Design GenAI System: Face Generation
Design a face generation system: GAN/diffusion models, safety filters, and production scaling for synthetic face creation.
What is a face generation system?
A face generation system creates a new portrait from a prompt and bounded visual controls. A diffusion model may draw the pixels, but a production system also decides whether a request is allowed, schedules scarce GPU work, verifies the result, records provenance, and delivers only an authorized asset.
The core invariant is no unverified likeness release: do not publish an image unless the request is permitted, consent and identity evidence are sufficient for the product, the generated pixels pass policy, and an auditable provenance record exists. This practice design assumes a fictional consumer and enterprise portrait product handling 120,000 final images per day, with a 45-second p95 target for standard jobs.
- Prerequisite: Review text-to-image generation for diffusion, asynchronous jobs, and image-safety basics.
- First-version boundary: Create fictional portraits and consent-backed self portraits. Do not support public-figure generation, third-party face uploads, deceptive identity editing, or real-time video.
Begin with an authorized, bounded journey
- A user chooses either a fictional portrait or a self-portrait flow and selects bounded controls such as framing, lighting, background class, and style family.
- For a self portrait, the service gathers a consent receipt, checks that the supplied references contain one eligible subject, and records a retention choice before reserving GPU capacity.
- A durable job produces low-cost previews, then a selected final candidate in quarantine storage.
- Independent identity, policy, technical-quality, and provenance gates decide whether the candidate is released, reviewed, retried, or deleted.
State what the product promises
Product
Functional scope
- Prompted fictional faces and consent-backed self portraits.
- Bounded controls for crop, lighting, background, clothing category, and style family.
- Preview, final render, cancellation, download, and deletion workflows.
- Tenant-scoped presets with a versioned audit trail.
SLO
Service objectives
- Accept a valid job quickly and complete standard final jobs within 45 seconds at p95.
- Keep accepted jobs durable across worker loss and make cancellation and retries idempotent.
- Deliver through signed URLs from isolated object storage.
- Report an ETA or reject admission before queues become unbounded.
Likeness
Safety boundaries
- Require explicit consent for reference-based likeness generation.
- Block public-figure, deceptive impersonation, and disallowed sexual or violent requests.
- Do not use controls to materially change protected traits, apparent age, health, or credentials.
- Hold low-confidence evidence for review instead of silently lowering a threshold.
Boundary
Out of scope
- No open-ended face editor or identity-cloning API.
- No training on user uploads without a separate, revocable agreement.
- No cross-tenant reference reuse or shared fine-tune artifacts.
- No release when a required gate or audit dependency is unavailable.
The correct degraded response is an honest delay, lower-cost preview, request for better inputs, or review queue. It is never to skip a consent, identity, safety, or provenance gate.
Model choice for interactive face generation
Your app generates face images on demand while the user waits on screen for the result. Faces must look convincing but need not be flawless. Which model architecture should power the generator?
Constraint: Users wait interactively for each result, so perceived latency is the priority; image quality must be good but not flawless.