How Private is Private? A Comparative Study for Face De-Identification

Hui Wei; Hao Yu; Hui Kuurila-Zhang; Guoying Zhao

cs.CVOct 7, 2026

How Private is Private? A Comparative Study for Face De-Identification

Authors: Hui Wei, Hao Yu, Hui Kuurila-Zhang, Guoying Zhao

Organizations: ELLIS Institute Finland, Finland · Center for Machine Vision and Signal Analysis (CMVS), University of Oulu, Finland

Abstract

Face de-identification (FDeID) has emerged as a critical privacy-preserving technology, yet its evaluation remains fundamentally fragmented. Existing protocols rely on inconsistent metrics, heterogeneous datasets, and partial annotation coverage, so methods targeting different utility dimensions, such as landmark versus expression preservation, are reported on different benchmarks under different metrics, rendering cross-method comparison infeasible. We revisit FDeID evaluation from both the data and metric perspectives. On the data side, we introduce UtilFace, a curated, demographically balanced benchmark with high identity diversity, assembled from four large-scale face datasets through identity-aware cleaning, resolution enhancement, and stratified filtering. On the metric side, we propose HiFD, a Hierarchical Face De-identification metric that unifies identity suppression, multi-level utility preservation, and image quality under a single consistency-based paradigm: every component is computed from pretrained estimators' outputs on the original face and its de-identified counterpart, directly quantifying how much identity is suppressed and how much downstream-perceivable utility survives. HiFD organizes facial signals into a three-level utility hierarchy spanning macro cues (L1), micro cues (L2), and imperceptible cues (L3), and aggregates the five resulting components into a single interpretable score via weighted harmonic mean, with configurable application-specific profiles. Using this unified protocol, we conduct a comprehensive comparative study spanning adversarial, GAN-based, and diffusion-based methods, surfacing trade-offs and failure modes that remain invisible under existing protocols. We release the benchmark and evaluation toolkit to foster systematic and reproducible research in privacy-preserving human face analysis.

Figures & tables

Figure 1 : HiFD reveals what the eye and single-axis metrics cannot. One face processed by six FDeID methods. Privacy score ( $\bar{P}$ ) and quality score ( $Q$ ) overlay each de-identified image. Rows report utility scores at each hierarchy level (L1 macro: $U_{1}$ , L2 micro: $U_{2}$ , L3 imperceptible: $U_{3}$ ) and the composite HiFD . The bottleneck tag names the weakest of $\{\bar{P},Q,U_{1},U_{2},U_{3}\}$ . Cells marked flag scores that contradict naive intuition: (i) Chameleon Chow et al. (2024) looks visibly noisy yet $U_{3}=0.80$ because the rPPG signal remains stable, whereas PGD, whose perturbation is invisible, drops to $0.57$ . (ii) Adv-Makeup Yin et al. (2021) looks identical to the original yet collapses to $\textbf{HiFD}=0.06$ . (iii) WeakenDiff Salar et al. (2025) passes L1 and L2 yet destroys the rPPG signal at L3.

Figure 2 : The proposed 3-level facial utility hierarchy. Facial utilities are categorized by perceptual accessibility into macro-cues (L1), micro-cues (L2), and imperceptible-cues (L3), motivating a hierarchical metric for FDeID evaluation.

Dataset	Modality	#Images/Videos	#IDs	L1: Macro-Cues					L2: Micro-Cues		L3
Dataset	Modality	#Images/Videos	#IDs	Age	Gender	Ethnicity	Macro-Exp.	Landmark	Micro-Exp.	Gaze	rPPG
LFW Huang et al. (2008)	Image	13,233	5,749	✗	✗	✗	✗	✗	✗	✗	✗
CelebA Liu et al. (2015)	Image	202,599	10,177	✗	✓	✗	✓	✓	✗	✗	✗
FFHQ Karras et al. (2019)	Image	70,000	–	✗	✗	✗	✗	✓	✗	✗	✗
AgeDB Moschoglou et al. (2017)	Image	16,488	568	✓	✓	✗	✗	✗	✗	✗	✗
RFW Wang et al. (2019)	Image	40,000	12,000	✗	✗	✓	✗	✗	✗	✗	✗

Table 1 : Annotation coverage of face datasets previously used for FDeID evaluation. No prior dataset provides the joint L1+L2+L3 annotation coverage that fragmented FDeID protocols have collectively required, forcing each method to be evaluated on a different subset. Under our consistency-based paradigm (§ 3.2 ), UtilFace itself requires no such annotations and the video benchmarks at the bottom (DFME for micro-expressions; PURE for rPPG) supply the L2/L3 coverage that no image dataset offers.

Stage	Operation	#Images	#Identities
1. Aggregation	Merge 4 source datasets	$\sim 69.55$ M	$\sim 3.12$ M
2. Cleaning + Enhancement	Identity-aware filtering; GFPGAN / CodeFormer	$\sim 20.58$ M	$\sim 701{,}810$
3. Quality filter	NIQE $<5.0$	$\sim 8.69$ M	$\sim 640{,}035$
4. Balanced sampling	Hierarchical stratified sampling	$99{,}928$	$2{,}069$

Table 2 : UtilFace curation pipeline. Each stage progressively filters the pool toward a high-quality, demographically balanced evaluation benchmark.

Figure 3 : Distributions comparison before and after the balance sampling. Each panel reports the proportion of images across categories for five facial annotations: gender, ethnicity, expression, head pose, and age.

Method	$\bar{P}\!\uparrow$	$Q\!\uparrow$	L1: Macro-cues					$U_{1}\!\uparrow$	L2: Micro-cues		$U_{2}\!\uparrow$	L3: rPPG		$U_{3}\!\uparrow$	HiFD $\!\uparrow$
Method	$\bar{P}\!\uparrow$	$Q\!\uparrow$	Age	Gen.	Eth.	MExp	Lmk	$U_{1}\!\uparrow$	Gaze	ME	$U_{2}\!\uparrow$	BVP	HR	$U_{3}\!\uparrow$	HiFD $\!\uparrow$
(a) Adversarial perturbation
MI-FGSM	0.134	0.360	0.975	0.962	0.916	0.951	0.834	0.928	0.936	0.799	0.868	0.471	0.478	0.474	0.343
PGD	0.113	0.362	0.978	0.968	0.935	0.964	0.843	0.938	0.940	0.817	0.878	0.577	0.555	0.566	0.321
TI-DIM	0.500	0.342	0.880	0.826	0.656	0.739	0.684	0.757	0.921	0.722	0.821	0.424	0.425	0.424	0.509
TIP-IM	0.496	0.446	0.927	0.882	0.701	0.794	0.728	0.806	0.944	0.812	0.878	0.643	0.605	0.624	0.607

Table 3 : HiFD comparative results. Consistency scores (higher is better,

\in[0,1]

) of each method under the HiFD protocol. Sub-scores are reported per dimension;

U_{1}

averages the five L1 consistency scores,

U_{2}

averages gaze and micro-expression, and

U_{3}

averages BVP and HR. The final column is the HiFD composite.

Figure 6 : Per-demographic-slice HiFD on UtilFace . Methods are ordered by global HiFD (descending). Left shows the female/male split and right shows the seven-way ethnicity split (alphabetical). Differences across demographic strata are small in absolute terms (

<\!0.07

within any method) compared to the inter-method spread.

Figure 7 : Consistency scores next to ground-truth scores. (a) Macro-expression consistency on the de-identified RAF-DB against the fraction of ground-truth label accuracy retained. (b)

U_{3}

on MMPD against the fraction of contact-sensor heart-rate accuracy retained. (c) Privacy score

\bar{P}

against FDeID success at FAR

10^{-3}

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	#Identities	#Images	Images / ID
WebFace42M Zhu et al. (2021)	$2$ M	$42$ M	$21.0$
Glint360K An et al. (2021)	$360$ K	$17$ M	$47.2$
MS1MV2 Deng et al. (2019)	$85$ K	$5.8$ M	$68.2$
MegaFace Kemelmacher-Shlizerman et al. (2016)	$672$ K	$4.7$ M	$7.1$
Aggregated pool	$\sim 3.12$ M	$\sim 69.55$ M	$22.3$

Appendix

Table 4 : Source datasets aggregated into the UtilFace pool.

Constant	Value	Rationale
$\Delta_{\text{age}}$	$100$ years	Full biological age range.
$\tau_{\text{NME}}$	$0.10$	Threshold beyond which face landmarks are considered unreliable in standard benchmarks.
$\theta_{\max}$	$90^{\circ}$	Maximum possible angular error between two 3D unit vectors in the forward hemisphere.
$\tau_{\text{HR}}$	$20$ bpm	Clinical relevance threshold; errors above this render HR estimates unusable for downstream tasks.
$\tau_{\text{N}}$	$5$	Matches the NIQE curation threshold used to filter UtilFace .
$\alpha$	$0.5$	Equal weighting of reference-based and no-reference quality components.

Appendix

Table 5 : Normalization constants in HiFD.

Method	Component scores					Aggregation scheme (value, rank / 12)
Method	$\bar{P}$	$Q$	$U_{1}$	$U_{2}$	$U_{3}$	$\mathcal{A}$ (Arith.)	$\mathcal{G}$ (Geom.)	$\mathcal{H}$ (Harm., Ours)
(a) Adversarial perturbation
MI-FGSM	$0.134$	$0.360$	$0.928$	$0.868$	$0.474$	$0.553$ (8)	$0.450$ (7)	$0.343$ (7)
PGD	$0.113$	$0.362$	$0.938$	$0.878$	$0.566$	$0.572$ (5)	$0.453$ (6)	$0.321$ (9)
TI-DIM	$0.500$	$0.342$	$0.757$	$0.821$	$0.424$	$0.569$ (6)	$0.538$ (3)	$0.509$ (2)
TIP-IM	$0.496$	$0.446$	$0.806$	$0.878$	$0.624$	$0.650$ (3)	$\mathbf{0.628}$ (1)	$\mathbf{0.607}$ (1)

Appendix

Table 6 : Aggregation-scheme comparison on the Balanced profile (all 12 methods). Each cell is computed from the same five component scores

\{\bar{P},Q,U_{1},U_{2},U_{3}\}

in Tab. 3 via Eq. ( 15 ) with uniform weights. Ranks (gray) are over the full set of twelve methods.

Method	Consistency	Accuracy on $\hat{\mathbf{x}}$	Retention	AUC	Hidden flips
(a) Adversarial perturbation
MI-FGSM	0.813	0.646 [0.629, 0.662]	0.830	0.976	1.7%
PGD	0.860	0.694 [0.678, 0.710]	0.892	0.971	1.6%
TI-DIM	0.777	0.625 [0.607, 0.642]	0.804	0.979	0.7%
TIP-IM	0.779	0.613 [0.597, 0.630]	0.788	0.983	0.8%
Chameleon	0.792	0.621 [0.604, 0.638]	0.798	0.974	1.1%

Appendix

Table 7 : Does consistency track true expression preservation? (RAF-DB test split,

n{=}3{,}068

). Consistency is the mean

s_{\text{macro-exp}}

; accuracy is POSTER’s top-1 accuracy on the de-identified images against ground truth (originals:

0.778

), with a 95% image-level bootstrap CI; retention is accuracy on

\hat{\mathbf{x}}

over accuracy on

\mathbf{x}

; AUC is the per-image ability of the consistency score to predict that the true label survives; the last column is the fraction of pairs with consistency

>0.8

whose true label nevertheless flipped.

Method	$\bar{P}$	FAR $10^{-2}$	FAR $10^{-3}$	FAR $10^{-4}$
TI-DIM	0.500	0.859	0.935	0.971
TIP-IM	0.496	0.856	0.930	0.967
CIAGAN	0.450	0.839	0.959	0.987
Chameleon	0.239	0.188	0.270	0.351
WeakenDiff	0.222	0.000	0.001	0.008
G 2 Face	0.210	0.002	0.010	0.033

Appendix

Table 8 : De-identification success at fixed false-accept rates (recognizer ensemble; fraction of UtilFace faces no longer verified as their original), ordered by

\bar{P}

Method	$\bar{P}$	$Q$	Gaze	ME	$U_{2}$	$U_{3}$ (PURE)	HiFD
(a) Adversarial perturbation
MI-FGSM	0.134 [0.133, 0.138]	0.360 [0.359, 0.360]	0.937 [0.936, 0.938]	0.800 [0.782, 0.817]	0.868 [0.859, 0.877]	0.474 [0.392, 0.505]	0.343 [0.334, 0.348]
PGD	0.113 [0.112, 0.117]	0.362 [0.362, 0.363]	0.941 [0.939, 0.942]	0.818 [0.797, 0.836]	0.879 [0.869, 0.889]	0.566 [0.485, 0.602]	0.321 [0.316, 0.328]
TI-DIM	0.500 [0.500, 0.506]	0.342 [0.341, 0.342]	0.923 [0.922, 0.924]	0.715 [0.688, 0.740]	0.819 [0.806, 0.832]	0.424 [0.356, 0.444]	0.509 [0.490, 0.519]
TIP-IM	0.496 [0.496, 0.501]	0.446 [0.445, 0.447]	0.944 [0.943, 0.945]	0.812 [0.790, 0.834]	0.878 [0.868, 0.889]	0.624 [0.542, 0.662]	0.607 [0.593, 0.618]
Chameleon	0.239 [0.235, 0.246]	0.474 [0.473, 0.477]	0.965 [0.964, 0.966]	0.797 [0.777, 0.817]	0.881 [0.870, 0.892]	0.799 [0.722, 0.838]	0.508 [0.503, 0.516]

Appendix

Table 9 : Component scores with 95% bootstrap intervals (Balanced profile). Intervals are percentile intervals of the mean under identity-level resampling on UtilFace (

\bar{P}

Q

, gaze) and subject-level resampling on DFME (ME,

U_{2}

) and PURE (

U_{3}

); HiFD combines all three. Point estimates for gaze, ME, and

U_{2}

are the identity- and subject-weighted means at the center of the resampling distribution (every identity or subject counts once), which differ from the image- and clip-weighted means reported in Tab. 3 by at most

0.025

. The two weightings agree on every ranking statement in the paper.

Attribute	Substitution	Sub-score correlation	HiFD Spearman	Rank changes
Ethnicity	FairFace (7-class) $\to$ ViT ethnicity (5-class)	$0.937$	$1.000$	0
Macro-expression	POSTER/RAF-DB $\to$ POSTER/AffectNet	$0.979$	$1.000$	0
Macro-expression	POSTER/RAF-DB $\to$ FER ViT	$0.979$	$1.000$	0
Age	MiVOLO $\to$ ViT age	$0.944$	$1.000$	0
All L1 sub-scores	averaged over 2–3 models each	–	$1.000$	0
Axes that already ensemble: recognizers, pairwise Spearman $1.000$ / $0.965$ / $0.965$ ; rPPG estimators, $0.972$ / $1.000$ / $0.972$ .

Appendix

Table 10 : Estimator substitution and averaging leave the ranking unchanged. Sub-score correlation is the Spearman correlation between the per-method sub-score under the published estimator and under the alternative; HiFD Spearman compares the resulting composite ranking with Tab. 3 .

Figure 8 : Continuous weight sweeps. HiFD for all twelve methods as

w_{P}

(left) or

w_{3}

(right) varies from

0.2

0.6

with the remaining weight split equally; solid, dashed, and dotted lines are adversarial, GAN, and diffusion methods, and the four methods that ever enter the top three are highlighted.

	$w_{P}$ (remainder equal)					$w_{3}$ (remainder equal)
Method	0.2	0.3	0.4	0.5	0.6	0.2	0.3	0.4	0.5	0.6
TIP-IM	0.607	0.590	0.575	0.560	0.546	0.607	0.609	0.611	0.613	0.615
TI-DIM	0.509	0.508	0.507	0.506	0.504	0.509	0.497	0.485	0.474	0.463
Chameleon	0.508	0.445	0.396	0.357	0.325	0.508	0.532	0.558	0.588	0.621
CIAGAN	0.369	0.378	0.386	0.396	0.406	0.369	0.348	0.328	0.311	0.296
Leader	TIP-IM throughout					TIP-IM				Chameleon

Appendix

Table 11 : Weight sweep, tabulated. HiFD of the four methods that enter the top three at any setting.

Method	BRISQUE $\downarrow$	TOPIQ $\uparrow$	$Q_{\text{nr}}$ (rank)	$Q$ (rank)	HiFD [ $Q_{\text{nr}}$ ]	HiFD [no $Q$ ]	HiFD
(a) Adversarial perturbation
MI-FGSM	15.7	0.633	0.738 (2)	0.360 (10)	0.380 (6)	0.339 (7)	0.343 (7)
PGD	14.9	0.648	0.749 (1)	0.362 (9)	0.354 (7)	0.313 (9)	0.321 (9)
TI-DIM	25.3	0.575	0.661 (4)	0.342 (11)	0.595 (2)	0.580 (2)	0.509 (2)
TIP-IM	40.5	0.670	0.632 (7)	0.446 (5)	0.660 (1)	0.667 (1)	0.607 (1)
Chameleon	40.5	0.701	0.648 (5)	0.474 (3)	0.538 (3)	0.517 (3)	0.508 (3)

Appendix

Table 12 : Reference-free quality and its effect on the composite. BRISQUE (lower is better) and TOPIQ face-IQA (higher is better) on

12{,}000

images per method (originals:

38.4

0.752

Q_{\text{nr}}

averages the normalized scores; ranks in parentheses are within the column. The last three columns are HiFD with

Q_{\text{nr}}

substituted, with

Q

removed (four-axis harmonic mean), and as published.

Figure 9 : Qualitative comparison on a representative UtilFace sample. Original (top-left) and 12 de-identified outputs grouped by paradigm.

Figure 10 : Qualitative comparison on a representative UtilFace sample. Same layout as Fig. 9 .

Figure 11 : Per-demographic-slice Privacy-First HiFD on UtilFace . Same layout as Fig. 6 ; methods are ordered by global Privacy-First HiFD (descending). Left shows the female/male split and right shows the seven-way ethnicity split (alphabetical).

Figure 12 : Per-demographic-slice Clinical HiFD on UtilFace . Same layout as Fig. 6 .

Method	$U_{3}$ MMPD [95% CI]	$U_{3}$ PURE	Illumination range	Motion range	$\Delta$ MAE (bpm)	HR retention
(a) Adversarial perturbation
MI-FGSM	0.503 [0.491, 0.514]	0.474	[0.470, 0.520]	[0.400, 0.689]	3.3 [2.5, 4.2]	0.834
PGD	0.558 [0.546, 0.570]	0.566	[0.523, 0.578]	[0.445, 0.755]	2.2 [1.5, 3.0]	0.889
TI-DIM	0.410 [0.398, 0.421]	0.424	[0.379, 0.437]	[0.322, 0.585]	4.1 [3.2, 5.0]	0.794
TIP-IM	0.651 [0.640, 0.662]	0.624	[0.614, 0.683]	[0.591, 0.767]	1.7 [1.0, 2.4]	0.913
Chameleon	0.709 [0.700, 0.718]	0.799	[0.677, 0.723]	[0.677, 0.727]	0.7 [0.0, 1.3]	0.966

Appendix

Table 13 :

U_{3}

on MMPD versus PURE. MMPD

U_{3}

; PURE

U_{3}

; the range of

U_{3}

over the four illumination and five motion conditions of MMPD; and the contact-sensor validation of Appendix C.1.2 : the increase in heart-rate MAE caused by de-identification (

\Delta

MAE, bpm) and the fraction of the original HR accuracy retained.

Condition	Naturalness $\uparrow$	Artifacts $\downarrow$	Attributes kept $\uparrow$	Same person $\downarrow$
Unmodified original	3.32 [2.92, 3.70]	2.08	–	–
(a) Adversarial perturbation
MI-FGSM	3.12 [2.73, 3.53]	2.08	0.966 [0.898, 1.000]	0.977 [0.932, 1.000]
PGD	3.35 [2.95, 3.71]	2.02	0.932 [0.847, 0.994]	1.000 [1.000, 1.000]
TI-DIM	1.32 [1.14, 1.52]	4.52	0.881 [0.795, 0.949]	0.886 [0.773, 0.977]
TIP-IM	1.55 [1.27, 1.86]	4.29	0.858 [0.761, 0.938]	0.909 [0.795, 1.000]

Appendix

Table 14 : Human ratings by condition (

22

raters,

1{,}386

trials). Naturalness and artifacts are 5-point means on unpaired images (higher naturalness and lower artifacts are better); attributes kept is the fraction of the four attributes judged to match on pairs; same person is the fraction of pairs judged to show the same individual (lower is more private). Intervals are rater-level cluster bootstraps.

Component	Model	Arch.†	Train data	Source
Privacy ensemble
$\bar{P}$ (1/3)	ArcFace Deng et al. (2019)	IR-R100	MS1MV3	insightface model zoo
$\bar{P}$ (2/3)	CosFace Wang et al. (2018)	IR-R50	Glint360K	insightface model zoo
$\bar{P}$ (3/3)	AdaFace Kim et al. (2022)	IR-50	MS1MV2	official release
L1 macro-cues
Age, Gender	MiVOLO Kuprashevich and Tolstykh (2023)	ViT-MiVOLO	UTKFace	official release

Appendix

Table 15 : Pretrained checkpoints used in HiFD. URLs as released by the original authors. † Architecture is the inference backbone. ArcFace, CosFace, and AdaFace are insightface-style IR networks trained with different losses on different data.

Explore similar work

Jul 28, 2026cs.CV

Face De-Identification: A Domain-Centric Survey from Capture to Processing

Face de-identification (De-ID) aims to remove or conceal personally identifiable facial features in images or videos to prevent identity recognition while preserving utility for downstream tasks. With the rising emphasis on data privacy and responsible AI, face De-ID has emerged as an active research area spanning computer vision and privacy-preserving communities. Early approaches, and many contemporary ones, operate in the digital domain by modifying pixel-level or appearance-level features through post-capture processing. Recent advances extend face De-ID beyond post-processing by integrating privacy mechanisms directly into sensors during image acquisition, bridging sensing systems and downstream vision algorithms. In parallel, physical-domain methods explore wearable accessories and materials that conceal identity information in real-world environments prior to capture. In this survey, we present the first unified overview that spans the full data acquisition pipeline, encompassing the physical, sensor, and digital domains. Through this domain-centric lens, we systematically analyze current methodologies, technical progress, and the distinct challenges inherent to each stage. We then review and organize existing evaluation protocols, examining current practices and highlighting the critical need for standardized, comprehensive benchmarks. Finally, we identify key open problems and outline emerging research directions to guide future work in this rapidly evolving field. To support ongoing research, we maintain a project page that organizes relevant literature with collected datasets and open source code: https://github.com/CV-AC/Awesome-FaceDe-ID.

Hui Wei, Hao Yu, Guoying Zhao

ELLIS Institute Finland, Espoo, 02150, Finland · Center for Machine Vision and Signal Analysis, University of Oulu, 90570 Oulu, Finland

Face Recognition Model De-Identification Privacy-Preserving Framework Post-Processing Survey

Ask PDF

Jul 30, 2026cs.CV

Private Face Recognition Training Dataset Publication via Identity-Decoupled and Geometry-Preserving Face Distillation

Publishing private face recognition~(FR) training datasets is privacy-sensitive because faces expose identity information. Private FR training dataset publication mitigates this risk by releasing protected proxies as substitutes for private training faces. However, training FR models with such data introduces an identity paradox: \emph{the identity cues that make released faces useful for recognition supervision are also the cues that make them linkable to real individuals.} A protected face should be decoupled from the original identity, yet still behave as a reliable identity sample for training. Removing these cues too aggressively may destroy the class structure needed for recognition learning, whereas preserving them too faithfully may increase source-identity linkability. We argue that this paradox stems from conflating source-aligned identity semantics with recognition-useful proxy identity geometry. The former should be suppressed to reduce linkage to private individuals, while the latter should be preserved for FR learning. Based on this insight, we propose \textbf{Private Face Distillation}, an identity-decoupling and geometry-preserving framework. It uses Orthogonal Geometry Preservation to construct decoupled proxy identities from private identity representations while maintaining hyperspherical geometry, and Relational Topology Alignment to preserve identity relations for recognition learning. Experiments across multiple domain-shifted FR scenarios show that Private Face Distillation achieves stronger utility than the evaluated publication baselines. On IJB-C surveillance, it improves

\mathrm{TAR}@\mathrm{FAR}{=}1\text{e-}{3}

by 3.94% over the baseline while reducing source-identity linkability. These results suggest that private FR training dataset publication should decouple source-identity correspondence while preserving proxy identity geometry.

Shuhuan Chen, Xiangyu Zhu, Weisong Zhao +6

1IIE, CAS · 2CBSR&MAIS, CASIA · 4SAI, UCAS +3

Face Recognition Model Diffusion-Based Dataset Distillation Few-Step Distillation Journal

Ask PDF

Feb 2, 2026cs.CV

FaceLinkGen: A Re-evaluation of Identity Leakage in Privacy-Preserving Face Recognition and Face Anonymization Systems Using Simple Distillation

Privacy-preserving face recognition (PPFR) and face anonymization have different goals, but both must retain some identity-related information for their intended use. We show that an adaptive attacker can learn this information. We propose FaceLinkGen, a simple distillation-based attack that trains a face recognition model to map protected inputs back to standard face embeddings. FaceLinkGen applies to keyless PPFR systems and perception-preserving face de-identification (De-ID) systems. For PPFR, the recovered embeddings can be used to regenerate faces that match the original person. Across MinusFace, PartialFace, and DecoyFace, the regenerated faces achieve acceptance rates of 81.0--99.4% on Face++ and 74.9--99.6% on Amazon. For De-ID, FaceLinkGen links protected faces to unprotected images of the same person, reaching Recall@1 values of 48.4--89.6% in the one-side-protected setting across the evaluated methods. FaceLinkGen exposes identity leakage across all evaluated methods, including DecoyFace and WDP, whose protection resists the tested U-Net attacks on face recovery and protected-to-unprotected linkage, respectively. The attack also remains effective when trained with limited paired data. Code is available at https://github.com/weathon/FaceLinkGenRelease.

Wenqi Guo, Qingyun Qian, Mohamed Shehata +1

Department of Computer Science, Mathematics, Physics and Statistics University of British Columbia, Kelowna, BC, Canada

Face Recognition Model Facial Images Anonymization Data Leakage

Ask PDF