{"id":"e955e83b-0181-4b94-b5dc-5d8c477e76a3","arxiv_id":"2507.22153","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"AvatarLDP and AvatarRotation distort identity embeddings to create de-identified but photorealistic 2D and 3D avatars while aiming to preserve age, race, and gender.","lead":"This paper proposes two methods that distort a user's facial identity inside a generative model before rendering, producing photorealistic avatars that preserve demographic traits but fail face matching to the user. The goal is to let people use realistic avatars in public mixed-reality spaces without leaking a biometric identifier.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"End-to-end privacy claim is not supported: identity leakage through unperturbed context features yields ~15% re-identification even with uniform-random identity embeddings, so AvatarLDP's embedding-level DP guarantee does not transfer to rendered avatars.","rationale":"The central claim would require the privatized avatar's output distribution to be approximately independent of the true identity. The random-sampling baseline is the cleanest test of this: when the identity embedding is maximally privatized, any remaining identification is leakage through non-identity features. At ~15% rank-1 versus 0.1% chance, the output is far from identity-independent, so the differential privacy guarantee cannot be presented as an end-to-end property. This is the same load-bearing assumption the reader identified (identity disentanglement), and the paper's own Figure 9 documents failure cases. I do not think this invalidates the contribution, because AvatarRotation provides strong empirical de-identification at large θ and the paper is transparent about limitations; but the headline claim needs to be scoped to embedding-level guarantees with residual identity leakage. The mis-calibrated VMF ε (ignoring the sensitivity Δ in Theorem 1) is a separate formal error: as written, VMF(xid, ε) yields at most ε·π LDP, so reported ε values overclaim the formal guarantee by a constant factor. That error reinforces, but is secondary to, the end-to-end composition problem. The 3D evaluation's confinement to the 256 training identities is an additional generalization concern, but the leakage issue is more load-bearing because it directly contradicts the strongest privacy statement. Hence I keep the reader's CONDITIONAL verdict.","tokens_in":22732,"tokens_out":11225,"duration_ms":148153,"concrete_test":"Hold the privatized identity embedding fixed to a single random vector for all source identities in the SimSwap and GHOST random-sampling setups, and re-run rank-1 matching. If matching to the source identity stays substantially above the ~0.1% chance level (e.g., >1%), the residual identification is caused by source-dependent context features that AvatarLDP never perturbs, confirming that the embedding-level LDP guarantee does not compose to the rendered avatar.","verdict_should_be":"UNCHANGED","load_bearing_attack":"AvatarLDP's provable guarantee applies to the sampled identity embedding xid (Eq. 1), not to the final rendered avatar. The generator consumes, in addition to the privatized embedding, source-dependent contextual features that are never perturbed. The full mechanism A(source) = G(VMF(Enc_id(source)), Enc_ctx(source)) is therefore not a post-processing of the private embedding alone, and the standard DP post-processing property does not apply. The paper's own random-sampling rows demonstrate the consequence: with the identity embedding drawn uniformly at random (ε→0, so no identity information remains in that path), SimSwap still has 14.54% rank-1 re-identification and GHOST 14.96%, against a ~0.1% chance baseline (Tables I and III). This residual matching must come from context or other channels. Hence the abstract's claim that AvatarLDP 'provides differential privacy guarantees' for user appearance is only true for an embedding query, not for the avatar output; the 'without privacy risk' framing is unsupported. Section VIII-B and Figure 9 acknowledge the leakage, but treating it as future work understates that the formal guarantee and the empirical privacy floor are set by the generator's disentanglement, not by the proposed mechanism. AvatarRotation at θ≥135° still gives useful empirical privacy, so this is a caveat to the formal claim rather than a refutation of the whole system.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes two mechanisms, AvatarLDP and AvatarRotation, for de-identifying photorealistic self-avatars by perturbing the identity embedding inside identity-encoding generative models. AvatarLDP samples a new identity vector from a von Mises-Fisher distribution centered on the original embedding and claims ε-LDP guarantees; AvatarRotation rotates the identity vector by a user-specified angle along a random direction. The methods are implemented on two 2D face-swapping models (SimSwap and GHOST) and one 3D codec avatar model, and evaluated with rank-k identification, EER, SSIM, and demographic/expression classifiers. The paper reports that strong privacy settings reduce rank-1 identification to near the random-sampling floor while largely preserving photorealism and non-identity attributes, and it compares favorably against PixelDP, MetricSVD, and IdentityDP baselines.","tokens_in":23055,"tokens_out":5577,"duration_ms":71335,"significance":"The paper is a useful first exploration of privacy-preserving rendering for photorealistic 3D avatars, a timely problem as social VR and MR deploy realistic avatars. Its strengths include an honest empirical evaluation, explicit acknowledgment of identity-disentanglement leakage, and released code for the algorithms and evaluation pipeline, which supports reproducibility. If the formal claims are corrected, the work would be a solid contribution: it demonstrates that embedding-space perturbation can be adapted across heterogeneous generative architectures and provides a concrete comparison point for future privacy mechanisms in XR. The central formal claims, however, currently require revision: the ε calibration of the VMF mechanism is inconsistent with the paper's own Theorem 1, and the DP guarantee is argued for the identity embedding rather than the rendered avatar, leaving an unquantified residual leakage path through unperturbed context features.","major_comments":[{"comment":"The VMF mechanism is claimed to satisfy ε-LDP, but this is not what follows from the paper's own Theorem 1. Theorem 1 states that an ε d_X-private mechanism A_ε must be composed with the sensitivity Δ of the query to yield ε-DP, i.e., A_{ε/Δ} ∘ f is ε-DP. On the unit hypersphere, the maximum angular distance is π, so using the d_∠ metric requires sampling from VMF(x_id, ε/π) to achieve ε-LDP; using the Euclidean d_2 metric, whose maximum on S^{n-1} is 2, requires VMF(x_id, ε/2). Equation (1) instead uses VMF(x_id, ε) and the text repeatedly states that this is ε-LDP. The actual guarantee is therefore ε·π-LDP (or 2ε-LDP) for the stated mechanism, and the ε values in Tables I–III are not directly comparable with the ε of IdentityDP. This is a load-bearing error in the formal privacy claim and should be corrected by reparameterizing the concentration or by explicitly reporting the privacy parameter after sensitivity scaling.","section":"Section V-D and Eq. (1)"},{"comment":"The differential privacy guarantee applies to the sampled identity embedding x̃_id, not to the rendered avatar. The full mechanism is A(source) = G(VMF(Enc_id(source)), Enc_ctx(source)), where Enc_ctx(source) and the generator G are not post-processing of x̃_id alone, so the standard DP post-processing property does not transfer the guarantee to the output avatar. The paper's own random-sampling rows demonstrate this: with the identity embedding drawn uniformly at random (ε→0, so no identity information remains in that path), SimSwap retains rank-1 re-identification of 14.54% and GHOST 14.96%, against a chance baseline near 0.1%. This residual matching must come from context features or other non-perturbed channels. The abstract's claim that AvatarLDP 'provides differential privacy guarantees' for user appearance and the phrase 'without privacy risk' are therefore unsupported. Section VIII-B acknowledges the disentanglement limitation, but it is presented as future work rather than as a qualification of the main privacy claim. The manuscript should be reframed to state that the formal guarantee is embedding-level, and the avatar-level residual re-identification risk should be reported as part of the headline results.","section":"Section VI-A, Eq. (1), Tables I and III"},{"comment":"The 3D evaluation is restricted to the N=256 identities used to fit the PCA remapping in Eqs. (4)–(5). The same identities form both the PCA training set and the evaluation gallery, and no held-out identities are used. This makes the 3D rank-1 rates, such as the 1.95% random-sampling floor, hard to interpret for generalization to new users: the nearest-neighbor reconstruction in Eq. (5) may behave differently for an identity outside the PCA training set, and the privacy-utility trade-off may be confounded by the model's memorization of the training identities. The claim that the methods 'generalize across generative architectures in 2D and 3D' needs support from an evaluation with held-out identities or an external 3D avatar dataset, or the claim should be explicitly scoped to the 256-identity setting.","section":"Section VI-C and Table II"}],"minor_comments":[{"comment":"The heading and text misspell Weggenmann and Kerschbaum as 'Kershbaum' in several places; the name should be corrected.","section":"Section V-D"},{"comment":"The quantities b1 and b2 are used in Rodrigues' formula before their definition is fully explained; the sentence defining them as columns of U/|U| should be clarified and placed before Eq. (3).","section":"Section VI-A, Eq. (2)"},{"comment":"The 3D rank-1 estimates are computed on only 256 identities, so confidence intervals or a statement of statistical uncertainty would help; with 256 trials, the difference between 0.78% and 1.95% is within a plausible sampling range.","section":"Section VII-A and Table II"},{"comment":"There is a typo, 'phone scanes', which should read 'phone scans'.","section":"Section VIII-D"},{"comment":"The failure cases show only the SimSwap architecture; since GHOST also shows a random-sampling re-identification floor of 14.96%, including GHOST failure cases or explaining why they are omitted would strengthen the disentanglement discussion.","section":"Figure 9"}],"recommendation":"major_revision","confidential_remarks":"I see no evidence of misconduct or novelty suppression. The paper fits the scope of privacy work for XR and interactive systems. The main concerns are technical and fixable: the ε calibration error in the VMF mechanism and the gap between embedding-level DP and avatar-level privacy. I would encourage the editor to request a revision rather than reject, because the empirical comparison and released code are valuable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version. This is the first work I know of to apply privacy mechanisms directly to 3D avatar identity embeddings, and the PCA remap that lets VMF noise work on sparse codec-avatar features is a genuinely enabling trick. The 2D empirical evaluation is honest, the baselines are fair, and the code is public. That said, the paper overclaims what the DP guarantee covers, and the identity leakage through unperturbed context channels is more central than the \"future work\" framing suggests.\n\nThe strongest part is the engineering. The Relightable Gaussian Codec Avatars model only has 256 identities and sparse embeddings, so simple noise injection collapses the output. Mapping to R16 via PCA, sampling on the hypersphere, then recombining via softmax over nearest neighbors is a sensible workaround, and it lets the same mechanism work across SimSwap, GHOST, and the 3D model. The evaluation uses standard face recognizers and external datasets, and the citation pattern is fine -- the VMF privacy proof is properly attributed to Weggenmann and Kerschbaum. I also give them credit for showing failure cases where random identity sampling still matches ~15% of the time.\n\nNow the soft spots.\n\nFirst, the DP claim is mis-calibrated. The paper calls AvatarLDP ε-LDP and uses ε as the VMF concentration parameter. But their own Theorem 1 says to get ε-DP you divide the concentration by the sensitivity of the embedding query on the sphere, which is at most π. So the stated guarantee is off by that factor. This is fixable by reparameterization, but as written the formal claim is wrong.\n\nSecond, the guarantee applies to the sampled identity embedding, not to the rendered avatar. The generator also consumes context features that are never perturbed. The full mechanism is not post-processing of the private embedding, so DP post-processing does not transfer. The paper's own random-sampling rows show the consequence: with identity drawn uniformly at random (ε→0), SimSwap still re-identifies at 14.54% and GHOST at 14.96%, against a ~0.1% chance baseline. That residual matching has to come from context or other channels. The abstract's \"without privacy risk\" is unsupported. Section VIII-B and Figure 9 acknowledge the leakage, but treating it as future work understates that the privacy floor is set by the generator's disentanglement, not by the proposed mechanism. AvatarRotation at θ≥135° still gives good empirical privacy, so this is a caveat to the formal claim, not a refutation of the system.\n\nThird and minor: the 3D evaluation is restricted to the same 256 identities used to fit the PCA, so it's in-distribution. A held-out set would be stronger, but the architecture may not allow it.\n\nBottom line: HCI/security readers get a useful empirical study and a clever remapping technique. The formal privacy label needs correction, and the end-to-end claims need softening. With those revisions, the paper is solid. I'd send it to review.","headline":"First real attempt at DP for 3D avatar identity, with honest evaluation and a clever PCA remap, but the formal guarantee is mis-calibrated and the end-to-end privacy claim outruns what the disentanglement delivers.","tokens_in":23548,"tokens_out":3616,"would_cite":true,"duration_ms":41226,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper introduces two algorithms, AvatarLDP and AvatarRotation, that de-identify photorealistic self-avatars by perturbing only the identity embedding inside generative models, preserving demographic attributes and expression while…","keywords":["differential privacy","local differential privacy","face de-identification","photorealistic avatars","mixed reality","von Mises-Fisher distribution","identity disentanglement","generative models"],"falsifier":"Take a trained identity-encoding generative model and replace the identity embedding with a uniformly random point on the hypersphere while keeping the contextual embedding fixed. If the fraction of such avatars still matched to their source identity is substantially above random chance—the paper reports about 15% for SimSwap and GHOST—then identity is leaking through non-identity channels, and the empirical privacy floor is set by the generator rather than by the privacy mechanism. A complementary test is to drive AvatarLDP to $\\varepsilon \\to 0$ on a deliberately entangled model and measure whether expression or pose classifiers drift; if they do, the claim that non-identity attributes are preserved fails.","tokens_in":22570,"feed_emoji":"🕶️","tokens_out":9113,"duration_ms":94502,"temperature":0.7,"pith_summary":"The paper proposes a way to render photorealistic self-avatars in public mixed-reality spaces without broadcasting the user's true face to other users, servers, or apps. Its central claim is that modern identity-encoding generative models separate identity from appearance context well enough that replacing or rotating only the identity embedding produces an avatar that keeps the user's apparent age, race, gender, and expression but is no longer biometrically identifiable. AvatarLDP does this by sampling a new identity from a directional probability distribution centered on the true identity, with a formal local-differential-privacy guarantee; AvatarRotation rotates the identity vector by a user-chosen angle along a random direction, giving a predictable minimum identity offset. Across two 2D face-swapping models and one 3D codec avatar model, the methods push face-identification rates toward random-chance levels while keeping photorealism and non-identity attributes largely intact. If these results hold, social VR and MR can use photorealistic avatars in untrusted public settings without turning every avatar into a searchable biometric.","feed_headline":"Two algorithms shield your face in photorealistic MR avatars","feed_subtitle":"Your MR avatar keeps your face private without breaking realism or expression.","key_machinery":"The load-bearing object is the identity embedding vector $x_{id}$ produced by the model's identity encoder, viewed as a point on the unit hypersphere $S^{n-1}$. Privacy operations act on this vector alone: AvatarLDP samples a replacement from the von Mises-Fisher distribution $\\mathrm{VMF}(x_{id}, \\varepsilon)$—a directional distribution concentrated around a mean direction—whose metric-privacy guarantee ($\\varepsilon d_\\angle$ and therefore $\\varepsilon$-LDP) is established in the cited literature and whose concentration $\\varepsilon$ acts as the privacy budget; AvatarRotation forms a random orthonormal basis containing $x_{id}$ and applies a higher-dimensional rotation matrix with fixed angle $\\theta$, so every sample is moved exactly $\\theta$ away while the direction stays random. Because some models, such as the codec avatar, embed identity into sparse, non-metric spaces, the machinery includes a PCA remap to $\\mathbb{R}^{16}$, privacy operations there, then a softmax-weighted interpolation of the nearest real embeddings to return to the model's native embedding space. The entire scheme rests on these embeddings being sufficiently disentangled: changing $x_{id}$ alone should change identity attributes while leaving expression, pose, lighting, and demographic attributes intact.","core_discovery":"The discovery this paper is trying to establish is that de-identifying a photorealistic avatar does not require blurring pixels, retraining generators, or degrading realism: it can be done by editing one vector, the identity embedding, at a point inside the generation pipeline. Identity-encoding models such as SimSwap, GHOST, and the Relightable Gaussian Codec Avatar map an input face to a high-dimensional identity vector $x_{id}$; the proposed methods treat that vector as a point on the unit hypersphere $S^{n-1}$, where identity similarity is angular distance. AvatarLDP draws the replacement identity from the von Mises-Fisher distribution $\\mathrm{VMF}(x_{id}, \\varepsilon)$, whose concentration parameter $\\varepsilon$ controls how far the new identity wanders and which yields a provable $\\varepsilon$-LDP / $\\varepsilon d_\\angle$ guarantee. AvatarRotation instead rotates $x_{id}$ by a fixed angle $\\theta$ around a random axis, producing a user-specified minimum identity offset with uncertainty in direction. For 3D codec avatars whose identity embeddings are too sparse for angular sampling, the paper adds a PCA projection into a dense 16-dimensional angular space, resampling there, and reconstructing a plausible embedding as a softmax-weighted average of nearby real identities. The result, on the paper's evidence, is an avatar that looks like the user's demographic and expressive self but defeats identity lookup, impersonation, and linkage from screenshots or stored features.","pith_inferences":["The formal privacy guarantee covers the identity embedding, but the privacy a user actually experiences is bounded by the generator's disentanglement; the observed ~15% re-identification under random identity sampling implies that platform claims should read 'de-identified up to the generator's identity channel,' not 'de-identified in the face-recognition sense.'","The PCA remap-and-reconstruct step is a general adapter: any generative model with a sparse or non-metric identity latent space could be retrofitted with the same privacy operations, which generalizes the method well beyond the three tested architectures.","Because re-identification difficulty grows with the number of identities in the gallery, a large metaverse with millions of users would likely need much milder $\\varepsilon$ or $\\theta$ values to reach the same empirical privacy, improving the utility trade-off; that prediction is testable by scaling the authors' CelebA evaluation to a larger face gallery.","Facial appearance is only one identifying stream; the paper itself notes body motion, gaze, and voice also identify users, so this method is a necessary but not sufficient component of end-to-end privacy in mixed reality and should be composed with per-modality anonymization."],"forward_implications":["Public mixed-reality environments can render photorealistic avatars while the user's true face never leaves the device: identity is altered on the device before any external renderer or server receives it.","AvatarLDP's guarantee is a formal local differential privacy bound on the released identity embedding, so it holds against adversaries who know the generation pipeline and the privacy parameters, to the extent that the generator disentangles identity.","AvatarRotation gives users a concrete privacy dial: increasing $\\theta$ produces a larger enforced identity offset, with $\\theta = 150°$ lowering rank-1 identification to about 1% on the tested 2D face-swap models.","Because the composition of AvatarLDP and AvatarRotation inherits the DP guarantee through post-processing, applications can combine provable uncertainty with a user-specified minimum offset.","The methods operate on embeddings rather than pixels or rendered frames, so they transfer across generative architectures and can be dropped into existing avatar pipelines without retraining."],"supporting_citations":[{"why":"Supplies the proof that the von Mises-Fisher mechanism satisfies $\\varepsilon d_\\angle$ metric privacy and therefore $\\varepsilon$ local differential privacy, the formal foundation of AvatarLDP.","marker":"[78]"},{"why":"SimSwap is one of the two 2D face-swapping architectures used to demonstrate that the privacy mechanisms generalize across generators.","marker":"[30]"},{"why":"GHOST is the second 2D face-synthesis architecture in the evaluation, giving a second point of comparison for privacy and utility.","marker":"[25]"},{"why":"Relightable Gaussian Codec Avatars is the fully 3D avatar model the paper privatizes; its sparse identity embeddings motivate the PCA remapping.","marker":"[3]"},{"why":"IdentityDP is the closest prior work adding LDP noise to identity embeddings; the paper compares against it and shows why additive Laplace noise collapses the 3D codec avatar model.","marker":"[64]"},{"why":"Documents the deliberate sparse, non-continuous identity latent space of codec avatars, which is why simple resampling fails and remapping is required.","marker":"[21]"},{"why":"ArcFace supplies the identity embeddings used by the 2D face-swap models, and its properties define the angular metric space the privacy mechanisms operate in.","marker":"[83]"},{"why":"Demonstrates identity leakage in ArcFace-style encoders, cited as the cause of the ~15% re-identification floor when identity is replaced by random sampling.","marker":"[70]"}],"fun_headline_variants":["Edit one vector to keep avatars realistic but unrecognizable","Differential privacy for photorealistic MR avatars","Your avatar, de-identified: realism without facial recognition","Identity hiding in MR avatars via embedding manipulation","Privacy-preserving avatars: realistic but not identifiable"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a generative model's identity embedding is disentangled enough from expression, pose, lighting, and demographics that replacing or rotating only that embedding changes who the avatar looks like while leaving everything else intact—yet the paper's own results show random identity sampling still yields roughly 15% re-identification for SimSwap and GHOST, so the privacy guarantee inherits the generator's imperfect disentanglement.","fun_headline_variants_meta":{"raw":{"variants":["Edit one vector to keep avatars realistic but unrecognizable","Differential privacy for photorealistic MR avatars","Your avatar, de-identified: realism without facial recognition","Identity hiding in MR avatars via embedding manipulation","Privacy-preserving avatars: realistic but not identifiable"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000184,"raw_usage":{"total_tokens":1383,"prompt_tokens":1076,"completion_tokens":307,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":692,"completion_tokens_details":{"reasoning_tokens":230}},"tokens_in":692,"tokens_out":307,"duration_ms":4213,"temperature":1.0,"reasoning_tokens":230,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T12:01:16.662614+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a trained identity-encoding generative model and replace the identity embedding with a uniformly random point on the hypersphere while keeping the contextual embedding fixed. If the fraction of such avatars still matched to their source identity is substantially above random chance—the paper reports about 15% for SimSwap and GHOST—then identity is leaking through non-identity channels, and the empirical privacy floor is set by the generator rather than by the privacy mechanism. A complementary test is to drive AvatarLDP to $\\varepsilon \\to 0$ on a deliberately entangled model and measure whether expression or pose classifiers drift; if they do, the claim that non-identity attributes are preserved fails.","supporting_citations":[{"cited_title":"Differential Privacy for Direc- tional Data,","cited_arxiv_id":null,"evidence_quote":"Supplies the proof that the von Mises-Fisher mechanism satisfies $\\varepsilon d_\\angle$ metric privacy and therefore $\\varepsilon$ local differential privacy, the formal foundation of AvatarLDP."},{"cited_title":"SimSwap: An Efficient Framework For High Fidelity Face Swapping,","cited_arxiv_id":null,"evidence_quote":"SimSwap is one of the two 2D face-swapping architectures used to demonstrate that the privacy mechanisms generalize across generators."},{"cited_title":"IdentityDP: Differential private identification protection for face images,","cited_arxiv_id":null,"evidence_quote":"IdentityDP is the closest prior work adding LDP noise to identity embeddings; the paper compares against it and shows why additive Laplace noise collapses the 3D codec avatar model."},{"cited_title":"ArcFace: Additive Angular Margin Loss for Deep Face Recognition,","cited_arxiv_id":null,"evidence_quote":"ArcFace supplies the identity embeddings used by the 2D face-swap models, and its properties define the angular metric space the privacy mechanisms operate in."},{"cited_title":"BlendFace: Re-designing Identity Encoders for Face-Swapping,","cited_arxiv_id":null,"evidence_quote":"Demonstrates identity leakage in ArcFace-style encoders, cited as the cause of the ~15% re-identification floor when identity is replaced by random sampling."}],"review_version":1}