How to make a photo untraceable

A photo cannot be made perfectly untraceable, but its traceability can be cut substantially by treating it as five separate leak channels rather than one thing to scrub. Four of them, the face, the scene, the sensor fingerprint and any copy already indexed online, sit in the pixels and survive the metadata deletion most people stop at. Each channel closes by a different amount with a different tool, so the realistic goal is reduction across all five, not a guarantee on any one.

Channel one: metadata, necessary and weak

Deleting the EXIF, XMP and IPTC block removes the timestamp, GPS coordinates and device name in seconds, and it is worth doing first. But it changes no pixels, so it touches none of the four channels below. Treat it as hygiene, not anonymisation. Why a clean strip is necessary but nowhere near sufficient is set out in can you be identified after removing EXIF data.

Channel two: the face, remove it rather than blur it

A face is the densest identifier in most photos. Recognition networks such as ArcFace match one to a name and score near-perfect on clean benchmarks, about 99.8% on LFW (Deng, Guo, Xue, Zafeiriou, CVPR 2019), though performance falls sharply on low-quality imagery, where Kim, Jain and Liu note that “Recognition in low quality face datasets is challenging because facial attributes are obscured and degraded” (AdaFace, CVPR 2022). Reducing a face is harder than it looks, because the obvious fix does not work: Todt, Hanisch and Strufe found 11 of 15 tested face anonymisations at least partially reversible, blur and pixelation among them, because those methods only average the identifying information rather than remove it, and they argue a real protection “must be a one-way function for any arbitrary adversary” (Fantômas, PoPETs 2024). The deep, GAN-based replacements DeepPrivacy and CIAGAN were the least reversible in that study, so replacing a face or cropping it out beats obscuring it. Even a hidden face can leak attributes: a megastudy by Tkachenko and Jedidi found 82 of 349 personal attributes predictable better than random from a facial image, mostly demographic rather than character, concluding that facial analysis can “strip away privacy” (Scientific Reports 2023).

Channel three: the scene, geolocated from pixels alone

The background is its own identifier, independent of any GPS tag. PlaNet “outperforms previous approaches and even attains superhuman levels of accuracy in some cases” (Weyand, Kostrikov, Philbin, ECCV 2016); PIGEON places 40.4% of its predictions within 25 km of the true location, a city-scale radius (Haas et al., CVPR 2024); and GeoCLIP localises images worldwide against a learned, continuous gallery of coordinates (Vivanco Cepeda, Nayak, Shah, NeurIPS 2023). A storefront, a skyline, a road sign or a window reflection narrows a place with no metadata at all, so cropping or covering identifying scenery is part of the job, not an optional extra.

Channel four: the sensor fingerprint, a trace you can only degrade

Beneath the visible image is the camera’s own noise signature, its photo-response non-uniformity or PRNU, introduced for source identification by Lukáš, Fridrich and Goljan (IEEE TIFS 2006). It lives in the pixels, so a metadata wipe does nothing to it, and Goljan and Fridrich note it “survives a wide range of common image processing operations, including lossy compression, filtering, and gamma adjustment” (Proc. SPIE 6819, 2008). It is not invulnerable: it is the residual a denoiser removes, and the same authors put its signal ratio to the image at “-50dB or less,” so downscaling, heavy re-encoding and denoising weaken it, at a cost to quality. On modern computational-photography phones its reliability is already contested (Iuliani, Fontani, Piva, IEEE Access 2021). The full account of what it can and cannot trace is in can a photo be traced without metadata.

Channel five: existing copies, reverse and face search

None of the edits above matters if an earlier copy is already indexed, and this is the channel most people get backwards. It is often said that re-encoding or resizing defeats reverse image search, but that is not true of hash-based services: a perceptual hash of the TinEye kind is documented invariant to recompression and rescaling, and is weakened mainly by heavy cropping, past roughly a third of the frame, and by mirroring. Learned-embedding search such as Google Lens tolerates crop and flip better still, and face-search engines such as PimEyes and Clearview match a face across the web rather than the file. Those face services are believed to run on recognition embeddings of the same angular-margin family as ArcFace (Deng, Guo, Xue, Zafeiriou, CVPR 2019), though no vendor discloses which network, so the specific model is unverifiable. The rule is that an edit is not a guarantee of a miss: reverse-search your own result before trusting it, and if a face is already indexed, the removal routes are in how to opt out of PimEyes and remove photos from face-recognition sites.

Where the ceiling sits

Across all five channels the pattern is the same: metadata and a face-blur are easy and weak, while the scene, the sensor fingerprint and the already-indexed-copy problem are the signals that actually carry identity, and each can only be reduced at a cost, never zeroed by a single action. Layering the reductions, removing rather than blurring content, cropping the scene, degrading the fingerprint, and checking what is already indexed, moves a photo from trivially traceable to substantially harder to trace. One step stays irreversible, and that is publishing, which is why the pixel work belongs before the upload, covered in how to anonymise a photo before posting. Untraceable is the direction you move a photo in, not a box you can tick.

Sources

• Lukáš, Fridrich, Goljan (2006). Digital Camera Identification from Sensor Pattern Noise. IEEE TIFS 1(2):205-214.
• Goljan, Fridrich (2008). Camera Identification from Cropped and Scaled Images. Proc. SPIE 6819, Security, Forensics, Steganography, and Watermarking of Multimedia Contents X.
• Iuliani, Fontani, Piva (2021). A leak in PRNU based source identification. Questioning fingerprint uniqueness. IEEE Access 9.
• Weyand, Kostrikov, Philbin (2016). PlaNet: Photo Geolocation with Convolutional Neural Networks. ECCV 2016.
• Haas, Skreta, Alberti, Finn (2024). PIGEON: Predicting Image Geolocations. CVPR 2024:12893-12902.
• Vivanco Cepeda, Nayak, Shah (2023). GeoCLIP: Clip-Inspired Alignment between Locations and Images for Effective Worldwide Geo-localization. NeurIPS 2023.
• Deng, Guo, Xue, Zafeiriou (2019). ArcFace: Additive Angular Margin Loss for Deep Face Recognition. CVPR 2019.
• Kim, Jain, Liu (2022). AdaFace: Quality Adaptive Margin for Face Recognition. CVPR 2022.
• Tkachenko, Jedidi (2023). A megastudy on the predictability of personal information from facial images. Scientific Reports 13:21073.
• Todt, Hanisch, Strufe (2024). Fantômas: Understanding Face Anonymization Reversibility. Proc. Privacy Enhancing Technologies (PoPETs) 2024.