Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Robust Safeguard for Evading Deep Facial Manipulation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ARS, a learning-based two-way protection network that generates robust adversarial noise against facial manipulation models in a single forward pass, trained with a differentiable perturbation module and an adversarial network.
Problem
Proactive adversarial-noise protection of facial images against deep facial manipulation is fragile to simple perturbations (e.g., blur, resize, JPEG) and optimization-based methods are too slow to scale.
Approach
A feed-forward U-Net generates input-specific noise in two branches: a basic protection branch and a robust branch that fuses image features with spatially repeated noise embeddings for redundancy, trained end-to-end against a differentiable perturbation module and an adversarial network that tries to erase the protection.
Key results
- Under the highest-level perturbations on pSp-mix, ARS reaches a success rate of 0.96 versus 0.86 for Disrupt and 0.64 for TAFIM (eps=0.3, averaged over perturbations).
- On JPEG compression against pSp-mix, ARS achieves SR 1.0000 with MSE 0.6911, while TAFIM reaches MSE 0.2899.
- ARS inference takes 0.46 s per image, matching TAFIM and far faster than PGD (2.79 s) and Disrupt (2.84 s).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add Robust Protection, Perturbation Module, and Adv Net to Basic (ablation) | ARS · pSp-mix with randomly selected perturbations and levels | SR: 0.8741 -> 0.9600 | Helped |
| add Robust Protection while retaining the Perturbation Module and Adv Net (ablation) | Basic · pSp-mix with randomly selected perturbations and levels | MSE: 0.2221 -> 0.6304 | Helped |
| remove the Perturbation Module and Adv Net (ablation) | ARS · pSp-mix with randomly selected perturbations and levels | SR: 0.9600 -> 0.8930 | Hurt |
| add the Perturbation Module (ablation) | non-lossy ARS · pSp-mix with randomly selected perturbations and levels | SR: 0.8930 -> 0.9290 | Helped |
| add Adv Net and adversarial training (ablation) | ARS w/o Adv · pSp-mix with randomly selected perturbations and levels | SR: 0.9290 -> 0.9600 | Helped |
| use ARS instead of Disrupt against Gaussian blur | pSp-mix protection · Gaussian Blur, highest level | SR: 0.4633 -> 0.8040 | Helped |
| use ARS instead of TAFIM against downscaling | pSp-mix protection · Down Scale, highest level | SR: 0.5160 -> 0.9590 | Helped |
| use ARS instead of TAFIM against color saturation | pSp-mix protection · Color Saturation, highest level | SR: 0.7850 -> 0.9960 | Helped |
| add Adv Net and adversarial training (ablation) | ARS w/o Adv · pSp-mix with randomly selected perturbations and levels | MSE: 0.6145 -> 0.5035 | Hurt |
Surprising findings
- Without perturbations, the learned ARS protection at eps=0.1 is weaker than PGD and Disrupt in some settings, and the non-lossy variant has higher MSE/PSNR but lower success rate than the full model.
- Gaussian blur was the most damaging perturbation for protection methods in the robustness evaluation.
Limitations
- Epsilon must be raised to 0.3 to achieve robust protection, which visibly degrades image quality.
- Robustness is evaluated only against a fixed set of six perturbation types at five levels, not adaptive attacks.
- Evaluation is limited to four manipulation methods on specific datasets.
Experimental setup
Datasets: FFHQ VGGFace2
Benchmarks: FFHQ test split VGGFace2 custom test subset
Metrics: MSE PSNR LPIPS SSIM Success Rate Masked Success Rate
Baselines: FGSM PGD Disrupt TAFIM
Builds on: TAFIM Disrupt FGSM PGD U-Net
Closest papers by meaning
- BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing (NeurIPS 2025 · similarity 0.87)
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.87)
- Transferable Facial Privacy Protection against Blind Face Restoration via Domain-Consistent Adversarial Obfuscation (ICML 2024 · similarity 0.86)
- AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption (ICLR 2025 · similarity 0.86)
- DataFreeShield: Defending Adversarial Attacks without Training Data (ICML 2024 · similarity 0.85)
- Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.