NullFace: Training-Free Localized Face Anonymization

Abstract

Privacy concerns around ever increasing number of cameras are increasing in today's digital age. Although existing anonymization methods are able to obscure identity information, they often struggle to preserve the utility of the images. In this work, we introduce a training-free method for face anonymization that preserves key non-identity-related attributes. Our approach utilizes a pre-trained text-to-image diffusion model without requiring optimization or training. It begins by inverting the input image to recover its initial noise. The noise is then denoised through an identity-conditioned diffusion process, where modified identity embeddings ensure the anonymized face is distinct from the original identity. Our approach also supports localized anonymization, giving users control over which facial regions are anonymized or kept intact. Comprehensive evaluations against state-of-the-art methods show our approach excels in anonymization, attribute preservation, and image quality. Its flexibility, robustness, and practicality make it well-suited for real-world applications. Code and data can be found at github.com/hanweikung/nullface.

Method

Our anonymization framework integrates diffusion model inversion, a dual-path denoising structure, and modified face embeddings. Given a facial image, we perform DDPM inversion to retrieve the initial noise map x_T and a sequence of noise maps {z_t}. Face embeddings extracted via a face recognition model are negated with a hyperparameter λ_id, creating negative identity guides that steer generation away from the original identity during denoising.

The denoising combines conditional and unconditional paths: the conditional path uses negated identity embeddings to obscure identifying features, while the unconditional path preserves non-identifying attributes. Outputs are merged via classifier-free guidance. For localized control, segmentation maps selectively anonymize specific facial regions while preserving others.

Experiments

Controlling Image Alignment via T_skip

Increasing T_skip makes the generated face align more closely with the original image structure and pose.

T_skip=0 T_skip=29 T_skip=59 T_skip=89 Original

Identity Change with Anonymization Parameter λ_id

Increasing λ_id controls how far the anonymized identity drifts from the source.

Original λ_id=0.0 λ_id=0.33 λ_id=0.67 λ_id=1.0

Effect of Guidance Scale λ_cfg

Higher guidance scale values yield anonymized identities that are more distinct from the originals. However, excessive guidance reduces photorealism.

Original λ_cfg=5 λ_cfg=10 λ_cfg=15 λ_cfg=20

Localized Anonymization via Segmentation Masks

Segmentation masks make it possible to anonymize the full face or keep specific regions visible, such as the eyes, nose, or mouth.

Original Change whole face Keep eyes Keep nose Keep mouth

Comparison with Baselines

Quantitative Results

Quantitative results on CelebA-HQ (CHQ) and FFHQ (FHQ). Best results are bold, second-best are underlined.

Privacy–Utility Trade-off

Privacy–Utility Trade-off Evaluation. The green gradient highlights the optimal zone (lower-left) where both privacy (low Re-ID) and utility (low metric values) are achieved. Our method offers the best balance across all metrics.

Qualitative Results — CelebA-HQ

Original Ours FAMS FALCO LDFA DP2

Qualitative Results — FFHQ

Original Ours FAMS RiDDLE LDFA DP2

Localized Anonymization Applications

Localized anonymization enables practitioners to share case studies while maintaining patient confidentiality. The example below shows facial identity being anonymized while preserving dermatological symptoms (acne on the cheeks).

Original

Mask (keep cheek)

Anonymized

BibTeX