How to Blur Faces in Photos Without Leaving a Way Back

You have a folder of photos ready to publish. A school sports day, a site inspection, a street scene shot for a case study. Somewhere in the frame there are people who did not agree to appear. So you reach for the blur tool, drag a soft-edged rectangle over each head, export, and move on.

That is the intuitive answer to how to blur faces in photos, and for a lot of situations it is fine. But the assumption underneath it — that a blurred face is a face that has been removed — is not something you should take on faith. Researchers have spent years testing exactly that assumption, and the results are worth knowing before you publish.

Blurring is a transformation, not a deletion

It helps to be precise about what a blur actually does. It does not delete the pixels containing a face. It replaces them with a mathematical function of those pixels: a weighted average of each pixel and its neighbours. The output still carries information derived from the input. The question is how much, and whether that residue is enough to work backwards from.

This is the framing used in Fantômas: Understanding Face Anonymization Reversibility, a paper by Julian Todt, Simon Hanisch and Thorsten Strufe accepted to Proceedings on Privacy Enhancing Technologies. The authors describe anonymisations as transformations applied to clear images to obfuscate sensitive information while retaining some utility. They then set out to test which of those transformations can be undone.

Their finding is blunt. Of 15 face anonymisation approaches tested, 11 were at least partially reversible. The paper identifies two underlying processes that make reversal possible: reconstruction and inversion. In the authors' framing, reversing an anonymised image so it resembles the real input — and can be identified by face recognition — is "the strongest indicator for flawed anonymization."

The practical takeaway is not that blurring is useless. It is that "I applied a blur" and "this person cannot be identified" are two different statements, and the first does not automatically produce the second.

Why weak blurs leak, in mechanical terms

Think about what a light Gaussian blur preserves. Head shape and outline. Skin tone. Hair colour and rough hairline. The dark regions where eyes and mouth sit. The angle of the head. Relative distance between features, smeared but not erased.

If you know the blur kernel — and a standard blur in standard software is not a secret — the transformation is a known operation with a known amount of information loss. That is what makes reconstruction and inversion, the two mechanisms the Fantômas authors highlight, tractable problems rather than impossible ones. A model can be trained to map blurred faces back toward plausible sharp faces, and the closer the residue leaves it to the original, the better that mapping works.

Two things follow for anyone applying face blurring by hand:

A stronger blur removes more. A blur radius chosen so the result still "looks like" the person is a blur that has kept the information that makes them look like themselves. If a colleague can glance at the output and say who it is, the anonymisation has not done its job.

Small faces need proportionally more. A face occupying 40 pixels of frame and a face occupying 400 pixels do not need the same blur radius. The radius has to scale with the size of the region, or distant faces in a crowd shot end up under-treated while the foreground subject is heavily obscured.

If you would rather not judge radius by eye across a batch, our face blurring tool applies the treatment automatically across images and video.

The alternative: replace rather than smear

There is a second line of research that takes a different route. Instead of degrading the original face, it generates a new one.

iFADIT, by Lin Yuan and colleagues, is an example. Its starting observation is the same one you would arrive at by trial and error: blurring and pixelation remove much of the identifying detail, but they significantly degrade image quality and are vulnerable to deep reconstruction attacks. Generative models offer a way to anonymise a face while keeping a natural appearance.

The iFADIT framework separates identity information from non-identifying attributes, then transforms the identity component using a flow-based model controlled by a secret key. The anonymised face is rendered through a pre-trained StyleGAN so the output has realistic facial detail. Because the transform is invertible, the original face can be recovered by anyone holding the matching secret — which the authors note is valuable in contexts such as image forensics.

Notice what that means for your purposes. Invertibility is a feature in iFADIT, deliberately built in. It is exactly what you do not want if your goal is publishing a photo that can never be walked back to the person in it. The same paper that demonstrates high-quality generative anonymisation also demonstrates that "the face looks natural and different" and "the original is unrecoverable" are separate properties, and a system can be designed to have the first without the second.

So when you evaluate any approach to anonymise photos, the question to ask is not only how convincing the output looks. It is whether recovery is possible, and for whom.

Faces are rarely the only identifier in frame

A blur that handles every face perfectly can still leave a photo that identifies someone. Consider what else sits in a typical frame:

A license plate, which links a vehicle to a registration. A distinctive tattoo, which is a durable visual identifier tied to one person. And the file's own metadata — EXIF fields that can record capture time, device, and in many cases GPS coordinates. None of that is touched by drawing a blur over a face.

This is why treating anonymisation as a per-photo review rather than a single action matters. Scanon.ai detects and redacts faces, license plates, and tattoos in images and video, and strips EXIF metadata from the images it processes. You can see the range in the blurring tools overview, or go directly to the license plate tool and the tattoo blurring tool.

A working method

Pulling the above together into something you can apply to a batch:

Decide the standard before you start. Are you obscuring faces so a casual viewer cannot tell who someone is, or so that recovery is not feasible? The Fantômas results suggest these are meaningfully different bars, and the second is harder to clear than the first.

Scan the whole frame, not just the obvious subject. Faces in the background, in reflections, in the middle distance. Plates. Tattoos. Anything visible that belongs to one specific person.

Scale the treatment to the region. A fixed blur radius applied across a whole batch will over-treat some faces and under-treat others.

Check the metadata separately. Visual redaction and metadata removal are independent steps. A perfectly blurred image can still carry the coordinates of where it was taken.

Keep a record. If someone asks later whether a published image was processed, having something verifiable is more useful than remembering that you did it. Scanon.ai can issue a redaction certificate that allows a processed document to be verified later at scanon.ai/verify.

Work on copies. Redaction should be irreversible in the published output. That means the originals live somewhere else, under whatever access controls you already use.

If you are publishing family photos, classroom material, or video with bystanders in it, the guidance written for parents and creators covers the same ground with those situations in mind.

What the research changes about the everyday question

The honest version of how to blur faces in photos is less satisfying than a one-click answer. Blurring is a transformation of the original, not its removal, and the strength of that transformation determines whether anything useful survives. Fifteen approaches were tested for reversibility in the Fantômas work and eleven gave something back. A more recent framework shows that recovery can be engineered in on purpose.

None of that argues against blurring. It argues for blurring with intent: strong enough for the region, applied to every identifier in the frame rather than the face alone, with metadata handled as its own step. That is a checklist, not a judgement about what any particular publication requires — the standard that applies to your work is yours to determine.

Frequently asked questions

Sources

• https://arxiv.org/abs/2210.10651
• https://arxiv.org/abs/2501.04390