AI 中文总结
针对Deepfake换脸威胁，提出SRAP方法结合逐通道截断SVD优化与身份重要性掩码，在CelebA-HQ等数据集上实现了防御性能与图像保真度的良好权衡。
AI 中文摘要
Deepfake技术对面部隐私和身份安全构成日益严重的威胁，推动了在面部图像被滥用前进行保护的主动防御技术。尽管通过投影梯度下降（PGD）生成的对抗扰动能够破坏换脸模型使用的身份表征，但其视觉质量受两个特征影响而下降：扰动广泛分布在图像各处，包括对身份不敏感的区域，且包含视觉上显著的高频分量。我们通过身份敏感性估计和PGD扰动的奇异值分解（SVD）分析了这些空间和频谱效率低下的问题。分析表明，后续奇异分量包含不成比例的大量高频能量，而主导分量保留了大部分扰动能量和防御效用。基于这些观察，我们提出了SRAP，该方法在每一步优化中结合了逐通道截断SVD优化与身份重要性掩码。SVD优化抑制了高阶高频残差，而掩码将扰动限制在对身份表征影响强烈的位置。在CelebA-HQ和VGGFace2-HQ上的实验表明，SRAP在所有报告的指标上大幅提升了受保护图像的保真度，同时保持了有竞争力的身份破坏性能，在换脸防御和视觉不可感知性之间取得了有利的权衡。
英文摘要
Deepfake technologies pose increasing threats to facial privacy and identity security, motivating proactive defenses that protect facial images before misuse. Although adversarial perturbations generated by projected gradient descent (PGD) can disrupt the identity representations used by face-swapping models, their visual quality is degraded by two characteristics: perturbations are distributed broadly over the image, including identity-insensitive regions, and they contain visually salient high-frequency components. We analyze these spatial and spectral inefficiencies through identity-sensitivity estimation and the singular-value decomposition (SVD) of PGD perturbations. Our analysis shows that later singular components contain a disproportionate amount of high-frequency energy, while the leading components preserve most of the perturbation energy and defense utility. Based on these observations, we propose SRAP, which combines per-channel truncated SVD refinement with an identity-importance mask at every optimization step. The SVD refinement suppresses high-rank, high-frequency residuals, while the mask restricts perturbations to locations that strongly influence identity representations. Experiments on CelebA-HQ and VGGFace2-HQ demonstrate that SRAP substantially improves protected-image fidelity across all reported metrics while maintaining competitive identity-disruption performance, yielding a favorable trade-off between face-swap defense and visual imperceptibility.
Comments13 pages, 8 figures
