The widespread sharing of face images on social media platforms and in large-scale datasets raises pressing privacy concerns, as biometric identifiers can be exploited without consent. Face anonymization seeks to generate realistic facial images that irreversibly conceal the subject's identity while preserving their usefulness for downstream tasks. However, most existing generative approaches focus on identity removal and image realism, often neglecting facial expressions as well as photometric consistency -- specifically attributes such as illumination and skin tone -- that are critical for applications like relighting, color constancy, and medical or affective analysis. In this work, we propose a feature-preserving anonymization framework that extends DeepPrivacy by incorporating dense facial landmarks to better retain expressions, and by introducing lightweight post-processing modules that ensure consistency in lighting direction and skin color. We further establish evaluation metrics specifically designed to quantify expression fidelity, lighting consistency, and color preservation, complementing standard measures of image realism, pose accuracy, and re-identification resistance. Experiments on the CelebA-HQ dataset demonstrate that our method produces anonymized faces with improved realism and significantly higher fidelity in expression, illumination, and skin tone compared to state-of-the-art baselines. These results underscore the importance of feature-aware anonymization as a step toward more useful, fair, and trustworthy privacy-preserving facial data.
Figures & tables
Fig. 1: Comparison of canonical image processing methods for face anonymization. From left to right are masking, blurring, pixelation, noise, and generation [ 11 ] .
Fig. 2: Comparison of pose-conditioning landmarks for anonymization. (a) Sparse set of seven landmarks extracted with Mask R-CNN [ 49 ] , covering only ears, eyes, nose, and shoulders as in the original DeepPrivacy framework. (b) Dense set of 68 facial landmarks detected with the DLib implementation of [ 50 ] , providing finer geometric detail and enabling more faithful expression preservation.
Fig. 3: Relighting pipeline. The original image Io and anonymized image Ia are decomposed into albedo ( A ) and shading ( S ) components. The shading of Io is combined with the albedo of Ia , and a Laplacian pyramid is used to refine consistency across spatial frequencies, producing the blended output Iblend .
Fig. 4: Albedo, normal and shading images estimated for a face image by the SfSNet model [ 54 ] .
Dimension
Metric
Description / Computation
Image Quality
FID ImageNet
Fréchet Inception Distance computed in ImageNet-pretrained Inception feature space [ 48 ] . Lower is better.
FID CLIP
FID computed in CLIP embedding space for semantically aligned evaluation [ 56 ] .
Detection Rate
Percentage of anonymized images where MTCNN detects a valid face [ 57 ] . Higher is better.
Privacy
Cosine Similarity of Identity Embeddings
Cosine similarity between FaceNet embeddings of original and anonymized images, using two FaceNet versions (VGGFace2 and CASIA-WebFace) [ 58 , 59 , 60 ] . Lower indicates better anonymization.
Face Re-identification Rate
Percentage of original-anonymized pairs matched by a re-identification network above a similarity threshold.
Geometry
Pose Preservation
Normalized L 1 distance between 68 facial landmarks detected by DLib [ 50 , 51 ] . Lower is better.
TABLE I: Summary of Evaluation Metrics Used for Anonymization Performance Assessment. Metrics are grouped by evaluation dimension, with their purpose and computation method explicitly stated.
Method
Year
FID ImageNet ( ↓ )
FID CLIP ( ↓ )
Face detection ( ↑ )
Face re-identification ( ↓ )
Pose estimation ( ↓ )
Inference time ( ↓ )
VGGFace2
CASIA-WebFace
AIDPro [ 30 ]
2025
26.63
14.48
98.79
0.1532 ± 0.1591
0.2140 ± 0.1470
0.0500
0.02
AnonyGAN [ 55 ]
2022
60.23
19.34
96.79
0.3892 ± 0.1546
0.3768 ± 0.1408
0.0339
0.10
CIAGAN [ 14 ]
2020
1.78
34.00
95.25
0.1796 ± 0.1658
0.2172 ± 0.1432
0.0791
0.08
DeepPrivacy [ 11 ]
2019
32.50
21.10
97.24
0.1917 ± 0.1748
0.2170 ± 0.1514
0.0520
0.12
DeepPrivacy2 [ 18 ]
2022
15.08
11.69
95.84
0.1738 ± 0.1681
0.2063 ± 0.1507
0.0946
0.28
TABLE II: Comparison of common anonymization performance metrics across state-of-the-art methods. We report visual quality (FID ImageNet , FID CLIP ), face detection rate, identity similarity using FaceNet embeddings (VGGFace2 and CASIA-WebFace), pose preservation error (normalized L 1 distance), and average inference time per image. ↓ indicates lower is better, ↑ indicates higher is better. Best and second-best results are highlighted in blue and red respectively.
Method
Landmark error ( ↓ )
Facial expression acc. ( ↑ )
AIDPro [ 30 ]
0.0510
63.91
AnonyGAN [ 55 ]
0.0321
73.11
CIAGAN [ 14 ]
0.0801
56.55
DeepPrivacy [ 11 ]
0.0513
53.29
DeepPrivacy2 [ 18 ]
0.0973
51.23
FALCO [ 17 ]
0.0598
59.43
TABLE III: Evaluation of facial expression preservation using normalized landmark error (51 expression-related landmarks) and emotion classification accuracy. Lower values ( ↓ ) indicate better landmark alignment, higher values ( ↑ ) indicate better expression consistency. Best and second-best results are highlighted in blue and red respectively.
Method
Si-MSE ( ↓ )
Si-L 2 ( ↓ )
AIDPro [ 30 ]
0.0314 ± 0.0122
0.0131 ± 0.0073
AnonyGAN [ 55 ]
0.0359 ± 0.0205
0.0146 ± 0.0081
CIAGAN [ 14 ]
0.0792 ± 0.0392
0.0185 ± 0.0095
DeepPrivacy [ 11 ]
0.0549 ± 0.0355
0.0163 ± 0.0095
DeepPrivacy2 [ 18 ]
0.0838 ± 0.0516
0.0211 ± 0.0124
FALCO [ 17 ]
0.0654 ± 0.0386
0.0163 ± 0.0088
TABLE IV: Lighting direction preservation evaluated using scale-invariant Mean Squared Error (Si-MSE) and scale-invariant L 2 distance (Si-L 2 ) between the original and anonymized faces. Lower values ( ↓ ) indicate better preservation. Best and second-best results are highlighted in blue and red respectively.
Method
Si-MSE
MSE-L
MSE-ab
ΔE
AIDPro [ 30 ]
3.60 ×10−7
0.1241 ± 0.1316
0.1426 ± 0.1128
10.30 ± 9.46
AnonyGAN [ 55 ]
3.19 ×10−7
0.1053 ± 0.1083
0.1269 ± 0.0945
9.03 ± 7.84
CIAGAN [ 14 ]
6.82 ×10−7
0.2153 ± 0.2320
0.2289 ± 0.1976
17.26 ± 16.61
DeepPrivacy [ 11 ]
4.76 ×10−7
0.1482 ± 0.1675
0.1710 ± 0.1446
12.27 ± 12.06
DeepPrivacy2 [ 18 ]
6.40 ×10−7
0.2087 ± 0.2353
0.2226 ± 0.2010
16.73 ± 16.87
FALCO [ 17 ]
4.89 ×10−7
0.1605 ± 0.1457
0.1772 ± 0.1264
13.08 ± 10.50
TABLE V: Skin color preservation evaluated using SiMSE, lightness error (MSE-L), chroma error (MSE-ab), and perceptual difference ( ΔE2000 ) between original and anonymized faces. Lower values indicate better color consistency. Best and second-best results are highlighted in blue and red respectively.
Fig. 5: Aggregated performance across five evaluation dimensions: image quality, privacy, geometry, lighting, and color. Each axis represents the normalized average score for a dimension, where higher values indicate better performance.
Fig. 6: Anonymization results on CelebA-HQ.
68 Landmarks
Relighting
Lapl. Pyr.
FID ImageNet
FID CLIP
Face det.
Face re-identification
Pose estim.
Facial expr.
Light. (SiMSE)
Skin color ( ΔE )
VGGFace2
CASIA-WebFace
✗
✗
✗
32.50
21.10
97.24
0.1917
0.2170
0.0520
53.29
0.0549
12.27
✓
✗
✗
9.85
7.20
99.35
0.2193
0.2237
0.0360
72.40
0.0430
9.74
✓
SfSNet
✓
30.21
17.52
95.33
0.4641
0.4671
0.0339
74.62
0.0363
10.71
✓
Intr. Decom.
✗
7.50
6.02
98.94
0.2331
0.2366
0.0392
74.77
0.0208
9.36
✓
Intr. Decom.
✓
10.54
8.27
98.04
0.2125
0.2184
0.0334
75.00
0.0137
8.93
TABLE VI: Ablation study. Effect of facial landmark alignment, relighting method, and Laplacian pyramid refinement on image fidelity, recognition, and lighting and color consistency metrics. The best resultas are highlited in blue and red respectively.
The proliferation of facial recognition (FR) systems has raised privacy concerns in the digital realm, as malicious uses of FR models pose a significant threat. Traditional countermeasures, such as makeup style transfer, have suffered from low transferability in black-box settings and limited applicability across various demographic groups, including males and individuals with darker skin tones. To address these challenges, we introduce a novel facial privacy protection method, dubbed MAP, a pioneering approach that employs human emotion modifications to disguise original identities as target identities in facial images. Our method uniquely fine-tunes a score network to learn dual objectives, target identity and human expression, which are jointly optimized through gradient projection to ensure convergence at a shared local optimum. Additionally, we enhance the perceptual quality of protected images by applying local smoothness regularization and optimizing the score matching loss within our network. Empirical experiments demonstrate that our innovative approach surpasses previous baselines, including noise-based, makeup-based, and freeform attribute methods, in both qualitative fidelity and quantitative metrics. Furthermore, MAP proves its effectiveness against an online FR API and shows advanced adaptability in uncommon photographic scenarios.
Facial expression recognition relies on facial data that inherently expose identity and thus raise significant privacy concerns. Current privacy-preserving methods typically fail in realistic open-set video settings where identities are unknown, and identity labels are unavailable. We propose a two-stage framework for video-based privacy-preserving FER in challenging open-set settings that requires no identity labels at any stage. To decouple privacy and utility, we first train an identity-suppression network using intra- and inter-video knowledge priors derived from real-world videos without identity labels. This network anonymizes identity while preserving expressive cues. A subsequent denoising module restores expression-related information and helps recover FER performance. Furthermore, we introduce a falsification-based validation method that uses recognition priors to rigorously evaluate privacy robustness without requiring annotated identity labels. Experiments on three video datasets demonstrate that our method effectively protects privacy while maintaining FER accuracy comparable to identity-supervised baselines.
Feng Xu, Xun Li, Lars Petersson +3
School of CSE, UNSW Sydney, Australia · CSIRO’s Data61, Australia
Photos of faces uploaded online are vulnerable to malicious actors who can scrape facial images from online sources and intrude on personal privacy via unauthorized use of facial recognition models. This paper presents FaceCloak, a novel personalized face privacy protection system, which can generate defensive identity-specific universal face privacy masks from a single image of a user, causing facial recognition to fail. FaceCloak introduces a three-stage personalized face perturbation learning methodology: (1) It generates a small set of high-variety synthetic face images of a person based on a single image of the person. (2) It learns face cloaking by adding more protection to key facial-identity leakage regions through iterative perturbation generation over the small set of synthetic images, effectively shifting a user's identity embedding towards a distant anchor identity and away from a similar one. (3) It generates a personalized identity-protective mask in the form of pixel-wise cloaking, which is light-weight and can be efficiently applied to any facial image of a user while maintaining good perceptual quality. Extensive experiments on three popular face datasets across ten recognition models show the effectiveness of FaceCloak compared to 29 other existing representative methods. Code is available at https://github.com/zacharyyahn/FaceCloak
Zachary Yahn, Fatih Ilhan, Tiansheng Huang +5
Georgia Institute of Technology, Atlanta, Georgia, USA