Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces MetaCloak-JPEG, an adversarial perturbation method designed to protect face images from unauthorized DreamBooth-based deepfake generation by accounting for JPEG compression. It incorporates a Differentiable JPEG (DiffJPEG) layer using the Straight-Through Estimator within a bilevel meta-learning framework to optimize perturbations robust to JPEG compression artifacts. Experiments demonstrate that MetaCloak-JPEG significantly outperforms existing methods like PhotoGuard across various JPEG quality factors while maintaining image fidelity and memory efficiency.
Existing methods for preventing DreamBooth deepfakes crumble after standard JPEG compression, but MetaCloak-JPEG survives by explicitly modeling the compression pipeline.
The rapid progress of subject-driven text-to-image synthesis, and in particular DreamBooth, has enabled a consent-free deepfake pipeline: an adversary needs only 4-8 publicly available face images to fine-tune a personalized diffusion model and produce photorealistic harmful content. Current adversarial face-protection systems -- PhotoGuard, Anti-DreamBooth, and MetaCloak -- perturb user images to disrupt surrogate fine-tuning, but all share a structural blindness: none backpropagates gradients through the JPEG compression pipeline that every major social-media platform applies before adversary access. Because JPEG quantization relies on round(), whose derivative is zero almost everywhere, adversarial energy concentrates in high-frequency DCT bands that JPEG discards, eliminating 60-80% of the protective signal. We introduce MetaCloak-JPEG, which closes this gap by inserting a Differentiable JPEG (DiffJPEG) layer built on the Straight-Through Estimator (STE): the forward pass applies standard JPEG compression, while the backward pass replaces round() with the identity. DiffJPEG is embedded in a JPEG-aware EOT distribution (~70% of augmentations include DiffJPEG) and a curriculum quality-factor schedule (QF: 95 to 50) inside a bilevel meta-learning loop. Under an l-inf perturbation budget of eps=8/255, MetaCloak-JPEG attains 32.7 dB PSNR, a 91.3% JPEG survival rate, and outperforms PhotoGuard on all 9 evaluated JPEG quality factors (9/9 wins, mean denoising-loss gain +0.125) within a 4.1 GB training-memory budget.