Pith. sign in

REVIEW 3 major objections 5 minor 73 references

Restoring Gaussian Blurred Face Images for Deanonymization Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Heavily Gaussian-blurred faces can be restored and re-identified at 95.9% accuracy, so blur is not safe anonymization.

desk verdict Novel and credible attack on Gaussian-blurred faces, but the headline 95.9% re-ID accuracy rests on a 50-round voting scheme that isn't compared against single-round baselines. read the letter →

arxiv 2506.12344 v1 pith:ZQFILTNT submitted 2025-06-14 cs.CR cs.CV

Haoyu Zhai , Shuo Wang , Pirouz Naghavi , Qingying Hao , Gang Wang This is my paper · ORCID
classification cs.CRcs.CV
keywords Gaussianblurfacede-anonymizationdiffusionmodelmemorizationeffectidentityretrievalimagerestorationprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that Gaussian blur, even the heavy blur used to hide faces in sensitive photos, does not actually protect identity. The authors build Revelio, an attack that first trains a conditional diffusion model on a reference database of face images, uses that model to produce a preliminary face restoration, then retrieves the most likely identity from the database and fine-tunes the model on that person's images to refine the face. In their closed-world evaluation, the restored faces let an identity-retrieval model reach 95.9% accuracy under a kernel size of $K=81$, where direct face recognition on the blurred input is 0%. Even for people with no photos in the reference database, the method still restores a recognizable face. The paper's conclusion is that Gaussian blur should not be used for face anonymization.

What carries the argument

The load-bearing object is the conditional diffusion model approximating the inverse Gaussian blur mapping. Its reverse process is conditioned on the blurred image $x$, so the generated face is guided by residual identity information instead of drifting to a generic face; the training objective is the standard conditional-diffusion noise-prediction loss. Two supporting mechanisms carry the identity preservation: the memorization effect of generative models, which makes the model reproduce training identities when triggered, and an identity-retrieval stage that runs the base model $n=50$ times, selects the nearest-neighbor identity in an embedding space with the shortest distance, and then fine-tunes only the attention blocks on that identity's reference images. A kernel-size estimator rounds its regression output to the nearest odd integer, letting the attacker pick the right model despite unknown blur settings.

What would settle it

Run Revelio on a dataset of low-resolution or side-profile face images blurred with $K=81$, with the reference database containing only frontal high-resolution images; if re-identification accuracy falls far below the reported 95.9%, the general claim that Gaussian blur is unsafe for face anonymization is limited to the paper's test conditions.

Watch

Extended reading notes

Core claim

Revelio demonstrates that the inverse of Gaussian blur does not have to be lossless to be dangerous. A diffusion model conditioned on the blurred image is trained to approximate $p(y|x)$, and because the model has memorized identities from the reference database, its denoising process tends to reproduce identity-specific features rather than an average face. The preliminary restored face is then embedded and matched against the database over 50 stochastic restorations, taking the nearest neighbor as the identity; when the person is in the database, this yields 95.9% identity retrieval under heavy blur, and the matched reference images are used to fine-tune the model's attention blocks to sharpen fidelity. The same pipeline restores out-of-dataset faces using similar-looking identities, and a regression-based kernel-size estimator keeps the attack working when the blur parameters are unknown.

Load-bearing premise

The attack works only if the blurred photo retains enough identity information and the diffusion model has memorized the target or someone similar from the reference database; the paper demonstrates this on frontal, high-resolution, well-aligned face images and explicitly leaves low-resolution, side-face, and database-size variations untested.

Editorial extensions

If this is right

  • Under the paper's closed-world setting, Gaussian blur with a kernel size of 81 leaves 95.9% of faces re-identifiable, so the paper concludes that blur is not a meaningful anonymization for frontal high-resolution faces.
  • The attack extends to unknown Gaussian blur settings: the kernel estimator achieves a mean absolute error below 1, and the model tolerates kernel-size offsets up to about 6.
  • Out-of-distribution identities, with no photos in the reference database, can still have faces restored using similar-looking identities, which enables ad-hoc re-identification by people who know the person.
  • Simple countermeasures such as Gaussian noise, JPEG compression, or box blur disrupt the vanilla attack, but an adaptive attack that fine-tunes the model on the defense restores identity retrieval to 88.66%.
  • The authors therefore recommend replacing Gaussian blur with full-face occlusion, such as a black mask, when anonymity is the goal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper tests only frontal, high-resolution, celebrity-style faces; the same memorization mechanism may weaken sharply on low-resolution, side-profile, or heavily occluded faces, which would bound the real-world threat until tested.
  • Because the retrieval mechanism needs only one of fifty restorations to trigger memorization, increasing the number of sampling rounds or ensembling multiple diffusion seeds might push the attack closer to 100% on the tested distribution.
  • The identity-retrieval step makes the reference database composition central: a database dominated by one demographic would likely bias restored faces toward that demographic, and mixing databases of different demographics is a natural next stress test.
  • If conditional-diffusion memorization is the mechanism, similar attacks may transfer to other linear image degradations such as box blur or downsampling, since the same approximate-inverse training could be repeated for those kernels; the paper only shows limited transferability for blur-dependency changes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Revelio, a two-stage pipeline for attacking Gaussian-blurred face images: a conditional diffusion model (MB) approximates the inverse of the blur, then an identity retrieval model matches the preliminary restoration against a reference database and, if a candidate identity is found, fine-tunes MB to produce a fidelity-enhanced output. Experiments on CelebA-HQ and FFHQ report identity retrieval accuracy of 100% (K=37) and 95.9% (K=81), outperforming GFP-GAN, DifFace, PULSE, Fantômas, and parrot recognition, plus a kernel-size estimator, OOD detection, countermeasures, and adaptive attacks. The conclusion is that Gaussian blur should not be used for face anonymization.

Significance. If the result holds, it is significant for the privacy community: it would demonstrate a practical deanonymization attack against a widely used anonymization technique, with an intuitive mechanism (memorization in diffusion models) and a clear threat model. The paper also makes a useful methodological contribution by combining conditional diffusion with identity retrieval and by studying kernel-size mismatch and adaptive attacks. However, the empirical support is currently limited to a small test set (97 images) from two high-quality frontal-face datasets, and the headline accuracy is produced by a 50-round voting procedure whose comparison with baselines is not controlled; the OOD threshold is selected on the evaluation set. These issues are fixable with additional experiments.

major comments (3)
  1. [§4.3, Table 1] The headline IRA of 95.9% (K=81) is computed from n=50 stochastic restorations of MB, taking the mode of per-round nearest-neighbor identities. The baseline methods in Table 1 are, as far as the paper reports, evaluated on a single restoration, and Revelio's single-round (n=1) IRA is never reported. Likewise, the IRA of the final fine-tuned output yf from MF is not reported. Because the paper's conclusion (§7.1, §8) claims that blurred faces 'can be restored to their clear form' and then re-identified, the evidence must show that a typical restoration—or the final output—is identity-preserving; the 50-round voting procedure can retrieve the correct identity even if most individual restorations are not identity-preserving. The comparison in Table 1 should be controlled for the number of restoration samples, and single-round/final-output accuracies should be reported for Revelio and for stochastic baselines such as DifFace.
  2. [§5.5, Fig. 7] The OOD detection threshold d=0.43 is chosen to maximize overall accuracy on the same 97 OOD and 97 in-distribution images used to report the 90% detection accuracy. This is a form of fitting to the evaluation set and likely overstates the detector's performance. The authors should report detection accuracy on a held-out set, or use cross-validation for threshold selection, and should also report the ROC curve or a calibration measure rather than only the operating point selected on the test data.
  3. [§5.1, Table 1] All quantitative claims about IRA and restoration quality are based on 97 test images (50 identities) for the closed-world setting and 97 images for OOD. No confidence intervals, significance tests, or error bars are reported for the headline 95.9% accuracy or for the restoration metrics in Tables 2–5. Given the small sample, the reported advantage over baselines, while large, should be accompanied by binomial confidence intervals and ideally by a sensitivity analysis over different random choices of test identities.
minor comments (5)
  1. [§7.1] There is a typo: 'denonymization' should be 'deanonymization'.
  2. [Tables 3 and 4] The 'GT' row uses '∞' for PSNR; consider replacing with '—' or 'N/A' to avoid implying an infinite measurement.
  3. [Appendix C] The mismatched-kernel-size experiment uses n=1 and only 50 sampled images, while the main experiments use n=50 and 97 images; state explicitly that these figures use a reduced protocol and may not be directly comparable to Tables 1–4.
  4. [§5.1] The text says the training set also serves as the reference database for identity retrieval; it would be helpful to state explicitly that each test identity therefore has, on average, several other images in D and to discuss how this affects the closed-world results.
  5. [§1 and throughout] The name 'Fantômas' is typeset inconsistently (e.g., 'Fantˆomas' in the PDF/plain text); please unify the spelling in the camera-ready version.

Circularity Check

1 steps flagged · score 3.0 of 10

One sub-result (OOD detection) is fitted to its own evaluation set; the headline 95.9% IRA is an empirical closed-world measurement, not a circular derivation.

  1. fitted input called prediction [§5.5, Figure 7 (OOD detection threshold d=0.43)]
    "When we set d = 0.43, we obtain a TPR of 0.92, an FPR of 0.12, and an overall detection accuracy of 90%."

    The threshold d is a free parameter of the OOD detector, and Figure 7 sweeps it over the same in-distribution and OOD evaluation sets used to report the result, labeling d=0.43 as the value that yields an overall accuracy of 90%. No separate validation split or cross-validation for d is described. The reported 90% accuracy is therefore the fitted value of the threshold on the evaluation data, not an independent prediction; the metric is statistically forced by the threshold selection. This affects only the OOD-detection sub-result: the headline 95.9% identity retrieval accuracy does not use d and is not fitted in this way.

full rationale

The central derivation of Revelio is not circular: MB is trained on blurred/clear pairs, the 95.9% IRA is obtained by restoring held-out test images and matching them against the reference database using an externally trained face recognizer, and the fine-tuning stage does not feed back into Table 1's IRA. The use of the same database for training and retrieval is the closed-world threat model, not a definitional identity between input and output. Baselines are retrained or run from public code, and there is no load-bearing self-citation chain. The one genuine circular step is the OOD detector threshold d=0.43: the paper sweeps d on the very OOD/in-distribution sets used to report the 90% accuracy (Figure 7), making that accuracy a fitted value. This inflates a sub-result but does not propagate to the headline identity retrieval number. A separate, non-circular evaluation caveat is that the headline 95.9% is produced by n=50 shortest-distance voting (§4.3) while baseline methods are reported on single restorations, and single-round or final-output IRA is not reported; this weakens the comparison in Table 1 as evidence that a typical restored face permits identification, but it is not circularity. §7.4 candidly acknowledges limitations (low-resolution, side faces, database size), which further supports treating the central claim as an empirical closed-world attack result rather than a derived equivalence.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper postulates no new physical or mathematical entities. The main load-bearing elements are the availability of a reference database, the memorization effect of diffusion models, and the assumption that faces in the wild match the high-quality frontal distribution of CelebA-HQ/FFHQ. The OOD threshold and the number of retrieval rounds are free parameters that influence the reported accuracies.

free parameters (3)
  • OOD detection threshold d = 0.43
    Selected from the TPR/FPR tradeoff curve (Figure 7) on the same OOD and in-distribution evaluation sets, so the reported 90% detection accuracy is partially fitted to the test data.
  • Identity retrieval rounds n = 50
    The method performs n=50 stochastic restorations and takes the shortest identity distance (§4.3). The paper does not report how IRA varies with n, so the 95.9% figure depends on this choice.
  • Kernel-size mismatch tolerance = offset of 6
    Qualitative tolerance claimed from Figure 15 in Appendix C; no formal statistical bound is derived.
assumptions (5)
  • standard math Gaussian blur convolution and the standard diffusion forward/reverse process equations (Eqs. 1-5)
    Background math used without proof; standard in image processing and diffusion models.
  • domain assumption Adversary has a large reference database D of face images containing other photos of the target identity (closed-world) or similar faces (OOD)
    Central threat model premise (§3). Without such a database, identity retrieval cannot work.
  • domain assumption The diffusion model trained on D memorizes identity-specific details sufficient to restore a blurred face
    Core design intuition (§4.1). The paper provides empirical evidence on CelebA-HQ, but this is not a general guarantee.
  • domain assumption Test faces are frontal, high-resolution, cropped, and follow the CelebA-HQ/FFHQ distribution
    The evaluation is limited to this distribution; the paper acknowledges low-resolution and side-face limitations in §7.4.
  • domain assumption The blur kernel follows the standard K-sigma dependency used by PyTorch/OpenCV, or the attacker can estimate the effective kernel
    Main experiments assume matching kernel for the 95.9% result; robustness to mismatches is tested but with small samples (§5.4, Appendix C).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Restoring Gaussian Blurred Face Images for Deanonymization Attacks." pith.science (2026). https://pith.science/paper/ZQFILTNT

@misc{pith2026250612344,
  author       = {Pith},
  title        = {Pith review of: Restoring Gaussian Blurred Face Images for Deanonymization Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZQFILTNT}},
  note         = {Machine review of arXiv:2506.12344}
}
read the original abstract

Gaussian blur is widely used to blur human faces in sensitive photos before the photos are posted on the Internet. However, it is unclear to what extent the blurred faces can be restored and used to re-identify the person, especially under a high-blurring setting. In this paper, we explore this question by developing a deblurring method called Revelio. The key intuition is to leverage a generative model's memorization effect and approximate the inverse function of Gaussian blur for face restoration. Compared with existing methods, we design the deblurring process to be identity-preserving. It uses a conditional Diffusion model for preliminary face restoration and then uses an identity retrieval model to retrieve related images to further enhance fidelity. We evaluate Revelio with large public face image datasets and show that it can effectively restore blurred faces, especially under a high-blurring setting. It has a re-identification accuracy of 95.9%, outperforming existing solutions. The result suggests that Gaussian blur should not be used for face anonymization purposes. We also demonstrate the robustness of this method against mismatched Gaussian kernel sizes and functions, and test preliminary countermeasures and adaptive attacks to inspire future work.

Figures

Figures reproduced from arXiv: 2506.12344 by the authors.

Figure 1
Figure 1. The original face has been blurred with Gaussian [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. System workflow. The original clear image [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. We use two different levels of Gaussian blur. The [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Restored faces before fine-tuning and after fine￾tuning. We highlight the area where the fine-tuning has made a major improvement in image fidelity and quality. Model PSNR↑ SSIM↑ LPIPS↓ IDD↓ FID↓ MB 24.75 0.68 0.24 0.71 41.84 MF 24.94 0.69 0.23 0.64 39.97 TABLE 2: The …
Figure 6
Figure 6. Figure 6: Face restoration under Heavy Blur ( [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: The true positive rate (TPR) and false positive rate [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Face restoration examples for out-of-distribution [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Defense against face restoration. We show that the [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Adaptive attack against JPEG Compression de [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: Examples of identity retrieval errors. The restored [PITH_FULL_IMAGE:figures/full_fig_p015_11.png]
Figure 12
Figure 12. Figure 12: Face restoration examples for out-of-distribution (OOD) identities. (a) shows OOD identities missed by our [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: The confusion matrix of the kernel size estimator. [PITH_FULL_IMAGE:figures/full_fig_p016_13.png]
Figure 14
Figure 14. Figure 14: Example face restoration results with mismatched kernel sizes for Gaussian blur. The model is trained with [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 15
Figure 15. Figure 15: Image restoration quality and fidelity under mismatched kernel sizes. The ground-truth kernel size is [PITH_FULL_IMAGE:figures/full_fig_p017_15.png]
Figure 16
Figure 16. Figure 16: Examples of the transferability experiment re [PITH_FULL_IMAGE:figures/full_fig_p017_16.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

73 extracted references · 70 canonical work pages

  1. [1]

    Video shows florida police sergeant grabbing fellow officer by her throat,

    M. Lenthang and A. Mullen, “Video shows florida police sergeant grabbing fellow officer by her throat,” https://www.nbcnews.com/news/us-news/florida-police-sergeant- accused-grabbing-officer-throat-rcna12236, 2022

    work page 2022

  2. [2]

    Officers find ‘no real firearms’ in home of wisconsin teen arrested on suspicions of planning a school shooting,

    C. V on Quednow and C. Bailey, “Officers find ‘no real firearms’ in home of wisconsin teen arrested on suspicions of planning a school shooting,” https://www.cnn.com/2024/11/07/us/wisconsin- elementary-school-staff-stops-boy-with-suspicious-bags-entering- campus, 2024

    work page 2024

  3. [3]

    Speaker mike johnson says he’s blurring jan. 6 footage so rioters don’t get charged,

    R. Reilly, “Speaker mike johnson says he’s blurring jan. 6 footage so rioters don’t get charged,” https://www.nbcnews.com/politics/ congress/speaker-mike-johnson-says-blurring-jan-6-footage-rioters- dont-get-char-rcna128181, 2023

    work page 2023

  4. [4]

    Face of a dissident as images from protests circulate online, some fear that individuals will become targets,

    M. Aggeler, “Face of a dissident as images from protests circulate online, some fear that individuals will become targets,” https://www. thecut.com/2020/06/face-of-a-dissident.html, 2020

    work page 2020

  5. [5]

    Deblurring gaussian blur,

    R. A. Hummel, B. Kimia, and S. W. Zucker, “Deblurring gaussian blur,” Computer Vision, Graphics, and Image Processing , vol. 38, no. 1, pp. 66–80, 1987

    work page 1987

  6. [6]

    Towards targeted obfuscation of adversarial unsafe im- ages using reconstruction and counterfactual super region attribution explainability,

    M. Bethany, A. Seong, S. H. Silva, N. Beebe, N. Vishwamitra, and P. Najafirad, “Towards targeted obfuscation of adversarial unsafe im- ages using reconstruction and counterfactual super region attribution explainability,” in Proc. of USENIX Security , 2023

    work page 2023

  7. [7]

    On the (in) effectiveness of mosaicing and blurring as tools for document redaction,

    S. Hill, Z. Zhou, L. Saul, and H. Shacham, “On the (in) effectiveness of mosaicing and blurring as tools for document redaction,” in Proc. of PETS, 2016

    work page 2016

  8. [8]

    Demystifying gaussian blur

    A. G. Kenton Waltz, “Demystifying gaussian blur.” https://www. adobe.com/creativecloud/photography/discover/gaussian-blur.html, 2024

    work page 2024

Show all 73 references
  1. [9]

    Motion user guide,

    Apple, “Motion user guide,” https://help.apple.com/pdf/motion/en US/motion-user-guide.pdf, 2025

    2025

  2. [10]

    Blur photo editor: blur effect,

    Google-Play, “Blur photo editor: blur effect,” https://play.google.com/ store/apps/details?id=com.fookiemonsters.photo blur mosaic, 2025

    2025

  3. [11]

    How to blur face in picsart,

    D. Blake, “How to blur face in picsart,” https://picsartone.com/how- to-blur-face-in-picsart/, 2025

    2025

  4. [12]

    Add gaussian blur filter to image,

    ASPOSE, “Add gaussian blur filter to image,” https://products.aspose. app/imaging/photo-filter/gaussian-blur, 2025

    2025

  5. [13]

    Getting the face behind the squares: Reconstructing pixelized video streams,

    L. Cavedon, L. Foschini, and G. Vigna, “Getting the face behind the squares: Reconstructing pixelized video streams,” in Proc. of WOOT, 2011

    2011

  6. [14]

    Towards real-world blind face restoration with generative facial prior,

    X. Wang, Y . Li, H. Zhang, and Y . Shan, “Towards real-world blind face restoration with generative facial prior,” in Proc. of CVPR, 2021

    2021

  7. [15]

    Difface: Blind face restoration with diffused error contraction,

    Z. Yue and C. C. Loy, “Difface: Blind face restoration with diffused error contraction,” IEEE Transactions on Pattern Analysis and Ma- chine Intelligence, vol. 46, no. 12, pp. 9991–10 004, 2024

    2024

  8. [16]

    Diffir: Efficient diffusion model for image restoration,

    B. Xia, Y . Zhang, S. Wang, Y . Wang, X. Wu, Y . Tian, W. Yang, and L. Van Gool, “Diffir: Efficient diffusion model for image restoration,” in Proc. of ICCV , 2023

    2023

  9. [17]

    Pulse: Self-supervised photo upsampling via latent space exploration of generative models,

    S. Menon, A. Damian, S. Hu, N. Ravi, and C. Rudin, “Pulse: Self-supervised photo upsampling via latent space exploration of generative models,” in Proc. of CVPR , 2020

    2020

  10. [18]

    Fant ˆomas: Understanding face anonymization reversibility,

    J. Todt, S. Hanisch, and T. Strufe, “Fant ˆomas: Understanding face anonymization reversibility,” in Proc. of PETS , 2024

    2024

  11. [19]

    Understanding and mitigating copying in diffusion models,

    G. Somepalli, V . Singla, M. Goldblum, J. Geiping, and T. Goldstein, “Understanding and mitigating copying in diffusion models,” in Proc. of NeurIPS, 2023

    2023

  12. [20]

    Progressive growing of GANs for improved quality, stability, and variation,

    T. Karras, T. Aila, S. Laine, and J. Lehtinen, “Progressive growing of GANs for improved quality, stability, and variation,” in Proc. of ICLR, 2018

    2018

  13. [21]

    A Style-Based Generator Archi- tecture for Generative Adversarial Networks ,

    T. Karras, S. Laine, and T. Aila, “ A Style-Based Generator Archi- tecture for Generative Adversarial Networks ,” IEEE Transactions on Pattern Analysis & Machine Intelligence , vol. 43, no. 12, pp. 4217– 4228, 2021

    2021

  14. [22]

    A false sense of privacy: Towards a reliable evaluation methodology for the anonymization of biometric data,

    S. Hanisch, J. Todt, J. Patino, N. Evans, and T. Strufe, “A false sense of privacy: Towards a reliable evaluation methodology for the anonymization of biometric data,” in Proc. of PETS , 2024

    2024

  15. [23]

    Android sdk: Gaussianblur,

    Google, “Android sdk: Gaussianblur,” https://developer.android.com/ reference/androidx/media3/effect/GaussianBlur, 2025

    2025

  16. [24]

    Developer documentation: Blur filters,

    Apple, “Developer documentation: Blur filters,” https://developer. apple.com/documentation/coreimage/blur filters, 2025

    2025

  17. [25]

    Automatic differen- tiation in pytorch,

    A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang, Z. DeVito, Z. Lin, A. Desmaison, L. Antiga, and A. Lerer, “Automatic differen- tiation in pytorch,” in Proc. of NeurIPS Autodiff Workshop , 2017

    2017

  18. [26]

    The OpenCV Library,

    G. Bradski, “The OpenCV Library,” Dr. Dobb’s Journal of Software Tools, 2000

    2000

  19. [27]

    Gan prior embedded network for blind face restoration in the wild,

    T. Yang, P. Ren, X. Xie, and L. Zhang, “Gan prior embedded network for blind face restoration in the wild,” in Proc. of the CVPR , 2021

    2021

  20. [28]

    Pro- gressive semantic-aware style transformation for blind face restora- tion,

    C. Chen, X. Li, L. Yang, X. Lin, L. Zhang, and K.-Y . K. Wong, “Pro- gressive semantic-aware style transformation for blind face restora- tion,” in Proc. of CVPR , 2021

    2021

  21. [29]

    Diffbir: Toward blind image restoration with generative diffusion prior,

    X. Lin, J. He, Z. Chen, Z. Lyu, B. Dai, F. Yu, Y . Qiao, W. Ouyang, and C. Dong, “Diffbir: Toward blind image restoration with generative diffusion prior,” in Proc. of ECCV , 2025

    2025

  22. [30]

    Palette: Image-to-image diffusion models,

    C. Saharia, W. Chan, H. Chang, C. Lee, J. Ho, T. Salimans, D. Fleet, and M. Norouzi, “Palette: Image-to-image diffusion models,” in Proc. of SIGGRAPH, 2022

    2022

  23. [31]

    Zero-shot image restoration using denoising diffusion null-space model,

    Y . Wang, J. Yu, and J. Zhang, “Zero-shot image restoration using denoising diffusion null-space model,” in Proc. of ICLR , 2023

    2023

  24. [32]

    Denoising diffusion models for plug-and-play image restoration,

    Y . Zhu, K. Zhang, J. Liang, J. Cao, B. Wen, R. Timofte, and L. Van Gool, “Denoising diffusion models for plug-and-play image restoration,” in Proc. of CVPR , 2023

    2023

  25. [33]

    Image super-resolution via iterative refinement,

    C. Saharia, J. Ho, W. Chan, T. Salimans, D. J. Fleet, and M. Norouzi, “Image super-resolution via iterative refinement,” IEEE Transactions on Pattern Analysis & Machine Intelligence, vol. 45, no. 4, pp. 4713– 4726, 2023

    2023

  26. [34]

    Srdiff: Single image super-resolution with diffusion prob- abilistic models,

    H. Li, Y . Yang, M. Chang, S. Chen, H. Feng, Z. Xu, Q. Li, and Y . Chen, “Srdiff: Single image super-resolution with diffusion prob- abilistic models,” Neurocomputing, vol. 479, pp. 47–59, 2022

    2022

  27. [35]

    Defeating image obfus- cation with deep learning,

    R. McPherson, R. Shokri, and V . Shmatikov, “Defeating image obfus- cation with deep learning,” arXiv preprint arXiv:1609.00408 , 2016

    2016 arXiv

  28. [36]

    Arcface: Additive angular margin loss for deep face recognition,

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “Arcface: Additive angular margin loss for deep face recognition,” in Proc. of CVPR , 2019

    2019

  29. [37]

    Deepface: Closing the gap to human-level performance in face verification,

    Y . Taigman, M. Yang, M. Ranzato, and L. Wolf, “Deepface: Closing the gap to human-level performance in face verification,” in Proc. of CVPR, 2014

    2014

  30. [38]

    Cosface: Large margin cosine loss for deep face recogni- tion,

    H. Wang, Y . Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “Cosface: Large margin cosine loss for deep face recogni- tion,” in Proc. of CVPR , 2018

    2018

  31. [39]

    Sphereface: Deep hypersphere embedding for face recognition,

    W. Liu, Y . Wen, Z. Yu, M. Li, B. Raj, and L. Song, “Sphereface: Deep hypersphere embedding for face recognition,” inProc. of CVPR, 2017

    2017

  32. [40]

    Facenet: A unified embedding for face recognition and clustering,

    F. Schroff, D. Kalenichenko, and J. Philbin, “Facenet: A unified embedding for face recognition and clustering,” in Proc. of CVPR , 2015

    2015

  33. [41]

    Circle loss: A unified perspective of pair similarity opti- mization,

    Y . Sun, C. Cheng, Y . Zhang, C. Zhang, L. Zheng, Z. Wang, and Y . Wei, “Circle loss: A unified perspective of pair similarity opti- mization,” in Proc. of CVPR , 2020

    2020

  34. [42]

    Magface: A universal representation for face recognition and quality assessment,

    Q. Meng, S. Zhao, Z. Huang, and F. Zhou, “Magface: A universal representation for face recognition and quality assessment,” in Proc. of CVPR, 2021

    2021

  35. [43]

    Adaface: Quality adaptive margin for face recognition,

    M. Kim, A. K. Jain, and X. Liu, “Adaface: Quality adaptive margin for face recognition,” in Proc. of CVPR , 2022

    2022

  36. [44]

    Uniid: Spoofing face authentication system by universal identity,

    Z. Wu, Y . Cheng, S. Zhang, X. Ji, and W. Xu, “Uniid: Spoofing face authentication system by universal identity,” in Proc. of NDSS, 2024

    2024

  37. [45]

    Fishy faces: Crafting adversarial images to poison face authentication,

    G. Garofalo, V . Rimmer, D. Preuveneers, W. Joosen et al. , “Fishy faces: Crafting adversarial images to poison face authentication,” in Proc. of WOOT, 2018

    2018

  38. [46]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proc. of CCS , 2016

    2016

  39. [47]

    Understanding osn- based facial disclosure against face authentication systems,

    Y . Li, K. Xu, Q. Yan, Y . Li, and R. H. Deng, “Understanding osn- based facial disclosure against face authentication systems,” in Proc. of ASIACCS, 2014

    2014

  40. [48]

    Fawkes: Protecting privacy against unauthorized deep learning mod- els,

    S. Shan, E. Wenger, J. Zhang, H. Li, H. Zheng, and B. Y . Zhao, “Fawkes: Protecting privacy against unauthorized deep learning mod- els,” in Proc. of USENIX Security , 2020

    2020

  41. [49]

    {FaceObfuscator}: Defending deep learning- based privacy attacks with gradient descent-resistant features in face recognition,

    S. Jin, H. Wang, Z. Wang, F. Xiao, J. Hu, Y . He, W. Zhang, Z. Ba, W. Fang, S. Yuanet al., “{FaceObfuscator}: Defending deep learning- based privacy attacks with gradient descent-resistant features in face recognition,” in Proc. of USENIX Security , 2024

    2024

  42. [50]

    FACE- AUDITOR: Data auditing in facial recognition systems,

    M. Chen, Z. Zhang, T. Wang, M. Backes, and Y . Zhang, “FACE- AUDITOR: Data auditing in facial recognition systems,” in Proc. of USENIX Security, 2023

    2023

  43. [51]

    Diversity-driven privacy protection masks against unauthorized face recognition,

    K.-H. Chow, S. Hu, T. Huang, F. Ilhan, W. Wei, and L. Liu, “Diversity-driven privacy protection masks against unauthorized face recognition,” in Proc. of PETS , 2024

    2024

  44. [52]

    Denoising diffusion restoration models,

    B. Kawar, M. Elad, S. Ermon, and J. Song, “Denoising diffusion restoration models,” in Proc. of NeurIPS , 2022

    2022

  45. [53]

    Snips: Solving noisy inverse problems stochastically,

    B. Kawar, G. Vaksman, and M. Elad, “Snips: Solving noisy inverse problems stochastically,” in Proc. of NeurIPS , 2021

    2021

  46. [54]

    Extracting training data from diffusion models,

    N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V . Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace, “Extracting training data from diffusion models,” in Proc. of USENIX Security , 2023

    2023

  47. [55]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Proc. of NeurIPS , 2020

    2020

  48. [56]

    Efficientnetv2: Smaller models and faster train- ing,

    M. Tan and Q. Le, “Efficientnetv2: Smaller models and faster train- ing,” in Proc. of ICML , 2021

    2021

  49. [57]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in Proc. of CVPR, 2009

    2009

  50. [58]

    Face recognition,

    A. Geitgey, “Face recognition,” https://github.com/ageitgey/face recognition, 2018

    2018

  51. [59]

    Labeled faces in the wild: A database forstudying face recognition in un- constrained environments,

    G. B. Huang, M. Mattar, T. Berg, and E. Learned-Miller, “Labeled faces in the wild: A database forstudying face recognition in un- constrained environments,” in Proceedings of the Workshop on faces in’Real-Life’Images: detection, alignment, and recognition , 2008

    2008

  52. [60]

    Fine-tuning diffusion models with limited data,

    T. Moon, M. Choi, G. Lee, J.-W. Ha, and J. Lee, “Fine-tuning diffusion models with limited data,” in Proc. of NeurIPS Workshop on Score-Based Methods , 2022

    2022

  53. [61]

    The megaface benchmark: 1 million faces for recognition at scale,

    I. Kemelmacher-Shlizerman, S. M. Seitz, D. Miller, and E. Brossard, “The megaface benchmark: 1 million faces for recognition at scale,” in Proc. of CVPR , 2016

    2016

  54. [62]

    Level playing field for million scale face recognition,

    A. Nech and I. Kemelmacher-Shlizerman, “Level playing field for million scale face recognition,” in Proc. of CVPR , 2017

    2017

  55. [63]

    Image quality metrics: Psnr vs. ssim,

    A. Hore and D. Ziou, “Image quality metrics: Psnr vs. ssim,” in Proc. of ICPR, 2010. Ground Truth Restored Mismatched Reference ID Figure 11: Examples of identity retrieval errors. The restored image (middle) from MB is mismatched with a wrong identity in the reference databas...

    2010

  56. [64]

    The unreasonable effectiveness of deep features as a perceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in Proc. of CVPR , 2018

    2018

  57. [65]

    Image quality assessment: from error visibility to structural similarity,

    Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli, “Image quality assessment: from error visibility to structural similarity,” IEEE transactions on image processing , vol. 13, no. 4, pp. 600–612, 2004

    2004

  58. [66]

    Restoreformer++: Towards real-world blind face restoration from undegraded key-value pairs,

    Z. Wang, J. Zhang, T. Chen, W. Wang, and P. Luo, “Restoreformer++: Towards real-world blind face restoration from undegraded key-value pairs,” IEEE Transactions on Pattern Analysis & Machine Intelli- gence, vol. 45, no. 12, pp. 15 462–15 476, 2023

    2023

  59. [67]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochre- iter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,” in Proc. of NeurIPS , 2017

    2017

  60. [68]

    Ethics in security vulnerability research,

    A. M. Matwyshyn, A. Cui, A. D. Keromytis, and S. J. Stolfo, “Ethics in security vulnerability research,” IEEE Security & Privacy , vol. 8, no. 2, pp. 67–72, 2010

    2010

  61. [69]

    Understanding hackers’ work: An empirical study of offensive security practitioners,

    A. Happe and J. Cito, “Understanding hackers’ work: An empirical study of offensive security practitioners,” in Proc. of ESEC/FSE , 2023

    2023

  62. [70]

    Diffbfr: Bootstrapping diffusion model for blind face restoration,

    X. Qiu, C. Han, Z. Zhang, B. Li, T. Guo, and X. Nie, “Diffbfr: Bootstrapping diffusion model for blind face restoration,” in Proc. of MM, 2023

    2023

  63. [71]

    Anonymousnet: Natural face de-identification with measurable privacy,

    T. Li and L. Lin, “Anonymousnet: Natural face de-identification with measurable privacy,” in Proc. of CVPR Workshops , 2019

    2019

  64. [72]

    Personalized and invertible face de-identification by disentangled identity information manipulation,

    J. Cao, B. Liu, Y . Wen, R. Xie, and L. Song, “Personalized and invertible face de-identification by disentangled identity information manipulation,” in Proc. of ICCV , 2021

    2021

  65. [73]

    Divide and conquer: a two-step method for high quality face de-identification with model explainability,

    Y . Wen, B. Liu, J. Cao, R. Xie, and L. Song, “Divide and conquer: a two-step method for high quality face de-identification with model explainability,” in Proc. of ICCV , 2023. Appendix A. Case Study: Identity Retrieval Errors As discussed in §5.3, our method achieves an iden...

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.