# Protecting Against Image Translation Deepfakes by Leaking Universal Perturbations from Black-Box Neural Networks

arXiv: https://arxiv.org/abs/2006.06493 · HTML: https://mlsanity.com/paper/2006.06493/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Jun 2020.

## Built on by (most cited first, 7 of 7)

- [Raising the Cost of Malicious AI-Powered Image Editing](https://mlsanity.com/paper/2302.06588/) (2023)
- [Restricted Black-box Adversarial Attack Against DeepFake Face Swapping](https://mlsanity.com/paper/2204.12347/) (2022)
- [Watermark Vaccine: Adversarial Attacks to Prevent Watermark Removal](https://mlsanity.com/paper/2207.08178/) (2022)
- [Simulated Adversarial Testing of Face Recognition Models](https://mlsanity.com/paper/2106.04569/) (2021)
- [Imperceptible Protection against Style Imitation from Diffusion Models](https://mlsanity.com/paper/2403.19254/) (2024)
- [FaceSwapGuard: Safeguarding Facial Privacy from DeepFake Threats through Identity Obfuscation](https://mlsanity.com/paper/2502.10801/) (2025)
- [Fingerprinting Image-to-Image Generative Adversarial Networks](https://mlsanity.com/paper/2106.11760/) (2021)

## Abstract (arXiv)

In this work, we develop efficient disruptions of black-box image translation deepfake generation systems. We are the first to demonstrate black-box deepfake generation disruption by presenting image translation formulations of attacks initially proposed for classification models. Nevertheless, a naive adaptation of classification black-box attacks results in a prohibitive number of queries for image translation systems in the real-world. We present a frustratingly simple yet highly effective algorithm Leaking Universal Perturbations (LUP), that significantly reduces the number of queries needed to attack an image. LUP consists of two phases: (1) a short leaking phase where we attack the network using traditional black-box attacks and gather information on successful attacks on a small dataset and (2) and an exploitation phase where we leverage said information to subsequently attack the network with improved efficiency. Our attack reduces the total number of queries necessary to attack GANimation and StarGAN by 30%.