Pith. sign in

REVIEW 4 major objections 5 minor 117 references

PhantomSeal claims that a single invisible perturbation, embedding a chosen 'cloak' identity, simultaneously blocks face-swapping from stealing either the source identity or the target context and leaves a forensic trail pointing to the clo

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 15:20 UTC pith:PUBW5HV3

load-bearing objection Solid white-box defense with honest limitations; the headline claim overreaches and the black-box context-protection gap needs fixing. the 4 major comments →

arxiv 2607.20564 v1 pith:PUBW5HV3 submitted 2026-07-20 cs.CR

PhantomSeal: Proactive Deepfakes Defense with Identity/Context Protection and Forensic Tracing

Liangqin Ren , Zeyan Liu , Ye Wang , Yuxin Chen , Fengjun Li , Bo Luo This is my paper
classification cs.CR
keywords proactive deepfake defenseface-swappingidentity protectioncontext protectionforensic tracingcloakingadversarial perturbationSimSwap
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

PhantomSeal tries to establish a proactive defense that acts before a deepfake is made, not after. It claims that one imperceptible perturbation can protect the same photo in both attack roles at once: when the photo is used as the source, the swapped face becomes a preselected cloak identity instead of the victim's face; when the photo is used as the target, the attacker's face fails to integrate into the scene. Because the cloak identity is chosen in advance, the manipulated output also carries a traceable anchor pointing to that cloak. On SimSwap, the reported attack success rate drops to 0.30% while tracing succeeds on 97.97% of manipulated images. This would close the gap left by detection-based and single-role defenses.

Core claim

The central claim is that face-swapping can be steered rather than merely broken. PhantomSeal optimizes a protected photo so its identity embedding moves toward a selected cloak and away from the victim, while its context latent code moves far enough from the original that a generator cannot reuse the scene. The paper argues this push-and-pull co-optimization is the first single mechanism to deliver identity protection, context protection, and forensic tracing at once, and it reports consistent results across GAN-based, diffusion-based, and autoencoder-based face-swapping pipelines.

What carries the argument

The load-bearing object is the cloak image — a face whose identity embedding becomes the target of a constrained, PGD-style iterative update on the user's photo. The objective in Eq. 5 combines four terms: utility (keep pixels close to the original), context deviation (push the latent code off course), cloak attraction (pull identity toward the cloak), and identity repulsion (push identity away from the victim), subject to channel-specific RGB bounds and prioritized optimization. An outer bilevel loop picks the cloak that maximizes a composite protection score; a simple identity-distance heuristic (around 1.20) recovers nearly all of the optimal performance.

Load-bearing premise

The white-box protection stands or falls on face-swapping models exposing decoupled, differentiable identity and context extractors whose gradients can be steered — plus on the attacker never having the clean original or the cloak image; the paper itself concedes in Section 8 that black-box context protection and tracing degrade sharply.

What would settle it

Run the exact SimSwap protocol on 3,000 fresh pairs: if identity-stealing success stays above 1% or tracing falls below 90%, the flagship numbers fail. Or train a residual U-Net denoiser on 200 paired clean/protected images and test context protection: the paper's own robustness table shows context-stealing success jumping toward 97%, which would settle that context protection does not survive a determined denoiser.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Identity-stealing swaps from a protected source now point to the cloak: reported attack success drops to 0.30–0.73% on SimSwap, with tracing success of 94–98%.
  • A protected photo resists context-stealing: the attacker's face fails to land in the scene, with attack success of 1.90–3.20% on SimSwap and under 1.1% on DiffFace.
  • One protected image transfers across architectures: unified and black-box settings cut identity-stealing success to below 2.5% for most of nine face-swapping models, including a commercial live-cam tool.
  • Autoencoder training is poisoned by protected images: mixing even 10% protected images into the victim's training set prevents the decoder from reconstructing the identity.
  • Forensic tracing survives common post-processing better than dedicated watermarking baselines under most operations tested.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because the mechanism depends on decoupled identity/context extractors, a future model that encodes identity and context jointly would likely bypass the white-box guarantee; a natural extension is to optimize against an ensemble of heterogeneous extractors to force transferability.
  • The paper's own robustness tables show context protection collapses once an adaptive denoiser is trained on 100+ clean/protected pairs; in real deployment, the platform-side assumption that attackers cannot gather such pairs is the practical safeguard, so a stronger variant should randomize cloak selection per image or add a denoising-resistant objective.
  • The cloak identity effectively converts an attack into an attribution event: if platforms always use AI-generated cloaks, any output resembling a given cloak is automatically linked to that user's protected upload, which could be combined with existing detection systems to trace across platforms.
  • The near-optimal performance of distance-based cloak selection suggests the expensive bilevel search can be replaced by choosing a cloak at a fixed identity distance (~1.20), making per-image protection fast enough (under 2 seconds) for platform-side deployment.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes PhantomSeal, a proactive image perturbation that embeds a selected 'cloak' identity into a user's image before public sharing. The perturbation is optimized (Eq. 5) to (a) push the image's identity embedding away from the user and toward a cloak identity, (b) disrupt the context/latent embedding of a known face-swapping model, and (c) keep the image visually close to the original. The authors claim this simultaneously protects the image from both identity-stealing and context-stealing face-swapping attacks while also enabling forensic tracing to the cloak identity. They evaluate the method white-box against SimSwap and DiffFace, black-box against nine face-swapping models, under image transformations and adaptive attacks, and in a human study, reporting low attack success rates (e.g., ASR_id 0.30% for SimSwap/Face++) and high tracing rates (e.g., TSR 97.97%).

Significance. If the results hold, PhantomSeal would be a valuable contribution to proactive deepfake defense: it addresses both the source-identity and target-context roles in a single perturbation, and the cloaking mechanism gives a concrete forensic anchor. The paper has clear strengths: a wide empirical scope (nine face-swapping systems, two primary and two additional face-recognition evaluators, a human study), careful ablation and robustness experiments, and a candid discussion of limitations. The central novelty, however, is the simultaneous identity/context protection claim, and that claim is only fully demonstrated in white-box settings; the black-box and unified experiments do not report context protection at all, and Section 8 concedes that context protection drops significantly out-of-distribution. This is a load-bearing gap that needs to be addressed by additional experiments or by explicitly rescoping the claimed contribution.

major comments (4)
  1. [§5.5, Table 6; §8] The paper's headline claim is simultaneous identity/context protection with tracing. Section 5.5's black-box evaluation (Table 6) reports only ASR_id and TSR; no ASR_ctxt is given for any of the nine face-swapping models. Section 8 states that 'In the black-box setting ... context protection and tracing capabilities drop significantly.' Thus the abstract's unqualified 'simultaneously protect both identity and context' is supported only when the exact white-box attack model is known. This is load-bearing: the claimed novelty over identity-only defenses (e.g., LowKey/NullSwap) is the context-protection component, and that component is not demonstrated to transfer. The authors should either (a) report ASR_ctxt for all black-box/unified settings with the same evaluation protocol, or (b) explicitly restrict the context-protection claim to the known-model setting throughout the abstract, contr
  2. [§3.2, Eq. (4)/(5), Table 3] TSR is defined as the matching rate between the face-swapped output and the pre-embedded cloak identity. The optimization in Eq. (4)/(5) directly minimizes ||E_id(˜x)-E_id(x_c)|| (the Δz_c term). White-box TSR values of 94–98% in Table 3 therefore reflect the extent to which the optimizer achieved its explicit objective, not an independent forensic capability. This does not invalidate the method, but the claim of 'forensic tracing' should be framed as a by-design steering effect, and the paper should show evidence that tracing remains informative when the attacker uses a model whose identity extractor was not part of the optimization (black-box TSR in Table 6 is already much lower, 1.7–27%). Consider adding an evaluation where the model is fixed but the optimizer is forbidden from using the cloak-distance term, to calibrate what TSR adds beyond the objective.
  3. [§5.5, Eq. (2)–(5)] The unified defense in Section 5.5 jointly targets identity extractors of three GAN models and then evaluates ASR_id and TSR. It does not report ASR_ctxt. Since the context-protection loss (Eq. 3/5) maximizes deviation in the E_ctxt of a specific model, and Section 8 concedes that 'context extractors are more architecturally diverse' and less transferable, the claimed 'unified protection across different model architectures' (Section 5.4) is not supported for context. Please either provide transfer experiments for context protection (e.g., perturb against SimSwap's E_ctxt and evaluate ASR_ctxt against FaceShifter/HifiFace/DiffFace), or restrict the transferability claim to identity protection.
  4. [§7.1, Table 10, §8] The adaptive-denoiser experiment shows that context protection is fragile: training on only 100 clean/protected pairs raises ASR_ctxt from 4.0% to 97.1% (FaceNet-512) and to 99.2% (Face++); at 500 pairs it stays at 94.2%/99.0%. The Section 8 discussion is candid, but this is a core part of the simultaneous-protection claim, not a peripheral robustness issue. The argument that collecting paired data is 'highly suspicious' relies on the threat model's assumption that the attacker never holds Alice's clean image; if that assumption fails (e.g., an image already circulated unprotected, or a platform insider), the context-protection guarantee collapses. Please state this dependency explicitly at the point where the contribution is claimed.
minor comments (5)
  1. [Tables 3–10] All effectiveness metrics are reported as point estimates. With N=3,000 image pairs (or 1,301 for the autoencoder experiment), exact binomial confidence intervals would be easy to add and are especially needed for the 0.00% entries in Tables 4 and 9.
  2. [Appendix D] Initiative Defense and CMUA-Watermark are designed for attribute editing/reenactment, not face swapping. The comparison therefore does not establish superiority in a meaningful baseline; either identify a face-swap-specific context defense or present these as exploratory rather than as a quantitative baseline.
  3. [§5.7, Q1] The human acceptability finding (79.43% for DiffFace) is in tension with the better objective utility metrics reported for DiffFace in Table 3. The text offers an explanation, but the main text should state this inconsistency more prominently rather than leaving it for the reader to reconcile.
  4. [Eq. (6)] The composite score weights w_id, w_ctx, and w_cloak are fixed to 1 (or 0 in the protection-prioritized variant) without sensitivity analysis. Since the cloak selection in Algorithm 1 uses S, the paper should state whether the ranking of cloaks is stable to these weights.
  5. [Algorithm 1] The outer-loop cloak selection evaluates S using the same FR models that are later used for test-set evaluation. Although the selection is done on a validation set, the test metrics may inherit a validation-selection bias; consider a nested evaluation protocol or reporting the robustness of the final metrics to the chosen validation split.

Circularity Check

0 steps flagged

No significant circularity: PhantomSeal's tracing is an explicit optimization objective, not a hidden prediction; black-box limitations are disclosed in Section 8.

full rationale

PhantomSeal is an optimization-based defense rather than a predictive derivation. The cloak-matching objective in Eq. (4) explicitly implements tracing, and the paper does not claim TSR is an emergent or theory-derived quantity; it is the method's stated goal. TSR is measured on held-out test images using external FR models (FaceNet-512, Face++, Face Recognition, AWS Rekognition) and a human study, while the inner-loop optimization targets SimSwap's E_id/E_ctxt, so the evaluation is not the same function being optimized. The composite score S is used both as cloak-selection objective on validation and as a reporting metric, but final numbers are on a separate test set, so this is hyperparameter selection, not circularity. The only self-citation ([54]) is a general reference on adversarial AI-art and is not load-bearing. Section 8 explicitly discloses that black-box context protection and tracing degrade; this is an honest scope limitation rather than a circular step. No step in the paper's derivation reduces to its own inputs by construction.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 1 invented entities

The paper's central claims depend on several hand-set hyperparameters (loss weights, deviation bounds, RGB bounds, distance thresholds) and on domain assumptions about the architecture of face-swapping models and the attacker's capabilities. These are stated more honestly than in many papers, but the headline numbers are conditional on their specific values.

free parameters (5)
  • loss weights (lambda_util, lambda_ctx, lambda_cloak, lambda_id) = 1000, 0.1, 10000, 10000 (SimSwap default); alpha=750, beta=0.1 (autoencoder)
    Chosen to balance utility vs protection. Section 6 sensitivity analysis shows strong dependence on lambda_cloak and lambda_ctx, so these are not neutral defaults.
  • identity/context deviation bounds (delta_id, delta_ctx) = delta_id=0.003, delta_ctx=25 (SimSwap); ||delta z|| <= 75 (autoencoder)
    Hand-set bounds; ablation in Table 9 shows removing the identity-deviation bound destroys tracing (TSR drops to 0), so the reported tracing result depends on this specific bound.
  • per-channel RGB perturbation bounds (delta_RGB) = (0.075, 0.03, 0.075) for SimSwap; (0.08, 0.03, 0.1) for autoencoder
    Motivated by human green-channel sensitivity, but the exact values are hand-picked. Removing them raises MSE from 106 to 128 and improves protection, showing they materially constrain the result.
  • identity-distance cloak selection threshold = 1.20 (SimSwap), 1.31/1.55 (DiffFace baseline/protection-prioritized)
    Selected on the validation set by maximizing composite score S, then frozen for the test set. This is a hyperparameter fitted to data and directly affects the reported ASR/TSR trade-off.
  • composite score weights (w_id, w_ctx, w_cloak) = 1,1,1 baseline; 1,1,0 protection-prioritized
    User-defined priorities. Setting w_cloak=0 changes the selected distance threshold and yields different ASR/TSR numbers, so the headline results are conditional on these choices.
axioms (4)
  • domain assumption Face-swapping models have decoupled, differentiable identity and context extractors.
    Invoked in Section 4.1 (Eq. 2) and Section 8. If the model uses a monolithic encoder or a non-differentiable pipeline, the gradient steering may not transfer.
  • domain assumption Attack success can be measured by a face-recognition model matching rate.
    Section 3.2 defines success as FR-model matching. Real-world attack success includes human perception and other criteria, though the paper adds a human study for some checks.
  • domain assumption The attacker never has access to the unprotected original image or the cloak image.
    Section 3.1 states this explicitly. If an attacker obtains the clean original, the defense is trivially bypassed; this is a standard but load-bearing threat-model axiom.
  • standard math Projected gradient descent on the combined loss yields a perturbation that transfers to the full face-swapping output.
    The optimization in Algorithm 1 is standard PGD-style. Its transferability to the full swap pipeline is an empirical claim validated only for the tested models.
invented entities (1)
  • Cloak identity / cloak image independent evidence
    purpose: An anchor face that the protected image's identity vector is pushed toward, so deepfake outputs resemble the cloak and can be traced.
    The cloak is not an unfalsifiable construct: it is directly observable in the output face, measured by FR matching to the cloak (TSR up to 97.97%) and by human judges in Q2.

pith-pipeline@v1.3.0-alltime-deepseek · 35211 in / 13334 out tokens · 121072 ms · 2026-08-01T15:20:20.222541+00:00 · methodology

0 comments
read the original abstract

Deepfakes, especially face-swapping attacks, pose significant challenges to authenticity, security, and ethics across science, engineering, and society. While most existing detection/tracing approaches operate post hoc, proactive defenses that aim to intervene before deepfake generation remain limited in terms of real-world effectiveness. In this paper, we present PhantomSeal, the first proactive defense to simultaneously protect both the identity and the context of users' images from being used in face-swapping attacks, while supporting forensic tracing. We present a novel cloaking technique that embeds a selected identity as a stealthy identifier. This mechanism steers the deepfake generation process toward producing content that resembles the chosen cloak identity, thereby preventing successful face-swapping while enabling effective feature-based forensic analysis. The effectiveness and robustness of PhantomSeal is demonstrated in extensive experiments across different face-swapping architectures and models. For example, it reduces the attack success rate of SimSwap, an advanced deepfake model, to 0.30%, and correctly identifies 97.97% of manipulated content. Codes can be found at https://github.com/LiangqinRen/PhantomSeal

Figures

Figures reproduced from arXiv: 2607.20564 by Bo Luo, Fengjun Li, Liangqin Ren, Ye Wang, Yuxin Chen, Zeyan Liu.

Figure 1
Figure 1. Figure 1: Identity-stealing (A) and context-stealing (B, C) [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: An overview of the PhantomSeal workflow. (A) Without protection, Bob and Charlie successfully perform face swapping on Alice’s image. (B) A suitable cloak image is selected and applied to protect Alice. (C) With protection, face swapping fails: Bob’s output resembles the cloak identity, while Charlie’s result fails to integrate his face into Alice’s image. SimSwap Defense. SimSwap extracts an identity vect… view at source ↗
Figure 3
Figure 3. Figure 3: Sensitivity analysis of coefficient weights. The x-axis represents the weight values ranging from 0 to [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: PhantomSeal robustness against denoisers trained with different numbers of training samples. while𝑇𝑆𝑅 remains stable throughout. When the number of training samples increases from 10 to 30, 𝐴𝑆𝑅𝑐𝑡𝑥 remains low and nearly unchanged. However, when the training set size reaches 40, 𝐴𝑆𝑅𝑐𝑡𝑥 increases sharply to more than 50%. When the number of train￾ing samples reaches 70, the context protection fails, and addi… view at source ↗
Figure 5
Figure 5. Figure 5: Training loss with clean images of 𝐼𝐴 and protected images of 𝐼𝐸 with different poison ratios [PITH_FULL_IMAGE:figures/full_fig_p020_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

117 extracted references · 16 linked inside Pith

  1. [1]

    ageitgey. 2026. Face Recognition. https://github.com/ageitgey/face_recognition

    2026

  2. [2]

    Jiaxin Ai, Zhongyuan Wang, Baojin Huang, and Zhen Han. 2023. DeepReversion: Reversely Inferring the Original Face from the DeepFake Face. InIJCNN

    2023

  3. [3]

    Jiaxin Ai, Zhongyuan Wang, Baojin Huang, Zhen Han, and Qin Zou. 2023. Deepfake Face Provenance for Proactive Forensics. InICIP

    2023

  4. [4]

    Amazon Web Services. 2026. Amazon Rekognition Documentation. https: //docs.aws.amazon.com/rekognition/

    2026

  5. [5]

    Vishal Asnani, Xi Yin, Tal Hassner, Sijia Liu, and Xiaoming Liu. 2022. Proactive image manipulation detection. InCVPR

    2022

  6. [6]

    Mauro Barni, Kassem Kallas, Ehsan Nowroozi, and Benedetta Tondi. 2020. CNN detection of GAN-generated face images based on cross-band co-occurrences analysis. InWIFS

    2020

  7. [7]

    Nicolas Beuve, Wassim Hamidouche, and Olivier Déforges. 2023. Waterlo: Pro- tect images from deepfakes using localized semi-fragile watermark. InICCVW

    2023

  8. [8]

    brandstudio.ai. 2026. Brand Studio. https://brandstudio.com/

    2026

  9. [9]

    Qiong Cao, Li Shen, Weidi Xie, Omkar M Parkhi, and Andrew Zisserman. 2018. VGGFace2: A dataset for recognising faces across pose and age. InFG

    2018

  10. [10]

    Nicholas Carlini and Hany Farid. 2020. Evading deepfake-image detectors with white-and black-box attacks. InCVPR Workshops

    2020

  11. [11]

    Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. 2020. What makes fake images detectable? understanding properties that generalize. InECCV

    2020

  12. [12]

    Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge. 2020. Simswap: An efficient framework for high fidelity face swapping. InACM MM

    2020

  13. [13]

    Zhikai Chen, Lingxi Xie, Shanmin Pang, Yong He, and Bo Zhang. 2021. Magdr: Mask-guided detection and reconstruction for defending deepfakes. InCVPR

    2021

  14. [14]

    Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. 2021. LowKey: Protecting Social Media Users from Facial Recognition. InICLR

    2021

  15. [15]

    Samantha Cole. 2017. AI-assisted fake porn is here and we’re all fucked.Moth- erboard Tech by Vice(2017)

    2017

  16. [16]

    Kaiwen Cui, Rongliang Wu, Fangneng Zhan, and Shijian Lu. 2023. Face trans- former: Towards high fidelity and accurate face swapping. InCVPRW

    2023

  17. [17]

    Yunshu Dai, Jianwei Fei, and Fangjun Huang. 2024. IDGuard: Robust, General, Identity-Centric POI Proactive Defense Against Face Editing Abuse. InCVPR

    2024

  18. [18]

    Debayan Deb, Xiaoming Liu, and Anil K Jain. 2023. FaceGuard: A self-supervised defense against adversarial face images. InFG

    2023

  19. [19]

    deepfakes. 2026. faceswap. https://github.com/deepfakes/faceswap

    2026

  20. [20]

    P Kingma Diederik and Welling Max. 2019. An introduction to variational autoencoders.Foundations and Trends in Machine Learning12 (2019), 307–392

    2019

  21. [21]

    Junhao Dong and Xiaohua Xie. 2021. Visually maintained image disturbance against deepfake face swapping. InICME

    2021

  22. [22]

    Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. 2020. Leveraging frequency analysis for deep fake image recognition. InICML

    2020

  23. [23]

    Pashami, F

    Jia Fu, Xiao Zhang, S. Pashami, F. Rahimian, and Anders Holst. 2025. DiffPAD: Denoising Diffusion-Based Adversarial Patch Decontamination. InW ACV

    2025

  24. [24]

    Gege Gao, Huaibo Huang, Chaoyou Fu, Zhaoyang Li, and Ran He. 2021. Infor- mation bottleneck disentanglement for identity swapping. InCVPR

    2021

  25. [25]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples.arXiv:1412.6572(2014)

    Pith/arXiv arXiv 2014

  26. [26]

    Weinan Guan, Ziwen He, Wei Wang, Jing Dong, and Bo Peng. 2022. Defending against deepfakes with ensemble adversarial perturbation. InICPR

    2022

  27. [27]

    Luca Guarnera, Oliver Giudice, and Sebastiano Battiato. 2020. Fighting Deepfake by Exposing the Convolutional Traces on Images.IEEE Access8 (2020)

    2020

  28. [28]

    Guodong Guo and Na Zhang. 2019. A survey on deep learning based face recognition.CVIU189 (2019), 102805

    2019

  29. [29]

    hacksider. 2026. Deep-Live-Cam. https://github.com/hacksider/Deep-Live- Cam

    2026

  30. [30]

    Ziwen He, Wei Wang, Weinan Guan, Jing Dong, and Tieniu Tan. 2022. Defeating DeepFakes via Adversarial Visual Reconstruction. InACM MM. 2464–2472

    2022

  31. [31]

    HeraHaven. 2026. HeraHaven. https://herahaven.com/

    2026

  32. [32]

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilis- tic models. InNeurIPS

    2020

  33. [33]

    Shang-Lin Hsieh, Chun-Che Chen, and Wen-Shan Shen. 2014. Combining digital watermarking and fingerprinting techniques to identify copyrights for color images.The Scientific World Journal2014, 1 (2014), 454867

    2014

  34. [34]

    Shu Hu, Yuezun Li, and Siwei Lyu. 2021. Exposing GAN-generated faces using inconsistent corneal specular highlights. InICASSP

    2021

  35. [35]

    Xiaoxiao Hu, Qichao Ying, Zhenxing Qian, Sheng Li, and Xinpeng Zhang. 2023. Draw: Defending camera-shooted raw against image manipulation. InICCV

    2023

  36. [36]

    Hao Huang, Yongtao Wang, Zhaoyu Chen, Yuze Zhang, Yuheng Li, Zhi Tang, Wei Chu, J. Chen, W. Lin, and Kai-Kuang Ma. 2022. Cmua-watermark: A cross- model universal adversarial watermark for combating deepfakes. InAAAI

    2022

  37. [37]

    Qidong Huang, Jie Zhang, Wenbo Zhou, Weiming Zhang, and Nenghai Yu. 2021. Initiative defense against facial manipulation. InAAAI. PhantomSeal CCS ’26, November 15-19, 2026, Hague, Netherlands

    2021

  38. [38]

    Huang, F

    Y. Huang, F. Juefei-Xu, Q. Guo, Yang Liu, and G. Pu. 2022. Fakelocator: Robust localization of gan-based face manipulations.IEEE TIFS17 (2022)

    2022

  39. [39]

    Yihao Huang, Felix Juefei-Xu, Run Wang, Qing Guo, Lei Ma, Xiaofei Xie, Jian- wen Li, Weikai Miao, Yang Liu, and Geguang Pu. 2020. Fakepolisher: Making deepfakes more detection-evasive by shallow reconstruction. InACM MM

    2020

  40. [40]

    iperov. 2026. DeepFaceLive. https://github.com/iperov/DeepFaceLive

    2026

  41. [41]

    Dave Itzkoff. 2016. How ‘Rogue One’ brought back familiar faces.New York Times27 (2016)

    2016

  42. [42]

    Jaehwan Jeong, Sumin In, Sieun Kim, Hannie Shin, Jongheon Jeong, Sang Ho Yoon, Jaewook Chung, and Sangpil Kim. 2024. FaceShield: Defending Facial Image against Deepfake Threats.arXiv:2412.09921(2024)

    arXiv 2024

  43. [43]

    Tero Karras, Samuli Laine, and Timo Aila. 2019. A style-based generator archi- tecture for generative adversarial networks. InCVPR

    2019

  44. [44]

    John Kerry. 2026. File: Dr. Klaus Schwab Founder of the WEF. https://commons.wikimedia.org/wiki/File:Dr._Klaus_Schwab_Founder_ of_the_WEF_(24511853176).jpg

    2026

  45. [45]

    Kihong Kim, Yunho Kim, Seokju Cho, Junyoung Seo, Jisu Nam, Kychul Lee, Seungryong Kim, and KwangHee Lee. 2025. DiffFace: Diffusion-based face swapping with facial guidance.PR163 (2025), 111451

    2025

  46. [46]

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial machine learning at scale.arXiv:1611.01236(2016)

    Pith/arXiv arXiv 2016

  47. [47]

    Shulin Lan, Kanlin Liu, Yazhou Zhao, Chen Yang, Yingchao Wang, Xingshan Yao, and Liehuang Zhu. 2024. Facial Features Matter: a Dynamic Watermark based Proactive Deepfake Detection Approach.arXiv:2411.14798(2024)

    Pith/arXiv arXiv 2024

  48. [48]

    Dami Lee. 2019. Deepfake Salvador Dalí takes selfies with museum visitors.The Verge10 (2019)

    2019

  49. [49]

    Guandong Li and Mengxia Ye. 2026. Inject Where It Matters: Training-Free Spatially-Adaptive Identity Preservation for Text-to-Image Personalization. arXiv preprint arXiv:2602.13994(2026)

    arXiv 2026

  50. [50]

    Haodong Li, Bin Li, Shunquan Tan, and Jiwu Huang. 2020. Identification of deep network generated images using disparities in color components.Signal Processing174 (2020), 107616

    2020

  51. [51]

    L. Li, J. Bao, H. Yang, D. Chen, and F. Wen. 2019. FaceShifter: Towards High Fidelity and Occlusion Aware Face Swapping.arXiv:1912.13457(2019)

    Pith/arXiv arXiv 2019

  52. [52]

    Ming Li, Zhaoli Yang, Tao Wang, Yushu Zhang, and Wenying Wen. 2024. Dual Protection for Image Privacy and Copyright via Traceable Adversarial Examples. IEEE TCSVT34, 12 (2024), 13401–13412

    2024

  53. [53]

    Maomao Li, Ge Yuan, Cairong Wang, Zhian Liu, Yong Zhang, Yongwei Nie, Jue Wang, and Dong Xu. 2023. E4S: Fine-grained Face Swapping via Editing With Regional GAN Inversion.arXiv:2310.15081(2023)

    Pith/arXiv arXiv 2023

  54. [54]

    Yuying Li, Zeyan Liu, Junyi Zhao, Liangqin Ren, Fengjun Li, Jiebo Luo, and Bo Luo. 2024. The Adversarial AI-Art: Understanding, Generation, Detection, and Benchmarking. InESORICS

    2024

  55. [55]

    Yuezun Li and Siwei Lyu. 2021. Obstructing deepfakes by disrupting face detection and facial landmarks extraction.Deep Learning-Based Face Analytics (2021), 247–267

    2021

  56. [56]

    Yuezun Li, Pu Sun, Honggang Qi, and Siwei Lyu. 2024. LandmarkBreaker: A proactive method to obstruct DeepFakes via disrupting facial landmark extrac- tion.CVIU240 (2024), 103935

    2024

  57. [57]

    Yuezun Li, Xin Yang, Baoyuan Wu, and Siwei Lyu. 2019. Hiding faces in plain sight: Disrupting ai face synthesis with adversarial perturbations. arXiv:1906.09288(2019)

    Pith/arXiv arXiv 2019

  58. [58]

    Zheng Li, Ning Yu, Ahmed Salem, Michael Backes, Mario Fritz, and Yang Zhang

  59. [59]

    AI Innovate Technology Limited. 2026. AILab Smart Beauty API. https://www. ailabtools.com/portrait-intelligent-beautification-example

    2026

  60. [60]

    Tencent Technology Limited. 2026. Tencent Cloud BeautifyPic API. https: //cloud.tencent.com/document/product/1172/40715

    2026

  61. [61]

    Yuzhen Lin, Han Chen, Emanuele Maiorana, Patrizio Campisi, and Bin Li. 2022. Source-ID-Tracker: Source Face Identity Protection in Face Swapping. InICME

    2022

  62. [62]

    Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weim- ing Zhang, and Nenghai Yu. 2021. Spatial-phase shallow learning: rethinking face forgery detection in frequency domain. InCVPR

    2021

  63. [63]

    Bestagini, Weiming Zhang, Y

    Honggu Liu, Xiaodan Li, Wenbo Zhou, Han Fang, P. Bestagini, Weiming Zhang, Y. Chen, S. Tubaro, Nenghai Yu, Yuan He, and Hui Xue. 2023. BiFPro: A Bidirec- tional Facial-data Protection Framework against DeepFake. InACM MM

    2023

  64. [64]

    Yisu Liu, Jinyang An, Wanqian Zhang, Dayan Wu, Jingzi Gu, Zheng Lin, and Weiping Wang. 2024. Disrupting diffusion: Token-level attention erasure attack against diffusion-based customization. InACM MM

    2024

  65. [65]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks.arXiv:1706.06083(2017)

    Pith/arXiv arXiv 2017

  66. [66]

    Venkata Srinath Mannam, Andrey Makrushin, and Jana Dittmann. 2024. On Feasibility of Transferring Watermarks from Training Data to GAN-Generated Fingerprint Images.VISIGRAPP4 (2024), 435–445

    2024

  67. [67]

    Falko Matern, Christian Riess, and Marc Stamminger. 2019. Exploiting Visual Artifacts to Expose Deepfakes and Face Manipulations. InW ACV Workshops

    2019

  68. [68]

    Megvii. 2026. Face++. https://console.faceplusplus.com/documents/5679308

    arXiv 2026

  69. [69]

    Mehdi Mirza and Simon Osindero. 2014. Conditional generative adversarial nets.arXiv:1411.1784(2014)

    Pith/arXiv arXiv 2014

  70. [70]

    Lakshmanan Nataraj, Tajuddin Manhar Mohammed, Shivkumar Chan- drasekaran, Arjuna Flenner, Jawadul H Bappy, Amit K Roy-Chowdhury, and BS Manjunath. 2019. Detecting GAN generated fake images using co-occurrence matrices.arXiv:1903.06836(2019)

    Pith/arXiv arXiv 2019

  71. [71]

    Thanh Thi Nguyen, Quoc Viet Hung Nguyen, Dung Tien Nguyen, Duc Thanh Nguyen, Thien Huynh-The, Saeid Nahavandi, Thanh Tam Nguyen, Quoc-Viet Pham, and Cuong M Nguyen. 2022. Deep learning for deepfakes creation and detection: A survey.CVIU223 (2022), 103525

    2022

  72. [72]

    Yuanchen Niu, Yuanman Li, Guijia Zhang, and Xia Li. 2024. A diffusion-based approach for restoring face-swapped images. InAPSIPA ASC

    2024

  73. [73]

    Oldpan. 2026. Faceswap-Deepfake-Pytorch. https://github.com/Oldpan/ Faceswap-Deepfake-Pytorch

    2026

  74. [74]

    Rajeev Ranjan, Swami Sankaranarayanan, Ankan Bansal, Navaneeth Bodla, Jun-Cheng Chen, Vishal M Patel, Carlos D Castillo, and Rama Chellappa. 2018. Deep learning for understanding faces: Machines may be just as good, or better, than humans.SPM35, 1 (2018), 66–83

    2018

  75. [75]

    Hannah Roberts. 2025. ‘Haunting’ to see deepfake pornography of myself, says journalist Cathy Newman. https://www.standard.co.uk/showbiz/celebrity- news/cathy-newman-good-morning-britain-british-ai-technology- government-b1203312.html

    2025

  76. [76]

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. 2015. U-net: Convolutional networks for biomedical image segmentation. InMICCAI

    2015

  77. [77]

    Florian Schroff, Dmitry Kalenichenko, and James Philbin. 2015. Facenet: A unified embedding for face recognition and clustering. InCVPR

    2015

  78. [78]

    Eran Segalis and Eran Galili. 2020. OGAN: Disrupting deepfakes with an adver- sarial attack that survives training.arXiv:2006.12247(2020)

    Pith/arXiv arXiv 2020

  79. [79]

    Sefik Serengil and Alper Özpınar. 2024. A Benchmark of Facial Recognition Pipelines and Co-Usability Performances of Modules.JIT17, 2 (2024), 95–107

    2024

  80. [80]

    Sefik Ilkin Serengil and Alper Ozpinar. 2020. Lightface: A hybrid deep face recognition framework. InASYU. 23–27

    2020

Showing first 80 references.