Organizations: Institute of Automation, Chinese Academy of Sciences, Beijing 100190, China. · School of Future Technology, University of Chinese Academy of Sciences, Beijing 100049, China. · Beihang University, Beijing 100191, China. · Macau University of Science and Technology, Macau SAR 999078, China. · ROSE Lab, School of EEE, Nanyang Technological University, Nanyang Avenue 639798, Singapore.
Most existing Face Forgery Detection (FFD) models assume access to raw face images. In practice, under a client-server framework, private facial data may be intercepted during transmission or leaked by untrusted servers. Previous privacy protection approaches, such as anonymization, encryption, or distortion, partly mitigate leakage but often introduce severe semantic distortion, making images appear obviously protected. This alerts attackers, provoking more aggressive strategies and turning the process into a cat-and-mouse game. Moreover, these methods heavily manipulate image contents, introducing degradation or artifacts that may confuse FFD models, which rely on extremely subtle forgery traces. Inspired by advances in image steganography, which enable high-fidelity hiding and recovery, we propose a Stega}nography-based Face Forgery Detection framework (StegaFFD) to protect privacy without raising suspicion. StegaFFD hides facial images within natural cover images and directly conducts forgery detection in the steganographic domain. However, the hidden forgery-specific features are extremely subtle and interfered with by cover semantics, posing significant challenges. To address this, we propose Low-Frequency-Aware Decomposition (LFAD) and Spatial-Frequency Differential Attention (SFDA), which suppress interference from low-frequency cover semantics and enhance hidden facial feature perception. Furthermore, we introduce Steganographic Domain Alignment (SDA) to align the representations of hidden faces with those of their raw counterparts, enhancing the model's ability to perceive subtle facial cues in the steganographic domain. Extensive experiments on seven FFD datasets demonstrate that StegaFFD achieves strong imperceptibility, avoids raising attackers' suspicion, and better preserves FFD accuracy compared to existing facial privacy protection methods.
Figures & tables
Figure 1: Different client-server frameworks for FFD, including (a) vanilla, (b) encryption-based, (c) anonymization-based, and (d) the proposed StegaFFD framework. Our StegaFFD makes the attacker fail to notice the existence of facial images.
Protection Method
Protection Target
Alert Raising
Acc. Retention
No Protection
—
✓ (Facial Image)
✓
Federated Learning Guan et al. (2024) ; Liu et al. (2024)
Training Data
—
✓
Differential Privacy Abadi et al. (2016)
Training Data
—
✓
Encryption Kim et al. (2021a)
Testing Data
✓ (Noise)
✓
Distortion Gaudio et al. (2023)
Testing Data
✓ (Distorted Facial Image)
✗
Anonymization Li et al. (2021)
Testing Data
✓ (Facial Image)
✗
Table 1: Comparison between StegaFFD and other prominent privacy-protection approaches ensuring the security and privacy of facial images during their training, transmission, and analysis processes. The plaintext or encrypted forms of information may raise alerts among malicious actors.
Figure 2: Illustration of the detailed structure of the proposed StegaFFD. (a) Client-side image hiding network H(⋅) hides facial secret images into natural cover images for privacy-preserving transmission. (b) Server-side Detector analyzes stego images directly in the steganographic domain to lift facial features by ML for forgery detection. (c) SDA branch enhances detector training by aligning steganographic-domain features with raw facial features lifted by ML′ , improving forgery detection accuracy. This branch operates exclusively during training and is omitted during deployment.
Figure 3: Illustration of (a) the server-side network M(⋅) of the proposed LFAD and SFDA. The feature lifting network contains LFAD and SFDA, which extracts high-frequency steganographic features containing facial information. (b) SDA branch M′(⋅) helps to lift secret facial features by aligning stego-domain features with raw facial features.
Privacy Preserving
Type
FFD Detector
Cross Domain Evaluation
CDFv1
CDFv2
DFD
DFDC
DFDCP
Fsh
UADFV
Avg.
Top-3
None
Plain
Xception
74.85
75.97
82.11
69.19
68.11
59.48
88.01
73.96
—
None
Plain
Meso4
63.69
55.65
52.97
58.89
49.03
52.90
59.05
56.03
—
None
Plain
MesoIncep
70.84
70.02
59.80
60.16
74.57
69.21
89.78
70.63
—
None
Freq.
F3Net
62.91
64.89
83.88
66.61
70.84
72.66
77.76
71.36
—
Falco
Plain
Xception
69.12
65.41
59.49
58.54
61.92
54.98
51.48
60.13
0
Table 2: Cross-domain evaluations using the AUC (%) metric. All detectors are trained on FF-c23 and evaluated on other data. “Avg.” denotes the average AUC for within-domain and cross-domain evaluation, and the overall results. “Top-3” represents the count of each method’s ranks within the top-3 across all testing datasets. “Freq.” denotes the frequency type. Privacy Preserving method include (i) unprotected (None), (ii) an anonymization method (Falco Barattin et al. (2023) ), (iii) existing steganography method (HiNet Jing et al. (2021b) to BalujaNet Baluja (2019) ). The best-performing method for each column is highlighted in red and the top three are shown in bold .
Figure 4: Visual attribution analysis of face forgery detection algorithms (i.e., StegaFFD, Xception Rossler et al. (2019) , Meso4 Afchar et al. (2018) , MesoIncep Afchar et al. (2018) , and F3Net Qian et al. (2020) ) using Grad-CAM++, highlighting feature focus on cover and secret image regions (e.g., facial forgery areas).
Figure 5: Robust attribution analysis of face forgery detection across varied cover images for a single facial instance and failure cases. This figure illustrates Grad-CAM++ attribution heatmaps highlighting feature focus on cover and secret image regions (e.g., facial forgery areas).
Figure 6: Quantitative attribution analysis using violin plots comparing attention to embedded face regions versus natural backgrounds across detectors. StegaFFD exhibits a markedly larger face–natural separation than the four baselines, indicating stronger, more consistent focus on face content.
Image Pair
PSNR ↑
SSIM ↑
xcover/xstego
32.46
0.86
xsecret/xstego
10.38
0.41
Table 3: Similarity metrics PSNR and SSIM for image pairs xcover/xstego and xsecret/xstego , demonstrating StegaFFD’s imperceptibility.
Figure 7: Comparison of imperceptibility between StegaFFD and anonymization-based methods. StegaFFD hides facial information within natural images, achieving higher imperceptibility, while anonymization-based methods introduce face forgery features, leading to reduced FFD accuracy.
Variation
CDFv1
CDFv2
of SFDA
AUC ↑
ACC ↑
AP ↑
EER ↓
AUC ↑
ACC ↑
AP ↑
EER ↓
LFAD
53.04
38.36
54.05
47.38
58.18
34.22
61.72
44.43
HFAD
64.15
65.33
62.84
39.48
60.44
64.78
65.64
40.10
w/o DWT
73.20
62.24
81.57
32.00
71.46
66.12
73.51
33.77
StegaFFD
81.22
71.25
86.93
24.85
72.43
70.68
82.95
26.62
Table 4: Ablation results for SFDA variants on CDFv1 and CDFv2 datasets. All metrics in the table are presented as percentages.
SDA Loss
AUC ↑
ACC ↑
AP ↑
EER ↓
None
72.57
62.21
79.04
31.92
FA(l2) loss
73.20
63.99
75.46
34.33
AA(sda) loss
70.88
66.35
78.49
36.24
FA(l2)+AA(l2) loss
75.31
63.23
81.96
30.25
FA(sda)+AA(sda) loss
79.65
65.63
84.35
27.09
FA(l2)+AA(sda) loss
81.22
71.25
86.93
24.85
Table 5: Ablation study on SDA Loss formulations for StegaFFD on CDFv1 datasets. All metrics in the table are presented as percentages.
LoD
CDFv1
CDFv2
UADFV
w/
w/o
w/
w/o
w/
w/o
AUC ↑
81.22
77.15
72.43
72.41
73.63
71.47
ACC ↑
71.25
64.28
70.68
68.34
63.51
60.65
AP ↑
86.93
76.60
82.95
75.81
74.85
73.12
EER ↓
24.85
34.24
26.62
37.22
27.85
26.87
Table 6: Comparison of detection performance with and without LoD across CDFv1, CDFv2, and UADFV datasets. All metrics in the table are presented as percentages.
DIH
CDFv1
CDFv2
UADFV
Network
AUC ↑
EER ↓
AUC ↑
EER ↓
AUC ↑
EER ↓
HiNet Jing et al. (2021b)
75.88
30.34
63.22
40.58
75.49
25.15
BalujaNet Baluja (2019)
66.61
38.07
66.92
38.04
69.54
31.67
WengNet Weng et al. (2019)
72.56
34.49
66.19
38.96
65.00
37.23
HiDDeN Zhu et al. (2018)
81.22
24.85
72.43
26.62
73.63
27.85
Table 7: Performance comparison of DIH networks across datasets using AUC and EER Metrics. All metrics in the table are presented as percentages.
The rapid advancement of diffusion-based generative models has made face forgery detection a critical challenge in digital forensics. Current detection methods face two fundamental limitations: poor cross-domain generalization when encountering unseen forgery types, and substantial computational overhead that hinders deployment on resource-constrained devices. We propose LRD-Net (Lightweight Real-centered Detection Network), a novel framework that addresses both challenges simultaneously. Unlike existing dual-branch approaches that process spatial and frequency information independently, LRD-Net adopts a sequential frequency-guided architecture where a lightweight Multi-Scale Wavelet Guidance Module generates attention signals that condition a MobileNetV3-based spatial backbone. This design enables effective exploitation of frequency-domain cues while avoiding the redundancy of parallel feature extraction. Furthermore, LRD-Net employs a real-centered learning strategy with exponential moving average prototype updates and drift regularization, anchoring representations around authentic facial images rather than modeling diverse forgery patterns. Extensive experiments on the DiFF benchmark demonstrate that LRD-Net achieves state-of-the-art cross-domain detection accuracy, consistently outperforming existing methods. Critically, LRD-Net accomplishes this with only 2.63M parameters - approximately 9x fewer than conventional approaches - while achieving over 8x faster training and nearly 10x faster inference. These results demonstrate that robust cross-domain face forgery detection can be achieved without sacrificing computational efficiency, making LRD-Net suitable for real-time deployment in mobile authentication systems and resource-constrained environments.
Xuecen Zhang, Vipin Chaudhary
Department of Computer and Data Sciences, Case Western Reserve University, Cleveland, OH, USA
Continual face forgery detection (CFFD) requires detectors to learn emerging forgery paradigms without forgetting previously seen manipulations. Existing CFFD methods commonly rely on replaying a small amount of past data to mitigate forgetting. Such replay is typically implemented either by storing a few historical samples or by synthesizing pseudo-forgeries from detector-dependent perturbations. Under strict memory budgets, the former cannot adequately cover diverse forgery cues and may expose facial identities, while the latter remains strongly tied to past decision boundaries. We argue that the core role of replay in CFFD is to reinstate the distributions of previous forgery tasks during subsequent training. To this end, we directly condense the discrepancy between real and fake distributions and leverage real faces from the current stage to perform distribution-level replay. Specifically, we introduce Distribution-Discrepancy Condensation (DDC), which models the real-to-fake discrepancy via a surrogate factorization in characteristic-function space and condenses it into a tiny bank of distribution discrepancy maps. We further propose Manifold-Consistent Replay (MCR), which synthesizes replay samples through variance-preserving composition of these maps with current-stage real faces, yielding samples that reflect previous-task forgery cues while remaining compatible with current real-face statistics. Operating under an extremely small memory budget and without directly storing raw historical face images, our framework consistently outperforms prior CFFD baselines and significantly mitigates catastrophic forgetting. Replay-level privacy analysis further suggests reduced identity leakage risk relative to selection-based replay.
The rapid advancement of deepfakes necessitates robust face forgery detection. Although forged faces may lack obvious artifacts, they often contain subtle disharmony among different facial regions. We propose SGF-CDNet, a Consistency-Discrepancy Graph Network (CD-GNN) over Semantic-Geometric Fused (SGF) nodes. First, SGF-CDNet constructs SGF nodes by deeply fusing semantic regions from face parsing with geometric information from facial landmarks, allowing nodes to capture both high-level concepts and precise geometric constraints. Next, a dual-path CD-GNN performs parallel relational reasoning on these nodes across two dimensions: consistency and discrepancy. The consistency path evaluates if facial components follow natural biological patterns, while the discrepancy path mines for structural tensions and feature conflicts introduced by forgeries. By integrating these processes, our model effectively identifies disharmonious relationships between facial components. Extensive experiments on public datasets demonstrate that SGF-CDNet achieves superior performance, establishing it as a reliable solution for face forgery detection.
Jiayao Jiang, Bin Liu, Nenghai Yu
School of Cyber Science and Technology, University of Science and Technology of China, China · Anhui Province Key Laboratory of Digital Security, China