PaperlayerView exact revision on arXiv

Source-linked AI summary

Toward Interpretable Privacy Guarantees in Face-Swapping Anonymization

Vishnu Bondalakunta, Arman Zareian Jahromi, Shuangqing Wei, George Amariucai

arXiv:2608.25750v1cs.CR

TL;DR

Face-swapping can preserve useful visual content while leaving exploitable target identity leakage, challenging observational privacy assessments. The paper measures leakage across seven tools, models swaps as affine stochastic operators in identity-embedding space, and derives testable cascade predictions. The results support interpretable privacy analysis while identifying limits from model fidelity, adversary scope, and coverage.

  • Problem

    Single swaps suppress target match scores but can still leak identity, while empirical evaluation alone does not explain the mechanism or predict repeated-swapping behavior.

  • Method

    The paper fits an affine stochastic embedding-space model in which donor and target operators plus noise describe swap embeddings and target-transfer powers govern cascades.

  • Results

    Every tested tool leaks target identity; among five tools that anonymize at all, AUC is 0.73–0.95, TPR reaches 61% at 1% FPR, and closed-set rank-1 reaches 34%.

  • Takeaways & Limitations

    Single-swap anonymization should be presumed leaky, while measurable spectral rates and the non-member baseline provide interpretable targets for evaluating and improving anonymizers.

  • Takeaways & Limitations

    The affine model has uneven fidelity across tools, stronger adversaries could extract more leakage, and spectral coverage is limited to three fitted tools.

Abstract

from arXiv · show

Face-swapping has emerged as a promising approach to facial privacy protection, replacing a target individual's appearance with that of a donor while preserving non-facial context. The resulting images visually resemble the donor, and face recognition systems tend to suppress the target's match scores -- ostensibly satisfying privacy requirements. Empirical evaluation across a range of face-swapping models, however, reveals that significant target identity leakage still occurs. This raises a deeper question: why does leakage occur, and can it be predicted? We propose a linear stochastic model that treats face-swappers as transformations on the space of identity embeddings, providing an interpretable account of the leakage mechanism. The model is fit to empirical observations and used to derive testable predictions. The aim is to ground privacy assessments in principled, interpretable analysis, thus making formal privacy guarantees explainable -- and perfectible -- rather than purely observational.

1. Introduction

Face-swapping preserves useful facial context but does not reliably remove target identity. The paper measures this leakage and models its mechanism through affine stochastic transformations in identity-embedding space.

  • Motivation: Face-swapping preserves donor-like identity while retaining target pose, expression, and scene context for downstream applications.This motivates it as an alternative to blurring, which can destroy utility.
  • Empirical leakage: Every tested tool leaks target identity, despite donor-dominated outputs that can pass visual or donor-centric audits.Across seven systems, target similarity remains closer to the protected individual than to unrelated people.
  • Empirical leakage: The study evaluates seven face-swappers using score distributions, membership inference, and closed-set recognition under a unified protocol.The protocol uses 947 donor/target/non-member triples, two recognizers, and a hardened non-member pool.
  • Model: The paper models face-swappers as affine stochastic operators on identity-embedding space and fits them for FaceFusion, BlendFace, and CanonSwap.The model is estimated on identity-disjoint corpora and its assumptions are explicitly validated.
  • Predictions: Repeated swapping is predicted to exhibit two-rate decay, a non-member leakage floor, and tool ordering determined by fitted spectral radii.Tests report successes and failures, including off-manifold cascade inputs that explain some mismatches.
  • Implications: Single-swap anonymization should be presumed leaky, while dilution improves privacy at a measurable, tool-specific exponential rate.For the studied tools, reaching the noise floor requires approximately 18–20 passes.

2. Background and Related Work

The paper situates face-swapping within identity-embedding recognition, generative face synthesis, and privacy auditing. It emphasizes low-false-positive membership inference as a meaningful privacy evaluation tool.

  • Identity representations: Face recognition maps facial images to unit-norm identity embeddings, where same-person images are nearby and identity decisions use cosine similarity.ArcFace- or FaceNet-style metric learning supports this representation.
  • Face-swapping: Face-swapping transfers donor identity onto a target image while preserving identity-irrelevant attributes such as pose and expression.Published systems include encoder-decoder, GAN-based, and diffusion architectures.
  • Privacy methods: Earlier de-identification methods often trade utility for privacy, motivating generative anonymizers and formal approaches such as k-Same.The related work includes blurring, pixelation, masking, inpainting, and controllable identity synthesis.
  • Privacy evaluation: Membership inference asks whether a record was used in training and has become a standard instrument for auditing privacy mechanisms.Low-FPR true-positive rates are emphasized because confident identification of a small member fraction can be especially harmful.
  • Workflow: Figure 1 presents the general face-swapping workflow.The cited materials identify it as a workflow overview rather than reporting a specific comparison.

3. Preliminaries

The preliminaries define subjects, identity embeddings, face-swapping notation, similarity summaries, and identity inference attacks. These components establish the formal objects used for privacy evaluation.

  • Notation: A subject is a collection of facial images, with donor, target, and candidate superscripts distinguishing each subject’s role.Donors are permitted identities; targets are identities the mechanism aims to protect.
  • Identity embeddings: An identity extractor maps facial images to compact, unit-normalized embeddings in a hyperspherical representation space.The embeddings are intended to capture person-specific facial structure while resisting lighting, pose, and expression variation.
  • Similarity: Subject-level similarity aggregates pairwise embedding comparisons using either the median for typical matching or the maximum for closest-image alignment.These summaries capture different notions of identity similarity across a subject’s image gallery.
  • Face-swapping: Face-swapping is represented as F(Id, It) = Is, transferring donor identity while retaining target attributes.In embedding notation, zd and zt produce swap embedding zs through the induced model action.
  • Identity inference: Identity inference determines whether a candidate individual is represented in a privatized database using similarity ranking and thresholding.The procedure can aggregate scores with median or maximum similarity and evaluate performance through ROC curves and closed-set rankings.
  • Identity inference: The adversary first finds the most similar database subject, then applies a threshold whose binary output indicates inferred membership.Threshold sweeping traces the attack ROC curve over target members and unrelated non-members.

4. Threat Model

The threat model considers a data owner releasing face-swapped images of protected targets using public donors. Privacy is defined against a black-box adversary distinguishing represented individuals from non-members.

  • Data release: A data owner replaces each target image with a swap using a randomly assigned donor from a public pool.The released database is intended to preserve photorealistic nonidentity content while protecting target identities.
  • Privacy and utility: The release must preserve pose, expression, and context while revealing nothing about which individuals were present in the original database.Donor identities are assumed safe to expose.
  • Adversary: The adversary uses public candidate photographs, a strong black-box recognizer, and thresholded similarity without knowing donor assignments or original images.This weak adversary trains nothing, so measured leakage lower-bounds what stronger adversaries could extract.
  • Privacy goal: Privacy requires target and non-member score distributions to be statistically indistinguishable, making the adversary’s advantage over random guessing negligible.Evaluation uses ROC-AUC, TPR at FPR ≤1% and ≤0.1%, and closed-set rank-k rates.

5. Part 1: Does Face-Swapping Leak Privacy?

Across seven face-swapping systems, single-pass anonymization suppresses target similarity but leaves measurable, target-specific identity leakage that persists under robust attacks.

  • Evaluation protocol: 947 complete donor-target-non-member pairs were evaluated across seven publicly available face-swapping systems using two recognizers and multiple attack settings.The protocol used VGGFace2-HQ, matched non-members, target/donor/non-member galleries, and median or max aggregation.
  • Donor transfer: Five tools produced donor-dominated outputs in more than 93% of pairs, making their residual target leakage relevant to plausible anonymizer deployments.The five tools were FaceFusion, DiffFace, BlendFace, E4S, and CanonSwap.
  • Target leakage: For every tool, target scores exceeded the unrelated non-member baseline; target-vs-non-member AUC ranged from 0.729 for E4S to 0.993 for DiffSwap.Non-member scores were concentrated near zero, while every target distribution shifted rightward.
  • Target leakage: FaceFusion reduced mean target similarity from 0.616 to 0.098, an 84% reduction, yet the result remained above the approximately 0.008 non-member baseline.The suppression would appear successful under verification-style evaluation, but the residual distribution remained target-specific.
  • Membership inference: At FPR ≤1%, membership-inference TPR reached 61% for BlendFace and 52% for CanonSwap, while FaceFusion still reached 30%.At FPR ≤0.1%, FaceFusion reached 15%; closed-set rank-1 identification reached 34% for BlendFace versus 0.1% chance.
  • Robustness checks: The leakage pattern persisted with a second recognizer, alternative aggregation rules, and adversarially selected non-members, though non-member scores increased and gaps narrowed.Across the five tools that anonymized at all, AUC was 0.73–0.95, with TPR up to 61% at 1% FPR and closed-set rank-1 identification up to 34%.

6. Part 2: Face-Swappers as Affine Stochastic Operators

The paper models a face-swapper as an affine stochastic operator on identity-embedding space, where separate donor-write and target-transfer operators expose the mechanism of leakage.

  • Model definition: The modeled object is the face-swapper’s embedding-space transformation rather than its nonlinear image-space generator, because the attacks operate on embeddings.This representation is intended to explain and predict leakage through the adversary’s observable space.
  • Model definition: The model writes the swap embedding as s = Ad + Bt + c + e, separating donor writing, target transfer, bias, and stochastic residual effects.A and B are fixed operators; e captures pose, expression, generator, and blending effects not explained by the affine component.
  • Privacy interpretation: B is the interpretable leakage channel: a perfect embedding-space anonymizer would have B equal to the zero matrix.A instead measures how strongly donor identity is written into the output.
  • Assumptions: The model is deliberately first-order: affine maps compose, enabling analysis of repeated swapping, while linearity is not claimed for the image generator itself.The paper motivates the approximation partly because modern systems condition synthesis on identity embeddings through linear modulation layers.
  • Fitted operators: FaceFusion achieved R2 = 0.585, compared with 0.399 for BlendFace and 0.338 for CanonSwap, so the model is strongest for FaceFusion and coarser for the others.Despite differing fit quality, all three target-transfer operators shared structural features used in cascade analysis.
  • Fitted operators: For FaceFusion, B has ρ(B) = 0.894 but σmax(B) = 10.1, meaning repeated application eventually contracts despite possible large one-step amplification.The paper attributes this contrast to strong non-normality; the dominant spectral modulus sets the asymptotic decay rate.

7. Cascade Dynamics and Testable Predictions

The paper models repeated face-swapping as a linear stochastic dynamical system, separating target-identity propagation from donor and residual contributions. This yields testable predictions about two-rate decay, a non-member leakage floor, persistent directions, and cross-tool cascade ordering.

  • Cascade recursion: Repeated swapping propagates the protected identity through the target-transfer operator B, while fresh donors and residuals contribute target-independent variation.Cascade privacy therefore depends on the behavior of B^k along the target direction.
  • Two-rate dynamics: Leakage is predicted to decay in two stages: a rapid first-pass contraction near bu ≈0.18 followed by a slower asymptotic tail approaching ρ(B) ≈0.89.Extreme non-normality explains why real target directions are initially crushed before surviving components rotate toward the slow eigenspace.
  • Floor and inference: The cascade leakage floor should equal the non-member similarity baseline rather than zero, while membership-inference AUC should decay toward chance as depth increases.The FaceFusion fit predicts a plateau of 0.0055 against a measured non-member baseline of 0.006.
  • Additional predictions: The first swap is predicted to remove most target similarity, with later passes contributing substantially less absolute reduction.The model also predicts slower decay for targets aligned with B’s dominant eigenspace.
  • Cross-tool ordering: Fitted spectral radii predict late-cascade ordering: BlendFace is slowest, FaceFusion intermediate, and CanonSwap fastest.Monte Carlo rollout provides quantitative per-pass leakage estimates for these model-based predictions.

8. Verification on Dilution Data

Verification on independent dilution cascades confirms the predicted decay rates, floor behavior, and cross-tool ordering, while revealing that absolute leakage levels are misestimated under cascade domain shift. The data also show that practical privacy improvement requires many passes and does not reach chance after five swaps.

  • FaceFusion verification: The five-pass FaceFusion cascade confirms monotone two-rate decay: excess ratios rise from 0.139 to a late 0.893, matching fitted ρ(B) = 0.894.The sequence has a small 0.915 →0.893 wobble, so idealized monotonicity is not exact.
  • Membership inference: Membership-inference AUC falls from 0.874 to 0.709 across five passes, improving privacy but remaining above chance.The figure attributes the persistent tail to ρ(B) being close to 1.
  • Pass contributions: The first pass removes 0.525 of absolute gallery similarity, whereas all four later passes together remove 0.044, a 12:1 asymmetry.Persistent-direction effects have the predicted sign but only weak support, with Spearman correlations 0.21 and 0.11.
  • Model limitations: The model gets decay rates right but over-predicts pass-1 leakage and under-predicts pass-5 leakage because cascaded outputs leave the natural image-embedding manifold.Observed residual–state correlations rise to 0.04–0.06 versus approximately 0.01–0.02 for single swaps, favoring preservation of the existing face.
  • Cross-tool verification: Cross-tool cascades confirm the predicted spectral ordering: BlendFace decays slowest, FaceFusion is intermediate, and CanonSwap decays fastest.Three-pass data support ordering rather than exact asymptotic ratios; similar single-swap leakage does not determine cascade behavior.

9. Discussion: Privacy Implications

Single-swap anonymization remains exploitable, and repeated swapping offers measurable but diminishing privacy gains. The relevant benchmark depends on the non-member floor and, for deeper cascades, the fitted spectral properties of each tool.

  • 30–61% of protected individuals remain exposed to membership inference at 1% FPR, even after a visually successful donor-match audit.Evaluations should report low-FPR TPR against measured non-members, alongside closed-set CMC when the candidate pool is enumerable.
  • Single-pass leakage spans 0.048–0.137 across five credible anonymizers, while first-pass contraction bu varies only from 0.18–0.22.For one-pass use, E4S is preferred in this cohort because it synthesizes farther from both inputs, accepting weaker donor resemblance.
  • Later cascade behavior is governed by spectral radius ρ(B), which ranges from 0.85–0.92 and separates tools that look similar after one pass.BlendFace and CanonSwap begin with near-identical pass-1 leakage but diverge steadily with depth.
  • An ∼85% first-swap leakage reduction is followed by removing only ∼11% of the remainder per pass, with 18–20 passes extrapolated to reduce excess leakage below 0.01.The measured deep-cascade tail runs above the model rollout, so simulation-based dilution budgets are lower bounds.
  • The non-member similarity baseline is the privacy floor, because an output face cannot make target similarity lower than that of a random stranger.The fitted rate and floor support stating an expected excess-leakage bound after k passes rather than only reporting observed scores.

10. Limitations

The study’s conclusions are bounded by adversary scope, model fidelity, data coverage, and recognizer choice. In particular, off-manifold extrapolation and limited operator coverage constrain fine-grained or broad deployment claims.

  • The reported leakage is a lower bound because stronger adversaries could use tool knowledge, swap-trained models, or multiple released images.The study measures identity inference only and does not measure attribute inference from preserved non-facial context.
  • The affine model explains 59% of held-out variance for FaceFusion, but only 40% and 34% for BlendFace and CanonSwap.Residual anisotropy, non-Gaussianity, and deep-cascade level mismatch limit the model’s use for fine-grained distributional claims.
  • Reliable operator spectra require 10^3–10^4 swaps per tool, so operators were fit for only three of five donor-retaining tools.The five-pass cascade was available only for FaceFusion; DiffFace and E4S had single-pass leakage measurements without fitted operators.
  • All experiments use VGGFace2 celebrity faces with GFPGAN normalization, leaving demographic structure beyond one matched control and behavior on clinical or surveillance imagery unexplored.A future stronger recognizer could detect more leakage; the Facenet-versus-ArcFace gap already indicates recognizer strength affects attack strength.

11. Conclusion

Across seven modern tools, face-swapping leaves target identity exploitable despite donor-like outputs. An affine stochastic embedding-space model explains leakage dynamics and yields verified rate, floor, and ordering predictions, while exposing optimistic deep-cascade levels under domain shift.

  • Up to 61% of targets are recovered at 1% false-positive rate among tools that genuinely transfer the donor.The result shows that the donor-like appearance does not complete the security argument.
  • The swapper is modeled as an affine stochastic operator whose target-transfer matrix B governs first-pass suppression, asymptotic decay, and the privacy floor.The Rayleigh gain explains large first-pass suppression, spectral radius dictates the slow geometric tail, and stability fixes the non-member baseline.
  • Two-rate decay and the spectral tail rate were confirmed to three decimal places for FaceFusion, and the model correctly ordered three tools.Absolute deep-cascade levels nevertheless revealed optimism under domain shift.
  • The operator framework makes privacy claims explainable and provides measurable spectra as training and certification targets for future anonymizers.The supported scope is mechanism, rates, floors, and orderings rather than unrestricted certainty about anonymization.

Appendix C. Closed-Set Re-Identification Results

Closed-set evaluation ranks the true target against 948 candidate identities, showing substantial re-identification beyond chance. The appendix also supports the affine model as a useful first-moment approximation while limiting its distributional interpretation.

  • Closed-set re-identification: Table 4 reports closed-set identification rates at rank k out of 948 candidates using VGGFace2, buffalo_l, and median aggregation.The corresponding CMC curves compare rank performance with the diagonal random-guessing baseline.
  • Affine-model adequacy: The donor+target affine model is the simplest predictor that captures the leakage channel, outperforming simpler donor-based baselines on held-out FaceFusion embeddings.The appendix describes a 10,667-triplet identity-disjoint evaluation and a substantial residual after prediction.
  • Closed-set re-identification: 34% of BlendFace swaps rank the true target first among 948 candidates, and 63% place it in the top ten.The rank-1 result is 340 times the 0.1% chance rate reported for this gallery size.
  • Closed-set re-identification: 26.5% of E4S swaps place the target in the top 50, versus 5.3% under random guessing.Closed-set ranking can exploit target-specific signal even when absolute membership scores appear comparatively benign.
  • Affine-model adequacy: Residuals are plausibly ordinary same-person variation plus generator randomness, but they are anisotropic and heavier-tailed than Gaussian.Residual norms are close to ordinary same-person embedding deviations, while approximately 98% of residual energy lies in the embedding sphere’s tangent space.
  • Affine-model adequacy: The model supports first-moment cascade rates and floors, not exact per-pass score distributions, which are reproduced only approximately.This scope follows from supported mean dynamics and residual assumptions despite failed isotropy and Gaussianity checks.

Appendix E. How Much Data Does Operator Identification Need?

Operator identification requires substantial training data because undersampling destabilizes spectral estimates and held-out fit quality. In five-pass FaceFusion cascades, dilution preserves photorealism and target context while producing only mild fine-detail loss.

  • Data requirements: At 500–1,000 training triplets, operator fits are unusable: held-out R2 is negative, and estimated ρ(B) exceeds 1 at N=1,000.The latter would incorrectly predict cascade amplification of the target.
  • Data requirements: ρ(B) stabilizes near 5,000 triplets, while held-out fit quality stabilizes near 20,000 triplets.These thresholds are measured with a fixed identity-disjoint test set.
  • Cascade behavior: Five-pass FaceFusion outputs remain photorealistic while retaining the target’s pose, expression, hair, and background across fresh-donor passes.The inner face drifts toward each pass’s donor, while non-facial context remains largely unchanged.
  • Cascade behavior: Only mild smoothing of fine detail accumulates with cascade depth, avoiding obvious visual artifacts as dilution proceeds.The example chains preserve pose, expression, and context throughout.
Loading 2608.25750v1…