Pixelated text has been recovered and blurred faces unblurred. What actually removes information from an image — and what only looks like it does.
Blur and pixelation are transformations, not deletions. They take the pixels that were there and compute new ones from them, which means the output is still a function of the original. Some of the information survives the trip, and how much survives is not obvious by looking.
A solid fill is different in kind. It does not compute anything from the pixels underneath — it replaces them. Nothing about the original survives, because nothing about the original was used.
Pixelation averages each block of pixels down to a single colour. That sounds destructive, and for a photograph of a face it mostly is. For text it often is not, because text is drawn from a small, known set of shapes.
If an attacker can guess the font, the size and the rendering, they can pixelate every candidate string the same way and compare the blocks against yours until they match. Tooling to do exactly this has existed publicly since 2020. Short, high-value, predictable strings — an account number, an API key, an email address, a licence plate — are the easiest targets, because the search space is small and the payoff is large.
A Gaussian blur is a convolution, and convolutions can be approximately inverted. Recovery is harder than with pixelation and often imperfect, but "imperfect" can still be enough — you do not need a pristine image to read six digits.
The most famous case is not even mathematical. In 2007, Interpol released images in which a suspect's face had been obscured with a swirl filter. The swirl was simply applied in reverse, the face came back, and the man was identified and arrested. The filter had rearranged pixels rather than discarding them.
Two things routinely leak after a picture has been carefully censored.
The first is metadata. A photo straight off a phone carries EXIF: camera model, timestamp, and often GPS coordinates accurate to a few metres. Redacting a face in the frame does nothing about the location tag that says where it was taken.
The second is the layer. Drawing a black rectangle over text in a PDF or a slide deck covers it visually while leaving the text object intact underneath, where anyone can select and copy it. This has embarrassed law firms, government departments and newspapers repeatedly, and it will keep happening, because the document still looks correct on screen.
Ask one question: if someone reversed this perfectly, what would they get? If the answer is "a slightly clearer photo of a street", the filter is fine. If the answer is "my client's account number", it was never the right tool, however unreadable it looks to you.