Search papers, labs, and topics across Lattice.
This paper introduces SRAP, a novel defense mechanism against face-swapping attacks that leverages singular-value decomposition (SVD) to refine adversarial perturbations. By analyzing the spatial and spectral inefficiencies of existing perturbation methods, the authors demonstrate that their approach significantly enhances the visual fidelity of protected images while effectively disrupting identity representations. Experimental results on CelebA-HQ and VGGFace2-HQ show that SRAP achieves a superior balance between imperceptibility and defense efficacy compared to traditional methods.
SRAP achieves a remarkable trade-off, enhancing image fidelity while maintaining robust identity disruption against face-swapping attacks.
Deepfake technologies pose increasing threats to facial privacy and identity security, motivating proactive defenses that protect facial images before misuse. Although adversarial perturbations generated by projected gradient descent (PGD) can disrupt the identity representations used by face-swapping models, their visual quality is degraded by two characteristics: perturbations are distributed broadly over the image, including identity-insensitive regions, and they contain visually salient high-frequency components. We analyze these spatial and spectral inefficiencies through identity-sensitivity estimation and the singular-value decomposition (SVD) of PGD perturbations. Our analysis shows that later singular components contain a disproportionate amount of high-frequency energy, while the leading components preserve most of the perturbation energy and defense utility. Based on these observations, we propose SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step. The SVD refinement suppresses high-rank, high-frequency residuals, while the mask restricts perturbations to locations that strongly influence identity representations. Experiments on CelebA-HQ and VGGFace2-HQ demonstrate that SRAP substantially improves protected-image fidelity across all reported metrics while maintaining competitive identity-disruption performance, yielding a favorable trade-off between face-swap defense and visual imperceptibility.
