{"id":"1dc0dda7-fcb7-4ddd-8010-53e76016e238","arxiv_id":"2412.08276","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A stochastic, high-frequency-preserving anonymization method is claimed to keep faces unrecognizable to people while retaining 94.21% average accuracy on face recognition models that were not used during optimization.","lead":"This paper describes a face anonymization method that keeps images unrecognizable to humans while preserving enough detail for face recognition software to still identify people. The authors report 94.21% average recognition accuracy on unseen face recognition models and stronger resistance to image reconstruction than four prior methods.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The stochastic fill in Eq. (4) is mean-preserving: averaging multiple anonymized outputs cancels the noise and exposes a deterministic function of the original, so the 'irreversible' privacy claim is not established by the single U-net SSIM/PSNR test.","rationale":"The reader's formal weakest_assumption is the black-box transfer to unseen architectures. That concern is real but empirical: the ensemble protocol in Sec. 4.3 is a reasonable transfer test, and extending it to a transformer-based recognizer would address it. The more load-bearing issue is the privacy claim, which the reader also flagged in the rationale as 'the weakest part' but did not make the primary weakest_assumption. The mean-preserving structure of Eq. (4) gives a concrete, testable reason to doubt irreversibility: if the stochastic fill is centered on original-derived statistics, then the mapping has a learnable mean and multiple samples of the same image reveal that mean. This directly threatens the paper's main claimed advance over reversible encoding methods. I therefore agree with the reader's overall conditional verdict, but the condition should explicitly include the averaging and identity-match tests described above.","tokens_in":12248,"tokens_out":9343,"duration_ms":116420,"concrete_test":"Generate J = 50 protected versions of the same original face using different random seeds and the authors' hyperparameters. Compute the averaged image Ā_J = (1/J) Σ X'_j and compare it to the original with SSIM/PSNR and with ArcFace cosine similarity. Separately, take the U-net reconstructions from the Tab. 3 protocol and measure their ArcFace match rate against the original identity. If the averaged images or the U-net reconstructions match the original identity at high rate (e.g., above the standard cosine threshold) while single-image SSIM remains low, the stochastic injection is not irreversible and the privacy claim must be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central novelty is 'irreversible stochastic injection' (Sec. 1, Sec. 3.3-3.4), but the stochastic filling defined in Eq. (4) is R(x,y) ~ N(µ(x,y), σ(x,y)·κ), with µ and σ taken from the original image's color statistics. This makes the stochastic component mean-preserving: E[R] = µ(x,y), so the randomness is zero-mean noise around a deterministic function of X. Consequently, averaging multiple independent anonymized versions of the same image cancels the added noise and exposes µ(x,y), which is exactly the global color/structure information the high-pass filter was intended to remove. Even with a single protected image, a reconstruction model trained to minimize squared error can learn to predict E[X | X'] and partially denoise the output. The only reconstruction evidence in Sec. 4.4 and Tab. 3 is one U-net attack scored by SSIM/PSNR; low pixel similarity does not imply that identity is protected, since a reconstructed face can match the original identity at high rate while having low SSIM. The ablation in Tab. 6 uses the same image-similarity metrics and cannot settle this. Thus the privacy claim is load-bearing and currently unsupported by an appropriate test.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a privacy-preserving face recognition (PPFR) method built on the observation that machine face recognizers rely on local features more than global ones. A source image is high-pass filtered in the Fourier domain, the discarded regions are filled with stochastic Gaussian values, and the resulting image is iteratively updated with multi-scale temporal noise under a momentum-driven ensemble recognition loss plus an entropy regularization term. The authors report 94.21% average verification accuracy on six black-box face recognition models across five datasets, lower SSIM between original and anonymized images than four prior methods, and lower SSIM/PSNR after a U-net reconstruction attack. The core claims are that the method transfers to black-box models without retraining and that the stochastic injection makes the anonymization irreversible.","tokens_in":12483,"tokens_out":9239,"duration_ms":95758,"significance":"Should the accuracy result hold, the local-feature-preservation idea with ensemble optimization is a useful step for PPFR: it would decouple anonymization from a specific recognition architecture and avoid the per-model retraining required by frequency-domain baselines. The evaluation is designed to avoid the most obvious circularity, since the target model is excluded from the optimization ensemble; the reported Table 4 numbers are internally consistent, and the qualitative comparison in Fig. 5 is suggestive. However, the second central claim, irreversibility, is not established by the current evidence, and the black-box claim is stronger than the experiments support. The paper needs a substantially stronger privacy evaluation and a true held-out architecture/domain test before its main claims can be accepted.","major_comments":[{"comment":"The stochastic fill is mean-preserving, because R(x,y) ~ N(µ(x,y), σ(x,y)·κ) has conditional expectation µ(x,y). An adversary with several anonymized versions of the same image can therefore average them to cancel the injected randomness and expose a deterministic function of the original. This is in tension with the 'irreversible stochastic injection' claim in Sec. 1 and Sec. 3.3-3.4. The reconstruction evaluation in Sec. 4.4 and Table 3 uses a single U-net and pixel-level SSIM/PSNR only; low pixel similarity does not imply that identity is protected, since a reconstructed face can match the original identity at high rate while having low SSIM. Please add a multi-observation averaging attack, an identity-based metric on reconstructed images, and a precise definition of irreversibility (or a differential-privacy-style bound).","section":"Sec. 3.2, Eq. (4)"},{"comment":"The held-out protocol correctly excludes the evaluated model from the optimization ensemble, but all six evaluated models are standard CNN face recognizers of the same general family used as surrogates. No genuinely unseen architecture or domain is tested (for example, a ViT-based face recognizer or a commercial black-box API), so the abstract's claim that the method 'works on black-box models' is an extrapolation. Please add at least one held-out architecture/domain outside the pool, or restrict the claim to CNN recognizers of this type.","section":"Sec. 4.3, Table 5"},{"comment":"Table 5 reports 61.00% for FaceNet with an ensemble of three models, while Table 2 reports 92.00% for FaceNet on LFW with the full method. The text concludes that a minimum of three models is sufficient, but for FaceNet the fourth model appears to be necessary, and the configuration underlying the headline 94.21% is not uniquely specified. Please reconcile the two tables and state which ensemble size produced the results in Tables 2 and 4.","section":"Sec. 4.5, Table 5 vs. Table 2"},{"comment":"Key hyperparameters are missing (ω_C, κ, α, momentum µ, ensemble weights β_i, entropy weight γ, number of noise orders n, persistence ε, scales τ and λ, and the number of optimization iterations), and no code is provided. Because the method is an iterative optimization procedure, these choices are load-bearing for reproducing the 94.21% average. Please report the full configuration and include standard deviations or confidence intervals for the percentages in Tables 2-6.","section":"Sec. 3.2-3.5"}],"minor_comments":[{"comment":"The inverse-transform normalization is written as 1/(MN), but the transform in Eq. (1) is over an H×W image; this should be 1/(HW).","section":"Sec. 3.2, Eq. (3)"},{"comment":"The sentence 'N (x, y) represents a normal distribution where the mix is the mean' should read 'where µ(x,y) is the mean'.","section":"Sec. 3.2, after Eq. (4)"},{"comment":"The smoothing function φ(x−i, y−i) appears to use the same index i in both coordinates; if the second coordinate should be y−j, please correct it.","section":"Sec. 3.3, Eq. (5)"},{"comment":"The caption labels (a) as 'Lack of robust privacy protection' and (b) as 'Limited adaptability to black-box scenarios', but the panel headings are the reverse; please align them.","section":"Fig. 1"},{"comment":"Dataset names are inconsistent ('C ELEBA', 'CELEB A', 'CELEBA', 'A GEDB'); standardize to CelebA and AgeDB.","section":"Tables 1 and 4"},{"comment":"'Moblienet' should be 'MobileNet'.","section":"Tables 2 and 5"}],"recommendation":"major_revision","confidential_remarks":"This is a promising idea, but the privacy claim is central and currently unsupported, and there is an unresolved inconsistency between Table 5 and Table 2. If the authors can provide code, a true held-out architecture test, and a stronger reconstruction evaluation including averaging attacks and identity-based metrics, the paper could become a solid contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read this for the black-box transfer result, not for the privacy claim. The 94.21% average on held-out face models is a real empirical contribution and the tables are internally consistent. The combination of Fourier high-pass local-feature preservation, per-image momentum ensemble optimization, and multi-scale stochastic noise is genuinely new relative to DuetFace, PartialFace, and MinusFace. The protocol that excludes the evaluated model from the ensemble is a fair transfer test, and the numbers hold up on LFW, CelebA, AgeDB, CPLFW, and CALFW.\n\nWhat the paper does not do is establish \"irreversible stochastic injection.\" The stress-test point about Eq. (4) is on target: the fill is mean-preserving, so an adversary who averages multiple protected copies of the same image gets a deterministic function of the original. The full iterative update in Eq. (9) is more complex because the noise multiplies a gradient that depends on the noisy image itself, so a simple averaging attack may not fully cancel the randomness. But the paper never tests this. The only reconstruction evidence is one U-net scored with SSIM/PSNR, which does not say anything about whether identity survives reconstruction. Low pixel similarity is not a privacy guarantee. You need averaging attacks, an identity-retention metric on the reconstructed faces, and preferably a stronger adversary (more models, different architectures) before the word \"irreversible\" is justified.\n\nThe other soft spots are standard but real. No code, no hyperparameters, no noise schedule values, no definition of the eye mask, no error bars. For a method that is essentially a tuned per-image optimization, that makes the result hard to reproduce. And the \"black-box\" claim is narrower than advertised: all six models are standard CNNs from the same family. No vision transformer, no backbone with a genuinely different feature space. The transfer finding may still generalize, but it is not demonstrated.\n\nThe recognition half of the paper deserves a serious referee. The privacy half needs a major revision with stronger adversarial evaluation and a more careful claim. I would accept it for review but not with the current privacy language. If the authors release code, this could be a useful baseline for black-box PPFR.","headline":"A genuinely new combination for black-box PPFR with a promising 94% transfer result, but the privacy claim needs a much stronger attack model.","tokens_in":13067,"tokens_out":3731,"would_cite":false,"duration_ms":39397,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A privacy-preserving face anonymizer claims 94.21% black-box verification accuracy by keeping local features and making the mapping stochastic, with reconstructed images reduced to an average face.","keywords":["privacy-preserving face recognition","black-box face recognition","face anonymization","local features","stochastic injection","reconstruction attack","Fourier high-pass filtering","ensemble optimization"],"falsifier":"An evaluator could take a face recognition model outside the tested six with a different architecture or training domain, run the anonymized images through it, and measure verification accuracy; if it approaches the near-zero level of the prior methods instead of 94.21%, the black-box transfer claim collapses. Separately, train a reconstruction network on a large set of anonymized pairs generated with different noise seeds and test whether the reconstructed faces can be matched to the originals; if they can, the claimed irreversibility of the stochastic injection fails.","tokens_in":11981,"feed_emoji":"🔒","tokens_out":9493,"duration_ms":90325,"temperature":0.7,"pith_summary":"This paper is trying to establish that privacy-preserving face recognition can work for black-box recognition models, not just for the specific model a protection scheme was trained on. The observation is that face recognition models identify people from local details like contours, edges, and skin texture, whereas human viewers read the global structure of a face; so a transform that removes the global structure and keeps the local structure can anonymize for humans while remaining usable for machines. The paper makes this transform non-deterministic by filling pruned image regions with stochastic values and adding multi-scale temporal noise under an entropy-increasing loss, so that the anonymization cannot be learned and inverted by a reconstruction network. On this basis it reports an average recognition accuracy of 94.21% across six mainstream face recognition models under a black-box protocol, with lower image similarity scores after reconstruction attacks than prior methods.","feed_headline":"Anonymized faces stay recognizable to black-box models at 94.21%","feed_subtitle":"Stripping global face structure while preserving local details keeps recognition alive and blocks reconstruction.","key_machinery":"The load-bearing object is a stochastic identity-preserving transform. Its core pieces are a Fourier high-pass filter $H(u,v) = \\mathbb{I}[\\sqrt{u^2+v^2} > \\omega_C]$ that removes global facial structure while keeping high-frequency microstructure; a stochastic nonlinear fill $R(x,y) \\sim \\mathcal{N}(\\mu(x,y), \\sigma(x,y)\\kappa)$ that replaces the removed regions with random values; multi-scale temporal noise $N'(x,y,\\sigma) = \\sum_{k=0}^{n} \\varepsilon^k N(\\tau^k x/\\lambda, \\tau^k y/\\lambda, \\sigma)$ that makes each anonymization iteration different; and an entropy regularizer $H(X) = -\\sum_i p(X_i)\\log p(X_i)$ that drives pixel distributions toward disorder. These are combined in a momentum-based iterative optimizer, $X_{t+1} = X_t + N'(x,y,\\sigma)\\alpha(\\mu g_t + \\nabla_X L_{\\mathrm{total}}(X_t)/\\|\\nabla_X L_{\\mathrm{total}}(X_t)\\|_p)$, with $L_{\\mathrm{total}} = \\sum_i \\beta_i f_i(X, X_t) + \\gamma E(H(X_t))$, so that recognition loss from an ensemble of surrogate face models and entropy pressure are optimized together. The stochastic components are what make the transform irreversible: reconstruction networks cannot learn a stable inverse mapping from $(X, X')$ pairs.","core_discovery":"On its own terms the paper's central claim is that the hard part of privacy-preserving face recognition is not the recognizer but the mapping from a face image to a protected image. Because CNN face recognizers rely on local microstructure rather than the global face layout that humans perceive, the paper keeps the local detail and replaces global structure with stochastic noise. The protected image is generated by Fourier high-pass filtering, randomized filling of the removed regions, iterated addition of multi-scale temporal noise, and an entropy-increasing regularizer, which together make the mapping non-deterministic. The paper reports that under a black-box protocol where the evaluated model is excluded from the optimization ensemble, the method retains an average verification accuracy of 94.21% on five face datasets and six face recognition models, while reconstruction networks trained on anonymized pairs recover only an average face, with SSIM and PSNR lower than the compared methods.","pith_inferences":["Not in the paper: if the local-feature hypothesis is general, the same recipe of preserving edge and texture microstructure while destroying global layout and injecting stochasticity could extend to privacy-preserving recognition of other biometrics such as gait or iris, though only faces are tested.","Not in the paper: an averaging attack is a natural next test; if an adversary collects many stochastic anonymizations of the same identity and denoises them, the identity might resurface, and that attack is not evaluated.","Not in the paper: the reported accuracy is measured against recognizers that share a CNN inductive bias, so a deployment recognizer built on a different architecture or preprocessing pipeline would test whether the transfer claim holds beyond the six-model pool."],"forward_implications":["Anonymized images can be handed to existing face recognition models without retraining or a dedicated feature codec, because the retained local features are the generic cues CNN recognizers use.","A reconstruction model trained on a large set of anonymized pairs learns no stable inverse; its output converges to an average face rather than the target identity.","The method's black-box transfer depends on ensemble diversity: with one or two surrogate models accuracy is much lower, and three or more are needed to reach the reported level.","Since the comparison baselines drop below 2% black-box accuracy, 94.21% is the method's claimed separation from prior reversible-encoding approaches, not an incremental improvement."],"supporting_citations":[{"why":"DuetFace, the frequency-domain channel-splitting PPFR baseline whose black-box accuracy and reconstruction resistance are compared against the method.","marker":"[26]"},{"why":"PartialFace, the random-frequency-component PPFR baseline used as a comparison method.","marker":"[27]"},{"why":"MinusFace, the trainable feature-subtraction PPFR baseline contrasted with the method's 94.21% black-box accuracy.","marker":"[28]"},{"why":"ProFace, the Siamese-network obfuscation baseline used in the anonymization and reconstruction comparisons.","marker":"[40]"},{"why":"The U-net architecture used to train reconstruction attack models in the anti-reconstruction experiments.","marker":"[33]"},{"why":"ArcFace, one of the six face recognition models used both as a surrogate in the ensemble and as a black-box test model.","marker":"[4]"},{"why":"FaceNet, one of the six face recognizers whose black-box accuracy is reported in the method's evaluation table.","marker":"[34]"},{"why":"ResNet, one of the face recognizers used in the multi-model ensemble and in the black-box accuracy table.","marker":"[8]"}],"fun_headline_variants":["Local features keep anonymized faces recognizable at 94%","Stochastic anonymization preserves face recognition for black-box models","Anonymized faces retain 94.21% accuracy on black-box recognition","Preserve local detail, scramble global structure: private face recognition"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a pool of six standard convolutional face recognizers represents the black-box models a deployment would actually meet; if real-world face recognizers rely on different local features or different preprocessing, the preserved local structure may not transfer and the 94.21% average would not hold.","fun_headline_variants_meta":{"raw":{"variants":["Local features keep anonymized faces recognizable at 94%","Stochastic anonymization preserves face recognition for black-box models","Anonymized faces retain 94.21% accuracy on black-box recognition","Preserve local detail, scramble global structure: private face recognition"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000234,"raw_usage":{"total_tokens":1470,"prompt_tokens":895,"completion_tokens":575,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":511,"completion_tokens_details":{"reasoning_tokens":503}},"tokens_in":511,"tokens_out":575,"duration_ms":5874,"temperature":1.0,"reasoning_tokens":503,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:00:11.453700+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An evaluator could take a face recognition model outside the tested six with a different architecture or training domain, run the anonymized images through it, and measure verification accuracy; if it approaches the near-zero level of the prior methods instead of 94.21%, the black-box transfer claim collapses. Separately, train a reconstruction network on a large set of anonymized pairs generated with different noise seeds and test whether the reconstructed faces can be matched to the originals; if they can, the claimed irreversibility of the stochastic injection fails.","supporting_citations":[{"cited_title":"Duetface: Collab- orative privacy-preserving face recognition via channel split- ting in the frequency domain","cited_arxiv_id":null,"evidence_quote":"DuetFace, the frequency-domain channel-splitting PPFR baseline whose black-box accuracy and reconstruction resistance are compared against the method."},{"cited_title":"Privacy- preserving face recognition using random frequency compo- nents","cited_arxiv_id":null,"evidence_quote":"PartialFace, the random-frequency-component PPFR baseline used as a comparison method."},{"cited_title":"Privacy-preserving face recognition us- ing trainable feature subtraction","cited_arxiv_id":null,"evidence_quote":"MinusFace, the trainable feature-subtraction PPFR baseline contrasted with the method's 94.21% black-box accuracy."},{"cited_title":"Pro-face: A generic framework for privacy- preserving recognizable obfuscation of face images","cited_arxiv_id":null,"evidence_quote":"ProFace, the Siamese-network obfuscation baseline used in the anonymization and reconstruction comparisons."},{"cited_title":"U-net: Convolutional networks for biomedical image segmentation","cited_arxiv_id":null,"evidence_quote":"The U-net architecture used to train reconstruction attack models in the anti-reconstruction experiments."},{"cited_title":"Arcface: Additive angular margin loss for deep face recognition","cited_arxiv_id":null,"evidence_quote":"ArcFace, one of the six face recognition models used both as a surrogate in the ensemble and as a black-box test model."},{"cited_title":"Facenet: A unified embedding for face recognition and clus- tering","cited_arxiv_id":null,"evidence_quote":"FaceNet, one of the six face recognizers whose black-box accuracy is reported in the method's evaluation table."},{"cited_title":"Deep residual learning for image recognition","cited_arxiv_id":null,"evidence_quote":"ResNet, one of the face recognizers used in the multi-model ensemble and in the black-box accuracy table."}],"review_version":1}