If you do something really simple like a Gaussian blur (which is a type of convolution), it might be possible to find the inverse convolution (de-convolution) and restore the original image with some accuracy.
One method is the Lucy-Richardson deconvolution [1], which is an iterative algorithm, and here [2] is the best practical example I could find right away. Unfortunately the text is not in English, but the illustrations and formulae might be enough to give some intuition of the process.
Yes this is possible before JPEG compression, because convolution removes fairly little information but once you compress using JPEG you remove the frequency components that make it reversible.
That's the problem - the data you think is gone isn't gone. High frequencies are gone.... but you left all the low frequencies, didn't you? You can read a face from the low frequencies.
If you blur then mosaic, or vice-versa, then presumably you get rid of the low and high frequencies? Depending on the detail shown in the original image either, or both, might remove enough information to render the image anonymised.
How about replace each face with a "this is not a person" AI generated face, then blur+mosaic. Or just a non-person face using a deepfake system that matches the facial expression?
Don't tell people what not to do. Figure out why they're doing it, and provide what they actually want while still achieving the goals (here: security).
Very coarse mosaic, add noise, then blur seems reasonably safe, and doesn't have to look like crap.
"seems reasonably safe" seems like a terrible cryptographic analysis. in fact, given that we already know that both blurring and mosaicing are individually reversible, and noise is easily removable from a sufficiently wide mosaic, this seems like a particularly terrible algorithm. that's not the point though: any man can create an encryption algorithm that he himself cannot break. maybe you can come up with an obfuscation algorithm that cannot be trivially broken, but that doesn't mean it's even remotely a good idea.
I was writing a HN comment, not a scientific paper, which is why I wrote "seems safe" instead of making stronger claims.
I'd also like to know how mosaicing is reversible, since it demonstrably reduces the total available amount of information from e.g. 20x20 = 400 RGB values to a single RGB value. This is not sufficient for text where you can start brute-forcing individual options because the search space is small and inputs can be reconstructed precisely, but I'd like to see an explanation why you think this is reversible for photos (even without noise added). I'd also like to know how you want to remove random noise applied to each mosaic block.
The mosaicing is supposed to be the security step here. The blur is optional eye candy not expected to remove further information.
In particular, if you claim that a face mosaiced with a large "pixel" size (e.g. so that the typical face is 5x5 "mosaic blocks" big), you're effectively claiming that you can perform facial recognition based on noisy 5x5 pixel images.
it doesn't matter though. as I've explained, it's far easier to come up with flawed schemes than prove them insecure. just because I can't explain why your specific scheme is insecure doesn't mean it stands a chance against real cryptographers.
The 20x26 example is indeed scary, but in line with what was known about facial recognition. (It also becomes a bit less scary when you don't look at a zoomed-in version of the image.)
Hence my suggestion to reduce a face to something like 5x5 blocks.
While I'm familiar with the crypto design problem, this is not a crypto algorithm. Sure, it can't be ruled out that someone in the future will find a way to do it, but the state of the art says that 5x5 pixels are not anywhere near enough to run face recognition.
And a solution that may be broken in the future is often much better than a solution that people don't use because it doesn't meet their needs, which in this case is not having fugly black boxes in their picture.
I would be worried that a generated fake face would be similar enough to the face of a real someone, somewhere, to get that person in trouble. This isn't a crisp portrait photo; a blurry cell phone video with a lot of activity and noise already kind of leaves an opening for mis-identification.
I think people are stumbling over the word "reverse" here. A common use of "reverse" is to undo. And you're 100% right that you cannot undo the destruction of information.
But instead, "reverse" is being used here to mean something like analyze or to apply countermeasures to defeat the obfuscation.
Very minor but interesting nitpick: the font used on checks is not OCR (optical) but MICR (magnetic ink). The design objectives are different and different font families exist for the two purposes. MICR as used on checks (more properly called E-13B) bears unusual, distinctive character shapes emphasizing abnormally wide horizontal components due to the need for each character to have a distinctive waveform when read as density from left to right, essentially by a tape recorder read head. Fonts optimized for OCR are usually more normal looking to humans because they emphasize clear detection of lines instead.
E-13B is a bit of an ideal use case for this method because of the highly constrained character set used on checks and the unusually nonuniform density of E-13B. The same thing can be done on text more generally but gets significantly more difficult.
Blur is in effect a lowpass filter on the image. The high frequency information is gone. Reconstruction based on domain knowledge, like AI methods etc is unlikely to be able to reconstruct the distinguishing features between people enough to avoid false positives when used to search for similar people.
Then again, maybe groups of people can be associated together, and a poor match is good enough given other clues.
So, much better to be safe than sorry.
I'm not sure if I had a particular good point to make, other than that blurring does remove information that cannot easily be reversed. You can probably make very convincing reconstructions, but they might not look like the original person.
I don't when de-blurring would be a novel idea. I think newer methods that use machine learning can produce very good results. But the math of it is much older than any computer implementation.
If you remove high frequency details, you in effect remove distinguishing features. That it is possible to create an absolutely convincing high-detail image that if blurred, gives the same "original" blurred image doesn't mean you have the correct deblurred image.
With not too fancy methods, I'm pretty sure you can make a blurred image identify as any multiple people.
I don't think this is a controversial statement either. In any case, this is a tangential discussion, since blurring to hide identities is a flawed method to begin with. With video recording, tracking, grouped individuals, etc, I'm sure reconstruction with good databases of likely subjects can have some surprising accuracy. So, better to avoid it altogether.
That said, one image, sufficiently blurred with a proper low-pass filter (i.e not a softer gaussian type, but one that just removes frequency ranges altogether), will absolutely not contain information to identify someone. The information literally isn't there. A large number of people are an equally good match, and then no one is. But, since combined with other methods I mentioned, it's a bad idea, then, yes, it's a bad idea.
True. I think the reasonable assumption would be a low-pass filter that removes high frequencies altogether. A gaussian filter wouldn't be a particularly good idea.
I mean, if you have a prior probabilistic model for what a face looks like, you could combine that with standard deconvolution and get a scary good reconstruction I imagine
You can get a scaryly real like looking high detailed image that blurs to something really close to the original blurred image. Yet, it won't look like the original image, and won't identify the person.
Any examples? You can't reverse it if the data is gone.