# NullSwap: Proactive Identity Cloaking Against Deepfake Face Swapping

arXiv: https://arxiv.org/abs/2503.18678 · HTML: https://mlsanity.com/paper/2503.18678/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 28 of its 50 references that are in the map.
- First posted on arXiv 24 Mar 2025.

## Builds on (most cited first, 28 of 28)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Squeeze-and-Excitation Networks](https://mlsanity.com/paper/1709.01507/) (2017)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Arbitrary Style Transfer in Real-time with Adaptive Instance Normalization](https://mlsanity.com/paper/1703.06868/) (2017)
- [FaceForensics++: Learning to Detect Manipulated Facial Images](https://mlsanity.com/paper/1901.08971/) (2019)
- [SimSwap: An Efficient Framework For High Fidelity Face Swapping](https://mlsanity.com/paper/2106.06340/) (2021)
- [DeepFaceLab: Integrated, flexible and extensible face-swapping framework](https://mlsanity.com/paper/2005.05535/) (2020)
- [Implicit Identity Leakage: The Stumbling Block to Improving Deepfake Detection Generalization](https://mlsanity.com/paper/2210.14457/) (2022)
- [Fast Face-swap Using Convolutional Neural Networks](https://mlsanity.com/paper/1611.09577/) (2016)
- [Fine-Grained Face Swapping via Regional GAN Inversion](https://mlsanity.com/paper/2211.14068/) (2022)
- [Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systems](https://mlsanity.com/paper/2003.01279/) (2020)
- [SFace: Privacy-friendly and Accurate Face Recognition using Synthetic Data](https://mlsanity.com/paper/2206.10520/) (2022)
- [Countering Malicious DeepFakes: Survey, Battleground, and Horizon](https://mlsanity.com/paper/2103.00218/) (2021)
- [CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes](https://mlsanity.com/paper/2105.10872/) (2021)
- [Deepfake Detection: A Comprehensive Survey from the Reliability Perspective](https://mlsanity.com/paper/2211.10881/) (2022)
- [SepMark: Deep Separable Watermarking for Unified Source Tracing and Deepfake Detection](https://mlsanity.com/paper/2305.06321/) (2023)
- [Anti-Forgery: Towards a Stealthy and Robust DeepFake Disruption Attack via Adversarial Perceptual-aware Perturbations](https://mlsanity.com/paper/2206.00477/) (2022)
- [Initiative Defense against Facial Manipulation](https://mlsanity.com/paper/2112.10098/) (2021)
- [TAFIM: Targeted Adversarial Attacks against Facial Image Manipulations](https://mlsanity.com/paper/2112.09151/) (2021)
- [Restricted Black-box Adversarial Attack Against DeepFake Face Swapping](https://mlsanity.com/paper/2204.12347/) (2022)
- [Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Faces](https://mlsanity.com/paper/2006.07421/) (2020)
- [LampMark: Proactive Deepfake Detection via Training-Free Landmark Perceptual Watermarks](https://mlsanity.com/paper/2411.17209/) (2024)
- [Deep Convolutional Pooling Transformer for Deepfake Detection](https://mlsanity.com/paper/2209.05299/) (2022)
- [Robust Identity Perceptual Watermark Against Deepfake Face Swapping](https://mlsanity.com/paper/2311.01357/) (2023)
- [GenFace: A Large-Scale Fine-Grained Face Forgery Benchmark and Cross Appearance-Edge Learning](https://mlsanity.com/paper/2402.02003/) (2024)
- [Information-containing Adversarial Perturbation for Combating Facial Manipulation Systems](https://mlsanity.com/paper/2303.11625/) (2023)

## Built on by (most cited first, 8 of 8)

- [FractalForensics: Proactive Deepfake Detection and Localization via Fractal Watermarks](https://mlsanity.com/paper/2504.09451/) (2025)
- [Towards Robust Protective Perturbation against DeepFake Face Swapping](https://mlsanity.com/paper/2512.07228/) (2025)
- [Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attacks](https://mlsanity.com/paper/2606.11615/) (2026)
- [Defending Deepfake via Texture Feature Perturbation](https://mlsanity.com/paper/2508.17315/) (2025)
- [Disruptive Attacks on Face Swapping via Low-Frequency Perceptual Perturbations](https://mlsanity.com/paper/2508.20595/) (2025)
- [ID-Eraser: Proactive Defense Against Face Swapping via Identity Perturbation](https://mlsanity.com/paper/2604.21465/) (2026)
- [DecoyFace: Beyond Obfuscation via Controllable and Imperceptible Identity Misdirection for Privacy-Preserving Face Recognition](https://mlsanity.com/paper/2607.17504/) (2026)
- [Can Tainted Pixels Expose Deepfake Videos?](https://mlsanity.com/paper/2608.27492/) (2026)

## Abstract (arXiv)

Suffering from performance bottlenecks in passively detecting high-quality Deepfake images due to the advancement of generative models, proactive perturbations offer a promising approach to disabling Deepfake manipulations by inserting signals into benign images. However, existing proactive perturbation approaches remain unsatisfactory in several aspects: 1) visual degradation due to direct element-wise addition; 2) limited effectiveness against face swapping manipulation; 3) unavoidable reliance on white- and grey-box settings to involve generative models during training. In this study, we analyze the essence of Deepfake face swapping and argue the necessity of protecting source identities rather than target images, and we propose NullSwap, a novel proactive defense approach that cloaks source image identities and nullifies face swapping under a pure black-box scenario. We design an Identity Extraction module to obtain facial identity features from the source image, while a Perturbation Block is then devised to generate identity-guided perturbations accordingly. Meanwhile, a Feature Block extracts shallow-level image features, which are then fused with the perturbation in the Cloaking Block for image reconstruction. Furthermore, to ensure adaptability across different identity extractors in face swapping algorithms, we propose Dynamic Loss Weighting to adaptively balance identity losses. Experiments demonstrate the outstanding ability of our approach to fool various identity recognition models, outperforming state-of-the-art proactive perturbations in preventing face swapping models from generating images with correct source identities.