Often, yes — and the cases where it cannot be undone are not the ones people expect. A blur is arithmetic performed on the pixels of a face, and arithmetic can be run backwards. What follows is what actually survives a blur, what survives a mosaic, and the one treatment that leaves nothing to work with.
The short answer
A blurred face should be treated as readable. Not always, not by everyone, but often enough that it is the wrong tool for anything that matters — and the attacks that read it do not require a laboratory. Two of the three below can be run by one person on a laptop.
The confusion comes from a reasonable assumption: that a picture which looks unrecognisable to you is unrecognisable. It is not. You are judging the image by whether you can see a face in it. An attacker is not looking at it at all — they are asking a narrower and much easier question, which is whether this blurred region is more consistent with one person than another.
What a blur actually does
A Gaussian blur replaces every pixel with a weighted average of the pixels around it. Nothing is thrown away in that step. The face is still in the file, spread across a slightly wider area and attenuated — the same information, redistributed. The operation is a convolution, and a convolution has an inverse.
A blur does not delete a face. It smears one, and a smear can be read.
What stops the inverse from being perfect is not the blur. It is everything that happens after it: the values are rounded to eight bits, the frame is compressed, sensor noise is amplified along with the signal. Those losses are real and they are why a deblurred face comes back imperfect rather than exact. They are also why the recovery does not need to be exact.
Three ways it comes off
Deconvolution — running the arithmetic backwards
If the blur kernel is known or can be estimated from the image, standard deconvolution methods — Wiener filtering, Richardson–Lucy — invert most of it. This is not exotic software; it is a menu item in scientific imaging packages and has been for decades, because the same problem appears in astronomy and microscopy where nobody is hiding anything. The output is noisy and imperfect. It is also frequently good enough to recognise somebody you have already met.
Guess and check — the attack that ignores the image
This is the one that matters, and it does not try to recover anything. The attacker takes a set of faces they suspect it might be, applies the same blur to each, and compares the results to the blurred region in your file. Whichever candidate matches best is the answer.
It works because obfuscation is deterministic: the same face blurred the same way always produces the same output. Researchers at Cornell Tech demonstrated this in 2016 against blurring, pixelation and a privacy scheme designed to resist exactly this, and identified faces far more often than chance on standard datasets. The method needs no deblurring, no reconstruction and no clever maths — only a list of candidates, which in most real cases is short. A colleague. An ex-partner. Somebody who was at the same protest.
Video, which hands over hundreds of attempts
A photograph gives an attacker one blurred observation of a face. A ten-second clip gives them two or three hundred, each with the face at a slightly different position and angle relative to the pixel grid. Combining many degraded observations of the same subject into one sharper estimate is a solved problem with a name — multi-frame super-resolution — and it is why a blur in a video is weaker than the same blur in a still, not stronger.
The same logic condemns the swirl. A twirl effect permutes pixels rather than replacing them, so every bit of the original is still present in a different arrangement, and the arrangement is invertible. Interpol reversed one in 2007 and arrested the man in the photographs. Anything that moves pixels instead of destroying them is a puzzle, not a redaction.
Pixelation is much better, and still not safe
Averaging a whole block down to a single colour is a genuinely different operation. A 16×16 block holds 256 values; the mosaic keeps one. That is a projection into a space hundreds of times smaller, and unlike a blur it has no inverse — the information is not redistributed, it is gone. Deconvolution has nothing to work on.
But the guess-and-check attack does not need an inverse. The block colours that survive are a short fingerprint, and a fingerprint is enough to compare against a list. Pixelation raises the cost of identification; it does not remove the possibility.
Which is the honest version of a claim this site used to make more simply. A mosaic is not reversible. It is still matchable, and for somebody whose safety depends on this, the distinction between “cannot be undone” and “cannot be linked to me” is the entire question.
What leaves nothing behind
A solid bar. Every pixel under it is replaced with the same value, so the covered region is not a degraded copy of the face — it is not a copy of anything. There is no kernel to invert, no surviving fingerprint to match, and no amount of compute that helps. The only thing an attacker learns is where the bar is.
Which moves the whole problem somewhere else, and this is worth being clear about, because a cover that is theoretically perfect fails in practice for reasons that have nothing to do with mathematics:
- It has to be on the face in every frame. One uncovered frame in a thirty-second clip is one clean photograph of the person, and anybody can step through a video frame by frame. This is where most redaction actually fails.
- It has to cover enough. A bar across the eyes alone leaves a jaw, a hairline, a nose and a mouth — recognisable to anybody who knows the person, though not to a stranger. What is enough depends on who you are hiding from, and it is worth deciding that before you start rather than after.
- It has to be in the pixels. A bar drawn as an overlay in an editor, or a redaction box placed on top of a document, is not a redaction at all if the original survives underneath it in the exported file. This has ended careers in published court filings.
How to decide what you need
The useful question is not which effect looks most hidden. It is: who is looking, and what do they already have?
- Nobody in particular is looking. A blur is probably fine, and this page is not about you.
- Somebody who knows you might see it. They have a candidate list of one. Use a cover, not a blur, and cover more than the eyes.
- Somebody is actively trying to identify you. Assume every reversible treatment will be reversed, assume the file’s metadata is read, and assume your voice is as identifying as your face.
Questions people ask next
Can AI unblur a face?
It can produce a sharp face from a blurred one, but not necessarily the right face. Generative upscalers invent plausible detail rather than recovering the original, and they have been shown to turn a blurred photograph of one person into a convincing portrait of somebody else entirely. That is useless as evidence and dangerous as identification — but it is not safety, because a second kind of attack does not need to reconstruct anything. It only needs to compare.
Is pixelation safer than blurring?
Yes, meaningfully. Averaging a block down to one colour throws away far more than a Gaussian blur does, and there is no arithmetic that walks it backwards. But it is not zero: the surviving block colours are a fingerprint, and if somebody already has a short list of people it might be, they can pixelate each candidate the same way and see which one matches. Published research has done exactly this with high accuracy.
How much blur is enough?
There is no radius that makes a blur safe, because the attack that matters does not care how blurry the result looks. A heavier blur reduces what survives, but the question is always what an attacker can compare it against, and the answer for a face in a video posted publicly is usually a great deal. If the goal is that identification is impossible rather than inconvenient, do not use a blur.
What about the swirl or twirl filter?
A swirl rearranges pixels instead of destroying them, so all of the information is still there in a different order — and the order can simply be reversed. This is not theoretical: Interpol un-swirled photographs in a 2007 case and identified the man in them. Any effect that moves pixels rather than replacing them has the same flaw.
Does a black bar have the same problem?
No. A solid bar replaces every pixel it covers with the same colour, so the covered region carries no information about what was underneath it — there is nothing to invert and nothing to match against. Its weaknesses are different ones: it has to cover enough of the face, and it has to stay on the face in every single frame.
Cover the faces instead of blurring them.
Sitr draws a solid cover over every face in a video or a photo and tracks it through movement, then decodes the finished file and checks every frame again. It runs in your browser — the file is never uploaded, which means there is no original for anyone to recover either.
2 files freeNo cardNothing uploaded