Transferable Attack against Face Swapping in an Extended Space

Authors: Mingzhi Lyu, Yi Huang, Jun Xie, Zihao Zhao, Hong Xu, Adams Wai-Kin Kong

Published: 2026-06-24 04:09:57+00:00

AI Summary

This paper introduces the Additive Identity attack based on a Relighting function (AIR), a transferable attack designed to disrupt subject-agnostic face swapping (FS) models. AIR combines reillumination and additive perturbations to mislead identity extraction modules, extending the attack space for stronger yet visually natural adversarial examples. The method achieves high transferability without requiring a surrogate FS model and significantly outperforms existing attacks in success rate and image quality.

Abstract

Although deep Face Swapping (FS) models may benefit the entertainment industry, they pose severe threats to privacy and security. Existing protections, including deepfake detection and adversarial perturbation, are either passive responses or ineffective to unseen subject-agnostic FS models. In this paper, we propose a transferable attack against subject-agnostic FS models named Additive Identity attack based on a Relighting function (AIR). AIR leverages reillumination and additive perturbations to mislead the identity extraction modules in subject-agnostic FS models. By using these two types of perturbations simultaneously, the attack space is extended such that stronger but more visually natural adversarial examples can be identified. To further enhance the visual quality while preserving the effectiveness of the attack, an adaptive translation-invariant operation and an illumination control scheme are designed for AIR. Unlike other methods, AIR does not require a surrogate FS model to achieve high transferability. In addition, a mathematical proof is given for the extension of the attack space. Extensive experiments using 1000 image pairs across various state-of-the-art subject-agnostic FS models, including GAN and diffusion-based FS models, show that AIR surpasses all existing attacks in terms of both attack success rate and image quality.

Key findings

AIR significantly outperforms state-of-the-art attack methods on various GAN- and diffusion-based subject-agnostic FS models in terms of attack success rate (ASR) and image quality. The proposed Adaptive Translation-Invariant (ATI) operation markedly improves transferability while maintaining visual quality. The combined additive and functional attack strategy effectively expands the adversarial attack space, leading to more robust and less perceptible adversarial examples.

Approach

The AIR attack employs two strategies: Additive Identity Attack (AIA) and Relighting Functional Attack (RFA). AIA uses an adaptive translation-invariant operation to generate additive perturbations that mislead face recognition models used as surrogates. RFA leverages a relighting model to create functional perturbations by optimizing spherical harmonic coefficients, further extending the attack space. This combined approach targets identity extraction modules instead of the full FS model, enhancing transferability and imperceptibility.

Datasets

CelebA-HQ, VGGFace2-HQ, FFHQ

Model(s)

FaceShifter, SimSwap, MegaGAN, Diffface, Diffswap (as target FS models); ArcFace, SphereFace, CosFace, ElasticFace (as surrogate face recognition models); DPR (relighting model)

Author countries

Singapore

← Previous