FakeTracer: Catching Face-swap DeepFakes via Implanting Traces in Training

TL;DR

Face-swap DeepFakes pose practical security risks by enabling identity replacement with convincing realism. FakeTracer offers a proactive defense by embedding two trace types—STrace (persistent) and ETrace (erasable)—into training faces to steer the DeepFake model toward generating traces-bearing outputs, which can be detected to reveal forgeries. The approach uses a trainable STrace generator, a STrace identifier, and a DeepFake simulator to mimic encoding-decoding, achieving high recovery accuracy and robust detection across architectures and post-processing. This method exposes DeepFakes without altering the model architecture or generation pipeline, offering a scalable defense with practical robustness and broad potential impact on privacy and verification workflows.

Abstract

Face-swap DeepFake is an emerging AI-based face forgery technique that can replace the original face in a video with a generated face of the target identity while retaining consistent facial attributes such as expression and orientation. Due to the high privacy of faces, the misuse of this technique can raise severe social concerns, drawing tremendous attention to defend against DeepFakes recently. In this paper, we describe a new proactive defense method called FakeTracer to expose face-swap DeepFakes via implanting traces in training. Compared to general face-synthesis DeepFake, the face-swap DeepFake is more complex as it involves identity change, is subjected to the encoding-decoding process, and is trained unsupervised, increasing the difficulty of implanting traces into the training phase. To effectively defend against face-swap DeepFake, we design two types of traces, sustainable trace (STrace) and erasable trace (ETrace), to be added to training faces. During the training, these manipulated faces affect the learning of the face-swap DeepFake model, enabling it to generate faces that only contain sustainable traces. In light of these two traces, our method can effectively expose DeepFakes by identifying them. Extensive experiments corroborate the efficacy of our method on defending against face-swap DeepFake.

Figures (11)

• Figure 1: (a) and (b) are the regular training phase and testing (generation) phase of the DeepFake model, while (c) and (d) are the training phase and testing (generation) phase of the DeepFake model using our method. It can be seen that our method can intervene in the DeepFake model by implanting two kinds of traces into the users' face images.
• Figure 2: The training phase (top) and testing phase (bottom) of the face-swap DeepFake model. In this illustration, ID 0 is the target identity, and ID 1 is the source identity.
• Figure 3: The training phase (top) and testing phase (bottom) of the face-synthesis DeepFake model. $z$ denotes random noises.
• Figure 4: Overview of our method. (a) The face images are implanted traces by our method before uploading them into the Internet. (b) The attackers collect the face images of a target identity ( e.g., ID 0) to train the face-swap DeepFake model. Note that the training faces of another identity remain untouched. This setting is consistent with reality, as the users are expected to protect themselves by only modifying their face images. After training, the DeepFake model is learned to retain STrace but remove ETrace. (c) In the generation phase, given an input face of a source identity ( e.g., ID 1), the generated face can contain STrace.
• Figure 5: The visual illustration of our preliminary validation. (top) The illustration of the training process using faces of ID 0 with blue and red circles. (middle) In the generation phase, the clean face of ID 1 is selected as the ingredient to generate a face of ID 0. (bottom) The left column shows the training face images of ID 0 with blue and red circles. The middle column shows the input faces of ID 1 used for face swapping DeepFake. The right column corresponds to the generated faces of ID 0.