Disruptive Attacks on Face Swapping via Low-Frequency Perceptual Perturbations

2025/08/28 by Mengxiao Huang, Minglei Shu, Huang, Mengxiao +5
Computer Science · #Biometric Identification and Security #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #Face recognition and analysis

paper · pdf · doi:10.48550/arxiv.2508.20595

openalex publication_date 2025/08/28 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Deepfake technology, driven by Generative Adversarial Networks (GANs), poses significant risks to privacy and societal security. Existing detection methods are predominantly passive, focusing on post-event analysis without preventing attacks. To address this, we propose an active defense method based on low-frequency perceptual perturbations to disrupt face swapping manipulation, reducing the performance and naturalness of generated content. Unlike prior approaches that used low-frequency perturbations to impact classification accuracy,our method directly targets the generative process of deepfake techniques. We combine frequency and spatial domain features to strengthen defenses. By introducing artifacts through low-frequency perturbations while preserving high-frequency details, we ensure the output remains visually plausible. Additionally, we design a complete architecture featuring an encoder, a perturbation generator, and a decoder, leveraging discrete wavelet transform (DWT) to extract low-frequency components and generate perturbations that disrupt facial manipulation models. Experiments on CelebA-HQ and LFW demonstrate significant reductions in face-swapping effectiveness, improved defense success rates, and preservation of visual quality.

Citations

• FractalForensics: Proactive Deepfake Detection and Localization via Fractal Watermarks
• NullSwap: Proactive Identity Cloaking Against Deepfake Face Swapping
• Robust Identity Perceptual Watermark Against Deepfake Face Swapping
• HyperReenact: One-Shot Reenactment via Jointly Learning to Refine and Retarget Faces
• Fine-Grained Face Swapping via Regional GAN Inversion
• StyleMask: Disentangling the Style Space of StyleGAN2 for Neural Face Reenactment
• Anti-Forgery: Towards a Stealthy and Robust DeepFake Disruption Attack via Adversarial Perceptual-aware Perturbations
• TAFIM: Targeted Adversarial Attacks against Facial Image Manipulations
• CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes
• Image-to-image Translation via Hierarchical Style Disentanglement
• DeepFake Detection Based on the Discrepancy Between the Face and its Context
• Disrupting Deepfakes: Adversarial Attacks Against Conditional Image\n Translation Networks and Facial Manipulation Systems
• Face X-ray for More General Face Forgery Detection
• StarGAN v2: Diverse Image Synthesis for Multiple Domains
• AttentionGAN: Unpaired Image-to-Image Translation using Attention-Guided Generative Adversarial Networks
• Multi-level Wavelet Convolutional Neural Networks
• GANimation: Anatomically-aware Facial Animation from a Single Image
• AttGAN: Facial Attribute Editing by Only Changing What You Want
• Progressive Growing of GANs for Improved Quality, Stability, and Variation
• Squeeze-and-Excitation Networks
• Universal adversarial perturbations
• U-Net: Convolutional Networks for Biomedical Image Segmentation
• Deep Learning Face Attributes in the Wild
• Image quality assessment: from error visibility to structural similarity

Related

• Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Faces
• FaceShield: Defending Facial Image against Deepfake Threats
• Defending Deepfake via Texture Feature Perturbation
• Hiding Faces in Plain Sight: Defending DeepFakes by Disrupting Face Detection
• Restricted Black-box Adversarial Attack Against DeepFake Face Swapping