AI Can Rebuild Blurred Faces, So How Do We Protect People Now?

There is a trope in crime science investigation television shows. The lead investigator leans over a forensic expert and says “Enhance the image,” and after a few clicks, a blurry face snaps into focus. For years, we used this clip in human rights documentation and verification training to mock Hollywood, stating that you can’t enhance what’s not there. We believed pixels don’t magically appear. However, that was years ago, and times have changed.

Last year, as new AI tools and capabilities emerged at breakneck speed, a question began to nag at us as human rights workers focused on visual research: are the blurs we rely on to protect people in photos and videos still doing their job? Or with enough time, tooling and incentive, could a government, a well-resourced actor, or even a motivated individual now reverse them?

Many human rights organizations and media outlets frequently use blurs to obscure the identities of people for their protection, to protect their security, privacy or dignity, or to reduce our readers’ exposure to distressing content. As a test, we took a published photograph of two children with their faces blurred and ran it through some commercially available AI “refocusing” tools, and facial structure re-emerged. Features sharpened. A plausible face appeared. Even if the reconstructed image did not reveal the children’s actual faces, it narrowed anonymity. It suggested age, gender, ethnicity, and resemblance. It moved the image closer to identity, and thus closer to harm. The question is not whether these tools are perfectly accurate today, but where they are heading.

This is no longer a hypothetical question. In January 2026, NPR reported on online users attempting to identify the ICE agent who fatally shot Renee Nicole. Using AI tools, they transformed a partially obscured image into a generated, reconstructed face, one that could potentially be compared against databases. The original photograph was never intended to reveal biometric data. AI turned it into something that could. The line between “non-identifying” and “identifiable” collapsed.

This is not new behavior. People have previously used open-source refocusing tools to identify Tinder users who “liked” their profiles, demonstrating both the feasibility of reversal and the existence of actors willing to attempt it. Media forensics expert Hany Farid shared a case with us from nearly 20 years ago, in which a serious criminal had posted photos of themselves online and used a spiral blur to hide their face. By simply reversing the blur with the same tool that created it, Photoshop, the individual was identified, leading to their arrest. Today’s AI shortcuts make that process faster and far more accessible. What has changed is scale, accessibility, and power—AI now amplifies these capabilities exponentially. For activists, witnesses, children, and bystanders, the stakes couldn’t be higher.

When we showed that crime scene clip in our training years ago, we were right, but only partially. The core problem is this: traditional blurring techniques—Gaussian blur, pixelation, soft focus—do not fully remove or obscure information. They degrade it. In photos and videos, blurring reduces spatial detail by averaging or obscuring pixel values. To humans, this loss of detail looks like disappearance: faces become indistinguishable, features seem unreadable. But to machines trained to recover a signal from noise, the underlying information often remains present. It is distorted, but not erased.

Blurring was designed for human eyes, not machine vision. Modern computer vision systems are explicitly trained to operate under degraded conditions: low resolution, motion blur, extreme angles, partial occlusion, and noise. In the era of generative AI, blurring is increasingly ineffective as a protection measure. Diffusion models, for example, are designed to reconstruct images by progressively denoising random patterns. When blur or pixelation is applied, it functions as a predictable form of noise, one that these models are especially good at reversing or approximating. Similarly, recognition systems are trained to infer identity from incomplete cues and can be inverted or paired with generative models to produce clean, plausible reconstructions, including frontal portraits. What appears lost to humans may remain recoverable to an algorithm. For human rights researchers, continuing to rely on blurring techniques risks creating a dangerous illusion of safety for people whose lives may depend on anonymity. If we think of the blur as visual identity encryption, that encryption has now been cracked, or is about to be.

These capabilities are no longer experimental. They are commercial, widely accessible through open-source models, and improving rapidly. And this shift is already changing practice. In 2024, Human Rights Watch revised how we film people who require anonymity for safety reasons. Rather than relying on darkness, blurring, or post-production effects, our teams now avoid capturing identifiable visual data in the first place—filming people looking away from the camera, behind an object, or filming their shadow and carefully excluding identifiable features, landmarks, and locations.

The ‘black square’ approach

To understand what this means in practice, we spoke with leading experts and asked a simple question: how robust are our blurs, really?

Every expert gave the same answer. There are no assurances that a blur applied today cannot be reversed tomorrow, through a process officially called deconvolution. Technological progress makes guarantees impossible.

Their most consistent recommendation was also the most blunt: if you need to protect identity, cover it completely. Faces, bodies, tattoos, license plates, buildings—remove them with solid blocks of color. The “black square” approach.

The uncomfortable technical truth is simple: if identifying information remains in an image, it can potentially be recovered. The only reliable way to prevent reconstruction is removal. Black squares work. Full redaction works. Once data is gone, it is gone.

Simple. But not quite. Blurring exists for a reason. We blur to protect bystanders, children, perpetrators, we blur a face, a body, a tattoo, a street sign with the idea that we are obscuring identities, reducing harm and publishing evidence responsibly all while still communicating to our readers an idea of what the image shows. A blur preserves context, and a hint of the face behind the blur. It allows a reader to understand what is happening without drawing attention to the act of redaction itself. It is visually familiar. It signals care without overwhelming the viewer. It preserves emotion and narrative flow.

Replacing blurs with black squares would introduce a new visual language, one that may initially feel harsh or distracting, or worse, it may remove the humanity from the image. Perhaps audiences would adapt. Perhaps they would not. Once you start to notice “black squares,” it becomes apparent that they are slowly making an appearance, and it seems that we are not alone in asking these questions. Just look at the recent Jeffrey Epstein-related photos the US Department of Justice released at the end of January 2025—not a blur as a method of redaction in sight.

But total redaction comes at a cost. Visual evidence remains essential for documenting abuse, countering denial, and amplifying voices that would otherwise be ignored. Images matter because they convey humanity, emotion, context, and credibility. Even a blurred face can still give a human presence to the atrocities we report on. Replacing that with a black square or complete visual erasure risks weakening our ability to communicate harm, mobilize empathy, advocate effectively, and ultimately contribute to change.

Using AI to mitigate AI-driven harm

All the experts we consulted suggested a second, more experimental approach: using generative AI itself as a protective layer.

The idea is counterintuitive. Instead of blurring a face, first replace it with an AI-generated version of the same face and then blur that face. This would ensure that if the blur is later reversed, what emerges is not the original person but a fabricated stand-in. Returning to the encryption analogy, if the encryption has been cracked, change what you are encrypting.

We tested this approach on footage of a child crying in an ambulance, with a few clicks in Photoshop, we selected and masked the face area, entered a short text prompt, and used the built-in generative fill tool to synthesize a new face. When blurred, we got back an older man looking like he was screaming in pain.

This approach raises a series of uncomfortable questions. Would people inadvertently add a sensitive face to AI training data? How accurate would the AI face be, and if it were too close to the person we were trying to protect, could that resemblance expose them (or someone who looks similar) to mistaken identity, with serious real-world consequences? There are also deeper ethical concerns. How comfortable are human rights organizations using generative AI to edit evidence? What will the cost be for the integrity of human rights evidence and human rights organizations themselves, exposing them to reputational harm for using generative AI to edit evidence? And, for those needing to blur-on-the-go or without access to expensive tools like Photoshop, how would this solution work for small media outlets and civil society organizations?

Third solution—a really, really strong blur

A third path was suggested: not blur alone, but blur as part of a layered anonymization pipeline. Instead of relying on a single visual transformation, this approach combines multiple degradations so that no single reversal technique is sufficient to reconstruct identity.

Experts emphasized that layering matters more than intensity. A single, heavy blur can still preserve structural signals that AI systems are trained to exploit. Multiple, overlapping transformations are far more effective.

In practice, this can include, in addition to replacing real faces with synthetic ones before blurring, downsampling to permanently discard visual information; heavy compression to introduce irreversible artifacts; adding noise or randomness to disrupt statistical patterns; and expanding redaction beyond the face to hair, neck, shoulders, or bodies. For video, temporal techniques, such as variable blur that changes across space and time or frame degradation, can prevent identity cues from accumulating over time.

These techniques together raise the cost of reversal, forcing an adversary to overcome multiple interacting obstacles rather than applying a single “deblur” tool. Small implementation details: order, randomness, consistency across frames, can make the difference. This approach adds intention to the small details: slowing re-identification, increasing uncertainty, and adding friction in an environment in which perfect anonymization is impossible.

Friction-maxxing

One answer we have settled on is intentionality: publishing visuals only when there is a clear and defensible reason to do so. Rather than blurring and republishing by default, we prioritize photos and videos with genuine evidentiary value, understanding that the solution is not less imagery but greater responsibility in its use.

We need to move from cosmetic blur to structural anonymization. Blur may still have a role, but pretending it is sufficient alone no longer protects potentially vulnerable sources and witnesses. We must stop treating blur as an ethical endpoint and start treating anonymization as a core safeguard that is designed, tested, and maintained with the same seriousness as data security.

We must also acknowledge a harder truth: there is no permanent solution, only risk reduction. In a rapidly evolving, adversarial technical environment, one-size-fits-all techniques are especially fragile, especially if these techniques are described publicly in detail. And the risk is not limited to faces. Identity leaks through bodies, posture, gait, scars, tattoos, clothing, background objects, architecture, signage, and location cues. Even when a face is blurred, an individual may remain identifiable, especially when images are combined with other data, revisited later with more powerful tools, or analyzed using multimodal AI systems that see patterns faster and more comprehensively than humans ever could. We could use AI tools to stress-test our anonymization by asking them what would help them de-anonymize a photo or video.

We need more resilient, layered, and adaptive approaches, ones that account for how both humans see and algorithms infer. These approaches should aim to remove identifying signals rather than merely obscure them, while still preserving the humanity of the people depicted. Such practices may require new visual norms; ways of preserving dignity without preserving identity. Above all, they demand clarity about risk, about limits, and about responsibility. Media platforms such as YouTube, which added built-in blurring tools following sustained engagement and advocacy by WITNESS, should now also reckon with the risk of over-promising protection, as these tools were designed for an earlier technical reality and may no longer provide the safety users assume.

This is not about achieving perfect safety. As Hany Farid told us in an interview, “nothing is fully future-proof”. The goal is friction: to raise the cost of re-identification high enough that harm becomes unlikely within a realistic threat model. Anonymization cannot be “set and forget.” Techniques that seem adequate today may fail tomorrow. Standards must be reviewed, tested, and revised.

That raises difficult questions. Should previously published images be reassessed? How do we audit what is already online? Should organizations test their own imagery against reconstruction tools? How accessible will new protocols be globally? How transparent can protective methods be without empowering adversaries?

Avoiding these questions does not eliminate risk. It merely transfers it onto the people depicted. Blurring, as we have known it, is over. What comes next needs to be stronger, more honest, and worthy of the trust placed in it.