Blur every face in a photo — proposed, then checked

Most likely because the face broke one of the three shape tests rather than because it was not detected as skin. A head turned to profile against a bare shoulder joins that shoulder into one blob whose proportions are no longer head-shaped; sunglasses or a heavy beard split the skin region in two so neither half fills enough of its own bounding box; two people standing cheek to cheek merge into a single wide region and are rejected for being too wide. Small faces are dropped on purpose, because a region under about a sixth of a percent of the frame is more often a hand than a head. All four are why the list is a proposal and the download needs a tick.

Because a hand is made of skin and a cupped hand is roughly as tall as it is wide, which is the whole of what the finder tests. The same goes for a forearm at the right angle, a terracotta pot, a varnished wooden door, a slice of ham and a great deal of desert. This is the known cost of chrominance-based skin detection and it is the safe direction to be wrong in — an extra oval is one click to remove, whereas a missing one is only found by the person in the photograph.

No — it makes the face unreadable, which is a smaller claim. Identity in a photograph is carried by a great deal besides the face: build, hair, posture, clothing, a tattoo, a walking stick, the room, the other people present and whatever the caption says. Recognition systems also do measurably better than chance on blurred faces, because a blur removes high-frequency detail and leaves the coarse geometry the model actually leans on. If the requirement is that a person cannot be placed at all, a blurred face in a photograph that names the venue and the date does not meet it.

Because a head is closer to an ellipse than to a box, and the corners of the box are where the background lives. Filling a rectangle takes out the wall, the shoulder and the hair behind the ear along with the face, which is both uglier and more obvious. The ellipse is inscribed in the box you see, so growing the box grows the oval, and the blur inside it samples only from within that box — the covered region is computed from itself rather than from the photograph around it, which keeps a hard, visible boundary instead of a soft halo that makes it unclear what was treated.

A blur is a convolution, and convolutions are in principle invertible, so the honest answer is that recovery is limited by noise rather than forbidden by mathematics. In practice it depends entirely on strength: at a deviation of a twentieth of the face there is plenty of structure left and a sharpening pass gets a usable amount of it back, while at a quarter the detail has fallen under what an 8-bit channel can still represent and there is nothing to amplify but rounding error. The slider on this page runs across that whole range on purpose, which is why the number it shows is a real deviation in pixels rather than a word like medium.

Because the failure mode of an automatic face blur is silent and one-sided. A tool that covers four faces out of five in a group shot produces a picture that looks handled, and nobody counts. The tick is the page declining to let the finder be the last thing that looked at the photograph, and it clears itself whenever the list, the strength or the picture changes, so it can never be a stale confirmation of an older set of ovals.

No, and the shortfall is in the method rather than in this implementation. The chrominance window it uses was published in 1999 from a limited set of subjects, and windows of that kind are known to under-detect very dark skin, which sits below the brightness floor, and very light skin under warm indoor light, which drifts out of the red-difference band. Anything strongly colored by the lighting — a stage wash, a sunset, a screen lighting a face blue — moves a face out of the window as well. Assume the proposals will be least complete exactly where it matters most, and drag the boxes yourself.