Pith. sign in

REVIEW 3 major objections 5 minor 25 references

SRAP: SVD-Refined Adversarial Perturbations for Imperceptible Face-Swap Defense

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Per-channel truncated SVD plus an identity-importance mask removes the visible artifacts of PGD face-swap protection while keeping identity disruption competitive.

desk verdict Real fidelity gains and a genuinely new SVD+mask pipeline, but the general face-swap defense claim rests on one tested model and an unnamed surrogate identity encoder. read the letter →

arxiv 2608.03395 v1 pith:MVIVTXND submitted 2026-08-04 cs.CV cs.LG

Sungwon Cho , Kwanghyun Ko , Myungjoo Kang This is my paper
classification cs.CVcs.LG
keywords face-swapdefenseadversarialperturbationtruncatedSVDidentity-importancemaskimperceptibilityprojectedgradientdescentdeepfakeprotectionJPEGrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to fix a practical flaw in adversarial face-swap defenses: the protective noise, though bounded in magnitude, is visible because it is smeared across the whole image and loaded with high-frequency speckle. It claims both defects have one remedy — make every PGD update spend its budget only where it matters. SRAP rebuilds each perturbation channel from its leading singular components (rank 50) and multiplies it by a binary mask of the 30% of pixels that most influence the identity encoder. The reported numbers: protected images stay perceptually close to the original (LPIPS 0.0253 vs 0.1429 for the strongest baseline on CelebA-HQ, PSNR 37.00), while the swap output's identity similarity stays low (ISMprot 0.0802 vs 0.5810 clean), and the low-rank form is markedly more robust to JPEG compression. The paper evaluates against a single face-swap model, so the breadth of the claim rests on transfer of the surrogate gradients.

What carries the argument

The load-bearing object is the per-iteration update operator of Eqs. (19)-(21): PGD ascent on $\mathcal{L}_{\text{pgd}} = \mathcal{L}_{\text{id}} + \lambda_{\text{vae}} \mathcal{L}_{\text{vae}}$, followed by per-channel truncated SVD rebuilt from the $r=50$ leading singular components, then a fixed binary identity-importance mask $M$, then clipping to the box constraints. The mask is computed once per image by averaging gradient magnitudes of $\cos(F_{\text{id}}(x), F_{\text{id}}(x+\eta))$ over $T$ random probes $\eta \sim U(-\epsilon,\epsilon)$ and keeping the top-$\rho$ quantile ($\rho=0.3$). The rank choice is motivated by three diagnostics — a DCT-based high-frequency ratio, the perturba

What would settle it

Protect the same images with SRAP and feed them through a second face-swap model — a diffusion-based swapper or an attention-based one — under the same $\epsilon = 12/255$. If protected-output identity similarity rises back toward the clean level while a FaceShield-style defense stays low, the surrogate-gradient transfer premise fails. A sharper check of the spectral claim: take a vanilla PGD perturbation, keep only the residual tail (ranks $> 50$), and run it through SimSwap; if that tail alone still disrupts identity substantially, the trailing components are not as utility-free as the paper

Watch

Extended reading notes

Core claim

The paper's central discovery is that the two visual defects of PGD face-swap protection — whole-image support and high-frequency speckle — are concentrated in the trailing singular components of the perturbation. Measuring each rank-one component $\sigma_i u_i v_i^\top$ with a DCT-based high-frequency ratio, the authors find that spectral centroid and high-frequency energy rise with rank; at $r=50$ the discarded residual holds only 16.83% of the perturbation energy, yet 93.12% of that residual is high frequency. Truncating at $r=50$ and masking to the top-$\rho$ identity-sensitive locations ($\rho=0.3$) at every PGD iteration preserves the defense utility carried by the leading components w

Load-bearing premise

The defense is tuned on the gradients and importance map of one surrogate identity encoder plus one VAE encoder and measured against a single face-swap model; if that gradient and mask do not transfer to other face-swap models, the protection weakens.

Editorial extensions

If this is right

  • Protected images can be posted or shared with near-imperceptible distortion: LPIPS 0.0253 vs 0.1429 for FaceShield on CelebA-HQ, with PSNR 37.00 and SSIM 0.9872.
  • Low-rank refinement survives JPEG compression far better than full PGD noise: ISM change 9.03% at rank 50 vs 21.82% at rank 512.
  • Identity disruption stays competitive: ISMprot 0.0802 on CelebA-HQ against FaceShield's -0.0772, from a clean baseline of 0.5810.
  • The two knobs — retained rank $r$ and mask ratio $\rho$ — give a deployer a direct trade-off between defense strength and visible distortion.
  • The DCT high-frequency ratio and the RMT-inspired reference lines are general diagnostics that can be applied to any perturbation-based protection method.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The truncate-and-mask loop is not tied to face swapping: any PGD-style protection against diffusion editing or biometric spoofing suffers the same whole-support and high-frequency-tail inefficiency, so SRAP's update operator should transfer to those objectives — a direct test would be bolting Eqs. (19)-(21) onto an AdvDM- or PhotoGuard-style loss.
  • The threat model is non-adaptive: an adversary who knows $r$ and $\rho$ could route swap computation through the masked-off, untouched regions; robustness against a knowing attacker is untested here.
  • The subspace-alignment peak near $k=45$ hints that identity-relevant perturbation lives in a content-independent subspace of roughly 50 dimensions, which would let the retained rank be fixed per encoder rather than per dataset.
  • Because the mask is computed once on the clean image, geometric post-processing such as cropping or resizing could shift the identity-sensitive regions away from the mask; testing mask stability under such transforms is a natural next step.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces SRAP, a PGD-based adversarial perturbation method for protecting facial images against face-swapping. SRAP applies two refinements at each PGD iteration: per-channel truncated SVD (rank r=50) to suppress high-frequency trailing singular components, and a fixed binary identity-importance mask (retained ratio rho=0.3) derived from gradient-based sensitivity probing of a frozen identity encoder. On CelebA-HQ and VGGFace2-HQ, evaluated against SimSwap, SRAP reports the best protected-image fidelity among baselines (LPIPS 0.0253/0.0351, PSNR 37.00/36.57, SSIM 0.9872/0.9824) and second-best identity disruption (ISMprot 0.0802/0.1183, behind FaceShield's -0.0772/-0.0166). The abstract and conclusion generalize this to a favorable trade-off between face-swap defense and visual imperceptibility.

Significance. If the empirical claims hold beyond the single evaluated target, SRAP is a practically useful refinement: it decomposes the sources of perceptual artifact in PGD perturbations into spectral (high-rank/high-frequency) and spatial (broad support) components and demonstrates large fidelity gains on two datasets. The paper has several strengths: it includes explicit diagnostic analyses (SVD spectra, pixel-shuffle null, subspace alignment), it is careful not to overclaim the RMT thresholds as formal significance tests, it runs ablations for rank and mask ratio, and it explicitly acknowledges the single-model limitation in Sec. 5. However, the central trade-off claim is currently supported only for SimSwap, and the identity encoder used for optimization is not identified, leaving the transferability of the defense unverified. If the method is white-box with respect to SimSwap, the general defense utility is not established; if it is black-box, a single transfer example is insufficient. The absence of error bars also weakens the quantitative comparisons.

major comments (3)
  1. [Sec. 4.1.2, Eq. (2), Eqs. (14)-(16)] The paper never identifies the frozen identity encoder Fid used in the objective and in the importance mask, nor whether it matches SimSwap's identity extractor. Since the central claim is 'maintaining competitive identity-disruption performance,' this matters: if Fid is SimSwap's own encoder, the method is white-box against the only target model, so the result does not generalize; if Fid is a different surrogate encoder, the reported ISMprot is a single black-box transfer instance. Either way, Tables 2 and 3 do not establish the unqualified claim in the abstract and conclusion. A second face-swapping model (e.g., FaceShifter or a diffusion-based method) and at least one held-out identity encoder are needed to make the claim load-bearing.
  2. [Sec. 4.2, Tables 2-3] All quantitative claims are reported as point averages over 100 source-target pairs, with no standard deviations, confidence intervals, or significance tests. For example, the paper states that SRAP 'substantially outperforms' diffusion-oriented baselines and is 'second-best' in disruption, but without variance estimates it is possible that some of these differences are within run-to-run noise. Since 100 pairs are used, standard errors are straightforward to compute. Reporting them is necessary to support the 'favorable trade-off' claim, especially because the trade-off is between two competing objectives and the hierarchy among methods is part of the central claim.
  3. [Sec. 4.3, Figs. 7-8] The two main hyperparameters, retained rank r=50 and mask ratio rho=0.3, are selected from ablations, but the ablation curves in Figs. 7 and 8 do not show error bars or the number of images used per point. The text says rho is selected on a 'held-out validation subset' but gives no details on its size or composition. Because these hyperparameters directly control the fidelity-disruption trade-off, the reader cannot assess the stability of the chosen operating point. Adding error bars or at least a table of mean +/- std for a few key points would strengthen the selection rationale.
minor comments (5)
  1. [Eq. (3)] The distance D is described in the text as squared L2 distance between channel-wise normalized VAE features, but the equation just says D(.,.). Please make the definition explicit in the equation or immediately after it.
  2. [Eq. (6)] The displayed formula has 'FP' in the denominator, which appears to be a typo or leftover from fraction formatting. The text describes a ratio of block-DCT energies; the notation should be cleaned up.
  3. [Table 1] The caption states measurements are on 10 CelebA-HQ images, but no variance is reported. Since the rank selection relies partly on this table, adding the spread or noting it is a diagnostic on a small sample would help.
  4. [Sec. 3.2] The paper correctly cautions that MP/Gavish-Donoho thresholds are not formal significance tests, but the phrase 'reference lines' and 'median counts' could be clarified: median over what? Presumably over the 10 images. This should be stated.
  5. [References] Small typo in reference [19]: 'V . A. Marchenko' has an extra space after the initial. Also, the arXiv ID 2608.03395 is far in the future relative to the reference list; this is not an issue for review but should be checked for consistency if this is a preprint.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SRAP is an empirical method paper whose proposed refinements are validated by ablations and external evaluation, not by construction.

full rationale

The paper's derivation chain is empirical rather than circular. The PGD objective (Eqs. 2–4) is an independently defined attack loss; the SVD refinement (Eqs. 12–13) and importance mask (Eqs. 14–17) are proposed transformations applied during optimization, not quantities fitted to the reported evaluation metrics. The retained rank r=50 and mask ratio ρ=0.3 are selected through ablations on validation data and explicitly presented as empirical operating points, not as predictions derived from the method itself. The RMT and subspace-alignment diagnostics are descriptive and the paper repeatedly cautions that they are not formal significance tests nor unique determiners of the rank. The central claims—improved protected-image fidelity and competitive identity disruption—are evaluated against an external face-swap model (SimSwap) using standard metrics (LPIPS, PSNR, SSIM, ISMprot). While the paper acknowledges the evaluation is limited to a single face-swap model and does not identify the surrogate identity encoder Fid, that is a transferability/generality limitation, not a circularity: there is no equation in which a reported result is equivalent by definition to an input, and no self-citation is load-bearing. The manuscript is self-contained against the external benchmark and the claimed improvements are empirical outcomes, so no circular step can be exhibited.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The method relies on surrogate-encoder transferability, a random-probe sensitivity heuristic, and several unreported hyperparameters. No new physical or mathematical entities are introduced. The diagnostic use of RMT is appropriately hedged by the authors as reference lines rather than statistical tests.

free parameters (6)
  • Retained SVD rank r = 50
    Selected from task-level rank ablations (Fig. 7) and subspace-alignment diagnostics, not derived from RMT thresholds which give counts of about 23-31.
  • Mask ratio rho = 0.3
    Selected on a held-out validation subset as balancing ISM and protected-image PSNR (Fig. 8).
  • VAE loss weight lambda_vae = not reported
    Weighting coefficient in Eq. 4; its value is not given in the paper.
  • PGD step size alpha = not reported
    Step size in Eqs. 5 and 19; not specified.
  • Number of PGD iterations K = not reported
    Iteration count in Eq. 21; not specified.
  • Number of random probes T = not reported
    Number of perturbations used for importance-map estimation in Eqs. 14-16; not specified.
assumptions (5)
  • domain assumption Disrupting a frozen identity encoder Fid and VAE encoder Fvae transfers to the target face-swap model (SimSwap).
    The objective (Eqs. 2-4) optimizes against surrogate encoders, not the face-swap model; only SimSwap is tested (Sec. 4.1.2), so transferability is assumed.
  • domain assumption The random-probe gradient map on the clean image identifies locations whose perturbation most influences identity representations.
    Eqs. 14-16 estimate sensitivity with random probes; the fixed mask assumes these gradients predict useful locations for PGD optimization.
  • domain assumption Truncating each channel to rank r preserves defense utility while removing perceptually harmful high-frequency content.
    Claimed from rank ablations (Fig. 7) and frequency diagnostics (Table 1), not from a theorem; the paper notes SVD rank and spatial frequency are distinct concepts.
  • domain assumption The DCT high-frequency mask based on the JPEG quantization table approximates perceptual salience of perturbation noise.
    The Hhf mask is taken from FaceShield's JPEG frequency split (Sec. 3.2); it is a modeling choice.
  • standard math SVD gives the best rank-r approximation in Frobenius norm, and low-rank-plus-noise tools (Marchenko-Pastur, Gavish-Donoho) provide reference thresholds.
    Standard linear algebra and random matrix theory results invoked in Secs. 3.2-3.3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SRAP: SVD-Refined Adversarial Perturbations for Imperceptible Face-Swap Defense." pith.science (2026). https://pith.science/paper/MVIVTXND

@misc{pith2026260803395,
  author       = {Pith},
  title        = {Pith review of: SRAP: SVD-Refined Adversarial Perturbations for Imperceptible Face-Swap Defense},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MVIVTXND}},
  note         = {Machine review of arXiv:2608.03395}
}
read the original abstract

Deepfake technologies pose increasing threats to facial privacy and identity security, motivating proactive defenses that protect facial images before misuse. Although adversarial perturbations generated by projected gradient descent (PGD) can disrupt the identity representations used by face-swapping models, their visual quality is degraded by two characteristics: perturbations are distributed broadly over the image, including identity-insensitive regions, and they contain visually salient high-frequency components. We analyze these spatial and spectral inefficiencies through identity-sensitivity estimation and the singular-value decomposition (SVD) of PGD perturbations. Our analysis shows that later singular components contain a disproportionate amount of high-frequency energy, while the leading components preserve most of the perturbation energy and defense utility. Based on these observations, we propose SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step. The SVD refinement suppresses high-rank, high-frequency residuals, while the mask restricts perturbations to locations that strongly influence identity representations. Experiments on CelebA-HQ and VGGFace2-HQ demonstrate that SRAP substantially improves protected-image fidelity across all reported metrics while maintaining competitive identity-disruption performance, yielding a favorable trade-off between face-swap defense and visual imperceptibility.

Figures

Figures reproduced from arXiv: 2608.03395 by the authors.

Figure 1
Figure 1. Visual comparison between a vanilla PGD-protected image and an image protected by [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Frequency characteristics of individual SVD components [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Complementary diagnostics for retained-rank selection. (a) The singular-value spectrum [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: SVD-based refinement. At each update, the current perturbation is decomposed channel [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Importance-guided masking. Random probe perturbations are used to estimate spatial [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Importance masks for different retained ratios. Smaller ratios retain only the most identity [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Effect of retained SVD rank. Defense utility improves and then saturates, while retaining [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Effect of mask ratio. Increasing perturbation coverage initially improves disruption, but [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

25 extracted references · 15 canonical work pages

  1. [1]

    Phase transition of the largest eigenvalue for nonnull complex sample covariance matrices.The Annals of Probability, 33(5):1643–1697, 2005

    Jinho Baik, Gérard Ben Arous, and Sandrine Péché. Phase transition of the largest eigenvalue for nonnull complex sample covariance matrices.The Annals of Probability, 33(5):1643–1697, 2005

    2005

  2. [2]

    The singular values and vectors of low rank perturbations of large rectangular random matrices.Journal of Multivariate Analysis, 111: 120–135, 2012

    Florent Benaych-Georges and Raj Rao Nadakuditi. The singular values and vectors of low rank perturbations of large rectangular random matrices.Journal of Multivariate Analysis, 111: 120–135, 2012

    work page 2012

  3. [3]

    Parkhi, and Andrew Zisserman

    Qiong Cao, Li Shen, Weidi Xie, Omkar M. Parkhi, and Andrew Zisserman. Vggface2: A dataset for recognising faces across pose and age. In2018 13th IEEE International Conference on Automatic Face and Gesture Recognition, pages 67–74, 2018

    work page 2018

  4. [4]

    Simswap: An efficient framework for high fidelity face swapping

    Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge. Simswap: An efficient framework for high fidelity face swapping. InProceedings of the 28th ACM international conference on multimedia, pages 2003–2011, 2020

    2003

  5. [5]

    Sim- swap++: Towards faster and high-quality identity swapping.IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(1):576–592, 2024

    Xuanhong Chen, Bingbing Ni, Yutian Liu, Naiyuan Liu, Zhilin Zeng, and Hang Wang. Sim- swap++: Towards faster and high-quality identity swapping.IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(1):576–592, 2024

    work page 2024

  6. [6]

    Faceswap.https://github.com/deepfakes/faceswap, 2024

    Deepfakes. Faceswap.https://github.com/deepfakes/faceswap, 2024

    work page 2024

  7. [7]

    Matan Gavish and David L. Donoho. The optimal hard threshold for singular values is 4/ √ 3. IEEE Transactions on Information Theory, 60(8):5040–5053, 2014

    work page 2014

  8. [8]

    Faceshield: Defending facial image against deepfake threats

    Jaehwan Jeong, Sumin In, Sieun Kim, Hannie Shin, Jongheon Jeong, Sang Ho Yoon, Jaewook Chung, and Sangpil Kim. Faceshield: Defending facial image against deepfake threats. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 10364– 10374, 2025

    work page 2025

Show all 25 references
  1. [9]

    Johnstone

    Iain M. Johnstone. On the distribution of the largest eigenvalue in principal components analysis. The Annals of Statistics, 29(2):295–327, 2001

    2001

  2. [10]

    Progressive growing of gans for im- proved quality, stability, and variation

    Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. InInternational Conference on Learning Representations, 2018

    2018

  3. [11]

    Diffface: Diffusion-based face swapping with facial guidance.Pattern Recognition, 163:111451, 2025

    Kihong Kim, Yunho Kim, Seokju Cho, Junyoung Seo, Jisu Nam, Kychul Lee, Seungryong Kim, and KwangHee Lee. Diffface: Diffusion-based face swapping with facial guidance.Pattern Recognition, 163:111451, 2025

    2025

  4. [12]

    Kingma and Max Welling

    Diederik P. Kingma and Max Welling. Auto-encoding variational bayes.arXiv preprint arXiv:1312.6114, 2013

    2013 arXiv

  5. [13]

    Tran, and Anh Tran

    Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N. Tran, and Anh Tran. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 2116–2127, 2023

    2023

  6. [14]

    Selfswapper: Self-supervised face swapping via shape agnostic masked autoencoder

    Jaeseong Lee, Junha Hyung, Sohyun Jung, and Jaegul Choo. Selfswapper: Self-supervised face swapping via shape agnostic masked autoencoder. InComputer Vision – ECCV 2024, pages 383–400, 2024. 12

    2024

  7. [15]

    Faceshifter: Towards high fidelity and occlusion aware face swapping.arXiv preprint arXiv:1912.13457, 2019

    Lingzhi Li, Jianmin Bao, Hao Yang, Dong Chen, and Fang Wen. Faceshifter: Towards high fidelity and occlusion aware face swapping.arXiv preprint arXiv:1912.13457, 2019

    1912 arXiv

  8. [16]

    Mist: Towards improved adversarial examples for diffusion models.arXiv preprint arXiv:2305.12683, 2023

    Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion models.arXiv preprint arXiv:2305.12683, 2023

    2023 arXiv

  9. [17]

    Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. InProceedings of the 40th International Conference on Ma...

    2023

  10. [18]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  11. [19]

    V . A. Marchenko and L. A. Pastur. Distribution of eigenvalues for some sets of random matrices. Mathematics of the USSR-Sbornik, 1(4):457–483, 1967

    1967

  12. [20]

    Fsgan: Subject agnostic face swapping and reenactment

    Yuval Nirkin, Yosi Keller, and Tal Hassner. Fsgan: Subject agnostic face swapping and reenactment. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 7184–7193, 2019

    2019

  13. [21]

    Deepfacelab: Integrated, flexible and extensible face-swapping framework

    Ivan Perov, Daiheng Gao, Nikolay Chervoniy, Kunlin Liu, Sugasa Marangonda, Chris Umé, Dpfks, Carl Shift Facenheim, Luis RP, Jian Jiang, Sheng Zhang, Pingyu Wu, Bo Zhou, and Weiming Zhang. Deepfacelab: Integrated, flexible and extensible face-swapping framework. arXiv preprint ...

    2005 arXiv

  14. [22]

    Raising the cost of malicious ai-powered image editing

    Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. InProceedings of the 40th International Conference on Machine Learning, volume 202 ofProceedings of Machine Learning Research, pages 29894–...

    2023

  15. [23]

    Toward effective protec- tion against diffusion-based mimicry through score distillation

    Haotian Xue, Chumeng Liang, Xiaoyu Wu, and Yongxin Chen. Toward effective protec- tion against diffusion-based mimicry through score distillation. InThe Twelfth International Conference on Learning Representations, 2024

    2024

  16. [24]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unrea- sonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 586–595, 2018

    2018

  17. [25]

    Diffswap: High-fidelity and controllable face swapping via 3d-aware masked diffusion

    Wenliang Zhao, Yongming Rao, Weikang Shi, Zuyan Liu, Jie Zhou, and Jiwen Lu. Diffswap: High-fidelity and controllable face swapping via 3d-aware masked diffusion. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8568–8577, 2023. 13

    2023

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.