PhantomSeal is presented, the first proactive defense to simultaneously protect both the identity and the context of users' images from being used in face-swapping attacks, while supporting forensic tracing.
Abstract
Deepfakes, especially face-swapping attacks, pose significant challenges to authenticity, security, and ethics across science, engineering, and society. While most existing detection/tracing approaches operate post hoc, proactive defenses that aim to intervene before deepfake generation remain limited in terms of real-world effectiveness. In this paper, we present PhantomSeal, the first proactive defense to simultaneously protect both the identity and the context of users'images from being used in face-swapping attacks, while supporting forensic tracing. We present a novel cloaking technique that embeds a selected identity as a stealthy identifier. This mechanism steers the deepfake generation process toward producing content that resembles the chosen cloak identity, thereby preventing successful face-swapping while enabling effective feature-based forensic analysis. The effectiveness and robustness of PhantomSeal is demonstrated in extensive experiments across different face-swapping architectures and models. For example, it reduces the attack success rate of SimSwap, an advanced deepfake model, to 0.30%, and correctly identifies 97.97% of manipulated content. The source codes is available at https://github.com/LiangqinRen/PhantomSeal.
Abstract The rapid advancement of deepfake technologies, driven by generative artificial intelligence, has made distinguishing authentic media from synthetic content increasingly challenging. While much research has concentrated on detecting deepfakes after their creation, proactive prevention strategies remain relatively underdeveloped. This review provides a comprehensive examination of the evolution of deepfake generation pipelines, the risks they pose, and the current landscape of detection techniques. It also critically evaluates existing preventive measures such as digital watermarking, cryptographic signing, visual obfuscation, and adversarial image cloaking highlighting their shortcomings in terms of scalability, robustness, and practical implementation. To address these limitations, the paper introduces a conceptual prevention framework that applies imperceptible, adaptive perturbations directly to images and video frames at the source. These perturbations are designed to disrupt the feature extraction mechanisms of deepfake generation models, thereby hindering the creation of convincing synthetic media while preserving visual fidelity for human viewers. The proposed approach emphasizes resilience across different model architectures and suitability for real-time deployment in mobile and web-based environments. The study concludes by outlining future research directions to validate and refine this prevention strategy, advocating for a proactive shift in digital content protection that prioritizes prevention alongside detection.
Current proactive defense mechanisms, though effective, predominantly concentrate on impeding deepfake models rather than regulating them. In light of the pervasive demand for deepfake creation for legitimate purposes, we introduce a proactive deepfake control framework based on a “whitelist” mechanism. This framework conditionally governs deepfake output through the utilization of a key-protected watermark, guaranteeing robustness throughout the entire process. The scheme proposes an encrypted embedder and an encrypted extractor. The former ensures that only the data owner can embed watermarks on their own facial images, while the latter safeguards against watermark leakage while facilitating watermark extraction and matching. Subsequently, the deepfake model is retrained to exclusively accept facial images that contain the specified watermark. Furthermore, a three-stage training strategy is proposed to bolster robustness and ensure watermark traceability. Experimental findings underscore the efficacy and rationality of our approach in regulating deepfake generation. Additionally, the results demonstrate the impressive performance of our scheme in terms of image quality and robustness.
Yizhi Guo, Bingwen Feng, Xiaotian Wu et al.· ACM Transactions on Multimed...· 0 citations
Large language models (LLMs) are becoming increasingly integrated into mainstream development platforms and daily technological workflows, typically behind moderation and safety controls. Despite these controls, preventing prompt-based policy evasion remains challenging, and adversaries continue to"jailbreak"LLMs by crafting prompts that circumvent implemented safety mechanisms. Prior work has established cipher-mediated interaction, code-embedded decryption, prompt decomposition and reconstruction, and layered custom encryption as viable attack primitives. However, reported evaluations generally collapse visible acceptance, successful recovery of the concealed request, and subsequent execution into an aggregate attack-success outcome. This leaves limited evidence about where multistage prompt-transformation attacks fail within an observable black-box interaction. This paper introduces RoguePrompt, a jailbreak pipeline that partitions a forbidden prompt and applies two nested encodings, Vigenere followed by ROT13, along with natural-language reconstruction instructions. RoguePrompt was developed and evaluated under a black-box threat model, with only API or user-interface access to the hosted models, and was tested on 313 real-world, hard-rejected prompts. Success was measured in terms of moderation bypass, instruction reconstruction, and execution when the relevant stage exceeded its automated criterion. RoguePrompt achieved average rates of 93.93% for filter bypass, 79.02% for reconstruction, and 70.18% for execution. These results demonstrate the effectiveness of layered prompt encoding while providing stage-level evidence of where multistage jailbreaks fail during moderation bypass, instruction reconstruction, and execution.
In the contemporary digital landscape, the exponential proliferation of high-dimensional multimedia data across social platforms, communication networks, and biometric authentication channels is accompanied by an escalating threat of sophisticated generative deception. Deepfakes and synthetic media manipulations present critical systemic risks, ranging from targeted identity fraud to widespread misinformation campaigns. Traditional forensic methodologies—such as pixel-level error level analysis, lighting inconsistency checks, and static rule-based verification—fail to scale efficiently against modern deep synthesis techniques due to heavy compression assumptions, manual feature-engineering constraints, and computational latency. To address these challenges, this monograph presents the design and deployment of the Deepfake Forensic Suite, an automated Identity Mapping and Media Integrity Verification System. The proposed framework establishes a multi-layered security pipeline. First, it implements a high-precision biometric mapping and alignment phase utilizing Multi-task Cascaded Convolutional Networks (MTCNN) to isolate facial regions and eliminate environmental noise. Second, it leverages an optimized MobileNetV2 architecture to extract deep spatial features and compress complex visual attributes into a compact latent representation. By learning the structural characteristics of authentic human faces, the system computes principled prediction probability scores that naturally diverge when processing synthetic manipulations. Furthermore, a statistically robust tri-state classification strategy (Real, Fake, or Uncertain) is established based on validation-set confidence percentiles, enhancing forensic reliability by flagging borderline cases for manual administrative review. The performance of the system is evaluated against established baselines, including traditional Viola-Jones frameworks and shallow convolutional structures. Finally, the practical deployment-readiness of the system is demonstrated through model serialization, a real-time webcam inference API, and a reproducible, interactive web dashboard engineered entirely within the Streamlit framework. The resulting suite provides a lightweight, high-assurance digital forensics solution capable of edge-device execution without requiring slow, cloud-dependent infrastructure.
T. Manimala, P. Sravani, V. Rajitha et al.· EPRA international journal o...· 0 citations
Identity document (ID) authentication relies on the structural integrity of complex, high-frequency security patterns. However, advanced Generative AI models can now inject localized, high-fidelity manipulations, creating deceptive attacks that bypass standard verification. Training robust image forensic models to detect these anomalies is hindered by privacy regulations, forcing reliance on synthetic templates lacking the intricate visual patterns of real IDs. To bridge this domain gap, we introduce FakeIDet3-DB, the first comprehensive database of digital manipulations on real, government-issued IDs. FakeIDet3-DB encompasses classical (e.g., copy-move) and Generative AI-driven manipulations (e.g., face-swapping, inpainting) enhanced with advanced image refinement procedures to suppress visual artifacts. In addition, to comply with strict data protection regulations (e.g., GDPR), we adopt a recently-proposed framework based on patches. In order to maximize forensic utility, we formulate privacy-aware patch extraction from a real ID as a geometrically constrained image processing problem. We propose PACE, a Pseudo-Anonymized Contextual patch Extraction algorithm, which leverages Integral Image mapping and distance-driven Non-Maximum Suppression (NMS). PACE efficiently contours anonymization masks that prevent Personally Identifiable Information (PII) leakage while maximizing semantic density in peri-censorship regions, yielding almost 5.2M patches extracted from more than 6.4K images from real/fake IDs. Furthermore, an extensive evaluation of the proposed FakeIDet3-DB is performed using state-of-the-art models, showcasing they all struggle to detect and locate attacks coming from generative and classic techniques (32.45\% EER in detection and 83.48\% AUC-ROC in localization).
Muñoz-Haro Javier, Teruel Andres, Tolosana Ruben et al.· 0 citations
Purpose: The spread of deepfakes on platform X threatens the integrity of digital information, but previous research has applied Metadata Analysis, Error Level Analysis (ELA), and Reality Defender separately, not yet as an integrated approach. This study applied Metadata Analysis and ELA to identify manipulation in deepfake images, as well as evaluate the effectiveness of Reality Defender in detecting deepfake content in images circulating on platform X as an application case study.
Methods/Study design/approach: Using a descriptive qualitative approach with digital forensic experiment methods, seven purposive selected image samples representing seven content characteristic scenarios (original, face-swap, GAN, full generative AI, anti-forensics, conventionally edited, and platform compressed), analyzed through three layered stages with tiered final classification criteria based on the cross-validated Reality Defender score threshold with ELA.
Result/Findings: Metadata is only informative before uploading, as X deletes EXIF uniformly post-upload. ELA remained effective in both conditions, showing localized intensity anomalies (close to 240-255 from 255) across deepfake samples. Reality Defender correctly classified six of the seven samples (85.7% accuracy, 100% in the deepfake category, 66.7% in the original category), with one false positive (64%) in the original, conventionally edited image.
Novelty/Originality/Value: This study integrated all three methods simultaneously and layered with explicit criteria, showing Metadata lost post-upload diagnostic value while ELA and Reality Defender remained the most reliable for content sourced from platform X.
Kurnia Nur Hikmah, G. Muflih· Intechno Journal (Informatio...· 0 citations