FDeID-Toolbox: Face De-Identification Toolbox

Abstract

Face de-identification (FDeID) aims to remove personally identifiable information from facial images while preserving task-relevant utility attributes such as age, gender, and expression. It is critical for privacy-preserving computer vision, yet the field suffers from fragmented implementations, inconsistent evaluation protocols, and incomparable results across studies. These challenges stem from the inherent complexity of the task: FDeID spans multiple downstream applications (e.g., age estimation, gender recognition, expression analysis) and requires evaluation across three dimensions (e.g., privacy protection, utility preservation, and visual quality), making existing codebases difficult to use and extend. To address these issues, we present FDeID-Toolbox, a comprehensive toolbox designed for reproducible FDeID research. Our toolbox features a modular architecture comprising four core components: (1) standardized data loaders for mainstream benchmark datasets, (2) unified method implementations spanning classical approaches to SOTA generative models, (3) flexible inference pipelines, and (4) systematic evaluation protocols covering privacy, utility, and quality metrics. Through experiments, we demonstrate that FDeID-Toolbox enables fair and reproducible comparison of diverse FDeID methods under consistent conditions.

Figures (6)

• Figure 1: FDeID Pipiline. An example of the components of a FDeID pipeline including pre-processing, face de-identification, and post-processing. Components shown with dashed borders are optional and method-dependent.
• Figure 2: Architecture of the FDeID-Toolbox. The modular design comprises four core modules: Data for unified dataset management, Methods spanning traditional, adversarial, and generative approaches, Pipeline for pre-processing, training, and post-processing, and Evaluation integrating privacy, utility, and quality metrics. Components communicate through a unified API, enabling plug-and-play extensibility.
• Figure 3: Qualitative comparison of FDeID methods on a sample face image. Traditional naive methods (blur, pixelate, mask, k-Same variants newton2005preservinggross2005integratingmeng2014face) provide privacy but degrade visual quality. Adversarial methods (MI-FGSM dong2018boosting, PGD madry2018towards, TI-DIM dong2019evading, TIP-IM yang2021towards, Chameleon chow2024personalized) focus on introducing visually imperceptible perturbations. Generative methods (Adv-Makeup yin2021adv, CIAGAN maximov2020ciagan, AMT-GAN hu2022protecting, DeID-rPPG savic2023identification, G$^{2}$Face yang2024g, WeakenDiff salar2025enhancing) synthesize de-identified faces with varying degrees of identity change and visual realism.
• Figure 4: Examples of the FDeID-Toolbox's visualization module.
• Figure 5: Qualitative comparison of FDeID methods on a sample face image. The source image is from LFW dataset huang2008labeled. Methods are grouped by paradigm: naive, $k$-same-based, adversarial, and generative.