Safe Fakes: Evaluating Face Anonymizers for Face Detectors

TL;DR

This study empirically evaluates how different face anonymization techniques, especially GAN-based methods like DeepPrivacy, impact the training performance of face detectors, highlighting that GANs cause less performance loss than traditional methods.

Contribution

It is the first comprehensive empirical analysis comparing conventional and GAN-based face anonymizers on face detection performance, revealing GANs' potential for privacy-preserving face anonymization.

Findings

GAN-based anonymizers cause less performance degradation than traditional methods.

DeepPrivacy maintains high face detector accuracy with only a modest decrease in mAP.

GAN evaluation metrics do not strongly correlate with face detector performance.

Abstract

Since the introduction of the GDPR and CCPA legislation, both public and private facial image datasets are increasingly scrutinized. Several datasets have been taken offline completely and some have been anonymized. However, it is unclear how anonymization impacts face detection performance. To our knowledge, this paper presents the first empirical study on the effect of image anonymization on supervised training of face detectors. We compare conventional face anonymizers with three state-of-the-art Generative Adversarial Network-based (GAN) methods, by training an off-the-shelf face detector on anonymized data. Our experiments investigate the suitability of anonymization methods for maintaining face detector performance, the effect of detectors overtraining on anonymization artefacts, dataset size for training an anonymizer, and the effect of training time of anonymization GANs. A final experiment investigates the correlation between common GAN evaluation metrics and the performance of a trained face detector. Although all tested anonymization methods lower the performance of trained face detectors, faces anonymized using GANs cause far smaller performance degradation than conventional methods. As the most important finding, the best-performing GAN, DeepPrivacy, removes identifiable faces for a face detector trained on anonymized data, resulting in a modest decrease from 91.0 to 88.3 mAP. In the last few years, there have been rapid improvements in realism of GAN-generated faces. We expect that further progression in GAN research will allow the use of Deep Fake technology for privacy-preserving Safe Fakes, without any performance degradation for training face detectors.