{"id":"5160a520-9618-48d1-93e5-b34655e3541a","arxiv_id":"2412.13507","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":2.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"Subtle cosmetic lines near facial key points and an alpha-layer PNG trick are claimed to hide faces from commercial detectors, but the evidence is anecdotal and not reproducible.","lead":"The paper claims that subtle dark lines near the brow, nose bridge, and jawline, combined with a hidden PNG transparency layer, can stop commercial face recognition systems from detecting a face. It presents only a few example screenshots, with no code, data, or quantitative success rates.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central claim is supported only by selected screenshots: no detection counts, confidence scores, trial denominators, or random-pattern analysis are provided, so the alleged 'vertical perturbations near key points break face detection' is not empirically established.","rationale":"I read the paper as a proposal rather than a validated demonstration. Its novelty is plausible: combining keypoint-targeted cosmetic lines with alpha-layer sandwiching is a reasonable extension of CV dazzle and Juggalo methods. But novelty is not what fails; the evidentiary chain fails. The weakest link is the empirical claim of 'effective obfuscation.' None of the figures report aggregate data. Figure 3 is a single ablated generated face; Figures 5 through 7 are individual screenshots. The random-shape experiment described in Methods has no reported results. The paper's own limitations acknowledge Haar cascades are outdated and real-time or video recognition is not tested, but even the static-image claim is not quantified. My concern is specifically selection bias and the lack of a denominator, not disagreement with consensus and not an internal mathematical inconsistency. A concrete rerun with full trial enumeration would settle it. Since the reader's REJECT was based on this same unsupported empirical basis, my read leaves the verdict unchanged. I am not claiming the method is fraudulent or impossible; I am claiming the paper has not provided the evidence required to credit it.","tokens_in":8653,"tokens_out":3389,"duration_ms":31446,"concrete_test":"Reproduce the pipeline with the authors' images or a matched set: for each of at least 100 source faces, generate 1,000 random-shape perturbations using Table 1's parameters and also create the alpha/RGB sandwich from the Supplemental pseudocode. Submit all baseline, perturbed, and sandwiched images to the same detectors (Haar cascade, BetaFaceAPI, and an open-source deep detector such as RetinaFace), recording detection rate, confidence, and reverse-search match counts. If perturbed images do not reduce detection or matching by a large, consistent margin relative to baseline, the central claim of reliable low-visibility cloaking fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract's load-bearing assertion is that subtle vertical perturbations near the brow, nose bridge, and jawline reliably defeat commercial face detectors, and that PNG alpha-layer sandwiches make faces invisible to reverse-image search while remaining human-visible. For this to hold, the experiments must show that these modifications cause detection and matching failures at a high rate. The paper never supplies that evidence. Results (Figures 3, 5, 6, 7) show only selected screenshots from BetaFaceAPI, Bing Visual Search, and PimEyes; no success/failure counts, no confidence scores, no number of submitted images, and no negative controls are reported. The Methods' random-shape procedure (Table 1) says the authors generate random shapes, save patterns that pass Haar detection, and analyze common elements, yet no analysis of those saved patterns appears; 'millions of alternative facial patterns' are claimed but no sample size or success rate is given. The alpha-transparency mechanism is imported from the authors' prior work [34] and re-illustrated, not re-measured. Because the causal claim depends on a high success rate over many trials, and selected screenshots are compatible with cherry-picking, the central claim is unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes a facial camouflage method that combines subtle \"warpaint\" darkening of high-density key-point regions (brow, nose bridge, jawline) with an alpha-transparency PNG attack in which a human-visible layer and a machine-readable RGB layer disagree. The authors report qualitative demonstrations against Haar cascade detection, BetaFaceAPI, Microsoft Bing Visual Search, and PimEyes, and they include pseudocode for a random-shape search intended to identify recurrent disguise patterns. The central claim is that these low-visibility perturbations \"significantly disrupt detection\" while preserving human recognizability. No code, data, trial counts, or quantitative success metrics are provided; the evidence consists largely of selected screenshots.","tokens_in":8840,"tokens_out":5305,"duration_ms":49041,"significance":"If the central claim were established quantitatively, the paper would offer a practical low-visibility obfuscation approach and a useful demonstration that alpha-layer decoupling transfers to face detection and reverse-image search. The paper has strengths: it states a falsifiable prediction, includes pseudocode for the random-shape and alpha-blending procedures, and is candid about limitations such as reliance on Haar cascades and untested video generalization. However, because the reported experiments contain no denominators, confidence scores, or negative controls, the current evidence is anecdotal. The result is therefore not yet at the standard of an archival computer-vision paper.","major_comments":[{"comment":"The central empirical claim—that subtle key-point perturbations and alpha-layer sandwiches reliably defeat commercial face detectors and reverse-image search—is supported only by illustrative screenshots. The manuscript reports no detection confidence values, no counts of successes versus failures, no number of submitted images, and no negative controls. For example, Figure 6 shows a single \"no face detected\" result and Figure 5 shows one Bing Visual Search panel with no matches. These outcomes are compatible with cherry-picking from a larger set of trials. The text should report, for each detector and condition, the trial denominator, the success rate, and the relevant confidence or similarity scores, and it should test the unperturbed baseline in the same pipeline.","section":"Results (Figs. 3, 5, 6, 7)"},{"comment":"The random-shape experiment is described as generating \"millions of alternative facial patterns\" and saving \"the collection of those patterns that pass a Haar detection\" for analysis of common elements. No such analysis is presented: there is no sample size, no number of iterations per image, no success rate, and no list of common elements. The only concrete number is the arbitrary choice of 15 shapes per face in Table 1. The claimed vertical perturbations near dense facial key points are asserted to be the common element, but the data from which that element was extracted are never shown. This omission removes the evidential basis for the main causal claim.","section":"Methods, Table 1 and accompanying text"},{"comment":"The alpha-transparency attack is essentially re-illustrated from the authors' prior work [34] rather than re-measured here. Figure 5 shows one Bing Visual Search failure, and Supplemental Material 1 gives pseudocode without reporting the parameter values used (steps, learning rate, image size) or any outcome statistics. To support the abstract's claim that faces \"disappear in machine-readable RGB layers,\" the authors should provide a quantitative comparison of altered versus unaltered PNGs over a set of queries, including the rate of zero-match results and any false matches to unrelated subjects.","section":"Results, Figure 5 and Supplemental Material 1"},{"comment":"The Conclusions state that the work \"demonstrates successful obfuscation against commercial detection systems and vision-language transformers,\" but the body evidence is limited to a few screenshots. The Discussion itself concedes that video, robust deep detectors (MTCNN, RetinaFace, YOLO), and multi-modal pipelines are untested. The Conclusions should be reworded to match the demonstrated scope, and the central claim should be explicitly qualified as based on a small illustrative sample unless quantitative trials are added.","section":"Discussion and Conclusions"}],"minor_comments":[{"comment":"The text contains typos: \"GDRP\" should be \"GDPR,\" and \"hajibs\" should likely be \"hijabs.\"","section":"Introduction"},{"comment":"The random-shape generation parameters (shape count, size ranges, color ranges, transparency, random seed) are not specified clearly enough for reproduction; the number 15 appears arbitrary and should be justified or varied.","section":"Methods, Table 1"},{"comment":"The alpha-blending pseudocode omits concrete values for the image size, number of steps, and learning rate; without these, the procedure cannot be reproduced from the paper alone.","section":"Supplemental Material 1"},{"comment":"The figures would be easier to interpret with clear annotations showing which output is a detection, which is a bounding box, and which is a zero-match result; currently the reader must infer this from the text.","section":"Figures 3 and 5"},{"comment":"The statement that shape transparency \"can vary the expected success of the disguise\" is supported only by a qualitative figure; at minimum, detection outcomes should be tabulated for each transparency level.","section":"Results, Supplemental Material 2"},{"comment":"Reference [34] is central to the alpha-transparency mechanism; the manuscript should clarify precisely which components are new contributions beyond that prior work and which are re-demonstrations.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"I weighed reject as an option because the central empirical claim is unverified as written. I chose major_revision rather than reject because the missing quantitative validation is, in principle, obtainable within the paper's scope: the authors could rerun the same detectors and search engines with trial counts, confidence scores, and negative controls, and could release code and data. If such evidence is not supplied in a revised version, the paper should be rejected. The manuscript may otherwise be better suited to a workshop or short-report venue than to a full archival journal."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper shows a few screenshots of a face drawn with makeup-like vertical lines that make BetaFaceAPI fail to detect it, and re-runs the authors' earlier alpha-transparency trick against Bing Visual Search. The genuinely new bit is the systematic ablation around the brow, nose bridge, and jawline, plus a randomized-shape search procedure that sounds like it could identify robust disguise patterns. That procedure is never actually analyzed: the pseudocode says the successful patterns get 'saved and analyzed for common elements,' but no such analysis appears anywhere in the text. Claims of 'millions of alternative facial patterns' are made without any counts.\n\nWhat the paper does well: it is honestly written about its own limitations (static images, Haar vs. deep detectors, possible social scrutiny), it cites the relevant prior art including Guetta et al.'s natural makeup attack, and the alpha-layer mechanism is clearly described enough to reproduce. The idea that subtle tonal changes at dense key-point regions can break detection is not crazy; the supporting evidence just isn't there.\n\nThe soft spots are large. Every positive result is a selected screenshot. There are no success/failure counts, no confidence scores, no number of trials, and no negative controls. The random-shape experiment is described but its results are not reported, so we cannot tell if the 'vertical lines' finding is a robust effect or a lucky pick. The alpha-transparency attack is imported from the authors' prior paper [34] and re-illustrated rather than re-measured; it might work on Bing today, but that is a single black-box observation. Finally, the paper only tests two commercial APIs plus Haar cascades, not modern deep detectors like MTCNN or RetinaFace, so the generality claim in the abstract outruns the experiments.\n\nBottom line: this is a reasonable tech note / starting point, not a validated result. A serious referee would ask for basic statistics and the saved pattern analysis, so the paper deserves a closer look rather than a desk reject, but it should not be published in its current form. My reading-group pick would be a pass; I would not cite it for any operational claim until the missing data appear.","headline":"A plausible privacy-attack idea with an interesting ablation, but the absence of any quantitative evaluation makes the central claim unverified.","tokens_in":9402,"tokens_out":2000,"would_cite":false,"duration_ms":18675,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Subtle camouflage at the brow, nose bridge, and jawline can hide a face from AI detectors while leaving it visible to humans.","keywords":["facial camouflage","face detection evasion","alpha transparency attack","facial key-point perturbation","reverse image search","Haar cascade classifier","privacy-enhancing disguise","CV dazzle"],"falsifier":"A direct test would take a fixed set of, say, 100 real faces, apply the same brow, nose-bridge, and jawline perturbations plus the alpha-layer sandwich, and submit each image to BetaFaceAPI, Bing Visual Search, and PimEyes while recording detection confidence and match outputs. If the no-detection rate is low or inconsistent across trials, the reported screenshots are not evidence of a general effect; if it is high and stable, the central claim is supported.","tokens_in":8402,"feed_emoji":"🎭","tokens_out":5794,"duration_ms":51995,"temperature":0.7,"pith_summary":"The paper tries to establish that a face can be made invisible to machine recognition without being disguised to human eyes. It argues that small, targeted changes to high-density facial key-point areas—the brow, nose bridge, and jawline—plus an alpha-transparency trick in PNG images can make commercial face detectors and reverse image searches fail. The authors test this with a Haar-cascade detector, BetaFaceAPI, Microsoft Bing Visual Search, and PimEyes, and report that vertical line-like perturbations near these key points are the common element in successful disguises. If true, the result matters because it points to a low-visibility way to evade surveillance and mass face indexing: camouflage that does not look like a mask or costume.","feed_headline":"Subtle face paint can hide faces from AI detection","feed_subtitle":"Targeted brow, nose, and jawline tweaks plus a PNG transparency trick keep faces human-visible but machine-invisible.","key_machinery":"The machinery is a two-layer attack. First is a key-point camouflage: randomized or hand-drawn shapes (rectangles, circles, triangles, and lines) are placed near the facial regions that face detectors rely on—brow, nose bridge, and jawline—so that the detector's key-point model no longer returns a positive face. Second is an alpha-transparency sandwich: in a PNG file, the alpha layer shows the unaltered face to a human viewer while the RGB layer holds the disguised face that the machine reads when the transparency is flattened. The random-shape iteration procedure (Table 1) is what lets the authors search the space of possible disguises and collect the common elements of the ones that break detection.","core_discovery":"The central claim is that subtle cosmetic coverings—darkened angular shapes over the brow, nose bridge, jawline, and mouth—can prevent a detected face from being classified as a face, while the same face remains plainly visible to a person. The paper's second claim is that a PNG image can carry two contradictory layers: the human-visible alpha layer shows a normal face, but the machine-read RGB layer contains the cosmetically obscured face, so reverse image search and vision-language models see no match. Across the reported experiments, the authors find the strongest effect when vertical perturbations sit near dense key points, and find that removal of the brow line in particular restores recognition. The authors present this as an advance over CV dazzle, adversarial patches, and Juggalo makeup, which are theatrical and therefore draw attention; the new class is meant to be scalable and socially plausible.","pith_inferences":["The alpha-transparency trick is not obviously limited to faces; the same two-layer PNG could hide any object the machine reads from the RGB layer, so the attack may extend to general image search and object detection.","A natural next experiment, which the paper's discussion points toward, is testing the same camouflage against depth cameras and thermal sensors; if those still recognize the face, the method only defeats visible-light, image-only systems.","The reported sensitivity to vertical brow-line perturbations suggests a specific, testable hypothesis: detectors that place dense key points around the eyes and brow are disproportionately disrupted by thin line-like occlusion in that region."],"forward_implications":["If the effect is general, a person could darken or reshape a few facial contours with makeup and become undetectable to standard image-based face detectors without looking disguised.","The alpha-layer attack, if it transfers, would let users publish PNG portraits that look normal on a screen but return no matches in reverse image search.","Because the method works on static images, it would apply to profile photos and shared images, not just live surveillance footage.","The random-shape iteration process could generate many distinct successful disguises, making it harder for a system to retrain on a fixed set of known disguise templates."],"supporting_citations":[{"why":"The commercial face detector whose key-point outputs and no-face results are the paper's central evidence.","marker":"[30]"},{"why":"The Haar cascade face detector used in the iterative random-shape experiment that identifies which perturbations break detection.","marker":"[36]"},{"why":"The earlier alpha-transparency attack that the paper extends to face camouflage with the two-layer PNG sandwich.","marker":"[34]"},{"why":"The key-point map that defines the dense facial regions (lips, eyes, jawline, nose bridge) the disguise targets.","marker":"[37]"},{"why":"The reverse face search service reported to fail on the disguised images.","marker":"[38]"}],"fun_headline_variants":["Subtle face tweaks fool AI, keep humans seeing you","Camouflage that works: AI can't see your face, but people can","Facial camouflage: visible to humans, invisible to AI","Smart face paint hides from AI, not humans","AI-proof face: subtle makeup defeats recognition"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper's load-bearing premise is that the few screenshots in which BetaFaceAPI or Bing reports no face represent a general, reliable effect, because no counts, confidence scores, or reproducibility data are reported.","fun_headline_variants_meta":{"raw":{"variants":["Subtle face tweaks fool AI, keep humans seeing you","Camouflage that works: AI can't see your face, but people can","Facial camouflage: visible to humans, invisible to AI","Smart face paint hides from AI, not humans","AI-proof face: subtle makeup defeats recognition"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00074,"raw_usage":{"total_tokens":3271,"prompt_tokens":877,"completion_tokens":2394,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":493,"completion_tokens_details":{"reasoning_tokens":2312}},"tokens_in":493,"tokens_out":2394,"duration_ms":15051,"temperature":1.0,"reasoning_tokens":2312,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T13:03:28.112542+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A direct test would take a fixed set of, say, 100 real faces, apply the same brow, nose-bridge, and jawline perturbations plus the alpha-layer sandwich, and submit each image to BetaFaceAPI, Bing Visual Search, and PimEyes while recording detection confidence and match outputs. If the no-detection rate is low or inconsistent across trials, the reported screenshots are not evidence of a general effect; if it is high and stable, the central claim is supported.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The commercial face detector whose key-point outputs and no-face results are the paper's central evidence."},{"cited_title":"(2017, October)","cited_arxiv_id":null,"evidence_quote":"The Haar cascade face detector used in the iterative random-shape experiment that identifies which perturbations break detection."},{"cited_title":"Exploiting Alpha Transparency In Language And Vision-Based AI Systems","cited_arxiv_id":"2402.09671","evidence_quote":"The earlier alpha-transparency attack that the paper extends to face camouflage with the two-layer PNG sandwich."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The key-point map that defines the dense facial regions (lips, eyes, jawline, nose bridge) the disguise targets."},{"cited_title":"Processing complete","cited_arxiv_id":null,"evidence_quote":"The reverse face search service reported to fail on the disguised images."}],"review_version":1}