NullSwap: Proactive Identity Cloaking That Makes Deepfake Face Swapping Fail (ICCV 2025 Oral)

Forum topic · 二一 · 2026-05-13

Summary

NullSwap, an ICCV 2025 Oral paper, proposes a proactive defense against Deepfake face swapping. Instead of passively detecting fake images after the fact, it embeds invisible perturbations into a user's photo so that face-swapping models can no longer recognize or transfer the person's identity. The method extracts an identity feature vector from the photo, generates identity-targeted perturbations that are visually imperceptible, and reconstructs the image by fusing these perturbations with low-level features. A dynamic loss-weighting strategy adapts the attack strength across different identity encoders, keeping the protection effective in a pure black-box setting where the target face-swapping model and its encoder are unknown. Unlike prior adversarial perturbation approaches that degrade image quality, NullSwap preserves visual fidelity while protecting the source identity (the face being swapped) rather than the target image. Experiments show it significantly outperforms existing proactive perturbation methods. Practically, users can upload a protected selfie to social media; even if downloaded and fed to state-of-the-art face-swapping models, the swap fails because the identity features have been scrambled.

Overview

This ICCV 2025 (Oral) paper, NullSwap: Proactive Identity Cloaking Against Deepfake Face Swapping, takes a defensive rather than reactive approach to Deepfakes. Instead of detecting fake images after generation, it modifies your photos in advance so that face-swapping algorithms cannot recognize your identity.

The Problem

Deepfake face-swapping keeps getting more realistic. Mainstream defenses rely on passive detection — judging after the fact whether a face is real or fake. But this is a cat-and-mouse game: as generators improve, detectors must be upgraded too.

NullSwap flips the idea: rather than detecting after the fact, sabotage in advance — apply an invisible protective layer to your photos so that no face-swapping algorithm can identify you. This is called Proactive Identity Cloaking.

How It Works

Traditional methods add perturbations directly to pixels (like adversarial examples), which noticeably degrades image quality. NullSwap takes a smarter path:

1. Identity extraction: extract the identity feature vector ("who you are") from your photo 2. Perturbation generation: based on this identity feature, generate targeted perturbations that are nearly invisible 3. Cloaked reconstruction: fuse the perturbations with low-level image features to rebuild a photo that "looks like you, but AI can't recognize as you"

The key is dynamic loss weighting: because different face-swapping models use different identity encoders, NullSwap adaptively balances attack strength across identity encoders during training — remaining effective in a black-box setting where the target model's encoder is unknown.

Results

Significantly outperforms existing proactive perturbation methods
Pure black-box setting — no access to the target face-swapping model during training
Protects the source identity (the face being swapped), not the target image
Good visual quality — the protection is imperceptible to the human eye

In practice: you upload a "protected" selfie to social media; even if someone downloads it and feeds it to the most advanced face-swapping model, your face can't be swapped in. The model sees you as an "unknown identity" because your identity features have been cleverly scrambled.

Paper Information

Title: NullSwap: Proactive Identity Cloaking Against Deepfake Face Swapping
Venue: ICCV 2025 (Oral)
Core innovation: Pure black-box proactive identity cloaking, protecting the source identity rather than the target image