StegaFFD: Privacy-Preserving Face Forgery Detection via Fine-Grained Steganographic Domain Lifting

Guoqing Ma; Xun Lin; Hui Ma; Ajian Liu; Yizhong Liu; Wenzhong Tang; Shan Yu; Chenqi Kong

cs.CVMar 3, 2026

StegaFFD: Privacy-Preserving Face Forgery Detection via Fine-Grained Steganographic Domain Lifting

Authors: Guoqing Ma, Xun Lin, Hui Ma, Ajian Liu, Yizhong Liu, Wenzhong Tang, Shan Yu, Chenqi Kong,

Organizations: Institute of Automation, Chinese Academy of Sciences, Beijing 100190, China. · School of Future Technology, University of Chinese Academy of Sciences, Beijing 100049, China. · Beihang University, Beijing 100191, China. · Macau University of Science and Technology, Macau SAR 999078, China. ·

Abstract

Most existing Face Forgery Detection (FFD) models assume access to raw face images. In practice, under a client-server framework, private facial data may be intercepted during transmission or leaked by untrusted servers. Previous privacy protection approaches, such as anonymization, encryption, or distortion, partly mitigate leakage but often introduce severe semantic distortion, making images appear obviously protected. This alerts attackers, provoking more aggressive strategies and turning the process into a cat-and-mouse game. Moreover, these methods heavily manipulate image contents, introducing degradation or artifacts that may confuse FFD models, which rely on extremely subtle forgery traces. Inspired by advances in image steganography, which enable high-fidelity hiding and recovery, we propose a Stega}nography-based Face Forgery Detection framework (StegaFFD) to protect privacy without raising suspicion. StegaFFD hides facial images within natural cover images and directly conducts forgery detection in the steganographic domain. However, the hidden forgery-specific features are extremely subtle and interfered with by cover semantics, posing significant challenges. To address this, we propose Low-Frequency-Aware Decomposition (LFAD) and Spatial-Frequency Differential Attention (SFDA), which suppress interference from low-frequency cover semantics and enhance hidden facial feature perception. Furthermore, we introduce Steganographic Domain Alignment (SDA) to align the representations of hidden faces with those of their raw counterparts, enhancing the model's ability to perceive subtle facial cues in the steganographic domain. Extensive experiments on seven FFD datasets demonstrate that StegaFFD achieves strong imperceptibility, avoids raising attackers' suspicion, and better preserves FFD accuracy compared to existing facial privacy protection methods.

Figures & tables

Figure 1: Different client-server frameworks for FFD, including (a) vanilla, (b) encryption-based, (c) anonymization-based, and (d) the proposed StegaFFD framework. Our StegaFFD makes the attacker fail to notice the existence of facial images.

Protection Method	Protection Target	Alert Raising	Acc. Retention
No Protection	—	✓ (Facial Image)	✓
Federated Learning Guan et al. (2024) ; Liu et al. (2024)	Training Data	—	✓
Differential Privacy Abadi et al. (2016)	Training Data	—	✓
Encryption Kim et al. (2021a)	Testing Data	✓ (Noise)	✓
Distortion Gaudio et al. (2023)	Testing Data	✓ (Distorted Facial Image)	✗
Anonymization Li et al. (2021)	Testing Data	✓ (Facial Image)	✗

Table 1: Comparison between StegaFFD and other prominent privacy-protection approaches ensuring the security and privacy of facial images during their training, transmission, and analysis processes. The plaintext or encrypted forms of information may raise alerts among malicious actors.

Figure 2: Illustration of the detailed structure of the proposed StegaFFD. (a) Client-side image hiding network $\mathcal{H}(\cdot)$ hides facial secret images into natural cover images for privacy-preserving transmission. (b) Server-side Detector analyzes stego images directly in the steganographic domain to lift facial features by $\mathcal{M}_{L}$ for forgery detection. (c) SDA branch enhances detector training by aligning steganographic-domain features with raw facial features lifted by $\mathcal{M}^{\prime}_{L}$ , improving forgery detection accuracy. This branch operates exclusively during training and is omitted during deployment.

Figure 3: Illustration of (a) the server-side network $\mathcal{M}(\cdot)$ of the proposed LFAD and SFDA. The feature lifting network contains LFAD and SFDA, which extracts high-frequency steganographic features containing facial information. (b) SDA branch $\mathcal{M}^{\prime}(\cdot)$ helps to lift secret facial features by aligning stego-domain features with raw facial features.

Privacy Preserving	Type	FFD Detector	Cross Domain Evaluation
Privacy Preserving	Type	FFD Detector	CDFv1	CDFv2	DFD	DFDC	DFDCP	Fsh	UADFV	Avg.	Top-3
None	Plain	Xception	74.85	75.97	82.11	69.19	68.11	59.48	88.01	73.96	—
None	Plain	Meso4	63.69	55.65	52.97	58.89	49.03	52.90	59.05	56.03	—
None	Plain	MesoIncep	70.84	70.02	59.80	60.16	74.57	69.21	89.78	70.63	—
None	Freq.	F3Net	62.91	64.89	83.88	66.61	70.84	72.66	77.76	71.36	—
Falco	Plain	Xception	69.12	65.41	59.49	58.54	61.92	54.98	51.48	60.13	0

Table 2: Cross-domain evaluations using the AUC (%) metric. All detectors are trained on FF-c23 and evaluated on other data. “Avg.” denotes the average AUC for within-domain and cross-domain evaluation, and the overall results. “Top-3” represents the count of each method’s ranks within the top-3 across all testing datasets. “Freq.” denotes the frequency type. Privacy Preserving method include (i) unprotected (None), (ii) an anonymization method (Falco Barattin et al. (2023) ), (iii) existing steganography method (HiNet Jing et al. (2021b) to BalujaNet Baluja (2019) ). The best-performing method for each column is highlighted in red and the top three are shown in bold .

Figure 4: Visual attribution analysis of face forgery detection algorithms (i.e., StegaFFD, Xception Rossler et al. (2019) , Meso4 Afchar et al. (2018) , MesoIncep Afchar et al. (2018) , and F3Net Qian et al. (2020) ) using Grad-CAM++, highlighting feature focus on cover and secret image regions (e.g., facial forgery areas).

Figure 5: Robust attribution analysis of face forgery detection across varied cover images for a single facial instance and failure cases. This figure illustrates Grad-CAM++ attribution heatmaps highlighting feature focus on cover and secret image regions (e.g., facial forgery areas).

Figure 6: Quantitative attribution analysis using violin plots comparing attention to embedded face regions versus natural backgrounds across detectors. StegaFFD exhibits a markedly larger face–natural separation than the four baselines, indicating stronger, more consistent focus on face content.

Image Pair	PSNR $\uparrow$	SSIM $\uparrow$
$\boldsymbol{x}_{cover}/\boldsymbol{x}_{stego}$	32.46	0.86
$\boldsymbol{x}_{secret}/\boldsymbol{x}_{stego}$	10.38	0.41

Table 3: Similarity metrics PSNR and SSIM for image pairs

\boldsymbol{x}_{cover}/\boldsymbol{x}_{stego}

and

\boldsymbol{x}_{secret}/\boldsymbol{x}_{stego}

, demonstrating StegaFFD’s imperceptibility.

Figure 7: Comparison of imperceptibility between StegaFFD and anonymization-based methods. StegaFFD hides facial information within natural images, achieving higher imperceptibility, while anonymization-based methods introduce face forgery features, leading to reduced FFD accuracy.

Variation	CDFv1				CDFv2
of SFDA	AUC $\uparrow$	ACC $\uparrow$	AP $\uparrow$	EER $\downarrow$	AUC $\uparrow$	ACC $\uparrow$	AP $\uparrow$	EER $\downarrow$
LFAD	53.04	38.36	54.05	47.38	58.18	34.22	61.72	44.43
HFAD	64.15	65.33	62.84	39.48	60.44	64.78	65.64	40.10
w/o DWT	73.20	62.24	81.57	32.00	71.46	66.12	73.51	33.77
StegaFFD	81.22	71.25	86.93	24.85	72.43	70.68	82.95	26.62

Table 4: Ablation results for SFDA variants on CDFv1 and CDFv2 datasets. All metrics in the table are presented as percentages.

SDA Loss	AUC $\uparrow$	ACC $\uparrow$	AP $\uparrow$	EER $\downarrow$
None	72.57	62.21	79.04	31.92
FA(l2) loss	73.20	63.99	75.46	34.33
AA(sda) loss	70.88	66.35	78.49	36.24
FA(l2)+AA(l2) loss	75.31	63.23	81.96	30.25
FA(sda)+AA(sda) loss	79.65	65.63	84.35	27.09
FA(l2)+AA(sda) loss	81.22	71.25	86.93	24.85

Table 5: Ablation study on SDA Loss formulations for StegaFFD on CDFv1 datasets. All metrics in the table are presented as percentages.

LoD	CDFv1		CDFv2		UADFV
LoD	w/	w/o	w/	w/o	w/	w/o
AUC $\uparrow$	81.22	77.15	72.43	72.41	73.63	71.47
ACC $\uparrow$	71.25	64.28	70.68	68.34	63.51	60.65
AP $\uparrow$	86.93	76.60	82.95	75.81	74.85	73.12
EER $\downarrow$	24.85	34.24	26.62	37.22	27.85	26.87

Table 6: Comparison of detection performance with and without LoD across CDFv1, CDFv2, and UADFV datasets. All metrics in the table are presented as percentages.

DIH	CDFv1		CDFv2		UADFV
Network	AUC $\uparrow$	EER $\downarrow$	AUC $\uparrow$	EER $\downarrow$	AUC $\uparrow$	EER $\downarrow$
HiNet Jing et al. (2021b)	75.88	30.34	63.22	40.58	75.49	25.15
BalujaNet Baluja (2019)	66.61	38.07	66.92	38.04	69.54	31.67
WengNet Weng et al. (2019)	72.56	34.49	66.19	38.96	65.00	37.23
HiDDeN Zhu et al. (2018)	81.22	24.85	72.43	26.62	73.63	27.85

Table 7: Performance comparison of DIH networks across datasets using AUC and EER Metrics. All metrics in the table are presented as percentages.

Image Forgery Detection

Image Forgery Detection studies how to identify manipulated or synthetic images and locate the visual evidence of tampering.

See all 126 papers

LRD-Net: A Lightweight Real-Centered Detection Network for Cross-Domain Face Forgery Detection
Apr 13, 2026Xuecen Zhang, Vipin ChaudharyDeepfake Detection
Department of Computer and Data Sciences, Case Western Reserve University, Cleveland, OH, USA
Direct Discrepancy Replay: Distribution-Discrepancy Condensation and Manifold-Consistent Replay for Continual Face Forgery Detection
Apr 14, 2026Tianshuo Zhang, Haoyuan Zhang, Siran Peng +3Deepfake Detection Replay-Based Continual Learning
SAI, UCAS · MAIS, CASIA · IIE, CAS +2
SGF-CDNet: A Consistency-Discrepancy Graph Network over Semantic-Geometric Fused Nodes for Face Forgery Detection
Jul 4, 2026Jiayao Jiang, Bin Liu, Nenghai YuGraph Neural Networks Image Forgery Detection
School of Cyber Science and Technology, University of Science and Technology of China, China · Anhui Province Key Laboratory of Digital Security, China

Apr 13, 2026J/K move · Enter open · S save

LRD-Net: A Lightweight Real-Centered Detection Network for Cross-Domain Face Forgery Detection

Xuecen Zhang, Vipin Chaudhary

Department of Computer and Data Sciences, Case Western Reserve University, Cleveland, OH, USA

Deepfake Detection

Open paper AskPDF arXiv

The rapid advancement of diffusion-based generative models has made face forgery detection a critical challenge in digital forensics. Current detection methods face two fundamental limitations: poor cross-domain generalization when encountering unseen forgery types, and substantial computational overhead that hinders deployment on resource-constrained devices. We propose LRD-Net (Lightweight Real-centered Detection Network), a novel framework that addresses both challenges simultaneously. Unlike existing dual-branch approaches that process spatial and frequency information independently, LRD-Net adopts a sequential frequency-guided architecture where a lightweight Multi-Scale Wavelet Guidance Module generates attention signals that condition a MobileNetV3-based spatial backbone. This design enables effective exploitation of frequency-domain cues while avoiding the redundancy of parallel feature extraction. Furthermore, LRD-Net employs a real-centered learning strategy with exponential moving average prototype updates and drift regularization, anchoring representations around authentic facial images rather than modeling diverse forgery patterns. Extensive experiments on the DiFF benchmark demonstrate that LRD-Net achieves state-of-the-art cross-domain detection accuracy, consistently outperforming existing methods. Critically, LRD-Net accomplishes this with only 2.63M parameters - approximately 9x fewer than conventional approaches - while achieving over 8x faster training and nearly 10x faster inference. These results demonstrate that robust cross-domain face forgery detection can be achieved without sacrificing computational efficiency, making LRD-Net suitable for real-time deployment in mobile authentication systems and resource-constrained environments.

Abstract

Image Forgery Detection

Explore similar work

LRD-Net: A Lightweight Real-Centered Detection Network for Cross-Domain Face Forgery Detection

Direct Discrepancy Replay: Distribution-Discrepancy Condensation and Manifold-Consistent Replay for Continual Face Forgery Detection

SGF-CDNet: A Consistency-Discrepancy Graph Network over Semantic-Geometric Fused Nodes for Face Forgery Detection