Source-linked AI summary
Privacy-Protective-GAN for Face De-identification
Yifan Wu, Fan Yang, Haibin Ling
TL;DR
Face de-identification must protect identity while preserving image utility, but existing approaches can provide poor visual quality or fail to preserve structure. PP-GAN adapts GANs with verificator and regulator modules; the authors report a 100% de-identification rate and the best trade-off between identity removal and visual similarity.
Problem
Method
PP-GAN is an end-to-end GAN framework for single-probe de-identification, using identity-space verificator mechanisms and a regulator for structure preservation.
Source: §1 · p. 2Results
100% de-identification rate and the best trade-off between identity removal and visual similarity are reported for PP-GAN.
Source: §1 · p. 2Takeaways & Limitations
The experiments assess privacy protection, utility preservation, and visual similarity, including attribute utility with an attribute-specific generator.
Source: §1 · p. 2, §5 · p. 8PP-GAN targets biometric information only; it does not remove soft biometrics such as age or race, or non-biometric information such as hairstyles.
Source: §2 · p. 3
Abstract
from arXiv · showhide
Face de-identification has become increasingly important as the image sources are explosively growing and easily accessible. The advance of new face recognition techniques also arises people's concern regarding the privacy leakage. The mainstream pipelines of face de-identification are mostly based on the k-same framework, which bears critiques of low effectiveness and poor visual quality. In this paper, we propose a new framework called Privacy-Protective-GAN (PP-GAN) that adapts GAN with novel verificator and regulator modules specially designed for the face de-identification problem to ensure generating de-identified output with retained structure similarity according to a single input. We evaluate the proposed approach in terms of privacy protection, utility preservation, and structure similarity. Our approach not only outperforms existing face de-identification techniques but also provides a practical framework of adapting GAN with priors of domain knowledge.
1. Introduction
Face de-identification must remove identity while preserving image utility, but existing approaches can fail at privacy protection or produce poor visual quality. PP-GAN adapts GANs with separate identity and structure mechanisms and evaluates privacy, utility, and similarity.
1. Introduction
- Prior k-same approaches can yield poor visual quality, while cGAN losses may fail to distinguish identities or preserve structure.The paper attributes the structure issue to inconsistency between GAN-type and structural-loss feature spaces.Source: §1 · pp. 1–2
- The method introduces external mechanisms to expand sampling away from the input in identity space while constraining structural variation.The paper says these objectives conflict within the GAN loss, so it expresses them as external losses.Source: §1 · p. 2
- The experiments assess whether outputs thwart face verification, avoid simply switching to training images, preserve luminance, contrast, and structure, and retain attributes with an attribute-specific generator.Source: §1 · p. 2
- PP-GAN is presented as an end-to-end GAN framework that generates de-identified output for each single probe face.Source: §1 · p. 2
- PP-GAN uses a verificator and regulator to balance privacy protection with image quality while retaining pixel-level structure similarity.The verificator distinguishes input and synthesized outputs in identity-related feature space, while the regulator preserves structure.Source: §1 · p. 2
- 100% de-identification rate and the best trade-off between identity removal and visual similarity are reported for PP-GAN.The evaluation uses a face verificator [27] for de-identification rate and a face detector for detection rate.Source: §1 · p. 2
2. Related Work
Prior face-de-identification work includes masking, blurring, pixelation, and k-same methods, with research also exploring GAN-based synthesis. The discussion identifies constraints in these approaches and specifies that this paper focuses on biometric information.
2. Related Work
- Blurring and pixelation may fail to thwart face recognition, while k-same represents an image by an average of nearby gallery faces and can produce ghosting artifacts.Variants aim to improve utility, naturalness, or preserve attributes such as race, gender, and age [6, 9, 11, 16, 19, 22, 30].Source: §2 · pp. 2–3
- The paper identifies three k-same/AAM limitations: assumptions about one image per subject, closed-set processing, and unnatural-looking generated images.Source: §2 · p. 3
- GAN-based de-identification work includes full-body synthesis that does not guarantee face-area quality and face synthesis that still relies on k-same [20].Source: §2 · p. 3
- This paper focuses on biometric information and does not remove soft biometric features such as age or race, or non-biometric information such as hairstyles.Source: §2 · p. 3
3. Method
PP-GAN adapts a conditional GAN for face de-identification by combining adversarial realism, identity separation, and structural similarity objectives. A pretrained verificator and SSIM loss guide the generator to change identity while preserving visual correspondence.
3. Method
- The final generator serves as the de-identification function; a frozen verificator and SSIM loss guide its updates alongside the cGAN objective.The original and generated images are evaluated in identity-related feature space and for pixel-level structural similarity.Source: §3 · p. 3
3.1. Objective
- Face de-identification jointly targets realistic output, identity separation, and pixel-level luminance, contrast, and structure consistency through a combined loss.The generator is optimized using the cGAN, verification, and SSIM losses.Source: §3.1 · p. 3
3.2. Architecture of GAN
- The cGAN maps an input image and noise to a synthesized image; a U-Net generator and patch discriminator train outputs to appear realistic.The U-Net uses skip connections, while the discriminator produces a patch-level real/fake judgment.Source: §3.2 · p. 4
3.3. Face Verification
- A pretrained Light CNN-9 verificator is frozen, then applies contrastive loss to original and generated pairs labeled as different identities.The verificator is pretrained on balanced positive and negative pairs.Source: §3.3 · p. 5
3.4. Structure Similarity
- The SSIM-based regulator preserves input-output correspondence through luminance, contrast, and structural similarity, addressing cGAN’s lack of guaranteed image-space closeness.The paper uses SSIM rather than MSE or PSNR as its perceptual image-degradation measure.Source: §3.4 · p. 5
4. Experiments
The experiments evaluate PP-GAN on MORPH across demographic groups, testing privacy protection, utility preservation, and visual similarity. Results support high de-identification rates and a balance between identity removal and retained image structure.
4.1. experimental Setup
- The evaluation uses male MORPH data, partitions it by race and age into eight groups, and compares cGAN-only, SSIM, verificator, and combined-objective settings.The dataset contains 55,000 images of more than 13,000 people; female data are excluded because the number of female subjects is limited.Source: §4.1 · p. 6
4.2. Privacy Protection
- The overall de-identification rates are described as very high for both Black and White groups, and identification-switching experiments find 0 switches in Black-Youth and White-Youth.The FaceNet evaluation verificator achieves greater than 97% accuracy on all Black groups and 94% on White groups.Source: §4.2 · pp. 6–7
- Prior k-anonymity methods reach about 90% de-identification at k = 8, while a GAN-based method reaches 43.2% at k = 2; the authors report PP-GAN outperforms previous methods.The authors attribute the comparison to explicitly adding the de-identification metric to the optimization objective.Source: §4.2 · pp. 6–7
4.3. Utility Preservation
- Detection rates on original and de-identified images are similar, while age-specific models preserve group attributes better than the age-nonspecific group.Cropped faces are padded with 50 pixels of zeros per axis for face detection; the authors note that some generated-image detection rates exceed originals because some originals are distorted.Source: §4.3 · p. 7, Figure 5 · p. 7
4.4. Visual Similarity
- PP-GAN retains luminance, contrast, and structure while changing identity-related facial features, and the reported trade-off compares SSIM with de-identification rate.The authors describe the paired images as retaining correspondence rather than randomly replacing the face.Source: §4.4 · p. 7, Figure 7 · p. 8
- Across objective variants, cGAN-only and cGAN+Sim each show a privacy–similarity trade-off, while cGAN+Verif can produce visually strange outputs; including both modules yields the best visual results across groups.The authors report that cGAN+Sim can behave nearly like identity mapping, whereas cGAN+Verif expands sampling but lacks structural constraints; Figure 8 reports PP-GAN as visually agreeable beyond the other settings on every group.Source: Figure 8 · p. 8, §4.4 · p. 8
5. Conclusion
The conclusion presents PP-GAN as a framework for generating a de-identified image from a single input. Its experiments evaluate privacy protection, utility preservation, and visual similarity.
- PP-GAN generates de-identified output from a single input and is evaluated for privacy protection, utility preservation, and visual similarity.Source: §5 · p. 8