Generative Video Anonymization: Whole-Body Identity Suppression with Semantic Preservation

Modern person re-identification systems can recover identity from whole-body biometric cues such as gait, body shape, clothing configuration, and silhouette, making face-only anonymization insufficient for privacy-preserving video analysis. Existing anonymization methods either destroy semantic utility through coarse obfuscation or preserve full-body identity cues by operating only on facial regions. We introduce Generative Video Anonymization (GVA), a new task that aims to synthesize a semantically equivalent video in which whole-body biometric identity is suppressed while action dynamics, scene context, and visual realism are preserved. We first formalize GVA as a constrained identity-action decoupling problem and show that general-purpose video-to-video editing methods are structurally misaligned with this objective, failing due to inadequate subject grounding, the absence of Re-ID-aware identity objectives, and weak temporal identity consistency. To support principled evaluation, we propose a dedicated privacy-utility protocol with metrics for assessing identity retrieval resilience, feature-level identity leakage, scene preservation, temporal coherence, and behavioral action consistency. We further introduce the Belvedere Museum dataset, a naturalistic egocentric benchmark collected in a real museum environment, where visitors and bystanders must be distinguished from artistic depictions such as paintings and statues. We present MOSAIC, a task-specific framework that combines agentic perceptual grounding, counterfactual identity planning, and mask-constrained diffusion-based video generation. Experiments on OpenHumanVid and Belvedere Museum show that MOSAIC achieves the strongest whole-body identity suppression among the evaluated generative methods across all three privacy metrics, while retaining competitive, metric-dependent utility, occupying a distinct operating point on the privacy–utility trade-off.