How secure is our face blur?

Our old Mosaic effect processed the face three times: first to soften it, then twice to turn it into blocks. When we investigated whether more passes would help, we found a problem that more pixelation wasn't going to fix.

The soft edge was mixing some of the original picture back into the result. And in a video, a cover could fade or disappear for part of a tracking gap. Processing the face again didn't help at a moment when the cover wasn't there.

Those are the things we changed. The treatment now fills the whole coverage circle, new covers have no fade, and lost tracking holds a larger cover on screen for you to review. Solid also lets you replace the covered facial pixels with a color, while Blur and Mosaic keep altered versions of the face.

This matters to the videos we make for Baby Acrobatics, where our children appear in movement demonstrations on Instagram while their faces, names and other personal details stay private. The edit has to hold through the movement and into the file people actually receive.

Did we use multiple passes?

Yes. The earlier Mosaic effect shrank and enlarged the picture to soften it, applied a coarse grid, then applied another grid shifted by half a block.

The current Mosaic works differently. It takes the pixels in each block and fills that block with their average color. Imagine mixing the colors from one small square of the picture in a paint pot, then painting the square with the result. The fine arrangement within that square is gone, but its color still comes from the face. Across the blocks, some broader shape remains too.

Blur still uses three rounds of smoothing, called box-blur passes, to approximate a Gaussian blur. That's how we draw the soft effect. It doesn't mean there are three separate protections to get through.

New covers start with Blur and no fades. When you choose another effect, subsequent covers in that editing session use that choice too. If you want the shared copy to retain less facial information, select Solid and make it large enough to contain the whole face.

What the extra passes missed

To examine the old edge, we used a test picture made of tiny light and dark squares. After saving the edit as a JPEG, we measured how much of that pattern's contrast survived in a narrow band near the cover's edge.

Here is what happened with the old renderer at its default softness:

The extra passes barely changed that edge because the untouched picture was being blended back in after the processing. Making the full circle opaque removed that source of leakage. We moved the soft transition outside the circle, so changing softness no longer makes its interior partly untreated.

These percentages measure a checkerboard pattern, not a face. The last result doesn't mean “99.6% secure.” A coarse mosaic can erase tiny squares while preserving the larger shapes useful for recognizing a person. The experiment answered why that edge leaked and whether the change fixed it.

When placing a cover, use the circle itself as the boundary. The soft halo outside it can fade into the picture; a cheek sitting in that halo isn't fully covered.

The cover also has to be there

The old tracking behavior could leave more than half a second completely uncovered during a one-second gap between detections. A stronger mosaic in the frames on either side wouldn't change the clear frames in between.

The app now holds an enlarged cover spanning the known positions. Choose Review gap to go to that interval and watch where the face went. If the child moved outside the held area, correct the cover there using the video guide. The larger area gives you coverage to work with; it doesn't establish where an undetected child was.

New covers also start without fades. You can add one, but fading makes the original show through while the cover appears or disappears. Keep fades at zero when the face needs continuous coverage.

We fixed export timing as well. Previously, the time used to position a cover could differ from the video frame being saved, leaving a boundary frame uncovered. Covers now use the saved frame's timing. Extending a track's end holds its last known position, so that extension doesn't create a new gap inside the track.

What we tested, and what we haven't

For Solid, we changed the picture underneath the cover while keeping everything outside it the same, then saved it again. In those cases the covered output didn't change. The same check passed for all eight Emoji options with their solid backing. That checks whether the covered source pixels still affect the saved image.

For movement, the September 5 test used four short video exports: a full and a trimmed clip through each of the app's two export methods. All 182 decoded frames passed the coverage and timing checks, including the first and last covered frames and controlled tracking gaps. Markers in the test video identified which source frame was actually saved.

These were synthetic images and clips exported in Chrome on macOS. They check the drawing and saving of known covers. They don't measure how often scanning misses a real face or how well Blur and Mosaic resist identification. The recorded test notes contain the examples, browser version and results.

Could AI still identify someone?

Yes. In Defeating Image Obfuscation with Deep Learning, researchers trained models to recognize people from blurred or pixelated pictures. Those models had learned from examples of the people they were later asked to identify. They didn't need to reconstruct a sharp photograph to pick the person out.

The study didn't test this app, and we haven't established that our Blur or Mosaic resists recognition or reconstruction attacks. Both effects keep information from the face. Solid replaces the pixels it covers, but another clear frame, a voice or a named caption can still identify the child.

An AI-generated face that looks convincing is another possibility: it may simply be an invention. The AI unblurring guide separates those outcomes so a polished demonstration doesn't get mistaken for recovery of the original.

What to do before sharing

Select Solid if you want to replace the facial pixels rather than soften them. Fit the whole face inside it, leave fades at zero and review any tracking gaps. Emoji also has an opaque backing in this tool; it needs the same coverage check.

Then save a new copy and open that file. The cover is part of its pixels, with no separate sticker layer a recipient can turn off. Watch it with sound, especially at entrances, exits and head turns. If you hear a name or address, remove that part of the audio before sharing, and check the location data and caption.

If an uncovered version is already online, remove that posted copy as well.