Spring 2024Computer Vision, ML Model, Front-end

Refract

A cloaking model that protects your face from deepfakes.

Deepfake abuse does not only happen to celebrities. Refract adds invisible pixels to your photos, but disruptive to deepfake models trying to learn your likeness after scraping online.

Role: Design lead and front-end, in a team of five
Tech stack: Python, Hugging Face, TypeScript, React
Outcome: 2nd place, Annual Data Science Competition @ UCSB
Links: Source on GitHub

Random noise doesn't cut. We need to attack the embeddings.

We started by adding random noise. However, random pixel-level distortion is trivial for a training pipeline to average out, so it protects nothing.

Deepfake models work from facial feature embeddings, the numbers that encode what makes your face yours.

Method: Optimizing to minimize visual difference (L2 norm) and maximize embedding difference (LPIPS)

Inspired by Glaze, which protects artists' styles by encoding embeddings of a different one in their work, our version does the same thing to a face. The model picks a different face from our database and cloaks the original with a thin layer of that face's feature embeddings, tuned so the source looks like the target to a machine and unchanged to a person.

Scraping real faces without consent was against the nature of this project, so we generated 500 faces from thispersondoesnotexist.com to train the model for our data.

I wrote Python scripts that:

scraped for the 500 face database
pulled feature embeddings with Hugging Face
searched and picked the target face with most similar embeddings to the original

Poster showing the Refract methodology and workflow — Poster we presented at the competition.

Visual branding and learning TypeScript

Figma prototyping process for Refract — Figma prototyping to test interaction before code. This was before vibe-coding was good enough to speed up this process.

I worked with another member on the branding colour and typography. We built the system in Figma, then implemented the front-end. It was my first time writing TypeScript, and I learned a lot about React here.

$Refract brand book showing colour and type$

2.56× more effective at fooling deepfake models

75.67%: Cloaked image similarity to the target face
29.57%: Cloaked image similarity to the original face
2.56×: More effective at fooling deepfake models

The original face photograph — Measured across all 500 images by Euclidean distance in embedding space. To a person these are the same photograph.

The same face after cloaking — Measured across all 500 images by Euclidean distance in embedding space. To a person these are the same photograph.

Make the data cheap to take and worthless to have

Most people have posted a photograph of their face somewhere public, which means most people are already in the training data of something. Refract is small, but it points at the right defence: make the thing scrapers want cheap to take and worthless to have.

The Refract team on stage at the Annual Data Science Competition at UCSB — Second place at the Annual Data Science Competition at UCSB, spring 2024.