SRAP: SVD-Refined Adversarial Perturbations for Imperceptible Face-Swap Defense

Authors: Sungwon Cho, Kwanghyun Ko, Myungjoo Kang

Published: 2026-08-04 09:48:46+00:00

Comment: 13 pages, 8 figures

AI Summary

This paper introduces SRAP, a novel defense mechanism against deepfake face-swapping that enhances the imperceptibility of adversarial perturbations. SRAP refines Projected Gradient Descent (PGD) perturbations by combining per-channel truncated Singular Value Decomposition (SVD) with an identity-importance mask. This approach concentrates perturbations on identity-sensitive regions and suppresses high-frequency noise, leading to a better trade-off between defense effectiveness and visual fidelity.

Abstract

Deepfake technologies pose increasing threats to facial privacy and identity security, motivating proactive defenses that protect facial images before misuse. Although adversarial perturbations generated by projected gradient descent (PGD) can disrupt the identity representations used by face-swapping models, their visual quality is degraded by two characteristics: perturbations are distributed broadly over the image, including identity-insensitive regions, and they contain visually salient high-frequency components. We analyze these spatial and spectral inefficiencies through identity-sensitivity estimation and the singular-value decomposition (SVD) of PGD perturbations. Our analysis shows that later singular components contain a disproportionate amount of high-frequency energy, while the leading components preserve most of the perturbation energy and defense utility. Based on these observations, we propose SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step. The SVD refinement suppresses high-rank, high-frequency residuals, while the mask restricts perturbations to locations that strongly influence identity representations. Experiments on CelebA-HQ and VGGFace2-HQ demonstrate that SRAP substantially improves protected-image fidelity across all reported metrics while maintaining competitive identity-disruption performance, yielding a favorable trade-off between face-swap defense and visual imperceptibility.

Key findings

SRAP significantly improves protected-image fidelity across LPIPS, PSNR, and SSIM metrics compared to existing methods, achieving the lowest LPIPS and highest PSNR/SSIM. While maintaining competitive identity-disruption performance (second best after FaceShield), SRAP offers a favorable trade-off between defense effectiveness and visual imperceptibility. The SVD refinement effectively removes high-frequency noise, and the importance mask localizes perturbations to identity-sensitive areas, demonstrating the efficacy of both components.

Approach

SRAP generates adversarial perturbations using PGD, then refines them through two main steps at each optimization iteration. First, it applies per-channel truncated SVD to suppress high-rank, high-frequency residuals. Second, it uses an identity-importance mask, derived from spatial sensitivity estimation, to restrict perturbations to areas that strongly influence identity representations, thereby reducing visually salient artifacts.

Datasets

CelebA-HQ, VGGFace2-HQ

Model(s)

SimSwap (as the target face-swapping model), frozen identity encoder (Fid), frozen VAE encoder (Fvae)

Author countries

South Korea

← Previous