# Perceptual Indistinguishability-Net (PI-Net): Facial Image Obfuscation with Manipulable Semantics

arXiv: https://arxiv.org/abs/2104.01753 · HTML: https://mlsanity.com/paper/2104.01753/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- Builds on 32 of its 53 references that are in the map.
- First posted on arXiv 5 Apr 2021.

## Builds on (most cited first, 30 of 32)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Perceptual Losses for Real-Time Style Transfer and Super-Resolution](https://mlsanity.com/paper/1603.08155/) (2016)
- [Improved Training of Wasserstein GANs](https://mlsanity.com/paper/1704.00028/) (2017)
- [Spectral Normalization for Generative Adversarial Networks](https://mlsanity.com/paper/1802.05957/) (2018)
- [Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning](https://mlsanity.com/paper/1602.07261/) (2016)
- [StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translation](https://mlsanity.com/paper/1711.09020/) (2017)
- [Interpreting the Latent Space of GANs for Semantic Face Editing](https://mlsanity.com/paper/1907.10786/) (2019)
- [Image2StyleGAN: How to Embed Images Into the StyleGAN Latent Space?](https://mlsanity.com/paper/1904.03189/) (2019)
- [Renyi Differential Privacy](https://mlsanity.com/paper/1702.07476/) (2017)
- [MesoNet: a Compact Facial Video Forgery Detection Network](https://mlsanity.com/paper/1809.00888/) (2018)
- [AttGAN: Facial Attribute Editing by Only Changing What You Want](https://mlsanity.com/paper/1711.10678/) (2017)
- [DeepFakes and Beyond: A Survey of Face Manipulation and Fake Detection](https://mlsanity.com/paper/2001.00179/) (2020)
- [Semantic Image Inpainting with Deep Generative Models](https://mlsanity.com/paper/1607.07539/) (2016)
- [DP-CGAN: Differentially Private Synthetic Data and Label Generation](https://mlsanity.com/paper/2001.09700/) (2020)
- [GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generators](https://mlsanity.com/paper/2006.08265/) (2020)
- [DeepPrivacy: A Generative Adversarial Network for Face Anonymization](https://mlsanity.com/paper/1909.04538/) (2019)
- [CIAGAN: Conditional Identity Anonymization Generative Adversarial Networks](https://mlsanity.com/paper/2005.09544/) (2020)
- [Generative Face Completion](https://mlsanity.com/paper/1704.05838/) (2017)
- [Learning to Anonymize Faces for Privacy Preserving Action Detection](https://mlsanity.com/paper/1803.11556/) (2018)
- [Natural and Effective Obfuscation by Head Inpainting](https://mlsanity.com/paper/1711.09001/) (2017)
- [RelGAN: Multi-Domain Image-to-Image Translation via Relative Attributes](https://mlsanity.com/paper/1908.07269/) (2019)
- [AnonymousNet: Natural Face De-Identification with Measurable Privacy](https://mlsanity.com/paper/1904.12620/) (2019)
- [Live Face De-Identification in Video](https://mlsanity.com/paper/1911.08348/) (2019)
- [Adversarial Learning of Privacy-Preserving and Task-Oriented Representations](https://mlsanity.com/paper/1911.10143/) (2019)
- [Make a Face: Towards Arbitrary High Fidelity Face Manipulation](https://mlsanity.com/paper/1908.07191/) (2019)

## Built on by (most cited first, 20 of 20)

- [CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Search](https://mlsanity.com/paper/2306.10008/) (2023)
- [G2Face: High-Fidelity Reversible Face Anonymization via Generative and Geometric Priors](https://mlsanity.com/paper/2408.09458/) (2024)
- [GAN-based Facial Attribute Manipulation](https://mlsanity.com/paper/2210.12683/) (2022)
- [Face De-identification: State-of-the-art Methods and Comparative Studies](https://mlsanity.com/paper/2411.09863/) (2024)
- [Disguise without Disruption: Utility-Preserving Face De-Identification](https://mlsanity.com/paper/2303.13269/) (2023)
- [Learnable Privacy-Preserving Anonymization for Pedestrian Images](https://mlsanity.com/paper/2207.11677/) (2022)
- [Task-aware Privacy Preservation for Multi-dimensional Data](https://mlsanity.com/paper/2110.02329/) (2021)
- [MaSS: Multi-attribute Selective Suppression](https://mlsanity.com/paper/2210.09904/) (2022)
- [On Mask-based Image Set Desensitization with Recognition Support](https://mlsanity.com/paper/2312.08975/) (2023)
- [Crafter: Facial Feature Crafting against Inversion-based Identity Theft on Deep Models](https://mlsanity.com/paper/2401.07205/) (2024)
- [Seeing is not Believing: An Identity Hider for Human Vision Privacy Protection](https://mlsanity.com/paper/2307.00481/) (2023)
- [SemDP: Semantic-level Differential Privacy Protection for Face Datasets](https://mlsanity.com/paper/2412.15590/) (2024)
- [ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration](https://mlsanity.com/paper/2503.06986/) (2025)
- [Contextualize differential privacy in image database: a lightweight image differential privacy approach based on principle component analysis inverse](https://mlsanity.com/paper/2202.08309/) (2022)
- [Data-Driven but Privacy-Conscious: Pedestrian Dataset De-identification via Full-Body Person Synthesis](https://mlsanity.com/paper/2306.11710/) (2023)
- [Privacy-Preserving Medical Image Classification through Deep Learning and Matrix Decomposition](https://mlsanity.com/paper/2308.16530/) (2023)
- [VerA: Versatile Anonymization Applicable to Clinical Facial Photographs](https://mlsanity.com/paper/2312.02124/) (2023)
- [FairDeFace: Evaluating the Fairness and Adversarial Robustness of Face Obfuscation Methods](https://mlsanity.com/paper/2503.08731/) (2025)
- [A Dual-stage Prompt-driven Privacy-preserving Paradigm for Person Re-Identification](https://mlsanity.com/paper/2511.05092/) (2025)
- [Interpolation-Based Optimization for Enforcing lp-Norm Metric Differential Privacy in Continuous and Fine-Grained Domains](https://mlsanity.com/paper/2601.09946/) (2026)

## Abstract (arXiv)

With the growing use of camera devices, the industry has many image datasets that provide more opportunities for collaboration between the machine learning community and industry. However, the sensitive information in the datasets discourages data owners from releasing these datasets. Despite recent research devoted to removing sensitive information from images, they provide neither meaningful privacy-utility trade-off nor provable privacy guarantees. In this study, with the consideration of the perceptual similarity, we propose perceptual indistinguishability (PI) as a formal privacy notion particularly for images. We also propose PI-Net, a privacy-preserving mechanism that achieves image obfuscation with PI guarantee. Our study shows that PI-Net achieves significantly better privacy utility trade-off through public image data.