SimSwap: High-Fidelity Face Swapping

• SimSwap is a GAN-based face swapping framework that achieves arbitrary identity swap by injecting a source face into a target image while retaining its facial attributes.
• It features an encoder, an ID Injection Module with Adaptive Instance Normalization in ID-Blocks, and an identity-agnostic decoder for flexible targeting.
• The framework employs multi-term objectives including weak feature matching loss to balance effective identity transfer with preservation of attributes such as expression, pose, and lighting.

SimSwap (“Simple Swap”) is a GAN-based face swapping framework for high-fidelity arbitrary face swapping: given a source face image and a target face image, it generates an output whose identity matches the source while preserving the target’s facial attributes such as expression, pose, gaze direction, and lighting (Chen et al., 2021). In the taxonomy of face deepfakes, SimSwap belongs to identity swap rather than expression swap or reenactment, because its purpose is to replace the identity of a target face with the source identity while preserving the target’s pose/expression-related attributes (Fernando et al., 13 Feb 2025). Its defining technical ideas are an ID Injection Module (IIM) for arbitrary-identity conditioning and a Weak Feature Matching Loss for target-attribute preservation (Chen et al., 2021).

1. Taxonomic position and problem setting

The face-deepfake taxonomy summarized in the 2025 survey divides generation methods into four categories: (i) synthesising the entire face, (ii) identity swap, (iii) attribute manipulation, and (iv) expression swap (Fernando et al., 13 Feb 2025). SimSwap is placed in identity swap, and the survey distinguishes this category from reenactment methods that encode source identity and target motion separately and decode the source animated by target motion (Fernando et al., 13 Feb 2025).

In SimSwap’s formulation, the problem is to take a source face image $I_S$ and a target face image $I_T$, and to generate a swapped image $I_R$ in which the person looks like the source identity but retains the target’s non-identity facial properties (Chen et al., 2021). The original paper states three major requirements for practical face swapping: generalization to arbitrary identities, strong identity transfer from source, and preservation of target attributes such as expression, head pose, gaze, and lighting (Chen et al., 2021).

This positioning is significant because earlier target-oriented methods often failed in one of two ways: they were identity-specific and could only swap among fixed trained identities, or they generalized to arbitrary identities but insufficiently preserved expression, pose, and gaze (Chen et al., 2021). The survey accordingly describes SimSwap as “another notable GAN-based architecture in face swapping”, emphasizing that it is “generalisable to arbitrary faces” and that it “preserves the facial expression and gaze direction of the target face during the swapping process” (Fernando et al., 13 Feb 2025).

2. Generator design and identity injection

SimSwap uses a target-oriented generator with three parts: Encoder, ID Injection Module (IIM), and Decoder (Chen et al., 2021). The target image is first encoded into a feature representation,

$Fea_T = Enc(I_T),$

while the source identity is extracted by a pretrained face-recognition network, specifically ArcFace,

$v_S = \text{ArcFace}(I_S).$

The decoder then reconstructs the swapped image from target features that have been modified by the IIM: $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$ This decomposition is the central architectural distinction of SimSwap (Chen et al., 2021).

The original paper argues that DeepFakes-like models fail to generalize because identity information is embedded in identity-specific decoder weights. SimSwap moves identity conditioning out of the decoder and into an intermediate feature modulation stage, so the decoder becomes identity-agnostic and reusable for arbitrary identities (Chen et al., 2021). The survey compresses the same point by identifying the pivotal contribution as an “ID injection module” that “transfers the identity information of the source face into a feature representation that the decoder uses in the decoding process” (Fernando et al., 13 Feb 2025).

The IIM itself contains ID-Blocks, described as modified residual blocks in which Batch Normalization is replaced with Adaptive Instance Normalization (AdaIN) (Chen et al., 2021). The AdaIN operation is given as

$$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$

where $\mu(Fea)$ and $\sigma(Fea)$ are the channel-wise mean and standard deviation of the feature, and $\mu_S,\sigma_S$ are parameters generated from $I_T$0 using fully connected layers (Chen et al., 2021). The paper states that it uses a total of 9 ID-Blocks to ensure sufficient identity embedding (Chen et al., 2021).

This design explains why SimSwap is regarded as an arbitrary face-swapping framework rather than an identity-specific one. Identity is supplied dynamically as an input embedding instead of being baked into decoder parameters, which makes arbitrary-identity swapping a conditional feature-modulation problem (Chen et al., 2021). Later implementation-focused work retained this overall structure and continued to describe SimSwap as an efficient encoder-decoder generator with an identity injection module (Patil et al., 8 Aug 2025).

3. Objective functions and optimization

SimSwap combines identity preservation, target-attribute preservation, realism, and self-reconstruction through a multi-term objective (Chen et al., 2021). The original paper gives five components: Identity Loss, Reconstruction Loss, Adversarial Loss, Gradient Penalty, and Weak Feature Matching Loss (Chen et al., 2021). The 2025 survey summarizes the training process as leveraging adversarial loss, reconstruction loss, identity loss, and weak feature matching loss (Fernando et al., 13 Feb 2025).

The identity term uses cosine distance between the ArcFace embedding of the result $I_T$1 and the source identity embedding $I_T$2: $I_T$3 Its role is to push the generated face identity toward the source identity (Chen et al., 2021). The reconstruction term is applied only when source and target are the same identity: $I_T$4 This regularizes the model and discourages unnecessary changes when identity transfer is not needed (Chen et al., 2021).

The most characteristic auxiliary term is the Weak Feature Matching Loss. Starting from full discriminator feature matching, SimSwap replaces the unavailable swapped-face ground truth with the target image $I_T$5, and matches only the last discriminator layers: $I_T$6 with the multi-scale sum

$I_T$7

The “weak” aspect is not a small coefficient but the exclusion of shallow layers, so the output is constrained semantically without forcing low-level texture similarity to the target (Chen et al., 2021).

The full objective is

$I_T$8

with

$I_T$9

The paper states that it uses hinge adversarial loss, multi-scale discriminators, and Adam with $I_R$0 and $I_R$1 (Chen et al., 2021).

Training is performed on VGGFace2. Images smaller than $I_R$2 are removed; faces are aligned and cropped to a standard position; and the final training resolution is $I_R$3 (Chen et al., 2021). Batches alternate between source-target pairs with the same identity and pairs with different identities, and training lasts for more than 500 epochs (Chen et al., 2021). This setup is central to SimSwap’s weakly supervised character: self-reconstruction supplies direct image-level supervision only in the same-identity case (Chen et al., 2021).

4. Empirical behavior, comparative performance, and failure modes

On FaceForensics++, the original paper evaluates identity transfer by ID retrieval and target-attribute preservation by a posture metric (Chen et al., 2021). The reported results are: DeepFakes $I_R$4 ID retrieval and $I_R$5 posture; FaceShifter $I_R$6 and $I_R$7; SimSwap-oFM $I_R$8 and $I_R$9; SimSwap $Fea_T = Enc(I_T),$0 and $Fea_T = Enc(I_T),$1; and SimSwap-nFM $Fea_T = Enc(I_T),$2 and $Fea_T = Enc(I_T),$3 (Chen et al., 2021). These numbers support the paper’s central claim that weak feature matching provides a balance between identity transfer and attribute preservation: removing feature matching improves identity retrieval but worsens posture, while original feature matching preserves posture but damages identity transfer (Chen et al., 2021).

The 2025 survey places SimSwap in an appendix table of face-swap methods with the following summary: Input features: Facial images; Architecture: GAN; Performance: FaceForensics++ 8.04 (EFD), 11.76 (FID); Strengths: “Effective injection of source identity”; Weaknesses: “Cannot handle occlusions. Limited resolution in the synthesised faces” (Fernando et al., 13 Feb 2025). The survey also states that SimSwap is better described as an image-based method than a landmark-driven one (Fernando et al., 13 Feb 2025).

The original paper repeatedly emphasizes better preservation of expression, gaze direction, and lighting than FaceShifter and FSGAN, while also noting a trade-off between identity and attributes (Chen et al., 2021). One ablation finding is that increasing the identity loss too much can cause overfitting and even bring in source hair, which is undesirable because only the face should change (Chen et al., 2021). The survey’s compact assessment is consistent with this pattern: SimSwap is credited with preserving target expression and gaze direction, but it is not presented as solving occlusion handling or high-resolution realism (Fernando et al., 13 Feb 2025).

In later implementation-focused work, the baseline SimSwap design is again characterized as efficient and practical, but still subject to the usual trade-off: preserving source identity can harm target attributes, visual artifacts still occur, and difficult cases include extreme poses, occlusions, and challenging lighting (Patil et al., 8 Aug 2025). This suggests that the original balance achieved by IIM and weak feature matching remained useful, but not definitive, as later systems pushed toward finer identity detail and higher resolution.

5. Forensic interpretation and biometric implications

The 2025 survey directly names SimSwap in its biometric evaluation and states: “Our evaluations demonstrate that deepfake methods such as Wav2Lip, SimSwap, and first-order model are capable of fooling biometric recognition systems, especially the lightweight systems such as MobileNet.” (Fernando et al., 13 Feb 2025) The evaluation uses a face-verification success metric,

$Fea_T = Enc(I_T),$4

and the cosine similarity score

$Fea_T = Enc(I_T),$5

Here $Fea_T = Enc(I_T),$6 is the face-recognition feature extractor, $Fea_T = Enc(I_T),$7 is the enrolled image, $Fea_T = Enc(I_T),$8 is the target or probe image, and $Fea_T = Enc(I_T),$9 is the decision threshold (Fernando et al., 13 Feb 2025).

Against five recognition backbones, the survey reports the following SimSwap results: irse50: success rate 1.00 / 1.00 / 1.00 at FAR @01/@001/@0001, similarity 0.96; Facenet: 0.97 / 0.91 / 0.85, similarity 0.89; Mobile Face: 1.00 / 1.00 / 1.00, similarity 0.97; ir152: 1.00 / 0.99 / 0.98, similarity 0.88; Deep Face: 0.95 / 0.89 / 0.83, similarity 0.79 (Fernando et al., 13 Feb 2025). The survey identifies this as a significant concern because lightweight systems are commonly used in mobile unlocking, app login, payment gateways, and social-media tagging (Fernando et al., 13 Feb 2025).

The same survey also provides the most relevant generic forensic framing for SimSwap-generated swaps. Especially relevant cues for face-swapping methods are feature point defects caused by smoothing and blending, 3D head-pose inconsistency between central and outer facial landmarks, facial symmetry inconsistencies, texture artifacts and irregular frequency-domain traces, and biological or behavioral inconsistencies if subtle expressions or dynamics are perturbed (Fernando et al., 13 Feb 2025). The survey does not state that a particular detector “detects SimSwap” explicitly, but because SimSwap is reviewed as a face-swapping GAN, these are the recommended forensic cues for this category (Fernando et al., 13 Feb 2025).

6. Extensions, plug-ins, and competing formulations

Subsequent work has treated SimSwap both as a baseline to improve and as a representative of a broader global-feature paradigm. The implementation-focused extension “MotionSwap” keeps the SimSwap backbone structure and ArcFace identity supervision, but adds self-attention, cross-attention, dynamic weighting of selected loss terms, and cosine annealing learning-rate scheduling (Patil et al., 8 Aug 2025). In the reported comparison, baseline SimSwap obtains identity similarity $v_S = \text{ArcFace}(I_S).$0 and FID $v_S = \text{ArcFace}(I_S).$1, whereas the enhanced model reaches identity similarity $v_S = \text{ArcFace}(I_S).$2 and FID $v_S = \text{ArcFace}(I_S).$3 (Patil et al., 8 Aug 2025). Within the attention ablation, the best configuration is the combination of self-attention and cross-attention, with identity $v_S = \text{ArcFace}(I_S).$4, attribute consistency $v_S = \text{ArcFace}(I_S).$5, and FID $v_S = \text{ArcFace}(I_S).$6 (Patil et al., 8 Aug 2025).

ReliableSwap addresses a different SimSwap weakness: the reliance on reconstruction as a proxy task when source and target differ, which leaves the network without image-level supervision for true cross-identity swaps (Yuan et al., 2023). It introduces cycle triplets as reliable supervision and FixerNet as a lower-face identity extractor (Yuan et al., 2023). On FaceForensics++, the authors’ reproduced SimSwap baseline has ID Ret. $v_S = \text{ArcFace}(I_S).$7, L Ret. $v_S = \text{ArcFace}(I_S).$8, Pose $v_S = \text{ArcFace}(I_S).$9, and Exp. $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$0, while ReliableSwap built on SimSwap reaches ID Ret. $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$1, L Ret. $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$2, Pose $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$3, and Exp. $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$4 (Yuan et al., 2023). The especially large gain in lower-face retrieval reflects the paper’s claim that SimSwap-style systems tend to underconstrain mouth shape, jawline, and lower-face contour (Yuan et al., 2023).

E4S offers a more explicit conceptual alternative. It argues that methods like SimSwap, FaceShifter, and HiFiFace rely on single global identity features from face-recognition models and therefore omit local visual cues that matter for perceived identity (Li et al., 2023). E4S instead performs swapping in StyleGAN latent space using regional style codes and semantic masks (Li et al., 2023). In the CelebAMask-HQ comparison reported there, SimSwap obtains CosFace Top-1 11.73, CosFace Top-5 26.09, CosFace similarity 0.3665, BlendFace Top-1 75.68, BlendFace similarity 0.5164, Pose 2.892, Expression 2.129, FID 22.41, and resolution $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$5; E4S reports CosFace Top-1 42.42, CosFace Top-5 58.22, CosFace similarity 0.3829, BlendFace Top-1 75.02, BlendFace similarity 0.5684, Pose 3.281, Expression 0.881, FID 9.02, and resolution $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$6 (Li et al., 2023). This comparison is presented as evidence that SimSwap represents a simpler, lighter, target-oriented regime, whereas regional editing methods pursue finer identity detail and higher-resolution realism (Li et al., 2023).

7. SimSwap as a benchmark in proactive defense research

By 2026, SimSwap had also become a standard downstream attack model in proactive face-protection work. Phantom treats SimSwap as one of three face-swapping systems used to test whether privacy-preserving perturbations survive an actual swap pipeline (Kim et al., 30 Jun 2026). In Phantom’s framing, ordinary adversarial protections often weaken under face swapping because swappers disentangle identity from style and may discard perturbations placed in peripheral or stylistic regions (Kim et al., 30 Jun 2026). On CelebA-HQ, clean images have near-zero protection success rate against SimSwap, averaging 0.007, whereas Phantom reaches 0.964 average PSR; on LADN, clean images average 0.000, whereas Phantom reaches 0.934 (Kim et al., 30 Jun 2026). The paper highlights gains of 16.6 percentage points on CelebA-HQ and 17.4 percentage points on LADN over the best baselines for SimSwap (Kim et al., 30 Jun 2026).

AEGIS uses SimSwap even more directly, evaluating it in both white-box and black-box proactive defense settings (Li et al., 2 Apr 2026). For face swapping, AEGIS defines defense success as

$I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$7

where lower identity similarity between the protected person and the manipulated output indicates stronger defense (Li et al., 2 Apr 2026). Against white-box SimSwap, AEGIS reports on CelebA: $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$8, ID sim $I_R = Dec(\mathrm{IIM}(Fea_T, v_S)).$9, DSR $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$0; on FFHQ: $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$1, ID sim $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$2, DSR $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$3; and on LFW: $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$4, ID sim $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$5, DSR $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$6 (Li et al., 2 Apr 2026). In black-box SimSwap, AEGIS reports DSR $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$7, compared with RUIP: DSR $$AdaIN(Fea,v_{S})=\sigma_{S}\frac{Fea-\mu(Fea)}{\sigma(Fea)}+\mu_{S},$$8 (Li et al., 2 Apr 2026). Its robustness table further gives SimSwap post-processing AUCs of 0.983 / 0.954 / 0.976 / 0.982, average 0.974, for JPEG compression, Gaussian blur, average blur, and downscaling (Li et al., 2 Apr 2026).

This later literature shows that SimSwap occupies two roles simultaneously. It remains a historically important arbitrary face-swapping method built around decoder-side identity injection and weak feature matching (Chen et al., 2021), and it functions as a realistic downstream generator in security and privacy research, where the persistence of identity transfer, perturbation removal, and biometric risk can be measured directly (Fernando et al., 13 Feb 2025).