“…The method based on antagonistic disturbance (Kingma & Welling, 2013) (Sharif et al, 2016) usually highly depends on the reachability of the target system, requires special training, and has poor robustness. Recent generative-based methods (Hukkelås et al, 2020) (Chen et al, 2020;Guo & Chen, 2019;Hukkelås et al, 2019;Meden et al, 2017;Ren et al, 2018;Sun, Tewari, & Xu, 2018;Zhang, Hu, & Luo, 2018) also have difficulty generating realistic anonymous faces.…”