Paper deep dive
Face De-Identification: A Domain-Centric Survey from Capture to Processing
Hui Wei, Hao Yu, Guoying Zhao
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Face de-identification (De-ID) aims to remove or conceal personally identifiable facial features in images or videos to prevent identity recognition while preserving utility for downstream tasks. With the rising emphasis on data privacy and responsible AI, face De-ID has emerged as an active research area spanning computer vision and privacy-preserving communities. Early approaches, and many contemporary ones, operate in the digital domain by modifying pixel-level or appearance-level features through post-capture processing. Recent advances extend face De-ID beyond post-processing by integrating privacy mechanisms directly into sensors during image acquisition, bridging sensing systems and downstream vision algorithms. In parallel, physical-domain methods explore wearable accessories and materials that conceal identity information in real-world environments prior to capture. In this survey, we present the first unified overview that spans the full data acquisition pipeline, encompassing the physical, sensor, and digital domains. Through this domain-centric lens, we systematically analyze current methodologies, technical progress, and the distinct challenges inherent to each stage. We then review and organize existing evaluation protocols, examining current practices and highlighting the critical need for standardized, comprehensive benchmarks. Finally, we identify key open problems and outline emerging research directions to guide future work in this rapidly evolving field. To support ongoing research, we maintain a project page that organizes relevant literature with collected datasets and open source code: this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2607.25926v1
- Canonical: https://arxiv.org/abs/2607.25926v1
Trouble viewing inline? Open PDF directly →
Full Text
140,942 characters extracted from source content.
Expand or collapse full text
Face De-Identification: A Domain-Centric Survey from Capture to Processing Hui Wei, Hao Yu, and Guoying Zhao, Fellow, IEEE Hui Wei, Hao Yu, and Guoying Zhao are with the ELLIS Institute Finland, Espoo, 02150, Finland, and also with the Center for Machine Vision and Signal Analysis, University of Oulu, 90570 Oulu, Finland. Guoying Zhao is the corresponding author. E-mail: guoying.zhao@oulu.fi Abstract Face de-identification (De-ID) aims to remove or conceal personally identifiable facial features in images or videos to prevent identity recognition while preserving utility for downstream tasks. With the rising emphasis on data privacy and responsible AI, face De-ID has emerged as an active research area spanning computer vision and privacy-preserving communities. Early approaches, and many contemporary ones, operate in the digital domain by modifying pixel-level or appearance-level features through post-capture processing. Recent advances extend face De-ID beyond post-processing by integrating privacy mechanisms directly into sensors during image acquisition, bridging sensing systems and downstream vision algorithms. In parallel, physical-domain methods explore wearable accessories and materials that conceal identity information in real-world environments prior to capture. In this survey, we present the first unified overview that spans the full data acquisition pipeline, encompassing the physical, sensor, and digital domains. Through this domain-centric lens, we systematically analyze current methodologies, technical progress, and the distinct challenges inherent to each stage. We then review and organize existing evaluation protocols, examining current practices and highlighting the critical need for standardized, comprehensive benchmarks. Finally, we identify key open problems and outline emerging research directions to guide future work in this rapidly evolving field. To support ongoing research, we maintain a project page that organizes relevant literature with collected datasets and open source code: https://github.com/CV-AC/Awesome-FaceDe-ID. Index Terms: Face De-identification, Utility Preservation, Evaluation Protocol, Privacy Protection, Literature Survey. 1 Introduction Human face contains abundant identity-related information, making it a cornerstone of biometric recognition systems in modern society [214, 45]. However, the widespread collection and utilization of facial data pose significant privacy, security, and ethical concerns [115, 86]. Recent regulatory frameworks, most notably the EU AI Act (Regulation (EU) 2024/1689), underscore that the misuse of facial data constitutes a severe infringement of fundamental rights, including the right to privacy [29]. To mitigate these risks, the research community has developed face de-identification (De-ID), which is defined as the class of image- or video-domain transformations that conceal personally identifiable facial information such that the depicted subject cannot be recognized, by either an automated face recognizer or a human observer, while non-identity attributes required by downstream applications (e.g., medical analysis [201] and attribute recognition [9]) remain usable. Figure 1: Overall perspective of this face De-ID survey paper. The process begins in physical world, where identity cues are modified directly on the subject through adversarial wearables, cosmetics, or projection-based interventions. It then transitions through the sensor-capturing stage, where privacy-preserving optics and computational imaging encode De-ID at the sensor level. Finally, in digital space, post-capture algorithms apply pixel- or feature-level transformations to conceal identity while retaining utility. In recent years, face De-ID has been widely studied and has expanded from purely digital treatments to encompass sensor-integrated and physical-world interventions (see Fig. 1). Early face De-ID efforts predominantly operated in the digital domain, manipulating recorded imagery via hand-crafted filters (e.g., blurring, pixelation) [59] or statistical anonymization mechanisms such as k-Same family [123]. Subsequent advances leveraged adversarial perturbations [65, 147] and generative models [207, 84] to synthesize photorealistic yet privacy-safe faces. While these digital approaches achieved remarkable fidelity and controllability, they remain post hoc interventions, exposing raw sensitive data prior to De-ID [137]. To mitigate this vulnerability, recent research has shifted privacy protection into the imaging process. Sensor domain face De-ID paradigms integrate optical and computational imaging designs that suppress identity cues at capture time, embedding privacy filters in optics or sensors to eliminate identifiable cues before digital conversion (e.g., PrivacyOptics [106]). In parallel, physical domain strategies extend face De-ID into the real world by modifying subjects’ appearance through adversarial wearables [159], cosmetics [204], or projected light patterns [104] that confuse recognition systems under unconstrained environments. Collectively, these directions represent a continuum from post-capture face De-ID to sensor-level and physical-level protection, each offering distinct advantages and challenges regarding effectiveness, utility, and realism. Figure 2: Cumulative growth of face De-ID methods across domains. Data collected via Google Scholar using keywords: ”face de-identification”, ”face privacy preserving”, and ”face adversarial attack”. (a) Conceptual (left) and historical (right) overview of face De-ID, clarifying the paper’s domain-centric taxonomy. This paper provides a unique and up-to-date survey of the rapidly growing area of face De-ID (Fig. 2 illustrates the growth trajectory and domain-specific research trends). Although several survey papers have reviewed aspects of face De-ID, existing works remain fragmented and narrow in scope (see TABLE I). Specifically, most prior surveys concentrate only on digital domain techniques [99, 17], overlooking the rapid evolution of sensor-based and physical face De-ID methods that increasingly shape real-world privacy protection. Moreover, current surveys rarely provide evaluation protocol analysis [48, 10], resulting in insufficient overview of the datasets and metrics that are critical for advancing this field. To address these gaps, this survey presents a comprehensive review and critical analysis of face De-ID techniques from physical, sensor, and digital perspectives, spanning more than three decades of research. Our goal is to bridge the fragmented literature across these domains, establish a unified taxonomy, and highlight both the fragmentation of evaluation protocols in this field and the emerging convergence between optical design, adversarial learning, and generative synthesis for privacy preservation. Specifically, this paper makes the following contributions: • We provide the first domain-centric taxonomy of face De-ID methods, systematically categorizing approaches according to where privacy transformation occurs: before, during, or after image capture, and summarizing representative methodologies within each domain. • We perform an in-depth analysis of methodologies and trends across physical, sensor-based, and digital face De-ID, highlighting their design principles, advantages, and limitations. • We review and summarize evaluation protocols, emphasizing the need for unified assessment frameworks that jointly measure privacy protection, utility preservation, and visual quality. • We identify open challenges and future directions, including cross-modal privacy preservation, foundation model level face De-ID, verifiable and reversible De-ID, and fairness-aware privacy guarantees. The remainder of this paper is organized as follows. Sec. 2 establishes conceptual foundations. Sec. 3 reviews methodologies across the three domains. Sec. 4 systematizes evaluation protocols. Sec. 5 outlines open problems and Sec. 6 concludes the survey. TABLE I: Summary of existing survey papers related to face De-ID. Prior works predominantly focus on digital-domain methods, with limited exploration of sensor-based or physical de-identification. Our survey provides the first unified, domain-centric overview that spans all three levels and includes evaluation protocol analysis. Paper Year Physical Sensor Digital Protocol Perspective [128] 2015 ✗ ✓ ✓ ✗ Camera [142] 2015 ✗ ✓ ✓ ✗ Image/video [141] 2016 ✗ ✓ ✓ ✗ Multimedia [112] 2021 ✗ ✓ ✓ ✗ Pipeline-level [99] 2022 ✗ ✗ ✓ ✗ Social network [17] 2022 ✗ ✗ ✓ ✗ 3D face De-ID [48] 2023 ✓ ✗ ✗ ✗ Presentation-level [10] 2024 ✗ ✗ ✓ ✗ Processing level [74] 2024 ✗ ✗ ✓ ✗ Person De-ID [186] 2024 ✗ ✗ ✓ ✗ Digital era [36] 2025 ✗ ✗ ✓ ✗ Generative [134] 2025 ✗ ✗ ✓ ✗ Deepfake [86] 2025 ✗ ✓ ✓ ✗ Leakage/solution Ours — ✓ ✓ ✓ ✓ Domain-centric 2 Preliminaries Research on face De-ID traces back to the early era of computational face analysis. The first successful demonstration of automatic face recognition, Eigenfaces [173] by Turk and Pentland in 1991, highlighted both the feasibility of machine-based identification and the accompanying privacy risks. Shortly thereafter, the first dedicated De-ID technique, EFVAP [59], was introduced in 1996, marking the beginning of systematic efforts to suppress identifiable facial information. Since then, the field has expanded into a broad research direction. Fig. LABEL:fig:timeline presents a curated chronological trajectory of representative face De-ID methods, revealing a clear shift in research emphasis over time. A work appears in the timeline if it satisfies at least two of the following criteria: (i) it introduced a methodological primitive subsequently adopted by other works (e.g., k-Same [123], AdvEyeglass [159], DefocusOptics [137]); (i) it is the first reported method in its sub-category (e.g., EFVAP [59]); (i) it represents the current state of the art or a distinct subsequent generation within a sub-category (e.g., AT3D [199], G2G^2Face [194]); or (iv) it has high scholarly impact (citations ≥200≥ 200 for works published before 2022 and ≥50≥ 50 from 2022 onwards). Exhaustive coverage of all 112 surveyed methods, including those not selected for the timeline, is provided in TABLE IV. 2.1 Face De-ID vs. Privacy-Preserving As shown in Fig. LABEL:figure:taxonomy, face De-ID represents one branch within a broader family of privacy-preserving methodologies. More broadly, privacy-preserving methodologies comprise complementary paradigms, including differential privacy [215], federated learning [58], cryptographic protocols [5], synthetic data generation [66], and de-identification [186, 47], each of which addresses distinct dimensions of data protection. Face De-ID is a vision-centric technique that complements but does not replace other privacy paradigms. Recognition in video and surveillance further exploits complementary modalities including body shape, gait, and other behavioral biometrics (e.g., voice, eye gaze, hand motions). Face De-ID is thus one component of a broader person De-ID pipeline. 2.2 Face De-ID vs. Face Identification Face identification maximizes the discriminability of identity-bearing cues, whereas face De-ID suppresses those cues while preserving non-identity information. Most face De-ID approaches therefore assume a strong face recognition (FR) adversary as their primary threat model. Modern FR systems extract discriminative embeddings optimized for intra-class compactness and inter-class separability through metric learning objectives. Representative architectures include FaceNet [153], which pioneered triplet-loss deep metric learning; SphereFace [101], which introduced angular softmax for hypersphere embedding; ArcFace [25], the most prevalent in De-ID research owing to its additive angular margin loss; and AdaFace [77], which adapts margins to image quality. These systems typically operate on faces localized by detectors such as RetinaFace [24]. This adversarial relationship runs throughout the De-ID pipeline: physical methods optimize perturbations to fool FR models in the real world [199]; sensor-based approaches design optics that suppress identity-discriminative frequencies [129]; and digital methods incorporate pre-trained FR models as verifiers in their training objectives [109]. With FR systems defining both the attack surface and the evaluation criteria, face identification is foundational to designing and benchmarking De-ID techniques. 2.3 Problem Formulation Let ∈ℝH×W×3I ^H× W× 3 denote an input face image (or video frame) containing personally identifiable information about an individual. A face De-ID method seeks a transformation ℱ(⋅)F(·) that produces a de-identified output ~=ℱ() I=F(I) in which identity-related cues are concealed while non-identity, task-relevant information is preserved. For applications that additionally require authorized recovery (e.g., forensic investigation, medical audit, legal disclosure), ℱF is paired with a key-conditioned inverse ℛ(⋅;k)R(·\,;\,k) such that ℛ(~;k)≈R( I;\,k) only when k is the legitimate recovery key. Formally, we cast face De-ID as the joint maximization of privacy, utility, visual-quality, and reversibility scores: maxℱ,ℛλp+λu+λq+δrevλr, _F,\,R\; _pP+ _uU+ _qQ+ _rev\, _rS, (1) where (,~)P(I, I), (,~)U(I, I), (~)Q( I), and (,~,ℛ;k)S(I, I,R;\,k) denote privacy, utility, visual-quality, and key-conditioned reversibility scores (each to be maximized), λp,λu,λq,λr≥0 _p, _u, _q, _r≥ 0 are trade-off weights, and δrev∈0,1 _rev∈\0,1\ is an application-level switch that enables the reversibility term when authorized recovery is required and disables it otherwise. The expected solution should satisfy the following criteria: 1. Privacy Protection: The de-identified ~ I should not match any other identity. Formally, for any recognizer fidf_id, Pr(fid(~)=fid(i))≈0,∀i \! (f_id( I)=f_id(I_i) )≈ 0,\ ∀ i, where iI_i denotes any image of identity i. This prevents both re-identification to the original and misattribution to others. 2. Utility Preservation: For a set of downstream tasks =t1,…,tnT=\t_1,…,t_n\, the task-specific predictors ftjf_t_j should maintain consistent outputs before and after face De-ID, i.e., ftj(~)≈ftj()f_t_j( I)≈ f_t_j(I). 3. Visual Fidelity and Naturalness: The de-identified image should remain photorealistic and free from perceptible artifacts, ensuring usability and social acceptability in real applications. 4. Reversibility: When δrev=1 _rev=1, there should exist a key-conditioned inverse ℛ(⋅;k)R(·\,;\,k) satisfying ℛ(~;k)≈R( I;\,k) for the legitimate key while Pr(ℛ(~;k′)≈)→0 \! (R( I;\,k ) )→ 0 for any k′≠k ≠ k. Reversibility is orthogonal to privacy: a method may be strongly de-identifying yet reversible (e.g., password-conditioned generative inversion), strongly de-identifying and irreversible, or neither. 2.4 Taxonomy: A Domain-Centric Perspective Face De-ID methods are fundamentally characterized by where in the imaging pipeline the privacy transformation occurs. This survey adopts a domain-centric taxonomy with three classes, physical, sensor, and digital, each embodying distinct design constraints and trade-offs. Physical Domain. A transformation ℱpF_p alters the subject’s real-world appearance before capture (e.g., adversarial accessories, makeup, light projection, 3D mask) so that the captured image ~ I inherently exhibits suppressed identity. These methods strongly protect against raw-data exposure but offer limited controllability and may be conspicuous. Sensor Domain. Imaging components ℱsF_s embed privacy during acquisition through optical coding, sensor-level transformations, or computational imaging (e.g., learned phase masks, PSF manipulation), encoding ~=ℱs() I=F_s(I) in the raw measurement space so that no identifiable face is produced. They provide strong trust-boundary guarantees but face stringent hardware constraints (latency, resolution, power) and deployment challenges. Digital Domain. Post-capture methods operate on recorded imagery, modifying identity through filtering, mapping, adversarial perturbations, or generative synthesis (e.g., GANs [35], diffusion models [53]) to obtain ~=ℱd() I=F_d(I). They are the most flexible and widely adopted, enabling fine-grained control and high fidelity, but expose raw data before De-ID and remain most vulnerable to re-identification. 2.5 Cross-Domain Interactions A genuine unification of physical, sensor, and digital De-ID must articulate not only what each domain does in isolation, but how interventions in one domain interact with the others along the acquisition pipeline. First, a physical-domain perturbation must survive lens distortion, sensor noise, demosaicing, white balance, and downstream JPEG/H.264 compression before reaching a digital recognizer. Empirically, perturbations optimized without explicit modeling of the ISP pipeline (e.g., early adversarial patches) lose substantial attack success after realistic capture. Methods that explicitly model the capture chain (ProjAttacker [104], AT3D [199]) close this gap, illustrating the necessity of co-design between physical perturbations and the sensing stage they must traverse. Second, multi-stage interventions can compound or conflict. A sensor-domain phase mask combined with a downstream digital generative refiner (PrivacyOptics [106]) leverages the strengths of both: the optics provide hardware-level identity suppression while the generator restores task utility. Conversely, a physical adversarial patch followed by a digital denoiser may be neutralized, since the patch is treated as removable noise. Third, an intervention at an earlier stage can obviate the need for one at a later stage. Extreme low-resolution capture (ISR [145]) makes downstream digital pixelation redundant; conversely, strong digital generative De-ID (Swapping-DeID [84]) makes physical perturbations unnecessary when full digital pipeline control exists. Fourth, the three domains differ fundamentally in where raw identity-bearing signal first exists in digital form. Physical-domain De-ID prevents identifiable signal from ever being produced; sensor-domain De-ID ensures that identifiable signal never leaves the camera; digital-domain De-ID accepts a fully identifiable signal and removes identity in software layer. The choice of domain is therefore primarily a choice of trust model rather than a choice of algorithm. 3 Face De-ID Methodologies Building upon the domain-centric taxonomy established in Sec. 2.4, we now present a comprehensive analysis of face De-ID methodologies across the physical, sensor, and digital domains. Fig. 4 provides a visual overview of the face De-ID methods discussed in this section. 3.1 Physical-Domain Face De-ID Physical-domain face De-ID manipulates the physical appearance of individuals or their surrounding environment to prevent FR systems from correctly identifying them. Following Sec. 2.5, these methods intervene at the earliest stage of the acquisition pipeline: identity cues are suppressed on the subject before any digital signal exists, but the perturbation must subsequently survive optics, sensor, and ISP processing to remain effective at the recognizer. Based on their mechanism, existing methods fall into three classes: wearable adversarial accessories (printed or fabricated items such as eyeglasses, hats, stickers, masks, and bandages), projected perturbations (external devices that cast adversarial patterns onto faces using visible or infrared light), and adversarial illumination (manipulated environmental lighting that creates naturally-appearing yet recognition-disrupting effects). Fig. I illustrates representative examples. Figure 4: Hierarchical taxonomy of face De-ID methodologies. Each domain is further categorized into specific sub-classes based on their technical approaches. (a) AdvEyeglass [159] (b) AdvHat [78] (c) ALPA [125] (d) AdvMakeup [204] (e) AdvMask [222] (f) AdvSticker [183] (g) AT3D [199] (h) Optical De-ID [94] (i) ProjAttacker [104] 2016 2020 2020 2021 2022 2022 2023 2023 2025 TABLE I: Sample figures of representative physical‑domain face De-ID methods. Wearable adversarial accessories: (a), (b), (d), (e), (f), (g). Projected perturbations: (c), (i). Adversarial illumination: (h). Unlike digital or sensor methods, physical-domain face De-ID is governed by four dimensions that shape every design choice in this section. (1) Manufacturability and configurability: the perturbation must be physically realizable using printing, fabrication, or projection hardware with bounded resolution, color gamut, and material reflectance. (2) Real-world robustness: because the perturbation cannot be re-tuned at deployment time, it must remain effective across viewpoint, distance, motion, illumination, weather, background, and partial occlusion. (3) Conspicuity and social acceptability: the perturbation is worn or projected in public, so its visual impact and social cost (legality, suspicion, attention) directly determine deployability, independently of attack success rate. (4) Propagation through sensor capture: the perturbation passes through optics, sensor noise, ISP processing, and compression before reaching the recognizer, all of which can attenuate or destroy the adversarial signal. The following subsections examine the three classes of methods along these four axes. 3.1.1 Wearable Adversarial Accessories Eyeglass-Based Approaches. Sharif et al. [159] (AdvEyeglass) established the foundational paradigm for physical attacks against FR, introducing eyeglass frames with optimized textures that enable evasion or impersonation. Building on this, AGNs [160] introduced a GAN-based framework that learns to generate adversarial eyeglasses from real eyeglass datasets, addressing vaguely specified objectives such as inconspicuousness that resist mathematical modeling. Patch and Sticker-Based Methods. The small perturbation area imposed by L0L_0-norm restrictions on eyeglasses motivates larger patches and stickers. AdvHat [78] affixes rectangular stickers to hats for larger perturbation areas while preserving natural appearance. OAP [135] proposes grayscale patches for facial regions or eyeglasses, with a reproducible pipeline accounting for printing and camera color discrepancies. Physical AX [165] contributes a threshold-based smoothness loss with delayed total-variation penalties that improves convergence, and a patch-noise combo attack combining localized patches with imperceptible full-face noise for higher white-box and black-box success. A central challenge is transferability in query-free black-box settings against unknown commercial systems. GenAP [191] regularizes patches on low-dimensional manifolds learned by pre-trained generative models (ProGAN [69], StyleGAN [70, 71]), constraining them toward natural face features and narrowing the substitute-target response gap. PadvFace [217] models physical-world variations including chromatic aberration, sticker deformation, and illumination changes. EAP [102] targets impersonation via random similarity transformations, image pyramids, and meta-ensemble attacks for robustness across scales, resolutions, and models. Other work moves beyond optimized patterns: AdvSticker [183] uses real-life meaningful stickers (e.g., decorative designs); PPAttack [182] jointly optimizes patch perturbation and position via reinforcement learning; and FaceAdv [162] uses Grad-CAM [154] to locate critical regions, with a generator-converter architecture simulating physical capture under limited sticker area. Makeup and Mask-Based Approaches. Cosmetics offer a vehicle for inconspicuous perturbations. AdvMakeup [204] pioneered this with a GAN-based approach synthesizing natural adversarial eye shadow over the orbital region, combining gradient constraints with VGG16-based style/content losses [164] for imperceptibility. The COVID-19 normalization of face masks enabled mask-based methods. Adversarial Mask [222] embeds Universal Adversarial Perturbations into fabric masks through differentiable digital masking that places perturbations precisely along facial contours. SASMask [33] instead optimizes adversarial mask styles via continuous relaxation, maximizing impersonation success while staying visually realistic across digital, physical, and commercial platforms. AdvBandage [6] uses perturbed medical bandages as discreet patches, optimizing bandage size and placement with iterative FGSM [34] for both dodging and impersonation, with bandages providing natural cover without arousing suspicion. 3D Adversarial Meshes. 2D accessories are limited by detectability under anti-spoofing defenses and reduced effectiveness against commercial systems. 3D adversarial meshes address this by modeling the full geometry of facial perturbations for robust attacks across viewing conditions. AT3D [199] pioneered this with Adversarial Textured 3D Meshes that are 3D-printed and applied directly to faces; its key innovation is optimization in the low-dimensional coefficient space of 3D Morphable Models (3DMM) [172] rather than high-dimensional mesh space, which accelerates optimization, avoids local optima, and improves black-box transferability. Physical tests showed evasion of four commercial anti-spoofing APIs, two mobile systems, and two access control systems. Face3DAdv [200] extends this with a controllable simulation framework that reconstructs full 3D face information (texture, shape, viewpoint, lighting) via a differentiable renderer, using importance sampling to prioritize critical physical transformations. 3.1.2 Projected Perturbations Projection-based methods shift from accessories to artifact-free De-ID by manipulating light patterns cast onto faces, offering real-time adaptability and multi-target flexibility. ALPA [125] pioneered this direction with real-time adversarial light projections using an off-the-shelf camera-projector setup, incorporating landmark-based position calibration and Lab-space color calibration to accurately reproduce adversarial patterns, while generating transformation-invariant patterns through representative face averages. ProjAttacker [104] addressed digital-physical gap challenges through 3DMM [172] initialization for geometry alignment, Light Reflection Function modeling for interactions among projected light, skin reflectance, and ambient illumination, and a differentiable camera ISP proxy network simulating real-world imaging variations. Agile [180] pushes stealthiness further with adjustable, invisible infrared laser emissions directed into camera CMOS sensors rather than visible-light projection, enabling Denial-of-Service, dodging, and impersonation attacks. 3.1.3 Adversarial Illumination Unlike projection-based methods that actively cast patterns onto faces, adversarial illumination exploits FR sensitivity to lighting by manipulating environmental lighting or the illumination used in specialized 3D acquisition systems, achieving De-ID through naturally-appearing lighting variations that avoid the conspicuousness of projected patterns. Optical De-ID [94] targets structured-light-based 3D FR by corrupting the 3D data acquisition process itself, integrating 3D reconstruction and skin reflectance models into optimization through two strategies: phase shifting attacks that modify projected structured light patterns, and phase superposition attacks that project external adversarial noise. The dual approach enables adversarial point placement anywhere on the face with robustness to head movements. ARA [209] exploits illumination vulnerabilities in 2D FR by producing naturally relighted face images, combining physical model-based optimization (which guides adversarial lighting using feedback from FR systems) with efficient neural-network-based prediction (instantaneous prediction of adversarial light settings), with physical-world verification using precise relighting hardware. 3.1.4 Discussion Physical-domain face De-ID has progressed from handcrafted, accessory-bounded textures to 3D- and optics-aware pipelines that explicitly model capture physics and sensor behavior. Reviewing this progress along the four physical-domain dimensions, several gaps persist. On manufacturability, low-dimensional priors such as GAN manifolds [35], 3DMM coefficients [172], and style spaces [191, 33] have systematically improved transfer and realism by constraining perturbations near the face manifold, but standardized fabrication tolerances and material-aware optimization remain underdeveloped, particularly for 3D-printed meshes [199, 200] where print resolution and material reflectance directly affect deployment fidelity. On real-world robustness, non-contact photonic channels (visible/IR projection [125, 104, 180], structured-light interference [94]) widen the attack surface while alleviating occlusion-induced liveness failures, yet standardized benchmarks encompassing multi-view video, multi-sensor (RGB-IR-depth) fusion, and liveness under varied ambient conditions are still lacking, as are cross-system generalization studies under policy and threshold changes (including open-set verification) and principled evaluations of long-term stability such as washability, wear, and battery/thermal constraints for emitters [125, 180]. On conspicuity and social acceptability, quantitative stealth metrics aligned with human perception and social norms are needed; current proxies based on area or total-variation [165] under-capture social cost, and even methods designed for inconspicuousness [204, 222, 6] rely largely on qualitative argument rather than measurement. On propagation through sensor capture, methods that explicitly model the capture chain [104, 199] demonstrate the value of physical–sensor co-design, but co-design with defenses that jointly perform spoof detection, quality assessment, and identity inference remains largely unexplored. Addressing these gaps will require reproducible, physics-grounded testbeds, shared calibration protocols, and reporting standards that elevate claims from single-device demonstrations to robust, deployable face De-ID guarantees. 3.2 Sensor-Domain Face De-ID Sensor-domain face De-ID methods intervene during image acquisition, preventing identifiable facial information from ever being recorded. Following the cross-domain analysis of Sec. 2.5, sensor-domain methods intervene inside the camera: identity-bearing signal exists optically but is encoded before digitization, and these methods frequently combine with downstream digital generators that restore task utility from the privacy-encoded measurement. These techniques fall into two paradigms: optical privacy-preserving designs that manipulate incident light through defocus, aberrations, or phase masks before it reaches the sensor, and extreme low-resolution imaging that captures faces below the recognition threshold. Fig. 5 contrasts the two paradigms: (a) shows the optical pipeline, in which a point source is encoded by the camera optics into a privacy-preserving point spread function (PSF) before reaching the sensor, across its fixed, learnable, and dynamic generations; (b) shows the low-resolution pipeline, in which a tiny camera records faces too coarse for recognition while a downstream network still recovers task utility. 3.2.1 Optical Privacy-Preserving Designs Optical designs encode privacy in the imaging optics themselves. As illustrated in Fig. 5(a), they have progressed through three generations, namely fixed designs with hand-specified degradation, learnable designs that jointly optimize optics and downstream networks, and dynamic designs that vary the optical configuration at capture time. Fixed Optics. Early optical privacy methods employed fixed designs to attenuate facial features. DefocusOptics [137] pioneered k-anonymity [169] preserving optical designs using intentional defocus blur, providing foundations for miniaturizing privacy optics within small sensor volumes. DefocusOptics+ [138] extended this with programmable optics enabling pre-capture mask-based techniques. However, these hand-specified defocus mechanisms proved vulnerable to deconvolution attacks, motivating learnable optical designs with complex, irreversible degradations. Figure 5: Taxonomy of sensor-domain face De-ID paradigms. (a) Optical privacy-preserving designs encode privacy in the camera optics: a point source is shaped by a lens and phase mask into a point spread function (PSF) recorded by the sensor, yielding a de-identified image while downstream utility is retained. Three generations are shown, namely fixed optics with hand-specified degradation (DefocusOptics [137], DefocusOptics+ [138]), learnable optics jointly optimized with downstream networks (PrivHPE [52], PrivHAR [51], PrivPDE [171], OpticalDR [129], PrivacyOptics [106]), and dynamic PSF that randomize the configuration per capture (DyPP [16]). (b) Extreme low-resolution imaging uses a tiny camera (e.g., 16×12 pixels) to capture faces below the recognition threshold, with a downstream neural network recovering task utility (ISR [145], LRPrivacy [144]). Learnable Optics. Learnable optical approaches jointly optimize hardware and software components for task-specific privacy-utility trade-offs. PrivHPE [52] introduced end-to-end optimization of optical encoders (parametrized via Zernike coefficients) and CNN decoders for pose estimation, using privacy-preserving loss functions to minimize face keypoint detection while maintaining task performance. PrivHAR [51] advanced this through adversarial training of phase masks for action recognition, achieving near-random classification performance on FR while preserving action recognition accuracy. Further refinements emerged through adversarial learning frameworks: PrivPDE [171] balanced FR prevention with depth estimation via aperture-plane phase masks, OpticalDR [129] achieved near-random FR while preserving depression-related features, and PrivacyOptics [106] combined optical encoding with GAN-based face synthesis to close the security gap between capture and De-ID. Dynamic Optics. A critical vulnerability of fixed and learnable-but-static designs is susceptibility to PSF inversion attacks, where adversaries recover the point spread function to reconstruct faces. DyPP [16] addressed this by introducing time-varying PSFs sampled from a learned privacy manifold, implemented via spatial light modulators. This dynamic design randomizes the optical configuration for each capture, significantly enhancing robustness against inversion attacks while maintaining task utility for object detection and pose estimation. 3.2.2 Extreme Low-Resolution Imaging Rather than encoding privacy in the optics, extreme low-resolution imaging achieves face De-ID by capturing at resolutions (e.g., 16×12 pixels) where facial detail is inherently insufficient for reliable recognition (faces are reduced to 2×2 or smaller representations). As shown in Fig. 5(b), the coarse capture is fed directly to a downstream network that recovers task utility without ever recording an identifiable image. ISR [145] pioneered this paradigm by proposing inverse super resolution, generating multiple informative low-resolution training videos from high-resolution sources via optimized sub-pixel transformations. This enables learning robust decision boundaries in low-resolution feature space while ensuring hardware-level privacy, achieving comparative activity recognition accuracy. LRPrivacy [144] advanced this through a two-stream multi-Siamese CNN that learns transformation-invariant embeddings, enabling real-time activity classification on mobile GPUs without recording identifiable high-resolution videos. 3.2.3 Discussion Sensor-based face De-ID offers strong security-by-design advantages by eliminating the raw identifiable face from the acquisition path, but several challenges persist. First, threat models and evaluation protocols require standardization: claims of irreversibility should be stress-tested against optical inversion, deconvolution/deblurring, super-resolution, face restoration, and ISP-level side channels across diverse sensors and color pipelines. Second, dynamic optics (e.g., DyPP) improve resilience but introduce calibration, latency, and energy costs; quantifying these trade-offs for mobile and embedded platforms is essential. Third, privacy–utility objectives remain task- and population-dependent: preserving low-frequency geometry can leak soft-biometrics, and fairness across demographics under optical distortions is underexplored. Fourth, co-design with downstream ISPs and multi-camera systems is largely unaddressed, as is long-term robustness to hardware drift and manufacturing tolerances. Finally, reproducible cross-device benchmarks coupling privacy, task, and perception metrics are needed for on-sensor De-ID at scale. (a) Traditional digital-domain face De-ID approaches. (a) Handcrafted filters, including blur, pixelization, and masking, uniformly reduce the recognizability of the facial region, alongside spatially adaptive filtering (EmotionPreserve [89]) that selectively blurs identity-bearing structures while preserving utility-bearing regions. (b) The k-Same framework aggregates a cluster of k face images to synthesize a mean face that replaces the original, theoretically limiting the recognition probability to 1/k1/k. Together they illustrate the shift from ad-hoc distortion to statistically grounded face De-ID. 3.3 Digital-Domain Face De-ID Following the cross-domain analysis of Sec. 2.5, digital-domain methods accept a fully identifiable digital signal and suppress identity in software. Their flexibility comes at the cost of accepting raw exposure and, in some regimes, replacing rather than complementing upstream physical or sensor interventions. 3.3.1 Handcrafted Distortion and Filtering Handcrafted distortion methods are the earliest face De-ID approaches, employing simple image processing operations. Fig. 7(a)(a) shows naive distortion (Gaussian blur, pixelization, masking), while Fig. 7(a)(b) depicts the k-Same framework, marking the shift from ad-hoc distortion to statistically grounded face De-ID. Early work evaluated these operations for their privacy-utility trade-offs. EFVAP [59] and De-ID Filter [7] studied blur and pixelization in workplace video, finding that moderate blur conceals identity while preserving awareness cues such as posture, activity, and people count. Blur outperformed pixelization, which showed abrupt jumps in information disclosure across levels. However, BFPP [122] exposed a limitation in home telecommuting: blur weak enough to preserve awareness cues failed to de-identify, since motion and context still enabled recognition. This tension motivated spatially adaptive techniques that selectively preserve task-relevant information. PUI [20] introduced the Eigen-space filter, projecting live images onto a PCA basis learned from “socially correct” reference images so that reconstruction retains only reference-set information while suppressing non-conforming elements, though this raised ethical concerns over misuse for face animation and masquerading. EmotionPreserve [89] instead preserved expressions via variational adaptive filtering with Total Variation regularization, strongly blurring identity-contributing structures (nose, wrinkles) while sparing expression-related regions (eyes, eyebrows, mouth). Discussion. Handcrafted distortion established the foundational framework for digital face De-ID but suffers from critical limitations. Uniform operations cannot achieve strong De-ID while preserving utility, owing to the coupling between identity and task-relevant features: privacy-preserving settings eliminate awareness cues, while utility-preserving settings leave enough signal for recognition through motion and context. These methods also lack formal privacy guarantees, relying on user studies or model-specific recognition accuracy rather than rigorous metrics. Their need for empirical, context-dependent tuning shows that handcrafted distortion cannot universally balance privacy and utility, motivating learning-based approaches that adaptively optimize this trade-off. 3.3.2 k-Anonymity-Based Methods Formal privacy notions migrated into face De-ID via k-anonymity [169], which bounds re-identification risk by ensuring each released record is indistinguishable from at least k−1k-1 others. The foundational k-Same algorithm [123] translates this principle to faces by clustering images and replacing each with the cluster average, guaranteeing recognition accuracy ≤1/k≤ 1/k. Early refinements addressed utility and quality: k-Same-Select [38] imposed utility constraints to preserve gender and expression during clustering, while k-Same-M [40] leveraged active appearance models for improved alignment and photometric fidelity. These works systematically exposed weaknesses in ad-hoc pixelation, including susceptibility to parrot recognition and resolution enhancement attacks [40]. Subsequent developments expanded beyond closed-set scenarios. The ϵε-map framework [42] formalized three privacy targets: ϵε-map (“like no one”), wrong-map (“like someone else”), and (ϵ,k)(ε,k)-map (“like everyone”), via adaptive pixelation and likelihood equalization under reference models, supporting multiple images per subject with explicit privacy bounds. Multi-Factor DeID [41] disentangled identity from nuisance factors using unified linear/bilinear/quadratic models with semi-supervised fitting. An alternative emerged with k-Same-furthest [113], which averaged over maximally dissimilar clusters rather than similar ones, theoretically driving recognition toward zero while maintaining k-anonymity. Attribute preservation became central in later methods. GARP-Face [27] blended faces with attribute-matched gallery images to preserve demographics while removing identity. APFD [68] formulated this as joint optimization over AAM parameters, computing optimal fusion weights for k attribute-similar images. Deep learning enabled new approaches: FIP-DeID [18] exploited pose-invariant features to generate averaged faces; k-Same-Net [110] replaced averaging with a generator trained on a disjoint proxy identity set, eliminating pixel-averaging artifacts while preserving the 1/k1/k bound; ELEGANT-DeID [193] combined k-Same with generative attribute transfer, achieving complete preservation with minimal gallery requirements. Discussion. k-Anonymity methods established the first formal privacy framework for face de-identification, providing provable guarantees that recognition accuracy cannot exceed 1/k1/k. However, this guarantee entails fundamental limitations: clustering constraints reduce scalability and introduce bias with skewed distributions, while pixel averaging produces perceptual artifacts. More critically, k-anonymity addresses only closed-world threat models, offering no protection against adversaries with auxiliary information. The utility–privacy trade-off remains coarse-grained (reducing k to preserve visual detail discontinuously increases re-identification risk) and attribute-preservation extensions [68, 193] require extensive labeled data with limited control over attribute retention. Despite these constraints, k-anonymity methods laid essential conceptual groundwork for subsequent developments. Figure 7: Architectural paradigms of contemporary digital-domain face De-ID. (Left) Adversarial perturbation-based methods inject imperceptible noise at the pixel level to mislead face recognizers. (Middle) GAN-based generative approaches synthesize identity-removed faces through encoder–decoder frameworks guided by discriminators and identity losses. (Right) Diffusion-based methods employ iterative denoising processes to achieve high-fidelity, photorealistic anonymization within structured latent spaces. Together, these architectures illustrate the evolution from explicit perturbation to implicit generative synthesis for controllable, realistic, and utility-preserving face De-ID. 3.3.3 Adversarial Perturbation-based Methods Early adversarial perturbation approaches generated minimal, imperceptible noise to fool FR systems (Fig. 7, left). EvolutionaryAttack [26] showed that perturbations as small as 10−510^-5 MSE enable dodging attacks, while P-FGVM [15] added realism constraints to spatial-domain perturbations, and AdvFaces [23] used discriminators for high perceptual quality under both dodging and impersonation. These pixel-level approaches, though effective, struggled with visual naturalness and cross-system transferability. To address this, researchers turned to feature-space manipulation in learned representations rather than pixel space. FSAP [192] optimizes latent vectors via bi-loss alternation between identity dissimilarity and attribute preservation; TIP-IM [198] combines relative identification loss with Maximum Mean Discrepancy constraints for open-set naturalness; FE-DeID [46] concentrates perturbations on critical regions (eyes, nose, mouth) via feature embedding; and Adv-Inversion [178] optimizes latent codes through reconstruction-fidelity losses, improving transferability over pixel-level perturbations. Other methods use natural visual modifications as perturbation carriers for stealthiness. AMT-GAN [55] reconciles adversarial noise with cycle consistency in makeup transfer through joint training, while Makeup De-ID [221] embeds perturbations in eye-makeup regions for more realistic dodging and impersonation. CLIP2Protect [157] searches latent manifolds guided by textual makeup prompts, and DiffProtect [100] produces target-agnostic examples that avoid noise-based artifacts, while WeakenDiff [147] targets purification effects via learned unconditional embeddings to raise impersonation success. Semantic-level manipulation has gained attention for its natural appearance and transferability. Adv-Attribute [65] perturbs high-level attributes in disentangled latent spaces through importance-aware selection and multi-objective optimization, excelling against robust black-box models. Adv-CPG [179] integrates customized portrait generation with progressive two-layer identity encryption, enabling multi-modal control while achieving strong black-box success. Black-box transferability remains a central challenge. DFANet [218] uses dropout to diversify examples and prevent surrogate overfitting, establishing the TALFW robustness benchmark; Sibling-Attack [97] adds attribute recognition as an auxiliary task to improve generalization; SMAP [108] jointly optimizes patch texture, position, and shape via gradient-guided location selection; and ADA [54] and DPA [219] respectively survey transferability enhancement across FR architectures and advance unrestricted-attack embedding strategies. A further group targets specialized scenarios. GMAA [90] produces expression-robust impersonation by training across facial action units; UAXs [3] exposes vulnerabilities via identity-agnostic universal perturbations that spoof multiple identities at once; VLA [161] extends attacks to physical settings using projected visible light with alternating perturbation and concealing frames; Chameleon [19] offers instant protection through identity-preserving targeted perturbations; and Veil Privacy [130] generates veiled data that conceals identity from humans while preserving, or enhancing, DNN utility. Discussion. Adversarial perturbation methods have evolved from pixel-level noise injection [26, 15] through feature-space methods [192, 198] to semantic manipulations [65, 178], a clear trend toward more natural-looking and transferable perturbations. Yet four challenges persist. First, the transferability-imperceptibility trade-off: perturbations effective on surrogates often fail on black-box systems, while larger magnitudes compromise naturalness [218, 97]. Second, limited robustness to preprocessing (JPEG compression, resizing, filtering), which attenuates adversarial effects before reaching the target. Third, variable computational efficiency, with iterative optimization [198, 192] limiting real-time use. Fourth, evaluation inconsistency across FR models, datasets, and metrics, which hinders systematic comparison. Future work should prioritize unified protocols assessing not only attack success but also visual quality, transferability, and efficiency. 3.3.4 Generative Model-based Methods GANs have emerged as a dominant paradigm for face De-ID, enabling the synthesis of photorealistic faces while preserving non-identity attributes (Fig. 7, middle). Early approaches established foundational architectures through style transfer and conditional generation. FATM [96] pioneered facial attribute transfer through encoder-decoder architectures mapping non-identity attributes to donor identities. EPD-Net [2] introduced dual auxiliary networks with identity and emotion verificators to maximize emotion preservation while minimizing identity similarity. Live-DeID [31] extended these principles to video streams through attractor-repeller mechanisms where low-to-mid level features enforce similarity to input frames while high-level representations enforce distance from target identities. Several methods have addressed privacy-utility trade-offs through specialized architectures and loss formulations. P-GAN [189] combined Siamese verificators for identity removal with SSIM-based regulators for utility preservation. Generative-DeID [8] extended De-ID to full-body scenarios through segmentation-conditioned synthesis. AutoDeID [79] integrated k-anonymity principles through Anonymous Semantic Masks and identity-adversarial discriminators ensuring distance from original and sensitive identities. DeID-GAN [1] utilized StyleGAN-generated proxy faces as anonymous templates, fusing non-biometric attributes based on emotion and pose similarity. Attribute-aware and controllable generation has become increasingly prominent. A3GAN [207] formulated face De-ID as joint semantic suppression and controllable attribute injection through suppressive convolutional units and attribute-aware injective networks. FaceSwap [196] combined StyleGAN-based attribute disentanglement with adversarial vector mapping in latent space to generate recognition-resistant images. SF-GAN [95] distinguished between shallow attributes (hairstyle, glasses) and deep attributes (expression, gender) through specialized processing networks, employing uniqueness loss to ensure distinctness. AnonymousNet [91] achieved measurable privacy through four-stage frameworks integrating attribute selection compliant with k-anonymity, l-diversity, t-closeness, and ε -differential privacy. Disguise [9] grounded De-ID in differential privacy and ensemble learning with mixture-of-experts utility networks for attribute disentanglement. Reversibility represents critical advances for practical deployment. IdentityMask [184] introduced reversible video De-ID with Protection and Recovery Modules using user-specific keys and motion flow guidance for temporal consistency. PIDIM [11] enabled personalized invertible De-ID through password-controlled hyperspherical transformations. U-Net [139] proposed landmarks-free reversible solutions using sequential encoder-decoder models for public anonymization and private reconstruction. IDeudemon [185] adopted divide-and-conquer strategies obfuscating 3D disentangled identity codes from NeRF models while preserving utility through visual similarity assistance. Contemporary methods leverage advanced architectures including StyleGAN variants and diffusion models. StyleGAN-based approaches demonstrate particular promise: StyleGAN-DeID [75] achieved effective De-ID through style mixing preserving utility attributes; FALCO [4] operated in StyleGAN2 latent space with margin-based identity obfuscation in ArcFace space and feature-matching attribute preservation in FaRL’s ViT space, eliminating background-based re-identification risks; and CPP-DeID [111] enabled customizable privacy-utility trade-offs through GAN inversion with privacy parameter-controlled identity suppression in W+W^+ latent space. Diffusion-based De-ID (Fig. 7, right) has emerged as a powerful alternative to GANs. DiffAM [168] introduced diffusion-based adversarial makeup with superior black-box transferability. Diff-Privacy [49] unified anonymization via Multi-Scale image Inversion with embedding scheduling. Synthetic-DeID [132] reformulated De-ID as training-free identity editing in frozen diffusion models, and Swapping-DeID [84] simplified the pipeline through reconstruction loss within Stable Diffusion, controlling De-ID via a single parameter. Multi-spectral and 3D-aware approaches extend De-ID beyond RGB still imagery. Thermal-F De-ID [98] combined RGB and thermal imagery with ensemble learning, showing that thermal features prevent photo-based spoofing. MVC-DeID [12] leveraged 3D-aware StyleNeRF for viewpoint-consistent identity disentanglement, while G2Face [194] integrated 3D face models and StyleGAN decoders for password-based reversibility. Context-specific applications are defined by application-driven utility constraints: DeID-rPPG [151] preserves remote photoplethysmography signals; FaceMotionPreserve [220] maintains facial motion for medical diagnosis; Egocentric-DeID [140] targets wearable-camera footage; Veil Privacy [130] balances human-imperceptible obfuscation with DNN utility; and DRGAN [103] pioneered 2D/3D De-ID preserving expression, gender, and ethnicity through disentanglement-reconstruction. 3.3.5 Discussion Generative methods represent the most sophisticated paradigm for face De-ID. The field has progressed from early conditional GANs prioritizing photorealism to frameworks incorporating formal privacy guarantees (k-anonymity [79], differential privacy [91]), reversible mechanisms [11, 184], and latent space manipulation [111, 4]. Despite superior visual quality, critical challenges remain: (1) the privacy-utility trade-off constitutes a fundamental limitation: perfect identity removal conflicts with perfect attribute preservation given representation entanglement; (2) evaluation fragmentation persists across disparate datasets and metrics, precluding meaningful comparison; (3) computational costs prohibit real-time deployment, particularly for diffusion approaches [84]; and (4) temporal consistency for video receives insufficient attention, with most methods designed for images. Recent diffusion models [132, 49] and geometric priors [194, 12] suggest promising directions, yet the field lacks frameworks characterizing achievable privacy-utility frontiers. Future priorities include: (a) standardized evaluation protocols; (b) information-theoretic analysis of privacy-utility trade-offs; and (c) video extensions with temporal consistency guarantees via 3D-aware or NeRF approaches [185, 12]. TABLE I: Overview of primary face De-ID evaluation datasets, grouped by modality. Env.: C = Controlled, S = Semi-controlled, W = In-the-wild. Dataset #Img/Vid #IDs Resolution Env. Annotations RGB Images LFW [56] 13,233 5,749 250×250 W identity CelebA [105] 202,599 10,177 178×218 W identity, 40 attr., 5 lmk CelebA-HQ [69] 30,000 — 1024×1024 W 40 attr., 5 lmk FFHQ [70] 70,000 — 1024×1024 W — VGGFace2 [13] 3.31M 9,131 varies W identity, pose, age CASIA-WebFace [203] 494,414 10,575 varies W identity MS-Celeb-1M [44] 10M 100,000 varies W identity MegaFace [73] 1M 690,572 varies W identity PubFig [82] 58,797 200 varies W 73 attr. AgeDB [120] 16,488 568 varies W identity, age, gender CFP [155] 7,000 500 varies W frontal/profile FERET [136] 14,126 1,199 256×384 C pose, expre. Multi-PIE [39] 750,000 337 varies C 15 poses, 19 illu., 6 expre. MORPH [143] 55,134 13,000 varies S age, gender, race RaFD [87] 8,040 67 681×1024 C 8 expre., gaze, 5 poses CK+ [107] 593 seq. 123 640×490 C expre., AU AffectNet [118] 450,000 — varies W valence-arousal, 8 expre. LADN [43] 635 — varies W makeup style RGB Video YTF [188] 3,425 vid. 1,595 varies W identity VoxCeleb [121] 150K vid. 6,112 varies W speaker, audio VidTIMIT [150] 430 vid. 43 512×384 C speaker, audio Ego4D [37] 3,670 hrs — varies W narration, activity 3D Face Bosphorus [152] 4,666 scans 105 3D mesh C 35 expre., AU, occlusion BU-3DFE [205] 2,500 scans 100 3D mesh C 6 expre. × 4 levels Eurecom Kinect [117] 936 52 RGB-D C pose, expre., occlusion SIAT-3DFE [202] 8,000 scans 500 3D mesh C expre. Physiological (rPPG / Affective) PURE [167] 60 vid. 10 640×480 C heart rate ground truth OBF [93] 200 vid. 100 varies C heart rate, atrial fibrillation AVEC [175, 174] — 84+ varies S depression score 4 Evaluation Protocols Face De-ID lacks the standardized benchmarks and metrics characteristic of mature vision tasks. Instead, evaluation practice has evolved heterogeneously, shaped by diverse threat models and application contexts across the three domains. TABLE IV summarizes the evaluation protocols of the 112 surveyed methods, revealing both remarkable breadth and concerning fragmentation. We first review the underlying datasets, then analyze the metrics used to assess privacy, utility, and visual quality. TABLE IV: Overview of the face De-ID landscape highlighting the heterogeneity in evaluation protocols. Methods are organized by domain (Physical, Sensor, Digital) and publication year, summarizing the specific datasets, performance metrics (Privacya, Utilityb, and Qualityc), and key innovations. Method Year Dataset Privacya Utilityb Qualityc Key Innovation Physical-Domain Face De-ID: Real-world Adversarial Modifications (Sec. 3.1) AdvEyeglass [159] 2016 PubFig [82] Success Rate (↑ ): 31.0% ✗ ✗ Eyeglass-frame perturbation AGNs [160] 2019 PubFig [82] Success Rate (↑ ): 70.0% ✗ ✗ GAN-based natural eyeglasses OAP [135] 2019 CASIA [203] Similarity (↑ ) ✗ ✗ Grayscale patches for ArcFace VLA [161] 2019 CusFace, LFW [56] Success Rate (↑ ): 85.6% ✗ Similarity, Distance, SelfDis Visible light-based physical attack ALPA [125] 2020 —- Success Rate (↑ ): 92.0% ✗ ✗ Adversarial light projection AdvHat [78] 2021 CASIA [203] Similarity (↑ ) ✗ ✗ Hat-based surface attack AdvMakeup [204] 2021 LFW [56], LADN [43] Success Rate (↑ ): 63.74% ✗ ✗ Physical eye-shadow makeup attack FaceAdv [162] 2021 LFW [56], VolFace [162] Success Rate (↑ ): 100% ✗ ✗ Multi-shape sticker GAN GenAP [191] 2021 LFW [56], CelebA-HQ [69] Success Rate (↑ ): ≤ 99% ✗ ✗ GAN manifold regularization AdvSticker [183] 2022 LFW [56], CelebA [105] Fooling Rate (↑ ) ✗ ✗ Attack using real-life stickers Physical AX [165] 2022 VGGFace2 [13] Success Rate (↑ ): ≤ 83% ✗ ✗ Threshold-based smoothness loss AdvMask [222] 2022 CASIA [203], CelebA [105], MS-Celeb-1M [44] Recognition Rate (↓ ) ✗ ✗ Universal fabric mask patterns PPAttack [182] 2023 LFW [56], CelebA [105] Fooling Rate (↑ ) ✗ ✗ Simultaneously optimization AT3D [199] 2023 LFW [56], CelebA-HQ [69] Success Rate (↑ ): ≤ 100% ✗ ✗ Low-dim 3-DMM coefficient Optical De-ID [94] 2023 Bosphorus [152], Eurecom [117], SIAT-3DFE [202] Success Rate (↑ ): ≤ 99% ✗ RMSE Adversarial-illumination 3D attack PadvFace [217] 2023 LFW [56] Success Rate (↑ ): 31% ✗ ✗ Curriculum-optimized sticker SASMask [33] 2024 LFW [56], VGGFace2 [13], AgeDB [120], CFP [155] Success Rate (↑ ): 43.4% ✗ SSIM Adversarial style optimization Agile [180] 2024 LFW [56], YTF [188] Success Rate (↑ ): 80% ✗ ✗ Invisible infrared laser perturbations EAP [102] 2024 LFW [56], CelebA-HQ [69] Success Rate (↑ ): 91.2% ✗ ✗ Meta-ensemble gradient extraction AdvBandage [6] 2024 LFW [56] Accuracy (↓ ) ✗ ✗ Physical attack using bandages ARA [209] 2024 VGGFace2 [13], CelebA [105] Success Rate (↑ ): ≤ 99% ✗ BRISQUE, NIQE Physical natural adversarial lighting Face3DAdv [200] 2025 LFW [56], CelebA-HQ [69] Success Rate (↑ ): ≤ 99% ✗ ✗ Robust 3D adversarial patches ProjAttacker [104] 2025 LFW [56], CelebA-HQ [69] Success Rate (↑ ): ≤ 98% ✗ ✗ Configurable physical attack Sensor-Domain Face De-ID: Acquisition-Level Privacy Protection (Sec. 3.2) DefocusOptics [137] 2015 —- k-anonymity Depth, Tracking ✗ Optical PSF-based k-anonymity DefocusOptics+ [138] 2016 FERET [136] k-anonymity Depth, Counting, Detection ✗ Pre-capture privacy-preserving optics ISR [145] 2017 HMDB [80], DogCentric [62], JPL-Interaction [146] Subjective Action ✗ Extreme low resolution LRPrivacy [144] 2018 HMDB [80], DogCentric [62] Subjective Action ✗ Multi-view embedding PrivHPE [52] 2021 LFW [56], MS-Celeb-1M [44], AgeDB [120], CFP [155] AUC (↓ ) Pose PSNR, SSIM End-to-end optimize optical encoder PrivHAR [51] 2022 HMDB [80], VISPR [127], PA-HMDB [190] C-MAP (↓ ), AUC (↓ ) Action ✗ Adversarial optical encoding PrivPDE [171] 2022 VGGFace2 [13], NYUv2 [163] AUC (↓ ) Depth, Action ✗ Optimize phase mask OpticalDR [129] 2024 CelebA [105], CK+ [107], AVEC [175, 174] AUC (↓ ) Emotion, Depression ✗ Depression signal preservation DyPP [16] 2024 PubFig [82], LFW [56], AgeDB [120] Accuracy (↓ ), AUROC (↓ ) Counting, Pose, Detection PSNR, SSIM Time-varying optical privacy PrivacyOptics [106] 2024 CelebA-HQ [69], FFHQ [70] L2L_2 Distance (↑ ) Attribute FID De-ID via learned optical encoder Digital-Domain Face De-ID: Post-Capture Processing Methods (Sec. 3.3) Handcrafted Distortion & Filtering (Sec. 3.3.1) EFVAP [59] 1996 – Subjective ✗ ✗ Gaussian blur and pixelation De-ID Filter [7] 2000 – Protection Rate (↑ ) ✗ ✗ Evaluation of filters PUI [20] 2000 – Subjective ✗ ✗ Eigen-space filtering BFPP [122] 2006 – Awareness Rate (↓ ) ✗ ✗ Home telepresence study EmotionPreserve [89] 2015 LFW [56] Verification Rate (↓ ) Expression, Gaze ✗ Variational adaptive filtering k-Anonymity & Statistical Methods (Sec. 3.3.2) k-Same [123] 2005 FERET [136] k-anonymity ✗ ✗ First formal framework k-Same-Select [38] 2005 FERET [136] Recognition Rate (↓ ) Gender, Expression ✗ Incorporate utility constraints k-Same-M [40] 2006 Multi-PIE [39], FERET [136] Recognition Rate (↓ ) Expression ✗ Model-based face De-ID ϵε-map DeID [42] 2007 – Rank-1 Accuracy (↓ ) Gender, Expression ✗ k-anonymity guarantees Multi-Factor DeID [41] 2008 IMM Face Dataset [166] Recognition Rate (↓ ) Expression ✗ Multi-factor separation k-Same-furthest [113] 2014 IMM Face Dataset [166] Recognition Rate (↓ ) Gender, Age, Expression ✗ Cluster furthest away GARP-Face [27] 2014 MORPH Dataset [143] Recognition Accuracy (↓ ) Race, Gender, Age ✗ Structured utility hierarchy DiffPose-DeID [149] 2014 IMM Face Dataset [166] Recognition Rate (↓ ) Pose, Emotion ✗ De-ID across different poses Photorealistic-DeID [119] 2014 Multi-PIE [39], MUCT [116], PUT [72] ROC Analysis Gender, Expression, Pose PSNR Component-based face synthesis APFD [68] 2015 FaceTracer [81], FaceScrub [124], ND1 [14], FERET [136], CAS-PEAL [32], BioID [64] Recognition Rate (↓ ) Attribute PSNR Optimal weighted fusion FIP-DeID [18] 2015 Multi-PIE [39] Recognition Rate (↓ ) Gender, Race, Age, Expression ✗ Deep learning-based method k-Same-Net [110] 2018 RaFD [87], XM2VTS [114], CK+ [107] Recognition Rate (↓ ) Expression ✗ Generative realization of k-anonymity ELEGANT-DeID [193] 2019 CelebA [105] k-anonymity Age, Gender, Expression ✗ ELEGANT-based attribute transfer Adversarial Perturbation Methods (Sec. 3.3.3) EvolutionaryAttack [26] 2019 LFW [56], MegaFace [73] MSE (↑ ) ✗ ✗ Decision-based attack on recognition P-FGVM [15] 2019 CelebA [105] Misclassification Rate (↑ ) ✗ MSSIM Realism-penalized gradient Makeup De-ID [221] 2019 Custom Dataset Success Rate (↑ ) ✗ ✗ Makeup-based adversarial attack AdvFaces [23] 2020 CASIA [203], LFW [56] Success Rate (↑ ): 99.67% ✗ SSIM GAN-based face synthesis DFANet [218] 2020 LFW [56], MS-Celeb-1M [44], VGGFace2 [13], CASIA [203], IMDb-Face [177] Success Rate (↑ ) ✗ SSIM Dropout-based method UAXs [3] 2021 LFW [56], VGGFace2 [13] FMR (↑ ) ✗ ✗ Universal multi-identity spoofing TIP-IM [198] 2021 LFW [56], MS-Celeb-1M [44], MegaFace [73] Rank-N-T (↓ ) ✗ PSNR, SSIM, MMD Principled distribution matching Adv-Attribute [65] 2022 FFHQ [70], CelebA-HQ [69] Success Rate (↑ ) ✗ FID, MSE Compositional attribute editing AMT-GAN [55] 2022 MT [92], CelebA-HQ [69], LADN [43] Success Rate (↑ ): 52.8% ✗ FID, PSNR, SSIM Makeup transfer (cycle-consistent) FSAP [192] 2023 FFHQ [70], CelebA [105] SPR (↑ ) Detection MSE StyleGAN W-space perturbation CLIP2Protect [157] 2023 CelebA-HQ [69], LADN [43], LFW [56] Success Rate (↑ ) ✗ FID, PSNR, SSIM Text-guided face De-ID DiffProtect [100] 2023 CelebA-HQ [69], FFHQ [70] Success Rate (↑ ) ✗ FID Semantic code optimization Sibling-Attack [97] 2023 CelebA-HQ [69], LFW [56] Success Rate (↑ ) ✗ SSIM, MSE Multi-task transferable attack SMAP [108] 2023 CelebA-HQ [69], LFW [56], VGGFace2 [13] Success Rate (↑ ) ✗ FID, LPIPS, SSIM Spatial mutable adversarial patch GMAA [90] 2023 CelebA-HQ [69], LFW [56] Success Rate (↑ ) ✗ ✗ Generalized manifold (AU-aware) Chameleon [19] 2024 FaceScrub [124], LFW [56] Success Rate (↑ ) Pose, Expression, Age, Gender FID, LPIPS, SSIM, User Study Universal privacy protection mask ADA [54] 2024 CelebA-HQ [69], LFW [56] Success Rate (↑ ) ✗ SSIM, PSNR, FID Injection and denoising FE-DeID [46] 2024 LFW [56], CelebA [105], GFSG2 [71] Success Rate (↑ ) ✗ PSNR, SSIM, LPIPS Feature embedding via CNN WeakenDiff [147] 2025 CelebA-HQ [69], LADN [43] Success Rate (↑ ): 79.2% ✗ FID, PSNR, SSIM Counter-purification targeting DPA [219] 2025 CelebA-HQ [69], LFW [56] Success Rate (↑ ): ≤ 98.2% ✗ ✗ Diverse parameters augmentation Adv-Inversion [178] 2025 FFHQ [70], CelebA-HQ [69] Success Rate (↑ ), Rank-N-T (↓ ) ✗ FID, SSIM, PSNR GAN inversion framework Adv-CPG [179] 2025 FGID [57], FFHQ [70], CelebA-HQ [69], LFW [56] Success Rate (↑ ) ✗ FID, SSIM, PSNR Double-layer encryption Generative Model-Based Methods (Sec. 3.3.4) Generative-DeID [8] 2017 CCP [197], Human3.6M [61] Accuracy (↓ ) Garment Shape, Silhouette Naturalness Score GAN-based full-body De-ID P-GAN [189] 2019 MORPH Dataset [143] De-ID Rate (↑ ) Detection, Age SSIM Verificator+regulator paradigm Continued on next page FATM [96] 2019 LFW [56], PIPA [208], VidTIMIT [150] Accuracy Drop (↑ ) Expression SSIM Encoder-decoder architecture DeepPrivacy [60] 2019 FDF, WIDER FACE [195] Subjective Detection FID Conditional GAN with U-Net AnonymousNet [91] 2019 CelebA [105] k-anonymity Attribute PSNR, SSIM, MS-SSIM StarGAN + formal privacy Live-DeID [31] 2019 LFW [56], CelebA [105], PubFig [82], CelebA-HQ [69] Accuracy (↓ ) Attribute SSIM First video De-ID CIAGAN [109] 2020 CelebA [105], MOTS [176], LFW [56] Recall (↑ ) Detection FID Conditional GAN-Based De-ID EPD-Net [2] 2020 RaFD [87] De-ID Rate (↑ ) Emotion SSIM pix2pix-based face De-ID Thermal-F De-ID [98] 2020 Custom dataset Accuracy (↓ ) Detection ✗ Novel feature extraction FaceSwap [196] 2021 FFHQ [70] ID Similarity (↓ ) Detection, Expression FID, LPIPS Attribute disentanglement PIDIM [11] 2021 CelebA-HQ [69], FFHQ [70], CASIA [203] De-ID Rate (↑ ) Detection ✗ Password-based reversibility DeID-GAN [1] 2021 RaFD [87], XM2VTS [114], CelebA [105], FFHQ [70] DMOS (↑ ) Emotion, Attribute FMOS Three-stage pipeline with StyleGAN AutoDeID [79] 2021 LFW [56], VGGFace2 [13], CelebA-HQ [69] Re-ID Recall (↑ ) Detection, Attribute FID Combining k-anonymity with GAN SF-GAN [95] 2021 CelebA-HQ [69], FFHQ [70] SSIM (↓ ) Expression, Gender, Hairstyle, Glasses ✗ Multi-attribute preservation A3GAN [207] 2022 CelebA [105], WIDER FACE [195], ExpW [213], NTHU-D [187] Accuracy (↓ ) Detection, Expression FID Attribute editing-based De-ID IdentityMask [184] 2022 VoxCeleb [121] CSIM (↓ ) Pose, Expression, Landmark FID Reversible face video De-ID U-Net [139] 2022 YTF [188], P-DESTRE [83], BIODI, MARS [216] AUC (↓ ) Pose, Lighting, Background, Expression ✗ ROI steganography (surveillance) MVC-DeID [12] 2023 – ID Distance (↑ ) Detection PSNR, SSIM, LPIPS 3D-aware generators CPP-DeID [111] 2023 CelebA-HQ [69], RaFD [87], XM2VTS [114], AffectNet [118] AUC (↓ ), De-ID score (↑ ) Gender, Expression FID, LPIPS, SSIM, MSE Controllable privacy protection DartBlur [67] 2023 WIDER FACE [195], FDDB [63], CrowdHuman [158] Subjective Face Detection PSNR, SSIM Learnable U-Net-based blur model DeID rPPG [151] 2023 PURE [167], OBF [93] Accuracy (↓ ) rPPG signal PSNR, SSIM De-ID preserving rPPG signals IDeudemon [185] 2023 CelebA-HQ [69], FFHQ [70] L2L_2 Distance (↑ ) Pose, Expression PSNR, SSIM, FID Parametric NeRF De-ID FALCO [4] 2023 CelebA-HQ [69], LFW [56] Re-ID Rate (↓ ) Detection FID Latent code optimization Egocentric DeID [140] 2023 Ego4D [37] Similarity (↓ ), Accuracy (↓ ) ✗ FID, LPIPS, SSIM Consistent identity replacement StyleGAN-DeID [75] 2023 CelebA [105], LFW [56] Success Rate (↑ ) Detection, Gender, Pose, Expression, Age ✗ StyleGAN’s style-mixing Verifiable DeID [133] 2024 LFW [56], FFHQ [70] Selection Rate (↓ ) ✗ FID, SSIM, BRISQUE Verifiable proof framework Disguise [9] 2024 VGGFace2 [13], LFW [56], CelebA-HQ [69] TPR (↓ ) Landmark, Gaze, Emotion SER-FIQ DP-inspired pseudo-identities RBGAN [212] 2024 CelebA-HQ [69], FFHQ [70], CASIA [203], LFW [56] CSIM (↓ ): 23.0% Face Detection, Attribute SSIM, PSNR, FID Symmetric-consistency guidance DiffAM [168] 2024 CelebA-HQ [69], LADN [43] Success Rate (↑ ) ✗ FID, PSNR, SSIM Diffusion makeup adversarial FaceCaricature [85] 2024 CelebA-HQ [69] Recognition Rate (↓ ) Attribute LPIPS, SSIM, FID Face De-ID using face caricatures Veil Privacy [130] 2024 BioID [64], ORL [148], LFW [56], CelebA [105] SSIM (↓ ), User Study Classification SSIM Random pixel flipping FaceMotionPreserve [220] 2024 PD Dataset Similarity (↓ ) Medical Info ✗ GAN-based face swapping Diff-Privacy [49] 2024 CelebA-HQ [69], LFW [56] Re-ID Rate (↓ ), mAP (↓ ), Accuracy (↓ ) Pose, Expression, Age, Gender FID, KID, SSIM, LPIPS Unified diffusion framework G2Face [194] 2024 CelebA-HQ [69], LFW [56], FFHQ [70] CSIM (↓ ), TAR (↓ ) Detection, 3D Shape, Expression, Pose FID Reversible face De-ID DRGAN [103] 2025 BU-3DFE [205], BU-4DFE [211], Bosphorus [152] ACC (↓ ), EER (↑ ) Biometric, Expression, Gender, Ethnicity ✗ 2D/3D face De-ID Face-DeID-Net [206] 2025 CelebA-HQ [69], MyStyle [126] Re-ID Rate (↓ ) Attribute IQA Identity extraction and removal Synthetic DeID [132] 2025 CelebA-HQ [69], FFHQ [70] SID (↑ ), TID (↓ ) Landmark, Emotion LPIPS Training-free identity editing VCA-DeID [76] 2025 CelebAMask-HQ [88], FFHQ [70], LFW [56] IS (↓ ), VR (↓ ), EER (↓ ) Attribute, Gender, Race FID, FIQ Image-text aligned attributes Swapping De-ID [84] 2025 CelebA-HQ [69], FFHQ [70] Re-ID Rate (↓ ), Face Distance (↑ ) Pose, Gaze, Expression IQA Face swapping for De-ID 4.1 Evaluation Datasets TABLE I summarizes the principal characteristics of the most widely adopted face De-ID datasets, grouped by modality and including capture environment, scale, resolution, and annotation richness. Across the 112 surveyed methods, a clear concentration emerges: LFW [56], CelebA / CelebA-HQ [105, 69], VGGFace2 [13], and FFHQ [70] together account for the majority of evaluations. Task-specific benchmarks address narrower utility goals, e.g., RaFD [87] and AffectNet [118] for expression, Bosphorus [152] for 3D-aware methods, and PURE [167] for rPPG-preserving De-ID, while a smaller subset evaluates privacy–utility trade-offs in activity recognition (HMDB [80], DogCentric [62]). Beyond adoption statistics, these datasets exhibit structural properties that determine their suitability. (i) Web-scraped, celebrity-dominated composition: the dominant benchmarks (LFW, CelebA(-HQ), VGGFace2, MS-Celeb-1M, MegaFace) contain adult, quasi-frontal, well-lit faces with demographic skew, so results on them overstate robustness for children, older adults, and under-represented groups. (i) Identity as the only universal annotation: utility labels (expression, AUs, gaze, physiological signals) exist only in separate, smaller, often lab-controlled corpora; this asymmetry is a root cause of the fragmentation in Fig. 8, since privacy scores are comparable across papers while utility must be evaluated on disjoint datasets. Resolution and labeling further partition roles: LFW supports recognition-based privacy evaluation but not generative-quality assessment. CelebA(-HQ) and FFHQ provide the resolution and attribute labels needed by generative methods, though FFHQ lacks identity labels and thus cannot support formal privacy measurement. FERET and Multi-PIE remain the testbeds for factor-isolating k-anonymity analyses. (i) Static RGB stills as the default modality: video, 3D, and physiological resources (YTF, Ego4D; Bosphorus, BU-3DFE; PURE, OBF) are scarce and small-scale, explaining why temporal consistency and micro-level utility signals remain under-evaluated. In total, 66 distinct datasets appear across the method-level protocols catalogued in TABLE IV, of which TABLE I distills the 29 primary, recurrently adopted ones. Despite this apparent abundance, three critical gaps remain. First, evaluation fragmentation across domains (TABLE IV, Fig. 8): physical-domain methods (23 techniques) report privacy exclusively, sensor-domain methods (10 techniques) universally report both privacy and utility, and digital-domain methods are the most heterogeneous. Second, lack of multi-modal semantic annotations: as TABLE I shows, no single dataset jointly provides identity, fine-grained expression, demographics, and physiological labels, forcing researchers to evaluate utility preservation across heterogeneous datasets (e.g., expression on RaFD, attributes on CelebA), which impedes fair benchmarking. Third, paucity of child-centric resources: although datasets such as FG-NET [131] (1,002 images, 82 subjects), ITWCC [21] (1,705 images, 304 subjects), and CLF [22] exist, they lack the scale and diversity required for training and analyzing, leaving vulnerable populations underserved. 4.2 Evaluation Metrics Face De-ID evaluation balances three competing objectives: privacy protection, utility preservation, and visual quality. Fig. 8 summarizes the evaluation landscape: the left reports how often each aspect is measured per domain, and the right ranks the 69 distinct metrics extracted from existing papers by adoption. Two forms of fragmentation are evident: the set of reported aspects differs across domains, and the choice of metric within each aspect is largely method-specific. The metric families below are organized along the three axes; per-metric adoption is deferred to Fig. 8. 4.2.1 Privacy Protection Evaluation Metrics Identity Verification and Recognition Metrics. The most direct privacy assessment employs FR systems as adversaries. True Acceptance Rate (TAR) at fixed False Acceptance Rate (FAR) thresholds (commonly FAR=0.1% or 0.01%) measures genuine pair acceptance, with lower TAR indicating stronger De-ID. Equal Error Rate (EER), where FAR equals False Rejection Rate, provides a threshold-independent metric pushed toward 50% (random chance) by effective De-ID. Rank-N accuracy assesses whether the true identity appears in the top-N retrievals. Attack Success Rate (ASR), or fooling rate, quantifies adversarial effectiveness: for dodging it measures the proportion of pairs failing verification, and for impersonation the rate of successful targeted misclassification. As Fig. 8 shows, ASR is the single most widely reported metric (∼ 36%) and dominates the physical domain. Embedding Space Metrics. Latent-space measurements provide fine-grained privacy quantification beyond binary verification. Cosine Similarity (CSIM) and L2L_2 Distance between original and De-ID embeddings measure feature-space proximity, with lower similarity and larger distance indicating stronger privacy. Source/Target Identity Distance (SID/TID) extends these to targeted scenarios, with SID maximized against the original identity and TID minimized toward the target. Maximum Mean Discrepancy (MMD) quantifies distributional divergence between embedding sets, enabling dataset-level assessment valuable for evaluating transferability. Formal Privacy Guarantees. k-anonymity-based methods enforce group indistinguishability, upper-bounding recognition accuracy at 1/k1/k; De-ID rate measures the proportion of faces meeting this bound or failing verification at a given threshold. Near-perfect De-ID (TPR@FPR) reports the re-identification rate at extremely low False Positive Rates (e.g., FPR=0.02%), relevant for high-security scenarios where even rare breaches are unacceptable. Human Perceptual Metrics. Algorithmic metrics may diverge from human recognition. Human recognition rate through user studies provides ground-truth privacy assessment, and Mean Opinion Scores (MOS) capture subjective De-ID and naturalness. Such evaluations are critical for social acceptability (used by ∼ 15% of surveyed methods). Figure 8: Evaluation-protocol fragmentation across the surveyed face De-ID methods. Left: per-domain reporting rates of the three evaluation aspects. Physical-domain methods (n=23n=23) report privacy universally but utility never and quality rarely; sensor-domain methods report privacy and utility universally and quality in 30% of cases; digital-domain methods report privacy universally but utility and quality in only 65% of cases each. Right: adoption of the 69 distinct metrics used by existing papers, ranked by reporting share and colored by aspect. Only ASR (∼ 36%), SSIM (∼ 30%), and FID (∼ 25%) exceed a quarter of methods, while 60 metrics (grey) fall below 10%. 4.2.2 Utility Preservation Evaluation Metrics Utility metrics assess the retention of task-relevant, non-identity signals, and are coupled to the target application. Facial Attribute Preservation. Attribute classifiers measure retention of soft biometrics, with classification accuracy for gender, age, and race quantifying utility degradation.Landmark localization error (normalized mean error over 68 fiducial points) assesses geometric structure preservation, critical for gaze estimation and medical diagnostics. Detection metrics (mAP, recall) evaluate whether De-ID faces remain detectable, essential for surveillance utility. Expression and Affect Recognition. Emotion-preserving methods report accuracy on expression datasets (e.g., CK+ [107], AVEC [175, 174]), with strong methods retaining >85% 85\% of original performance. Action Unit (AU) detection [30] provides fine-grained assessment of facial movement preservation. Pose and Gaze Estimation. Head pose error (mean angular error in yaw/pitch/roll) and gaze estimation error quantify geometric utility, the latter critical for attention analysis and driver monitoring. Depth estimation metrics (RMSE, absolute relative error) assess 3D utility, particularly for the sensor-domain methods in TABLE IV that prioritize depth. Remote Physiological Signal Preservation. Remote photoplethysmography (rPPG) enables contactless extraction of cardiovascular signals from facial videos. Evaluation metrics include pulse-waveform SNR, heart-rate MAE, and Pearson correlation of inter-beat interval sequences, with PURE [167] and OBF [93] providing synchronized ground truth. DeID rPPG [151] showed that conventional face De-ID severely degrades rPPG quality, motivating approaches that explicitly preserve frequency-domain characteristics. 4.2.3 Visual Quality Metrics Visual quality metrics assess photorealism, naturalness, and artifact presence of the de-identified outputs. Pixel-Level Distortion Metrics. Peak Signal-to-Noise Ratio (PSNR) measures pixel-wise fidelity but correlates poorly with perceptual quality for synthesized content. Structural Similarity Index (SSIM) [181] captures structural preservation (0-1 scale), and Multi-Scale SSIM extends it across spatial scales. SSIM is the most widely reported quality metric (∼ 30%, Fig. 8), yet aligns poorly with human perception for GAN-synthesized or heavily perturbed images. Perceptual / Distribution Metrics. Fréchet Inception Distance (FID) [50] measures distributional divergence in Inception-v3 [170] feature space; Kernel Inception Distance (KID) is an unbiased alternative with better small-sample properties [49]; and LPIPS [210] correlates strongly with human judgment. FID (∼ 25%) is the third most reported metric overall; generative methods adopt FID and LPIPS almost universally, whereas adversarial methods rarely use them due to minimal pixel changes. Image Quality Assessment. No-reference metrics assess naturalness without a reference image. BRISQUE and NIQE detect artifact-indicative statistical anomalies [209, 133], with lower scores indicating higher naturalness, and Face Image Quality (FIQ) scores (e.g., SER-FIQ) evaluate recognizability for face recognition [9], providing coupled privacy-utility insight. Human Perceptual Studies. User studies provide ground-truth quality assessment where algorithmic proxies fail, via MOS for photorealism, the De-ID-specific FMOS and DMOS, and pairwise preference tests that reduce absolute-rating bias. As Fig. 8 confirms, such studies sit in the long tail of rarely adopted metrics despite their deployment importance, limited by cost and scalability. 4.3 Performance Analysis Despite the evaluation fragmentation, cross-domain analysis of TABLE IV reveals discernible performance patterns. Physical-domain methods achieve remarkably high attack success rates: 3D adversarial meshes (AT3D [199]) and projection-based approaches (ProjAttacker [104]) reach near-perfect rates (98–100%) against FR models, while eyeglass-based methods (AdvEyeglass [159], AGNs [160]) trail at 31–70% due to limited perturbation area. However, all 23 physical-domain methods report privacy metrics exclusively, reflecting their attack-centric origins. Sensor-domain methods exhibit the most balanced privacy-utility trade-offs, with all 10 techniques reporting both privacy and utility. PrivHAR [51] and PrivPDE [171] reduce FR to near-random levels (AUC approaching 0.5) while keeping depth estimation within acceptable bounds, OpticalDR [129] preserves depression-related diagnostic signals, and DyPP [16] adds robustness to PSF inversion. This balance reflects the inherent advantage of optical encoding, which attenuates identity-discriminative frequencies while preserving task-relevant information. Digital-domain methods exhibit the greatest heterogeneity across the ∼ 80 techniques catalogued. Handcrafted distortion and k-anonymity methods (k-Same [123], k-Same-Select [38]) provide formal guarantees but limited utility and quality. Adversarial perturbation methods achieve high success rates but transfer poorly to black-box systems. Generative approaches deliver the best holistic performance: GAN-based (FALCO [4], CPP-DeID [111], Disguise [9]) and diffusion-based methods (Diff-Privacy [49], Synthetic DeID [132]) retain attribute preservation above 90% while achieving effective De-ID and competitive quality, and hybrid adversarial-generative methods (DiffProtect [100], WeakenDiff [147]) point toward unified privacy-utility-quality optimization. In summary, physical-domain methods achieve the strongest privacy but neglect utility; sensor-domain methods offer principled privacy-utility optimization through differentiable optical design; and digital-domain methods provide maximum flexibility, with generative approaches delivering the best holistic performance. The field shows a clear progression from ad-hoc distortion toward learned representations that jointly optimize competing objectives, yet the absence of standardized benchmarks remains a critical barrier to definitive cross-method comparison. 5 Future Directions and Open Challenges While substantial progress has been achieved across the physical, sensor, and digital domains, critical challenges and emerging opportunities warrant focused investigation. Physical Domain: Bridging the Utility Gap. Sec. 4 shows that physical-domain methods universally report privacy metrics without evaluating utility preservation, reflecting adversarial origins where recognition evasion supersedes downstream task enablement. Yet real-world deployment (e.g., healthcare monitoring, emotion-aware interaction) demands physical De-ID that preserves task-relevant attributes. Closing this gap requires two innovations: (1) multi-objective optimization that jointly maximizes privacy and minimizes utility degradation across tasks (expression recognition, gaze estimation, age perception) under manufacturability constraints (printability, material reflectance, durability) absent in digital methods; and (2) attribute-disentangled adversarial patterns that suppress identity-discriminative features while sparing utility-related regions. Social acceptability is a further concern: bandages and medical masks offer plausible cover, whereas adversarial eyeglasses and stickers may attract unwanted attention, undermining covert protection. Sensor Domain: Advancing Programmable Optics. Sensor-based face De-ID offers strong theoretical guarantees by preventing identity capture before digitization, yet current implementations rely on static or learned-but-fixed optics (Fig. 5), lacking adaptive systems that adjust privacy-utility trade-offs to scene context or task. Three directions warrant priority: (1) context-aware programmable optics that pair scene understanding (medical consultation versus public space) with real-time optical reconfiguration; (2) multi-modal sensor fusion combining privacy-encoded RGB with unencoded depth or infrared to preserve geometric utility (pose, tracking) while suppressing identity-rich texture; and (3) co-design of optical encoders and downstream networks through differentiable imaging pipelines. Programmable optics, however, incur latency, power, and cost penalties that limit deployment, so standardized protocols must assess privacy-utility trade-offs alongside computational efficiency, hardware complexity, and long-term robustness. Digital Domain: Verifiable and Reversible Face De-ID. Two coupled challenges define the next phase of digital-domain face De-ID: verifiability, the ability to prove that a de-identified output meets a stated privacy criterion without revealing the original I, and reversibility (criterion (4) of Sec. 2.3), required by forensic, medical, and legal workflows but difficult to combine with strong irreversible guarantees. Existing reversible methods rely predominantly on password- or key-conditioned generative inversion [184, 194], which is vulnerable to brute-force, key-leakage, and auxiliary-information attacks because the recovery mapping is learned rather than cryptographically protected. A promising direction is to integrate cryptographic primitives, particularly homomorphic encryption and secure multi-party computation, with generative models, so that the recovery oracle ℛ(⋅;k)R(·\,;k) is realized through provably secure protocols rather than learned mappings alone. Verifiability can be addressed in parallel through zero-knowledge proofs or audit logs that attest, without disclosing I, that ~ I was produced by a sanctioned ℱF meeting a privacy threshold. Addressing Micro-Level Utility Signals. Face De-ID research predominantly targets macro-level attributes (age, gender, expression), yet emerging healthcare, affective computing, and behavioral analysis applications demand preservation of micro-level signals far more sensitive to identity suppression. Three categories stand out. (1) Physiological signals [151] (rPPG, heart rate, respiration) require signal-aware methods with frequency-domain constraints or correlation losses validated across skin tones, lighting, and De-ID paradigms. (2) Micro-expressions (fleeting movements revealing genuine emotion) require temporal robustness through optical-flow consistency and micro-expression-aware losses, supporting deception detection, mental health assessment, and human-robot interaction. (3) Neurological diagnostic features (stroke asymmetries, Parkinsonian tremor, autism-related expression abnormalities) require interdisciplinary collaboration to extend the OpticalDR paradigm [129], validate clinical accuracy, and earn medical community acceptance. Underlying all three is the fine-grained coupling between identity and utility, which calls for information-theoretic bounds on achievable privacy-utility trade-offs and principled, application-driven navigation of those bounds. Unified Evaluation Protocols and Benchmarks. The evaluation fragmentation identified in Sec. 4 represents a primary bottleneck. Addressing these issues requires community-wide coordination: (1) curated multi-task datasets with comprehensive annotations (identity, age, gender, expression, landmarks); (2) standardized metrics spanning privacy (TAR@FAR, embedding distance), utility (attribute classification, landmark localization, expression recognition), and quality (FID, LPIPS, BRISQUE, NIQE); (3) reference implementations across all three domains with reproducible scripts; and (4) continuously updated leaderboards tracking SOTA performance. Beyond technical infrastructure, benchmark design must address fairness by stratifying performance across race, gender, and age, while adversarial robustness evaluation (JPEG compression, resizing, denoising) remains critical but underexplored. Cross-Domain Co-Design for Privacy-First Sensing. The convergence of optical and algorithmic privacy mechanisms invites a rethinking of the sensing-to-analytics pipeline, with next-generation systems integrating the physical-sensor-digital stack to enforce privacy at the earliest stages of acquisition. Programmable sensors can implement De-ID in analog or early digital domains through neuromorphic architectures or event-based cameras that inherently suppress identity-rich spatial detail while retaining motion and scene dynamics. Differentiable imaging pipelines complement this by jointly optimizing optical elements (metasurfaces, diffractive optics), image signal processing, and downstream task networks under unified privacy-utility objectives. Realizing this vision requires differentiable models of the full image-formation process and optimization strategies that account for physical realizability, manufacturing tolerances, and deployment conditions, marking a shift from post-capture De-ID toward architectures where protection is intrinsic to the imaging system. Emerging Application Domains. Beyond traditional surveillance, access control, and social media, face De-ID must address emerging domains where conventional approaches fall short. Three stand out. (1) Autonomous vehicles and smart cities deploy ubiquitous sensing and require perception systems that balance public safety against individual privacy. (2) Medical and telehealth applications need domain-specific methods that preserve clinically relevant cues (expressions for neurological assessment, dermatological conditions for diagnosis) while preventing re-identification. (3) Metaverse and extended reality introduce new attack surfaces, where avatars, behavioral patterns, and physiological signals (eye tracking, gestures, locomotion) enable identity inference beyond facial biometrics. Meeting these challenges demands collaboration across computer vision, cryptography, hardware design, and policy. Joint De-ID Across Face, Body, and Behavioral Channels. Face De-ID alone is insufficient when other identity-bearing channels remain intact: body shape, gait, voice, eye gaze, and hand motions are each independently sufficient for re-identification, and recent surveys document active research on each [74, 47]. Face De-ID nonetheless retains substantial standalone value. The face is the most discriminative and most widely operationalized biometric cue [214], targeted by commercial recognition systems, watchlists, and web-scale search [86], so its suppression removes the adversary with the greatest practical reach. In the data-release scenarios that most often motivate De-ID (photographs, medical and telehealth recordings [201], social-media imagery [99]), the face is often the only channel captured at recognition-grade quality; gait requires temporal sequences [156] and body-appearance matching degrades under clothing and viewpoint variation [208]. Regulatory instruments such as the EU AI Act [29] and GDPR [28] further attach specific obligations to facial data. Face De-ID thus mitigates the dominant re-identification risk, while joint multi-channel anonymization remains necessary against adversaries with high-quality dynamic footage. Three open problems emerge at the intersection of face and these complementary channels: (1) joint anonymization frameworks that suppress identity across face, body, and motion simultaneously without re-introducing leakage in any single channel; (2) temporal-consistency guarantees for dynamic traits (e.g., gait, micro-expressions), where frame-wise face De-ID may still leak identity through motion signatures; and (3) cross-modal evaluation protocols that quantify residual leakage when one channel is anonymized but others are not. Addressing these problems requires bridging the face De-ID literature reviewed in this survey with the soft biometric anonymization literature, an essential direction for future research. 6 Conclusion This survey presents the first unified treatment of face de-identification (De-ID) spanning the full acquisition pipeline, from the physical world through the sensor interface to the digital domain. Our domain-centric analysis exposes a clear trade-off: digital methods offer mature generative fidelity but expose raw identity signals; physical methods push the trust boundary outward yet remain limited by robustness and social acceptability; and sensor-domain methods embed privacy at capture, the closest realization of a privacy-by-design paradigm. Our review of evaluation protocols further reveals substantial fragmentation across datasets, thresholds, and metrics. Progress will require standardized benchmarks jointly measuring privacy, utility, and quality, together with cross-domain co-design that advances physical materials, programmable optics, and verifiable generative models in tandem. Meeting the emerging challenges of foundation-model-scale recognition and multimodal surveillance will be central to building vision systems that are trustworthy and socially responsible. Acknowledgement This work was supported by the Research Council of Finland (former Academy of Finland) Academy Professor project EmotionAI (grants 336116, 359894), the University of Oulu & Research Council of Finland Profi 7 (grant 352788), EU HORIZON-MSCA-SE-2022 project ACMod (grant 101130271), and the Finnish Doctoral Program Network in Artificial Intelligence, AI-DOC (decision number VN/3137/2024-OKM-6). As well, the authors wish to acknowledge CSC – IT Center for Science, Finland, for computational resources. References [1] A. Agarwal, P. Chattopadhyay, and L. Wang (2021) Privacy preservation through facial de-identification with simultaneous emotion preservation. SIVP 15 (5), p. 951–958. Cited by: §3.3.4, §4. [2] A. Aggarwal, R. Rathore, P. Chattopadhyay, and L. Wang (2020) EPD-net: a gan-based architecture for face de-identification from images. In IOTEM, p. 1–7. Cited by: §3.3.4, §4. [3] T. Amada, S. P. Liew, K. Kakizaki, and T. Araki (2021) Universal adversarial spoofing attacks against face recognition. In IJCB, p. 1–7. Cited by: §3.3.3, TABLE IV. [4] S. Barattin, C. Tzelepis, I. Patras, and N. Sebe (2023) Attribute-preserving face dataset anonymization via latent code optimization. In CVPR, p. 8001–8010. Cited by: §3.3.4, §3.3.5, §4, §4.3. [5] D. Basin, C. Cremers, J. Dreier, and R. Sasse (2022) Tamarin: verification of large-scale, real-world, cryptographic protocols. IEEE Security & Privacy 20 (3), p. 24–32. Cited by: §2.1. [6] S. Bhilare and A. Hati (2024) Fooling face recognition systems through physical adversarial attack. In ICCVIP, p. 420–435. Cited by: §3.1.1, §3.1.4, TABLE IV. [7] M. Boyle, C. Edwards, and S. Greenberg (2000) The effects of filtered video on awareness and privacy. In ACM CSCW, p. 1–10. Cited by: §3.3.1, TABLE IV. [8] K. Brkic, I. Sikiric, T. Hrkac, and Z. Kalafatic (2017) I know that person: generative full body and face de-identification of people in images. In CVPRW, p. 1319–1328. Cited by: §3.3.4, TABLE IV. [9] Z. Cai, Z. Gao, B. Planche, M. Zheng, T. Chen, M. S. Asif, and Z. Wu (2024) Disguise without disruption: utility-preserving face de-identification. In AAAI, Vol. 38, p. 918–926. Cited by: §1, §3.3.4, §4, §4.2.3, §4.3. [10] J. Cao, X. Chen, B. Liu, M. Ding, R. Xie, L. Song, Z. Li, and W. Zhang (2024) Face de-identification: state-of-the-art methods and comparative studies. arXiv preprint arXiv:2411.09863. Cited by: TABLE I, TABLE I. [11] J. Cao, B. Liu, Y. Wen, R. Xie, and L. Song (2021) Personalized and invertible face de-identification by disentangled identity information manipulation. In ICCV, p. 3334–3342. Cited by: §3.3.4, §3.3.5, §4. [12] J. Cao, B. Liu, Y. Wen, R. Xie, and L. Song (2023) Achieving privacy-preserving multi-view consistency with advanced 3d-aware face de-identification. In ACM M Asia, p. 1–7. Cited by: §3.3.4, §3.3.5, §4. [13] Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman (2018) VGGFace2: a dataset for recognising faces across pose and age. In FG, p. 67–74. Cited by: TABLE I, §4, §4, §4.1, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [14] K. Chang, K. Bowyer, and P. Flynn (2003) Face recognition using 2d and 3d facial data. In ACM MUAW, p. 25–32. Cited by: TABLE IV. [15] E. Chatzikyriakidis, C. Papaioannidis, and I. Pitas (2019) Adversarial face de-identification. In ICIP, p. 684–688. Cited by: §3.3.3, §3.3.3, TABLE IV. [16] J. Cheng, X. Dai, J. Wan, N. Antipa, and N. Vasconcelos (2024) Learning a dynamic privacy-preserving camera robust to inversion attacks. In ECCV, p. 349–367. Cited by: Figure 5, Figure 5, §3.2.1, §4.3, TABLE IV. [17] K. H. Cheng, Z. Yu, H. Chen, and G. Zhao (2022) Benchmarking 3d face de-identification with preserving facial attributes. In ICIP, p. 656–660. Cited by: TABLE I, TABLE I. [18] H. Chi and Y. H. Hu (2015) Face de-identification using facial identity preserving features. In GCSIP, p. 586–590. Cited by: §3.3.2, TABLE IV. [19] K. Chow, S. Hu, T. Huang, and L. Liu (2024) Personalized privacy protection mask against unauthorized facial recognition. In ECCV, p. 434–450. Cited by: §3.3.3, TABLE IV. [20] J. L. Crowley, J. Coutaz, et al. (2000) Things that see. Communications of the ACM, p. 1–10. Cited by: §3.3.1, TABLE IV. [21] D. Deb, D. Aggarwal, and A. K. Jain (2020) Child face age-progression via deep feature aging. arXiv preprint arXiv:2003.08788. Cited by: §4.1. [22] D. Deb, N. Nain, and A. K. Jain (2018) Longitudinal study of child face recognition. In ICB, p. 225–232. Cited by: §4.1. [23] D. Deb, J. Zhang, and A. K. Jain (2020) AdvFaces: adversarial face synthesis. In IJCB, p. 1–10. Cited by: §3.3.3, TABLE IV. [24] J. Deng, J. Guo, E. Ververas, I. Kotsia, and S. Zafeiriou (2020) RetinaFace: single-shot multi-level face localisation in the wild. In CVPR, p. 5203–5212. Cited by: §2.2. [25] J. Deng, J. Guo, N. Xue, and S. Zafeiriou (2019) ArcFace: additive angular margin loss for deep face recognition. In CVPR, p. 4690–4699. Cited by: §2.2. [26] Y. Dong, H. Su, B. Wu, Z. Li, W. Liu, T. Zhang, and J. Zhu (2019) Efficient decision-based black-box adversarial attacks on face recognition. In CVPR, p. 7714–7722. Cited by: §3.3.3, §3.3.3, TABLE IV. [27] L. Du, M. Yi, E. Blasch, and H. Ling (2014) GARP-face: balancing privacy protection and utility preservation in face de-identification. In IJCB, p. 1–8. Cited by: §3.3.2, TABLE IV. [28] European Parliament and the Council of the European Union (2016-05-04) General data protection regulation. Vol. L 119. Note: Official Journal of the European UnionOJ L 119, 4.5.2016 External Links: Link Cited by: §5. [29] European Union (2024) Regulation (eu) 2024/1689 of the european parliament and of the council of 13 june 2024 laying down harmonised rules on artificial intelligence. Official Journal of the European Union L (2024/1689). Note: Entered into force: 2 August 2024 External Links: Link Cited by: §1, §5. [30] W. V. Friesen and P. Ekman (1978) Facial action coding system: a technique for the measurement of facial movement. Palo Alto 3 (2), p. 5. Cited by: §4.2.2. [31] O. Gafni, L. Wolf, and Y. Taigman (2019) Live face de-identification in video. In ICCV, p. 9378–9387. Cited by: §3.3.4, §4. [32] W. Gao, B. Cao, S. Shan, X. Chen, D. Zhou, X. Zhang, and D. Zhao (2007) The cas-peal large-scale chinese face database and baseline evaluations. TSMC 38 (1), p. 149–161. Cited by: TABLE IV. [33] H. Gong, M. Dong, S. Ma, S. Camtepe, S. Nepal, and C. Xu (2023) Stealthy physical masked face recognition attack via adversarial style optimization. TMM 26, p. 5014–5025. Cited by: §3.1.1, §3.1.4, TABLE IV. [34] I. J. Goodfellow, J. Shlens, and C. Szegedy (2015) Explaining and harnessing adversarial examples. In ICLR, Y. Bengio and Y. LeCun (Eds.), p. 1–11. Cited by: §3.1.1. [35] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio (2014) Generative adversarial nets. In NIPS, p. 1–9. Cited by: §2.4, §3.1.4. [36] S. Goswami, S. K. Paul, S. Jawlia, and A. Goel (2025) Faces in the fog: a deep dive into face de-identification techniques and their comparative analysis. In DICCT, p. 603–608. Cited by: TABLE I. [37] K. Grauman, A. Westbury, E. Byrne, Z. Chavis, A. Furnari, R. Girdhar, J. Hamburger, H. Jiang, M. Liu, X. Liu, et al. (2022) Ego4d: around the world in 3,000 hours of egocentric video. In CVPR, p. 18995–19012. Cited by: TABLE I, §4. [38] R. Gross, E. Airoldi, B. Malin, and L. Sweeney (2005) Integrating utility into face de-identification. In PETW, p. 227–242. Cited by: §3.3.2, §4.3, TABLE IV. [39] R. Gross, I. Matthews, J. Cohn, T. Kanade, and S. Baker (2008) Multi-pie. In FG, p. 1–8. Cited by: TABLE I, TABLE IV, TABLE IV, TABLE IV. [40] R. Gross, L. Sweeney, F. De la Torre, and S. Baker (2006) Model-based face de-identification. In CVPRW, p. 161–161. Cited by: §3.3.2, TABLE IV. [41] R. Gross, L. Sweeney, F. De La Torre, and S. Baker (2008) Semi-supervised learning of multi-factor models for face de-identification. In CVPR, p. 1–8. Cited by: §3.3.2, TABLE IV. [42] R. Gross and L. Sweeney (2007) Towards real-world face de-identification. In ICB, p. 1–8. Cited by: §3.3.2, TABLE IV. [43] Q. Gu, G. Wang, M. T. Chiu, Y. Tai, and C. Tang (2019) LADN: local adversarial disentangling network for facial makeup and de-makeup. In ICCV, p. 10481–10490. Cited by: TABLE I, §4, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [44] Y. Guo, L. Zhang, Y. Hu, X. He, and J. Gao (2016) MS-celeb-1m: a dataset and benchmark for large-scale face recognition. In ECCV, p. 87–102. Cited by: TABLE I, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [45] Y. Guo, H. Wang, L. Wang, Y. Lei, L. Liu, and M. Bennamoun (2023) 3D face recognition: two decades of progress and prospects. CSUR 56 (3), p. 1–39. Cited by: §1. [46] G. Hanawa, K. Ito, and T. Aoki (2024) Face image de-identification based on feature embedding. EURASIP Journal on Image and Video Processing 2024 (1), p. 25. Cited by: §3.3.3, TABLE IV. [47] S. Hanisch, P. Arias-Cabarcos, J. Parra-Arnau, and T. Strufe (2025) Anonymization techniques for behavioral biometric data: a survey. CSUR 57 (11), p. 1–54. Cited by: §2.1, §5. [48] M. R. Hasan, R. Guest, and F. Deravi (2023) Presentation-level privacy protection techniques for automated face recognition—a survey. CSUR 55 (13s), p. 1–27. Cited by: TABLE I, TABLE I. [49] X. He, M. Zhu, D. Chen, N. Wang, and X. Gao (2024) Diff-privacy: diffusion-based face privacy protection. IEEE TCSVT 34 (12), p. 13164–13176. Cited by: §3.3.4, §3.3.5, §4, §4.2.3, §4.3. [50] M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter (2017) GANs trained by a two time-scale update rule converge to a local nash equilibrium. In NIPS, p. 815–823. Cited by: §4.2.3. [51] C. Hinojosa, M. Marquez, H. Arguello, E. Adeli, L. Fei-Fei, and J. C. Niebles (2022) PrivHAR: recognizing human actions from privacy-preserving lens. In ECCV, p. 314–332. Cited by: Figure 5, Figure 5, §3.2.1, §4.3, TABLE IV. [52] C. Hinojosa, J. C. Niebles, and H. Arguello (2021) Learning privacy-preserving optics for human pose estimation. In ICCV, p. 2573–2582. Cited by: Figure 5, Figure 5, §3.2.1, TABLE IV. [53] J. Ho, A. Jain, and P. Abbeel (2020) Denoising diffusion probabilistic models. In NIPS, p. 6840–6851. Cited by: §2.4. [54] C. Hu, Y. Li, Z. Feng, and X. Wu (2024) Toward transferable attack via adversarial diffusion in face recognition. TIFS 19, p. 5506–5519. Cited by: §3.3.3, TABLE IV. [55] S. Hu, X. Liu, Y. Zhang, M. Li, L. Y. Zhang, H. Jin, and L. Wu (2022) Protecting facial privacy: generating adversarial identity masks via style-robust makeup transfer. In CVPR, p. 15014–15023. Cited by: §3.3.3, TABLE IV. [56] G. B. Huang, M. Mattar, T. Berg, and E. Learned-Miller (2008) Labeled faces in the wild: a database for studying face recognition in unconstrained environments. In Workshop on Faces in’Real-Life’Images, p. 1–11. Cited by: TABLE I, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4.1, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [57] J. Huang, X. Dong, W. Song, Z. Chong, Z. Tang, J. Zhou, Y. Cheng, L. Chen, H. Li, Y. Yan, et al. (2024) ConsistentID: portrait generation with multimodal fine-grained identity preserving. arXiv preprint arXiv:2404.16771. Cited by: TABLE IV. [58] W. Huang, M. Ye, Z. Shi, G. Wan, H. Li, B. Du, and Q. Yang (2024) Federated learning for generalization, robustness, fairness: a survey and benchmark. IEEE TPAMI 46 (12), p. 9387–9406. Cited by: §2.1. [59] S. E. Hudson and I. Smith (1996) Techniques for addressing fundamental privacy and disruption tradeoffs in awareness support systems. In ACM CSCW, p. 248–257. Cited by: §1, §2, §2, §3.3.1, TABLE IV. [60] H. Hukkelås, R. Mester, and F. Lindseth (2019) DeepPrivacy: a generative adversarial network for face anonymization. In International Symposium on Visual Computing, p. 565–578. Cited by: §4. [61] C. Ionescu, D. Papava, V. Olaru, and C. Sminchisescu (2013) Human3.6m: large scale datasets and predictive methods for 3d human sensing in natural environments. IEEE TPAMI 36 (7), p. 1325–1339. Cited by: TABLE IV. [62] Y. Iwashita, A. Takamine, R. Kurazume, and M. S. Ryoo (2014) First-person animal activity recognition from egocentric videos. In ICPR, p. 4310–4315. Cited by: §4.1, TABLE IV, TABLE IV. [63] V. Jain and E. Learned-Miller (2010) FDDB: a benchmark for face detection in unconstrained settings. Technical report UMass Amherst Technical Report. Cited by: §4. [64] O. Jesorsky, K. J. Kirchberg, and R. W. Frischholz (2001) Robust face detection using the hausdorff distance. In ICAVBPA, p. 90–95. Cited by: §4, TABLE IV. [65] S. Jia, B. Yin, T. Yao, S. Ding, C. Shen, X. Yang, and C. Ma (2022) Adv-attribute: inconspicuous and transferable adversarial attack on face recognition. In NIPS, p. 34136–34147. Cited by: §1, §3.3.3, §3.3.3, TABLE IV. [66] X. Jia, J. Du, H. Wei, R. Xue, Z. Wang, H. Zhu, and J. Chen (2025) Balancing privacy and performance: a many-in-one approach for image anonymization. In AAAI, Vol. 39, p. 17608–17616. Cited by: §2.1. [67] B. Jiang, B. Bai, H. Lin, Y. Wang, Y. Guo, and L. Fang (2023) Dartblur: privacy preservation with detection artifact suppression. In CVPR, p. 16479–16488. Cited by: §4. [68] A. Jourabloo, X. Yin, and X. Liu (2015) Attribute preserved face de-identification. In ICB, p. 278–285. Cited by: §3.3.2, §3.3.2, TABLE IV. [69] T. Karras, T. Aila, S. Laine, and J. Lehtinen (2018) Progressive growing of gans for improved quality, stability, and variation. In ICLR, p. 1–12. Cited by: §3.1.1, TABLE I, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4.1, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [70] T. Karras, S. Laine, and T. Aila (2019) A style-based generator architecture for generative adversarial networks. In CVPR, p. 4401–4410. Cited by: §3.1.1, TABLE I, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4, §4.1, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [71] T. Karras, S. Laine, M. Aittala, J. Hellsten, J. Lehtinen, and T. Aila (2020) Analyzing and improving the image quality of stylegan. In CVPR, p. 8110–8119. Cited by: §3.1.1, TABLE IV. [72] A. Kasinski, A. Florek, and A. Schmidt (2008) The put face database. IPC 13 (3-4), p. 59–64. Cited by: TABLE IV. [73] I. Kemelmacher-Shlizerman, S. M. Seitz, D. Miller, and E. Brossard (2016) The megaface benchmark: 1 million faces for recognition at scale. In CVPR, p. 4873–4882. Cited by: TABLE I, TABLE IV, TABLE IV. [74] W. Khan, L. Topham, U. Khayam, S. Ortega-Martorell, P. Heather, D. Ansell, D. Al-Jumeily, and A. Hussain (2024) Person de-identification: a comprehensive review of methods, datasets, applications, and ethical aspects along with new dimensions. IEEE TBBIS, p. 293–312. Cited by: TABLE I, §5. [75] S. M. S. M. Khorzooghi and S. Nilizadeh (2023) Examining stylegan as a utility-preserving face de-identification method. In PET, p. 341–358. Cited by: §3.3.4, §4. [76] H. Kim, J. Shim, S. Park, and E. Hwang (2025) Visual context-aware attribute-preserving face de-identification. Neurocomputing 638, p. 130205. Cited by: §4. [77] M. Kim, A. K. Jain, and X. Liu (2022) AdaFace: quality adaptive margin for face recognition. In CVPR, p. 18750–18759. Cited by: §2.2. [78] S. Komkov and A. Petiushko (2021) AdvHat: real-world adversarial attack on arcface face id system. In ICPR, p. 819–826. Cited by: §3.1.1, TABLE I, TABLE IV. [79] Z. Kuang, H. Liu, J. Yu, A. Tian, L. Wang, J. Fan, and N. Babaguchi (2021) Effective de-identification generative adversarial network for face anonymization. In ACM M, p. 3182–3191. Cited by: §3.3.4, §3.3.5, §4. [80] H. Kuehne, H. Jhuang, E. Garrote, T. Poggio, and T. Serre (2011) HMDB: a large video database for human motion recognition. In ICCV, p. 2556–2563. Cited by: §4.1, TABLE IV, TABLE IV, TABLE IV. [81] N. Kumar, P. Belhumeur, and S. Nayar (2008) FaceTracer: a search engine for large collections of images with faces. In ECCV, p. 340–353. Cited by: TABLE IV. [82] N. Kumar, A. C. Berg, P. N. Belhumeur, and S. K. Nayar (2009) Attribute and simile classifiers for face verification. In ICCV, p. 365–372. Cited by: TABLE I, §4, TABLE IV, TABLE IV, TABLE IV. [83] S. A. Kumar, E. Yaghoubi, A. Das, B. Harish, and H. Proença (2020) The p-destre: a fully annotated dataset for pedestrian detection, tracking, and short/long-term re-identification from aerial devices. TIFS 16, p. 1696–1708. Cited by: §4. [84] H. Kung, T. Varanka, S. Saha, T. Sim, and N. Sebe (2025) Face anonymization made simple. In WACV, p. 1040–1050. Cited by: §1, §2.5, §3.3.4, §3.3.5, §4. [85] L. Laishram, J. T. Lee, and S. K. Jung (2024) Face de-identification using face caricature. IEEE Access 12, p. 19344–19354. Cited by: §4. [86] L. Laishram, M. Shaheryar, J. T. Lee, and S. K. Jung (2025) Toward a privacy-preserving face recognition system: a survey of leakages and solutions. CSUR 57 (6), p. 1–38. Cited by: TABLE I, §1, §5. [87] O. Langner, R. Dotsch, G. Bijlstra, D. H. Wigboldus, S. T. Hawk, and A. Van Knippenberg (2010) Presentation and validation of the radboud faces database. Cognition and Emotion 24 (8), p. 1377–1388. Cited by: TABLE I, §4, §4, §4, §4.1, TABLE IV. [88] C. Lee, Z. Liu, L. Wu, and P. Luo (2020) MaskGAN: towards diverse and interactive facial image manipulation. In CVPR, p. 5549–5558. Cited by: §4. [89] G. Letournel, A. Bugeau, V. Ta, and J. Domenger (2015) Face de-identification with expressions preservation. In ICIP, p. 4366–4370. Cited by: 7(a), 7(a), §3.3.1, TABLE IV. [90] Q. Li, Y. Hu, Y. Liu, D. Zhang, X. Jin, and Y. Chen (2023) Discrete point-wise attack is not enough: generalized manifold adversarial attack for face recognition. In CVPR, p. 20575–20584. Cited by: §3.3.3, TABLE IV. [91] T. Li and L. Lin (2019) AnonymousNet: natural face de-identification with measurable privacy. In CVPRW, p. 0–10. Cited by: §3.3.4, §3.3.5, §4. [92] T. Li, R. Qian, C. Dong, S. Liu, Q. Yan, W. Zhu, and L. Lin (2018) BeautyGAN: instance-level facial makeup transfer with deep generative adversarial network. In ACM M, p. 645–653. Cited by: TABLE IV. [93] X. Li, I. Alikhani, J. Shi, T. Seppanen, J. Junttila, K. Majamaa-Voltti, M. Tulppo, and G. Zhao (2018) The obf database: a large face video database for remote physiological signal measurement and atrial fibrillation detection. In FG, p. 242–249. Cited by: TABLE I, §4, §4.2.2. [94] Y. Li, Y. Li, X. Dai, S. Guo, and B. Xiao (2023) Physical-world optical adversarial attacks on 3d face recognition. In CVPR, p. 24699–24708. Cited by: §3.1.3, §3.1.4, TABLE I, TABLE IV. [95] Y. Li, Q. Lu, Q. Tao, X. Zhao, and Y. Yu (2021) SF-gan: face de-identification method without losing facial attribute information. IEEE SPL 28, p. 1345–1349. Cited by: §3.3.4, §4. [96] Y. Li and S. Lyu (2019) De-identification without losing faces. In IHMSW, p. 83–88. Cited by: §3.3.4, §4. [97] Z. Li, B. Yin, T. Yao, J. Guo, S. Ding, S. Chen, and C. Liu (2023) Sibling-attack: rethinking transferable adversarial attacks against face recognition. In CVPR, p. 24626–24637. Cited by: §3.3.3, §3.3.3, TABLE IV. [98] C. Lin, Z. Wang, and G. Jong (2020) A de-identification face recognition using extracted thermal features based on deep learning. IEEE Sensors Journal 20 (16), p. 9510–9517. Cited by: §3.3.4, §4. [99] C. Liu, T. Zhu, J. Zhang, and W. Zhou (2022) Privacy intelligence: a survey on image privacy in online social networks. CSUR 55 (8), p. 1–35. Cited by: TABLE I, TABLE I, §5. [100] J. Liu, C. P. Lau, and R. Chellappa (2023) DiffProtect: generate adversarial examples with diffusion models for facial privacy protection. arXiv preprint arXiv:2305.13625, p. 1–14. Cited by: §3.3.3, §4.3, TABLE IV. [101] W. Liu, Y. Wen, Z. Yu, M. Li, B. Raj, and L. Song (2017) SphereFace: deep hypersphere embedding for face recognition. In CVPR, p. 212–220. Cited by: §2.2. [102] X. Liu, F. Shen, J. Zhao, and C. Nie (2024) EAP: an effective black-box impersonation adversarial patch attack method on face recognition in the physical world. Neurocomputing 580, p. 127517. Cited by: §3.1.1, TABLE IV. [103] Y. Liu, K. H. Cheng, M. Savic, H. Chen, Z. Yu, and G. Zhao (2025) 3D face de-identification with preserving multi-facial attributes: a benchmark. IEEE TBIOM, p. 1–14. Cited by: §3.3.4, §4. [104] Y. Liu, H. Wei, C. Jia, R. Xiao, W. Ruan, X. Wei, J. T. Zhou, and Z. Wang (2025) ProjAttacker: a configurable physical adversarial attack for face recognition via projector. In CVPR, p. 21248–21257. Cited by: §1, §2.5, §3.1.2, §3.1.4, TABLE I, §4.3, TABLE IV. [105] Z. Liu, P. Luo, X. Wang, and X. Tang (2015) Deep learning face attributes in the wild. In ICCV, p. 3730–3738. Cited by: TABLE I, §4, §4, §4, §4, §4, §4, §4, §4.1, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [106] J. Lopez, C. Hinojosa, H. Arguello, and B. Ghanem (2024) Privacy-preserving optics for enhancing protection in face de-identification. In CVPR, p. 12120–12129. Cited by: §1, §2.5, Figure 5, Figure 5, §3.2.1, TABLE IV. [107] P. Lucey, J. F. Cohn, T. Kanade, J. Saragih, Z. Ambadar, and I. Matthews (2010) The extended cohn-kanade dataset (ck+): a complete dataset for action unit and emotion-specified expression. In CVPRW, p. 94–101. Cited by: TABLE I, §4.2.2, TABLE IV, TABLE IV. [108] H. Ma, K. Xu, X. Jiang, Z. Zhao, and T. Sun (2023) Transferable black-box attack against face recognition with spatial mutable adversarial patch. TIFS 18, p. 5636–5650. Cited by: §3.3.3, TABLE IV. [109] M. Maximov, I. Elezi, and L. Leal-Taixé (2020) CIAGAN: conditional identity anonymization generative adversarial networks. In CVPR, p. 5447–5456. Cited by: §2.2, §4. [110] B. Meden, Ž. Emeršič, V. Štruc, and P. Peer (2018) K-same-net: k-anonymity with generative deep neural networks for face deidentification. Entropy 20 (1), p. 60. Cited by: §3.3.2, TABLE IV. [111] B. Meden, M. Gonzalez-Hernandez, P. Peer, and V. Štruc (2023) Face deidentification with controllable privacy protection. IVC 134, p. 104678. Cited by: §3.3.4, §3.3.5, §4, §4.3. [112] B. Meden, P. Rot, P. Terhörst, N. Damer, A. Kuijper, W. J. Scheirer, A. Ross, P. Peer, and V. Štruc (2021) Privacy–enhancing face biometrics: a comprehensive survey. TIFS 16, p. 4147–4183. Cited by: TABLE I. [113] L. Meng and Z. Sun (2014) Face de-identification with perfect privacy protection. In ICICTEM, p. 1234–1239. Cited by: §3.3.2, TABLE IV. [114] K. Messer, J. Matas, J. Kittler, J. Luettin, G. Maitre, et al. (1999) XM2VTSDB: the extended m2vts database. In ICAVBPA, Vol. 964, p. 965–966. Cited by: §4, §4, TABLE IV. [115] Y. Mi, Z. Zhong, Y. Huang, J. Ji, J. Xu, J. Wang, S. Wang, S. Ding, and S. Zhou (2024) Privacy-preserving face recognition using trainable feature subtraction. In CVPR, p. 297–307. Cited by: §1. [116] S. Milborrow, J. Morkel, and F. Nicolls (2010) The muct landmarked face database. PRASA 201 (0), p. 535. Cited by: TABLE IV. [117] R. Min, N. Kose, and J. Dugelay (2014) KinectFaceDB: a kinect database for face recognition. TSMCS 44 (11), p. 1534–1548. Cited by: TABLE I, TABLE IV. [118] A. Mollahosseini, B. Hasani, and M. H. Mahoor (2017) AffectNet: a database for facial expression, valence, and arousal computing in the wild. IEEE TAC 10 (1), p. 18–31. Cited by: TABLE I, §4, §4.1. [119] S. Mosaddegh, L. Simon, and F. Jurie (2014) Photorealistic face de-identification by aggregating donors’ face components. In ACCV, p. 159–174. Cited by: TABLE IV. [120] S. Moschoglou, A. Papaioannou, C. Sagonas, J. Deng, I. Kotsia, and S. Zafeiriou (2017) AgeDB: the first manually collected, in-the-wild age database. In CVPRW, p. 51–59. Cited by: TABLE I, TABLE IV, TABLE IV, TABLE IV. [121] A. Nagraniy, J. S. Chungy, and A. Zisserman (2017) VoxCeleb: a large-scale speaker identification dataset. In ISCA, Vol. 2017, p. 2616–2620. Cited by: TABLE I, §4. [122] C. Neustaedter, S. Greenberg, and M. Boyle (2006) Blur filtration fails to preserve privacy for home-based video conferencing. ACM TOCHI 13 (1), p. 1–36. Cited by: §3.3.1, TABLE IV. [123] E. M. Newton, L. Sweeney, and B. Malin (2005) Preserving privacy by de-identifying face images. IEEE TKDE 17 (2), p. 232–243. Cited by: §1, §2, §3.3.2, §4.3, TABLE IV. [124] H. Ng and S. Winkler (2014) A data-driven approach to cleaning large face datasets. In ICIP, p. 343–347. Cited by: TABLE IV, TABLE IV. [125] D. Nguyen, S. S. Arora, Y. Wu, and H. Yang (2020) Adversarial light projection attacks on face recognition systems: a feasibility study. In CVPRW, p. 814–815. Cited by: §3.1.2, §3.1.4, TABLE I, TABLE IV. [126] Y. Nitzan, K. Aberman, Q. He, O. Liba, M. Yarom, Y. Gandelsman, I. Mosseri, Y. Pritch, and D. Cohen-Or (2022) MyStyle: a personalized generative prior. TOG 41 (6), p. 1–10. Cited by: §4. [127] T. Orekondy, B. Schiele, and M. Fritz (2017) Towards a visual privacy advisor: understanding and predicting privacy risks in images. In ICCV, p. 3686–3695. Cited by: TABLE IV. [128] J. R. Padilla-López, A. A. Chaaraoui, and F. Flórez-Revuelta (2015) Visual privacy protection methods: a survey. Expert Systems with Applications 42 (9), p. 4177–4195. Cited by: TABLE I. [129] Y. Pan, J. Jiang, K. Jiang, Z. Wu, K. Yu, and X. Liu (2024) OpticalDR: a deep optical imaging model for privacy-protective depression recognition. In CVPR, p. 1303–1312. Cited by: §2.2, Figure 5, Figure 5, §3.2.1, §4.3, TABLE IV, §5. [130] S. Pang, R. Ma, B. Li, Y. Zhou, and Y. Yao (2024) Veil privacy on visual data: concealing privacy for humans, unveiling for dnns. In ECCV, p. 280–297. Cited by: §3.3.3, §3.3.4, §4. [131] G. Panis and A. Lanitis (2014) An overview of research activities in facial age estimation using the fg-net aging database. In ECCV, p. 737–750. Cited by: §4.1. [132] J. Park, S. Lee, M. Shaheryar, and S. K. Jung (2025) Facial identity editing: towards effective de-identification. In ICIP, p. 1792–1797. Cited by: §3.3.4, §3.3.5, §4, §4.3. [133] S. Park, H. Na, and D. Choi (2024) Verifiable facial de-identification in video surveillance. IEEE Access 12, p. 67758–67771. Cited by: §4, §4.2.3. [134] S. Park, H. Kim, S. Choi, T. Kim, and E. Park (2025) Privacy-driven faces: a survey on generative facial de-identification. In WSIDC, p. 27–32. Cited by: TABLE I. [135] M. Pautov, G. Melnikov, E. Kaziakhmedov, K. Kireev, and A. Petiushko (2019) On adversarial patches: real-world attack on arcface-100 face recognition system. In SIBIRCON, p. 0391–0396. Cited by: §3.1.1, TABLE IV. [136] P. J. Phillips, H. Wechsler, J. Huang, and P. J. Rauss (1998) The feret database and evaluation procedure for face-recognition algorithms. IVC 16 (5), p. 295–306. Cited by: TABLE I, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [137] F. Pittaluga and S. J. Koppal (2015) Privacy preserving optics for miniature vision sensors. In CVPR, p. 314–324. Cited by: §1, §2, Figure 5, Figure 5, §3.2.1, TABLE IV. [138] F. Pittaluga and S. J. Koppal (2016) Pre-capture privacy for small vision sensors. IEEE TPAMI 39 (11), p. 2215–2226. Cited by: Figure 5, Figure 5, §3.2.1, TABLE IV. [139] H. Proença (2022) The u-net: reversible face de-identification for visual surveillance video footage. IEEE TCSVT 32 (2), p. 496–509. Cited by: §3.3.4, §4. [140] B. Puangthamawathanakun, C. Arpnikanondt, W. Krathu, G. Healy, and C. Gurrin (2023) Towards face de-identification for wearable cameras. In ICCMI, p. 210–216. Cited by: §3.3.4, §4. [141] S. Ribaric, A. Ariyaeeinia, and N. Pavesic (2016) De-identification for privacy protection in multimedia content: a survey. Signal Processing: Image Communication 47, p. 131–151. Cited by: TABLE I. [142] S. Ribaric and N. Pavesic (2015) An overview of face de-identification in still images and videos. In FG, Vol. 4, p. 1–6. Cited by: TABLE I. [143] K. Ricanek and T. Tesafaye (2006) Morph: a longitudinal image database of normal adult age-progression. In FG, p. 341–345. Cited by: TABLE I, TABLE IV, TABLE IV. [144] M. Ryoo, K. Kim, and H. Yang (2018) Extreme low resolution activity recognition with multi-siamese embedding learning. In AAAI, Vol. 32. Cited by: Figure 5, Figure 5, §3.2.2, TABLE IV. [145] M. Ryoo, B. Rothrock, C. Fleming, and H. J. Yang (2017) Privacy-preserving human activity recognition from extreme low resolution. In AAAI, Vol. 31, p. 1–8. Cited by: §2.5, Figure 5, Figure 5, §3.2.2, TABLE IV. [146] M. S. Ryoo and L. Matthies (2013) First-person activity recognition: what are they doing to me?. In CVPR, p. 2730–2737. Cited by: TABLE IV. [147] A. Salar, Q. Liu, Y. Tian, and G. Zhao (2025) Enhancing facial privacy protection via weakening diffusion purification. In CVPR, p. 8235–8244. Cited by: §1, §3.3.3, §4.3, TABLE IV. [148] F. S. Samaria and A. C. Harter (1994) Parameterisation of a stochastic model for human face identification. In IEEE Workshop on Applications of Computer Vision, p. 138–142. Cited by: §4. [149] B. Samarzija and S. Ribaric (2014) An approach to the de-identification of faces in different poses. In ICICTEM, p. 1246–1251. Cited by: TABLE IV. [150] C. Sanderson and B. C. Lovell (2009) Multi-region probabilistic histograms for robust and scalable identity inference. In ICB, p. 199–208. Cited by: TABLE I, §4. [151] M. Savic and G. Zhao (2023) De-identification of facial videos while preserving remote physiological utility. In BMVC, p. 1–14. Cited by: §3.3.4, §4, §4.2.2, §5. [152] A. Savran, N. Alyüz, H. Dibeklioğlu, O. Çeliktutan, B. Gökberk, B. Sankur, and L. Akarun (2008) Bosphorus database for 3d face analysis. In BIMW, p. 47–56. Cited by: TABLE I, §4, §4.1, TABLE IV. [153] F. Schroff, D. Kalenichenko, and J. Philbin (2015) FaceNet: a unified embedding for face recognition and clustering. In CVPR, p. 815–823. Cited by: §2.2. [154] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra (2017) Grad-cam: visual explanations from deep networks via gradient-based localization. In ICCV, p. 618–626. Cited by: §3.1.1. [155] S. Sengupta, J. Chen, C. Castillo, V. M. Patel, R. Chellappa, and D. W. Jacobs (2016) Frontal to profile face verification in the wild. In WACV, p. 1–9. Cited by: TABLE I, TABLE IV, TABLE IV. [156] A. Sepas-Moghaddam and A. Etemad (2022) Deep gait recognition: a survey. IEEE TPAMI 45 (1), p. 264–284. Cited by: §5. [157] F. Shamshad, M. Naseer, and K. Nandakumar (2023) CLIP2Protect: protecting facial privacy using text-guided makeup via adversarial latent search. In CVPR, p. 20595–20605. Cited by: §3.3.3, TABLE IV. [158] S. Shao, Z. Zhao, B. Li, T. Xiao, G. Yu, X. Zhang, and J. Sun (2018) CrowdHuman: a benchmark for detecting human in a crowd. arXiv preprint arXiv:1805.00123, p. 1–9. Cited by: §4. [159] M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter (2016) Accessorize to a crime: real and stealthy attacks on state-of-the-art face recognition. In ACM SIGSAC, p. 1528–1540. Cited by: §1, §2, §3.1.1, TABLE I, §4.3, TABLE IV. [160] M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter (2019) A general framework for adversarial examples with objectives. ACM TPS 22 (3), p. 1–30. Cited by: §3.1.1, §4.3, TABLE IV. [161] M. Shen, Z. Liao, L. Zhu, K. Xu, and X. Du (2019) VLA: a practical visible light-based attack on face recognition systems in physical world. ACM IMWUT 3 (3), p. 1–19. Cited by: §3.3.3, TABLE IV. [162] M. Shen, H. Yu, L. Zhu, K. Xu, Q. Li, and J. Hu (2021) Effective and robust physical-world attacks on deep learning face recognition systems. TIFS 16, p. 4063–4077. Cited by: §3.1.1, TABLE IV, TABLE IV. [163] N. Silberman, D. Hoiem, P. Kohli, and R. Fergus (2012) Indoor segmentation and support inference from rgbd images. In ECCV, p. 746–760. Cited by: TABLE IV. [164] K. Simonyan and A. Zisserman (2015) Very deep convolutional networks for large-scale image recognition. In ICLR, Cited by: §3.1.1. [165] I. Singh, T. Araki, and K. Kakizaki (2022) Powerful physical adversarial examples against practical face recognition systems. In WACV, p. 301–310. Cited by: §3.1.1, §3.1.4, TABLE IV. [166] M. B. Stegmann, B. K. Ersboll, and R. Larsen (2003) FAME-a flexible appearance modeling environment. IEEE TMI 22 (10), p. 1319–1331. Cited by: TABLE IV, TABLE IV, TABLE IV. [167] R. Stricker, S. Müller, and H. Gross (2014) Non-contact video-based pulse rate measurement on a mobile service robot. In IEEE RHIC, p. 1056–1062. Cited by: TABLE I, §4, §4.1, §4.2.2. [168] Y. Sun, L. Yu, H. Xie, J. Li, and Y. Zhang (2024) DiffAM: diffusion-based adversarial makeup transfer for facial privacy protection. In CVPR, p. 24584–24594. Cited by: §3.3.4, §4. [169] L. Sweeney (2002) K-anonymity: a model for protecting privacy. IJUFKS 10 (05), p. 557–570. Cited by: §3.2.1, §3.3.2. [170] C. Szegedy, V. Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna (2016) Rethinking the inception architecture for computer vision. In CVPR, p. 2818–2826. Cited by: §4.2.3. [171] Z. Tasneem, G. Milione, Y. Tsai, X. Yu, A. Veeraraghavan, M. Chandraker, and F. Pittaluga (2022) Learning phase mask for privacy-preserving passive depth estimation. In ECCV, p. 504–521. Cited by: Figure 5, Figure 5, §3.2.1, §4.3, TABLE IV. [172] A. Tuan Tran, T. Hassner, I. Masi, and G. Medioni (2017) Regressing robust and discriminative 3d morphable models with a very deep neural network. In CVPR, p. 5163–5172. Cited by: §3.1.1, §3.1.2, §3.1.4. [173] M. Turk and A. Pentland (1991) Eigenfaces for recognition. Journal of Cognitive Neuroscience 3 (1), p. 71–86. Cited by: §2. [174] M. Valstar, B. Schuller, K. Smith, T. Almaev, F. Eyben, J. Krajewski, R. Cowie, and M. Pantic (2014) AVEC 2014: 3d dimensional affect and depression recognition challenge. In ACM IWAVEC, p. 3–10. Cited by: TABLE I, §4.2.2, TABLE IV. [175] M. Valstar, B. Schuller, K. Smith, F. Eyben, B. Jiang, S. Bilakhia, S. Schnieder, R. Cowie, and M. Pantic (2013) Avec 2013: the continuous audio/visual emotion and depression recognition challenge. In ACM IWAVEC, p. 3–10. Cited by: TABLE I, §4.2.2, TABLE IV. [176] P. Voigtlaender, M. Krause, A. Osep, J. Luiten, B. B. G. Sekar, A. Geiger, and B. Leibe (2019) MOTS: multi-object tracking and segmentation. In CVPR, p. 7942–7951. Cited by: §4. [177] F. Wang, L. Chen, C. Li, S. Huang, Y. Chen, C. Qian, and C. C. Loy (2018) The devil of face recognition is in the noise. In ECCV, p. 765–780. Cited by: TABLE IV. [178] H. Wang, W. Luo, X. Xie, P. Zheng, W. Huang, and J. Huang (2025) Adv-inversion: stealthy adversarial attacks via gan-inversion for facial privacy protection. TIFS, p. 1–15. Cited by: §3.3.3, §3.3.3, TABLE IV. [179] J. Wang, H. Zhang, and Y. Yuan (2025) Adv-cpg: a customized portrait generation framework with facial adversarial attacks. In CVPR, p. 21001–21010. Cited by: §3.3.3, TABLE IV. [180] Y. Wang, Z. Liu, B. Luo, R. Hui, and F. Li (2024) The invisible polyjuice potion: an effective physical adversarial attack against face recognition. In ACM SIGSAC, p. 3346–3360. Cited by: §3.1.2, §3.1.4, TABLE IV. [181] Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli (2004) Image quality assessment: from error visibility to structural similarity. IEEE TIP 13 (4), p. 600–612. Cited by: §4.2.3. [182] X. Wei, Y. Guo, J. Yu, and B. Zhang (2023) Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks. IEEE TPAMI 45 (7), p. 9041–9054. Cited by: §3.1.1, TABLE IV. [183] X. Wei, Y. Guo, and J. Yu (2022) Adversarial sticker: a stealthy attack method in the physical world. IEEE TPAMI 45 (3), p. 2711–2725. Cited by: §3.1.1, TABLE I, TABLE IV. [184] Y. Wen, B. Liu, J. Cao, R. Xie, L. Song, and Z. Li (2022) IdentityMask: deep motion flow guided reversible face video de-identification. IEEE TCSVT 32 (12), p. 8353–8367. Cited by: §3.3.4, §3.3.5, §4, §5. [185] Y. Wen, B. Liu, J. Cao, R. Xie, and L. Song (2023) Divide and conquer: a two-step method for high quality face de-identification with model explainability. In ICCV, p. 5148–5157. Cited by: §3.3.4, §3.3.5, §4. [186] Y. Wen, B. Liu, L. Song, J. Cao, and R. Xie (2024) Face de-identification: safeguarding identities in the digital era. Springer. Cited by: TABLE I, §2.1. [187] C. Weng, Y. Lai, and S. Lai (2016) Driver drowsiness detection via a hierarchical temporal deep belief network. In ACCV, p. 117–133. Cited by: §4. [188] L. Wolf, T. Hassner, and I. Maoz (2011) Face recognition in unconstrained videos with matched background similarity. In CVPR, p. 529–534. Cited by: TABLE I, §4, TABLE IV. [189] Y. Wu, F. Yang, Y. Xu, and H. Ling (2019) Privacy-protective-gan for privacy preserving face de-identification. JCST 34 (1), p. 47–60. Cited by: §3.3.4, TABLE IV. [190] Z. Wu, H. Wang, Z. Wang, H. Jin, and Z. Wang (2020) Privacy-preserving deep action recognition: an adversarial learning framework and a new dataset. IEEE TPAMI 44 (4), p. 2126–2139. Cited by: TABLE IV. [191] Z. Xiao, X. Gao, C. Fu, Y. Dong, W. Gao, X. Zhang, J. Zhou, and J. Zhu (2021) Improving transferability of adversarial patches on face recognition with generative models. In CVPR, p. 11845–11854. Cited by: §3.1.1, §3.1.4, TABLE IV. [192] H. Xue, B. Liu, X. Yuan, M. Ding, and T. Zhu (2023) Face image de-identification by feature space adversarial perturbation. CCPE 35 (5), p. e7554. Cited by: §3.3.3, §3.3.3, TABLE IV. [193] B. Yan, M. Pei, and Z. Nie (2019) Attributes preserving face de-identification. In ICCVW, p. 1217–1221. Cited by: §3.3.2, §3.3.2, TABLE IV. [194] H. Yang, X. Xu, C. Xu, H. Zhang, J. Qin, Y. Wang, P. Heng, and S. He (2024) G²face: high-fidelity reversible face anonymization via generative and geometric priors. TIFS 19, p. 8773–8785. Cited by: §2, §3.3.4, §3.3.5, §4, §5. [195] S. Yang, P. Luo, C. Loy, and X. Tang (2016) WIDER face: a face detection benchmark. In CVPR, p. 5525–5533. Cited by: §4, §4, §4. [196] S. Yang, W. Wang, Y. Cheng, and J. Dong (2021) A systematical solution for face de-identification. In CCBR, p. 20–30. Cited by: §3.3.4, §4. [197] W. Yang, P. Luo, and L. Lin (2014) Clothing co-parsing by joint image segmentation and labeling. In CVPR, p. 3182–3189. Cited by: TABLE IV. [198] X. Yang, Y. Dong, T. Pang, H. Su, J. Zhu, Y. Chen, and H. Xue (2021) Towards face encryption by generating adversarial identity masks. In ICCV, p. 3897–3907. Cited by: §3.3.3, §3.3.3, TABLE IV. [199] X. Yang, C. Liu, L. Xu, Y. Wang, Y. Dong, N. Chen, H. Su, and J. Zhu (2023) Towards effective adversarial textured 3d meshes on physical face recognition. In CVPR, p. 4119–4128. Cited by: §2.2, §2.5, §2, §3.1.1, §3.1.4, TABLE I, §4.3, TABLE IV. [200] X. Yang, L. Xu, T. Pang, Y. Dong, Y. Wang, H. Su, and J. Zhu (2025) Face3DAdv: exploiting robust adversarial 3d patches on physical face recognition. IJCV 133 (1), p. 353–371. Cited by: §3.1.1, §3.1.4, TABLE IV. [201] Y. Yang, J. Lyu, R. Wang, Q. Wen, L. Zhao, W. Chen, S. Bi, J. Meng, K. Mao, Y. Xiao, et al. (2022) A digital mask to safeguard patient privacy. Nature Medicine 28 (9), p. 1883–1892. Cited by: §1, §5. [202] Y. Ye, Z. Song, J. Guo, and Y. Qiao (2020) SIAT-3dfe: a high-resolution 3d facial expression dataset. IEEE Access 8, p. 48205–48211. Cited by: TABLE I, TABLE IV. [203] D. Yi, Z. Lei, S. Liao, and S. Z. Li (2014) Learning face representation from scratch. arXiv preprint arXiv:1411.7923, p. 1–9. Cited by: TABLE I, §4, §4, TABLE IV, TABLE IV, TABLE IV, TABLE IV, TABLE IV. [204] B. Yin, W. Wang, T. Yao, J. Guo, Z. Kong, S. Ding, J. Li, and C. Liu (2021) Adv-makeup: a new imperceptible and transferable attack on face recognition. In IJCAI, p. 1–7. Cited by: §1, §3.1.1, §3.1.4, TABLE I, TABLE IV. [205] L. Yin, X. Wei, Y. Sun, J. Wang, and M. J. Rosato (2006) A 3d facial expression database for facial behavior research. In FG, p. 211–216. Cited by: TABLE I, §4. [206] Y. Zeng, M. Zhang, and H. Xin (2025) Face-deid-net: generative face de-identification with identity removal and attribute preservation for latent diffusion model training. In ICSIP, p. 489–495. Cited by: §4. [207] L. Zhai, Q. Guo, X. Xie, L. Ma, Y. E. Wang, and Y. Liu (2022) A3gan: attribute-aware anonymization networks for face de-identification. In ACM M, p. 5303–5313. Cited by: §1, §3.3.4, §4. [208] N. Zhang, M. Paluri, Y. Taigman, R. Fergus, and L. Bourdev (2015) Beyond frontal faces: improving person recognition using multiple cues. In CVPR, p. 4804–4813. Cited by: §4, §5. [209] Q. Zhang, Q. Guo, R. Gao, F. Juefei-Xu, H. Yu, and W. Feng (2024) Adversarial relighting against face recognition. TIFS 19, p. 9145–9157. Cited by: §3.1.3, §4.2.3, TABLE IV. [210] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang (2018) The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, p. 586–595. Cited by: §4.2.3. [211] X. Zhang, L. Yin, J. F. Cohn, S. Canavan, M. Reale, A. Horowitz, and P. Liu (2013) A high-resolution spontaneous 3d dynamic facial expression database. In FG Workshop, p. 1–6. Cited by: §4. [212] Y. Zhang, Y. Fang, Y. Cao, and J. Wu (2024) RBGAN: realistic-generation and balanced-utility gan for face de-identification. IVC 141, p. 104868. Cited by: §4. [213] Z. Zhang, P. Luo, C. C. Loy, and X. Tang (2018) From facial expression recognition to interpersonal relation prediction. IJCV 126 (5), p. 550–569. Cited by: §4. [214] W. Zhao, R. Chellappa, P. J. Phillips, and A. Rosenfeld (2003) Face recognition: a literature survey. CSUR 35 (4), p. 399–458. Cited by: §1, §5. [215] Y. Zhao and J. Chen (2022) A survey on differential privacy for unstructured data content. CSUR 54 (10s), p. 1–28. Cited by: §2.1. [216] L. Zheng, Z. Bie, Y. Sun, J. Wang, C. Su, S. Wang, and Q. Tian (2016) MARS: a video benchmark for large-scale person re-identification. In ECCV, p. 868–884. Cited by: §4. [217] X. Zheng, Y. Fan, B. Wu, Y. Zhang, J. Wang, and S. Pan (2023) Robust physical-world attacks on face recognition. PR 133, p. 109009. Cited by: §3.1.1, TABLE IV. [218] Y. Zhong and W. Deng (2020) Towards transferable adversarial attack against deep face recognition. TIFS 16, p. 1452–1466. Cited by: §3.3.3, §3.3.3, TABLE IV. [219] F. Zhou, B. Yin, H. Ling, Q. Zhou, and W. Wang (2025) Improving the transferability of adversarial attacks on face recognition with diverse parameters augmentation. In CVPR, p. 3516–3527. Cited by: §3.3.3, TABLE IV. [220] B. Zhu, C. Zhang, Y. Sui, and L. Li (2024) FaceMotionPreserve: a generative approach for facial de-identification and medical information preservation. Scientific Reports 14 (1), p. 17275. Cited by: §3.3.4, §4. [221] Z. Zhu, Y. Lu, and C. Chiang (2019) Generating adversarial examples by makeup attacks on face recognition. In ICIP, p. 2516–2520. Cited by: §3.3.3, TABLE IV. [222] A. Zolfi, S. Avidan, Y. Elovici, and A. Shabtai (2022) Adversarial mask: real-world universal adversarial attack on face recognition models. In MLKDD, p. 304–320. Cited by: §3.1.1, §3.1.4, TABLE I, TABLE IV. Hui Wei received the PhD degree in computer science from Wuhan University, China. He is currently a postdoctoral researcher with the Center for Machine Vision and Signal Analysis, University of Oulu, Finland. He has authored or coauthored papers in mainstream conferences and journals, including CVPR, NeurIPS, AAAI, ACM Multimedia, and the IEEE TPAMI. His research interests include trustworthy AI, privacy protection, and machine learning. Hao Yu is currently a PhD student at the Center for Machine Vision and Signal Analysis, University of Oulu, Finland. His research interests focus on visual representation learning, facial attribute analysis, and visual generative models. Guoying Zhao (IEEE Fellow 2022) received the Ph.D. degree in computer science from the Chinese Academy of Sciences, Beijing, China, in 2005. She is currently an Academy Professor and full Professor (tenured in 2017) with University of Oulu, and a PI with ELLIS Institute Finland. She is a member of Academia Europaea, a member of Finnish Academy of Sciences and Letters, Fellow of IEEE, IAPR, ELLIS and AAIA. Her current research interests include image and video representation, facial-expression and micro-expression recognition, emotional gesture analysis, affective computing, and biometrics.