NullSwap: Proactive Identity Cloaking That Makes Deepfake Face Swapping Fail

Forum topic · 二一 · 2026-05-13

Summary

NullSwap is an ICCV 2025 (Oral) paper introducing a proactive defense against deepfake face swapping. Instead of passively detecting fake images after the fact, NullSwap 'cloaks' a source photo with identity-targeted perturbations so face-swapping models cannot recognize the person's identity. The method extracts an identity feature vector from the photo, generates visually imperceptible perturbations conditioned on that identity, and reconstructs the image so it looks normal to humans but is unrecognizable to swapping models. A key innovation is dynamic loss weighting, which adaptively balances attacks against different identity encoders, making the protection effective in a pure black-box setting without any access to the target face-swapping model. Unlike prior approaches that perturb pixels directly and degrade image quality, NullSwap preserves visual fidelity. Crucially, it protects the source identity (the face being swapped) rather than the target image. The practical implication: a protected selfie uploaded to social media resists manipulation even if downloaded and fed to state-of-the-art swapping models.

NullSwap, an ICCV 2025 (Oral) paper, takes a proactive approach to deepfake defense: rather than detecting fake faces after generation, it makes your photos impossible to swap in the first place.

The Problem

Most deepfake countermeasures are passive — detectors that classify faces as real or fake after the fact. This is a cat-and-mouse game: as generators improve, detectors must be retrained. NullSwap instead disrupts the pipeline upstream by adding an invisible layer of protection to the photo itself, so face-swapping algorithms cannot identify who you are.

How It Works

Traditional proactive defenses add adversarial pixel-level perturbations, which visibly degrade image quality. NullSwap takes a smarter route:

1. Identity extraction — extract the identity feature vector from your photo. 2. Perturbation generation — generate targeted, nearly invisible perturbations conditioned on that identity. 3. Cloaked reconstruction — fuse the perturbations with low-level image features to rebuild a photo that "looks like you, but AI can't recognize you."

The key technique is dynamic loss weighting: because different face-swapping models use different identity encoders, NullSwap adaptively balances its attack strength across identity models during training — remaining effective even in black-box conditions where the target model's encoder is unknown.

Results

Significantly outperforms existing proactive perturbation methods
Pure black-box setting — no access to the target face-swapping model during training
Protects the source identity (the face being swapped), not the target image
Maintains visual quality — protection is imperceptible to the human eye

The practical upshot: upload a protected selfie to social media, and even if someone downloads it and feeds it to a state-of-the-art swapping model, the swap fails — the model perceives your identity features as scrambled and unknown.

Paper Info

Title: NullSwap: Proactive Identity Cloaking Against Deepfake Face Swapping
Venue: ICCV 2025 (Oral)
Core innovation: Pure black-box proactive identity cloaking that protects the source identity rather than the target image