Transferable Attack against Face Swapping in an Extended Space

As deep face swapping (FS) models become more accessible, they pose significant risks to privacy and security. While existing defenses like deepfake detection are reactive, adversarial attacks aim to proactively protect images by making them resistant to manipulation. This paper addresses the challenge of creating transferable adversarial examples that can protect source faces against unseen, subject-agnostic FS models without requiring access to the target model's architecture or training data.

The authors propose the Additive Identity attack based on a Relighting function (AIR). AIR operates by targeting the identity extraction modules of FS models rather than the full generation pipeline. It employs two primary strategies: an Additive Identity Attack (AIA) that uses an Adaptive Translation-Invariant (ATI) operation to improve transferability while minimizing visible noise, and a Relighting Functional Attack (RFA) that uses spherical harmonics to reilluminate the image. By combining these two techniques, the authors expand the attack space, allowing for more effective and visually natural adversarial examples. Unlike previous methods, AIR uses an ensemble of face recognition models as surrogates, which avoids the need for specific FS model access.

Extensive experiments across various state-of-the-art GAN-based (e.g., FaceShifter, SimSwap) and diffusion-based (e.g., DiffFace, DiffSwap) FS models demonstrate that AIR significantly outperforms existing baseline attacks. AIR achieves a higher Attack Success Rate (ASR) while maintaining superior image quality, as measured by LPIPS and EMSE metrics. The study also provides a mathematical justification for how the dual-perturbation approach expands the attack space, leading to more robust transferability across diverse model architectures.

This research provides a practical, black-box solution for individuals to protect their online images from unauthorized face swapping. By demonstrating that effective protection can be achieved without needing to know the specific model used by an attacker, the authors offer a scalable defense mechanism that remains effective even as new, unseen face swapping technologies emerge.