Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Hiding Faces in Plain Sight: Defending DeepFakes by Disrupting Face Detection

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FacePoison claims that imperceptible adversarial noise applied to a person's photos can break the face-detection step that face-swap DeepFakes rely on, degrading forged videos in both training and inference.

desk verdict Solid empirical study: white-box face-detector disruption degrades DeepFake generation, with a real video extension, but the unknown-attacker transferability gap is the soft spot. read the letter →

arxiv 2412.01101 v2 pith:ZIJYCRGZ submitted 2024-12-02 cs.CV cs.CR

Delong Zhu , Yuezun Li , Baoyuan Wu , Jiaran Zhou , Zhibo Wang , Siwei Lyu This is my paper · ORCID
classification cs.CVcs.CR
keywords DeepFakedefenseproactivefacedetectionadversarialperturbationswappingvideoattackopticalflowpropagationmultimediaforensics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FacePoison is a proactive DeepFake defense: instead of detecting fake videos after they appear, it contaminates the data a forger would collect. The paper's central assertion is that face-swap DeepFake models depend on automatic face detection as the first step of both training and synthesis, so if deep-learning-based face detectors fail on a user's images, the extracted faces are wrong and the generated DeepFake faces degrade. On the WIDER benchmark the adapted attacks cut face-detection $F_1$ from roughly 94–99% to 5% or below, and across eleven DeepFake models the $SSIM$ of generated faces falls from roughly 90–99% to roughly 10–40% in many settings, reaching single digits when detection is fully broken. A video extension, VideoFacePoison, propagates one frame's perturbation to neighboring frames with optical flow to lower the computational cost. If the claim holds, individuals and platforms can protect uploaded media by poisoning the data-preparation stage rather than relying only on post-hoc forensics.

What carries the argument

The load-bearing object is the adversarial perturbation produced by attacking intermediate detector features. The authors define an importance-guided map for each attacked layer by back-propagating a pseudo-objective, the cosine similarity between the clean last-layer feature and the attacked last-layer feature, so the attack does not need to know the detector's task loss. The final loss is a weighted sum over layers of the importance-guided map multiplied by the attacked feature response, with random input masking and gradient averaging to stabilize the maps. For video, VideoFacePoison uses optical flow in both forward and backward directions to map a perturbation from one frame onto adjacent frames, recomputing only periodically.

What would settle it

Extract faces from poisoned images using a classical non-deep-learning face detector or manual crops, feed them into one of the reported DeepFake models, and measure SSIM; if the synthesized faces keep near the clean-baseline quality, the central claim fails.

Watch

Extended reading notes

Core claim

The paper argues that the face detector is the most exposed link in the face-swap pipeline. Given a victim's photo, FacePoison solves for a small bounded perturbation whose objective is to corrupt the intermediate feature maps of the detector, guided by importance maps, rather than to flip the detector's final output. The result is that the detector either produces no box, a wrong box, or a box so distorted that the downstream model consumes garbage faces; because the same corrupted face set feeds both model training and test-time synthesis, the generated DeepFake is visually degraded. The paper validates this on five deep-learning face detectors and eleven face-swap models, and the reported numbers are the evidence for the claim.

Load-bearing premise

The defense stands on the premise that face-swap DeepFake pipelines always begin by automatically cropping faces with a deep-learning-based detector, so anyone who crops faces by hand, uses a classical detector, or relies on a generator that skips automatic face detection bypasses the defense.

Editorial extensions

If this is right

  • A person can pre-poison photos before uploading them, so any face-swap model that later scrapes those images trains on contaminated faces and produces degraded forgeries.
  • DeepFake training need not be fully poisoned to start failing; the reported poison-ratio curve shows synthesis quality is harmed as the share of contaminated training faces grows.
  • Video protection becomes cheaper because VideoFacePoison computes full perturbations only on selected frames and propagates them with optical flow, retaining most of the disruption.
  • Because the attack targets intermediate features shared across detector backbones, one poisoned image can transfer among detectors, although the paper's transferability table shows heavier detectors make better sources than lightweight ones.
  • The defense is complementary to passive DeepFake detection: it acts at data collection time, before a forgery exists, so it does not depend on forensic methods keeping pace with new generators.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to test the same data-preparation sabotage against detectors retrained on poisoned images or against detectors outside the five tested; the transferability asymmetry suggests generating perturbations from heavy, feature-rich detectors is the safer deployment strategy.
  • The optical-flow propagation premise, that adversarial perturbations track image content, could be reused to protect other detection-dependent video processes such as person re-identification or face reenactment, though the paper does not claim this.
  • An attacker's cheapest countermeasure is to switch to classical face detection or manual cropping, which the paper acknowledges; a stronger defense would need perturbations that also disrupt non-deep detectors or survive platform re-encoding.
  • If platforms adopted pre-upload poisoning, the perturbation could double as a privacy watermark, but its robustness to each platform's compression and resizing would need to be measured in deployment.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes FacePoison, a proactive defense that adds bounded adversarial perturbations to images so that DNN-based face detectors fail to extract faces, thereby contaminating the face sets used by face-swap DeepFake models in both training and inference. It adapts several iterative adversarial attacks to a feature-level, importance-guided objective and introduces VideoFacePoison, which propagates perturbations across video frames via optical flow to reduce computational cost. Experiments on five face detectors and eleven DeepFake models report large F1-score drops for face detection and large SSIM drops for generated DeepFake faces, alongside robustness studies (compression, resizing, noise, blur) and a poison-ratio analysis.

Significance. If the central claim holds, this is a useful new direction for proactive DeepFake defense: rather than attacking the generative model directly, it attacks the data-preparation step that most face-swap pipelines share. The paper's strengths are its extensive empirical coverage (5 detectors, 11 DeepFake models, training and inference scenarios), the ablation of multi-layer feature attacks, robustness experiments, and the public release of source code. However, the practical significance depends on whether a poison generated for one detector transfers to the unknown detector used by an actual DeepFake attacker. The transferability results in Table III show that this does not hold for several practically important source-target pairs, and the DeepFake obstruction experiments are only reported in the white-box setting. The VideoFacePoison section also contains an internal inconsistency between the text and Table IV. These issues do not invalidate the white-box efficacy results, but they substantially narrow the currently supported claims.

major comments (4)
  1. [Section III-A and Table III] The threat model states that users process their photos before uploading and cannot know which face detector an attacker will use. Table III, however, shows that this unknown-attacker setting is not supported: perturbations generated from RetinaFace leave PyramidBox, S3FD, and DSFD at 97.6%, 96.4%, and 98.4% F1, respectively, and YOLO5Face-sourced perturbations leave those three detectors above 97% F1. The DeepFake obstruction experiments in Tables V-VII only report the case where the detector used for poisoning matches the detector used for face extraction. The central claim that FacePoison 'hides faces in plain sight' from DeepFake pipelines therefore needs either (a) experiments demonstrating that cross-detector poisons also degrade DeepFake SSIM, or (b) an explicit re-scoping of the claim to a known, white-box detector setting.
  2. [Section V-B5 and Table IV] The text states that VideoFacePoison 'largely outperforms FP-forward on average,' but Table IV gives an average F1 of 34.5 for VideoFacePoison versus 38.0 for FP-forward, which is the opposite ordering. The claim is also contradicted for RetinaFace (33.6 vs. 46.7) and YOLO5Face (59.0 vs. 55.8 for the per-detector comparison, though the average is lower). The narrative around VideoFacePoison's effectiveness needs to be corrected, and the analysis should explain why bidirectional optical-flow propagation underperforms forward-only propagation on several detectors.
  3. [Section V-B5] The VideoFacePoison evaluation uses face detector outputs as ground truth because the videos have no face annotations. Since the attack is designed to make that same detector fail, computing F1 against the detector's own clean-frame outputs conflates genuine detection failures with detector-specific errors and can systematically bias the reported F1 scores. The authors should either use manually annotated video frames or explicitly report the sensitivity of the conclusions to the choice of ground-truth source.
  4. [Equations (10)-(11) and Section IV] For propagated frames, the adversarial perturbation is obtained by warping and averaging optical-flow-mapped perturbations and then adding it to the clean frame. Unlike the single-frame formulation in Eq. (6), there is no explicit clipping or constraint that the resulting perturbation remains within the epsilon bound. The imperceptibility claim for VideoFacePoison therefore needs an explicit verification of the per-frame L_infinity distortion, and, if necessary, a projection step to enforce the bound.
minor comments (6)
  1. [Abstract] The abstract contains a typo: 'F acePosion' should be 'FacePoison'.
  2. [Table IV] The text says 'None means no adversarial perturbations are added,' but Table IV does not include a None row; add the clean-video baseline for comparison.
  3. [Section V-C1] The text describes the model as 'BlendFace' but Tables V and VII refer to 'BlendSwap'; unify the naming.
  4. [Section VI] The conclusion calls face detection an 'indispensable pre-processing step,' which is stronger than the paper's own limitation statement in Section V-D; recommend softening this to reflect the face-swap-specific scope.
  5. [Section V-C2] The phrase 'which reveals that show that identity selection' contains a duplicated verb; rephrase.
  6. [Section IV-1] The name 'Lucas-Kanada' is a misspelling of Lucas-Kanade.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack is an empirical gradient-based optimization validated on external benchmarks; self-citation to the authors' ICME paper is an extension, not a load-bearing premise.

full rationale

FacePoison is an adversarial perturbation computed by minimizing a feature-space objective (Eq. 7) against a target face detector, and its success is then measured externally by F1-score on WIDER and by SSIM of DeepFake outputs on FF++, Celeb-DF, DFDC, and DFDCP. No predicted quantity is fitted from the data on which it is reported: the perturbation parameters are fixed hyperparameters, and the downstream DeepFake obstruction is a direct empirical consequence of detector failure, not an identity derived from the loss. The only self-reference to prior work is the stated extension of the authors' ICME 2023 paper [28], which is used to position the contribution rather than to justify the correctness of the experiments; the current paper reports new transferability, robustness, video propagation, and eleven-model DeepFake evaluations against external tools. The use of detector outputs as pseudo-ground-truth for the unlabeled Celeb-DF videos in Section V-B5 and the transferability gaps in Table III are validity and robustness caveats, but they do not make any conclusion true by construction. There is no self-definitional equivalence, no fitted parameter renamed as a prediction, and no imported uniqueness theorem. The derivation chain is therefore self-contained, and the appropriate circularity score is 0.

Assumptions & free parameters 8 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a domain assumption about the DeepFake pipeline and on empirically tuned hyperparameters. No new physical or architectural entities are introduced.

free parameters (8)
  • epsilon (distortion bound) = 8
    Hand-set bound on perturbation magnitude, chosen to maintain imperceptibility for face images (Section V-A6).
  • layer weights alpha_i = 0.2, 0.3, 0.5
    Weight factors for the three attacked feature scales in Eq. (7), chosen without theoretical justification.
  • random masking probability p = 0.9
    Probability of zeroing pixels when computing averaged importance maps (Section V-A6).
  • mask count m = 30
    Number of random masks used to average importance maps (Section V-A6).
  • number of iterations n = 10
    Iteration count for iterative attacks (Section V-A6).
  • sigma = 16
    Parameter listed in Section V-A6; its role is not explicitly explained in the text.
  • mu = 0.5
    Momentum decay factor used in MIM and DIM style attacks.
  • optical flow recalculation interval o = 4
    FacePoison is recalculated every o frames to limit propagation drift (Section V-A6).
assumptions (4)
  • domain assumption Face-swap DeepFake pipelines use DNN-based face detectors to extract faces as a prerequisite for training and inference.
    Stated in Sections II-A and III-A and the basis of the entire defense; acknowledged as a limitation in Section V-D for non-DNN detectors.
  • domain assumption Adversarial perturbations are temporally consistent and can be propagated across adjacent frames using optical flow.
    Hypothesis 1 in Section IV; tested empirically but not theoretically guaranteed.
  • ad hoc to paper The cosine-similarity pseudo-objective approximates the task-related objective of face detectors.
    Introduced in Section III-C2 to avoid knowing detector-specific training objectives; no proof that it captures the true objective.
  • standard math Standard backpropagation and optical flow assumptions, including brightness constancy, hold.
    Used throughout Sections III and IV.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hiding Faces in Plain Sight: Defending DeepFakes by Disrupting Face Detection." pith.science (2026). https://pith.science/paper/ZIJYCRGZ

@misc{pith2026241201101,
  author       = {Pith},
  title        = {Pith review of: Hiding Faces in Plain Sight: Defending DeepFakes by Disrupting Face Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZIJYCRGZ}},
  note         = {Machine review of arXiv:2412.01101}
}
read the original abstract

Face-swapping DeepFakes have become an escalating societal concern, attracting increasing attention in recent years. To counter this, we investigate a new proactive defense framework to prevent individuals from being victimized in DeepFake videos. The core idea of this framework is to contaminate the inputs of DeepFake models by disrupting face detectors, based on the observation that face detectors are commonly used to automatically extract victim faces in most DeepFake techniques. Once the face detectors malfunction, the faces will not be correctly extracted, thereby impairing the training or synthesis stages of DeepFake models. To achieve this, we describe a strategy named {\em FacePoison}, which fools face detectors by adding dedicated adversarial perturbations to video frames. Building upon this, we introduce {\em VideoFacePoison}, an extended strategy that can efficiently propagate FacePoison across video frames instead of applying it individually to each frame, thus significantly reducing the computational overhead while retaining favorable attack performance. This framework is validated on five face detectors, and extensive experiments against eleven different DeepFake models demonstrate the effectiveness of disrupting face detectors to hinder DeepFake generation. The source code is publicly available at: https://github.com/OUC-VAS/FacePoison.

Figures

Figures reproduced from arXiv: 2412.01101 by the authors.

Figure 1
Figure 1. Examples of DeepFake, which involves replacing the original faces with synthesized faces while keeping the same facial expres￾sions. These examples are from [17]. However, given the speed and reach of the propagation of online media, even the currently best forensic method will largely operate in a postmortem fashion, applicable only after the fake face images or videos emerge. In this work, we aim to develop proact… view at source ↗
Figure 2
Figure 2. Overview of FacePoison. The left part shows the typical generation process of DeepFake conducted by adversaries, covering the inference and training phase of DeepFake models. The right part shows how our method obstructs the DeepFake generation. The rationale is that our method disrupts face detection, leading to incorrect face detection results. It can pollute the input faces during either inference or training, ul… view at source ↗
Figure 3
Figure 3. Overview of our method on disrupting face detection. Our method attacks multiple intermediate features with the instruction of importance-guided maps, amplifying the disturbance on key elements indicated by these maps. See text for details. intermediate features ensures compatibility across different detectors. (2) Effectiveness: Intermediate features contain the important information that determines the results, th… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Overview of the VideoFacePoison method on disrupting face detection in a video. Our method can propagate the FacePoison on a certain frame (x(v) in this example) to adjacent frames based on the optical flow algorithms. See text for details. We reuse notation x, t here …
Figure 5
Figure 5. Figure 5: Visual examples of using different adaptations to disrupt face detection. For each face detector, the top row corresponds to the original results and the bottom row is the results using our method. PyramidBox, S3FD, and DSFD, greatly decreasing the perfor￾mance below 2…
Figure 6
Figure 6. Figure 6: Performance of different face detectors under different image quality, resize scale, Gaussian noise, and Gaussian blurring. ing the compression factor from [30, 100], where a larger value indicates higher quality. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Visual examples of our method obstructing the inference phase of DeepFake models. The first row shows the effect of results using clean images. The second and third rows show the results corresponding to AO (source image is polluted while target image is original) and …
Figure 8
Figure 8. Figure 8: Visual examples of DeepFake faces. The first column shows DeepFake faces without our method. The other right columns show DeepFake faces with our method. TABLE VIII OBSTRUCTING TRAINING: SSIM SCORE (%) OF SYNTHESIZED FACES USING PYRAMIDBOX FACE DETECTOR ON OTHER IDENTI…
Figure 9
Figure 9. Figure 9: Effect of different poison ratios used for polluting training faces. 0 denotes all training samples are clean and 1 denotes our method is applied to all training faces. D. Discussion F1-score VS Average Precision (AP). Average Precision (AP) represents the area under t…
Figure 10
Figure 10. Figure 10: Illustration of PR curve for calculating AP. Compared to the left case, the right case has more face candidate proposals (blue triangles). However, since all faces are detected, these proposals can not impact the recall score, i.e., always 1. Despite these proposals c…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. PhantomSeal: Proactive Deepfakes Defense with Identity/Context Protection and Forensic Tracing

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A single perturbation can steer face-swap outputs toward a chosen 'cloak' identity, giving both identity/context protection and forensic tracing.

Reference graph

Works this paper leans on

101 extracted references · 67 canonical work pages · cited by 1 Pith paper

  1. [1]

    Progressive growing of GANs for improved quality, stability, and variation,

    T. Karras, T. Aila, S. Laine, and J. Lehtinen, “Progressive growing of GANs for improved quality, stability, and variation,” in International Conference on Learning Representations , 2018

    2018

  2. [2]

    A style-based generator architecture for generative adversarial networks,

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” in IEEE Conference on Computer Vision and Pattern Recognition , 2019

    2019

  3. [3]

    Alias-free generative adversarial networks,

    T. Karras, M. Aittala, S. Laine, E. H ¨ark¨onen, J. Hellsten, J. Lehtinen, and T. Aila, “Alias-free generative adversarial networks,” Conference on Neural Information Processing Systems , 2021

    2021

  4. [4]

    faceswap github,

    “faceswap github,” https://github.com/deepfakes/faceswap

  5. [5]

    Deep- facelab: Integrated, flexible and extensible face-swapping framework,

    K. Liu, I. Perov, D. Gao, N. Chervoniy, W. Zhou, and W. Zhang, “Deep- facelab: Integrated, flexible and extensible face-swapping framework,” Pattern Recognition, 2023

    2023

  6. [6]

    Simswap: An efficient framework for high fidelity face swapping,

    R. Chen, X. Chen, B. Ni, and Y . Ge, “Simswap: An efficient framework for high fidelity face swapping,” in ACM International Conference on Multimedia, 2020

    2020

  7. [7]

    Information bottleneck disentanglement for identity swapping,

    G. Gao, H. Huang, C. Fu, Z. Li, and R. He, “Information bottleneck disentanglement for identity swapping,” in IEEE Conference on Com- puter Vision and Pattern Recognition , 2021

    2021

  8. [8]

    Mobilefaceswap: A lightweight framework for video face swapping,

    Z. Xu, Z. Hong, C. Ding, Z. Zhu, J. Han, J. Liu, and E. Ding, “Mobilefaceswap: A lightweight framework for video face swapping,” in AAAI Conference on Artificial Intelligence , 2022

    2022

Show all 101 references
  1. [9]

    Blendface: Re-designing identity encoders for face-swapping,

    K. Shiohara, X. Yang, and T. Taketomi, “Blendface: Re-designing identity encoders for face-swapping,” in IEEE International Conference on Computer Vision , 2023

    2023

  2. [10]

    ” deepfakes

    R. Spivak, “” deepfakes”: The newest way to commit one of the oldest crimes,” Geo. L. Tech. Rev., 2018

    2018

  3. [11]

    Diff-foley: Synchronized video- to-audio synthesis with latent diffusion models,

    S. Luo, C. Yan, C. Hu, and H. Zhao, “Diff-foley: Synchronized video- to-audio synthesis with latent diffusion models,” Conference on Neural Information Processing Systems , 2024

    2024

  4. [12]

    Diffusion self-guidance for controllable image generation,

    D. Epstein, A. Jabri, B. Poole, A. Efros, and A. Holynski, “Diffusion self-guidance for controllable image generation,” Conference on Neural Information Processing Systems , 2023

    2023

  5. [13]

    Toontalker: Cross-domain face reenactment,

    Y . Gong, Y . Zhang, X. Cun, F. Yin, Y . Fan, X. Wang, B. Wu, and Y . Yang, “Toontalker: Cross-domain face reenactment,” in IEEE International Conference on Computer Vision , 2023

    2023

  6. [14]

    Learning dense correspondence for nerf-based face reenactment,

    S. Yang, W. Wang, Y . Lan, X. Fan, B. Peng, L. Yang, and J. Dong, “Learning dense correspondence for nerf-based face reenactment,” in AAAI Conference on Artificial Intelligence , 2024

    2024

  7. [15]

    Deepfake: Creation, purpose, risks,

    A. Busacca and M. A. Monaca, “Deepfake: Creation, purpose, risks,” in Innovations and Economic and Social Changes due to Artificial Intelligence: The State of the Art , 2023

    2023

  8. [16]

    Defending informational sovereignty by detecting deepfakes: Risks and opportunities of an ai- based detector for deepfake-based disinformation and illegal activities,

    M. Tahraoui, C. Kr ¨atzer, and J. Dittmann, “Defending informational sovereignty by detecting deepfakes: Risks and opportunities of an ai- based detector for deepfake-based disinformation and illegal activities,” in Weizenbaum Conference” Practicing Sovereignty: Interventions ...

    2023

  9. [17]

    Celeb-df: A large-scale challenging dataset for deepfake forensics,

    Y . Li, X. Yang, P. Sun, H. Qi, and S. Lyu, “Celeb-df: A large-scale challenging dataset for deepfake forensics,” in IEEE Conference on Computer Vision and Pattern Recognition , 2020

    2020

  10. [18]

    Transcending forgery specificity with latent space augmentation for generalizable deepfake detection,

    Z. Yan, Y . Luo, S. Lyu, Q. Liu, and B. Wu, “Transcending forgery specificity with latent space augmentation for generalizable deepfake detection,” in IEEE Conference on Computer Vision and Pattern Recognition, 2024

    2024

  11. [19]

    In Ictu Oculi: Exposing AI generated fake face videos by detecting eye blinking,

    Y . Li, M.-C. Chang, and S. Lyu, “In Ictu Oculi: Exposing AI generated fake face videos by detecting eye blinking,” in IEEE International Workshop on Information Forensics and Security , 2018

    2018

  12. [20]

    Exposing deepfake videos by detecting face warping artifacts,

    Y . Li and S. Lyu, “Exposing deepfake videos by detecting face warping artifacts,” in IEEE Conference on Computer Vision and Pattern Recognition Workshops, 2019

    2019

  13. [21]

    Diff-id: An explainable identity difference quantification framework for deepfake detection,

    C. Yu, X. Zhang, Y . Duan, S. Yan, Z. Wang, Y . Xiang, S. Ji, and W. Chen, “Diff-id: An explainable identity difference quantification framework for deepfake detection,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  14. [22]

    Learning second order local anomaly for general face forgery detection,

    J. Fei, Y . Dai, P. Yu, T. Shen, Z. Xia, and J. Weng, “Learning second order local anomaly for general face forgery detection,” in IEEE Conference on Computer Vision and Pattern Recognition , 2022

    2022

  15. [23]

    Self-supervised learning of adversarial example: Towards good generalizations for deepfake detection,

    L. Chen, Y . Zhang, Y . Song, L. Liu, and J. Wang, “Self-supervised learning of adversarial example: Towards good generalizations for deepfake detection,” in IEEE Conference on Computer Vision and Pattern Recognition, 2022

    2022

  16. [24]

    Dynamic graph learning with content-guided spatial-frequency relation reasoning for deepfake detection,

    Y . Wang, K. Yu, C. Chen, X. Hu, and S. Peng, “Dynamic graph learning with content-guided spatial-frequency relation reasoning for deepfake detection,” in IEEE Conference on Computer Vision and Pattern Recognition, 2023

    2023

  17. [25]

    Exposing the deception: Uncovering more forgery clues for deepfake detection,

    Z. Ba, Q. Liu, Z. Liu, S. Wu, F. Lin, L. Lu, and K. Ren, “Exposing the deception: Uncovering more forgery clues for deepfake detection,” in AAAI Conference on Artificial Intelligence , 2024

    2024

  18. [26]

    S3fd: Single shot scale-invariant face detector,

    S. Zhang, X. Zhu, Z. Lei, H. Shi, X. Wang, and S. Z. Li, “S3fd: Single shot scale-invariant face detector,” in IEEE International Conference on Computer Vision , 2017

    2017

  19. [27]

    Pyramidbox: A context-assisted single shot face detector,

    X. Tang, D. K. Du, Z. He, and J. Liu, “Pyramidbox: A context-assisted single shot face detector,” inEuropean Conference on Computer Vision, 2018

    2018

  20. [28]

    Face poison: Obstructing deepfakes by disrupting face detection,

    Y . Li, J. Zhou, and S. Lyu, “Face poison: Obstructing deepfakes by disrupting face detection,” in IEEE International Conference on Multimedia and Expo , 2023

    2023

  21. [29]

    FakeApp,

    “FakeApp,” https://www.malavida.com/en/soft/fakeapp/

  22. [30]

    DFaker github,

    “DFaker github,” https://github.com/dfaker/df

  23. [31]

    faceswap-GAN github,

    “faceswap-GAN github,” https://github.com/shaoanlu/faceswap-GAN

  24. [32]

    Toward multimodal image-to-image translation,

    J.-Y . Zhu, R. Zhang, D. Pathak, T. Darrell, A. A. Efros, O. Wang, and E. Shechtman, “Toward multimodal image-to-image translation,” in Conference on Neural Information Processing Systems , 2017

    2017

  25. [33]

    Generative adversarial nets,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” in Conference on Neural Information Processing Systems , 2014

    2014

  26. [34]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Conference on Neural Information Processing Systems , 2020

    2020

  27. [35]

    Collaborative diffusion for multi-modal face generation and editing,

    Z. Huang, K. C. Chan, Y . Jiang, and Z. Liu, “Collaborative diffusion for multi-modal face generation and editing,” in IEEE Conference on Computer Vision and Pattern Recognition , 2023

    2023

  28. [36]

    Strokefacenerf: Stroke- based facial appearance editing in neural radiance field,

    X.-J. Li, D. Zhang, S.-Y . Chen, and F.-L. Liu, “Strokefacenerf: Stroke- based facial appearance editing in neural radiance field,” in IEEE Conference on Computer Vision and Pattern Recognition , 2024

    2024

  29. [37]

    StarGAN: Unified generative adversarial networks for multi-domain image-to- image translation,

    Y . Choi, M. Choi, M. Kim, J.-W. Ha, S. Kim, and J. Choo, “StarGAN: Unified generative adversarial networks for multi-domain image-to- image translation,” in IEEE Conference on Computer Vision and Pattern Recognition, 2018

    2018

  30. [38]

    Generative landmark guided face inpainting,

    Y . Yang and X. Guo, “Generative landmark guided face inpainting,” in Pattern Recognition and Computer Vision , 2020

    2020

  31. [39]

    Unmasking your expression: Expression- conditioned gan for masked face inpainting,

    S. Sola and D. Gera, “Unmasking your expression: Expression- conditioned gan for masked face inpainting,” in IEEE Conference on Computer Vision and Pattern Recognition , 2023

    2023

  32. [40]

    Retinaface: Single-shot multi-level face localisation in the wild,

    J. Deng, J. Guo, E. Ververas, I. Kotsia, and S. Zafeiriou, “Retinaface: Single-shot multi-level face localisation in the wild,” in IEEE Confer- ence on Computer Vision and Pattern Recognition , 2020

    2020

  33. [41]

    Yolo5face: Why reinventing a face detector,

    D. Qi, W. Tan, Q. Yao, and J. Liu, “Yolo5face: Why reinventing a face detector,” in European Conference on Computer Vision , 2022

    2022

  34. [42]

    Dsfd: dual shot face detector,

    J. Li, Y . Wang, C. Wang, Y . Tai, J. Qian, J. Yang, C. Wang, J. Li, and F. Huang, “Dsfd: dual shot face detector,” in IEEE Conference on Computer Vision and Pattern Recognition , 2019

    2019

  35. [43]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  36. [44]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE Conference on Computer Vision and Pattern Recognition, 2016

    2016

  37. [45]

    Mobilenets: Efficient convolutional neural networks for mobile vision applications,

    A. G. Howard, “Mobilenets: Efficient convolutional neural networks for mobile vision applications,” arXiv preprint arXiv:1704.04861 , 2017

    2017 arXiv

  38. [46]

    Shufflenet: An extremely efficient convolutional neural network for mobile devices,

    X. Zhang, X. Zhou, M. Lin, and J. Sun, “Shufflenet: An extremely efficient convolutional neural network for mobile devices,” in IEEE Conference on Computer Vision and Pattern Recognition , 2018

    2018

  39. [47]

    Wider face: A face detection benchmark,

    S. Yang, P. Luo, C.-C. Loy, and X. Tang, “Wider face: A face detection benchmark,” in IEEE Conference on Computer Vision and Pattern Recognition, 2016

    2016

  40. [48]

    Explaining and harness- ing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harness- ing adversarial examples,” in International Conference on Learning Representations, 2015

    2015

  41. [49]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial Intelligence Safety and Security, 2018

    2018

  42. [50]

    Deepfool: a simple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in IEEE Conference on Computer Vision and Pattern Recognition , 2016. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 13

    2016

  43. [51]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in IEEE Conference on Computer Vision and Pattern Recognition , 2018

    2018

  44. [52]

    Taking care of the discretization problem: A comprehensive study of the discretization problem and a black-box adversarial attack in discrete integer domain,

    L. Bu, Z. Zhao, Y . Duan, and F. Song, “Taking care of the discretization problem: A comprehensive study of the discretization problem and a black-box adversarial attack in discrete integer domain,” IEEE Transactions on Dependable and Secure Computing , 2022

    2022

  45. [53]

    Image transformation- based defense against adversarial perturbation on deep learning mod- els,

    A. Agarwal, R. Singh, M. Vatsa, and N. Ratha, “Image transformation- based defense against adversarial perturbation on deep learning mod- els,” IEEE Transactions on Dependable and Secure Computing , 2021

    2021

  46. [54]

    Invisible adversarial attack against deep neural networks: An adaptive penalization approach,

    Z. Wang, M. Song, S. Zheng, Z. Zhang, Y . Song, and Q. Wang, “Invisible adversarial attack against deep neural networks: An adaptive penalization approach,” IEEE Transactions on Dependable and Secure Computing, 2021

    2021

  47. [55]

    Decision-based query efficient adversarial attack via adaptive boundary learning,

    M. Shen, C. Li, H. Yu, Q. Li, L. Zhu, and K. Xu, “Decision-based query efficient adversarial attack via adaptive boundary learning,”IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  48. [56]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille, “Improving transferability of adversarial examples with input diversity,” in IEEE Conference on Computer Vision and Pattern Recognition , 2019

    2019

  49. [57]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” in International Conference on Learning Representations , 2020

    2020

  50. [58]

    A method for unconstrained convex minimization prob- lem with the rate of convergence o (1/k2),

    Y . Nesterov, “A method for unconstrained convex minimization prob- lem with the rate of convergence o (1/k2),” in Dokl. Akad. Nauk. SSSR, 1983

    1983

  51. [59]

    A bayesian-mrf approach for prnu-based image forgery detection,

    G. Chierchia, G. Poggi, C. Sansone, and L. Verdoliva, “A bayesian-mrf approach for prnu-based image forgery detection,” IEEE Transactions on Information Forensics and Security , 2014

    2014

  52. [60]

    Photo fakery and forensics,

    H. Farid, “Photo fakery and forensics,” Advances in Computers , 2009

    2009

  53. [61]

    Exposing deep fakes using inconsistent head poses,

    X. Yang, Y . Li, and S. Lyu, “Exposing deep fakes using inconsistent head poses,” in IEEE International Conference on Acoustics, Speech and Signal Processing , 2019

    2019

  54. [62]

    Face x-ray for more general face forgery detection,

    L. Li, J. Bao, T. Zhang, H. Yang, D. Chen, F. Wen, and B. Guo, “Face x-ray for more general face forgery detection,” in IEEE Conference on Computer Vision and Pattern Recognition , 2020

    2020

  55. [63]

    Fcd- net: Learning to detect multiple types of homologous deepfake face images,

    R. Han, X. Wang, N. Bai, Q. Wang, Z. Liu, and J. Xue, “Fcd- net: Learning to detect multiple types of homologous deepfake face images,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  56. [64]

    F 2 trans: High- frequency fine-grained transformer for face forgery detection,

    C. Miao, Z. Tan, Q. Chu, H. Liu, H. Hu, and N. Yu, “F 2 trans: High- frequency fine-grained transformer for face forgery detection,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  57. [65]

    Robust attentive deep neural network for detecting gan-generated faces,

    H. Guo, S. Hu, X. Wang, M.-C. Chang, and S. Lyu, “Robust attentive deep neural network for detecting gan-generated faces,” IEEE Access, 2022

    2022

  58. [66]

    Pulseedit: Editing physiological signals in facial videos for privacy protection,

    M. Chen, X. Liao, and M. Wu, “Pulseedit: Editing physiological signals in facial videos for privacy protection,” IEEE Transactions on Information Forensics and Security , 2022

    2022

  59. [67]

    Detecting GAN-generated imagery using color cues,

    S. McCloskey and M. Albright, “Detecting GAN-generated imagery using color cues,” arXiv preprint arXiv:1812.08247 , 2018

    2018 arXiv

  60. [68]

    Exploiting visual artifacts to expose deepfakes and face manipulations,

    F. Matern, C. Riess, and M. Stamminger, “Exploiting visual artifacts to expose deepfakes and face manipulations,” inIEEE Winter Applications of Computer Vision Workshops , 2019

    2019

  61. [69]

    Identification of deep network generated images using disparities in color components,

    H. Li, B. Li, S. Tan, and J. Huang, “Identification of deep network generated images using disparities in color components,” Signal Pro- cessing, 2020

    2020

  62. [70]

    Detecting and simulating artifacts in gan fake images,

    X. Zhang, S. Karaman, and S.-F. Chang, “Detecting and simulating artifacts in gan fake images,” in IEEE International Workshop on Information Forensics and Security , 2019

    2019

  63. [71]

    Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions,

    R. Durall, M. Keuper, and J. Keuper, “Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions,” in IEEE Conference on Computer Vision and Pattern Recognition, 2020

    2020

  64. [72]

    Cnn- generated images are surprisingly easy to spot... for now,

    S.-Y . Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros, “Cnn- generated images are surprisingly easy to spot... for now,” in IEEE Conference on Computer Vision and Pattern Recognition , 2020

    2020

  65. [73]

    Detecting cnn-generated facial images in real-world scenarios,

    N. Hulzebosch, S. Ibrahimi, and M. Worring, “Detecting cnn-generated facial images in real-world scenarios,” in IEEE Conference on Com- puter Vision and Pattern Recognition Workshops , 2020

    2020

  66. [74]

    Global texture enhancement for fake face detection in the wild,

    Z. Liu, X. Qi, and P. H. Torr, “Global texture enhancement for fake face detection in the wild,” in IEEE Conference on Computer Vision and Pattern Recognition, 2020

    2020

  67. [75]

    Representative forgery mining for fake face detection,

    C. Wang and W. Deng, “Representative forgery mining for fake face detection,” in IEEE Conference on Computer Vision and Pattern Recognition, 2021, pp. 14 923–14 932

    2021

  68. [76]

    Multi- attentional deepfake detection,

    H. Zhao, W. Zhou, D. Chen, T. Wei, W. Zhang, and N. Yu, “Multi- attentional deepfake detection,” in IEEE Conference on Computer Vision and Pattern Recognition , 2021

    2021

  69. [77]

    Swin transformer: Hierarchical vision transformer using shifted windows,

    Z. Liu, Y . Lin, Y . Cao, H. Hu, Y . Wei, Z. Zhang, S. Lin, and B. Guo, “Swin transformer: Hierarchical vision transformer using shifted windows,” in IEEE International Conference on Computer Vision, 2021

    2021

  70. [78]

    A survey on vision transformer,

    K. Han, Y . Wang, H. Chen, X. Chen, J. Guo, Z. Liu, Y . Tang, A. Xiao, C. Xu, Y . Xu et al., “A survey on vision transformer,” IEEE Transactions on Pattern Analysis and Machine Intelligence , 2022

    2022

  71. [79]

    Adversarial examples for generative models,

    J. Kos, I. Fischer, and D. Song, “Adversarial examples for generative models,” in IEEE Security and Privacy Workshops , 2018

    2018

  72. [80]

    Deceiving image-to-image transla- tion networks for autonomous driving with adversarial perturbations,

    L. Wang, W. Cho, and K.-J. Yoon, “Deceiving image-to-image transla- tion networks for autonomous driving with adversarial perturbations,” IEEE Robotics and Automation Letters , 2020

    2020

  73. [81]

    Adversar- ial robust safeguard for evading deep facial manipulation,

    J. Guan, Y . Zhao, Z. Xu, C. Meng, K. Xu, and Y . Zhao, “Adversar- ial robust safeguard for evading deep facial manipulation,” in AAAI Conference on Artificial Intelligence , 2024

    2024

  74. [82]

    Information-containing adversarial perturbation for combating facial manipulation systems,

    Y . Zhu, Y . Chen, X. Li, R. Zhang, X. Tian, B. Zheng, and Y . Chen, “Information-containing adversarial perturbation for combating facial manipulation systems,” IEEE Transactions on Information Forensics and Security, 2023

    2023

  75. [83]

    Df-rap: A robust adversarial perturbation for defending against deepfakes in real-world social network scenarios,

    Z. Qu, Z. Xi, W. Lu, X. Luo, Q. Wang, and B. Li, “Df-rap: A robust adversarial perturbation for defending against deepfakes in real-world social network scenarios,” IEEE Transactions on Information Forensics and Security, 2024

    2024

  76. [84]

    Cmua-watermark: A cross-model universal adversarial watermark for combating deepfakes,

    H. Huang, Y . Wang, Z. Chen, Y . Zhang, Y . Li, Z. Tang, W. Chu, J. Chen, W. Lin, and K.-K. Ma, “Cmua-watermark: A cross-model universal adversarial watermark for combating deepfakes,” in AAAI Conference on Artificial Intelligence , 2022

    2022

  77. [85]

    Feature importance-aware transferable adversarial attacks,

    Z. Wang, H. Guo, Z. Zhang, W. Liu, Z. Qin, and K. Ren, “Feature importance-aware transferable adversarial attacks,” in IEEE Interna- tional Conference on Computer Vision , 2021

    2021

  78. [86]

    Improving transferable adversarial attack via feature-momentum,

    X. He, Y . Li, H. Qu, and J. Dong, “Improving transferable adversarial attack via feature-momentum,” Computers & Security , 2023

    2023

  79. [87]

    Generaliz- ing adversarial explanations with grad-cam,

    T. Chakraborty, U. Trehan, K. Mallat, and J.-L. Dugelay, “Generaliz- ing adversarial explanations with grad-cam,” in IEEE Conference on Computer Vision and Pattern Recognition , 2022

    2022

  80. [88]

    Determining optical flow,

    B. K. Horn and B. G. Schunck, “Determining optical flow,” Artificial Intelligence, 1981

    1981

  81. [89]

    Lucas-kanade 20 years on: A unifying framework,

    S. Baker and I. Matthews, “Lucas-kanade 20 years on: A unifying framework,” International Journal of Computer Vision , 2004

    2004

  82. [90]

    Two-frame motion estimation based on polynomial expansion,

    G. Farneb ¨ack, “Two-frame motion estimation based on polynomial expansion,” in Scandinavian Conference on Image Analysis , 2003

    2003

  83. [91]

    Flownet: Learning optical flow with convolutional networks,

    A. Dosovitskiy, P. Fischer, E. Ilg, P. Hausser, C. Hazirbas, V . Golkov, P. Van Der Smagt, D. Cremers, and T. Brox, “Flownet: Learning optical flow with convolutional networks,” in IEEE International Conference on Computer Vision , 2015

    2015

  84. [92]

    Faceforensics++: Learning to detect manipulated facial images,

    A. Rossler, D. Cozzolino, L. Verdoliva, C. Riess, J. Thies, and M. Nießner, “Faceforensics++: Learning to detect manipulated facial images,” in IEEE International Conference on Computer Vision , 2019

    2019

  85. [93]

    The deepfake detection challenge (dfdc) dataset,

    B. Dolhansky, J. Bitton, B. Pflaum, J. Lu, R. Howes, M. Wang, and C. C. Ferrer, “The deepfake detection challenge (dfdc) dataset,” arXiv preprint arXiv:2006.07397, 2020

    2006 arXiv

  86. [94]

    The dee pfake detection challenge (dfdc) pre view dataset,

    B. Dolhansky, “The dee pfake detection challenge (dfdc) pre view dataset,” arXiv preprint arXiv:1910.08854 , 2019

    1910 arXiv

  87. [95]

    YOLOv5 github,

    “YOLOv5 github,” https://github.com/ultralytics/yolov5

  88. [96]

    Discrete cosine transform,

    N. Ahmed, T. Natarajan, and K. Rao, “Discrete cosine transform,” IEEE Transactions on Computers, 1974

    1974

  89. [97]

    DeepFaceLab github,

    “DeepFaceLab github,” https://github.com/iperov/DeepFaceLab

  90. [98]

    Distilling the knowledge in a neural network,

    G. Hinton, “Distilling the knowledge in a neural network,” arXiv preprint arXiv:1503.02531, 2015

    2015 arXiv

  91. [99]

    Real-time single image and video super- resolution using an efficient sub-pixel convolutional neural network,

    W. Shi, J. Caballero, F. Husz ´ar, J. Totz, A. P. Aitken, R. Bishop, D. Rueckert, and Z. Wang, “Real-time single image and video super- resolution using an efficient sub-pixel convolutional neural network,” in IEEE Conference on Computer Vision and Pattern Recognition , 2016

    2016

  92. [100]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” in International Conference on Learning Representations , 2018

    2018

  93. [101]

    Dlib-ml: A machine learning toolkit,

    D. E. King, “Dlib-ml: A machine learning toolkit,” Journal of Machine Learning Research, 2009

    2009

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.