[ICCV 2025] FaceShield: Defending Facial Image
against Deepfake Threats

Jaehwan Jeong¹, Sumin In¹, Sieun Kim¹, Hannie Shin¹,
Jongheon Jeong¹, Sang Ho Yoon², Jaewook Chung³, Sangpil Kim<sup>1†

1</sup>Korea University,   ²KAIST,   ³Samsung Research

🔍 TL;DR

We present FaceShield, a novel and imperceptible noise injection method that protects facial images from unauthorized use by disrupting a wide range of deepfake models—including both diffusion- and GAN-based approaches. It achieves state-of-the-art robustness, high imperceptibility, and strong transferability across datasets.

⚙️ Installation

Tested on Ubuntu 22.04 + CUDA 12.4 + Python 3.8 (RTX A6000)

git clone https://github.com/kuai-lab/iccv25_faceshield.git
cd iccv25_faceshield
conda env create -f environment.yaml
conda activate faceshield

📂 Model Setup

To prepare the pre-trained weights for inference, follow these steps:

Note: All pretrained weights used here are from publicly available sources.
We only reorganized them to match the codebase structure, without modifying the original weights.

1. Download the ArcFace pre-trained weights from ArcFace Pretrained Weights link.

2. Extract the downloaded ArcFace and place it in the ./models directory. Your directory structure should look like this:

   iccv25_faceshield/
   ├── models/
   │   ├── arcface50_checkpoint.tar/
   │   ├── arcface100_checkpoint.tar/
   │   ├── arcface_models.py/
   │   ├── config.py/
   ├── attack.py/
   ├── ddpwrapper.py
   └── ...

🛡️ Run the Protection

🛠️ run.sh: FaceShield Noise Injection Configuration

To run the protective noise generation with default settings, execute:

sh run.sh

You can customize the behavior by editing the variables inside run.sh as shown below:

# run.sh

image_path="data/test"           # Input image folder path
save_path="results"              # Directory where results will be saved
resize_shape=512                 # Resize input image to (512, 512)

proj_func="l1"                   # Projection loss type (e.g., l1, l2)
attn_func="l2"                   # Attention loss type (e.g., l1, l2)
attn_threshold=0.2               # Threshold for attention masking
arc_func="cosine"                # ArcFace loss type (e.g., cosine, l2)

total_iter=30                    # PGD total iterations
noise_clamp=12                   # Max allowed noise (L∞ norm)
step_size=1                      # Step size for each PGD iteration

# Execute attack with specified parameters
sh execute.sh $save_path $resize_shape $proj_func $attn_func $attn_threshold \
              $arc_func $total_iter $noise_clamp $step_size $image_path

📜 Citation

@InProceedings{Jeong_2025_ICCV,
    author    = {Jeong, Jaehwan and In, Sumin and Kim, Sieun and Shin, Hannie and Jeong, Jongheon and Yoon, Sang Ho and Chung, Jaewook and Kim, Sangpil},
    title     = {FaceShield: Defending Facial Image against Deepfake Threats},
    booktitle = {Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)},
    month     = {October},
    year      = {2025},
    pages     = {10364-10374}
}

Our code is based on these wonderful repos:

• Stable Diffusion
• CLIP
• MTCNN
• ArcFace