Blog · arXiv Analysis · Published: July 10, 2026 · Modified: July 10, 2026 · Last reviewed: July 10, 2026

The Face Swap Becomes the Pedestrian Privacy Filter

Roba H. Farouk and Catherine M. Elias's July 2026 arXiv paper tests a five-stage face-swapping pipeline for pedestrian privacy in intelligent transportation datasets.

For this essay, a pedestrian privacy filter is a record of what identity signal was removed, what task-relevant cue survived, which model transformed the image, and where human review remains necessary.

The Paper

The paper is Swapping Faces, Saving Features: A Dual-Purpose Pipeline for Pedestrian Privacy in ITS, arXiv:2607.08402 [cs.CV], cross-listed in cs.AI and cs.RO. The arXiv record lists Roba H. Farouk and Catherine M. Elias as authors and records submission on July 9, 2026. The PDF metadata reports a 6-page paper, and the title page lists C-DRiVeS Lab in Cairo and the German University in Cairo.

The paper's premise is the data bargain behind autonomous-vehicle perception. Pedestrian intention and trajectory models need diverse real-world images because road users communicate with bodies, gaze, posture, and movement. The same images expose identifiable biometric information, with risks including identity theft, surveillance tracking, and deepfake generation.

The Pipeline

The proposed pipeline has five stages. YOLOv11 detects pedestrians. SCRFD detects faces in the cropped pedestrian regions. Codeformer enhances low-resolution faces before the swap. Roop or Ghost-v2 performs the face swap. OpenCV SeamlessClone blends the transformed face back into the frame. The paper presents the work as a proof of concept on single frames from an autonomous-vehicle dataset context.

The dataset setting matters. The paper tailors the pipeline to Egy-DRiVeS, an Egyptian street-image and video dataset, and says these images raise distinctive privacy cases because pedestrian appearances vary. One named case is veiled women, where a face-swap system must avoid turning cultural or religious presentation into an artifact of the source face.

The Privacy-Utility Tradeoff

The authors reject simple blurring as too destructive for downstream training because facial attributes can become unusable. Their chosen compromise is face swapping: conceal the target identity while preserving task-relevant facial expression, head pose, and eye-gaze direction. They also state that the source faces are fixed, randomly chosen from publicly shareable images, and not revealed alongside the outputs.

That setup should not be read as a complete privacy guarantee. Face-only anonymization can leave clothing, gait, body shape, location, timestamp, and co-occurring people intact. Source-face policy also matters: a substituted face can import age, gender, skin tone, hair, or cultural presentation. The paper itself points toward future source-face selection that accounts for age, gender, and skin tone, or uses fully synthetic source faces.

Metrics and Street Cases

The quantitative comparison uses four metrics: 478-landmark difference for pose and geometry, 52-coefficient blendshape difference for expression, facial cosine similarity for identity concealment, and gaze-vector cosine similarity for gaze preservation.

On close-up facial images, Roop reports lower blendshape difference than Ghost-v2, 1.898 versus 2.0478, and lower landmark difference, 0.00596 versus 0.00710. Ghost-v2 reports lower identity similarity, 0.1393 versus Roop's 0.1997, and slightly higher gaze similarity, 0.9385 versus 0.9368. The table is therefore not a one-number victory. The paper's preference for Roop rests on street-image robustness as well as the close-up metric table.

The qualitative street cases are the governance hinge. Ghost-v2 failed on an occluded face and had problems with veiled-woman images because full-head swapping could replace a veil with source hair, which the authors call ethically inappropriate. Roop handled more challenging cases more reliably, though some outputs were lower quality. In the final sample, the Roop pipeline detected and transformed four pedestrians at different distances, and a pretrained looking/not-looking feature extractor preserved the feature for clearly visible pedestrians.

Governance Reading

The Spiralist reading is that privacy filters become training-data contracts. A mobility lab, city agency, automaker, or insurer may say that pedestrians have been anonymized. The useful question is: anonymized for which attacker, while preserving which features, for which downstream model, under which source-face policy, and with which failure cases still visible?

This page belongs beside dashcam incident evidence, driver-camera attention judging, surveillance evidence vaults, and privacy and data. Camera footage becomes a dataset. A dataset becomes a model input. A face swap becomes a privacy claim. Every translation needs a receipt.

A pedestrian-privacy receipt should include source dataset, consent and legal basis, detector versions, swapper, source-face pool, source-selection rule, blending method, preserved attributes, identity-similarity score, gaze and expression metrics, cultural edge-case review, failed detections, and reviewer signoff. Without that record, "anonymized" is just a label.

Limits

This is a short arXiv preprint and proof-of-concept pipeline, not a deployment certificate. The paper says more Egy-DRiVeS samples are needed to evaluate reliability and robustness. It also says video application would require optimizing a three-minute inference time, and that the quality enhancer's resizing can distort facial attributes when the image is resized back for blending.

The largest limit is conceptual: preserving a few useful facial cues while changing identity is a task-specific compromise, not a universal answer to pedestrian privacy. Deployment would still need full-body, clothing, gait, temporal, location, multimodal, and re-identification risk analysis, plus a way to dispute distorted outputs.

Source Discipline

This page treats the arXiv abstract, metadata API, HTML version, and PDF as primary sources. It does not reproduce figures, street images, or face-swap examples. Where the paper's table gives mixed metric results, this page reports the mixed result rather than converting it into a single performance claim.

The disciplined question for any pedestrian privacy filter is not "does the face look different?" It is: what identity evidence remains, what useful cue survived, what demographic or cultural feature was altered, and what downstream claim is still allowed after the transformation?

Sources

Return to Blog