Frame-By-Frame Blur Leaks
Face detectors miss motion blur, profiles, occlusion, and compression artifacts. Treat each frame independently and one missed box can reveal the person the pipeline was meant to protect.
videoprivacy associates detections with intersection-over-union tracking, pads and clips boxes, fills short detection gaps, and applies real OpenCV blur to the output video.
Ship The Redaction Report
The binary pipeline records every frame, track identifier, box, and inferred gap fill. Detection sequences can also be inspected through the CLI, JSON API, browser workbench, and tests.
The Demo
Across five frames, two identities produce ten redacted regions. One missing detection is filled from track continuity, so neither identity is exposed during the gap.
The default local Haar detector keeps setup light. Production use requires a detector evaluated for the actual camera domain, demographic coverage, pose, occlusion, and recall target.
Trying To Break My Own Redaction Guarantee
One demo scenario with one gap isn't much of a stress test for a tool whose entire job is "never let a face slip through." I looked hard for a real failure mode — specifically whether the greedy, frame-by-frame IoU assignment (not a globally optimal Hungarian match) could cause two crossing faces to swap identities under ambiguous geometry. It can. But it turns out that doesn't matter: every detection still resolves to some track ID and box regardless of which identity it gets swapped to, so a misassigned label never translates into a dropped redaction.
To confirm that held up beyond hand-reasoning, I simulated 40 tuning scenarios and a disjoint 30-seed holdout — multiple people walking with continuous motion and a 20% per-frame chance of a missed detection, the exact "detector blink" this tool exists to bridge. Across all 2,100 simulated frames on both sweeps, not one real detection was ever silently dropped from the redaction report. Gap-filling also delivered a consistent, generalizing coverage gain of roughly 27–30 percentage points over naive per-frame detection, not just in the one bundled scenario — and it even over-covers past 100% at a track's end rather than under-covering, since a track stays alive past someone's last real appearance. For a privacy tool, erring toward over-redaction is exactly the right failure mode.
Implementation Basis
The video path uses OpenCV's established detection and DNN tooling rather than inventing a media decoder or blur pipeline.
Read the OpenCV DNN face detection.