ReFaceX: donor-driven reversible face anonymisation with detached recovery

Abstract Organisations must share facial imagery that remains useful for analysis while protecting identity. Many current methods fail to strike this balance: reconstruction-centred encoder–decoder designs tend to blur salient detail, whereas latent edits in pretrained generators often retain or drift identity cues, undermining privacy and utility. We present ReFaceX, a reversible anonymisation framework that separates what to protect from what to preserve. A donor identity code steers a U-Net anonymiser with Identity Feature Fusion to change identity while retaining non-identity content such as pose, background and expression. A learned steganographic channel carries a compact recovery payload, and reconstruction gradients are blocked at the stego image so the anonymiser is never rewarded for keeping identity. The threat model is stated explicitly and outcomes are audited with strong recognisers. On LFW and CelebA-HQ datasets at 256 256, ReFaceX reduces identity similarity across FaceNet, ArcFace and AdaFace, and improves recovered-image quality (SSIM 0. 9378, LPIPS 0. 1002, PSNR 23. 97 dB), while operating in real time on a single RTX 3090. Robustness to common JPEG re-encoding is also demonstrated. By turning the privacy–utility balance into an explicit and auditable operating choice, ReFaceX provides a practical template for responsible release of facial imagery and a foundation for extensions to video, higher resolutions and stronger recovery guarantees.