Diffusion-Guided Adversarial Perturbation Injection for Generalizable Defense Against Facial Manipulations

Abstract: Recent advances in GAN and diffusion models have significantly improved the realism and controllability of facial deepfake manipulation, raising serious concerns regarding privacy, security, and identity misuse. Proactive defenses attempt to counter this threat by injecting adversarial perturbations into images before manipulation takes place. However, existing approaches remain limited in effectiveness due to suboptimal perturbation injection strategies and are typically designed under white-box assumptions, targeting only simple GAN-based attribute editing. These constraints hinder their applicability in practical real-world scenarios. In this paper, we propose AEGIS, the first diffusion-guided paradigm in which the AdvErsarial facial images are Generated for Identity Shielding. We observe that the limited defense capability of existing approaches stems from the peak-clipping constraint, where perturbations are forcibly truncated due to a fixed $L_\infty$-bounded. To overcome this limitation, instead of directly modifying pixels, AEGIS injects adversarial perturbations into the latent space along the DDIM denoising trajectory, thereby decoupling the perturbation magnitude from pixel-level constraints and allowing perturbations to adaptively amplify where most effective. The extensible design of AEGIS allows the defense to be expanded from purely white-box use to also support black-box scenarios through a gradient-estimation strategy. Extensive experiments across GAN and diffusion-based deepfake generators show that AEGIS consistently delivers strong defense effectiveness while maintaining high perceptual quality. In white-box settings, it achieves robust manipulation disruption, whereas in black-box settings, it demonstrates strong cross-model transferability.

• The paper demonstrates that latent-space adversarial perturbation injection guided by DDIM effectively disrupts facial manipulations across both white-box and black-box regimes.
• It achieves state-of-the-art defense success rates (up to 100%) while maintaining visual imperceptibility and robust identity protection.
• It decouples perturbation strength from traditional pixel-level constraints, opening new pathways for proactive deepfake defense and multimedia security.

Diffusion-Guided Adversarial Defense Against Facial Manipulation: The AEGIS Framework

Introduction and Motivation

The proliferation of high-fidelity facial manipulation via GAN and especially diffusion models has escalated privacy and identity misuse concerns. Existing defenses—primarily passive detection frameworks—are inherently reactive, susceptible to adversarial bypass, and insufficient to prevent initial harm. Recently, research has shifted towards proactive perturbation-based defenses, but these typically operate under constraining $L_\infty$ pixel-norms (introducing the peak-clipping constraint) and are narrowly designed for white-box GAN-based attribute editing. This restricts their defense strength, visual imperceptibility, and applicability across manipulation types or realistic black-box threat models.

To address these gaps, "Diffusion-Guided Adversarial Perturbation Injection for Generalizable Defense Against Facial Manipulations" (2604.01635) introduces AEGIS: a paradigm-shifting, diffusion-guided adversarial defense capable of disrupting GAN- and diffusion-based face manipulations across white-box and black-box environments. Unlike prior works, AEGIS injects perturbations in the latent denoising trajectory, decoupling perturbation effectiveness from pixel-level constraints and exploiting the DDIM noise-refinement process for both imperceptibility and disruption.

Figure 1: Taxonomy of defense: AEGIS is uniquely compatible with both white-box and black-box proactive defense against deepfakes.

Problem Formulation and Threat Model

The proactive defense scenario assumes the defender can only publish perturbed facial images; the adversary manipulates these using arbitrary deepfake generators (GAN, diffusion-based), optionally with pre-processing countermeasures (scaling, blur, compression). The goals are: (1) maximize manipulation disruption (defense success rate—DSR), (2) maintain imperceptibility, and (3) minimize residual identity cues (mitigating stigmatization and misuse). AEGIS’ generality is demonstrated under both white-box (full gradient access) and black-box (only model output queries) conditions.

Methodology: Diffusion-Guided Perturbation Injection

DDIM-Based Latent Space Perturbation

AEGIS leverages a pre-trained DDIM; the input face is forward-diffused to a noisy latent, then reconstructed via the reverse denoising process, during which adversarial perturbations—guided by either gradients (white-box) or NES-based gradient estimates (black-box)—are injected at each denoising step. This approach naturally regulates and self-adapts perturbation strength to semantic saliency, obviating the need for fixed pixel-wise bounds.

Figure 2: AEGIS pipeline: Adversarial gradients are injected into the DDIM denoising path, allowing scalable application to both white-box and black-box defense.

In the white-box setting, adversarial objectives maximize output discrepancy between original and manipulated images (using MSE or identity loss, depending on task), and optimization balances manipulation disruption and perceptual fidelity via a gradient projection strategy. In the black-box setting, Natural Evolution Strategies are used for query-efficient gradient estimation, maintaining effectiveness without gradient access.

Experimental Results

White-box Defense: Attribute Editing & Face Swapping

AEGIS consistently achieves state-of-the-art DSR (up to 100%) across StarGAN, HiSD, and SimSwap (see full numerical evidence in the manuscript and visual effectiveness in Figure 3), and generally outperforms or matches the strongest prior art on AttGAN despite (intentionally) lower pixel-space disruption (see Table 2). Importantly, AEGIS exhibits increased robustness to image degradations; it sustains top DSR under compression, blur, or downscaling, whereas competitors degrade rapidly (see AUC results in Table 4 and DSR curves in Figure 4).

Figure 3: AEGIS yields stronger semantic disruption than SOTA baselines in white-box DSR benchmarks.

AEGIS-generated perturbations are visually imperceptible (see Figure 5; PSNR/SSIM/LPIPS metrics confirm negligible visual degradation), a property the diffusion-based injection naturally confers even as defense strength is maximized.

Figure 5: White-box imperceptibility—AEGIS adversarial images remain indistinguishable from originals.

Black-box Defense: Generalization, Transferability, and Diffusion-based Threats

AEGIS' gradient-free method obtains superior or competitive DSR to specialized GAN-only defenses (e.g., RUIP, Venom), while uniquely achieving robust identity protection (minimal ID sim) and transferability. On black-box SimSwap, AEGIS is the only process yielding nonzero DSR, and in cross-model transfer, consistently outperforms competitors, including on attention-based architectures prone to defeats in other work.

Figure 6: In black-box attribute editing, AEGIS renders outputs unintelligible, significantly suppressing identity leakage as measured by ID sim.

Figure 7: Black-box face swapping—AEGIS prevents convincing recombination, unlike RUIP or unprotected images.

For the first time, black-box defense against diffusion-based identity-preserving forgeries (Arc2Face) is demonstrated: AEGIS achieves DSR=100% and ID sim=0.07 (Table 11; Figure 8), indicating complete de-identification, whereas previous GAN-focused defenses do not apply.

Figure 8: AEGIS fully obfuscates identity in diffusion-based (Arc2Face) synthesis—unprecedented for proactive defense.

Ablation: Diffusion Dynamics, Stepwise Injection, and Gradient Schemes

Comprehensive ablation shows: (1) moderate forward/denoising step counts in DDIM optimize trade-offs between perturbation preservation and output fidelity; (2) injecting adversarial signals from early denoising stages maximizes disruption; (3) gradient projection stabilizes defense/quality objectives, significantly boosting DSR under post-processing attacks.

Implications and Future Directions

Theoretically, AEGIS reveals that $L_\infty$-bounded pixel perturbations fundamentally limit proactive defense capability against semantic manipulation. Latent-space injection along generative trajectories (here, the DDIM denoising path) provides a principled route to decouple visual imperceptibility from adversarial effectiveness without retraining—a significant capability in practical environments where model internals and threat vectors are rapidly evolving.

Practically, AEGIS’s framework supports unified deployment in both white-box and black-box regimes, robustly covering GAN- and diffusion-based pipelines, and all major manipulation types (attribute editing, face swapping, and ID-preserving synthesis). The only explicit limitation is computational overhead in black-box mode, a known cost of query-based defenses.

Future AI security research should further improve sample efficiency for gradient estimation, explore input-dependent adaptive injection strategies, and address adversarial countermeasures such as advanced purification or multi-model fusion; techniques for efficient online operation and defense stacking are pressing research directions.

Conclusion

AEGIS introduces a diffusion-guided adversarial defense strategy, breaking the limitations of $L_\infty$ pixel perturbation and supporting generalization to arbitrary (including diffusion-based) facial manipulation, both in white-box and black-box scenarios (2604.01635). Empirical results establish best-in-class robustness, transferability, and imperceptibility—realizing a step-change in proactive deepfake defense by operationalizing latent-space adversarial injection. The paradigm is well-poised for generalization to other generative models and broader multimedia security applications.