ID-Eraser: Proactive Defense Against Face Swapping via Identity Perturbation

Authors: Junyan Luo, Peipeng Yu, Jianwei Fei, Shiya Zeng, Xiaoyu Zhou, Zhihua Xia, Xiang Liu

Published: 2026-04-23 09:18:34+00:00

AI Summary

ID-Eraser is a novel feature-space proactive defense against face swapping that perturbs identity embeddings to remove identifiable facial information. It reconstructs visually realistic protection images using a Face Revive Generator (FRG), making identities unusable for Deepfake models while appearing natural to humans. Experiments demonstrate its effectiveness in disrupting identity recognition and face swapping systems, achieving low Top-1 accuracy and high visual fidelity.

Abstract

Deepfake technologies have rapidly advanced with modern generative AI, and face swapping in particular poses serious threats to privacy and digital security. Existing proactive defenses mostly rely on pixel-level perturbations, which are ineffective against contemporary swapping models that extract robust high-level identity embeddings. We propose ID-Eraser, a feature-space proactive defense that removes identifiable facial information to prevent malicious face swapping. By injecting learnable perturbations into identity embeddings and reconstructing natural-looking protection images through a Face Revive Generator (FRG), ID-Eraser produces visually realistic results for humans while rendering the protected identities unusable for Deepfake models. Experiments show that ID-Eraser substantially disrupts identity recognition across diverse face recognition and swapping systems under strict black-box settings, achieving the lowest Top-1 accuracy (0.30) with the best FID (1.64) and LPIPS (0.020). Compared with swaps generated from clean inputs, the identity similarity of protected swaps drops sharply to an average of 0.504 across five representative face swapping models. ID-Eraser further demonstrates strong cross-dataset generalization, robustness to common distortions, and practical effectiveness on commercial APIs, reducing Tencent API similarity from 0.76 to 0.36.

Key findings

ID-Eraser effectively erases identity features, achieving an average Top-1 accuracy of 0.301 across four face recognition models and reducing identity similarity in swapped faces to an average of 0.504 across five face swapping models. It maintains superior visual quality (FID 1.64, LPIPS 0.020) and demonstrates strong cross-dataset generalization, robustness to common image degradations, and practical effectiveness on commercial APIs, such as reducing Tencent API similarity from 0.76 to 0.36.

Approach

ID-Eraser proactively defends against face swapping by operating in the latent feature space, rather than pixel space. It utilizes a Feature Perturbation Module (FPM) to inject learnable perturbations directly into identity embeddings, which are then used by a Face Revive Generator (FRG) to reconstruct visually natural images. These protected images appear normal to humans but prevent face swapping models from accurately extracting and transferring identity information.

Datasets

CelebA-HQ, FFHQ, LFW, VGGFace2, FaceForensics++

Model(s)

UNKNOWN

Author countries

China, Italy

← Previous