Toolkit for Facial Deidentification

Esteban Leiva-Montenegro; Matthieu Pillot; Manfred Gonzalez-Hernandez; Vitomir Struc; Peter Peer; Blaž Meden

cs.CVOct 19, 2026

Toolkit for Facial Deidentification

Authors: Esteban Leiva-Montenegro, Matthieu Pillot, Manfred Gonzalez-Hernandez, Vitomir Struc, Peter Peer, Blaž Meden

Organizations: Instituto Tecnológico de Costa Rica, Costa Rica · CERI/LARIS, ENSAM, Université Paris-Est Créteil, France · University of Ljubljana, Ljubljana, Slovenia

Abstract

This work presents a novel open-source toolkit designed for the evaluation of face deidentification techniques with available evaluation models. The framework provides a complete evaluation pipeline, including preprocessing, deidentification, and performance assessment, based on data utility, image quality, and identity protection metrics. It supports a variety of datasets, enabling researchers to easily benchmark new deidentification techniques. Results show the effectiveness of some techniques on maintaining privacy while preserving image utility. The toolkit is aimed at unifying future research by providing a standard evaluation framework for privacy-enhancing technologies in facial biometrics. Implementation is available at github.com/blazm/deid-toolkit.

Figures & tables

Fig. 1: Examples of visual results before and after deidentification—with reference images and the results visualized along with the rest of the deidentification techniques available in the toolkit.

Fig. 2: The architecture design of the proposed facial deidentification toolkit.

	MUG (still) dataset				CK+ dataset		ArFace dataset
Techniques	DAN (expr.) $\uparrow$	HSEmotion (expr.) $\uparrow$	DeepFace (gd) $\uparrow$	ResNet-18 (gd) $\uparrow$	DAN (expr.) $\uparrow$	HSEmotion (expr.) $\uparrow$	DeepFace (gd) $\uparrow$	ResNet-18 (gd) $\uparrow$
AMT-GAN	$76.98\%$	$80.73\%$	$90.57\%$	$91.68\%$	$78.19\%$	$81.88\%$	$88.44\%$	$91.52\%$
Croft et al.	$13.18\%$	$12.58\%$	$59.63\%$	$41.08\%$	$18.64\%$	$17.09\%$	$78.04\%$	$35.42\%$
Blur	$60.34\%$	$56.59\%$	$81.85\%$	$54.97\%$	$69.40\%$	$74.87\%$	$85.65\%$	$74.58\%$
CleanIR	$43.91\%$	$42.80\%$	$71.40\%$	$84.08\%$	$56.42\%$	$56.78\%$	$78.71\%$	$81.23\%$
CPP-DeID	/	$66.63\%$	$86.71\%$	$94.42\%$	/	$67.39\%$	$86.35\%$	$88.84\%$

TABLE I: Accuracy of deidentification techniques in preserving data utility, measured by facial expression classification (7 classes, using DAN [ 13 ] and HSEmotion [ 14 ] ) and gender prediction (using DeepFace [ 15 ] and ResNet-18 [ 16 ] ). DAN’s performance was excluded for CPP-DeID, as it served as the guidance model. Evaluation was conducted on the MUG-still, CK+, and ArFace datasets. Deidentification techniques are listed in the first column and the evaluation classification models are listed in the second row (in gray).

	image quality				verification (AUC $\downarrow$ )
Techniques	MSE $\downarrow$	LPIPS $\downarrow$	SSIM $\uparrow$	MS-SSIM $\uparrow$	MUG (still)	CK+	ArFace
AMT-GAN	$0.20\pm 0.06$	$0.43\pm 0.09$	$0.51\pm 0.12$	$0.59\pm 0.11$	$0.99\pm 0.00$	$0.99\pm 0.00$	$0.74\pm 0.01$
Croft et al.	$1.04\pm 0.14$	$0.67\pm 0.02$	$0.35\pm 0.04$	$0.24\pm 0.13$	$0.52\pm 0.01$	$0.50\pm 0.00$	$0.51\pm 0.00$
Blur	$0.01\pm 0.00$	$0.57\pm 0.04$	$0.71\pm 0.05$	$0.82\pm 0.03$	$0.99\pm 0.00$	$0.99\pm 0.00$	$0.72\pm 0.00$
CleanIR	$0.01\pm 0.00$	$0.23\pm 0.02$	$0.81\pm 0.04$	$0.90\pm 0.02$	$0.77\pm 0.01$	$0.84\pm 0.00$	$0.64\pm 0.00$
CPP-DeID	$0.03\pm 0.01$	$0.19\pm 0.03$	$0.66\pm 0.05$	$0.73\pm 0.06$	$0.95\pm 0.01$	$0.99\pm 0.00$	$0.72\pm 0.01$

TABLE II: Baseline performances in terms of computing image quality metrics, obtained on deidentified and source image pairs—including MSE, LPIPS [ 17 ] , SSIM [ 18 ] , and MS-SSIM [ 18 ] (left). Verification experiment results in terms of the reported Area Under the ROC Curve (AUC [ 19 ] ) (right). The evaluation was performed on the MUG-still, CK+, and ArFace datasets.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

FDeID-Toolbox: Face De-Identification Toolbox
Mar 13, 2026Hui Wei, Hao Yu, Guoying ZhaoPrivacy-Utility Tradeoff
ELLIS Institute Finland · Center for Machine Vision and Signal Analysis (CMVS), University of Oulu, Finland
How Private is Private? A Comparative Study for Face De-Identification
Oct 7, 2026Hui Wei, Hao Yu, Hui Kuurila-Zhang +1Privacy-Preserving ML
ELLIS Institute Finland, Finland · Center for Machine Vision and Signal Analysis (CMVS), University of Oulu, Finland
Face De-Identification: A Domain-Centric Survey from Capture to Processing
Jul 28, 2026Hui Wei, Hao Yu, Guoying Zhao
ELLIS Institute Finland, Espoo, 02150, Finland · Center for Machine Vision and Signal Analysis, University of Oulu, 90570 Oulu, Finland

Mar 13, 2026J/K move · Enter open · S save

FDeID-Toolbox: Face De-Identification Toolbox

Hui Wei, Hao Yu, Guoying Zhao

ELLIS Institute Finland · Center for Machine Vision and Signal Analysis (CMVS), University of Oulu, Finland

Privacy-Utility Tradeoff

Open paper AskPDF arXiv

Face de-identification (FDeID) aims to remove personally identifiable information from facial images while preserving task-relevant utility attributes such as age, gender, and expression. It is critical for privacy-preserving computer vision, yet the field suffers from fragmented implementations, inconsistent evaluation protocols, and incomparable results across studies. These challenges stem from the inherent complexity of the task: FDeID spans multiple downstream applications (e.g., age estimation, gender recognition, expression analysis) and requires evaluation across three dimensions (e.g., privacy protection, utility preservation, and visual quality), making existing codebases difficult to use and extend. To address these issues, we present FDeID-Toolbox, a comprehensive toolbox designed for reproducible FDeID research. Our toolbox features a modular architecture comprising four core components: (1) standardized data loaders for mainstream benchmark datasets, (2) unified method implementations spanning classical approaches to SOTA generative models, (3) flexible inference pipelines, and (4) systematic evaluation protocols covering privacy, utility, and quality metrics. Through experiments, we demonstrate that FDeID-Toolbox enables fair and reproducible comparison of diverse FDeID methods under consistent conditions.

Abstract

Privacy-Preserving ML

Explore similar work

FDeID-Toolbox: Face De-Identification Toolbox

How Private is Private? A Comparative Study for Face De-Identification

Face De-Identification: A Domain-Centric Survey from Capture to Processing