Abstract
Suffering from performance bottlenecks in passively detecting high-quality Deepfake images due to the advancement of generative models, proactive perturbations offer a promising approach to disabling Deepfake manipulations by inserting signals into benign images. However, existing proactive perturbation approaches remain unsatisfactory in several aspects: 1) visual degradation due to direct element-wise addition; 2) limited effectiveness against face swapping manipulation; 3) unavoidable reliance on white- and grey-box settings to involve generative models during training. In this study, we analyze the essence of Deepfake face swapping and argue the necessity of protecting source identities rather than target images, and we propose NullSwap, a novel proactive defense approach that cloaks source image identities and nullifies face swapping under a pure black-box scenario. We design an Identity Extraction module to obtain facial identity features from the source image, while a Perturbation Block is then devised to generate identity-guided perturbations accordingly. Meanwhile, a Feature Block extracts shallow-level image features, which are then fused with the perturbation in the Cloaking Block for image reconstruction. Furthermore, to ensure adaptability across different identity extractors in face swapping algorithms, we propose Dynamic Loss Weighting to adaptively balance identity losses. Experiments demonstrate the outstanding ability of our approach to fool various identity recognition models, outperforming state-of-the-art proactive perturbations in preventing face swapping models from generating images with correct source identities.
Abstract (translated)
由于生成模型的进步，被动检测高质量Deepfake图像时会遇到性能瓶颈。在这种情况下，通过在良性图片中插入信号来主动干扰的方法提供了一种有前景的策略，以阻止Deepfake操纵。然而，现有的主动干扰方法在几个方面仍不尽如人意：1）直接元素级添加导致视觉质量下降；2）对抗面部交换操作的有效性有限；3）不可避免地依赖于白盒和灰盒设置，在训练过程中涉及生成模型。 在这项研究中，我们分析了Deepfake面部交换的本质，并主张保护源身份而非目标图像的重要性。为此，我们提出了一种名为NullSwap的新主动防御方法，该方法在纯黑盒场景下隐藏源图像的身份并使面部交换无效。具体来说： 1. **Identity Extraction模块**：从源图像中获取面部身份特征。 2. **Perturbation Block**：根据上述身份信息生成引导扰动。 3. **Feature Block和Cloaking Block**：前者提取浅层图像特征，后者则将这些特征与扰动融合进行图像重建。 此外，为了确保在不同面部交换算法中的适应性，我们提出了动态损失加权（Dynamic Loss Weighting），以自适应地平衡身份损失。实验结果表明，我们的方法能够有效地欺骗各种身份识别模型，并且优于现有的主动干扰技术，在防止Deepfake生成带有正确源身份的图像方面具有更好的性能。
URL
https://arxiv.org/abs/2503.18678
