NullSwap: Proactive Identity Cloaking Against Deepfake Face Swapping (ICCV 2025 Oral)

Forum topic · 二一 · 2026-05-13

Summary

NullSwap, an ICCV 2025 Oral paper, introduces a proactive defense against deepfake face swapping called proactive identity cloaking. Instead of passively detecting manipulated images after the fact, NullSwap protects source photos in advance by embedding visually imperceptible perturbations that prevent face-swapping models from recognizing the subject's identity. The method works in three steps: extracting an identity feature vector from the photo, generating targeted identity-based perturbations, and fusing them with low-level image features to reconstruct a protected image that looks normal to humans but appears as an unknown identity to AI. A dynamic loss-weighting scheme adaptively balances attacks across different identity encoders, making NullSwap effective in a fully black-box setting without ever accessing the target face-swapping model during training. Unlike prior approaches, it protects the source identity rather than the target image, and preserves visual quality. The result: a protected selfie uploaded online cannot be successfully swapped onto other faces even by state-of-the-art models.

> A quote often attributed to Feynman: "If you crack the code, the other side may not even know they've been broken. The best defense isn't building a higher wall — it's making sure the attacker can't find the door in the first place." An ICCV 2025 paper does something similar: rather than detecting deepfakes after the fact, it makes your photos impossible to swap in the first place.

---

The Problem: Are Deepfakes Really Blocked?

Deepfake face swapping is becoming increasingly realistic. The mainstream defense is passive detection — deciding after the fact whether a face is real or fake. But this is a cat-and-mouse game: as generators improve, detectors must be upgraded in tandem.

What if we flipped the approach? Instead of detecting after the fact, disrupt in advance — add an "invisible armor" layer to your photos so that no face-swapping algorithm can recognize your identity.

This is the core idea of NullSwap: Proactive Identity Cloaking.

---

How It Works

Traditional methods add perturbations directly at the pixel level (similar to adversarial examples), but this causes noticeable degradation in image quality. NullSwap takes a smarter path:

1. Identity extraction: Extract the "who you are" identity feature vector from your photo 2. Perturbation generation: Generate targeted, visually near-imperceptible perturbations based on this identity feature 3. Cloaked reconstruction: Fuse the perturbations with low-level image features to reconstruct a photo that "looks like you, but AI can't recognize you"

The key is dynamic loss weighting: since different face-swapping algorithms use different identity encoders, NullSwap adaptively balances its attack strength across identity models during training — remaining effective even in a black-box setting (with no knowledge of which encoder the target model uses).

---

Results

Significantly outperforms existing proactive perturbation methods
Pure black-box setting — no access to the target face-swapping model during training
Protects the source identity (the face being swapped), not the target image
Good visual quality — the added protection is imperceptible to the human eye

This means: if you upload a "protected" selfie to a social platform, even if someone downloads it and feeds it to the most advanced face-swapping model, your face cannot be swapped. The model identifies you as an "unknown identity" — because your identity features have been cleverly scrambled.

---

*Paper information*

Title: NullSwap: Proactive Identity Cloaking Against Deepfake Face Swapping
Venue: ICCV 2025 (Oral)
Core innovation: Pure black-box proactive identity cloaking, protecting the source identity rather than the target image