{"id":"774a3651-d9c4-44e0-852e-d5dabde0dc38","arxiv_id":"2501.08665","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A review of facial image privacy protection methods for cloud services, categorizing them into obfuscation and adversarial perturbation, with a limited experimental comparison.","lead":"This paper surveys methods that alter facial images before uploading them to the cloud, so that face recognition systems cannot identify the person. It groups the methods into obfuscation-based and adversarial perturbation-based, and compares a handful of perturbation methods with its own experiments.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Quantitative comparison in Section IV-B mixes incompatible threat models: Fawkes and OPOM are measured under protocols unlike their intended use, so the PSR rankings in Figs. 2–3 are not reliable evidence for the paper's comparative claims.","rationale":"The survey's central claim includes an 'in-depth analysis' with quantitative comparisons. That claim is load-bearing because it is what distinguishes the paper from a simple bibliography. The Section IV-B protocol is not equivalent across methods: EM/REM are evaluated as training-time poisons, OPOM is an inference-time cloak, and APF/TIP-IM are inference-time adversarial perturbations, while Fawkes is a training-time cloak. Feeding all of APF/Fawkes/TIP-IM to a pretrained ArcFace and reporting PSR ignores Fawkes's designed mechanism. Likewise, the train-on-protected protocol used for EM/REM/OPOM is not OPOM's intended use. The reader's weakest_assumption identified exactly this comparability/fair-representation problem, so I agree. A concrete re-run under intended protocols would settle whether the numbers are artifacts. Because the flaw is in the experimental support for the quantitative claim, the paper should either correct the evaluation or soften the claim; the CONDITIONAL verdict is appropriate, so no verdict change is needed.","tokens_in":8846,"tokens_out":8103,"duration_ms":85420,"concrete_test":"Re-run the Section IV-B comparison for Fawkes and OPOM using each method's original intended protocol: for Fawkes, train an ArcFace/IR-SE model on the protected images and compute PSR on clean held-out probe images (as in Fawkes's original paper); for OPOM, apply the mask to query images and measure misclassification against a pretrained recognizer instead of using protected images as training data. If Fawkes PSR changes from ~89% to above 95%, or OPOM from ~77% to above 90%, the reported rankings are artifacts of the mismatched protocol and the quantitative claim should be revised or removed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central quantitative claim rests on Section IV-B, but the two experiments there do not measure the methods under their intended threat models. For EM/REM/OPOM, protected images are used to train a face recognition model and PSR is computed on clean test images. This is appropriate for EM and REM, which are unlearnable-example (data-poisoning) methods, but not for OPOM, whose mask is an inference-time adversarial cloak optimized against a feature subspace. For APF/Fawkes/TIP-IM, the text says protected images are fed directly to a pretrained ArcFace model and PSR is computed. That is a suitable inference-time setting for APF and TIP-IM, but Fawkes is designed to prevent a model trained on cloaked images from recognizing the user; its original protocol trains on the protected images and tests on clean probes. Therefore Fig. 3's 'Fawkes has low protection success rate' and Fig. 2's 'OPOM low success rate' may be artifacts of protocol mismatch. The comparison does not 'fairly represent each method's intended use' as the reader's weakest assumption requires, and the survey's quantitative conclusions are not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper surveys methods for preserving facial image privacy in cloud-based services, dividing them into image obfuscation-based and adversarial perturbation-based approaches. It provides qualitative comparisons through two tables, a quantitative comparison of six adversarial perturbation methods using protection success rate (PSR) and SSIM on CASIA-WebFace and LFW, and a discussion of future research directions. The abstract claims a comprehensive review with qualitative and quantitative comparisons of both categories.","tokens_in":9033,"tokens_out":4259,"duration_ms":38338,"significance":"If the quantitative comparison were reliable, the survey would provide a useful structured overview and a comparative baseline for adversarial perturbation-based facial privacy protection. The categorization into obfuscation and perturbation methods, the qualitative tables, and the proposed research directions are reasonable and potentially helpful to researchers entering the field. However, the quantitative evaluation is the paper's distinctive contribution, and its credibility is currently undermined by protocol mismatches that make the reported rankings unreliable.","major_comments":[{"comment":"The evaluation protocol used for EM, REM, and OPOM is to train a face recognition model on 80% protected images and test on 20% clean images. This is appropriate for EM and REM, which are unlearnable-example (data-poisoning) methods, but not for OPOM, which is an inference-time adversarial cloak optimized to be added at test time. Evaluating OPOM under a training-time poisoning protocol measures something other than its intended use, so the low PSR reported for OPOM in Fig. 2 should not be interpreted as a fair assessment of its protection effectiveness.","section":"Section IV-B, first experiment"},{"comment":"The protocol used for APF, Fawkes, and TIP-IM is to feed protected images directly to a pretrained ArcFace model and compute PSR. This is suitable for APF and TIP-IM, which are inference-time adversarial perturbations, but not for Fawkes, which is designed to prevent a model from learning to recognize cloaked images during training, as the paper itself notes in Section III-B. The low PSR for Fawkes in Fig. 3 is likely an artifact of evaluating it at inference time on a model that was never trained on Fawkes-cloaked images. The comparison therefore does not fairly represent each method's intended threat model, and the quantitative rankings in Figs. 2-3 do not support the paper's comparative claims.","section":"Section IV-B, second experiment"}],"minor_comments":[{"comment":"The sentence 'The comparison results of these four methods are shown in Fig. 2 and Fig. 4' should say 'three methods,' since Fig. 2 compares EM, REM, and OPOM only.","section":"Section IV-B"},{"comment":"In the description of the second experiment, 'we calculated the PSA' should be 'we calculated the PSR,' because the metric is protection success rate throughout.","section":"Section IV-B"},{"comment":"The abstract claims 'quantitative comparisons of their effectiveness' for both categories, but Section IV-B explicitly states that quantitative evaluation is performed only for adversarial perturbation methods because codes for most obfuscation methods are unavailable. The abstract should be qualified to avoid overstating the coverage.","section":"Abstract and Section IV-B"},{"comment":"The abbreviation MMD is expanded inconsistently: 'Max Mean Discrepancy' in Section III-B and 'maximum average difference' in Section IV-B. The correct term is Maximum Mean Discrepancy; please harmonize.","section":"Section III-B and Section IV-B"},{"comment":"The statement that 'only EM, REM, APF, and Fawkes can also maintain the protection ability' in out-of-distribution data leakage scenarios is too strong, because other methods are marked 'Not discussed' in Table II rather than shown ineffective; the wording should reflect the lack of evidence.","section":"Section IV-A"}],"recommendation":"major_revision","confidential_remarks":"The main obstacle is the threat-model mismatch in the quantitative comparison. If the authors can rerun the evaluation under each method's original protocol, or clearly reframe the experiment as a standardized stress test rather than a fair comparison, the paper could be acceptable. As presented, the quantitative conclusions are not supported and require substantial revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: a workmanlike survey of face-privacy protection methods, with a small re-run of six adversarial methods that is less compelling than the authors claim. The two-category split (obfuscation vs. adversarial perturbation) is fine but not new; the qualitative tables are useful, and the paper is an okay entry point.\n\nWhat's actually new: the quantitative comparison in Section IV-B, which re-runs EM, REM, OPOM, APF, Fawkes, and TIP-IM under a common protocol. That is a modest but real addition, and the authors are transparent that obfuscation methods are excluded because code is unavailable. The DSSIM/MMD discussion in the qualitative section is accurate.\n\nSoft spots: the comparison is not as fair as presented. The stress-test is right about Fawkes. Feeding Fawkes-protected images to a pretrained ArcFace model at inference time does not match the threat model in the Fawkes paper, which is about preventing a model trained on cloaked images from learning your identity. So the 'low protection success rate' for Fawkes in Fig. 3 is likely an artifact. The same concern is less clearly valid for OPOM: the survey's own description frames OPOM as a training-time class-wise perturbation, and their protocol (protect 80% of images, train, test on clean 20%) fits that. I would not extend the protocol-mismatch critique to OPOM on the basis of this text. Also, the 'four methods' text with three bars, the 'PSA' typo, and the missing comparison of obfuscation methods undercut the 'comprehensive' claim. The obfuscation section is thin: only six methods, and the qualitative table has several 'Not discussed' entries.\n\nThe central argument holds up as a survey: the categorization is sensible and the future directions are reasonable, if standard. It does not resolve an open problem or introduce a technique, but it does not pretend to.\n\nWho it is for: a grad student starting out, or a researcher who wants a quick map of the area. A serious referee should see it, mainly to tighten the experimental protocol and fix the internal inconsistencies. The paper deserves peer review rather than desk rejection, but it needs a major revision before acceptance.","headline":"A readable survey with a modest re-run of six methods, but the quantitative comparison is unreliable for Fawkes and the 'comprehensive' claim outruns the coverage.","tokens_in":9514,"tokens_out":3070,"would_cite":false,"duration_ms":29059,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A structured review of facial-image privacy protection, organized as image obfuscation versus adversarial perturbation, with quantitative benchmarks of six perturbation methods.","keywords":["facial image privacy","cloud-based services","image obfuscation","adversarial perturbation","face recognition","unlearnable examples","privacy protection"],"falsifier":"Re-running the six perturbation methods with each method's own recommended hyperparameters instead of the uniform budget and finding a different PSR/SSIM ranking, for example Fawkes outprotecting APF, would undercut the survey's comparative conclusions.","tokens_in":8650,"feed_emoji":"🔒","tokens_out":6653,"duration_ms":55861,"temperature":0.7,"pith_summary":"This survey aims to give cloud-service users a reliable map of how to keep their facial images from being learned by face recognition models. It sorts the field into two families: image obfuscation, which blurs, re-generates, or masks facial identity, and adversarial perturbation, which adds tiny noise that makes images 'unlearnable.' The authors run a qualitative comparison across practical dimensions such as open-set recognition, real-time speed, and scalability, and a quantitative comparison of six perturbation methods measuring both how often protection defeats a recognizer and how similar the protected image looks. A reader who wants to know which published method to try, or where the field is failing, gets a structured answer.","feed_headline":"Survey maps two families of face-privacy defenses and rates them","feed_subtitle":"Obfuscation and adversarial noise both make faces unlearnable, but only some hold up in real-world recognition.","key_machinery":"The central machinery is a two-way taxonomy paired with a standardized evaluation protocol: protection success rate (the fraction of protected images that a face recognizer misidentifies) measured together with structural similarity (how close the protected image looks to the original to the human eye). The quantitative part runs the released implementations of EM, REM, OPOM, APF, Fawkes, and TIP-IM under shared settings—CASIA-WebFace with Inception ResNet for the non-auxiliary group, LFW with ArcFace for the auxiliary group, a uniform perturbation budget of 0.03, and averaged SSIM—so that the methods' privacy and quality trade-offs are compared on a common footing.","core_discovery":"The paper's central claim is that current facial-image privacy protection in cloud services falls into two distinct technical families, and that they trade off differently. Image obfuscation methods (makeup transfer, latent-space blurring, diffusion-based anonymization, optical encoders) can hide identity from commercial APIs and support open-set scenarios, but often at the cost of visual fidelity, scalability, or real-time speed. Adversarial perturbation methods (error-minimizing noise, class-wise masks, universal filters, identity masks) keep images visually close to the original, and the survey's own runs of the released code show that among methods needing no auxiliary data, REM reaches about 88% protection success rate at 90.8% SSIM, while among auxiliary-data methods TIP-IM reaches about 94% at 90.9% SSIM, balancing protection with image quality better than APF and Fawkes under the stated protocol. This balance is the paper's evidence that no single method dominates; the choice depends on the threat model and quality budget.","pith_inferences":["A hybrid pipeline that combines perturbation for identity unlearnability with obfuscation for attribute-level privacy is a natural next step that the paper describes but does not itself evaluate.","Because the quantitative comparison fixes one perturbation budget for all methods, methods tuned for larger or smaller budgets could be misranked; testing each method at its native budget is a concrete follow-up.","The survey's finding that few methods handle open-set recognition suggests that cloud vendors could defeat user-side protection by training on external clean images; one testable check is whether retraining with heavy augmentation collapses the reported PSR gaps.","The exclusion of obfuscation methods from the quantitative runs, because their code is unavailable, leaves open the possibility that diffusion-based anonymization would outperform perturbation methods on the same PSR/SSIM scale."],"forward_implications":["A user who wants to publish a selfie without feeding a commercial face recognizer can apply an adversarial perturbation such as REM or TIP-IM and keep the image visually close to the original.","Image obfuscation methods such as makeup transfer or diffusion-based anonymization are better suited when the goal is open-set or whole-scene protection, but they must be checked for visual artifacts and compute cost.","Most adversarial perturbation methods protect against close-set training on the protected images themselves; they are not designed to stop a recognizer that already has clean images of the same person from other sources.","The survey's standardized PSR/SSIM protocol gives future method developers a concrete baseline to report against, which should make cross-paper comparisons easier.","Video, surveillance-like conditions, and training pipelines with data augmentation remain open gaps, so current protection should be considered partial rather than permanent."],"supporting_citations":[{"why":"Supplies the class-wise mask method OPOM, whose PSR/SSIM anchors the non-auxiliary quantitative comparison.","marker":"[3]"},{"why":"Defines makeup-transfer obfuscation (AMT-GAN), a core example of the image-obfuscation family and its API/open-set properties.","marker":"[4]"},{"why":"Provides the targeted identity-mask method TIP-IM and the MMD loss that anchors the auxiliary-data quantitative comparison.","marker":"[5]"},{"why":"Introduces latent-space blurring (DeepBlur) as a whole-image obfuscation baseline and a qualitative comparison row.","marker":"[6]"},{"why":"Contributes diffusion-based pixel-level anonymization (Diff-Privacy), used as the obfuscation method with real-time and open-set capability.","marker":"[8]"},{"why":"Supplies the hardware optical-encoder approach (Optics) that the survey rates for real-time capability and low scalability.","marker":"[9]"},{"why":"Defines error-minimizing unlearnable examples (EM), the non-auxiliary baseline that the first experiment measures.","marker":"[11]"},{"why":"Introduces robust error-minimizing noise (REM), which the first experiment finds to balance PSR and SSIM.","marker":"[12]"},{"why":"Provides the end-cloud adversarial privacy-preserving filter (APF), measured in the auxiliary-data comparison and noted for distortion.","marker":"[14]"},{"why":"Supplies the target-class protection method Fawkes, whose DSSIM-based naturalness and low PSR are compared against APF and TIP-IM.","marker":"[15]"}],"fun_headline_variants":["Two families of face privacy defenses, head-to-head in the cloud","Face privacy survey: obfuscation vs. adversarial, trade-offs exposed","How to hide faces from cloud AIs: two strategies, one comparison","Cloud face privacy: which method keeps identity secret best?","Survey pits face obfuscation against adversarial noise for cloud"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The comparison assumes that running each method's published code under the same benchmark settings gives numbers that fairly represent how well the method would work in real cloud use.","fun_headline_variants_meta":{"raw":{"variants":["Two families of face privacy defenses, head-to-head in the cloud","Face privacy survey: obfuscation vs. adversarial, trade-offs exposed","How to hide faces from cloud AIs: two strategies, one comparison","Cloud face privacy: which method keeps identity secret best?","Survey pits face obfuscation against adversarial noise for cloud"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000684,"raw_usage":{"total_tokens":3070,"prompt_tokens":877,"completion_tokens":2193,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":493,"completion_tokens_details":{"reasoning_tokens":2102}},"tokens_in":493,"tokens_out":2193,"duration_ms":14855,"temperature":1.0,"reasoning_tokens":2102,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T20:19:38.046319+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-running the six perturbation methods with each method's own recommended hyperparameters instead of the uniform budget and finding a different PSR/SSIM ranking, for example Fawkes outprotecting APF, would undercut the survey's comparative conclusions.","supporting_citations":[{"cited_title":"Opom: Customized invisible cloak towards face privacy protection,","cited_arxiv_id":null,"evidence_quote":"Supplies the class-wise mask method OPOM, whose PSR/SSIM anchors the non-auxiliary quantitative comparison."},{"cited_title":"Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer,","cited_arxiv_id":null,"evidence_quote":"Defines makeup-transfer obfuscation (AMT-GAN), a core example of the image-obfuscation family and its API/open-set properties."},{"cited_title":"Towards face encryption by generating adversarial identity masks,","cited_arxiv_id":null,"evidence_quote":"Provides the targeted identity-mask method TIP-IM and the MMD loss that anchors the auxiliary-data quantitative comparison."},{"cited_title":"Diff-privacy: Diffusion- based face privacy protection,","cited_arxiv_id":null,"evidence_quote":"Contributes diffusion-based pixel-level anonymization (Diff-Privacy), used as the obfuscation method with real-time and open-set capability."},{"cited_title":"Privacy-preserving optics for enhancing protection in face de-identification,","cited_arxiv_id":null,"evidence_quote":"Supplies the hardware optical-encoder approach (Optics) that the survey rates for real-time capability and low scalability."},{"cited_title":"Unlearnable examples: Making personal data unexploitable,","cited_arxiv_id":null,"evidence_quote":"Defines error-minimizing unlearnable examples (EM), the non-auxiliary baseline that the first experiment measures."},{"cited_title":"Robust unlearnable examples: Protecting data privacy against adversarial learning,","cited_arxiv_id":null,"evidence_quote":"Introduces robust error-minimizing noise (REM), which the first experiment finds to balance PSR and SSIM."},{"cited_title":"Adversarial privacy-preserving filter,","cited_arxiv_id":null,"evidence_quote":"Provides the end-cloud adversarial privacy-preserving filter (APF), measured in the auxiliary-data comparison and noted for distortion."},{"cited_title":"Fawkes: Protecting privacy against unauthorized deep learning models,","cited_arxiv_id":null,"evidence_quote":"Supplies the target-class protection method Fawkes, whose DSSIM-based naturalness and low PSR are compared against APF and TIP-IM."}],"review_version":1}