0.75
212.10
0.81
0.30
0.64
0.51
0.57
0.44
0.87
0.90
221.30
0.78
0.29
0.56
0.41
0.48
0.29
0.85
1.00
226.50
0.77
0.29
0.52
0.36
0.50
0.21
0.84
TABLE II: Ablation study on the effect of mask ratio in PrivateEdit . Face-FID, Cosine similarity, and CLIP score measure visual fidelity and task alignment (higher cosine / clip and lower Face-FID are better). Privacy is quantified via attribute inference F1-scores (lower is better). Decreasing the mask ratio improves editability but increases biometric leakage.
TABLE III: Mean Opinion Scores (MOS) from User Study ( N=10 ). Scores on a 5-point Likert scale (mean ± std. dev). Higher is better.
Fig. 2: Qualitative comparison of privacy‐preserving face edits. Each row corresponds to a different input image (leftmost column), followed by three edited versions: “GPT (No Privacy)” (second column), “GPT (Reconstruction)” (third column), and our method (“Ours (Face Re‐integration)”, rightmost column). Beneath each image, we report Face‐FID (FID), Cosine similarity (COS), and CLIP score (CLIP) relative to the prompt “Convert this image into a professional studio headshot.”
The widespread deployment of face recognition (FR) systems exposes personal images shared on social media and public platforms to identity linkage and privacy risks. Existing adversarial privacy protection methods can degrade unauthorized FR performance but are not compatible with generative face editing. Artificial intelligence-driven face editing tools are gaining popularity, which has significantly increased user demand for personalized portrait generation and social sharing. However, current editing methods often preserve identity features, making the edited images still susceptible to tracking by malicious FR systems. Thus, this paper proposes Flux-Guard, a privacy-preserving face editing framework based on adversarial attacks, which integrates face editing and privacy protection within a unified generative process. Specifically, we design a flow trajectory control method to align semantic manipulations with the generative process and introduce latent-space adversarial optimization with an adaptive perceptual-loss-driven weighting strategy, dynamically adjusting adversarial strength to maximize attack effectiveness while preserving visual quality. Extensive experiments demonstrate that Flux-Guard supports face editing while significantly improving attack success rates against cross-domain face recognition models on the CelebA-HQ and LADN datasets. Furthermore, evaluation results for commercial APIs have confirmed its effectiveness in real-world applications. The code is released at https://github.com/JLMWang/Flux-Guard.
Jie Wang, Tao Wang, Ru Zhang +1
School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, 100876, China · Nanjing University of Aeronautics and Astronautics, NanJing, China
The proliferation of facial recognition (FR) systems has raised privacy concerns in the digital realm, as malicious uses of FR models pose a significant threat. Traditional countermeasures, such as makeup style transfer, have suffered from low transferability in black-box settings and limited applicability across various demographic groups, including males and individuals with darker skin tones. To address these challenges, we introduce a novel facial privacy protection method, dubbed MAP, a pioneering approach that employs human emotion modifications to disguise original identities as target identities in facial images. Our method uniquely fine-tunes a score network to learn dual objectives, target identity and human expression, which are jointly optimized through gradient projection to ensure convergence at a shared local optimum. Additionally, we enhance the perceptual quality of protected images by applying local smoothness regularization and optimizing the score matching loss within our network. Empirical experiments demonstrate that our innovative approach surpasses previous baselines, including noise-based, makeup-based, and freeform attribute methods, in both qualitative fidelity and quantitative metrics. Furthermore, MAP proves its effectiveness against an online FR API and shows advanced adaptability in uncommon photographic scenarios.
Generating and editing a person's face demands high precision, as even minor modifications can significantly alter a subject's perceived identity. Current personalization and editing methods built on general-purpose text-to-image models, however, often lack the precision required for fine-grained facial edits. We present a method for fine-grained identity tuning in text-to-image personalization models. Unlike standard image editing, which operates on a given image, identity tuning modifies the latent representation of a specific identity, enabling the generation of diverse images that consistently depict the same edited identity. To enable fine-grained latent identity tuning, we explore the latent space of a pre-trained, frozen encoder for text-to-image personalization. Our approach requires no additional training. Instead, it leverages the existing architecture of a frozen encoder to uncover latent semantic directions. This space consists of a set of latent tokens that play distinct roles in capturing different aspects of an identity and often correspond to specific spatial or semantic facial regions. We show that meaningful directions can be identified within this space and within subspaces defined by selected tokens, enabling localized, fine-grained, and semantically coherent edits. We validate our approach through qualitative and quantitative experiments that demonstrate diverse localized facial edits while preserving cross-image identity consistency. Project page at: https://garibida.github.io/IdentityTuning/
Daniel Garibi, Ronen Kamenetsky, Hadar Averbuch-Elor +2