StegaFFD: Privacy-Preserving Face Forgery Detection via Fine-Grained Steganographic Domain Lifting

TL;DR

Low-Frequency-Aware Decomposition (LFAD) and Spatial-Frequency Differential Attention (SFDA) are proposed, which suppress interference from low-frequency cover semantics and enhance hidden facial feature perception.

Abstract

Most existing Face Forgery Detection (FFD) models assume access to raw face images. In practice, under a client-server framework, private facial data may be intercepted during transmission or leaked by untrusted servers. Previous privacy protection approaches, such as anonymization, encryption, or distortion, partly mitigate leakage but often introduce severe semantic distortion, making images appear obviously protected. This alerts attackers, provoking more aggressive strategies and turning the process into a cat-and-mouse game. Moreover, these methods heavily manipulate image contents, introducing degradation or artifacts that may confuse FFD models, which rely on extremely subtle forgery traces. Inspired by advances in image steganography, which enable high-fidelity hiding and recovery, we propose a Stega}nography-based Face Forgery Detection framework (StegaFFD) to protect privacy without raising suspicion. StegaFFD hides facial images within natural cover images and directly conducts forgery detection in the steganographic domain. However, the hidden forgery-specific features are extremely subtle and interfered with by cover semantics, posing significant challenges. To address this, we propose Low-Frequency-Aware Decomposition (LFAD) and Spatial-Frequency Differential Attention (SFDA), which suppress interference from low-frequency cover semantics and enhance hidden facial feature perception. Furthermore, we introduce Steganographic Domain Alignment (SDA) to align the representations of hidden faces with those of their raw counterparts, enhancing the model's ability to perceive subtle facial cues in the steganographic domain. Extensive experiments on seven FFD datasets demonstrate that StegaFFD achieves strong imperceptibility, avoids raising attackers' suspicion, and better preserves FFD accuracy compared to existing facial privacy protection methods.

Figures (7)

• Figure 1: Different client-server frameworks for FFD, including (a) vanilla, (b) encryption-based, (c) anonymization-based, and (d) the proposed StegaFFD framework. Our StegaFFD makes the attacker fail to notice the existence of facial images.
• Figure 2: Illustration of the detailed structure of the proposed StegaFFD. (a) Client-side image hiding network $\mathcal{H}(\cdot)$ hides facial secret images into natural cover images for privacy-preserving transmission. (b) Server-side Detector analyzes stego images directly in the steganographic domain to lift facial features by $\mathcal{M}_L$ for forgery detection. (c) SDA branch enhances detector training by aligning steganographic-domain features with raw facial features lifted by $\mathcal{M}'_L$, improving forgery detection accuracy. This branch operates exclusively during training and is omitted during deployment.
• Figure 3: Illustration of (a) the server-side network $\mathcal{M}(\cdot)$ of the proposed LFAD and SFDA. The feature lifting network contains LFAD and SFDA, which extracts high-frequency steganographic features containing facial information. (b) SDA branch $\mathcal{M}'(\cdot)$ helps to lift secret facial features by aligning stego-domain features with raw facial features.
• Figure 4: Visual attribution analysis of face forgery detection algorithms (i.e., StegaFFD, Xception rossler2019faceforensics++, Meso4 afchar2018mesonet, MesoIncep afchar2018mesonet, and F3Net qian2020thinking) using Grad-CAM++, highlighting feature focus on cover and secret image regions (e.g., facial forgery areas).
• Figure 5: Robust attribution analysis of face forgery detection across varied cover images for a single facial instance and failure cases. This figure illustrates Grad-CAM++ attribution heatmaps highlighting feature focus on cover and secret image regions (e.g., facial forgery areas).