Remote identity verification assumes that a camera stream shows a live person, yet public real-time face-swap tools can replace that person before the stream reaches the verifier. Passive deepfake detectors generalize poorly to new generators, while interactive challenges are often selected without evidence of which gestures expose current attacks. We evaluate randomized gesture challenges in 108 live sessions with six subjects, 24 impersonated identities, and two face-swap tools, DeepFaceLive and FaceFusion, injected through a virtual camera. The static calibration segment reaches a session-level AUC of 0.878 with a frozen UCF spatial detector, while the mean across the active-gesture windows reaches 0.988. Pose and combined gestures have the highest point estimates, whereas expressions show no clear improvement. Hand occlusion against FaceFusion, configured with an occlusion mask, scores below the static baseline. The end-to-end time required to satisfy the validator also distinguishes attacks from genuine sessions, achieving a session-level AUC of 0.732, although this signal includes synthesis and transport delays. These results show that challenge sets should be tested against current attack configurations and that response time can provide an additional, deployment-specific signal.
Figures & tables
Figure 1: The verification pipeline: a passive branch (blue) scores frames for deepfake artifacts while an interactive branch (orange) validates randomized, time-bounded challenges; the decision logic fuses both.
Figure 2: Per-session raw spatial score on the Hold Still baseline (x) versus the mean across the active-gesture windows (y). Points above the diagonal have a higher score during active capture than during calibration.
DeepFaceLive
FaceFusion
Category
AUC
Δ vs. baseline [CI]
AUC
Δ vs. baseline [CI]
Hold Still (baseline)
0.847
—
0.910
—
Expression
0.871
+0.024 [ −0.079 , +0.097 ]
0.924
+0.015 [ −0.054 , +0.094 ]
Pose
0.927
+0.080 [ −0.013 , +0.166 ]
0.943
+0.033 [ −0.036 , +0.083 ]
Occlusion
0.882
+0.035 [ −0.051 , +0.085 ]
0.840
−0.069 [ −0.180 , −0.017 ]
Complex
0.932
+0.085 [ −0.002 , +0.185 ]
0.867
−0.043 [ −0.142 , +0.024 ]
Table 1: Raw UCF AUC by gesture category and paired difference from Hold Still . Intervals use a subject-clustered bootstrap and are unadjusted for multiplicity; only the FaceFusion occlusion contrast has a 95 % interval that excludes zero.
Figure 3: Time to satisfy the challenge validator per gesture category. Attack sessions shift right across all categories, most strongly for occlusion and complex actions.
Face Presentation Attack Detection identifies spoofing attempts, such as printed, replayed, masked, or digitally altered faces, targeting face recognition systems.
This paper presents DF-CAPTCHA, an active defense against real-time deepfake impersonation in voice and video calls. Instead of passively searching for artifacts, DF-CAPTCHA prompts the caller to perform simple challenge-response tasks that are easy for humans but difficult for current real-time deepfake systems to generate convincingly. The framework verifies the response using four criteria: realism, identity consistency, task completion, and response time. We evaluate the approach across both audio and video modalities using user studies and experiments with real-time deepfake models. Results show that people often struggle to distinguish real-time deepfakes from authentic media, while DF-CAPTCHA substantially improves detection performance over passive methods, reaching high accuracy in both modalities. These findings suggest that active challenge-based verification is a practical and robust defense against next-generation social engineering attacks based on real-time deepfakes.
Guy Frankovits, Lior Yasur, Fred M. Grabovski +1
Ben-Gurion University, 1 Ben-Gurion Ave., Beersheba 8410501, Israel
Deepfake technologies have rapidly advanced with modern generative AI, and face swapping in particular poses serious threats to privacy and digital security. Existing proactive defenses mostly rely on pixel-level perturbations, which are ineffective against contemporary swapping models that extract robust high-level identity embeddings. We propose ID-Eraser, a feature-space proactive defense that removes identifiable facial information to prevent malicious face swapping. By injecting learnable perturbations into identity embeddings and reconstructing natural-looking protection images through a Face Revive Generator (FRG), ID-Eraser produces visually realistic results for humans while rendering the protected identities unusable for Deepfake models. Experiments show that ID-Eraser substantially disrupts identity recognition across diverse face recognition and swapping systems under strict black-box settings, achieving the lowest Top-1 accuracy (0.30) with the best FID (1.64) and LPIPS (0.020). Compared with swaps generated from clean inputs, the identity similarity of protected swaps drops sharply to an average of 0.504 across five representative face swapping models. ID-Eraser further demonstrates strong cross-dataset generalization, robustness to common distortions, and practical effectiveness on commercial APIs, reducing Tencent API similarity from 0.76 to 0.36.
Junyan Luo, Peipeng Yu, Jianwei Fei +4
Jinan University Guangzhou, China · University of Florence Florence, Italy · Dongguan University of Technology Dongguan, China
Face-swapping deepfakes pose an escalating threat to personal privacy by enabling unauthorized identity manipulation. While adversarial approaches have demonstrated success against black-box face recognition (FR) models, their applicability to face-swapping scenarios remains underexplored. In particular, reliance on fixed or random targets yields ambiguous latent guidance, and the lack of explicit spatial constraints causes perturbations to spill into identity-irrelevant regions. These issues are further exacerbated by identity-style disentanglement, which suppresses adversarial signals during deepfake generation. In this paper, we present Phantom, a unified face-swap deepfake protection framework that jointly constrains perturbations in latent and spatial domains. Phantom adaptively synthesizes identity-shifted yet attribute-preserving targets to guide identity-aware latent optimization, and applies masked perturbations confined to semantically relevant facial regions. Extensive experiments on state-of-the-art face-swapping deepfakes demonstrate that Phantom improves protection success rates in dodging scenarios by 27.8%, 25.6%, and 16.6% on UniFace, INSwapper, and SimSwap, respectively, while also enhancing visual quality. Furthermore, Phantom generalizes to impersonation scenario, yielding up to 10.2% higher protection while improving perceptual fidelity. These results underscore the effectiveness of jointly leveraging latent and spatial constraints for robust and coherent facial privacy protection.