Skip to content
Log in

Phantom: A Unified Face-Swap Deepfake Protection Framework with Latent and Spatial Constraints

Jungkon Kim Cheol-Oh Jung Jong-Min Choi Juseong Lee
Jun 2026 · arXiv.org · Vol abs/2606.31703 · 0 citations · 34 references
Computer Science

TL;DR

Phantom is presented, a unified face-swap deepfake protection framework that jointly constrains perturbations in latent and spatial domains that generalizes to impersonation scenario, yielding up to 10.2% higher protection while improving perceptual fidelity.

Abstract

Face-swapping deepfakes pose an escalating threat to personal privacy by enabling unauthorized identity manipulation. While adversarial approaches have demonstrated success against black-box face recognition (FR) models, their applicability to face-swapping scenarios remains underexplored. In particular, reliance on fixed or random targets yields ambiguous latent guidance, and the lack of explicit spatial constraints causes perturbations to spill into identity-irrelevant regions. These issues are further exacerbated by identity-style disentanglement, which suppresses adversarial signals during deepfake generation. In this paper, we present Phantom, a unified face-swap deepfake protection framework that jointly constrains perturbations in latent and spatial domains. Phantom adaptively synthesizes identity-shifted yet attribute-preserving targets to guide identity-aware latent optimization, and applies masked perturbations confined to semantically relevant facial regions. Extensive experiments on state-of-the-art face-swapping deepfakes demonstrate that Phantom improves protection success rates in dodging scenarios by 27.8%, 25.6%, and 16.6% on UniFace, INSwapper, and SimSwap, respectively, while also enhancing visual quality. Furthermore, Phantom generalizes to impersonation scenario, yielding up to 10.2% higher protection while improving perceptual fidelity. These results underscore the effectiveness of jointly leveraging latent and spatial constraints for robust and coherent facial privacy protection.

DOI arXiv Semantic Scholar
View source

Similar papers

Preprint Aug 2026

SRAP: SVD-Refined Adversarial Perturbations for Imperceptible Face-Swap Defense

This work proposes SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step, and demonstrates that SRAP substantially improves protected-image fidelity across all reported metrics while maintaining competitive identity-disruption performance.

Sung-Won Cho, Kwanghyun Ko, Myungjoo Kang · 0 citations
Preprint Aug 2026

Toward Interpretable Privacy Guarantees in Face-Swapping Anonymization

A linear stochastic model is proposed that treats face-swappers as transformations on the space of identity embeddings, providing an interpretable account of the leakage mechanism, thus making formal privacy guarantees explainable -- and perfectible -- rather than purely observational.

Vishnu Bondalakunta, Arman Zareian Jahromi, Shuangqing Wei et al. · 0 citations

Robust, Generalizable Proactive Face-Swapping Defense via Semantic Gradient Divergence

This work proposes a robust, generalizable proactive face-swapping defense via semantic gradient divergence (SGD-Guard), and introduces an integrated feature gallery that uses CLIP features and a generalized identity feature, obtained by iteratively refining heterogeneous identity features into a homogeneous representation.

Do Seung-hyeok Back, Hyun Ki, Juwan Kim et al. · 0 citations
Aug 2026

FDT-PC: Enhancing Adversarial Transferability through Frequency Domain Transformation and Perceptual Constraints

FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures, is proposed, which achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods.

Bo Li, Li Tang, Xin Jin et al. · 0 citations
Open access Aug 2026

Perspective-Invariant Attack With Enhanced Transferability of Adversarial Examples

Adversarial examples generated on a surrogate deep neural network (DNN) can often successfully fool other black-box DNN models. This cross-model transferability poses serious security threats to DNNs in practical applications. Input transformation techniques are widely used to enhance adversarial transferability by increasing the diversity of input images. However, existing methods primarily rely on local operations with limited degrees of freedom (DOF), such as block-wise shuffling and resizing, overlooking global perspective transformations that naturally arise from viewpoint changes. In this work, we propose a Perspective-Invariant Attack (PIA), which introduces a multi-DOF vertex sampling strategy that systematically covers the perspective transformation hierarchy from 2-DOF translation to 8-DOF projective mapping. By generating geometrically diverse input variations, PIA effectively reduces overfitting of adversarial perturbations to the surrogate model, thereby improving adversarial transferability. We further propose PIA-Mix, a generic extension that maintains a complementary transformation pool and efficiently combines our perspective transformation with auxiliary methods for improved transferability. Extensive experiments involving various DNN architectures, advanced defense mechanisms, and multimodal large language models (LLMs) demonstrate that PIA and PIA-Mix outperform state-of-the-art transfer-based attacks.

Kaisheng Liang, Yiming Cao, Bin Xiao · 0 citations