# Practical Digital Disguises: Leveraging Face Swaps to Protect Patient
Privacy ††thanks: This manuscript is a preprint that has not yet been peer-
reviewed.

Ethan Wilson
University of Florida
<EMAIL_ADDRESS>Frederick Shic
Seattle Children’s Research Institute
University of Washington School of Medicine
<EMAIL_ADDRESS>Jenny Skytta
Seattle Children’s Research Institute
<EMAIL_ADDRESS>Eakta Jain
University of Florida
<EMAIL_ADDRESS>
###### Abstract

With rapid advancements in image generation technology, face swapping for
privacy protection has emerged as an active area of research. The ultimate
benefit is improved access to video datasets, e.g. in healthcare settings.
Recent literature has proposed deep network-based architectures to perform
facial swaps and reported the associated reduction in facial recognition
accuracy. However, there is not much reporting on how well these methods
preserve the types of semantic information needed for the privatized videos to
remain useful for their intended application. Our main contribution is a novel
end-to-end face swapping pipeline for recorded videos of standardized
assessments of autism symptoms in children. Through this design, we are the
first to provide a methodology for assessing the privacy-utility trade-offs
for the face swapping approach to patient privacy protection. Our methodology
can show, for example, that current deep network based face swapping is
bottle-necked by face detection in real world videos, and the extent to which
gaze and expression information is preserved by face swaps relative to
baseline privatization methods such as blurring.

Figure 1: We present an end-to-end pipeline to face swap the faces of the
child patients in videos of recorded autism screening sessions.

_K_ eywords Face swapping $\cdot$ Deep fakes $\cdot$ Privacy

##  1 Introduction

Recent advances in generative technology [1, 2, 3, 4, 5] have led to a huge
advancement in face swapping technology [6,
7]111https://github.com/MarekKowalski/FaceSwap222https://github.com/shaoanlu/faceswap-
GAN333https://github.com/iperov/DeepFaceLab. These algorithms, informally
known as "deep fakes", are able to transpose a character face onto the
original face in images or video clips seamlessly, fooling human viewers [8].

Although the technology is commonly used for impersonation [9, 10],
researchers are beginning to harness this tool and apply face swaps in ways
that can benefit society [11]. There are emerging research topics assessing
and improving upon the privacy protections that face swaps and
deidentification guarantee [12, 13, zhenzhong:de-identi2021], and evaluating
the added utility that face swapping can provide [14].

The existing literature fails to consider the properties of many real-world
situations that require deidentification. Unlike in proper face datasets,
faces in real-world applications are typically low-resolution and distanced
from the camera with a lot of movement. For example, in clinical situations,
the assessment is the focus; the recorded video is solely for reference. In
some settings, the subjects are children, whose faces are known to have a
negative facial recognition performance when compared to adults [15].

To analyze these shortcomings, we designed an end-to-end system to deidentify
patients in autism symptom assessments in children with autism spectrum
disorder (ASD). A novel contribution of our system is a quick and accurate
user-in-the-loop facial annotation system that can guarantee accurate bounding
boxes quickly, allowing face swaps in frames where automatic face detection
algorithms fail. We share our implementation details and design decisions with
the intent to aid and assist further research pursuits in this field. When
designing the system, we considered privacy risks created by tele-health,
remote training for clinicians, and dataset sharing for computational
research.

We analyze our processed sessions against the original clips and various
degrees of blur to assess the privacy-utility trade-off that face swaps
provide. To generalize our findings, we report on three high-performing facial
recognition algorithms. We find that face swaps do provide a level of privacy
proportional to the size of the set of reference faces being queried against.
We analyze facial landmarks, gaze direction, and expression classification to
assess how well facial information is preserved.

##  2 Related Work

Traditional methods, such as blurring or pixelization, have a significant
drawback — in order to provide a reliable level of privacy, all semantic
information of the face is essentially destroyed [16]. Face swapping has been
recognized as a powerful tool for face obfuscation that can act as an
alternative. This has sparked privacy-oriented research, as face swaps seem
like a promising alternative to traditional privacy protections. If a
traditional obfuscation effect is weakened to where gaze direction,
expression, and mouth movements can still be seen, privacy is compromised. An
addition, emerging deep learning methods, including full-body identity
recognition [17, 18] and models specialized to overcome the obfuscations [19],
are nearing the state of rendering traditional privacy methods obsolete.

Alternative methods have been explored in the past, dating back to 2005. Fan
et al. proposed a framework to automatically segment video clips into object
and non-object regions [20]. This enabled less intrusive blurring and, when
combined with contextual object classification, replacement of human subjects
in video with 3D avatars.

To protect privacy in social media photos without obtruding on user experience
[21], face in-painting approaches have been proposed. Mahajan et al. provided
the SwapItUp framework to swap in a reference face [22]. Using the detected
facial landmarks, pose and feature estimation is performed to query a nearest-
matching face from a reference dataset. This face is aligned, color matched
and blended over the input. Sun et al. provided a GAN-based framework [23] for
facial in-painting in social media photos. Given a partial or full-body image,
facial landmarks are detected or generated using an adversarial auto-encoder
network. They then perform a structure-guided image generation. Their method
improves privacy protection against context-aware models, which are shown to
fixate on the "fake" face. When context-aware models predict blurred or masked
faces, body cues are prioritized and the facial region is largely ignored.
However, these approaches lack control over the resulting identity or temporal
consistency when applied to video.

Bailer and Winter proposed improvements to DCGAN [2] by applying portrait
segmentation on the training data and adding face detection loss [24].
Segmenting images to replace the background and adding facial structure
awareness on top of the discriminator’s unsupervised decision increased the
face detection rate of the result.

Multiple approaches have opted to generate a fully synthetic face rather than
face swapping with a reference identity. AnonymousNet [12] addresses the
weaknesses of established deidentification techniques: lack of photo realism
and an inability to balance privacy and usability. By leveraging multiple
privacy metrics, they generate a synthetic face satisfying k-anonymity and
l-diversity privacy guarantees across 40 facial attributes. They balance
between privacy protections and generation through controllable
hyperparameters, but their method tends to result in uncanny faces. Gafni et
al. developed a fully automatic video deidentification pipeline able to be
used in real-time [13]. This method provides privacy protections with apparent
preservation in semantic features such as expressions and pose. The method
performs by driving the identity away from a target face. The method performs
minor tweaks on the attributes of the face — facial recognition systems are
fooled, yet human viewers can likely still identify the individual. Kuang et
al. proposed DeIdGAN [25], improving on previous methods with a high
deidentification rate and high image quality. They first segment the image
into semantic features, then impose k-anonymity on the mask’s shape. The
segmented input is passed into a generator along with a style image, producing
an image that follows the facial layout of the mask but produces the
attributes of the passed in identity. With novel identity-adversarial
discriminators, the network teaches the generator to avoid resynthesizing the
original identity. They achieve reidentification rates equivalent to a
powerful blur, yet preserve close to 100% face detection rate and a high
attribute preservation rate. However, this method appears to misconstrue
expressions, possibly due to the segmentation shape anonymity introduced
before face generation. These methods yield promising high-quality results,
but each have flaws regarding face swapping without a reference identity.
AnonymousNet’s fully generated, privatized face appears uncanny and Gafni et
al.’s is perceptually similar to its source. DeIdGAN and Gafni et al. have
apparent difficulty preserving expressions. AnonymousNet and DeIdGAN’s
incorporation of k-anonymity limit them to image datasets and no
experimentation on video frames are shown.

Zhu et al. initiated the investigation into the real-world utility of face
swaps as a viable privacy protection method for clinical setups [14]. They
performed face swaps on two examinations of the Unified Parkinson’s Disease
Rating Scale (UPDRS). On their small dataset, they showed that the face swaps
successfully deidentified the clips while preserving body keypoint
invariability at a higher level than traditional face masking methods.
However, they discarded blurry and undetectable faces and did not explore more
in-depth facial landmark preservation, which could be more meaningful for
clinical diagnosis.

While generative models boast strong privacy guarantees, the literature does
not support them being feasible in clinical settings. Most methods work only
on static images, and are not shown in in-the-wild situations. Because
emerging methods utilize face detection and recognition pipelines, it is
unclear how they would perform on low-resolution face datasets that are
relatively more difficult to reidentify in the first place. Additionally, the
generative architectures of these methods appear to only loosely preserve
expression and gaze cues, which could have implications on human re-evaluation
of the video for reference or training purposes. Face swapping methods, which
are shown to enirely fool human viewers [26, 27], seem better suited towards
this use case, but analysis into their privacy/utility trade-off is limited.

##  3 System Design and Implementation

We designed an end to end system which takes videos of autism screening
sessions as input and creates a face swapped video as output. The constraints
of the healthcare setting informed the design of the system presented below.
Our system includes a novel user-in-the-loop annotation module that allows a
lay user to mark bounding boxes in frames where automatic face detection
algorithms fail (Sec 3.3.2).

###  3.1 Video Dataset: Constraints and Characteristics

The patients in the video dataset are children ranging in age from 5-16 years
old. Our dataset consists of 22 recorded administrations of the Autism
Diagnostic Observation Schedule (ADOS), a gold-standard behavioral assessment
instrument used in the diagnosis of ASD [28, 29]. Sessions are about one hour
in duration, with videos recorded at 60fps and 1280p resolution. There are two
to three people in every session: the patient, the clinician, and optionally a
parent/guardian. For the purposes of privatization, the patient is regarded as
the key subject. The face of the privatizing identity, which will be swapped
onto the key subject’s likeness, is here-on referred to as the character face.

Unlike talking head videos (referred to as medium close-ups in film), where
the positioning of the speaker’s face within the camera view and visual
fidelity are the central concerns, these videos focus on capturing the
interactive context of the clinical assessment. As a result, the camera is
installed in a corner of the assessment room and the faces are relatively low
resolution compared to talking head videos. Importantly, the faces we get are
the faces we get–we do not have the freedom to collect additional data.
Finally, because our subjects are children, they frequently move around and
present a variety of head poses and facial expressions. For example, it is a
common occurrence for a child to spin around in their chair or run around the
room, producing sequences with drastic movements and motion blur.

###  3.2 Overall design

Our system is a pipelined design. This allows for multiple video clips to be
processed simultaneously while maximizing the system resources on a single
machine. The GPU intensive model training can process one clip while less
intensive stages in the pipeline run for other clips. In clinics, after
recording a session, the video could be processed locally, eliminating the
security risks related to data transfer.

Our system can be divided into two main stages, each with a number of sub-
stages. These stages are:

  1. 1.

Face Annotation. Results in a bounding box at each frame containing the key
subject’s face.

     * •

Automatic face detection. A face detection algorithm provides a list of
bounding boxes for detected faces (of all identities present) across all
frames.

     * •

Manual corrections. A human annotator uses a GUI to perform multiple tasks:

       * –

(1.) Label regions of time where the key subject is present with face in-
frame.

       * –

(2.) Mark identities not belonging to the key subject so that they can be
ignored in later stages of the pipeline.

       * –

(3.) Fill in gaps where automatic face detection failed by manually marking
frames that should have bounding boxes for the key subject.

     * •

(4.) Interpolation. Frames within the ground truth that do not contain
bounding boxes are filled in by linearly interpolating nearest neighbors.

  2. 2.

Face swap processing. The face annotation data is used alongside a character
face dataset to produce a face swapped video result.

     * •

Face extraction. Face images are taken from the previously found bounding
boxes and aligned. This gives a dataset of face images for all frames
containing the key subject’s face.

     * •

Training. The key subject’s dataset and a similarly structured character
face’s dataset are used to train a model that swaps the character’s likeness
onto the key subject’s face images.

     * •

Deployment. Using the bounding boxes, the model is applied to every frame that
contains the key subject’s face.

We have made multiple design choices that consider the key subject. There are
simple modifications that could be made to instead address the privacy of
multiple subjects. For example, each key subject could be separately tagged in
the same manual annotation session, then face swap processing could be run
separately per-subject (or all at once, if you wish for the same character to
be applied!). To additionally protect privacy of non-key subjects, a blurring
operation could be applied to the detected faces currently being filtered out.

Figure 2: Overall system flow. System is divided into automatic face
detection, manual corrections via a graphical user interface, and face swap
processing (subsectioned into training and deployment) implemented with
DeepFaceLab’s code-base [30].

Detector | Time | Detection Rate | Detection Rate
---|---|---|---
| (Minutes) | (Single Face) | (Multiple Faces)
MTCNN | 1148.7 | 87.76% | 33.93%
S3FD | 123.8 | 91.88% | 62.57%
modified S3FD | 19.8 | 95.28% | 86.47%
Table 1: Detection rates and runtime for the three face detectors considered,
computed on a sample ADOS session consisting of two individuals.

Session | Automatic | Detection with
---|---|---
| Detection | Annotations
A | 57.29% | 96.36%
B | 95.02% | 98.43%
C | 73.11% | 88.24%
D | 53.52% | 86.83%
Table 2: A comparison of face detection rates for the key subject before and
after manual processing for four exemplar video observation sessions. These
results illustrate a large variation in the effectiveness of automatic face
detection, thus how much involvement is needed in manual correction.

###  3.3 Face Detection

Face detection is the starting point of our system, and a high quality face
detection result is necessary to extract accurate landmarks for alignment [31]
and ultimately create a high-quality face swapped result. When choosing a face
detection algorithm, we equally prioritized speed; a real-time or faster
processing time is important for this system to be feasibly utilized in
industry.

####  3.3.1 Comparison of face detection methods

We analyzed two high performing, deep learning-based face detection systems
and assessed their speed and performance: Multi-task Cascaded Convolutional
Network (MTCNN)444https://pypi.org/project/mtcnn/ [32] and Single Shot Scale-
invariant Face Detector
(S3FD)555https://github.com/iperov/DeepFaceLab/blob/master/facelib/S3FDExtractor.py
[33]. Our S3FD implementation is bundled as the de facto face detector in
DeepFaceLab, used later in our pipeline.

We found that S3FD outperformed MTCNN on our dataset, then we further iterated
on the S3FD’s design to produce modified-S3FD. In S3FD image frames above a
threshold size were scaled down to a target resolution before the algorithm
proceeded. Keeping the frame at a full resolution could improve detection
rates but significantly slow down the process. In modified-S3FD, we run S3FD
on the full resolution, but run the algorithm on every tenth frame (recall the
video sessions are recorded in 60fps). Then, we linearly interpolate the
detected faces across the skipped frames.

####  3.3.2 User in the loop to correct missed detection

We designed our system to overlay automatic face detection with a manual
correction pass to lower the amount of labor required. However,
straightforward per-frame annotation still was not feasible. For reference,
Celeb-A is one of the largest annotated face datasets, with around 200,000
images [34]. Our dataset of 22 sessions consists of 4.7 million image frames.
If we generously assume that automatic face detection marks 90% of frames and
that it takes a human annotator one second per frame, annotation would take
130 hours, or 6 hours per session. This ballpark estimate does not consider
false positives and the presence of more than one faces. Therefore, it was
imperative to design a system that would allow an annotator to quickly make
corrections while remaining highly accurate.

Figure 3: Manual annotation GUI being used to annotate the second pass of the
proposed annotation system.

Our system is a user interface consisting of four passes, three manual and one
algorithmic. A flow diagram of the full manual annotation process can be found
in Figure 2 and an illustration of the GUI contents can be seen in Figure 3.

In the first pass, the annotator goes through the video and marks key frames
where the key subject’s face enters or leaves the camera’s view. These key
frames are important for further passes, as they allow the annotator to
quickly jump to areas of interest.

In the second pass, the annotator marks face chains as belonging to the key
subject or not. A face chain is a continuous chain of faces for a particular
subject, computed based on faces’ pixel-wise distance in nearby frames. The
start and end frame of each face chain also becomes a key frame. Annotators
quickly jump between key frames and mark the face chains that belong to the
key subject.

The third pass is used to supplement additional bounding boxes. In regions
where a large amount of time passes or the subject moves drastically, the
annotator marks additional frames. These frames are used in the fourth pass to
aid with interpolation. In regions where the head slightly or does not move,
the annotator can very sparsely mark frames and rely on interpolation.
However, if there is a large amount of movement, the annotator must mark the
frames more tightly to get an accurate result.

The fourth pass is an algorithmic interpolation. At this point, faces are
labeled as belonging to the key subject or not, and the annotator has provided
sufficient coverage of the key subject. The pass processes any frame that has
been marked as containing the key subject but does not have facial
information. A new bounding box is created by interpolating the size and
location of the nearest neighbor marked faces.

After the fourth pass, an annotator can view the result of their work and
return to an earlier pass to make corrections if information was missed. Once
manual annotation has concluded and has been visually confirmed, the result
can be considered the ground truth for face detection. Regions containing the
key subject were labeled in the first pass, and the fourth pass ensured that
every frame within those regions has a bounding box.

The annotation system drastically reduced the workload compared to fully
manual annotation. Annotation typically took between 20-60 minutes per
session, depending on session length and the starting accuracy of the
automatic face detection algorithm.

###  3.4 Face Swap Processing Details

We use DeepFaceLab (DFL) as our face swapping framework [30]. DFL is a popular
open-source tool and has reported state-of-the-art results on the
FaceForensics++ dataset [35]. The overall stages are face extraction,
training, and deployment. We incorporate most of the DFL pipeline as-is, but
make changes during the face extraction stage.

Rather than using DFL’s face detector, we use the key subject’s bounding boxes
that were produced by our pipeline. We then use the Face Alignment Network
(FAN)666https://github.com/1adrianb/face-alignment to perform extraction and
alignment on the face data [36]. By passing in our manually tagged faces, we
enable face swapping even when automatic face detection fails.

####  3.4.1 Parameter choices

DFL offers multiple architectures to be used in model training and deployment.
These architectures vary in quality, training times, and system resources
required. To fit our use case, processing many frames with faces that are
quite small, we chose the dfHD architecture. This architecture provided
quality results with a processing rate that did not bottleneck the rest of the
pipeline. Our architecture parameters were: resolution: 128, face type: whole
face, auto-encoder dimensions: 128, encoder dimensions: 64, decoder
dimensions: 64, decoder mask dimensions: 22, batch size: 8. Additionally, eyes
and mouth priority, random warping, and flip faces were all set to true. When
reimplementing this system for other datasets, different architectures and/or
parameters can be chosen to best fit the use case.

We pretrained a model for 100,000 iterations using 100,000 face images
extracted from six identities within our dataset. For each session, we begin
with the pretrained model and train 100,000 iterations further on the key
subject paired with a character face.

##  4 Evaluation

In this section, we provide a methodology for assessing the privacy-utility
tradeoff for the face swapping approach to patient privacy protection. We
compute the recognition accuracy of multiple high performing face detection
algorithms on the privatized videos, as well as computing three sets of
metrics that capture the fidelity of gaze and expression information, which
are critical cues for autism screening.

In the following analysis, we consider 1/10th of the total number of frames
contained in our recorded sessions. This reduces the scale of our analysis
from 3.2 million faces to approximately 320,000.

###  4.1 Recognition Accuracy (Privacy Protection)

We report face detection accuracy in two scenarios:

  * •

Small-scale representation using hand-selected images.

  * •

Large representation using frames from across the full session.

These scenarios simulate two forms of attacks. In the first, an adversary with
access to a clinical recording tries to identify a specific individual and has
the time and resources to hand select ideal frames. This bypasses the
difficult nature of these videos where the patient’s face can often be
obscured or unclear by selecting high quality samples. The second scenario
models an automated attack where the adversary would process the frames of the
session and aggregate the face detection results to make a final prediction as
to the patient’s identity.

Figure 4: Illustration of blur intensities. Blur intensities titled "Weak" and
"Powerful" are used in further utility analysis. Weak blur provides a roughly
equivalent privacy protection to face swapping on our data. Powerful blur
provides strong privacy guarantees but fully degrades the face.

There are many face detection algorithms available, and we assume that an
adversary can use any (or multiple) algorithms in a reidentification attack.
To address this, we report our results on three high-performing face
recognition algorithms: Facenet [37], DeepFace [38], and ArcFace
[39]777Implementation of facial recognition systems used:
https://github.com/serengil/deepface.

|  |  | Blur Scale
---|---|---|---
| Original | Deepfakes | 1/5 | 1/10 | 1/15 | 1/20
Facenet |  |  |  |  |  |
Accuracy | 94.6% | 0.65% | 0.1% | 0.1% | 6.33% | 45.46%
Median | 1 | 153 | 490 | 473 | 159 | 2
Mean | 2.16 | 239.55 | 493 | 478.28 | 283 | 54.67
$\pm$SD |  $\pm$19.9 |  $\pm$242 |  $\pm$289 |  $\pm$291 |  $\pm$282 |  $\pm$142
DeepFace |  |  |  |  |  |
Accuracy | 78.69% | 3.61% | 1% | 12.64% | 45.13% | 64.51%
Median | 1 | 108 | 360 | 70 | 2 | 1
Mean | 24.76 | 220.29 | 400.82 | 203.09 | 78.55 | 45.6
$\pm$SD |  $\pm$106 |  $\pm$255 |  $\pm$293 |  $\pm$265 |  $\pm$179.3 |  $\pm$141
ArcFace |  |  |  |  |  |
Accuracy | 96.71% | 0.72% | 0.1% | 0.58% | 70.97% | 92.5%
Median | 1 | 120 | 482 | 75 | 1 | 1
Mean | 2.42 | 223.17 | 487.99 | 164.32 | 6.02 | 2.91
$\pm$SD |  $\pm$29.5 |  $\pm$246 |  $\pm$288 |  $\pm$206 |  $\pm$38.4 |  $\pm$32.2
Table 3: Face recognition results computed using uniformly selected frames
from the FaceForensics++ dataset. Reference face dataset consisted of 1000
individuals. Results are shown for the original and Deepfakes stimuli, as well
as blurred results at various scales.

We compare our results against a baseline privatization method: blur. We
implement a scaled box filter smoothing operation with a blur kernel intensity
equal to $ceil((width+height)*scale)$. Table 3 and Figure 6 show the impact
that different blur scales have on facial recognition accuracy. For further
experiments, we compare against a powerful blur set at $scale=1/5$ and a weak
blur set at $scale=1/15$. This weak blur has a much higher recognition
accuracy on FaceForensics++ data but comparable privacy protections to face
swapping on our dataset.

Figure 5: Recognition accuracy at varying blur scales. Original and face
swapped face detection rates are displayed for reference. Reported results are
for the FaceForensics++ dataset (1000 identities).

Figure 6: ArcFace facial recognition accuracy is displayed of a hand-selected
subset of video frames. Accuracy indicates that the true identity was within K
closest matches. As number of reference identities N increases, recognition
accuracy falls off.

Recognition accuracy is defined as the percentage of correct identifications
in the test set. A computed identity is correct if the true identity of an
individual is within K closest results of feature-wise distance vectors
computed by the recognition algorithm. Thus, when $K=1$, the correct identity
has been identified as the closest match. For more relaxed values of K, the
algorithm has identified the correct identity alongside $[K-1]$ reference
images of potentially false identities. In Figure 6, we report recognition
accuracy at different values of K.

|  | Original | Face Swap | Blur (S=1/5)
---|---|---|---|---
Facenet | K=1 | 39.33% | 16.03% | 0%
| K=2 | 50.85% | 26.89% | 0%
| K=5 | 65.82% | 50.42% | 0.04%
| K=10 | 78.25% | 74.81% | 0.13%
Identity | Median | 2 | 9 | 20
Ranking: | Mean$\pm$SD | 6.63$\pm$8.6 | 12.65$\pm$13.7 | 19.43$\pm$9.7
Deepface | K=1 | 69.24% | 28% | 0.05%
| K=2 | 76.59% | 43.58% | 0.08%
| K=5 | 86.65% | 66.17% | 0.15%
| K=10 | 93.22% | 87.24% | 0.25%
Identity | Median | 1 | 6 | 11
Ranking: | Mean$\pm$SD | 3.22$\pm$6.2 | 10.99$\pm$12.6 | 15.28$\pm$16.4
ArcFace | K=1 | 63.03% | 18.51% | 0%
| K=2 | 67.7% | 30.55% | 0.06%
| K=5 | 73.06% | 52.34% | 0.08%
| K=10 | 78.03% | 73.95% | 0.2%
Identity | Median | 1 | 9 | 23
Ranking: | Mean$\pm$SD | 6.81$\pm$14.5 | 15.72$\pm$18.7 | 30.21$\pm$31.5
Table 4: Face recognition results computed across all clinical sessions
processed. Reference face dataset consisted of 110 images of 22 individuals.
Detection accuracy is reported at ranks K=1, 2, 5, 10. Median and mean
identity rankings are reported as the ranking of the first true-positive
reference image.

For the first adversarial scenario, we hand selected five frames from each
session and cropped the images to the key face region. We split these frames
into query and reference datasets consisting of two and three frames per
subject, respectively. The recognition accuracy at different levels of K is
shown as dotted lines in Figure 6 (N=22). We augment the test set by adding
more identities as the reference databases in the defined threat scenario
would typically be much larger than our 22 identities. We include additional
identities, children aged 5-15, procured from the IMDB-Face dataset [40].
Recognition accuracy is shown as dashed lines (N=44) and solid lines (N=216).
In all cases, the face swapping approach reduces recognition accuracy relative
to the original faces. The powerful blur rendered the faces undetectable,
yielding a 0% recognition rate.

For the second scenario, we validate the identity of every tenth frame of the
recorded video sessions using five frames per identity as a reference set. We
report these results in Table 4. In addition to the recognition accuracy at
different K, we also report the identity ranking: the index of the true face’s
facial feature distance within the reference dataset, as reported by [13]. To
compare our results with existing benchmarks, we also report the mean index of
the original and DeepFakes888https://github.com/deepfakes/faceswap stimuli
contained within the FaceForensics++ dataset [35], processing ten uniformly
spaced frames from each video.

Our results indicate that face swapping does provide a measure of
deidentification for the subject’s face. The large standard deviations in the
identity rankings indicate that facial recognition accuracy is highly variable
for in-the-wild settings, both before and after manipulation. Face swapping
was able to consistently double the identity ranking across multiple facial
recognition algorithms.

Our results align with the results computed on the FaceForensics++ benchmark,
but with a higher recognition rate for the face swapped images
(15.69%/27.75%/18.37% versus 0.65%/3.61%/0.72%). We hypothesize this variation
is influenced by reference dataset size; the 22 individual ADOS set is much
lower than the 1000 individual set. This indication can be seen in Figure 6,
where a larger reference dataset more sharply decreased recognition accuracy
for the face swaps than for the original faces. Furthermore, the
FaceForensics++ reference set always contains the identity that is being used
as the character face in the face swap, guaranteeing a closely-resembling
result that is not the original identity.

Figure 7: Utility analysis pipeline. Red arrow indicates value comparison and
green arrows indicate classification. Once landmarks are computed, expressions
are estimated and the original and face swap are compared. Using predictions
built off of landmarks, gaze classifications (left/center/right;
up/center/down) are compared.

###  4.2 Landmarks Estimation

Landmark points are the basis for further processing of human faces, including
facial expression classification and gaze direction estimation. Euclidean
distance is a widely used metric when using landmarks for face recognition and
expression detection [41]. Because the pixel sizes of faces in our dataset are
not standardized, we report the Euclidean distance normalized within the
bounding box of the detected face, shown in Equation 1.

$D_{norm}=\frac{1}{68}\sum_{i=1}^{68}\sqrt{(\frac{O_{i}.x-DF_{i}.x}{Face_{w}})^{2}+(\frac{O_{i}.y-DF_{i}.y}{Face_{h}})^{2}}$
(1)

| Number | Normalized |  |  |
---|---|---|---|---|---
| of Faces | Euclidean | Per-feature Distance
| Compared | Distance | Eyes | Nose | Mouth
Face swap | 121949 | 0.0318 | 0.0245 | 0.0270 | 0.0332
Weak Blur | 49421 | 0.0375 | 0.0284 | 0.0319 | 0.0373
Strong Blur | 992 | 0.1681 | 0.1682 | 0.2111 | 0.1850
Table 5: Average normalized Euclidean distance between the landmark points of
original and swapped faces.

$D_{norm}$ is averaged over all 68 key points computed by the Dlib facial
landmark predictor [42, 43]. The original face’s points $O$ and the deepfake
points $DF$ are scaled between 0 and 1 within the bounds of the $Face$ region.

We report the distance between landmark estimation on the original faces with
the same estimation on the face swaps and on the blurred faces in Table 5. We
also report the distance separated by key regions (eyes, nose, mouth) by
averaging across select landmark points. We find that face swaps’ landmarks
are more true-to-original for eyes and nose than those of the mouth. Face swap
and weak blur have relatively similar landmark estimations, yet far less
blurred faces were able to be detected for analysis.

###  4.3 Gaze Direction Estimation

Stimuli | Total | % Over | % Gaze | Accuracy
---|---|---|---|---
| Faces | Threshold | Detected |
Original | 53915 | 82.21% | 38.26% | 100%
Face swap | " | " | 54.23% | 68.98%
Weak Blur | " | " | 0% | /
Strong Blur | " | " | 0% | /
Table 6: Gaze detection rate and accuracy results. We report the percentage of
frames considered after threshold application and the percentage of those
thresholded frames where gaze was detected and correctly classified.

This section evaluates how well the gaze direction after face swapping matches
the gaze direction in the original faces. In the metrics reported, gaze
direction (estimated by the GazeTracking
network999https://github.com/antoinelame/GazeTracking) of the original faces
is considered ground truth. To assess how well gaze is preserved, we implement
a classification approach, labeling gaze as {left, center, right} and {up,
center, down}, for a total of nine classes.

Because the size of faces can be very small, we employed a threshold-based cut
off such that only faces of $min(width,height)$ $>=$ $56$ pixels are
processed. Sessions where the GazeTracking network failed to detect a valid
gaze direction in at least 10% of the frames (from lack of contrast or non-
viable poses) were discarded. Of the 12 sessions considered (N=53915 frames),
once the threshold was applied, M=44326 frames remained. We report the
percentage of valid gaze samples and the accuracy of the gaze direction in
Table 6. As we can see, even weak blurring fully degrades gaze information and
no utility can be preserved. However, face swapping is able to detect gaze in
54.23% of frames and predict with 68.98% classification accuracy.
Interestingly, many frames that did not originally have detectable gaze were
able to be classified after face swapping. This indicates that face swaps
could impose an average gaze direction on frames that are originally occluded.

###  4.4 Expression Detection

Figure 8: Confusion matrix illustrating how well the face swapped result
matched the algorithmically classified expression on the original face (ground
truth).

To assess expressions, we employ the facial expression recognition network
(FER101010https://github.com/justinshenk/fer) [44, 45]. We consider the
computed expressions produced by the network for the original faces to be the
ground truth. The face swapped faces (N=91113 comparisons) were classified as
having the same expression as the original for 40.78% of the frames. Weak
blurred faces (N=62396 comparisons) were correctly classified only 27.27% of
the time. A confusion matrix illustrating the face swap classifications can be
found in Figure 8.

While the expression classification rate of the face swaps is not ideal, the
distribution of expressions is rather similar between face swaps and original
faces. Original faces are distributed from most concentrated to least as {Sad,
Happy, Neutral, Fear, Anger, Surprise, Disgust}. The face swap distribution is
{Happy, Neutral, Sad, Fear, Anger, Surprise, Disgust}, following the overall
ground truth distribution order other than the Sad class.

##  5 Conclusions

Our findings shed light on some of the challenges in real-world scenarios that
have not been considered in prior research. When implemented on high-quality
data, face swapping algorithms may be able to preserve expression and gaze
information. However, results are far less reliable on challenging data, which
could lead to misinterpretations of face swapped video. In use cases such as
clinical assessments for autism screening, where atypical gaze or eye contact
are important indicators[46], it is important to consider the level of privacy
offered by a privatization approach in conjunction with utility, i.e., the
retention of those cues that are needed by the clinician to make a diagnosis.

## Acknowledgments

This work was was supported by the National Institute of Mental Health through
award R21MH123997. We thank Dr. Sara Jane Webb and Megha Santosh for their
help in provision of media-release approved ADOS videos for use as exemplars
in this work.

## References

  * [1] Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial networks, 2014.
  * [2] Alec Radford, Luke Metz, and Soumith Chintala.  Unsupervised representation learning with deep convolutional generative adversarial networks, 2016.
  * [3] Tero Karras, Samuli Laine, and Timo Aila.  A style-based generator architecture for generative adversarial networks, 2019.
  * [4] Anders Boesen Lindbo Larsen, Søren Kaae Sønderby, Hugo Larochelle, and Ole Winther.  Autoencoding beyond pixels using a learned similarity metric, 2016.
  * [5] Satoshi Iizuka, Edgar Simo-Serra, and Hiroshi Ishikawa.  Globally and Locally Consistent Image Completion.  ACM Transactions on Graphics (Proc. of SIGGRAPH 2017), 36(4):107:1–107:14, 2017.
  * [6] Ruben Tolosana, Ruben Vera-Rodriguez, Julian Fierrez, Aythami Morales, and Javier Ortega-Garcia.  Deepfakes and beyond: A survey of face manipulation and fake detection, 2020.
  * [7] Thanh Thi Nguyen, Quoc Viet Hung Nguyen, Cuong M. Nguyen, Dung Nguyen, Duc Thanh Nguyen, and Saeid Nahavandi.  Deep learning for deepfakes creation and detection: A survey, 2021.
  * [8] Pavel Korshunov and Sébastien Marcel.  Deepfake detection: humans vs. machines, 2020.
  * [9] Cristian Vaccari and Andrew Chadwick.  Deepfakes and disinformation: Exploring the impact of synthetic political video on deception, uncertainty, and trust in news.  Social Media + Society, 6(1):2056305120903408, 2020.
  * [10] Douglas Harris.  Deepfakes: False pornography is here and the law cannot protect you.  Duke L. & Tech. Rev., 17:99, 2018.
  * [11] Nicholas Caporusso.  Deepfakes for the Good: A Beneficial Application of Contentious Artificial Intelligence Technology, pages 235–241.  01 2021.
  * [12] Tao Li and Lei Lin.  Anonymousnet: Natural face de-identification with measurable privacy, 2019\.
  * [13] Oran Gafni, Lior Wolf, and Yaniv Taigman.  Live face de-identification in video.  In 2019 IEEE/CVF International Conference on Computer Vision (ICCV), pages 9377–9386, 2019.
  * [14] Bingquan Zhu, Hao Fang, Yanan Sui, and Luming Li.  Deepfakes for Medical Video De-Identification: Privacy Protection and Diagnostic Information Preservation, page 414–420.  Association for Computing Machinery, New York, NY, USA, 2020.
  * [15] Nisha Srinivas, Karl Ricanek, Dana Michalski, David S. Bolme, and Michael King.  Face recognition algorithm bias: Performance differences on images of children and adults.  In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 2269–2277, 2019.
  * [16] Ralph Gross, Edoardo Airoldi, Bradley Malin, and Latanya Sweeney.  Integrating Utility into Face De-identification.  In George Danezis and David Martin, editors, Privacy Enhancing Technologies, Lecture Notes in Computer Science, pages 227–242, Berlin, Heidelberg, 2006. Springer.
  * [17] Seong Joon Oh, Rodrigo Benenson, Mario Fritz, and Bernt Schiele.  Faceless Person Recognition: Privacy Implications in Social Media.  In Bastian Leibe, Jiri Matas, Nicu Sebe, and Max Welling, editors, Computer Vision – ECCV 2016, Lecture Notes in Computer Science, pages 19–35, Cham, 2016. Springer International Publishing.
  * [18] Ning Zhang, Manohar Paluri, Yaniv Taigman, Rob Fergus, and Lubomir Bourdev.  Beyond frontal faces: Improving person recognition using multiple cues.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2015.
  * [19] Richard McPherson, Reza Shokri, and Vitaly Shmatikov.  Defeating Image Obfuscation with Deep Learning.  arXiv:1609.00408 [cs], September 2016.  arXiv: 1609.00408.
  * [20] Jianping Fan, Hangzai Luo, Mohand-Said Hacid, and Elisa Bertino.  A novel approach for privacy-preserving video sharing.  In Proceedings of the 14th ACM International Conference on Information and Knowledge Management, CIKM ’05, page 609–616, New York, NY, USA, 2005. Association for Computing Machinery.
  * [21] Yifang Li, Wyatt Troutman, Bart P. Knijnenburg, and Kelly Caine.  Human perceptions of sensitive content in photos.  In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 1671–16716, 2018.
  * [22] Sachit Mahajan, Ling-Jyh Chen, and Tzu-Chieh Tsai.  Swapitup: A face swap application for privacy protection.  In 2017 IEEE 31st International Conference on Advanced Information Networking and Applications (AINA), pages 46–50, 2017.
  * [23] Qianru Sun, Liqian Ma, Seong Joon Oh, Luc Van Gool, Bernt Schiele, and Mario Fritz.  Natural and effective obfuscation by head inpainting.  In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5050–5059, 2018.
  * [24] Werner Bailer and Martin Winter.  On improving face generation for privacy preservation.  In 2019 International Conference on Content-Based Multimedia Indexing (CBMI), pages 1–6, 2019.
  * [25] Zhenzhong Kuang, Huigui Liu, Jun Yu, Aikui Tian, Lei Wang, Jianping Fan, and Noboru Babaguchi.  Effective De-Identification Generative Adversarial Network for Face Anonymization, page 3182–3191.  Association for Computing Machinery, New York, NY, USA, 2021.
  * [26] Leslie Wöhler, Martin Zembaty, Susana Castillo, and Marcus Magnor.  Towards Understanding Perceptual Differences between Genuine and Face-Swapped Videos.  In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems, CHI ’21, pages 1–13, New York, NY, USA, May 2021. Association for Computing Machinery.
  * [27] Rashid Tahir, Brishna Batool, Hira Jamshed, Mahnoor Jameel, Mubashir Anwar, Faizan Ahmed, Muhammad Adeel Zaffar, and Muhammad Fareed Zaffar.  Seeing is Believing: Exploring Perceptual Differences in DeepFake Videos.  In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems, CHI ’21, pages 1–16, New York, NY, USA, May 2021. Association for Computing Machinery.
  * [28] Catherine Lord, Michael Rutter, Pamela C DiLavore, Susan Risi, Katherine Gotham, Somer L Bishop, et al.  Ados.  Autism diagnostic observation schedule. Manual. Los Angeles: WPS, 1999.
  * [29] Catherine Lord, Michael Rutter, Pamela C DiLavore, Susan Risi, Katherine Gotham, and Somer L Bishop.  Autism diagnostic observation schedule: Ados-2.  Western Psychological Services. Los Angeles, CA, 2012.
  * [30] Ivan Perov, Daiheng Gao, Nikolay Chervoniy, Kunlin Liu, Sugasa Marangonda, Chris Umé, Mr. Dpfks, Carl Shift Facenheim, Luis RP, Jian Jiang, Sheng Zhang, Pingyu Wu, Bo Zhou, and Weiming Zhang.  Deepfacelab: Integrated, flexible and extensible face-swapping framework, 2021.
  * [31] Shervin Minaee, Ping Luo, Zhe Lin, and Kevin Bowyer.  Going deeper into face detection: A survey, 2021.
  * [32] Kaipeng Zhang, Zhanpeng Zhang, Zhifeng Li, and Yu Qiao.  Joint face detection and alignment using multitask cascaded convolutional networks.  IEEE Signal Processing Letters, 23(10):1499–1503, Oct 2016.
  * [33] Shifeng Zhang, Xiangyu Zhu, Zhen Lei, Hailin Shi, Xiaobo Wang, and Stan Z. Li.  S3fd: Single shot scale-invariant face detector, 2017.
  * [34] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.  Deep learning face attributes in the wild.  In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
  * [35] Andreas Rössler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner.  Faceforensics++: Learning to detect manipulated facial images, 2019.
  * [36] Adrian Bulat and Georgios Tzimiropoulos.  How far are we from solving the 2d & 3d face alignment problem? (and a dataset of 230,000 3d facial landmarks).  In International Conference on Computer Vision, 2017.
  * [37] Florian Schroff, Dmitry Kalenichenko, and James Philbin.  Facenet: A unified embedding for face recognition and clustering.  2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Jun 2015.
  * [38] Yaniv Taigman, Ming Yang, Marc’Aurelio Ranzato, and Lior Wolf.  Deepface: Closing the gap to human-level performance in face verification.  09 2014.
  * [39] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou.  Arcface: Additive angular margin loss for deep face recognition, 2019\.
  * [40] Fei Wang, Liren Chen, Cheng Li, Shiyao Huang, Yanjie Chen, Chen Qian, and Chen Change Loy.  The devil of face recognition is in the noise.  arXiv preprint arXiv:1807.11649, 2018.
  * [41] Enrico Vezzetti and Federica Marcolin.  3d human face description: landmarks measures and geometrical features.  Image and Vision Computing, 30(10):698–712, 2012.  3D Facial Behaviour Analysis and Understanding.
  * [42] Davis E. King.  Dlib-ml: A machine learning toolkit.  J. Mach. Learn. Res., 10:1755–1758, 2009.
  * [43] Vahid Kazemi and Josephine Sullivan.  One millisecond face alignment with an ensemble of regression trees.  In 2014 IEEE Conference on Computer Vision and Pattern Recognition, pages 1867–1874, 2014.
  * [44] Octavio Arriaga, Matias Valdenegro-Toro, and Paul Plöger.  Real-time convolutional neural networks for emotion and gender classification, 2017.
  * [45] Ian J. Goodfellow, Dumitru Erhan, Pierre Luc Carrier, Aaron Courville, Mehdi Mirza, Ben Hamner, Will Cukierski, Yichuan Tang, David Thaler, Dong-Hyun Lee, Yingbo Zhou, Chetan Ramaiah, Fangxiang Feng, Ruifan Li, Xiaojie Wang, Dimitris Athanasakis, John Shawe-Taylor, Maxim Milakov, John Park, Radu Ionescu, Marius Popescu, Cristian Grozea, James Bergstra, Jingjing Xie, Lukasz Romaszko, Bing Xu, Zhang Chuang, and Yoshua Bengio.  Challenges in representation learning: A report on three machine learning contests, 2013.
  * [46] American Psychiatric Association.  Diagnostic and statistical manual of mental disorders: Dsm-5.  Arlington, VA, 2013.

Figure 9: Additional visual pairings between original faces (top) and the face
swaps produced by our system (bottom).