Think about what a blur actually does to an image. It does not delete the pixels underneath. It averages them with their neighbours. The information is still present, spread across a wider area and attenuated, in the way a voice in a noisy room is attenuated rather than absent. Whether it can be recovered is a question about the listener, not the room.
For twenty years the listener was a human being squinting at a screen, and blurring was sufficient. That is no longer the situation.
What the measurements say
A 2024 study tested fifteen face anonymisation methods against a general-purpose deep-learning attacker. Eleven of the fifteen proved at least partially reversible. Block permutation and pixel relocation, which are pure transformations, recovered above 90% recognition accuracy — unsurprising, since nothing was destroyed. More importantly, Gaussian blur, pixelation, added noise and eye masking landed between 30% and 70%. Only methods that removed the face and generated a replacement stayed below 15%.
An earlier and blunter result: against a set of 530 individuals, where random guessing scores 0.19%, mosaic obfuscation at a 16×16 window still permitted 57.6% top-one identification. YouTube-standard blurring on a smaller set permitted 57.8%. These are not marginal recoveries. They are a majority of faces correctly named.
An obfuscation that a network can invert is not an anonymisation. It is a rendering choice that happens to inconvenience humans.
And in 2025 a diffusion model was demonstrated restoring Gaussian-blurred faces, performing better at high blur settings than at low ones. The intuitive defence — blur harder — turns out to point in the wrong direction, because a heavier kernel produces a smoother, more predictable prior for a generative model to work against.
The part specific to us, and to everyone like us
There is an attack that does not require a neural network at all, and it is the one that should concern any company operating cameras on vehicles.
Pixelation replaces a region with a grid of averaged blocks. If the camera moves relative to the subject — and a camera mounted on a vehicle always does — then consecutive frames sample that region at slightly different sub-pixel offsets. Stabilise the frames, stack the offsets, and the effective resolution rises with the number of frames. No guessing is involved. The information was distributed across time rather than destroyed, and time is trivially reassembled.
NIST wrote the warning down in 2015: technology exists for de-pixelating and de-blurring video by combining multiple images. It was a footnote then. A dashcam fleet is the ideal input for it.
So the industry’s standard technique fails, and it fails hardest on the industry’s standard platform.
Plates are worse than faces
A face is a complicated object with enormous natural variation. A licence plate is a short string drawn from a thirty-six character alphabet, in a known typeface, at a known aspect ratio, on a rectangle of known proportions. That is very close to the easiest recovery problem in computer vision.
Research from Dartmouth on severely degraded plates found that at a plate width of 25 pixels and a modest signal-to-noise ratio, a convolutional network scored 75.2% top-one and 96.8% top-ten on three-character groups, against a chance rate of 0.002%. At 15 pixels wide, top-ten was still 54.9%. A correlation attack at that width read individual characters correctly 98.4% of the time in conditions where human observers managed 2.8%.
Which retires a defence we have all heard: the plate was too small and too blurry to read. It was too small and too blurry for you.
What the regulators actually ask
Here is the part that turns this from an engineering observation into a compliance one. European guidance sets no coverage percentage anywhere — we looked, across the EDPB video guidelines, the German supervisory authorities’ joint guidance, and the French regulator’s doctrine. What it sets instead is a reversibility test.
The EDPB describes blurring “with no retroactive ability to recover” the data, at which point the data count as erased. The German authorities are more direct: material remains personal data if the masking can subsequently be undone. The French regulator asks for irreversible blurring performed without human intervention.
Put the literature and the guidance side by side and the conclusion is uncomfortable for the whole category. The test is reversibility. The standard technique is reversible. Therefore the standard technique does not meet the test — not at 99% detection, not at 99.9%, not at any detection rate, because detection is not the failing part.
What does work
Two things, and neither is subtle.
- Overwrite the pixels. Fill the region with a constant. The information is gone because it has been replaced rather than transformed. Ugly, and it destroys the region for any downstream use.
- Replace the face with a different face. Generative substitution keeps the image useful for machine learning — a person is still present, occupying space, facing a direction — while the identity underneath is simply not there. This is the approach that held below 15% in the reversibility testing.
There is a real objection to the second one, and it was raised by Google in 2009 when they built the largest redaction system in the world. They rejected generative replacement deliberately, on the grounds that redaction should be visible as redaction — a blurred face tells the public that something was done, while a swapped face conceals the fact that anything happened at all. That is a serious argument about public trust and we do not think it has been answered.
What has changed since 2009 is that the alternative no longer works. A visible mark of redaction that does not redact is worse than an invisible one that does.
What would change our mind
A demonstration that the stacking attack fails against a specific blur implementation at production frame rates and realistic camera motion. We have not seen one. If it exists we would rather know, because overwriting pixels is expensive and it costs us data we would like to keep.
What we are least sure about
Whether generative replacement survives the next four years of attack research the way it has survived the last two. It is a newer technique with a thinner literature behind it, and the recovery methods are improving faster than the obfuscation methods. We are choosing it because the evidence today favours it, not because we believe it is permanent.
And a broader limit worth stating plainly. A correctly redacted frame is not an anonymous frame. Research using twenty-five million dashcam images from New York found that group-level inference remained possible from clothing, posture and spatial context even where blurring had been applied correctly. Removing a face removes a face. It does not remove a person from a scene.