AI Tool Bypasses Filters by Removing Digital Makeup

Facial cosmetics are enabling underage users, primarily girls, to bypass selfie-based age verification systems on platforms like dating apps and e-commerce sites. A new AI tool tackles this vulnerability with a discriminative model trained to remove makeup while preserving facial identity, making it more difficult for minors to deceive automated checks.

The adoption of third-party, selfie-based age verification services is growing, driven by a global trend toward online age verification.

For example, under the UK's Online Safety Act, age verification can be performed by various third-party services using methods like visual age estimation, where AI predicts a user's age from live mobile camera footage. Providers such as Ondato, TrustStamp, and Yoti use this approach.

However, age estimation is not foolproof. Teenagers' longstanding efforts to access adult privileges have led them to develop effective ways to enter dating sites, forums, and other platforms that restrict their age group.

One common method, especially among females*, is wearing facial makeup—a tactic known to trick automated age-estimation systems, which often overestimate the age of younger individuals and underestimate that of older ones.

Not Just the Girls

Before addressing potential objections to framing makeup as ‘female-focused,’ it's important to note that facial cosmetics on anyone are an unreliable indicator of gender:

In the study ‘Impact of Facial Cosmetics on Automatic Gender and Age Estimation Algorithms,’ US researchers found that gender verification systems were confused by gender-swapping makeup. Source: https://cse.msu.edu/~rossarun/pubs/ChenCosmeticsGenderAge_VISAPP2014.pdf

In 2024, an estimated 72% of US male consumers aged 18–24 included makeup in their grooming routines—though most used cosmetic products to enhance the appearance of healthy skin rather than adopting the mascara/lipstick combinations typically associated with women's aesthetics.

Therefore, we must approach the subject based on the most common scenario explored in recent research: female minors using makeup to bypass automated visual age-verification systems.

Effective Makeup Removal – The AI Way

The research discussed comes from three contributors at New York University, who authored the new paper DiffClean: Diffusion-based Makeup Removal for Accurate Age Estimation.

The project aims to develop an AI-driven method for removing the appearance of makeup from images (and potentially video) to better determine a person's true age.

From the new paper, an example showing how makeup removal can significantly change age prediction. Source: https://arxiv.org/pdf/2507.13292

One challenge in developing such a system is the sensitivity around collecting or curating images of underage girls wearing adult makeup. To address this, the researchers used EleGANt, a third-party Generative Adversarial Network-based system, to synthetically apply makeup styles—a highly effective approach:

Tsinghua University's 2022 EleGANt system uses a Generative Adversarial Network (GAN) to realistically overlay cosmetics onto source photos. Source: https://arxiv.org/pdf/2207.09840

Using synthetic data generated this way, along with various auxiliary projects and datasets, the authors surpassed state-of-the-art age-estimation methods when dealing with noticeable or ‘performative’ makeup.

The paper states:

‘DiffClean [erases] makeup traces using a text-guided diffusion model to defend against makeup attacks. [It] improves age estimation (minor vs. adult accuracy by 4.8%) and face verification (TMR by 8.9% at FMR=0.01%) over competing baselines on digitally simulated and real makeup images.'

Let's examine their methodology.

Method

To avoid using real images of minors wearing makeup, the authors applied synthetic cosmetics via EleGANt to images from the UTKFace dataset, creating before-and-after pairs for training.

Examples from the UTKFace dataset. Source: https://susanqq.github.io/UTKFace/

DiffClean was then trained to reverse this transformation. Since age-estimation algorithms struggle most with younger age groups, the researchers developed a proxy age classifier fine-tuned for ages 10–19. They used the SSRNet architecture trained on UTKFace with a weighted L1 loss.

A streamlined version of OpenAI's 2021 diffusion model formed the backbone, with added attention heads at various resolutions, deeper layers, and BigGAN-style blocks to enhance upsampling and downsampling.

Directional control was implemented using CLIP prompts: face with makeup and face without makeup, guiding the model to remove makeup while preserving facial details, age cues, and identity.

Synthetic makeup applied using EleGANt. Each triplet shows the original UTKFace image (left), the reference makeup style (center), and the result after style transfer (right). This type of makeup transfer is common in computer vision research and is also available in Adobe Photoshop's neural filters, which can apply makeup from a reference image to a target.

Four key loss functions guided makeup removal without altering facial identity or age cues. Besides the CLIP-based loss, identity preservation used weighted ArcFace losses from the InsightFace library, measuring similarity between the generated face and both the original clean image and the ‘made-up’ version to ensure consistency.

Third, the perceptual loss Learned Perceptual Similarity Metrics (LPIPS) used L1 distance to enforce pixel-level realism and maintain the original image's appearance after makeup removal.

Finally, age supervision used a fine-tuned SSRNet trained on UTKFace, with a smoothed L1 loss that penalized errors more heavily in the 10–29 age range, where misclassification is most common. A variant used a CLIP-based age prompt to match the appearance of a specific age.

For inference-time age estimation, the 2023 MiVOLO framework was employed.

Data and Tests

The SSRNet fine-tuning on UTKFace used 15,364 training images and 6,701 test images. The original 20,000 images were filtered to exclude individuals over 70 and split 70:30.

Following the 2023 DiffAM project's method, training occurred in two stages: an initial session with 300 real-world makeup images from BeautyGAN's MT dataset (200 for training, 100 for validation).

The model was further refined using 300 additional UTKFace images augmented with synthetic makeup via EleGANt, resulting in a final training set of 600 examples paired across five reference styles from BeautyGAN. Since makeup removal involves mapping multiple styles to a single clean face, training emphasized broad generalization over covering every cosmetic variation.

Performance was evaluated on both synthetic and real-world images. Synthetic testing used 2,556 images from the Flickr-Faces-HQ Dataset (FFHQ), evenly sampled across nine age groups under 70 and modified with EleGANt.

Generalization was assessed using 3,000 images from BeautyFace and 355 from LADN, both featuring real makeup.

Examples from the BeautyFace dataset, showing semantic segmentation that defines different facial areas affected by makeup. Source: https://li-chongyi.github.io/BeautyREC_files/

Metrics and Implementation

For metrics, the authors used Mean Absolute Error (MAE) between ground truth ages and predicted values (lower is better); age group accuracy to assess correct grouping (lower is better); and minor/adult accuracy to evaluate correct identification of adults (higher is better).

They also reported identity verification metrics: True Match Rate (TMR) and False Match Rate (FMR), along with related Receiver Operating Characteristic (ROC) values.

SSRNet was fine-tuned on 64×64px images with a batch size of 50, using the Adam optimizer, weight decay of 1e−4, a cosine annealing scheduler, and a learning rate of 1e−3 over 200 epochs with early stopping.

DiffClean received 256×256px input images and was fine-tuned for five epochs using Adam with a learning rate of 4e−3. Sampling used 40 DDIM inversion steps and 6 DDIM forward steps. All training was done on a single NVIDIA A100 GPU.

Competing systems tested were CLIP2Protect and DiffAM. The authors used ‘matte’ makeup styles, which CLIP2Protect found more effective.

To replicate DiffAM as a baseline, the pretrained model from BeautyGAN was fine-tuned on the MT dataset. For adversarial makeup transfer, the DiffAM checkpoint was used with default parameters.

Performance of DiffClean compared to baselines on age estimation tasks, using MiVOLO. Metrics reported are Minor/Adult classification accuracy, age group accuracy, and mean absolute error (MAE). DiffClean with CLIP age loss achieves the best results across all metrics.

The authors state:

‘[Our] method DIFFCLEAN outperforms both baselines, CLIP2Protect and DiffAM, and can successfully restore the age cues disrupted due to makeup by lowering the MAE (to 5.71) and improving the overall age group prediction accuracy (to 37%).

‘Our objective focused on minor age groups, and results indicate that we achieve superior minor vs adult age classification of 88.6%.'

Makeup removal results from baseline and proposed methods. The left-most column shows source images, the next outputs from CLIP2Protect and DiffAM. The third column shows results from DiffClean via SSRNet and CLIP-based age loss. The authors contend that DiffClean removes makeup more effectively, avoiding the feature distortion seen in CLIP2Protect, and the residual cosmetics missed by DiffAM.

The authors note that makeup does not uniformly affect perceived age—it can increase, decrease, or leave it unchanged. Thus, DiffClean doesn’t apply a blanket reduction in predicted age but aims to recover original age indicators by removing cosmetic traces:

Makeup removal examples from the CelebA-HQ and CACD datasets. Each column shows a pair of images before (left) and after (right) makeup removal. In the first column, predicted age decreases after makeup is removed; in the second, it remains unchanged; and in the third, it increases.

To test generalization, DiffClean was run on BeautyFace and LADN datasets, which contain real makeup but no paired clean images. Age predictions before and after makeup removal were compared to measure how well DiffClean reduced makeup-induced distortion:

Makeup removal results on real-world images from the LADN (left pair) and BeautyFace (right pair) datasets. DiffClean reduces the predicted ages by removing cosmetics, narrowing the gap between apparent and actual age. White numbers show estimated ages before and after processing.

Results showed DiffClean consistently narrowed the gap between apparent and actual age, reducing overestimation and underestimation errors by about three years on average, indicating strong generalization to real-world cosmetic styles.

Conclusion

It’s intriguing, and perhaps inevitable, that noticeable makeup would be used adversarially. Since girls mature at different rates but generally faster as a group, identifying the transition from minor to adult female status is one of the most ambitious challenges in this research field.

Still, over time, data may reveal consistent age-related indicators to anchor visual age-verification systems.

* Given the sensitive nature of this topic, and since ‘girls’ is exclusionary (while ‘women and girls,’ the currently accepted term for female-gendered people, doesn’t fit here), I’ve used ‘females’ as the best available compromise—though it doesn’t capture all demographic nuances, for which I apologize.

^†In this article, ‘performative’ refers to makeup intended to be visible and recognized as such, like mascara, eyeliner, blusher, and foundation, as opposed to concealing creams and other subtle cosmetic applications.

First published Friday, July 18, 2025