Head Count: Privacy-Preserving Face-Based Crowd Monitoring Fatemeh Marzani, Thijs van Ede, Geert Heijenk, Maarten van Steen University of Twente Enschede, The Netherlands f.marzani,t.s.vanede,geert.heijenk,[email protected]
arXiv:2604.14250v1 [cs.CR] 15 Apr 2026
ABSTRACT
that persist across locations. For a while, WiFi-based techniques provided such identifiers; mobile devices broadcast probe requests containing fixed MAC addresses, enabling reliable flow estimation. Stanciu et al. [3] proposed a method for privacy-preserving statistical counting using Bloom filters (BFs), probabilistic data structures supporting set operations; together with homomorphic encryption (HE), i.e., a type of encryption that allows performing operations on encrypted data. Their system allows counting over encrypted representations of sets or intersections of sets of devices without revealing what is being counted.2 They have shown that by combining BFs with HE it is possible to provide statistical counts while protecting the data of individuals. This approach is no longer feasible; modern operating systems now randomly assign MAC addresses, making repeated observations of the same device indistinguishable. Nevertheless, the core insight remains valuable: If we can extract person-unique identifiers from carry-on devices such as smartphones or access cards, accurate and privacy-preserving flow estimation remains feasible. The core challenge that remains is how to reliably identify and re-identify individuals for counting flows. Instead of relying on carry-on devices, we shift to biometric signals, specifically facial observations captured by cameras. Our focus in this work is on counting how many people move across non-overlapping camera ranges. The main advantage of this shift is that it removes the assumption that individuals carry smartphones, access cards, or other device-based identifiers. Faces are naturally present and can be detected consistently in locations. The drawback is that camera-based systems are heavily dependent on the quality of face detection and by themselves introduce privacy concerns. This work tackles both problems. Changes in pose, lighting, occlusion, camera angle, or image quality can make two images of the same person look different. As a result, the facial embeddings extracted from these images are noisy and unstable: the same person often produces different feature vectors at different locations. This variability makes re-identification much harder than in device-based methods. Combined with privacy issues, it also prevents the direct use of raw facial embeddings as identifiers to count unique individuals and estimate movement between locations. To overcome these limitations, our approach extracts approximate identifiers (simHashes) from facial images at each location and converts them into stable person-unique identifiers that cannot be traced back to original faces using fuzzy extractors. This places camera-based analytics in the same position as earlier systems that relied on identifiers derived from carry-on devices, but without requiring individuals to have such devices. Our pipeline consists of several stages. First, face images are processed to extract high-dimensional embeddings that represent the
An important aspect of crowd monitoring is knowing how many people we are dealing with. Sometimes, knowing the size of a crowd in a single location and at a specific moment is enough. Matters become problematic when counting the same people across different locations or counting them over longer periods of time. In those cases, we need to identify and later reidentify a person, which immediately leads to privacy concerns. Until recently, solutions have been based on unique identification of carry-on devices, yet privacy improvements have caused transmitted information to be randomized, rendering this technique mostly useless. We propose to use biometric data instead. We introduce a pipeline that counts people based on face recognition, yet without ever being able to reveal the identity of individuals. To count, a camera initially detects a face, extracts its features, and derives an identifier using a fuzzy extractor. The original facial image is then deleted. Identifiers are inserted into homomorphically encrypted Bloom filters. This allows oblivious set membership testing directly on encrypted data, enabling the system to count across locations or across different moments, without revealing any identities. We provide an initial evaluation of our method that shows promising results.
KEYWORDS Privacy-preserving analytics; Crowd monitoring; Smart cities; Fuzzy Extractors; Fully Homomorphic Encryption (FHE)
1
INTRODUCTION
Automated crowd monitoring systems play a crucial role in urban planning, public safety, and event management by analyzing human movements. There are two core tasks in crowd monitoring: footfall and crowd flow. Footfall is the count of detected individuals at a specific location within a defined time window; crowd flow is the more challenging task of counting how many detected people appear across different locations. Footfall can be derived directly from local observations at a specific moment. However, flow estimation requires re-identifying individuals across space and time.1 This re-identification step introduces significant privacy risks. It requires storing and linking personally identifiable information (PII), which can enable large-scale tracking and unauthorized profiling. Such practices also raise concerns under privacy regulations such as the EU General Data Protection Regulation (GDPR). Many techniques estimate footfall, from visual density regression [1] to edge-based systems like Cerberus [2], which runs analytics on-device and exports only counts. However, crowd-flow estimation methods remain limited as they require stable identifiers 1 In this paper, we concentrate on the combination of space and time, considering that
2 Intersections are used to determine crowd flow, measuring which individuals are
the situation of re-identification at the same location but at a later moment is just a special case.
present at multiple locations over time. 1
Head Count: Privacy-Preserving Face-Based Crowd Monitoring visual appearance of each detected individual. These embeddings are then converted into compact binary strings using SimHash, which preserves the similarity between repeated observations of the same person. Because these binary strings may still vary across captures, we apply a fuzzy extractor to transform them into consistent, non-invertible identifiers. These identifiers can then be inserted into Bloom filters, producing efficient set representations. Finally, Bloom filters are encrypted using fully homomorphic encryption (FHE). The server can then compute the intersection size, telling us how many identifiers appear at two or more different locations directly on the encrypted data. In this way, our system estimates the size of the crowd flow without revealing who is being counted or exposing facial information. Each stage of this pipeline has its own sources of error, from face detection and embedding extraction to SimHash collisions, fuzzy-extractor reconstruction thresholds, and Bloom-filter false positives. Together, these factors determine the overall accuracy and precision of the final flow estimate. Improving the robustness and reliability of each step is an important direction for further research.
2
by methods that focus only on density or lack support for noisy biometric data like faces.
3
METHODS
We consider two cameras, 𝐴 and 𝐵, deployed at different locations, each detecting faces over time. Our goal is to estimate how many people seen at location 𝐴 later appear at location 𝐵, I.e., our aim is to compute the size of the intersection between the sets of detected faces from both sites—without revealing who those people are. This task introduces two key challenges. First, face data are inherently noisy and repeated captures of the same person differ due to pose, lighting, or camera conditions. To reliably compute intersections, we must convert these noisy face embeddings into stable identifiers that remain consistent for the same individual across cameras. We address this by using SimHash to preserve similarity between embeddings, and fuzzy extractors to correct small variations and produce deterministic, non-invertible identifiers. Second, we compute the intersection size without storing, revealing, or comparing any raw identifiers or intermediate data. This can be achieved by converting identifiers into compact probabilistic data structures known as Bloom filters and encrypting them using Fully Homomorphic Encryption (FHE). This approach allows set operations to be performed directly on the encrypted Bloom filters.
RELATED WORK
Efforts to preserve privacy by monitoring crowds with face data have focused on footfall counting, which aggregates detections in a single location. Chan et al. [1] use density estimation in visual features to count people without models or tracking, reporting only crowd density (footfall) without addressing flow between locations. Similarly, the Cerberus system [2] processes analytics on-camera, discarding frames, and exporting only aggregate footfall counts rather than crowd flow between locations. Brazauskas et al. [2] introduce Cerberus, using edge-based face detection to preserve privacy and localization in urban settings, primarily reporting footfall density without flow estimation. Chen et al. [4] propose privacy-preserving crowd counting using federated learning, enabling secure model training without sharing face data, but it again targets footfall density rather than flow across locations. Ahmed et al. [5] explore voice-driven face recognition for crowd surveillance, integrating multimodal data for rapid identification, but their work emphasizes identification over flow estimation. Ren et al. [6] develop RAPOO, an efficient privacy-preserving facial expression recognition framework using secure multiparty computation, which is limited to expression analysis and again does not address crowd flow. Stanciu et al. [3] propose a privacy-preserving crowd-monitoring system using Bloom filters and homomorphic encryption, capable of estimating both crowd density (footfall) and crowd flow across locations. Later, Marzani et al. [7] improved privacy in sparsely populated crowd regions within that framework [3] by introducing controlled uncertainty sampling methods (e.g. detection or hash sampling). However, their approach does not support noisy data, such as face embeddings affected by variations in pose, lighting, or occlusions, limiting its applicability to face-based monitoring. In contrast, our proposed pipeline extends beyond footfall by estimating crowd flow across multiple locations using face data. By integrating fuzzy extractors with encrypted Bloom filters, we compute aggregate intersection sizes (flow counts) without revealing identities or storing linkable identifiers, addressing a gap left
3.1
Pipeline Overview
Figure 1 illustrates the setup of the system. The system consists of four entities: two cameras (𝐴 and 𝐵), a central server (𝑆), and authorized clients (𝐶). Each camera detects faces and processes them locally to prevent raw image exposure. 1. Extracting face embeddings. We apply a pre-trained deep neural network (DNN) to extract high-dimensional embeddings 𝑣 ∈ R𝑑 from each detected face. This embedding captures the unique visual features of a face, so that similar faces produce similar vectors. In practice, images of the same person generate embeddings that are close but not identical, while different people produce clearly distinct ones. To make these embeddings comparable, we first convert them into binary representations that preserve similarity using SimHash. However, even after this step, small differences may remain between binary strings of the same person. To address this, we later apply a fuzzy extractor, which can reproduce the same identifier when two binary strings differ only within a limited Hamming distance. 2. SimHash for similarity. We use SimHash [8], a localitysensitive hashing (LSH) method that maps similar inputs to similar binary outputs. SimHash preserves the angular similarity of embeddings by projecting them onto random hyperplanes, ensuring that two captures of the same person produce similar binary codes with small Hamming distance. Since fuzzy extractors operate in Hamming space, SimHash bridges the gap between continuous face embeddings and discrete binary input. 3. Fuzzy extractors for stability and privacy. Although SimHash maintains similarity, small visual variations can still flip bits if they are close to a SimHash plane. We use fuzzy extractors [9] to generate a stable, reproducible, and non-invertible identifier from noisy binary inputs. They act as an error-tolerant bridge between biometric variability and cryptographic determinism. Each extractor 2
Head Count: Privacy-Preserving Face-Based Crowd Monitoring
Figure 1: System model of the privacy-preserving face-based crowd monitoring pipeline. 𝐸𝑛𝑐 (𝑡) and estimates the number of shared individuals using the Bloom-filter cardinality Formula 1. The complete process operates as follows. Each authorized client generates a public–private key pair and shares the public key with both cameras. During each epoch, cameras 𝐴 and 𝐵 detect faces and convert them into SimHash binary strings. The camera 𝐴 applies a fuzzy extractor to generate a stable identifier 𝑅𝐴 along with public helper data 𝑃𝐴 . Helper data 𝑃𝐴 are shared with camera 𝐵, allowing it to attempt reconstructing the same identifier to match faces observed at its location. The camera 𝐵 uses these helpers with its own SimHashes to reproduce the corresponding identifiers 𝑅𝐵′ when the Hamming distance between the two hashes falls within the fuzzy threshold. Both cameras then encode their final identifiers into Bloom filters, encrypt them using the client’s public key, and send the encrypted Bloom filters to the central server. The server performs homomorphic multiplications and additions on ciphertexts to estimate intersections directly in the encrypted domain, without accessing any plaintext data. Finally, the client decrypts the aggregate ciphertext, obtains the total number of set bits (𝑡), and applies Eq. (1) to estimate the number of individuals appearing across both locations. This process ensures that only encrypted, aggregated data are processed, while raw facial information and intermediate representations are deleted.
produces a key 𝑅 and public helper data 𝑃. If a similar hash reappears on another camera, it reconstructs the same key using 𝑃. This mechanism ensures consistent identifiers between sites, while preventing any reverse reconstruction of biometric data. 4. Bloom filters for compact set representation. We use Bloom filters to compactly represent the individuals detected by each camera while enabling efficient, privacy-preserving computation. In our pipeline, the Bloom filter serves as a space-efficient encoding of the stable identifiers produced by the fuzzy extractor. This structure allows each camera to store and later compare large sets of identifiers without ever revealing their actual values. A Bloom filter is a probabilistic data structure that represents a set using a bit array of length 𝑚, initially filled with zeros, and 𝑘 independent hash functions. Each identifier is hashed 𝑘 times, and the corresponding bit positions are set to one. After inserting all identifiers, the number of bits set to one (𝑡) provides an accurate estimation of how many unique elements are represented [10]. The estimated number of inserted elements cardinality, 𝑐) can be computed as: 𝑚 𝑡 𝑐 = − ln 1 − . (1) 𝑘 𝑚 Bloom filters also support efficient set operations. The intersection between two encoded sets can be approximated with a simple bitwise AND (&) operation:
4
𝐵𝐹𝐴∩𝐵 ≈ 𝐵𝐹𝐴 & 𝐵𝐹𝐵 . The number of bits set to one in the resulting intersection filter (𝐵𝐹𝐴∩𝐵 ) can then be used in Eq. (1) to estimate |𝐴 ∩ 𝐵| the number of individuals appearing at both locations. 5. Fully Homomorphic Encryption for secure computation. Although Bloom filters hide identifiers, their bit patterns could still leak information if transmitted in plaintext as adversaries may test for the presence of known individuals. We therefore encrypt each Bloom filter using Fully Homomorphic Encryption (FHE), which allows arithmetic operations on encrypted data. The entire system works on an epoch basis, an epoch typically capturing 5 minutes of facial data. In other words, steps 1–5 are repeated after an epoch elapses; the plaintext Bloomfilters are discarded by the respective camera, and only their encrypted versions are stored at the server. 6. Decryption and cardinality estimation. When the server receives a query from the client, it computes the encrypted intersection of two Bloom filters as: 𝑚 ∑︁ 𝐸𝑛𝑐 (𝑡) = 𝐸𝑛𝑐 (𝐵𝐹𝐴 [𝑖]) × 𝐸𝑛𝑐 (𝐵𝐹𝐵 [𝑖]),
PRELIMINARY EVALUATION
We evaluate the reliability of the fuzzy extractor stage in our privacypreserving pipeline, which converts noisy SimHash outputs into stable identifiers prior to encrypted Bloom-filter intersection.3 The objective is to assess whether fuzzy extractors can consistently reproduce identical keys from different images of the same individual. The accuracy of encrypted Bloom-filter intersections has been extensively analyzed in [3] and is therefore not repeated here. We used the SCface dataset [11], which contains 130 individuals, each captured in nine images under varying lighting conditions and poses, allowing a controlled simulation of cross-camera variability. Faces are detected using VOLO [12] and embedded using a ResNet50 model pre-trained on VGGFace2 [13]. For each identity, four images are randomly assigned to site 𝐴 and four to site 𝐵, representing realistic sequences of multiple frames of the same individual captured under different conditions. Each camera performs the early stages of the pipeline locally: extracting embeddings, converting them into binary strings via SimHash, and generating stable identifiers using a fuzzy extractor. For each individual, camera 𝐴 produces
𝑖=1
where multiplication emulates bitwise AND, and addition counts set bits. The server operates only on ciphertexts and learns nothing about the underlying data. The client decrypts the encrypted total
3 The source code for this work is publicly available at: https://anonymous.4open.
science/r/simhash-to-bch-fuzzy-extractor-C12A/README.md
3
Head Count: Privacy-Preserving Face-Based Crowd Monitoring Table 1: Precision, recall, and F1-score for different SimHash lengths and fuzzy thresholds 𝑟 . Hyperplanes 64
128 Figure 2: Average TP and FN counts across different SimHash length and fuzzy thresholds. 256
a key 𝑅𝐴 and corresponding public helper data 𝑃𝐴 from the consensus SimHash of its observations. Camera 𝐵 then attempts to reconstruct this key using its own SimHash output and the helper data 𝑃𝐴 . If reconstruction succeeds for the same identity (𝑅𝐵′ = 𝑅𝐴 ), the result is counted as a True Positive (TP); otherwise, as a False Negative (FN). If reconstruction succeeds using helper data of a different identity, it is counted as a False Positive (FP). We vary the number of SimHash hyperplanes 𝑛 bits ∈ {64, 128, 256} and the relative error ratio 𝑟 ∈ {10%, 15%, 20%, 25%}, where the effective Hamming tolerance is defined as 𝜏 = 𝑟 · 𝑛 bits . we repeated each configuration over 100 random seeds to average out projection noise. Figure 2 shows the average TP and FN counts in all configurations. With 𝑛 bits ≥ 128 and relative error ratios 𝑟 ≥ 20%, nearly all 130 individuals produce consistent keys, demonstrating that the fuzzy extractor effectively corrects the variations of SimHash. Lower error ratios increase FN counts, reflecting reduced tolerance to intra-person variability. These results confirm the reliability of the fuzzy extractor stage in stabilizing similarity-preserving hashes, ensuring that the identifiers passed to the Bloom-filter stage are deterministic and suitable for encrypted intersection. Table 1 further quantifies this behavior using precision, recall, and F1-score. At 𝑟 = 10% achieved high precision but low recall, indicating overly strict matching that misses many correct reproductions. Increasing 𝑟 significantly improves recall. Longer representations (𝑛 bits = 128, 256) achieve near-perfect precision and recall at moderate error ratios (𝑟 ≥ 20%), showing improved robustness and reduced accidental collisions. Overall, these results show that fuzzy extractors reliably stabilize noisy facial embeddings and provide explicit control over the precision–recall trade-off, enabling accurate and privacy-preserving crowd-flow estimation [3].
5
Error Ratio 𝑟 10% 15% 20% 25% 10% 15% 20% 25% 10% 15% 20% 25%
Precision 1.000 0.997 0.995 0.993 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000
Recall 0.305 0.761 0.930 0.983 0.286 0.780 0.953 0.994 0.231 0.803 0.968 0.996
F1-score 0.465 0.862 0.961 0.988 0.443 0.876 0.976 0.997 0.374 0.890 0.984 0.998
the SCface dataset, we demonstrate that fuzzy extractors effectively stabilize noisy face embeddings into deterministic identifiers. In future work, we will evaluate how sensitive our approach is to different datasets, including images captured under diverse conditions, larger populations, and video-based scenarios. We will analyze when and why the method succeeds or fails in better understanding its operational limits and optimize it for real-world, privacy-preserving crowd analytics.
6
ACKNOWLEDGEMENTS
This research is funded by the Dutch Research Council (NWO) through the PERSPECTIEF Program P21-08 ’XCARCITY’. We gratefully acknowledge their financial support.
REFERENCES [1] Antoni B. Chan, Zhang-Sheng John Liang, and Nuno Vasconcelos. Privacy preserving crowd monitoring: Counting people without people models or tracking. In 2008 IEEE Conference on Computer Vision and Pattern Recognition, pages 1–7, 2008. doi: 10.1109/CVPR.2008.4587569. [2] Justas Brazauskas, Chris Jensen, Matthew Danish, Ian Lewis, and Richard Mortier. Cerberus: Privacy-preserving crowd counting and localisation using face detection in edge devices. In Proceedings of the 7th International Workshop on Edge Systems, Analytics and Networking, EdgeSys ’24, page 25–30, New York, NY, USA, 2024. Association for Computing Machinery. ISBN 9798400705397. doi: 10.1145/3642968.3654817. URL https://doi.org/10.1145/3642968.3654817. [3] Valeriu-Daniel Stanciu, Maarten van Steen, Ciprian Dobre, and Andreas Peter. Privacy-preserving crowd-monitoring using bloom filters and homomorphic encryption. In Proceedings of the 4th International Workshop on Edge Systems, Analytics and Networking, EdgeSys ’21, page 37–42, New York, NY, USA, 2021. Association for Computing Machinery. ISBN 9781450382915. doi: 10.1145/ 3434770.3459735. URL https://doi.org/10.1145/3434770.3459735. [4] Chen Zhang, Jing-an Cheng, Qiang Zhou, Wenzhe Zhai, and Mingliang Gao. Privacy-preserving crowd counting via quantum-enhanced federated learning. Expert Systems, 42(9):e70098, 2025. doi: https://doi.org/10.1111/exsy.70098. URL https://onlinelibrary.wiley.com/doi/abs/10.1111/exsy.70098. e70098 EXSY-May25-1921.R1. [5] Manish Bhat, Samuel Paul, Umesh Kumar Sahu, and Umesh Kumar Yadav. Revolutionizing crowd surveillance through voice-driven face recognition empowering rapid identification: towards development of sustainable smart cities. Engineering Research Express, 6(2):025219, 2024. doi: 10.1088/2631-8695/ad4ae9. URL https://doi.org/10.1088/2631-8695/ad4ae9. [6] Bo Tian, Bowen Zhao, Yang Xiao, Yang Liu, Qingqi Pei, and Yulong Shen. RAPOO: An Efficient Privacy-Preserving Facial Expression Recognition via Mobile Crowdsensing . IEEE Transactions on Mobile Computing, 24(11):11568– 11581, 2025. ISSN 1558-0660. doi: 10.1109/TMC.2025.3581687. URL https: //doi.ieeecomputersociety.org/10.1109/TMC.2025.3581687. [7] Fatemeh Marzani, Thijs van Ede, Geert Heijenk, and Maarten van Steen. Stop watching me! moving from data protection to privacy preservation in crowd
CONCLUSION AND FUTURE WORK
In this paper, we show that it is possible to count how many people appear across two camera locations while preserving privacy and without being able to identify who they are. We extend existing privacy-preserving crowd-flow systems that rely on deterministic identifiers to handle noisy biometric data, such as faces. Our method generates stable identifiers from facial embeddings using fuzzy extractors, maps them to encrypted Bloom filters, and computes intersection sizes directly on encrypted data. Through experiments on 4
Head Count: Privacy-Preserving Face-Based Crowd Monitoring monitoring. In Mila Dalla Preda, Sebastian Schrittwieser, Vincent Naessens, and Bjorn De Sutter, editors, Availability, Reliability and Security, pages 46–67, Cham, 2025. Springer Nature Switzerland. ISBN 978-3-032-00624-0. [8] Moses S. Charikar. Similarity estimation techniques from rounding algorithms. In Proceedings of the Thiry-Fourth Annual ACM Symposium on Theory of Computing, STOC ’02, page 380–388, New York, NY, USA, 2002. Association for Computing Machinery. ISBN 1581134959. doi: 10.1145/509907.509965. URL https://doi.org/ 10.1145/509907.509965. [9] Yevgeniy Dodis, Leonid Reyzin, and Adam Smith. Fuzzy extractors: How to generate strong keys from biometrics and other noisy data. In Christian Cachin and Jan L. Camenisch, editors, Advances in Cryptology - EUROCRYPT 2004, pages 523–540, Berlin, Heidelberg, 2004. Springer Berlin Heidelberg. ISBN 978-3-54024676-3. [10] S. Joshua Swamidass and Pierre Baldi. Mathematical correction for fingerprint similarity measures to improve chemical retrieval. Journal of chemical information and modeling, 47 3:952–64, 2007. URL https://api.semanticscholar.org/ CorpusID:16257544. [11] Mislav Grgic, Kresimir Delac, and Sonja Grgic. Scface – surveillance cameras face database. Multimedia Tools and Applications, 51(3):863–879, 2011. ISSN 1573-7721. doi: 10.1007/s11042-009-0417-2. URL http://dx.doi.org/10.1007/ s11042-009-0417-2. [12] Li Yuan, Qibin Hou, Zihang Jiang, Jiashi Feng, and Shuicheng Yan. Volo: Vision outlooker for visual recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(5):6575–6586, 2023. doi: 10.1109/TPAMI.2022.3206108. [13] Qiong Cao, Li Shen, Weidi Xie, Omkar M. Parkhi, and Andrew Zisserman. VGGFace2: A Dataset for Recognising Faces across Pose and Age . In 2018 13th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2018), pages 67–74, Los Alamitos, CA, USA, 2018. IEEE Computer Society. doi: 10.1109/ FG.2018.00020. URL https://doi.ieeecomputersociety.org/10.1109/FG.2018.00020.
5