{"id":"1d4441e0-25e7-4fca-9a44-834b6cac2ab3","arxiv_id":"2412.01101","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"Small adversarial perturbations that make DNN face detectors miss faces can substantially degrade face-swap DeepFake output quality in both training and inference.","lead":"This paper describes FacePoison, a defense that adds tiny adversarial noise to photos and videos so that face detectors fail and DeepFake creators cannot extract clean faces for training or synthesis. If it works in practice, it offers a proactive privacy tool that makes it harder to use someone's online images to make a DeepFake, without waiting for post-hoc forensic detection.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table III transferability results undermine the unknown-attacker setting: RetinaFace/YOLO5Face poisons leave other DNN detectors above 96% F1, so the central claim is only demonstrated for a known, white-box detector.","rationale":"The reader's weakest assumption correctly identifies the defense's dependence on DNN-based face detection and on transferability to unknown detectors. The paper's own Table III provides direct evidence that transferability is often absent: lightweight source detectors (RetinaFace, YOLO5Face) leave heavier detectors essentially unaffected, with F1 scores above 96%. Because the defense is intended to protect uploaded images against attackers who control the downstream pipeline, the relevant success condition is not white-box F1 collapse on the detector used to generate the perturbation, but black-box robustness against a detector selected by the attacker. The inference and training obstruction experiments all use matched detectors, so they cannot distinguish between 'the defense works against any DNN detector' and 'the defense works when the defender guesses the detector correctly.' This is a load-bearing gap, but it is not a reason to reject the paper outright: the method is clearly effective in the white-box setting, the random-noise baseline is properly controlled, the code is released, and the authors explicitly acknowledge the non-DNN limitation in Section V-D. The VideoFacePoison contradiction in Section V-B5 is also serious and independently supports a conditional verdict, but it concerns the new video-propagation component rather than the central FacePoison claim. Overall, the conditional verdict remains appropriate; the authors should either demonstrate cross-detector DeepFake obstruction or explicitly narrow the claimed defense to a known-detector scenario.","tokens_in":22332,"tokens_out":5211,"duration_ms":52143,"concrete_test":"Use the Table V protocol but decouple source and target detectors: (1) generate FacePoison with RetinaFace and YOLO5Face; (2) run SimSwap and InfoSwap on FF++/Celeb-DF using faces extracted from the poisoned images by DSFD, S3FD, and PyramidBox; (3) report SSIM against the same Random baseline used in Table V. If SSIM stays near the Random baseline (e.g., above roughly 85%) in these cross-detector settings, the central claim holds only under a white-box detector assumption and should be restated as detector-specific. A secondary check with the same logic: retrain one FaceSwap model on images poisoned with YOLO5Face but extract training faces with DSFD; if the trained model produces near-clean SSIM, the training-obstruction claim also fails under detector mismatch.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central practical claim is that FacePoison hides faces from DeepFake pipelines by making face detection malfunction. This requires the poison to work against the detector the attacker actually uses, which the defender does not know in the stated threat model (Section III-A). The paper's own transferability results contradict this for important cases: perturbations generated on RetinaFace leave PyramidBox, S3FD, and DSFD at 97.6%, 96.4%, and 98.4% F1, and YOLO5Face-sourced perturbations leave those three detectors above 97% F1 (Table III). Since open-source face-swap tools use different DNN detectors, an attacker can avoid the defense by choosing a detector for which the poison is ineffective. Section V-D explicitly concedes that non-DNN detectors such as Dlib are largely immune. The DeepFake obstruction experiments in Tables V-VII only report the white-box setting where the detector used for poisoning matches the detector used for face extraction during DeepFake synthesis, so they do not establish that a poisoned photo hides faces from an arbitrary downstream pipeline. The VideoFacePoison text/table inconsistency in Section V-B5 (Table IV shows VideoFacePoison average 34.5 versus FP-forward 38.0, the opposite of the claimed ordering) is a real internal problem, but the cross-detector transferability gap is the more load-bearing threat to the central claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FacePoison, a proactive defense that adds bounded adversarial perturbations to images so that DNN-based face detectors fail to extract faces, thereby contaminating the face sets used by face-swap DeepFake models in both training and inference. It adapts several iterative adversarial attacks to a feature-level, importance-guided objective and introduces VideoFacePoison, which propagates perturbations across video frames via optical flow to reduce computational cost. Experiments on five face detectors and eleven DeepFake models report large F1-score drops for face detection and large SSIM drops for generated DeepFake faces, alongside robustness studies (compression, resizing, noise, blur) and a poison-ratio analysis.","tokens_in":22535,"tokens_out":3491,"duration_ms":35032,"significance":"If the central claim holds, this is a useful new direction for proactive DeepFake defense: rather than attacking the generative model directly, it attacks the data-preparation step that most face-swap pipelines share. The paper's strengths are its extensive empirical coverage (5 detectors, 11 DeepFake models, training and inference scenarios), the ablation of multi-layer feature attacks, robustness experiments, and the public release of source code. However, the practical significance depends on whether a poison generated for one detector transfers to the unknown detector used by an actual DeepFake attacker. The transferability results in Table III show that this does not hold for several practically important source-target pairs, and the DeepFake obstruction experiments are only reported in the white-box setting. The VideoFacePoison section also contains an internal inconsistency between the text and Table IV. These issues do not invalidate the white-box efficacy results, but they substantially narrow the currently supported claims.","major_comments":[{"comment":"The threat model states that users process their photos before uploading and cannot know which face detector an attacker will use. Table III, however, shows that this unknown-attacker setting is not supported: perturbations generated from RetinaFace leave PyramidBox, S3FD, and DSFD at 97.6%, 96.4%, and 98.4% F1, respectively, and YOLO5Face-sourced perturbations leave those three detectors above 97% F1. The DeepFake obstruction experiments in Tables V-VII only report the case where the detector used for poisoning matches the detector used for face extraction. The central claim that FacePoison 'hides faces in plain sight' from DeepFake pipelines therefore needs either (a) experiments demonstrating that cross-detector poisons also degrade DeepFake SSIM, or (b) an explicit re-scoping of the claim to a known, white-box detector setting.","section":"Section III-A and Table III"},{"comment":"The text states that VideoFacePoison 'largely outperforms FP-forward on average,' but Table IV gives an average F1 of 34.5 for VideoFacePoison versus 38.0 for FP-forward, which is the opposite ordering. The claim is also contradicted for RetinaFace (33.6 vs. 46.7) and YOLO5Face (59.0 vs. 55.8 for the per-detector comparison, though the average is lower). The narrative around VideoFacePoison's effectiveness needs to be corrected, and the analysis should explain why bidirectional optical-flow propagation underperforms forward-only propagation on several detectors.","section":"Section V-B5 and Table IV"},{"comment":"The VideoFacePoison evaluation uses face detector outputs as ground truth because the videos have no face annotations. Since the attack is designed to make that same detector fail, computing F1 against the detector's own clean-frame outputs conflates genuine detection failures with detector-specific errors and can systematically bias the reported F1 scores. The authors should either use manually annotated video frames or explicitly report the sensitivity of the conclusions to the choice of ground-truth source.","section":"Section V-B5"},{"comment":"For propagated frames, the adversarial perturbation is obtained by warping and averaging optical-flow-mapped perturbations and then adding it to the clean frame. Unlike the single-frame formulation in Eq. (6), there is no explicit clipping or constraint that the resulting perturbation remains within the epsilon bound. The imperceptibility claim for VideoFacePoison therefore needs an explicit verification of the per-frame L_infinity distortion, and, if necessary, a projection step to enforce the bound.","section":"Equations (10)-(11) and Section IV"}],"minor_comments":[{"comment":"The abstract contains a typo: 'F acePosion' should be 'FacePoison'.","section":"Abstract"},{"comment":"The text says 'None means no adversarial perturbations are added,' but Table IV does not include a None row; add the clean-video baseline for comparison.","section":"Table IV"},{"comment":"The text describes the model as 'BlendFace' but Tables V and VII refer to 'BlendSwap'; unify the naming.","section":"Section V-C1"},{"comment":"The conclusion calls face detection an 'indispensable pre-processing step,' which is stronger than the paper's own limitation statement in Section V-D; recommend softening this to reflect the face-swap-specific scope.","section":"Section VI"},{"comment":"The phrase 'which reveals that show that identity selection' contains a duplicated verb; rephrase.","section":"Section V-C2"},{"comment":"The name 'Lucas-Kanada' is a misspelling of Lucas-Kanade.","section":"Section IV-1"}],"recommendation":"major_revision","confidential_remarks":"The white-box results are solid and the paper is likely to make a useful contribution after re-scoping. The main concern is that the title, abstract, and threat model promise protection against arbitrary DeepFake pipelines, while the evidence only supports a known-detector setting; the transferability gap is not a minor caveat but a load-bearing limitation. I would also ask the editor to ensure the VideoFacePoison text/table contradiction is addressed in revision, as it currently undermines a headline contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version. The paper's core claim — that adversarial perturbations can break DNN face detectors and thereby degrade face-swap DeepFake generation — is supported by a large, careful set of experiments. The headline numbers are real: F1 drops from around 98% to single digits in the white-box setting, and SSIM of generated faces drops from roughly 90-99% to 10-40% across eleven models. That is a useful result for proactive defense, complementary to post-hoc detection.\n\nWhat is actually new: VideoFacePoison, which propagates the perturbation across frames using optical flow, cutting computational cost. The expanded evaluation across eleven DeepFake models and five detectors is also a genuine contribution. The source code is public, and the paper is honest about the main limitation: non-DNN detectors like Dlib are largely immune, and the method only targets face-swap pipelines that rely on automatic face detection.\n\nThe soft spots, in decreasing severity. First, transferability (Table III) is the real load-bearing limitation. Poisons generated on lightweight detectors (RetinaFace, YOLO5Face) leave heavier detectors (PyramidBox, S3FD, DSFD) at 96-98% F1. In the threat model, the defender does not know which detector the attacker will use, so the practical guarantee is much narrower than the title suggests. The paper acknowledges this, but the DeepFake obstruction experiments only report the white-box setting where the detector used for poisoning matches the detector used for extraction. That leaves an open question: does a poison from a heavy source (e.g., DSFD) actually degrade DeepFake quality when the attacker uses a different detector? Likely yes in many cases, but it is not measured.\n\nSecond, the claimed internal contradiction in VideoFacePoison is a misreading. The text says VideoFacePoison outperforms FP-forward on average, and Table IV confirms it — 34.5 average F1 versus 38.0, where lower F1 is better. However, the missing None baseline in Table IV is a minor omission; we do not see the clean F1 for those videos, so the absolute effect is unclear.\n\nWho this is for: researchers working on proactive deepfake defense, adversarial attacks on detectors, and practical tools that protect images before upload. It deserves a serious referee. The main revision request should be cross-detector DeepFake obstruction experiments and a clearer statement of when the defense is expected to work. I would send it out.","headline":"Solid empirical study: white-box face-detector disruption degrades DeepFake generation, with a real video extension, but the unknown-attacker transferability gap is the soft spot.","tokens_in":23167,"tokens_out":5636,"would_cite":true,"duration_ms":46083,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FacePoison claims that imperceptible adversarial noise applied to a person's photos can break the face-detection step that face-swap DeepFakes rely on, degrading forged videos in both training and inference.","keywords":["DeepFake defense","proactive defense","face detection","adversarial perturbation","face swapping","video adversarial attack","optical flow propagation","multimedia forensics"],"falsifier":"Extract faces from poisoned images using a classical non-deep-learning face detector or manual crops, feed them into one of the reported DeepFake models, and measure SSIM; if the synthesized faces keep near the clean-baseline quality, the central claim fails.","tokens_in":22037,"feed_emoji":"🎭","tokens_out":13269,"duration_ms":113257,"temperature":0.7,"pith_summary":"FacePoison is a proactive DeepFake defense: instead of detecting fake videos after they appear, it contaminates the data a forger would collect. The paper's central assertion is that face-swap DeepFake models depend on automatic face detection as the first step of both training and synthesis, so if deep-learning-based face detectors fail on a user's images, the extracted faces are wrong and the generated DeepFake faces degrade. On the WIDER benchmark the adapted attacks cut face-detection $F_1$ from roughly 94–99% to 5% or below, and across eleven DeepFake models the $SSIM$ of generated faces falls from roughly 90–99% to roughly 10–40% in many settings, reaching single digits when detection is fully broken. A video extension, VideoFacePoison, propagates one frame's perturbation to neighboring frames with optical flow to lower the computational cost. If the claim holds, individuals and platforms can protect uploaded media by poisoning the data-preparation stage rather than relying only on post-hoc forensics.","feed_headline":"Poisoned pixels drop face detection below 5 percent","feed_subtitle":"Imperceptible noise on uploaded photos makes face-swap models produce badly degraded fake faces.","key_machinery":"The load-bearing object is the adversarial perturbation produced by attacking intermediate detector features. The authors define an importance-guided map for each attacked layer by back-propagating a pseudo-objective, the cosine similarity between the clean last-layer feature and the attacked last-layer feature, so the attack does not need to know the detector's task loss. The final loss is a weighted sum over layers of the importance-guided map multiplied by the attacked feature response, with random input masking and gradient averaging to stabilize the maps. For video, VideoFacePoison uses optical flow in both forward and backward directions to map a perturbation from one frame onto adjacent frames, recomputing only periodically.","core_discovery":"The paper argues that the face detector is the most exposed link in the face-swap pipeline. Given a victim's photo, FacePoison solves for a small bounded perturbation whose objective is to corrupt the intermediate feature maps of the detector, guided by importance maps, rather than to flip the detector's final output. The result is that the detector either produces no box, a wrong box, or a box so distorted that the downstream model consumes garbage faces; because the same corrupted face set feeds both model training and test-time synthesis, the generated DeepFake is visually degraded. The paper validates this on five deep-learning face detectors and eleven face-swap models, and the reported numbers are the evidence for the claim.","pith_inferences":["A natural extension is to test the same data-preparation sabotage against detectors retrained on poisoned images or against detectors outside the five tested; the transferability asymmetry suggests generating perturbations from heavy, feature-rich detectors is the safer deployment strategy.","The optical-flow propagation premise, that adversarial perturbations track image content, could be reused to protect other detection-dependent video processes such as person re-identification or face reenactment, though the paper does not claim this.","An attacker's cheapest countermeasure is to switch to classical face detection or manual cropping, which the paper acknowledges; a stronger defense would need perturbations that also disrupt non-deep detectors or survive platform re-encoding.","If platforms adopted pre-upload poisoning, the perturbation could double as a privacy watermark, but its robustness to each platform's compression and resizing would need to be measured in deployment."],"forward_implications":["A person can pre-poison photos before uploading them, so any face-swap model that later scrapes those images trains on contaminated faces and produces degraded forgeries.","DeepFake training need not be fully poisoned to start failing; the reported poison-ratio curve shows synthesis quality is harmed as the share of contaminated training faces grows.","Video protection becomes cheaper because VideoFacePoison computes full perturbations only on selected frames and propagates them with optical flow, retaining most of the disruption.","Because the attack targets intermediate features shared across detector backbones, one poisoned image can transfer among detectors, although the paper's transferability table shows heavier detectors make better sources than lightweight ones.","The defense is complementary to passive DeepFake detection: it acts at data collection time, before a forgery exists, so it does not depend on forensic methods keeping pace with new generators."],"supporting_citations":[{"why":"This is the prior conference version that introduced the face-poison idea, which the present paper extends to multiple attacks, video propagation, and eleven models.","marker":"[28]"},{"why":"RetinaFace is one of the five deep-learning face detectors under attack and supplies the MobileNet backbone targeted by the feature-level perturbations.","marker":"[40]"},{"why":"YOLO5Face is a lightweight detector in the attack set; its full disruption creates the all-zero training faces reported in the training obstruction tests.","marker":"[41]"},{"why":"WIDER is the face-detection benchmark on which the reported $F_1$ collapse from near-perfect levels to 5% or below is measured.","marker":"[47]"},{"why":"DIM is the input-diversity attack that the paper adapts into Ada-DIM and Ada-DIM++, the strongest variants in the detection disruption table.","marker":"[56]"},{"why":"This work motivates the importance-guided maps that select which feature elements to disturb, the core mechanism for transferable detector attacks.","marker":"[85]"},{"why":"This optical flow algorithm is what VideoFacePoison uses to propagate adversarial perturbations from one video frame to adjacent frames.","marker":"[90]"},{"why":"FaceSwap is the face-swapping software whose five model variants serve as the DeepFake testbed for the inference and training obstruction experiments.","marker":"[4]"},{"why":"SimSwap is one of the modern face-swap models evaluated, showing the obstruction claim extends beyond the classic auto-encoder pipelines.","marker":"[6]"},{"why":"Celeb-DF supplies the videos for VideoFacePoison evaluation and the identity-pair data for the training obstruction experiments.","marker":"[17]"}],"fun_headline_variants":["Hide faces in plain sight by poisoning face detectors","FacePoison disrupts face detectors to stop deepfake generation","Add noise to photos to break face detectors and ruin deepfakes","Hiding faces: new defense poisons face detection in videos","Pixel-level tricks blind face detectors, sabotaging deepfakes"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense stands on the premise that face-swap DeepFake pipelines always begin by automatically cropping faces with a deep-learning-based detector, so anyone who crops faces by hand, uses a classical detector, or relies on a generator that skips automatic face detection bypasses the defense.","fun_headline_variants_meta":{"raw":{"variants":["Hide faces in plain sight by poisoning face detectors","FacePoison disrupts face detectors to stop deepfake generation","Add noise to photos to break face detectors and ruin deepfakes","Hiding faces: new defense poisons face detection in videos","Pixel-level tricks blind face detectors, sabotaging deepfakes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000961,"raw_usage":{"total_tokens":4071,"prompt_tokens":900,"completion_tokens":3171,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":516,"completion_tokens_details":{"reasoning_tokens":3087}},"tokens_in":516,"tokens_out":3171,"duration_ms":20796,"temperature":1.0,"reasoning_tokens":3087,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T04:40:44.574238+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Extract faces from poisoned images using a classical non-deep-learning face detector or manual crops, feed them into one of the reported DeepFake models, and measure SSIM; if the synthesized faces keep near the clean-baseline quality, the central claim fails.","supporting_citations":[{"cited_title":"Face poison: Obstructing deepfakes by disrupting face detection,","cited_arxiv_id":null,"evidence_quote":"This is the prior conference version that introduced the face-poison idea, which the present paper extends to multiple attacks, video propagation, and eleven models."},{"cited_title":"Retinaface: Single-shot multi-level face localisation in the wild,","cited_arxiv_id":null,"evidence_quote":"RetinaFace is one of the five deep-learning face detectors under attack and supplies the MobileNet backbone targeted by the feature-level perturbations."},{"cited_title":"Yolo5face: Why reinventing a face detector,","cited_arxiv_id":null,"evidence_quote":"YOLO5Face is a lightweight detector in the attack set; its full disruption creates the all-zero training faces reported in the training obstruction tests."},{"cited_title":"Wider face: A face detection benchmark,","cited_arxiv_id":null,"evidence_quote":"WIDER is the face-detection benchmark on which the reported $F_1$ collapse from near-perfect levels to 5% or below is measured."},{"cited_title":"Improving transferability of adversarial examples with input diversity,","cited_arxiv_id":null,"evidence_quote":"DIM is the input-diversity attack that the paper adapts into Ada-DIM and Ada-DIM++, the strongest variants in the detection disruption table."},{"cited_title":"Feature importance-aware transferable adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"This work motivates the importance-guided maps that select which feature elements to disturb, the core mechanism for transferable detector attacks."},{"cited_title":"Two-frame motion estimation based on polynomial expansion,","cited_arxiv_id":null,"evidence_quote":"This optical flow algorithm is what VideoFacePoison uses to propagate adversarial perturbations from one video frame to adjacent frames."}],"review_version":1}