FaceShield: Defending Facial Image against Deepfake Threats

TL;DR

We propose FaceShield, a proactive defense that embeds invisible adversarial noise into facial images to neutralize deepfake face swapping. Prior defenses target only the general noise addition and removal process of diffusion models, whereas FaceShield directly disrupts the cross-attention conditioning mechanism, the core bottleneck through which the original face is projected into the deepfake output. By computing gradients at this exact pathway, the method achieves maximized disruption with only minimal perturbation. Defense coverage is further extended to GAN-based architectures by jointly attacking common facial feature extractors. To prevent the protective noise from being erased by image compression or purification, we apply Low-Pass Filtering (LPF), and to eliminate visually noticeable noise boundaries, we incorporate a Gaussian blur. As a result, FaceShield achieves state-of-the-art protection against the latest DM-based deepfake models, while also exhibiting strong transferability to GAN-based architectures, with lower noise visibility than all baselines.

Key Contributions

• First defense directly targeting the diffusion deepfake core pathway — we disrupt the Key-Value pairs in cross-attention where the source face is synthesized, a mechanism entirely overlooked by prior defenses. Defense coverage is further extended to GAN-based models by targeting facial feature extractors under a single unified perturbation.
• Enhanced imperceptibility via Gaussian blur — by smoothing out harsh differences between adjacent noise pixels, visual artifacts are reduced, making the protective noise far less noticeable to the human eye.
• Robustness against purification via Low-Pass Filtering — by concentrating noise in low-frequency components, the defense remains highly effective even after JPEG compression, bit reduction, and resizing.

Project Design

(ii) Facial Feature Extractor Attack

MTCNN's three-stage cascade (P-Net → R-Net → O-Net) for face detection and landmark localization.

The MTCNN attack adversarially perturbs the P-Net bounding box probabilities across multiple scales, ensuring the noise disrupts face detection regardless of interpolation mode or framework (PyTorch / TensorFlow). By combining this with an ArcFace identity attack, FaceShield performs a joint ensemble attack that broadly covers GAN-based deepfake models under a single perturbation.

(iii) Enhanced Noise Update

The adversarial noise is transformed to the frequency domain via 8×8 DCT patches. Using the Luminance Quantization Table — the same mask applied during actual JPEG compression — only low-frequency components are retained, then reconstructed via IDCT. This concentrates the perturbation in a band that survives JPEG compression without being discarded.

Even under a bounded noise budget (e.g., δ = 12/255), adjacent pixels can receive opposite extremes (e.g., +12 and −12), creating a local contrast gap of up to 24 that becomes visually conspicuous.

Sobel filtering identifies these boundary regions where neighboring noise values diverge sharply, and Gaussian blur is selectively applied to smooth them out, maximizing imperceptibility without affecting the overall perturbation strength.

Experiments

FaceShield protects against 6 deepfake models — DiffFace, DiffSwap, FaceSwap, IP-Adapter (DM-based, orange box) and SimSwap, InfoSwap (GAN-based, blue box). DM-based outputs exhibit distorted artifacts and GAN-based outputs generate unrelated identities, both preventing source face reproduction.

Compared to AdvDM, Mist, PhotoGuard, and SDST on IP-Adapter deepfakes, prior methods fail to disrupt the output. FaceShield causes visible generation failures, confirming that attacking the conditioning pathway is essential for DM-based deepfake protection.

Targeting the mid-layers of the denoising UNet produces the strongest protection compared to using only down/up layers or all layers, as confirmed by our ablation study. Mid-layer cross-attention carries the highest sensitivity to the conditioning source face, as this is where source identity is most strongly encoded and the face-swap signal is concentrated, making it the most effective and precise attack target.

Under FaceShield's perturbation, MTCNN fails to produce high-confidence bounding boxes at the P-Net stage (bottom row), preventing detected face crops from propagating to downstream deepfake models — compared to the unprotected case where detection succeeds cleanly (top row).

FaceShield's low-frequency noise concentration keeps performance close to lossless (PNG) across JPEG compression (Q90/75/50), bit reduction (8-bit/3-bit), and resizing (75%/50%, BILINEAR/INTER AREA) — consistently outperforming all baselines on both ISM and PSNR metrics.

Qualitative results after JPEG compression (Q90, Q75, Q50) and bit reduction (8-bit, 3-bit). Protection degrades minimally relative to the lossless PNG baseline.

Qualitative results after 75% and 50% resizing (BILINEAR and INTER AREA). The perturbation remains effective across both interpolation modes.

FaceShield generalizes across eight IP-Adapter variants (ControlNet, ImageVariation, Multi-modal prompts, Plus/PlusXL, FaceID, FaceIDPlus) — demonstrating robust transferability not only across structurally different architectures but also across models sharing the same backbone with different pre-trained weights.

Conclusion

We propose FaceShield, a proactive invisible protection technique against diverse deepfake systems. By targeting the cross-attention conditioning pathway specific to DM-based deepfakes — a mechanism overlooked by prior defenses — and jointly disrupting common facial feature extractors used by GAN-based models, FaceShield achieves broad architectural coverage under a single perturbation. An enhanced noise update combining Gaussian blur and low-pass filtering further ensures that protection is both imperceptible and robust to JPEG compression and resizing purification. Extensive experiments confirm state-of-the-art protection with the lowest noise visibility among all baselines, while requiring significantly less computation time and memory.