SRAP: SVD-Refined Adversarial Perturbations for Imperceptible Face-Swap Defense

• URL: http://arxiv.org/abs/2608.03395v1
• Date: Tue, 04 Aug 2026 09:48:46 GMT
• Title: SRAP: SVD-Refined Adversarial Perturbations for Imperceptible Face-Swap Defense
• Abstract summary: adversarial perturbations generated by projected gradient descent (PGD) can disrupt the identity representations used by face-swapping models.<n>We analyze these spatial and spectral inefficiencies through identity-sensitivity estimation and the singular-value decomposition (SVD) of PGD perturbations.<n>We propose SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step.
• Score: 15.331054591146978
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Deepfake technologies pose increasing threats to facial privacy and identity security, motivating proactive defenses that protect facial images before misuse. Although adversarial perturbations generated by projected gradient descent (PGD) can disrupt the identity representations used by face-swapping models, their visual quality is degraded by two characteristics: perturbations are distributed broadly over the image, including identity-insensitive regions, and they contain visually salient high-frequency components. We analyze these spatial and spectral inefficiencies through identity-sensitivity estimation and the singular-value decomposition (SVD) of PGD perturbations. Our analysis shows that later singular components contain a disproportionate amount of high-frequency energy, while the leading components preserve most of the perturbation energy and defense utility. Based on these observations, we propose SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step. The SVD refinement suppresses high-rank, high-frequency residuals, while the mask restricts perturbations to locations that strongly influence identity representations. Experiments on CelebA-HQ and VGGFace2-HQ demonstrate that SRAP substantially improves protected-image fidelity across all reported metrics while maintaining competitive identity-disruption performance, yielding a favorable trade-off between face-swap defense and visual imperceptibility.

Related papers

• Phantom: A Unified Face-Swap Deepfake Protection Framework with Latent and Spatial Constraints [0.6533091401094099]
  Face-swapping deepfakes pose an escalating threat to personal privacy by enabling unauthorized identity manipulation.<n>We present Phantom, a unified face-swap deepfake protection framework that jointly constrains perturbations in latent and spatial domains.
  arXiv  Detail & Related papers  (2026-06-30T14:10:38Z)
• Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attacks [2.1485350418225244]
  We propose Adv-TGD, a generative adversarial attack framework.<n>It synthesizes photorealistic faces capable of impersonating target identities and deceiving face recognition systems.<n> Adv-TGD attains an average attack success rate (ASR) of 85.90% across IR152, IRSE50, MobileFace, and FaceNet.
  arXiv  Detail & Related papers  (2026-06-10T03:28:00Z)
• Bypassing Copyright Protection in Diffusion-based Customization via Two-Stage Latent Feature Optimization [51.33055188976282]
  adversarial attacks have emerged as a prominent defense strategy to prevent malicious content forgery in personalized image generation.<n>We introduce Two-Stage Latent Feature Optimization (TS-LFO), an efficient and effective copyright-stealing attack against protected diffusion-based customization.<n>Extensive experiments show that TS-LFO consistently bypasses state-of-the-art (SOTA) copyright defenses and outperforms SOTA copyright attacks such as DiffPure, GrIDPure and IMPRESS.
  arXiv  Detail & Related papers  (2026-06-06T07:59:08Z)
• SIDeR: Semantic Identity Decoupling for Unrestricted Face Privacy [53.75084833636302]
  We propose SIDeR, a Semantic decoupling-driven framework for unrestricted face privacy protection.<n> SIDeR decomposes a facial image into a machine-recognizable identity feature vector and a visually perceptible semantic appearance component.<n>For authorized access, SIDeR can be restored to its original form when the correct password is provided.
  arXiv  Detail & Related papers  (2026-02-04T19:30:48Z)
• Single-Pixel Vision-Language Model for Intrinsic Privacy-Preserving Behavioral Intelligence [55.512671026669516]
  We propose the Single-Pixel Vision-Language Model (SP-VLM), a novel framework that reimagines secure environmental monitoring.<n>It achieves intrinsic privacy-by-design by capturing human dynamics through inherently low-dimensional single-pixel modalities.<n>We show that SP-VLM can nonetheless extract meaningful behavioral semantics, enabling robust anomaly detection, people counting, and activity understanding.
  arXiv  Detail & Related papers  (2026-01-21T09:11:26Z)
• Safeguarding Facial Identity against Diffusion-based Face Swapping via Cascading Pathway Disruption [21.37567715195999]
  We propose VoidFace, a systemic defense method that views face swapping as a coupled identity pathway.<n>We first introduce localization disruption and identity erasure to degrade physical regression and semantic embeddings, thereby impairing the accurate modeling of the source face.<n>We then intervene in the generative domain by decoupling attention mechanisms to sever identity injection, and corrupting intermediate diffusion features to prevent the reconstruction of source identity.
  arXiv  Detail & Related papers  (2026-01-21T07:52:56Z)
• Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protection [14.797807196805607]
  Face recognition has led to serious privacy concerns due to potential unauthorized surveillance and user tracking on social networks.<n>Existing methods for enhancing privacy fail to generate natural face images that can protect facial privacy.<n>We propose DiffAIM to generate natural and highly transferable adversarial faces against malicious FR systems.
  arXiv  Detail & Related papers  (2025-04-30T13:49:59Z)
• ID-Guard: A Universal Framework for Combating Facial Manipulation via Breaking Identification [60.73617868629575]
  misuse of deep learning-based facial manipulation poses a significant threat to civil rights.<n>To prevent this fraud at its source, proactive defense has been proposed to disrupt the manipulation process.<n>This paper proposes a universal framework for combating facial manipulation, termed ID-Guard.
  arXiv  Detail & Related papers  (2024-09-20T09:30:08Z)
• Diff-Privacy: Diffusion-based Face Privacy Protection [58.1021066224765]
  In this paper, we propose a novel face privacy protection method based on diffusion models, dubbed Diff-Privacy. Specifically, we train our proposed multi-scale image inversion module (MSI) to obtain a set of SDM format conditional embeddings of the original image. Based on the conditional embeddings, we design corresponding embedding scheduling strategies and construct different energy functions during the denoising process to achieve anonymization and visual identity information hiding.
  arXiv  Detail & Related papers  (2023-09-11T09:26:07Z)
• Dual Spoof Disentanglement Generation for Face Anti-spoofing with Depth Uncertainty Learning [54.15303628138665]
  Face anti-spoofing (FAS) plays a vital role in preventing face recognition systems from presentation attacks. Existing face anti-spoofing datasets lack diversity due to the insufficient identity and insignificant variance. We propose Dual Spoof Disentanglement Generation framework to tackle this challenge by "anti-spoofing via generation"
  arXiv  Detail & Related papers  (2021-12-01T15:36:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.