# A False Sense of Privacy: Towards a Reliable Evaluation Methodology for the Anonymization of Biometric Data

arXiv: https://arxiv.org/abs/2304.01635 · HTML: https://mlsanity.com/paper/2304.01635/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Apr 2023.

## Built on by (most cited first, 5 of 5)

- [Restoring Gaussian Blurred Face Images for Deanonymization Attacks](https://mlsanity.com/paper/2506.12344/) (2025)
- [On the Importance of Conditioning for Privacy-Preserving Data Augmentation](https://mlsanity.com/paper/2504.05849/) (2025)
- [Privacy-Preserving Computer Vision for Industry: Three Case Studies in Human-Centric Manufacturing](https://mlsanity.com/paper/2512.09463/) (2025)
- [Face anonymization preserving facial expressions and photometric realism](https://mlsanity.com/paper/2603.17567/) (2026)
- [MultiGait: A Multi-Sensor Multi-Perspective Multi-Session Biometric Inference Benchmark and its Dataset](https://mlsanity.com/paper/2609.01036/) (2026)

## Abstract (arXiv)

Biometric data contains distinctive human traits such as facial features or gait patterns. The use of biometric data permits an individuation so exact that the data is utilized effectively in identification and authentication systems. But for this same reason, privacy protections become indispensably necessary. Privacy protection is extensively afforded by the technique of anonymization. Anonymization techniques protect sensitive personal data from biometrics by obfuscating or removing information that allows linking records to the generating individuals, to achieve high levels of anonymity. However, our understanding and possibility to develop effective anonymization relies, in equal parts, on the effectiveness of the methods employed to evaluate anonymization performance. In this paper, we assess the state-of-the-art methods used to evaluate the performance of anonymization techniques for facial images and for gait patterns. We demonstrate that the state-of-the-art evaluation methods have serious and frequent shortcomings. In particular, we find that the underlying assumptions of the state-of-the-art are quite unwarranted. State-of-the-art methods generally assume a difficult recognition scenario and thus a weak adversary. However, that assumption causes state-of-the-art evaluations to grossly overestimate the performance of the anonymization. Therefore, we propose a strong adversary which is aware of the anonymization in place. We improve the selection process for the evaluation dataset, and we reduce the numbers of identities contained in the dataset while ensuring that these identities remain easily distinguishable from one another. Our novel evaluation methodology surpasses the state-of-the-art because we measure worst-case performance and so deliver a highly reliable evaluation of biometric anonymization techniques.