Introducing "Secure Blur" - Redact Videos Safely and Aesthetically

Blurring is a commonly used technique to redact information from images and videos, as are the classic pixelation or mosaic styles. At Reduct, we routinely process videos with sensitive and personally identifiable information, and often get requests for a blurring feature to redact sensitive information from parts of the video.

Unfortunately, and to many people’s surprise, the traditional methods of blurring and pixelation are not actually very secure. Even though they look to the human eye like they hide the sensitive information, they can be reversed under many conditions. We wanted any redaction done via Reduct to be irreversible, and so we came up with a different technique, which we are calling "secure blur."

In this post, I’ll dig a little deeper into traditional blurring and pixelation, why those methods are insecure, discuss the more secure alternative of masking, and finally present Reduct’s "secure blur" method. Secure blur offers similar aesthetic qualities to blurring, while being just as secure as completely masking information that needs to be redacted.

(Un)blurring images and videos

Image and video redaction is often achieved using one of the following methods to blur the sensitive information:

• Guassian (or similar) blur: each pixel gets a weighted average color value based on its surrounding pixel neighborhood, based on a gaussian (or other) distribution. This has the effect of smoothing details and edges, and producing that classic blurry effect.

• Mosaic/Pixelization: the area to be redacted is divided into a grid, and each grid is assigned the average color of every pixel from the original image inside that area. This makes everything look pixelated. A similar approach can sometimes also use a non-rectangular grid.

When it comes to hiding visual information, both of these techniques look great to the human eye. While the original information is hidden away, and you still get a rough sense of what was there. It feels like a perfect blend of aesthetics and security.

The only problem is that the security is a mirage. These methods are often reversible, with recent advances in AI and image processing now allowing even strong blurs to be un-done, with minimal effort.

Unblurring text - a victim of the guessing game

Let’s say you’re blurring or pixelating some financial or health information that is appearing on a screen-recording. It is very likely that this can be reversed well enough for the information to be recovered.

Text de-pixelation software takes advantage of the fact that there are only so many letters and numbers that can make up any text. Each letter or number is pixelated or blurred in the same way, which allows software to run through all of the combinations to effectively recover the original text.

In fact, there are several packages available on github implementing this approach

Similar techniques can be applied to blurred text, with some approaches actually using mosaicing as a part of the unblurring process.

Unblurring faces - an active area of computer vision research

Camera manufacturers have a big incentive to let their users have nice-looking images even if the original was quite shaky or blurry. A photo that’s blurry because of low light or a shaky hand poses the exact same challenges as a portion of an image that has been intentionally blurred. Working with sharp images is also important for several other computer vision algorithms, and as a result, unblurring faces is an active area of computer vision research.

The latest deep learning-based techniques can deblur images quite impressively. Below, for example, is a figure from this paper, which shows how much information can be reproduced from blurry originals.

Unblurring video - the possibility of utilizing information from across frames

When working with video as opposed to still images, there is an additional source of information - the fact that one frame is quite similar, and related, to another. If there is movement on the video (either because the camera is moving, or because something is scrolling), that movement information can be exploited. In this blog post, for example, security consultant Fabian Bräunlein describes a technique to use this motion information to re-create some information which could then be further enhanced using another unblurring technique.

Masking: secure, but…

At this point, hopefully you are convinced that simple blurring or pixelation are not secure techniques for redacting sensitive information. So what is?

The most widely available technique that is quite secure is masking - replacing the area of interest with a solid color block.

Unblurring is possible because both blurring and pixelation are transforming the information you are trying to redact – essentially taking (sophisticated) averages of the original. Unblurring, therefore, is just a matter of undoing those transformations. And as you have seen in the examples above, that’s often possible.

Masking is secure because it simply doesn’t use any of the information you want to hide - so there is nothing to reverse. The only information that is available in an image with a mask-based redaction is (1) the shape of the area that has been redacted, and (2) any information outside of the redacted area. As long as the redacted information is not possible to derive from what hasn’t been redacted, and the mask itself cannot be removed, the technique is safe.

So, for our first implementation of visual redaction at Reduct, this is what we chose.

But a black rectangle doesn’t look great. Blurring is popular for a reason - it looks better to a human eye. And if you don’t know that blurring is reversible, it’s natural to reach for the technique that looks better.

We kept getting demand for blurring. Understanding that masking wasn’t cutting it for aesthetic reasons, we started looking for another solution.

The solution - "Secure blur"

As we started looking for another solution, we followed a simple premise: whatever we do, we can’t use any of the information that is meant to be actually redacted.

Instead, we came up with a technique that uses various averages of the pixels just outside the redacted area.

As you see in the following examples, this "secure blur" can look at a glance like a standard blur, and serves the same aesthetic purpose: the redacted area still feels like it belongs in the image as a whole. And as I’ll illustrate in the thought exercise below, it’s just as secure as completely masking out the information.

Why this technique is secure

The security of Secure blur comes back to the premise I stated earlier: we don’t use any of the information that is meant to be redacted. Instead, we replaced the redacted area with a set of new pixels, which are calculated by averaging pixels from outside of the area of interest.

A simple thought experiment should convince you that this technique is secure, and in fact, equivalent to masking.

Imagine that you applied secure blur to two images. The first is to an original image, with an area selected for redaction. The second image is actually the original, but with the redaction area first masked out with a fully opaque rectangle.

Because secure blur is only using pixel values from outside the redacted area, the result is going to be the same. In fact, it doesn’t matter what is in the redacted area. If the redacted shape and position are the same, the result will be identical. Just like with masking, the only information that remains in an image redacted using secure blur is: (1) the shape of the area the redaction was applied to, and (2) any information available from outside the redacted area.

(If you’re interested in trying Secure blur yourself, you can sign up for a trial here, and follow step-by-step instructions in our help article.)

An important note for working with video

If you’re using Reduct’s secure blur, masking, or another secure technique to redact sensitive information from your videos, there are a couple of additional things to keep in mind.

Make sure you select a large enough area to redact - and especially in cases where the video is moving, that the selected area covers the sensitive information throughout the time period you intend to redact.

Additionally, make sure you select enough of the time range to redact. Sometimes, you’ve redacted the information in all but a couple of frames at the beginning or end. Video moves at 24 or 30 frames per second, so it may be hard to catch this without slowing down the video. If the information you are redacting is sensitive enough to be worth the effort to redact it, you may want to pad the time range you’ve selected (eg. by selecting an extra word in Reduct) on either end.

Always play back the selected time range and look closely, to make sure nothing sensitive escapes your redaction efforts - either by poking outside of the selected area, or by being shown before or after the selected time range.

And of course, make sure you choose software that provides you with redaction options that are secure!