AI Models Refuse to Judge Faces, But Will Draw a “Gay Man” or a “Criminal” on Request

Ask an AI model whether the person in a photo looks gay or straight, and it will refuse to answer. Ask it to edit the same photo so the person looks gay, straight, or like a criminal, and the model often complies, filling in stereotypical facial features. TechXplore reports this. The refusal, in other words, worked for the question but not for a task that leads to the same result.

Where the refusal breaks down

The direct question “is this person gay?” falls under a classic safety scenario. The model was trained not to infer sensitive attributes from appearance, and it learned that. An editing request looks different to it: it is a creative task, not an assessment of a person. Filters tuned for classification do not react to that phrasing.

The main takeaway is more troubling than the loophole itself. To “make a face look more criminal,” the model must hold some kind of map between facial features and labels. Refusing to answer hides that map but does not delete it. It stays in the weights and surfaces when the task is rephrased.

Physiognomy returns through the editor

The idea of “reading” orientation or criminal tendencies from a face is not new. In 2016, researchers from Shanghai claimed that a neural network could tell convicted people from non-convicted ones by their photos. In 2017, a paper by Michal Kosinski and Yilun Wang asserted that an algorithm could determine sexual orientation from a picture. Both papers drew harsh criticism: the correlations were explained by differences in hairstyles, makeup, camera angle, and photo quality, not by facial structure.

The edited images do not prove that such a link exists. They show what the model learned from its data: what the internet and image captions treat as “typical” for each category. The output reproduces cultural clichés, and it does so as a convincing photo of a specific person.

What the publication actually says

The available excerpt of the material contains no methodology or quantitative data, so what follows is only what it states directly:

• Direct question about orientation from a face: models refuse to answer.
• Request to edit a photo to look “gay” or “straight”: models often comply.
• Request to edit a photo to look like a “criminal”: the same behavior.
• The result is built on stereotypical features of appearance.
• Safety filters are tied to the wording of the request, not to the harm that is possible.

The share of successful requests, the list of tested models, and the experimental conditions should be checked in the original source.

What the risks are

The practical risks are clear. An edited photo can be used for harassment: to give a person a “criminal” look, to create “evidence” of orientation, or to pull an image out of context. For vulnerable groups, especially in countries where orientation is criminalized, this is a question of physical safety. Such images also reinforce stereotypes in the people who see them and consider them “plausible.”

What teams should do

If you are building a product on generative image editing, test it with more than direct questions. Include in your red-team exercises requests to transform appearance to fit social categories: orientation, ethnicity, religion, “criminality,” “poverty.” Test different phrasings and languages, because a refusal in English often does not carry over to Russian.

Filter at the level of output and intent, not just keywords. Do not use models to assess people by their faces in hiring, security, or scoring. If your model can “change the look” of a person, document which attributes it must not change, and check this regularly on new versions.