FaceShield: Defending Facial Image against Deepfake Threats

Authors: Jaehwan Jeong, Sumin In, Sieun Kim, Hannie Shin, Jongheon Jeong, Sang Ho Yoon, Jaewook Chung, Sangpil Kim

Published: 2024-12-13 07:20:35+00:00

Comment: Accepted to ICCV 2025. Keywords: Deepfake, Adversarial Attack, Diffusion Models, GANs, Face Swap, Proactive Defense

AI Summary

This paper introduces FaceShield, a proactive defense method against deepfakes, specifically targeting those generated by Diffusion Models (DMs) while also being effective against existing GAN-based models. FaceShield achieves this by manipulating DM attention mechanisms and facial feature extractors, producing robust yet imperceptible adversarial perturbations. The method achieves state-of-the-art performance against the latest DM-based deepfake models, demonstrating transferability to GANs and enhanced imperceptibility and robustness against compression.

Abstract

The rising use of deepfakes in criminal activities presents a significant issue, inciting widespread controversy. While numerous studies have tackled this problem, most primarily focus on deepfake detection. These reactive solutions are insufficient as a fundamental approach for crimes where authenticity is disregarded. Existing proactive defenses also have limitations, as they are effective only for deepfake models based on specific Generative Adversarial Networks (GANs), making them less applicable in light of recent advancements in diffusion-based models. In this paper, we propose a proactive defense method named FaceShield, which introduces novel defense strategies targeting deepfakes generated by Diffusion Models (DMs) and facilitates defenses on various existing GAN-based deepfake models through facial feature extractor manipulations. Our approach consists of three main components: (i) manipulating the attention mechanism of DMs to exclude protected facial features during the denoising process, (ii) targeting prominent facial feature extraction models to enhance the robustness of our adversarial perturbation, and (iii) employing Gaussian blur and low-pass filtering techniques to improve imperceptibility while enhancing robustness against JPEG compression. Experimental results on the CelebA-HQ and VGGFace2-HQ datasets demonstrate that our method achieves state-of-the-art performance against the latest deepfake models based on DMs, while also exhibiting transferability to GANs and showcasing greater imperceptibility of noise along with enhanced robustness. Code is available here: https://github.com/kuai-lab/iccv25_faceshield

Key findings

FaceShield achieves state-of-the-art protection against Diffusion Model-based deepfakes, outperforming baselines in distortion and source similarity while using less noise. The method also exhibits strong transferability to GAN-based deepfake models and maintains effectiveness under JPEG compression and various purification techniques. Human evaluations confirmed superior noise imperceptibility and deepfake prevention.

Approach

FaceShield employs a three-pronged defense strategy: (i) manipulating the attention mechanism of Diffusion Models to exclude protected facial features during denoising, (ii) targeting prominent facial feature extraction models (like MTCNN and ArcFace) to enhance adversarial perturbation robustness, and (iii) using Gaussian blur and low-pass filtering to improve imperceptibility and robustness against JPEG compression.

Datasets

CelebA-HQ, VGGFace2-HQ

Model(s)

UNKNOWN

Author countries

South Korea

← Previous