Efficient and Robust Video Defense Framework against 3D-field Personalized Talking Face

TL;DR

This work addresses privacy risks posed by 3D-field video-referenced Talking Face Generation (TFG) by proposing a practical video defense framework (VDF). Unlike-framewise image defenses, VDF perturbs the reference video processing in the frequency domain and employs a similarity-guided parameter sharing strategy along with a multi-scale, dual-domain attention mechanism to achieve high efficiency and robustness. Key contributions include the similarity-based initialization of frame perturbations, multiscale frequency-domain perturbations with spatial attention, and a perceptual loss to preserve video quality; collectively, these yield substantial speedups (up to ~60x), strong resistance to scaling and purification attacks, and effective disruption of 3D-field TFG identity extraction. The framework demonstrates robust privacy protection for portrait videos and offers practical implications for safeguarding personal likeness in real-time, 3D-field–driven synthesis pipelines, with a pathway toward unified defenses for both image- and video-referenced TFG systems.

Abstract

State-of-the-art 3D-field video-referenced Talking Face Generation (TFG) methods synthesize high-fidelity personalized talking-face videos in real time by modeling 3D geometry and appearance from reference portrait video. This capability raises significant privacy concerns regarding malicious misuse of personal portraits. However, no efficient defense framework exists to protect such videos against 3D-field TFG methods. While image-based defenses could apply per-frame 2D perturbations, they incur prohibitive computational costs, severe video quality degradation, failing to disrupt 3D information for video protection. To address this, we propose a novel and efficient video defense framework against 3D-field TFG methods, which protects portrait video by perturbing the 3D information acquisition process while maintain high-fidelity video quality. Specifically, our method introduces: (1) a similarity-guided parameter sharing mechanism for computational efficiency, and (2) a multi-scale dual-domain attention module to jointly optimize spatial-frequency perturbations. Extensive experiments demonstrate that our proposed framework exhibits strong defense capability and achieves a 47x acceleration over the fastest baseline while maintaining high fidelity. Moreover, it remains robust against scaling operations and state-of-the-art purification attacks, and the effectiveness of our design choices is further validated through ablation studies. Our project is available at https://github.com/Richen7418/VDF.

Figures (8)

• Figure 1: Motivation illustration. Given an audio input and a reference video, 3D field–based TFG models can synthesize highly realistic personalized talking-face videos. However, decomposing a video into individual frames and applying existing 2D image-level defenses introduces substantial computational overhead while proving largely ineffective against 3D-based generation. To efficiently protect portrait privacy from such personalized TFG models, we propose a video-level defense framework (VDF) that achieves both high efficiency and strong robustness.
• Figure 2: Overall architecture of the proposed framework. (a) Efficiency improvement mechanism. (b) Dual-domain attention mechanism with multiscale module.
• Figure 3: The basic process of acquiring target-specific information in 3D field–based TFG models. Accurate identity reconstruction relies heavily on the exquisite processing of the reference video, where expressions, head poses, and audio features are extracted and then rendered via NeRF or 3DGS to synthesize an audio-driven talking-face video.
• Figure 4: Qualitative Comparison with Image Protection Methods.
• Figure 5: Qualitative Comparison of images generated after Diffpure and Freqpure purification with Image Protection Methods.