The Short Answer
Detecting PII in media is a detection problem per modality and redaction is a destruction problem, and teams usually solve the first and skip the second. Faces, licence plates, screens, badges, and documents-in-frame are visual identifiers; a voice is a biometric identifier on its own, separate from whatever the words say; and a transcript is ordinary text PII once speech becomes writing.
The part that fails audits: drawing a black box over a face in a player, or blurring it in a derived preview, does not redact anything if the original file, the untouched keyframes, or the embedding computed before redaction are still reachable. Redaction is only real when the identifying signal is unrecoverable from every artifact you kept, which for media means the source, the derived renditions, the thumbnails, the transcript, and the vectors.
What Actually Counts as PII in Each Modality
Images. Faces are the obvious one. Licence plates, house numbers, ID cards and badges held up to camera, screens showing someone's inbox, and tattoos are all identifying. So is the metadata: EXIF routinely carries GPS coordinates and a device serial, which identify a person without a single pixel of them.
Video. Everything above, per frame, plus two things a per-frame view misses. Gait and posture identify people at distances where a face is unresolvable. And an identifier that appears for three frames out of ninety thousand is still an identifier, which is why sampling one frame per second is a detection strategy with a known hole in it.
Audio. Two independent layers. The content layer is what is said: names, addresses, card numbers, which become text PII the moment you transcribe. The biometric layer is the voice itself, which identifies the speaker regardless of the words, and survives transcription because it lives in the waveform you kept.
Documents in media. A photographed form, a shared screen in a recording, a whiteboard. These carry the highest density of PII and are the most commonly missed, because a detector trained on faces does not fire on a page of text.
Why Detect-Then-Blur Is Not Redaction
Three failure modes, in rough order of how often they turn up.
The original survives. The redacted rendition is a new file; the source object usually stays in the bucket, and the derived keyframes, thumbnails, and preview clips generated at ingest were produced before redaction and are not covered by it. Anyone with the source path retrieves the unredacted asset.
The blur is reversible. A Gaussian blur is a convolution, and a light one is invertible enough that deconvolution recovers a recognisable face. Pixelation is worse: it is downsampling, so the mapping from a small block grid to a plausible face is a problem models solve well. Irreversible redaction replaces the region with constant pixels or noise, destroying the information rather than smearing it.
The embedding remembers. If you embedded the frame before redacting it, the vector encodes the face. Similarity search over that index still retrieves the person, and embedding inversion can partially reconstruct what was encoded. Redacting the pixels while keeping the vector redacts the copy nobody was searching.
How Detection Actually Works
Faces use a detector such as RetinaFace, SCRFD, or a YOLO-family face model to produce boxes, and detection is deliberately separate from recognition: you need to know a face is present, not whose it is, and running identification to decide what to redact creates the biometric database you were trying to avoid.
Text in frame (plates, badges, documents) is scene-text detection plus OCR, then a rule or model pass over the recovered text. Plates benefit from a dedicated detector because they are small, angled, and motion-blurred in exactly the conditions where a general OCR model degrades. Our guide on OCR and document AI internals covers the recovery side.
Tracking, not per-frame detection, is what makes video work. Detect on sampled frames, then propagate boxes with a tracker so the redaction persists through the frames where the detector missed. A face turned three-quarters away often falls below threshold for a few frames, and a per-frame pipeline flickers the mask off for exactly those frames. See multi-object tracking.
Audio needs the words and the speaker separated. Transcribe with word-level timestamps, run entity detection over the transcript, then mute or tone the corresponding samples; forced alignment is what makes the timestamps precise enough to cut a card number without clipping the word before it. For the voice itself, redaction means removing or transforming the audio, since a pitch shift is reversible and leaves the biometric largely intact.
The Irreversibility Test
One question separates redaction from a visual effect: if someone has the redacted artifact and unlimited compute, can they recover the identifier? Apply it to each technique.
| Technique | Recoverable? | Notes |
| Black box / constant fill | No | The pixels are gone; nothing to invert |
| Noise fill | No | Original signal destroyed |
| Heavy pixelation | Often yes | Downsampling is invertible enough for a model to guess well |
| Gaussian blur | Often yes | Deconvolution recovers structure at low sigma |
| Overlay in the player | No, it was never applied | The file is untouched; only the viewer changed |
| Crop | No, if re-encoded | Yes if the crop is metadata over an intact stream |
| Audio silence | No | Samples replaced |
| Audio pitch shift | Yes | Invertible transform, voiceprint largely survives |
What About the Data You Already Indexed?
Redaction after indexing is a deletion problem as much as a detection one. The derived artifacts each need their own treatment: vectors computed from unredacted frames must be deleted and recomputed, transcripts need the spans removed rather than masked in a UI, and thumbnails or preview renditions must be regenerated from the redacted source. Anything still holding the pre-redaction signal is a copy of the thing you were asked to remove. Deleting data from a vector index covers why the vector is the copy people forget, and why most ANN indexes mark rather than remove.
The cheaper ordering, when you can choose it, is to redact at ingest and index the redacted rendition, so no vector ever encodes the identifier. That is only available if you know the policy before you index, which is exactly the thing that changes after the fact.
How Do You Verify a Redaction Actually Happened?
Checks that a passing pipeline cannot fake:
An empty result from a redaction check reads as success and is also what a broken check returns, so prefer checks that would fail loudly on an unredacted input, and test them against one.
What This Looks Like in Mixpeek
Detection runs as extraction over your object storage: faces, on-screen text, and transcripts with word-level timings become features on the document rather than a separate pipeline you operate. That matters for redaction specifically because the derivation is recorded, so "what did we produce from this object" is answerable, which is the question a redaction request actually asks.
Redaction policy stays yours. The useful primitive we provide is that everything derived from an object is enumerable and deletable together, so recomputing after a redaction does not leave an orphaned vector behind. MVS keeps those vectors in your own object storage, which keeps residency and erasure answerable in one place. Pricing starts at $25/mo for up to 1M vectors.