{"id":"94ca525c-ac2c-4d8a-9b49-3469ee953ce3","arxiv_id":"2412.00277","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A wavelet-based privacy pipeline for facial expression recognition reports high accuracy and low identity leakage, but the leakage metric is computed by the same identity classifier used during privacy training.","lead":"This paper describes a system that edits videos to hide who a person is while still letting a computer read their facial expression, reporting 78.84% expression accuracy with only 2.01% identity leakage on the CREMA-D dataset. The identity leakage number is measured with the same face-recognition model used to train the privacy edits, so it only proves the system can fool that one model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Privacy leakage ratio is computed with the same frozen identity classifier (Vpl) used as the training adversary (Chpr/Clpr), so 2.016% may just show overfitting to that validator; an independent face recognizer is needed before the privacy claim is credible.","rationale":"The paper's central claim is that the framework achieves 78.84% FER accuracy with only 2.016% facial identity leakage. For this claim to hold, the leakage metric must reflect genuine removal of identity information, not merely the inability of one specific classifier to recognize the actors. The weakest link is that the privacy leakage validator Vpl is parameter-identical to the identity budget controllers Chpr/Clpr used to train the privacy enhancers: the enhancers are optimized to fool these controllers, and then the same model is used to measure leakage. This is a textbook circular evaluation. The frequency-split assumption questioned by the reader is also unverified, but the circular validator is more load-bearing because even if identity is perfectly separable in frequency, the reported PLR would still not establish privacy against a different classifier. The paper's own statement in Section 3.4 that consistency between controllers and Vpl ensures the same privacy attribute is preserved actually highlights the shared-model dependency. The threat-model experiment in Section 4.5 tests recovery with a U-Net, which is a different and useful check, but it does not address identity recognition by an independent model. I agree with the reader's overall conditional verdict: the framework is plausible and the ablation supports the components, but the privacy claim needs an independent validator before it is accepted. My recommended verdict remains CONDITIONAL, matching the reader's verdict, because the required fix is a concrete additional experiment rather than a fundamental flaw in the architecture. The strongest independent evidence in the paper is the threat-model recovery test and the ablation study; neither is sufficient to validate the headline privacy number.","tokens_in":14210,"tokens_out":4830,"duration_ms":45765,"concrete_test":"Train an independent identity classifier from scratch on the original CREMA-D training set (same 91 identities and train/test split), using a different architecture or loss, such as ResNet-50 with ArcFace or a pretrained FaceNet/AdaFace model, with no access to the privacy-preserved videos or to Chpr/Clpr/Vpl. Freeze it and feed the same random frames from each privacy-preserved test video used in Table 1. Recompute the privacy leakage ratio. If the independent model's accuracy is near the ~1.1% chance level, the 2.016% claim is corroborated; if it is materially higher (e.g., >10%), the reported leakage is an artifact of using the same classifier for training and validation, and the privacy claim should be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Section 3.2 (Algorithm 1), the privacy enhancers Fhpr and Flpr are trained to maximize the cross-entropy loss of the frozen identity budget controllers Chpr and Clpr, both ResNet50 models pretrained on the CREMA-D training identities. In Section 3.4, the privacy leakage validator Vpl is a ResNet50 with the same pretrained parameters as Chpr and Clpr, and the paper explicitly states that maintaining consistency between Chpr, Clpr, and Vpl ensures the validated attribute is the same one preserved. This makes the reported 2.016% PLR circular: Vpl is the exact classifier that the privacy enhancers were optimized to fool. The result demonstrates only that the reconstructed videos suppress the identity cues relied on by this one ResNet50, not that facial identity has been removed. Because the closed-set test contains 91 identities, chance-level accuracy is about 1.1%, so 2.016% is only slightly above chance for this model; a different face recognition model, or a linear probe on deep features, could plausibly recover identities at much higher rates. The Section 4.5 threat model addresses image-recovery attacks with a U-Net, not identity classification by an independent model, so it does not break the circularity. The ablation study and engineering are coherent, but the headline privacy number is not yet evidence of general identity concealment.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a two-stream framework for video-based facial expression recognition (FER) with facial identity privacy preservation. The original video is decomposed by a wavelet transform into low- and high-frequency components; each component is passed through a separate privacy enhancer (U-Net) trained against a frozen identity classifier (the 'identity budget controller'), then inverse-transformed, then enhanced by a U-ViT feature compensator trained against a frozen FER classifier, and finally evaluated by an R3D video FER classifier and a 'privacy leakage validator' (Vpl) that measures residual identity recognition. On CREMA-D, the framework reports 78.84% FER accuracy (versus 87.201% with no privacy preservation) and a 2.016% privacy leakage ratio (PLR), compared with baselines such as Gaussian blurring, a trade-off framework, optical flow, and face swapping. An ablation study and a U-Net-based recovery threat model are also reported.","tokens_in":14471,"tokens_out":2988,"duration_ms":29787,"significance":"The core idea—decoupling privacy removal from utility-task feature compensation and applying them separately in the frequency domain—is well motivated, and the engineering is coherent. The paper deserves credit for running a systematic ablation (Table 4) that isolates the contribution of each component; in particular, the feature compensator's effect is large and internally consistent (Task 5 at 48.656% versus 78.843% for the full framework). The threat model against image-recovery attacks is also a useful addition. However, the headline privacy claim rests on a circular evaluation: the privacy leakage validator uses the same pretrained identity classifier as the training adversary, so the reported 2.016% PLR only demonstrates that the privacy enhancers fool that one classifier. The frequency-domain separation assumption is also not verified on the model's own features or on CREMA-D. These issues must be addressed before the results can support the paper's central claim of identity concealment with preserved FER performance.","major_comments":[{"comment":"The privacy leakage ratio is circular. Algorithm 1 trains Fhpr and Flpr to maximize the cross-entropy loss of the frozen identity budget controllers Chpr and Clpr, and Section 3.4 states that Vpl is a ResNet50 with the same pretrained parameters as Chpr and Clpr. Therefore the 2.016% PLR measures how well the privacy enhancers fool the exact classifier they were optimized against, not whether identity is generally concealed. Since the closed-set test has 91 identities, chance accuracy is about 1.1%, so 2.016% is barely above chance for this specific model. The paper should report PLR under an independent face recognizer (different architecture and/or different training data), a linear probe on deep features of the reconstructed frames, and ideally an open-set identity-verification protocol; without at least one such independent measurement, the headline privacy claim is not supported.","section":"Section 3.4 and Section 4.2"},{"comment":"The load-bearing assumption that identity is primarily carried in low-frequency components and expression in high-frequency components is cited from psychophysical studies but never verified on the actual data used. The paper should provide quantitative evidence on CREMA-D, for example: train an identity classifier on the high-frequency-only components and an expression classifier on the low-frequency-only components, and report their accuracies; or measure how much identity information is recoverable from each band by a linear probe on the deep features of Fhpr and Flpr outputs. Without such a test, the claim that the two-stream frequency split is the reason for the privacy/utility trade-off remains an unsupported premise.","section":"Section 3.2 and Section 4.2"},{"comment":"All experimental numbers are reported as single-point accuracies with no error bars, no multiple runs, and no statistical significance testing. In Table 1, differences as small as 0.134 percentage points (78.843% vs. 77.778%) are used to compare methods, and in Table 4, task-level differences (e.g., Task 5 at 48.656% vs. Task 4 at 61.187%) may be consequential but could also reflect run-to-run variance. The paper should report means and standard deviations over at least three seeds, and, given that only CREMA-D is tested, ideally validate on a second closed-set video FER dataset before making general claims.","section":"Table 1 and Table 4"},{"comment":"The threat model evaluates only pixel-level image-recovery attacks with a U-Net. This does not address the central privacy threat for the paper's own PLR definition, which is identity classification by a potentially independent classifier. An adversary that simply trains a new identity classifier on the privacy-preserved videos (rather than attempting to reconstruct the original pixels) could recover identity at a much higher rate than 2.016%. The threat model should include an adaptive identity-classification attack using an independently trained model, or the paper should clearly scope its privacy claim to protection against the specific validator architecture.","section":"Section 4.5"}],"minor_comments":[{"comment":"The notation is inconsistent: Figure 2 labels the utility task as Fu, but Section 3.5 sometimes refers to Fu(Vi) and Fu(Ci) and other places call it the 'downstream task' without defining the symbol; please define all model symbols consistently in one place.","section":"Section 3.5 and Figure 2"},{"comment":"The column headers use downward arrows for SSIM, PSNR, and PLR, but the interpretation differs: for privacy, lower SSIM/PSNR and lower PLR are better, while for image quality lower SSIM/PSNR would usually be worse. Please clarify the direction of desirability in the caption.","section":"Table 3"},{"comment":"The hyperparameters of the Gaussian blur baselines (the σ values used for 'Gaussian Blur 1' and 'Gaussian Blur 2') are not reported, making it impossible to reproduce the baseline results. Please provide the exact settings.","section":"Section 4.1 and Section 4.2"},{"comment":"In the ablation study, Task 1 removes the wavelet transform and inverse transform, but it is unclear whether the privacy enhancer then operates on the full-resolution video or on the combined frequency representation; please specify the exact input to Fhpr and Flpr in that task.","section":"Section 4.6"},{"comment":"There are minor typographical issues, such as 'identify-related features' instead of 'identity-related features' and an extra parenthesis in 'the feature-rich video frames (Ci))'; please proofread the manuscript.","section":"Abstract and Section 1"}],"recommendation":"major_revision","confidential_remarks":"The paper's engineering is solid and the ablation study is informative, but the central privacy claim is currently circular. In my view, this is fixable within the manuscript's scope: replacing Vpl with an independent identity classifier or a linear-probe evaluation, and adding a frequency-band verification experiment, would substantially strengthen the paper. I would also encourage the editors to consider whether a single-dataset evaluation with no error bars meets the journal's experimental standards; if the authors can address the circularity, the paper could be suitable after these revisions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know two things about this paper before reading: the engineering is solid and the ablation is coherent, but the headline privacy number (2.01% leakage) is computed with the exact same frozen identity classifier that the privacy enhancers were trained to fool. That makes the privacy claim circular rather than evidence of general identity concealment.\n\nWhat's new: the two-stream wavelet decomposition with separate high- and low-frequency privacy enhancers, each with its own identity-budget controller, plus a U-ViT feature compensator to restore expression features. This exact combination appears genuinely new. The authors also propose a closed-set privacy leakage ratio as an evaluation metric. The ablation in Table 4 supports each component: removing the wavelet split raises PLR to ~13%, removing the controller raises it to ~33%, and removing the feature compensator drops FER accuracy from 78.8% to 48.7%. That is a large, internally consistent effect. The feature compensator doing most of the utility work is plausible and well demonstrated.\n\nThe soft spots, in order of severity. First, the circularity: in Section 3.4, Vpl is a ResNet50 with the same pretrained parameters as Chpr and Clpr. The enhancers maximize cross-entropy loss against those controllers, so 2.016% PLR mostly shows the enhancers suppress what this one ResNet50 looks for. Chance-level is ~1.1%, so 2.016% is only slightly better than guessing for this validator. The threat model in Section 4.5 tests a U-Net reconstruction attack, not an independent identity recognizer, so it doesn't break the circularity. Second, the frequency assumption (identity in low, expression in high) is cited from psychophysics but never verified on the deep features of their own model or the CREMA-D videos. The ablation shows the split helps, but not that the assumption holds in the way claimed. Third, the evaluation is single-dataset, no error bars or significance tests, and no code or full implementation details (wavelet type, training schedules) are provided. The authors do state limitations honestly, but those limitations don't fix the missing independent validator.\n\nWho's this for: researchers working on privacy-preserving facial analysis will value the framework and the ablation. The paper is worth a serious referee, with the expectation that the authors add an external face recognition evaluation and release code. As is, I wouldn't cite the 2.01% number.","headline":"Solid framework and coherent ablations, but the 2.01% privacy leakage claim is circular because the validator is the same classifier used to train the privacy enhancers.","tokens_in":15015,"tokens_out":2212,"would_cite":false,"duration_ms":19323,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Facial identity can be removed from video expressions in the frequency domain while preserving most emotion recognition, yielding 78.84% accuracy and 2.02% identity leakage.","keywords":["facial expression recognition","privacy preservation","wavelet transform","feature compensation","identity leakage","video-based FER","closed-set privacy","frequency decomposition"],"falsifier":"Train an identity classifier on the high-frequency sub-bands of the original, unprivatized CREMA-D videos and measure its recognition accuracy: if it identifies the 91 actors well above chance, identity is present in high frequencies and the frequency-separation assumption is false for deep features. A complementary check is to run the full privacy pipeline with a hold-out identity classifier that was not used in training; if leakage rises well above 2%, the privacy guarantee is specific to the validator rather than to identity information itself.","tokens_in":13975,"feed_emoji":"🎭","tokens_out":9941,"duration_ms":76812,"temperature":0.7,"pith_summary":"Video-based facial expression recognition (FER) faces a dilemma: hiding who the person is usually destroys the very facial dynamics that reveal emotion. This paper argues the dilemma can be split apart by frequency: identity lives mostly in low-frequency video components while expression dynamics live in high-frequency components. The proposed framework applies a wavelet transform, scrubs identity from each band separately with its own privacy enhancer steered by a frozen identity classifier, reconstructs the video, then uses a diffusion-based feature compensator guided by an expression classifier to restore expression detail. On the CREMA-D benchmark, the result is 78.84% expression accuracy with only 2.016% identity leakage, compared with 87.2% accuracy and 100% leakage without privacy. The claim is that decoupling privacy removal from utility learning, rather than jointly optimizing them, is what makes this trade-off possible.","feed_headline":"Privacy-preserving FER keeps 78.8% accuracy with 2% identity leakage","feed_subtitle":"A two-stream wavelet framework scrubs identity from video while preserving expression cues.","key_machinery":"The load-bearing mechanism is the frequency split plus two independent controllers. A wavelet transform separates each video into low- and high-frequency sub-bands on the assumption that identity is primarily low-frequency and expression primarily high-frequency. Each band is passed through its own U-Net privacy enhancer ($F_{hpr}$ for high, $F_{lpr}$ for low) whose only training signal is to maximize the cross-entropy loss of a frozen identity budget controller (ResNet50, $C_{hpr}$/$C_{lpr}$) classifying the actor identity. The privacy-preserved bands are inverse-transformed into a reconstructed video, which is then passed through a feature compensator ($F_{fc}$, a U-ViT diffusion model) trained to minimize the cross-entropy loss of a frozen expression controller ($C_{fc}$, a ResNet50 pre-trained on DFEW), so that non-identity, expression-relevant features are enriched without re-introducing identity. A final frozen privacy leakage validator ($V_{pl}$, ResNet50 with the same weights as the controllers) converts identity recognition accuracy into the privacy leakage ratio, the paper's quantitative measure of privacy preservation.","core_discovery":"On the paper's own terms, the central discovery is that facial identity and facial expression are separable enough in the frequency domain that each can be processed independently: a wavelet transform splits each video into high- and low-frequency components, two U-Net privacy enhancers trained against a frozen ResNet50 identity classifier remove identity cues from both bands, and a U-ViT feature compensator trained against a frozen expression classifier rebuilds the expression-related detail that privacy enhancement strips away. The framework then measures what remains with a separate frozen identity classifier, the privacy leakage validator, which reports the proportion of frames whose true identity is still recognized. With this design, the paper reports near-chance identity leakage (2.016% versus a theoretical floor of about 1.099% for 91 identities) while keeping FER accuracy at 78.84%, within about 8 points of the no-privacy upper bound. The ablation study attributes the result to the per-frequency privacy enhancers, since leakage rises from 2.1% to 33.0% when they are removed, and to the controlled feature compensator, since accuracy falls from 78.8% to 48.7% when it is removed.","pith_inferences":["Not claimed by the paper: the frequency split is inherited from human psychophysics, but the authors do not verify it on deep features; a direct test is to train an identity classifier on high-frequency-only videos and check whether accuracy is well above chance.","Not claimed by the paper: the privacy guarantee is tied to the closed-set identity classifier used during training, so an attacker who re-identifies with a different face recognition model could report higher leakage than the 2.016% measured by the paper's own validator.","Not claimed by the paper: because the same controller supervises both frequency bands, the two enhancers are pushed to fool the same identity representation; separate controllers per band, or an adversarial loss that penalizes identity in the reconstructed video as a whole, might further close the gap to the roughly 1.1% chance floor.","Not claimed by the paper: the framework needs identity labels for training, so porting to in-the-wild video without identity annotations would require an unsupervised identity signal, such as clustering or self-supervised instance discrimination, as a proxy controller."],"forward_implications":["If the frequency-separation assumption holds for video faces, privacy enhancement can be applied per frequency band, giving finer control over the identity-utility trade-off than global blurring, which either leaks about 89% identity at comparable accuracy or drops accuracy to about 21% at comparable leakage.","Because the privacy modules and the FER classifier are trained separately, connected only by the feature compensator, the FER head can be swapped without retraining the privacy enhancers, and the same privacy pipeline could be reused for other downstream face-analysis tasks.","The privacy leakage ratio is an attribute-specific metric: with the appropriate controller and labels, the same validation mechanism can quantify leakage of other soft biometrics such as gender or skin colour.","Deployed systems should expect uneven per-expression performance: in the paper's results, sadness recognition falls from 80.8% to 40.9%, so applications serving particular emotions need per-class checks."],"supporting_citations":[{"why":"Supplies the psychophysical observation that identity is recognized from lower spatial frequencies than expression, which motivates the wavelet split.","marker":"[21]"},{"why":"Provides the L1-reconstruction pre-training of the privacy enhancers and the adversarial trade-off baseline that the framework is compared against.","marker":"[16]"},{"why":"Supplies the U-ViT architecture used as the feature compensator, with ImageNet pre-trained weights.","marker":"[7]"},{"why":"Provides the CREMA-D dataset with 91 actors and six expression labels, used for training and testing the whole framework.","marker":"[12]"},{"why":"Provides the DFEW dataset used to pre-train the frozen expression controller C_fc for feature compensation.","marker":"[25]"},{"why":"Provides the Kinetics-400 pre-training for the R3D video classifier used as the utility task.","marker":"[26]"},{"why":"Provides the U-Net architecture used both as the privacy enhancer backbone and as the recovery model in the white-box threat model.","marker":"[47]"}],"fun_headline_variants":["Frequency split hides identity, keeps expression: 78.8% accuracy, 2% leak","Two-band face privacy: 78.8% FER accuracy, 2% identity leak","Wavelet face scrubber: high expression, low identity (78.8% vs 2%)","Privacy-preserving FER hits 78.8% with 2% identity leak","Separating face identity and expression: 78.8% accuracy, 2% leak"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole frequency-split design rests on the premise that a person's identity is carried almost entirely in low-frequency video components and expression in high-frequency components; if identity also survives in high-frequency details, or expression depends on low-frequency structure, the separation collapses and the privacy enhancers cannot remove identity without also removing expression.","fun_headline_variants_meta":{"raw":{"variants":["Frequency split hides identity, keeps expression: 78.8% accuracy, 2% leak","Two-band face privacy: 78.8% FER accuracy, 2% identity leak","Wavelet face scrubber: high expression, low identity (78.8% vs 2%)","Privacy-preserving FER hits 78.8% with 2% identity leak","Separating face identity and expression: 78.8% accuracy, 2% leak"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000626,"raw_usage":{"total_tokens":2888,"prompt_tokens":929,"completion_tokens":1959,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":545,"completion_tokens_details":{"reasoning_tokens":1840}},"tokens_in":545,"tokens_out":1959,"duration_ms":14305,"temperature":1.0,"reasoning_tokens":1840,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T05:33:02.777218+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train an identity classifier on the high-frequency sub-bands of the original, unprivatized CREMA-D videos and measure its recognition accuracy: if it identifies the 91 actors well above chance, identity is present in high frequencies and the frequency-separation assumption is false for deep features. A complementary check is to run the full privacy pipeline with a hold-out identity classifier that was not used in training; if leakage rises well above 2%, the privacy guarantee is specific to the validator rather than to identity information itself.","supporting_citations":[{"cited_title":"A comparison of spatial frequency tuning for the recognition of facial identity and facial expressions in adults and children","cited_arxiv_id":null,"evidence_quote":"Supplies the psychophysical observation that identity is recognized from lower spatial frequencies than expression, which motivates the wavelet split."},{"cited_title":"All are worth words: A vit backbone for diffusion models","cited_arxiv_id":null,"evidence_quote":"Supplies the U-ViT architecture used as the feature compensator, with ImageNet pre-trained weights."},{"cited_title":"Crema-d: Crowd-sourced emotional multimodal actors dataset","cited_arxiv_id":null,"evidence_quote":"Provides the CREMA-D dataset with 91 actors and six expression labels, used for training and testing the whole framework."},{"cited_title":"Dfew: A 9 large-scale database for recognizing dynamic facial expres- sions in the wild","cited_arxiv_id":null,"evidence_quote":"Provides the DFEW dataset used to pre-train the frozen expression controller C_fc for feature compensation."},{"cited_title":"U- net: Convolutional networks for biomedical image segmen- tation","cited_arxiv_id":null,"evidence_quote":"Provides the U-Net architecture used both as the privacy enhancer backbone and as the recovery model in the white-box threat model."}],"review_version":1}