Skip to content
Computational Pathology Reading Roadmap

Writing study: NullSwap: Proactive Identity Cloaking Against Deepfake Face Swapping

← ICCV 2025 oral writing corpus

Tianyi Wang, Shuaicheng Niu, Harry Cheng, Xiao Zhang, Yinglong Wang · Official ICCV 2025 oral record

Figure, table and section ledger

Editorial contribution type: Domain-grounded methods & physical systems (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF
10 physical pages
Before references / appendix
≈ 8.1 page-equivalents
Main figures / tables
3 / 5
Attached appendix figures / tables
0 / 0
Attached appendix span
No boundary detected; not assumed zero
Before references / appendix: ≈ 81%References / intervening material: ≈ 19%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Extraction notes: No attached appendix boundary detected. Zero means no recognized caption, not independently verified absence.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level headingStarts on PDF pageEstimated spanShare of entire PDF
1. Introduction1≈ 1.2 pp.12%
2. Related Work2≈ 0.71 pp.7.1%
3. Method3≈ 2.38 pp.23.8%
4. Experiments5≈ 3.12 pp.31.2%
5. Conclusion8≈ 0.24 pp.2.4%
Acknowledgments9≈ 0.05 pp.0.5%
References9≈ 1.9 pp.19%
All detected figure and table locations

Main text

Attached appendix

    No recognized caption labels.

    Argument and organization

    1. 1 Introduction; 2 Related Work

      Reframes protection around the source identity and identifies fidelity, transfer and generative-model access as distinct constraints.

    2. 3 Method

      Defines source/target identity roles before feature-guided reconstruction, dynamic loss weights and image/identity objectives.

    3. 4 Experiments; 5 Conclusion

      Separates visual fidelity, source recognition, swapped-output similarity, unseen datasets and loss-balancing controls.

    Problem, claim and contribution

    The source-identity versus edited-target distinction is made explicit before architecture, clarifying exactly which entity the defense seeks to protect.

    Sections 1 and 3.1, physical pp.1–3 · Main paper

    Argument and section order

    The experiment sequence follows the two competing objectives: preserve the protected image, then test identity disruption on original and swapped outputs.

    Sections 4.2.1–4.2.2, pp.5–7 · Main paper

    Figures, captions and visual explanation

    The overview separates the identity/perturbation branch from shallow image features and the reconstruction branch, making the departure from direct pixel addition visible.

    Figure 2, p.3 · Main paper

    Tables, comparisons and evidence

    The cross-model table keeps ArcFace and VGGFace evaluation columns distinct, while the LFW table explains omission of a baseline requiring unavailable attributes.

    Tables 3–4, p.7 · Main paper

    Appendix and reproducibility

    No substantive supplement roadmap was located in the main body; dataset, loss and recognition-tool settings are presented directly in Sections 3.4 and 4.1. A separately linked source, if present in the inventory, remains uninspected.

    Sections 3.4–4.1, p.5; conclusion, p.8 · Main paper

    Clarity and writing conventions

    The text distinguishes recognition models used in training from unseen test recognizers, which is essential context for its black-box generative-model claim.

    Section 4.2.2, p.6 · Main paper

    What to reuse—and what not to infer

    Transferable lesson: State protection target and model-access assumptions before presenting defense scores, then separate imperceptibility from attack disruption.

    Boundary: Black-box here excludes face-swapping generators from training but still uses pretrained recognition tools. Lower embedding similarity is not a universal guarantee against identity misuse, adaptive attacks, image transformations or human recognition.

    Apply this lesson using the argument and evidence worksheet.

    Inspection record and sources

    Checked
    2026-10-07
    Reading status
    Writing-focused manuscript scan + selected visuals inspected
    Main text
    Writing-oriented scan across the main manuscript, physical PDF pp.1–8, covering framing, section progression, method explanations, captions, comparison protocols and concluding scope; reference boundary checked. Selected full-page rasters were inspected. Not exhaustive line-by-line reading, proof verification or experimental reproduction.
    Appendix / supplement
    Main-paper appendix/supplement references and the reference boundary were checked. No separate supplementary link appears in this dated CVF inventory; this does not establish that no supplementary material exists elsewhere.
    Visually inspected PDF pages
    3, 7

    This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.