iFADIT: Invertible Face Anonymization via Disentangled Identity Transform

TL;DR

The paper tackles privacy-preserving face anonymization by introducing iFADIT, a framework that disentangles identity from non-identifying attributes and applies a secret-key conditioned, invertible flow-based transform to produce anonymized faces. Anonymization is followed by high-quality reconstruction via a pre-trained StyleGAN, and de-anonymization is possible through inverse transformations using a matching secret key, enabling reversible handling for forensic contexts. The approach is reinforced by a dual-phase training regime and multiple loss terms that promote anonymity, diversity, and image fidelity, while enabling interpretability through disentangled latent representations. Empirical results on FFHQ-derived data and standard benchmarks demonstrate superior anonymity, reversibility, and visual quality compared with prior methods, highlighting practical utility for secure, reversible facial privacy in surveillance and forensics.

Abstract

Face anonymization aims to conceal the visual identity of a face to safeguard the individual's privacy. Traditional methods like blurring and pixelation can largely remove identifying features, but these techniques significantly degrade image quality and are vulnerable to deep reconstruction attacks. Generative models have emerged as a promising solution for anonymizing faces while preserving a natural appearance. However, many still face limitations in visual quality and often overlook the potential to recover the original face from the anonymized version, which can be valuable in specific contexts such as image forensics. This paper proposes a novel framework named iFADIT, an acronym for Invertible Face Anonymization via Disentangled Identity Transform. The framework features a disentanglement architecture coupled with a secure flow-based model: the former decouples identity information from non-identifying attributes, while the latter transforms the decoupled identity into an anonymized version in an invertible manner controlled by a secret key. The anonymized face can then be reconstructed based on a pre-trained StyleGAN that ensures high image quality and realistic facial details. Recovery of the original face (aka de-anonymization) is possible upon the availability of the matching secret, by inverting the anonymization process based on the same set of model parameters. Furthermore, a dedicated secret-key mechanism along with a dual-phase training strategy is devised to ensure the desired properties of face anonymization. Qualitative and quantitative experiments demonstrate the superiority of the proposed approach in anonymity, reversibility, security, diversity, and interpretability over competing methods.

Figures (8)

• Figure 1: The paradigm iFADIT built on a dual-phase training strategy: The first training phase optimizes a disentangle-reconstruct architecture that tries to decouple the identity and non-identifying representations of a face image. The second phase focuses on training a secure identity flow-based (SIF) model capable of transforming the disentangled identity representation in an invertible way controlled by a user-specific secret.
• Figure 2: The overall framework of iFADIT, which consists of two training phases. In the first training phase, the identity disentanglement and image reconstruction architecture is built. In the second training phase, the introduced SIF and ICL are imported and optimized, with other components fixed.
• Figure 3: Image samples of anonymization and de-anonymization results using different secret keys.
• Figure 4: Qualitative comparison of the anonymization performance of various literature approaches. Original images are randomly selected from CelebA-HQ.
• Figure 5: Qualitative comparison of the de-anonymization image quality of literature approaches that support reversibility. Original images are randomly selected from the StyleGAN synthesized dataset FFHQ* nitzan2020tog. $\Delta$ indicates the $2\times$ magnified absolute difference between the recovery image and the original image.