Blurring Faces Barely Slows AI Person Tracking

In an era where privacy concerns are paramount, a recent study offers a surprising insight: blurring faces in surveillance footage does little to hinder AI systems that track individuals across cameras. This finding could help balance the need for public safety with strict privacy regulations like the GDPR, allowing richer datasets to be shared without compromising personal identities.

The key discovery is that face anonymization—such as blurring or pixelating faces—causes only a minor drop in the performance of person re-identification (re-ID) systems. These AI models are designed to recognize and track the same person in different video feeds, commonly used in places like airports, university campuses, and city streets. Researchers tested this by applying various anonymization techniques to five popular datasets, including Market1501 and DukeMTMC-reID, and found that accuracy metrics like mean Average Precision (mAP) and rank-1 identification saw decreases of less than 1.5 percentage points on average. For instance, in the Market1501 dataset, the drop in mAP was just 1.39 points after anonymization, and it could be nearly recovered by retraining the models on anonymized data.

To conduct the experiments, the team used a face detection method called TinyFaces to locate faces in images, then applied anonymization techniques like Gaussian blurring, pixelation, or replacing face regions with blank or zeroed-out pixels. They evaluated six state-of-the-art re-ID models, such as PCB and BoT, which rely on deep learning to match people based on features like clothing and body shape rather than facial details. The methodology ensured that the anonymization was consistent across different scales and datasets, with the TinyFaces detector achieving high recall rates—around 90% to 98%—in identifying faces, though it struggled in low-resolution scenarios like the VIPeR dataset.

The results, detailed in tables throughout the paper, show that performance declines were statistically significant but small in practical terms. For example, on the DukeMTMC-reID dataset, mAP fell from an average of 66.3 to 64.4 after anonymization, but retraining on anonymized data brought it back to 65.4. Similarly, rank-1 accuracy dropped by about 1.24 points but recovered to within 0.44 points of the original. The study also compared different anonymization methods and found that blurring and pixelation performed slightly better than others, while zeroing out faces—replacing them with black pixels—offered extra security with only a 0.25% further drop in accuracy.

This research matters because it addresses a critical tension in modern surveillance: how to use AI for safety without violating privacy. With laws like the GDPR requiring that personal data not be processed in ways that identify individuals, anonymization could enable the release of datasets for research and city planning while avoiding fines and ethical breaches. For instance, airports could share video data to improve crowd management without fear of exposing travelers' identities. The findings suggest that current re-ID systems are robust enough to handle anonymized data, potentially encouraging more organizations to adopt privacy-preserving practices.

However, the study notes limitations, such as the face detector's reduced effectiveness in low-resolution images or side-profile views, as seen in the VIPeR dataset. Additionally, while the paper discusses resistance to attacks like deblurring, it points out that stronger anonymization methods, including those based on generative adversarial networks (GANs), were not fully explored and could be a focus for future work. This leaves open questions about how well these techniques hold up against advanced reconstruction attempts, emphasizing the need for ongoing innovation in privacy protection.