# Secure and reversible face anonymization with diffusion models

arXiv: https://arxiv.org/abs/2510.01031 · HTML: https://mlsanity.com/paper/2510.01031/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models.
- Builds on 20 of its 25 references that are in the map.
- First posted on arXiv 1 Oct 2025.

## Placed in

- Diffusion models / [Robustness, privacy and adversarial aspects](https://mlsanity.com/diffusion/robustness-privacy-and-adversarial-aspects/)

## Builds on (most cited first, 20 of 20)

- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Score-Based Generative Modeling through Stochastic Differential Equations](https://mlsanity.com/paper/2011.13456/) (2020)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Encoding in Style: a StyleGAN Encoder for Image-to-Image Translation](https://mlsanity.com/paper/2008.00951/) (2020)
- [BiSeNet: Bilateral Segmentation Network for Real-time Semantic Segmentation](https://mlsanity.com/paper/1808.00897/) (2018)
- [AdaFace: Quality Adaptive Margin for Face Recognition](https://mlsanity.com/paper/2204.00964/) (2022)
- [DeepPrivacy: A Generative Adversarial Network for Face Anonymization](https://mlsanity.com/paper/1909.04538/) (2019)
- [CIAGAN: Conditional Identity Anonymization Generative Adversarial Networks](https://mlsanity.com/paper/2005.09544/) (2020)
- [Attribute-preserving Face Dataset Anonymization via Latent Code Optimization](https://mlsanity.com/paper/2303.11296/) (2023)
- [An Introduction to Flow Matching and Diffusion Models](https://mlsanity.com/paper/2506.02070/) (2025)
- [Password-conditioned Anonymization and Deanonymization with Face Identity Transformers](https://mlsanity.com/paper/1911.11759/) (2019)
- [RiDDLE: Reversible and Diversified De-identification with Latent Encryptor](https://mlsanity.com/paper/2303.05171/) (2023)
- [G2Face: High-Fidelity Reversible Face Anonymization via Generative and Geometric Priors](https://mlsanity.com/paper/2408.09458/) (2024)
- [NullFace: Training-Free Localized Face Anonymization](https://mlsanity.com/paper/2503.08478/) (2025)
- [iFADIT: Invertible Face Anonymization via Disentangled Identity Transform](https://mlsanity.com/paper/2501.04390/) (2025)

## Abstract (arXiv)

Face anonymization aims to protect sensitive identity information by altering faces while preserving visual realism and utility for downstream computer vision tasks. Current methods struggle to simultaneously ensure high image quality, strong security guarantees, and controlled reversibility for authorized identity recovery at a later time. To improve the image quality of generated anonymized faces, recent methods have adopted diffusion models. However, these new diffusion-based anonymization methods do not provide a mechanism to restrict de-anonymization to trusted parties, limiting their real-world applicability. In this paper, we present the first diffusion-based framework for secure, reversible face anonymization via secret-key conditioning. Our method injects the secret key directly into the diffusion process, enabling anonymization and authorized face reconstruction while preventing unauthorized de-anonymization. The use of deterministic forward and reverse diffusion steps guarantees exact identity recovery when the correct secret key is available. Experiments on CelebA-HQ and LFW demonstrate that our approach achieves better anonymization and de-anonymization capabilities than prior work. We also show that our method remains robust to incorrect or adversarial key de-anonymization. Our code will be made publicly available.