Towards Robust Protective Perturbation against DeepFake Face Swapping

TL;DR

This paper introduces a novel reinforcement learning-based framework called EOLT that learns to generate robust protective perturbations against DeepFake face swapping, significantly improving defense robustness over existing methods.

Contribution

The paper proposes EOLT, a learnable transformation distribution framework that adaptively generates instance-specific perturbations for improved DeepFake defense robustness.

Findings

26% higher average robustness compared to state-of-the-art

Up to 30% gains on challenging transformations

EOLT outperforms traditional EOT in robustness and transferability

Abstract

DeepFake face swapping enables highly realistic identity forgeries, posing serious privacy and security risks. A common defence embeds invisible perturbations into images, but these are fragile and often destroyed by basic transformations such as compression or resizing. In this paper, we first conduct a systematic analysis of 30 transformations across six categories and show that protection robustness is highly sensitive to the choice of training transformations, making the standard Expectation over Transformation (EOT) with uniform sampling fundamentally suboptimal. Motivated by this, we propose Expectation Over Learned distribution of Transformation (EOLT), the framework to treat transformation distribution as a learnable component rather than a fixed design choice. Specifically, EOLT employs a policy network that learns to automatically prioritize critical transformations and adaptively generate instance-specific perturbations via reinforcement learning, enabling explicit modeling of defensive bottlenecks while maintaining broad transferability. Extensive experiments demonstrate that our method achieves substantial improvements over state-of-the-art approaches, with 26% higher average robustness and up to 30% gains on challenging transformation categories.