提出新型可迁移攻击，让换脸模型误认人脸身份。
Transferable Attack against Face Swapping in an Extended Space
- 结合光照重调与添加扰动，扩展攻击空间。
- 在1000组图像上成功率超现有方法，且视觉更自然。
- 无需替代模型，适合研究换脸防御的学者。
尽管深度换脸（FS）模型可能促进娱乐产业，但严重威胁隐私与安全。现有防护手段如深度伪造检测和对抗扰动，或为被动响应，或对未知的无主体依赖式FS模型无效。本文提出一种针对无主体依赖式换脸模型的可迁移攻击——基于重光照功能的加性身份攻击（AIR）。AIR利用重光照和加性扰动，误导无主体依赖式换脸模型中的身份提取模块。通过同时使用两种扰动，攻击空间被扩展，从而生成更强且更符合视觉自然性的对抗样本。为进一步提升视觉质量并保持攻击有效性，设计了自适应平移不变操作与光照控制方案。与现有方法不同，AIR无需替代换脸模型即可实现高可迁移性。此外，给出了攻击空间扩展的数学证明。在涵盖多种先进无主体依赖式换脸模型（包括基于GAN和扩散模型）的1000组图像对上进行大量实验，结果表明，AIR在攻击成功率和图像质量方面均优于所有现有攻击方法。
原文摘要 · Abstract (English)
Although deep Face Swapping (FS) models may benefit the entertainment industry, they pose severe threats to privacy and security. Existing protections, including deepfake detection and adversarial perturbation, are either passive responses or ineffective to unseen subject-agnostic FS models. In this paper, we propose a transferable attack against subject-agnostic FS models named Additive Identity attack based on a Relighting function (AIR). AIR leverages reillumination and additive perturbations to mislead the identity extraction modules in subject-agnostic FS models. By using these two types of perturbations simultaneously, the attack space is extended such that stronger but more visually natural adversarial examples can be identified. To further enhance the visual quality while preserving the effectiveness of the attack, an adaptive translation-invariant operation and an illumination control scheme are designed for AIR. Unlike other methods, AIR does not require a surrogate FS model to achieve high transferability. In addition, a mathematical proof is given for the extension of the attack space. Extensive experiments using 1000 image pairs across various state-of-the-art subject-agnostic FS models, including GAN and diffusion-based FS models, show that AIR surpasses all existing attacks in terms of both attack success rate and image quality.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。