Deepfake face swapping active defense method based on face identity feature level perturbation

Abstract

This invention provides an active defense method against deepfake face-swapping based on facial identity feature-level perturbation, belonging to the fields of artificial intelligence, digital image processing, and network information security. The method includes: (1) source face image acquisition and preprocessing; (2) facial identity feature extraction; (3) identity feature perturbation generation; (4) protection image reconstruction based on perturbed identity features; (5) adversarial optimization and joint training strategy; and (6) protection face image output and application. This invention, by performing targeted perturbation on facial identity features and reconstructing protection images, weakens the ability of deepfake face-swapping models to extract and utilize source identity features from the root, while ensuring the visual naturalness and consistency of face images. This achieves proactive defense against deepfake face-swapping behavior, solving the core problems of insufficient defense effectiveness, poor robustness in black-box scenarios, and difficulty in balancing defense effect and visual perception in existing technologies.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence, digital image processing and network information security, and in particular to an active defense method for deepfake deepfakes based on facial identity feature-level perturbations. Background Technology

[0002] With the rapid development of generative artificial intelligence technology, deepfake technology, represented by face swapping, has been widely used. This technology has been used by criminals for malicious acts such as online fraud, identity impersonation, public opinion manipulation, and bypassing identity authentication systems, posing a serious threat to personal privacy protection and public safety. Relevant regulatory authorities have issued management regulations, which clearly require technical control and risk prevention of deepfake content.

[0003] Existing research on deepfake technology mainly focuses on post-event detection and tracing. It can only identify the authenticity of forged images and videos and locate the forged areas after they are generated and disseminated. It cannot prevent the generation process of deepfakes in advance and lacks proactive protection capabilities in the judicial evidence collection and liability determination stages.

[0004] To compensate for the shortcomings of post-detection methods, the industry has proposed proactive defense methods. Most existing solutions interfere with deepfake models by introducing minute perturbations into the pixel space. However, modern mainstream face-swapping systems generally employ robust facial identity feature extraction modules, which can map faces to a high-dimensional identity feature space and then inject the identity features into the generator network to complete the face swap. These identity feature extraction modules have extremely strong anti-interference capabilities against pixel-level perturbations, causing the defense effect of existing pixel perturbation methods to be largely negated at the identity feature extraction stage, making it difficult to effectively block the spread and abuse of the source identity.

[0005] In summary, existing technologies still lack a proactive defense method for deepfake face-swapping that can directly intervene in facial identity features, has stable defense capabilities in black-box face-swapping scenarios, and does not significantly affect human visual perception. Summary of the Invention

[0006] This invention provides an active defense method against deepfake face-swapping based on facial identity feature-level perturbation. By performing targeted perturbation on facial identity features and reconstructing the protected image, the method weakens the ability of deepfake face-swapping models to extract and utilize source identity features at the source, while ensuring the visual naturalness and consistency of the facial image. This achieves proactive defense against deepfake face-swapping behavior and solves the core problems of insufficient defense effectiveness, poor robustness in black-box scenarios, and difficulty in balancing defense effect and visual perception in existing technologies.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] Active defense methods against deepfake face-swapping based on facial identity feature-level perturbations include:

[0009] (1) Obtain the source face image to be protected, and perform face detection, key point localization, face alignment and standardized cropping on the source face image to obtain a standardized face image;

[0010] (2) Input the standardized face image into the pre-trained face identity feature extraction network with parameters frozen throughout, and extract the high-dimensional identity feature vector of the corresponding source face;

[0011] (3) Input the high-dimensional identity feature vector into the preset feature perturbation module, perform nonlinear directional transformation on the high-dimensional identity feature vector, and generate a perturbation identity feature vector that deviates from the high-dimensional identity feature vector in the feature space;

[0012] (4) Input the standardized face image into the encoding branch of the preset image reconstruction module to complete the deep feature encoding of the image and obtain the face image encoding features;

[0013] (5) Input the perturbation identity feature vector and the face image coding feature into the fusion decoding branch of the image reconstruction module, and complete the perturbation identity feature fusion and image decoding processing in sequence to reconstruct the protected face image;

[0014] (6) Use protected facial images to replace the original source facial images for storage, publication and dissemination, so as to achieve proactive defense against deepfake face-swapping attacks.

[0015] In this specification, in step (1), after completing the localization of facial key points, the source face image is rigidly aligned based on the facial key points to eliminate the interference caused by differences in face pose and scale. Then, standardized cropping is completed according to the preset fixed size to obtain a standardized face image whose size matches the input requirements of the face identity feature extraction network and the image reconstruction module.

[0016] In this specification, in step (2), the pre-trained face identity feature extraction network with its parameters frozen throughout the process is trained using a backbone network architecture and pre-training dataset that is the same as that of the deepfake face-swapping model. After training, all network parameters are fixed throughout the process and are only used for the extraction of high-dimensional identity feature vectors. They do not participate in the parameter updates of the feature perturbation module and the image reconstruction module.

[0017] In this specification, in step (3), the feature perturbation module takes the destruction of the identity transferability of the high-dimensional identity feature vector in the face-swapping scenario as the core objective when performing nonlinear directional transformation. At the same time, it imposes an upper limit constraint on the perturbation amplitude generated by the transformation to avoid excessive perturbation that would cause visual distortion in the subsequently reconstructed protective face image.

[0018] In this specification, the feature perturbation module in step (3) adopts a nonlinear transformation network with residual structure. When performing directional transformation on the high-dimensional identity feature vector, the nonlinear transformation network with residual structure retains the basic feature components of the original high-dimensional identity feature vector and only performs directional perturbation on the feature components that represent the uniqueness of identity. This ensures the effectiveness of the perturbation while reducing the degree of visual distortion of the protected face image.

[0019] In this specification, the feature perturbation module and the image reconstruction module are pre-trained by joint training. During the training process, all parameters of the face identity feature extraction network are fixed, and the weighted sum of the multi-dimensional loss function is used as the optimization objective to complete the parameter iterative update of the two modules.

[0020] In this specification, the multidimensional loss function includes at least the defense effect loss, the visual consistency loss, and the perturbation amplitude constraint loss; wherein the defense effect loss is used to constrain the degree of deviation between the perturbation identity feature vector and the original high-dimensional identity feature vector in the feature space, the visual consistency loss is used to constrain the visual appearance difference between the protected face image and the standardized face image, and the perturbation amplitude constraint loss is used to limit the upper limit of the amplitude of feature perturbation.

[0021] In this manual, before performing step (3), the perturbation intensity weight of the feature perturbation module is preset according to the protection level requirements of the target application scenario. The dynamic balance between defense strength and visual consistency is achieved by adjusting the weight, so as to adapt to the protection requirements of different scenarios.

[0022] In this specification, in step (5), when the image reconstruction module's fusion decoding branch performs perturbation identity feature fusion, it performs channel-by-channel feature fusion of the face image encoding features and the perturbation identity feature vector, embeds the perturbation identity information into the image features, and then restores the protected face image with the same visual appearance as the standardized face image obtained in step (1) through decoding processing.

[0023] In this specification, when a protective face image is input into a deepfake face-swapping model, the identity feature extraction stage of the face-swapping model cannot extract effective source identity features from the protective face image, resulting in the source identity information in the final face-swapping result being weakened or completely invalidated, thus fundamentally blocking the spread and abuse of deepfake face-swapping identities.

[0024] In summary, the present invention has at least the following beneficial effects:

[0025] The effectiveness of the defense is fundamentally improved. This invention directly intervenes in the core link of deepfake face-swapping technology—facial identity feature extraction and utilization. It destroys the identifiability and transferability of the source identity at the identity feature space level, blocking the identity propagation in the face-swapping process from the root. It avoids the core defect of existing pixel-level perturbation methods being offset by the robust feature extraction module of the face-swapping model, making the defense effect more fundamental and stable.

[0026] The invention exhibits excellent scenario adaptability and black-box robustness. Its defense scheme does not rely on prior information such as the structure and parameters of a specific face-swapping model, nor does it require knowledge of the technical details of the target face-swapping system. It maintains stable defense performance even under strict black-box scenarios and is adaptable to real-world applications such as commercial identity verification systems, demonstrating strong practical application value.

[0027] This invention achieves a good balance between defensive performance and visual perception. Through joint optimization of learnable perturbation amplitude constraints and multi-dimensional loss functions, it can achieve high-strength identity protection while ensuring that the generated protected facial image is highly consistent with the original image in terms of visual appearance and naturalness, with no obvious visual distortion, and does not affect the normal viewing, dissemination, and compliant use of the facial image.

[0028] The technical solution possesses excellent scalability and applicability. The core module of this invention can flexibly adapt to mainstream face image processing workflows, with clear boundaries between each functional module. It can be deployed based on existing mainstream deep learning frameworks, and can flexibly adjust the balance weight between perturbation intensity and visual consistency according to the protection requirements of actual application scenarios to adapt to different protection levels. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram illustrating the framework of the deepfake deepfake / face-swapping proactive defense method based on facial identity feature-level perturbation involved in this invention. This represents the identity feature vector of the source face. This represents the identity feature vector after perturbation. This represents the identity feature vector of the generated protected image. Detailed Implementation

[0031] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the embodiments of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0032] The following disclosure provides many different implementations or examples for carrying out different structures of the embodiments of the present invention. To simplify the disclosure of the embodiments of the present invention, specific examples of components and arrangements are described below. Of course, these are merely examples and are not intended to limit the embodiments of the present invention. Furthermore, reference numerals and / or reference letters may be repeated in different examples of the embodiments of the present invention; such repetition is for simplification and clarity and does not in itself indicate a relationship between the various implementations and / or arrangements discussed.

[0033] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0034] like Figure 1 As shown, this embodiment provides an active defense method against deepfake face-swapping based on facial identity feature-level perturbations, including:

[0035] (1) Obtain the source face image to be protected, and perform face detection, key point localization, face alignment and standardized cropping on the source face image to obtain a standardized face image;

[0036] (2) Input the standardized face image into the pre-trained face identity feature extraction network with parameters frozen throughout, and extract the high-dimensional identity feature vector of the corresponding source face;

[0037] (3) Input the high-dimensional identity feature vector into the preset feature perturbation module, perform nonlinear directional transformation on the high-dimensional identity feature vector, and generate a perturbation identity feature vector that deviates from the high-dimensional identity feature vector in the feature space;

[0038] (4) Input the standardized face image into the encoding branch of the preset image reconstruction module to complete the deep feature encoding of the image and obtain the face image encoding features;

[0039] (5) Input the perturbation identity feature vector and the face image coding feature into the fusion decoding branch of the image reconstruction module, and complete the perturbation identity feature fusion and image decoding processing in sequence to reconstruct the protected face image;

[0040] (6) Use protected facial images to replace the original source facial images for storage, publication and dissemination, so as to achieve proactive defense against deepfake face-swapping attacks.

[0041] In some embodiments, in step (1), after completing the localization of facial key points, the source face image is rigidly aligned based on the facial key points to eliminate interference caused by differences in face pose and scale. Then, standardized cropping is performed according to a preset fixed size to obtain a standardized face image whose size matches the input requirements of the face identity feature extraction network and the image reconstruction module.

[0042] In some embodiments, in step (2), the pre-trained and parameter-frozen face identity feature extraction network is trained using a backbone network architecture and pre-training dataset that is the same as that of the deepfake face-swapping model. After training, all network parameters are fixed throughout the process and are only used for the extraction of high-dimensional identity feature vectors. They do not participate in the parameter updates of the feature perturbation module and the image reconstruction module.

[0043] In some embodiments, in step (3), when the feature perturbation module performs nonlinear directional transformation, the core objective is to destroy the identity transferability of the high-dimensional identity feature vector in the face-swapping scenario. At the same time, an upper limit constraint is imposed on the perturbation amplitude generated by the transformation to avoid excessive perturbation that would cause visual distortion in the subsequently reconstructed protective face image.

[0044] In some embodiments, the feature perturbation module in step (3) adopts a nonlinear transformation network with residual structure. When performing directional transformation on the high-dimensional identity feature vector, the nonlinear transformation network with residual structure retains the basic feature components of the original high-dimensional identity feature vector and only performs directional perturbation on the feature components that represent the uniqueness of identity, thereby reducing the degree of visual distortion of the protected face image while ensuring the effectiveness of the perturbation.

[0045] In some embodiments, the feature perturbation module and the image reconstruction module are pre-trained by joint training. During the training process, all parameters of the face identity feature extraction network are fixed, and the weighted sum of the multi-dimensional loss function is used as the optimization objective to complete the parameter iterative update of the two modules.

[0046] In some embodiments, the multidimensional loss function includes at least a defense effect loss, a visual consistency loss, and a perturbation amplitude constraint loss; wherein the defense effect loss is used to constrain the degree of deviation between the perturbation identity feature vector and the original high-dimensional identity feature vector in the feature space, the visual consistency loss is used to constrain the visual appearance difference between the protected face image and the standardized face image, and the perturbation amplitude constraint loss is used to limit the upper limit of the amplitude of feature perturbation.

[0047] In some embodiments, before performing step (3), the perturbation intensity weight of the feature perturbation module is preset according to the protection level requirements of the target application scenario. The dynamic balance between defense strength and visual consistency is achieved by adjusting the weight, so as to adapt to the protection requirements of different scenarios.

[0048] In some embodiments, in step (5), when the image reconstruction module's fusion decoding branch performs per-channel feature fusion of the face image encoding features and the perturbed identity feature vector, the perturbed identity information is embedded in the image features, and then the protected face image is restored through decoding to be consistent with the visual appearance of the standardized face image obtained in step (1).

[0049] In some embodiments, when a protective face image is input into a deepfake face-swapping model, the identity feature extraction stage of the face-swapping model cannot extract effective source identity features from the protective face image, resulting in the source identity information in the final face-swapping result being weakened or completely invalidated, thus blocking the spread and abuse of deepfake face-swapping identity from the root.

[0050] In some embodiments, the face identity feature extraction network adopts the ArcFace backbone network architecture, specifically using ResNet50 as the feature extraction backbone, and is pre-trained with the ArcFace loss function. The pre-training dataset uses the publicly available large-scale face dataset MS1M-ArcFace. After pre-training, all parameters of all convolutional layers and fully connected layers in the network are fixed, and only a high-dimensional identity feature vector with a dimension of 512 is output. The high-dimensional identity feature vector is completely aligned with the identity feature space used by mainstream deepfake face-swapping models, ensuring that perturbation operations can be directly applied to the core identity feature dimension on which the face-swapping model depends.

[0051] In some embodiments, the face identity feature extraction network adopts a backbone architecture that is the same as that of mainstream face-swapping models in the target defense scenario. When defending against mainstream face-swapping models such as SimSwap and InfoSwap, it adopts ArcFace pre-trained weights and network structure that are completely consistent with these face-swapping models. This ensures that the extracted high-dimensional identity feature vector and the feature vector output by the face-swapping model's identity extraction stage are in the same feature space, further improving the effectiveness of feature perturbation defense and avoiding the attenuation of perturbation effect due to feature space mismatch.

[0052] In some embodiments, the face identity feature extraction network can be any publicly pre-trained face feature extraction architecture among FaceNet, VGGFace, and SFace, and output high-dimensional identity feature vectors of different dimensions such as 128-dimensional, 512-dimensional, and 1024-dimensional. The feature perturbation module can adaptively adjust the input and output dimensions of the fully connected layer according to the output dimension of the selected identity feature extraction network to adapt to different identity feature space dimension requirements.

[0053] In some embodiments, the image reconstruction module adopts a U-Net-type encoding and decoding architecture, wherein the encoding branch is a downsampling encoding path, the decoding branch is an upsampling decoding path with skip connections, and the perturbation identity feature vector is fused at the deepest feature of the encoding branch and then input into the decoding branch to complete image reconstruction.

[0054] In some embodiments, the encoding branch of the image reconstruction module adopts a 4-level downsampling path consisting of an 8-layer convolutional structure. Each downsampling unit contains 2 convolutional layers with a kernel size of 3×3, a stride of 1, and padding of 1. At the end of each downsampling unit, a 2×2 convolutional layer with a stride of 2 is used to complete the feature map size downsampling. The first downsampling unit has 3 input channels, corresponding to the RGB three channels of a standardized face image, and 64 output channels. The number of output channels of each subsequent downsampling unit doubles at each level, becoming 128, 256, and 512 respectively. Finally, after the 4th level of downsampling, the output is a face image encoding feature with a size of 16×16 and 512 channels.

[0055] In some embodiments, the fusion decoding branch of the image reconstruction module first maps the perturbation identity feature vector through a fully connected layer to a feature map that matches the dimension of the face image encoded features output by the encoding branch. The mapped feature map has a size of 16×16 and 512 channels. The mapped perturbation identity feature map and the face image encoded features are then fused channel by channel to obtain the fused features. The decoding branch adopts a 4-level upsampling path symmetrical to the encoding branch. Each upsampling unit first completes the feature extraction through a 2×2 transposed convolutional layer with a stride of 2. Image size is upsampled, and then spliced ​​with the feature maps of the corresponding level of the encoding branch through skip connections. After splicing, feature refinement is completed through two 3×3 convolutional layers. The number of output channels of each upsampling unit is halved at each level, namely 256, 128, and 64 respectively. Finally, a 1×1 convolutional layer maps the number of channels to 3, outputting a 256×256 protected face image. All convolutional layers are followed by InstanceNorm normalization layers and LeakyReLU activation functions to ensure the stability and convergence efficiency of feature learning.

[0056] In some embodiments, the image reconstruction module uses the backbone architecture of the StyleGAN2 generator as the encoding and decoding basis. The encoding branch uses the encoding segments of the mapping network and the synthesis network to map the standardized face image into deep image features and style parameters. The perturbation identity feature vector is injected into multiple style modulation layers of the synthesis network. The perturbation identity information is embedded into the image features at different levels through style modulation. The decoding branch, based on the style parameters and image features with embedded perturbation information, completes the reconstruction of the protected face image through the synthesis network with progressive upsampling. This architecture can further improve the visual naturalness of the protected face image and reduce reconstruction distortion.

[0057] In some embodiments, to meet the lightweight requirements of edge deployment, the encoding and decoding branches of the image reconstruction module use depthwise separable convolutions instead of standard convolutions, with a core convolution kernel size of 3×3; the encoding branch is set with 3 levels of downsampling, the total number of convolutional layers is controlled within 12 layers, and the maximum number of channels is limited to 256; the decoding branch adopts a symmetrical 3-level upsampling structure, which significantly reduces the number of network parameters and computational load while ensuring the defense effect and visual consistency, and adapts to the real-time processing requirements of mobile terminals and edge devices.

[0058] In some embodiments, a dual-domain decoupled model is pre-built for the facial identity feature space, decoupling the high-dimensional identity feature vector into a core component for identity transferability and a component for individual uniqueness verification. The core component for identity transferability is the feature dimension that deepfake face-swapping models rely on for identity injection and cross-subject identity transfer. It is composed of the top 30% of feature dimensions that contribute to the identity similarity after face-swapping by performing gradient attribution analysis on the identity injection mechanism of mainstream face-swapping models. The component for individual uniqueness verification is the feature dimension that commercial face verification systems rely on for identity matching but that face-swapping models cannot use for identity transfer. It is composed of the remaining feature dimensions. The feature perturbation module performs directional nonlinear perturbation only on the core component for identity transferability and zero perturbation preservation processing on the component for individual uniqueness verification. At the same time, in the decoding branch of the image reconstruction module, the original component for individual uniqueness verification is embedded into the high-frequency component of the blue channel of the protected face image by least significant bit steganography. This embodiment breaks through the technical bias in the field that "defense strength and legal verification pass rate are inherently opposed". By precisely targeting and destroying the core dependent dimensions of the face-swapping model, it fully retains the identity features required for legal verification. It does not weaken the defense effect and solves the industry pain point that the protected image cannot be used for normal identity verification. It is a differentiated technical path that is difficult for those skilled in the art to think of based on existing technology.

[0059] In some embodiments, during the joint training phase of the feature perturbation module and the image reconstruction module, a differentiable face-swapping preprocessing simulation branch and a perturbation-inseparable constraint loss are introduced. The differentiable face-swapping preprocessing simulation branch incorporates differentiable implementations of common face preprocessing operations used in mainstream face-swapping models, including at least two of random rigid transformation, random scaling of illumination intensity, Gaussian blur, JPEG compression, random noise addition, and white balance adjustment. During the forward propagation of each training round, the protected face image output by the image reconstruction module is first subjected to randomly combined preprocessing operations through the preprocessing simulation branch, and then the preprocessed image is input into the frozen face identity feature extraction network to extract the preprocessed identity feature vector. The perturbation-inseparable constraint loss is used to constrain the cosine similarity between the preprocessed identity feature vector and the original high-dimensional identity feature vector, ensuring that it is no higher than the cosine similarity between the perturbation identity feature vector and the original high-dimensional identity feature vector. The loss expression is:

[0060] ;

[0061] in, For the pre-processed protected face image, For frozen identity feature extraction network, For the original standardized face image, To perturb the identity feature vector, The preset relaxation threshold ranges from 0.05 to 0.1; the non-removable constraint loss due to perturbation is added to the total loss function, with the corresponding weight coefficient set to 0.2-0.5. This embodiment addresses the commonly overlooked core vulnerability of "preprocessing in face-swapping models negating perturbation effects." It abandons the conventional, degraded path of "increasing the perturbation amplitude to counteract preprocessing," directly embedding the face-swapping preprocessing stage into the training loop. This allows the perturbation effect to resist filtering and stripping by various conventional preprocessing operations. Even if the face-swapping model performs multiple preprocessing steps, it still cannot extract effective transferable identity features. Furthermore, it eliminates the need to increase the original perturbation amplitude, perfectly balancing black-box defense robustness and visual consistency.

[0062] In some embodiments, to defend against attackers' perturbation-based reverse engineering attacks and de-perturbation model cracking based on data fitting, the feature perturbation module incorporates a dynamic random perturbation anchoring mechanism. During the inference phase, random latent variables conforming to a standard normal distribution are first generated. These random latent variables are then concatenated with a high-dimensional identity feature vector and input into a nonlinear transformation network to generate a perturbation vector. During the joint training phase, a dynamic sampling method for random latent variables is adopted. In each training round, different random latent variables are sampled for the same face image to generate differentiated perturbation vectors. Simultaneously, perturbation distribution diffusion loss and reverse defense loss are introduced into the total loss function. The perturbation distribution diffusion loss is used to constrain the same identity and the same face image under different random latent variables. Multiple perturbation feature vectors generated under the variable are uniformly diffusely distributed in the feature space. The cosine similarity between any two perturbation feature vectors is no higher than 0.3, preventing attackers from fitting a fixed perturbation mapping relationship through multiple sets of samples. The reverse defense loss is implemented through a built-in updatable deperturbation simulation network. The deperturbation simulation network is adversarially trained with the feature perturbation module and the image reconstruction module. It uses the protected face image as input and the original standardized face image as the optimization target for fitting. The reverse defense loss is used to constrain the identity features of the output image of the deperturbation simulation network. The cosine similarity with the original high-dimensional identity feature vector is still no higher than 0.5, preventing the deperturbation network from converging to effectively recover the identity features. This embodiment overcomes the inherent defects of existing fixed mapping defense schemes, abandons the conventional design idea of ​​"fixed input-fixed output", achieves the dynamic perturbation effect of "same image, different perturbations" through random latent variables, and avoids the perturbation pattern being fitted by the data through distributed diffuse loss. Furthermore, adversarial training pre-immunizes the deperturbation reverse attack, fundamentally improving the anti-cracking capability of the defense scheme.

[0063] In some embodiments, for proactive defense scenarios involving face videos, a temporal consistency constraint branch is added to the feature perturbation module, and inter-frame collaborative perturbation loss is introduced during the joint training phase. For the input continuous face video frame sequence, each frame is preprocessed to obtain a standardized face image sequence, and then a frozen face identity feature extraction network is used to extract the high-dimensional identity feature vector sequence corresponding to each frame. The feature perturbation module performs directional perturbation on the high-dimensional identity feature vector of the first frame in the sequence, generating a baseline perturbation identity feature vector and a corresponding baseline perturbation offset. For the high-dimensional identity feature vectors of subsequent frames in the sequence, adaptive fine-tuning is performed based only on the baseline perturbation offset of the first frame, combined with the feature component offsets caused by inter-frame face pose and expression changes, to generate... A continuous perturbation sequence of identity feature vectors with consistent perturbation direction and balanced perturbation amplitude is used to avoid random jumps in perturbation direction caused by independent perturbation frame by frame. During the training phase, the inter-frame cooperative perturbation loss includes two parts: first, the L2 norm constraint of the inter-frame perturbation offset, which constrains the difference in perturbation offset between adjacent frames to not exceed a preset threshold; second, the consistency constraint of the deviation of inter-frame identity features, which constrains the difference in cosine similarity between the perturbed identity features and the original identity features between adjacent frames to not exceed 0.08. At the same time, in the fusion decoding branch of the image reconstruction module, the optical flow features of adjacent frames are introduced as auxiliary inputs. The pixel displacements between frames are aligned based on the optical flow features to ensure the inter-frame continuity of the reconstructed protective video frames in non-face areas and background areas, and to eliminate temporal flicker. This embodiment addresses the core shortcomings of directly transferring single-frame solutions to video scenes. It abandons the conventional approach of processing each frame independently and instead places temporal constraints at the beginning of the identity feature perturbation stage. By using the perturbation of the first frame as a benchmark, it achieves coordinated consistency of perturbations between frames. This not only ensures the stability of identity perturbation effects in consecutive frames and prevents face-swapping models from recovering effective identity information through multi-frame feature fusion, but also ensures the visual continuity between video frames through optical flow alignment, forming a combined design of "feature space temporal perturbation coordination + image space optical flow alignment".

[0064] In some embodiments, to improve the robustness of defense in extreme black-box scenarios (where the identity feature extraction network of the face-swapping model is completely unknown and has no homology with the backbone used for training), a multi-backbone cross-space identity feature alignment system is pre-constructed. During the training phase, multiple heterogeneous face identity feature extraction networks with parameters frozen throughout the process are used to form a multi-source feature extraction cluster. The multi-source feature extraction cluster includes at least pre-trained models based on convolutional neural network architectures such as ArcFace and VGGFace, FaceViT based on Transformer architecture, and MobileFaceNet based on lightweight architecture. During the forward propagation process of training, for the same standardized face image, multiple sets of high-dimensional identity feature vectors corresponding to different feature spaces are extracted through each feature extraction network in the cluster. The feature perturbation module synchronously generates a feature vector vector corresponding to each feature space. The image reconstruction module reconstructs the protected face image based on the original image and the perturbed identity feature vectors of the backbone network. Then, it inputs the protected face image into all networks of the multi-source feature extraction cluster to extract multiple sets of protected identity feature vectors. A cross-space general defense loss is added to the total loss function. This loss constrains the cosine similarity between all protected identity feature vectors and their corresponding original high-dimensional identity feature vectors to be below a preset threshold, while also constraining the difference in identity deviation across different feature spaces to no more than 0.1. Through this training mechanism, the protected face image generated by the image reconstruction module can achieve stable identity feature destruction effects in different architectures, training sets, and face identity feature spaces of different dimensions, rather than being effective only for a single training backbone network. This embodiment overcomes the core limitations of existing feature-level perturbation schemes, which rely on homogeneous backbones and lack generalization. It abandons the conventional integration approach of "covering known backbones" and, through cross-space alignment training of multiple backbones, anchors the perturbation effect to a general semantic subspace related to the transferability of facial identity, which is jointly learned by different facial feature extraction networks, rather than a specific feature dimension of a certain backbone network. This achieves the generalized defense capability of "one-time training, effective across all types of backbones" and completely solves the problem of defense failure of heterogeneous face-swapping models in extreme black-box scenarios.

[0065] In some embodiments, a facial texture perturbation unit linked to identity perturbation is added to the fusion decoding branch of the image reconstruction module. First, based on the facial key points obtained in the preprocessing stage, the core regions of the facial features are located, including the periorbital area, nasal area, periorbital area, and jaw contour area, and a facial feature region mask is generated. In the shallow feature decoding stage of the decoding branch (corresponding to the texture and edge detail feature layers of the image), the perturbation identity feature vector is used to generate a texture perturbation weight map through a mapping network. The size of the texture perturbation weight map is consistent with the feature map size of the current decoding layer, and it is applied only to the facial feature core. Non-zero weights exist within the mask range corresponding to the heart region; the texture perturbation weight map is multiplied element-wise with the feature map of the current decoding layer, and the shallow texture features of the facial features are fine-tuned in conjunction with the direction of high-level identity perturbation. The fine-tuned feature map is then input into the subsequent decoding layer; at the same time, a texture perturbation constraint loss is added to the total loss function. The texture perturbation constraint loss is used to constrain the pixel-level difference between the protected face image and the original standardized face image in the facial features region. The average pixel difference does not exceed 3 gray levels, ensuring that the texture perturbation does not cause visually perceptible distortion. This embodiment addresses the common technical vulnerability of "separation between high-level identity features and low-level texture features," abandoning the conventional design of "only perturbing high-level identity features." Through a coordinated design of high-level identity perturbation and low-level texture micro-perturbation, it accurately targets facial texture identity clues that face-swapping models can utilize, while leaving non-face areas and non-core facial feature areas completely undisturbed. This not only further blocks the identity information extraction path of face-swapping models and improves the thoroughness of the defense, but also strictly constrains the perturbation amplitude, ensuring that it does not affect the visual naturalness of the image, thus forming a directional perturbation design that links high- and low-dimensional features.

[0066] The technical concept of this invention is as follows:

[0067] This invention breaks through the technical limitations of existing pixel-level perturbation by directly implementing learnable directional perturbation in the facial identity feature space. Through joint optimization of feature perturbation and image reconstruction, it achieves a balance between face-swapping defense capabilities and visual consistency.

[0068] The core technical process is as follows: First, the source face image to be protected is preprocessed to complete face detection, key point localization and alignment, and standardized cropping to obtain a face image that meets the network input requirements. Second, a pre-trained frozen parameter identity feature extraction network is used to extract high-dimensional identity feature vectors of the face to accurately represent the face identity information. Then, a feature perturbation module is used to perform nonlinear transformation on the identity feature vector to generate a perturbation vector with controllable amplitude, constructing a perturbation identity feature vector that deviates significantly from the original identity features in the feature space. Subsequently, the original face image and the perturbation identity features are input into the image reconstruction module to complete image feature encoding, perturbation identity feature fusion, and image decoding, reconstructing a protected face image that is visually consistent with the original image but whose identity features have been effectively destroyed. Finally, the protected image is output to replace the original image for storage, publication, and dissemination.

[0069] When a protective face image is input into a deepfake face-swapping model, the model cannot correctly extract effective source identity features, leading to a significant weakening or invalidation of the source identity information in the face-swapping result, thus achieving an active defense effect. Simultaneously, this invention employs a training strategy combining generative adversarial optimization and multiple loss functions during the training phase to further ensure the authenticity, naturalness, and robustness of the protective image.

[0070] This invention weakens the ability of deepfake face-swapping models to extract and utilize source identity information by perturbing the identity features of the source face and reconstructing a protective image. Specifically, it includes the following steps:

[0071] (1) Source face image acquisition and preprocessing. The source face image to be protected is acquired, and face detection, key point localization and alignment are performed on the source face image. The image is then cropped to a predetermined size and used as the input image for subsequent identity feature extraction and protection processing. In a specific embodiment, the face image is uniformly adjusted to... The resolution is adjusted to meet the requirements of subsequent network input.

[0072] (2) Facial identity feature extraction. The cropped facial image obtained in step (1) is input into the identity feature extraction module to extract identity feature vectors related to facial identity semantics, which are used to represent the identity information corresponding to the face. The method for facial identity feature extraction in step (2) is as follows:

[0073] (2.1) Feature encoding: The cropped face image is input into a pre-trained face identity feature extraction network, and a high-dimensional identity feature representation of the face is obtained through multi-layer feature mapping. The identity feature extraction network keeps its parameters frozen during training to ensure the stability of the identity feature space, so that subsequent perturbation operations can directly act on the reliable identity embedding representation.

[0074] (2.2) Identity feature output: The high-dimensional identity feature representation is output as an identity feature vector. This serves as the input for the subsequent feature perturbation module.

[0075] (3) Generation of identity feature perturbation. The face identity feature vector obtained in step (2) is input into the feature perturbation module to transform the identity features and generate a perturbed identity feature vector, so that it deviates significantly from the original identity features in the identity feature space, thereby reducing its identity discrimination ability. The method of inputting the identity features into the feature perturbation module to generate perturbed identity features in step (3) is as follows.

[0076] (3.1) Feature perturbation module structure: In a specific embodiment, the feature perturbation module adopts a nonlinear mapping structure composed of two fully connected networks. Let the dimension of the identity feature vector be... The characteristic perturbation module includes:

[0077] ① First linear mapping layer, weight matrix Bias term ;

[0078] ② The nonlinear activation function ReLU;

[0079] ③ Second linear mapping layer, weight matrix Bias term .

[0080] in, This represents the intermediate hidden layer dimension, which in a specific embodiment can be set to the same as... The same or slightly smaller values ​​are used to strike a balance between perturbation expressiveness and stability.

[0081] (3.2) Perturbation vector generation and amplitude constraint, which will affect the identity feature vector. Input the above feature perturbation module to generate a perturbation vector. The calculation method is as follows:

[0082] ;

[0083] The tanh function is used to constrain the components of the perturbation vector in each dimension. Within the range, this avoids excessive disturbance amplitude that could lead to image reconstruction distortion.

[0084] (3.3) In this embodiment, a perturbation scaling factor is introduced. The perturbation amplitude is adjusted to ultimately construct the perturbation identity feature vector:

[0085] ;

[0086] Wherein, the disturbance scaling factor This is an adjustable parameter used to balance the intensity of identity removal with the visual consistency of the image. In a specific embodiment, It can be used as a learnable parameter in the network training process, or it can be set to a fixed value within a preset range and its value can be adaptively determined through the joint optimization process with the image reconstruction module, thereby avoiding dependence on a fixed perturbation threshold.

[0087] (4) Protective image reconstruction based on perturbation identity features. The cropped face image obtained in step (1) and the perturbation identity feature vector obtained in step (3) are input into the image reconstruction module to generate a protective face image, so that the protective face image is visually consistent with the original face image, while its identity features have been effectively destroyed. Among them, the method of protective image reconstruction based on perturbation identity features in step (4) is as follows:

[0088] (4.1) Image feature encoding: The original face image is input into the encoding submodule of the image reconstruction module. The intermediate feature representation of the image is obtained through multi-layer convolution or feature extraction operations, which is used to characterize the structure, texture and semantic information of the image.

[0089] (4.2) Perturbation identity feature fusion: The perturbation identity feature vector obtained in step (3) is mapped to a feature space that matches the intermediate feature representation of the image, and injected into the intermediate feature layer of the image reconstruction module to suppress the reconstruction of identity-related features during the image generation process.

[0090] (4.3) Protective image decoding: Based on the fused intermediate features, the features are reconstructed step by step through the decoding submodule to generate a protective face image. The face image obtained in step (1) is then used... Perturbation identity features obtained in step (3) The common input image reconstruction module generates a protected face image. The mapping relationship is as follows:

[0091] ;

[0092] in, This represents an image reconstruction network used to embed perturbed identity features into generated face images while maintaining visual consistency.

[0093] (5) Adversarial optimization and joint training strategy. In a specific embodiment, to improve the realism and naturalness of the generated protective face images, a discriminative network is introduced into the image reconstruction module during the training phase, and a least squares generative adversarial network (LSGAN) is used for adversarial optimization. Through the adversarial training mechanism, the fitting ability of the protective images under the real visual distribution is improved, thereby enhancing the robustness against deepfake model evasion.

[0094] In a specific embodiment, the overall training objective function is composed of multiple loss functions, including identity deviation loss, pixel reconstruction loss, perceptual consistency loss, and adversarial loss, with each loss term weighted by a weight coefficient. Its expression is as follows:

[0095] ;

[0096] in, , , , These are the weight coefficients for adversarial loss, pixel reconstruction loss, perceptual consistency loss, and identity deviation loss, respectively; the definitions of each loss term are as follows.

[0097] (5.1) Combating Losses The adversarial loss is used to improve the realism of the generated protected face image. In a specific embodiment, the least squares generative adversarial loss is used, and its calculation method is as follows:

[0098] ;

[0099] in Indicates protection of facial images Take the expected value. Indicates the discriminant network, This indicates the generated protected face image.

[0100] (5.2) Pixel reconstruction loss The pixel reconstruction loss is used to constrain the differences between the protected face image and the original face image at the pixel level, and its calculation method is as follows:

[0101] ;

[0102] in, Represents the original human face image. This represents the square of the L2 norm.

[0103] (5.3) Loss of perceived consistency The perceptual consistency loss is used to maintain the consistency of the generated image in terms of high-level semantics and visual perception. In a specific embodiment, a perceptual distance metric based on a pre-trained network is adopted, and its calculation method is as follows:

[0104] ;

[0105] This represents the learned perceptual image patch similarity metric function.

[0106] (5.4) Loss due to identity deviation The identity deviation loss is used to reduce the similarity between the protected face image and the original face in the identity feature space, and its calculation method is as follows:

[0107] ;

[0108] in, This represents an identity feature extraction network. Let represent the cosine similarity function. By minimizing this loss, the protected face image deviates from the original identity features in the identity feature space.

[0109] In a specific embodiment, the weighting coefficient can be set as follows:

[0110] ;

[0111] The above parameter configuration is used to strike a balance between identity protection effectiveness and visual consistency.

[0112] (6) Output and application of protective face images. The generated protective face images are output and used to replace the original face images for storage, publication or dissemination. When the protective face images are input into a deepfake face-swapping model, since their identity features have been effectively disturbed in the feature space, the face-swapping model cannot correctly extract the source identity features, resulting in a significant weakening or failure of the source identity information in the face-swapping result.

[0113] Experimental verification:

[0114] In the experiments, this invention utilized the widely used CelebA-HQ dataset, which contains 30,000 high-quality face images covering 6,217 unique identities. Following the official classification, this invention used it for both training and testing. In the face-swapping defense experiment, this invention randomly selected target images from the FFHQ dataset to simulate a real-world, restricted black-box scenario where the target face is unknown. FFHQ contains 70,000 high-resolution face images with greater diversity in age, gender, skin color, and background. The source images were taken from the CelebA-HQ test set and processed using the defense method to be evaluated. All images underwent face detection, alignment, and normalization preprocessing, and were adjusted to a resolution of 256×256. In the identity erasure capability evaluation experiment, as shown in Table 1, this invention was evaluated on four publicly available face detection technologies: ArcFace, FaceNet, VggFace, and SFace. Acc5 and Acc1 scores represent Top-5 accuracy and Top-1 accuracy, respectively. The Top-5 accuracy is calculated as follows: In a multi-identity set, the cosine similarity between the identity features of the image to be tested and the identity features of all images in the set is calculated. The similarity values ​​are ranked from highest to lowest. If the identities of the top five images are the same as those of the image to be tested, it is considered a hit. Finally, the hit rate percentage is calculated to determine the Top-5 accuracy. The Top-1 method is similar, except that the highest similarity score is used as the hit. The average results of the four recognition models further validate this observation: the average Top-1 accuracy of the method in this invention is 0.300, and the average Top-5 accuracy is 0.461, both the lowest among all compared methods. This indicates that, compared with traditional pixel-level perturbation methods, the method in this invention fundamentally disrupts the identity embedding and extraction process of modern recognition systems by directly perturbing the identity representation in the latent space.

[0115] In the evaluation of anti-face-swapping capabilities, as shown in Table 2, this invention was evaluated on five excellent face-swapping methods: SimSwap, InfoSwap, E4S, BlendFace, and UniFace. The two metrics in Table 2, ArcF and VGGF, represent the identity similarity between the original face-swapping features extracted by ArcFace and VGGFace, respectively, and the features protecting the face-swapping result. The method of this invention achieved the lowest similarity scores on all face-swapping models, with an average similarity of 0.547 for ArcFace and 0.461 for VGGFace, both lower than all benchmark methods. These results demonstrate that this method can achieve significant and stable suppression of identity transfer across various face-swapping frameworks.

[0116] To evaluate the practical effectiveness of the method in real-world scenarios, this invention was further tested on two major commercial face verification APIs (Application Programming Interfaces): Baidu and Tencent. As shown in Table 3, the method significantly reduced identity similarity in both commercial systems: the average similarity measured by the Baidu API decreased from 84.03 to 53.87, and the average similarity measured by the Tencent API decreased from 76.48 to 35.61. These results demonstrate that commercial recognition systems can no longer accurately classify protected face-swapped images as belonging to the same identity, confirming that the method of this invention effectively disrupts the identity propagation process utilized by face-swapping models.

[0117] This result further highlights the practical security significance of the method of the present invention: by reducing the matching confidence of commercial identity verification services, the method of the present invention helps to prevent deepfake face-swapping attacks from bypassing liveness detection and identity authentication mechanisms, while demonstrating outstanding robustness and defense potential that exceeds standard academic benchmarks.

[0118] Table 1. Identity Erasure Capability Assessment Form

[0119] ;

[0120] Table 2. Assessment Table of Anti-Fake Deepfake Defense Capabilities

[0121] ;

[0122] Table 3. Evaluation of the ability of commercial face comparison APIs to defend against forgery and face swapping.

[0123] ;

[0124] Acc1: Top-1 recognition accuracy; Acc5: Top-5 recognition accuracy; Clean: Original unprotected baseline group; Initiative: Existing active defense methods (traditional pixel-level active defense schemes); CMUA: Existing CMUA adversarial perturbation defense method; DF-RAP: Existing DF-RAP deepfake defense method; NullSwap: Existing NullSwap face-swapping defense method; ArcFace: ArcFace face recognition model; FaceNet: FaceNet face recognition model; VGGFace: VGGFace face recognition model; SFace: SFace face recognition model; Anti-Forgery: Existing anti-forgery defense methods (existing industry-standard anti-forgery defense schemes); SimSwap: SimSwap face-swapping model; InfoSwap: InfoSwap face-swapping model; E4S: E4S face-swapping model; BlendFace: BlendFace face-swapping model; UniFace: UniFace face-swapping model.

[0125] This invention differs from existing active defense strategies that primarily operate in the pixel space. Starting from the facial identity feature space, it applies learnable perturbations to the source identity features and maps the perturbation results back to the image space through image reconstruction. This achieves active defense against deepfake face swapping without relying on a specific face-swapping model structure. The method remains stable and effective under strict black-box conditions, simultaneously balancing defense strength and visual consistency. Experimental results show that after using the protected facial images generated by this invention, the average Top-1 accuracy on various face recognition models decreases to 0.301, indicating a significant weakening of the source identity's identifiability. At the same time, the protected images maintain high consistency in visual quality. Furthermore, among the face-swapping results generated by five representative face-swapping models, the average identity similarity between the results obtained using the protected images from this invention and the normal face-swapping results decreases to 0.504. In evaluations that more closely resemble real-world application scenarios, this invention also demonstrated excellent protection effects on commercial face verification systems. Specifically, the average similarity score of the Baidu face comparison API decreased from 84.03 to 53.87, and the average similarity score of the Tencent face comparison API decreased from 76.48 to 35.61. This indicates a significant decrease in the confidence level of the commercial system in matching the protected identity, thereby enhancing its practical protective value against deepfake and face-swapping abuse. These results demonstrate that this invention not only possesses significant advantages in academic evaluation environments but also has clear engineering application value and practical protective significance in commercial face recognition and identity verification scenarios.

[0126] The embodiments described above are for illustrative purposes only and are not intended to limit the invention. Therefore, any changes in numerical values ​​or substitutions of equivalent elements should still fall within the scope of this invention.

[0127] The above detailed description will enable those skilled in the art to understand that the present invention can indeed achieve the aforementioned objectives and has complied with the provisions of the Patent Law.

[0128] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention. The above descriptions are merely preferred embodiments of the invention and are not intended to limit the invention. It should be noted that any modifications, equivalent substitutions, and improvements made within the spirit and principles of the invention should be included within the scope of protection of the invention.

[0129] It should be noted that the above description of the process is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art can make various modifications and changes to the process under the guidance of this specification. However, these modifications and changes remain within the scope of this specification.

[0130] The basic concepts have been described above. Obviously, for those skilled in the art who have read this application, the above disclosure is merely illustrative and does not constitute a limitation of this application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to this application. Such modifications, improvements, and corrections are suggested in this application, and therefore, such modifications, improvements, and corrections still fall within the spirit and scope of the exemplary embodiments of this application.

[0131] Furthermore, this application uses specific terms to describe its embodiments. For example, "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic related to at least one embodiment of this application. Therefore, it should be emphasized and noted that "an embodiment," "one embodiment," or "an alternative embodiment" mentioned twice or more in different positions in this specification do not necessarily refer to the same embodiment. In addition, certain features, structures, or characteristics in one or more embodiments of this application can be appropriately combined.

Claims

1. A proactive defense method against deepfake face-swapping based on facial identity feature-level perturbations, characterized in that, include: (1) Obtain the source face image to be protected, and perform face detection, key point localization, face alignment and standardized cropping on the source face image to obtain a standardized face image; (2) Input standardized face images into a pre-trained face identity feature extraction network with parameters frozen throughout, and extract the high-dimensional identity feature vector of the corresponding source face; perform dual-domain decoupling modeling on the face identity feature space in advance, and decouple the high-dimensional identity feature vector into the identity transferability core component and the individual uniqueness verification component; among them, the identity transferability core component is the feature dimension that the deepfake face-swapping model must rely on for identity injection and cross-subject identity transfer; the individual uniqueness verification component is the feature dimension that the commercial face verification system relies on for identity matching, but the face-swapping model cannot use for identity transfer. (3) Input the high-dimensional identity feature vector into the preset feature perturbation module, perform nonlinear directional transformation on the high-dimensional identity feature vector, and generate a perturbed identity feature vector that deviates from the high-dimensional identity feature vector in the feature space; the feature perturbation module only performs directional nonlinear perturbation on the core component of identity transferability, and performs zero perturbation retention processing on the individual uniqueness verification component; (4) Input the standardized face image into the encoding branch of the preset image reconstruction module to complete the deep feature encoding of the image and obtain the face image encoding features; (5) Input the perturbation identity feature vector and the face image coding feature into the fusion decoding branch of the image reconstruction module, and complete the perturbation identity feature fusion and image decoding processing in sequence to reconstruct the protected face image; in the decoding branch of the image reconstruction module, the original individual uniqueness verification component is embedded into the protected face image by least significant bit steganography. (6) Use protected facial images to replace the original source facial images for storage, publication and dissemination, so as to achieve proactive defense against deepfake face-swapping attacks.

2. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 1, characterized in that, In step (1), after completing the localization of facial key points, the source face image is rigidly aligned based on the facial key points to eliminate the interference caused by differences in face pose and scale. Then, standardized cropping is completed according to the preset fixed size to obtain a standardized face image whose size matches the input requirements of the face identity feature extraction network and the image reconstruction module.

3. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 1, characterized in that, In step (2), the pre-trained face identity feature extraction network with its parameters frozen throughout the process is trained using a backbone network architecture and pre-training dataset that is the same as that of the deepfake face-swapping model. After training, all network parameters are fixed throughout the process and are only used for the extraction of high-dimensional identity feature vectors. They do not participate in the parameter updates of the feature perturbation module and the image reconstruction module.

4. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 1, characterized in that, In step (3), when the feature perturbation module performs nonlinear directional transformation, the core objective is to destroy the identity transferability of the high-dimensional identity feature vector in the face-swapping scenario. At the same time, an upper limit constraint is imposed on the perturbation amplitude generated by the transformation to avoid excessive perturbation that would cause visual distortion in the subsequently reconstructed protective face image.

5. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 1, characterized in that, The feature perturbation module in step (3) adopts a nonlinear transformation network with residual structure. When performing directional transformation on the high-dimensional identity feature vector, the nonlinear transformation network with residual structure retains the basic feature components of the original high-dimensional identity feature vector and only performs directional perturbation on the feature components that represent the uniqueness of identity. This ensures the effectiveness of the perturbation while reducing the degree of visual distortion of the protected face image.

6. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 1, characterized in that, The feature perturbation module and the image reconstruction module are pre-trained by joint training. During the training process, all parameters of the face identity feature extraction network are fixed, and the weighted sum of the multi-dimensional loss function is used as the optimization objective to complete the parameter iterative update of the two modules.

7. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 6, characterized in that, The multidimensional loss function includes at least the defense effect loss, visual consistency loss, and perturbation amplitude constraint loss; wherein the defense effect loss is used to constrain the degree of deviation between the perturbation identity feature vector and the original high-dimensional identity feature vector in the feature space, the visual consistency loss is used to constrain the visual appearance difference between the protected face image and the standardized face image, and the perturbation amplitude constraint loss is used to limit the upper limit of the amplitude of feature perturbation.

8. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 1, characterized in that, Before performing step (3), based on the protection level requirements of the target application scenario, the perturbation intensity weight of the feature perturbation module is preset. By adjusting the weight, a dynamic balance between defense strength and visual consistency is achieved to adapt to the protection requirements of different scenarios.

9. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 1, characterized in that, In step (5), when the image reconstruction module's fusion decoding branch performs perturbation identity feature fusion, it performs channel-by-channel feature fusion of the face image encoding features and the perturbation identity feature vector, embeds the perturbation identity information into the image features, and then restores the protected face image with the same visual appearance as the standardized face image obtained in step (1) through decoding processing.

10. The active defense method for deepfake face-swapping based on facial identity feature-level perturbation according to claim 1, characterized in that, When a protective face image is input into a deepfake face-swapping model, the identity feature extraction stage of the face-swapping model cannot extract effective source identity features from the protective face image. This results in the source identity information in the final face-swapping result being weakened or completely invalidated, thus blocking the spread and abuse of deepfake face-swapping identities at the source.

Images