# PrivacyNet: Semi-Adversarial Networks for Multi-attribute Face Privacy

arXiv: https://arxiv.org/abs/2001.00561 · HTML: https://mlsanity.com/paper/2001.00561/

## Key facts

- Cited by 30 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Jan 2020.

## Built on by (most cited first, 30 of 30)

- [A Comprehensive Study on Face Recognition Biases Beyond Demographics](https://mlsanity.com/paper/2103.01592/) (2021)
- [SepMark: Deep Separable Watermarking for Unified Source Tracing and Deepfake Detection](https://mlsanity.com/paper/2305.06321/) (2023)
- [IdentityDP: Differential Private Identification Protection for Face Images](https://mlsanity.com/paper/2103.01745/) (2021)
- [High Resolution Face Editing with Masked GAN Latent Code Optimization](https://mlsanity.com/paper/2103.11135/) (2021)
- [An Overview of Privacy-enhancing Technologies in Biometric Recognition](https://mlsanity.com/paper/2206.10465/) (2022)
- [Generative Adversarial Networks: A Survey Towards Private and Secure Applications](https://mlsanity.com/paper/2106.03785/) (2021)
- [Face De-identification: State-of-the-art Methods and Comparative Studies](https://mlsanity.com/paper/2411.09863/) (2024)
- [On Generating Identifiable Virtual Faces](https://mlsanity.com/paper/2110.07986/) (2021)
- [FaceMAE: Privacy-Preserving Face Recognition via Masked Autoencoders](https://mlsanity.com/paper/2205.11090/) (2022)
- [Decouple-and-Sample: Protecting sensitive information in task agnostic data release](https://mlsanity.com/paper/2203.13204/) (2022)
- [Enhancing Privacy in Face Analytics Using Fully Homomorphic Encryption](https://mlsanity.com/paper/2404.16255/) (2024)
- [Video-DPRP: A Differentially Private Approach for Visual Privacy-Preserving Video Human Activity Recognition](https://mlsanity.com/paper/2503.02132/) (2025)
- [GMFIM: A Generative Mask-guided Facial Image Manipulation Model for Privacy Preservation](https://mlsanity.com/paper/2201.03353/) (2022)
- [On Mask-based Image Set Desensitization with Recognition Support](https://mlsanity.com/paper/2312.08975/) (2023)
- [Can GAN-induced Attribute Manipulations Impact Face Recognition?](https://mlsanity.com/paper/2209.02941/) (2022)
- [DAMP: Doubly Aligned Multilingual Parser for Task-Oriented Dialogue](https://mlsanity.com/paper/2212.08054/) (2022)
- [Reversing Deep Face Embeddings with Probable Privacy Protection](https://mlsanity.com/paper/2310.03005/) (2023)
- [Chaos in Motion: Unveiling Robustness in Remote Heart Rate Measurement through Brain-Inspired Skin Tracking](https://mlsanity.com/paper/2404.07687/) (2024)
- [SVIA: A Street View Image Anonymization Framework for Self-Driving Applications](https://mlsanity.com/paper/2501.09393/) (2025)
- [Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attacks](https://mlsanity.com/paper/2606.11615/) (2026)
- [Intelligent Frame Selection as a Privacy-Friendlier Alternative to Face Recognition](https://mlsanity.com/paper/2101.07529/) (2021)
- [Selective manipulation of disentangled representations for privacy-aware facial image processing](https://mlsanity.com/paper/2208.12632/) (2022)
- [PrivacyProber: Assessment and Detection of Soft-Biometric Privacy-Enhancing Techniques](https://mlsanity.com/paper/2211.08864/) (2022)
- [PRO-Face S: Privacy-preserving Reversible Obfuscation of Face Images via Secure Flow](https://mlsanity.com/paper/2307.09146/) (2023)
- [Adversarial Machine Learning-Enabled Anonymization of OpenWiFi Data](https://mlsanity.com/paper/2401.01542/) (2024)
- [Face anonymization preserving facial expressions and photometric realism](https://mlsanity.com/paper/2603.17567/) (2026)
- [Protecting and Preserving Protest Dynamics for Responsible Analysis](https://mlsanity.com/paper/2604.05256/) (2026)
- [Assessing Privacy Preservation and Utility in Online Vision-Language Models](https://mlsanity.com/paper/2604.09695/) (2026)
- [Privacy-Aware Video Anomaly Detection through Orthogonal Subspace Projection](https://mlsanity.com/paper/2605.08651/) (2026)
- [DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models](https://mlsanity.com/paper/2607.28936/) (2026)

## Abstract (arXiv)

Recent research has established the possibility of deducing soft-biometric attributes such as age, gender and race from an individual's face image with high accuracy. However, this raises privacy concerns, especially when face images collected for biometric recognition purposes are used for attribute analysis without the person's consent. To address this problem, we develop a technique for imparting soft biometric privacy to face images via an image perturbation methodology. The image perturbation is undertaken using a GAN-based Semi-Adversarial Network (SAN) - referred to as PrivacyNet - that modifies an input face image such that it can be used by a face matcher for matching purposes but cannot be reliably used by an attribute classifier. Further, PrivacyNet allows a person to choose specific attributes that have to be obfuscated in the input face images (e.g., age and race), while allowing for other types of attributes to be extracted (e.g., gender). Extensive experiments using multiple face matchers, multiple age/gender/race classifiers, and multiple face datasets demonstrate the generalizability of the proposed multi-attribute privacy enhancing method across multiple face and attribute classifiers.