Contents
You cannot stop every deepfake of your face, because anyone with a few public photos of you can attempt one. What you can do is degrade the pipeline that produces convincing fakes at several steps: cloak your face so recognition systems struggle to find and group photos of you, protect the images you do post so they resist being fine-tuned or edited, and pair that with monitoring and legal recourse. As with every protection on this site, each layer raises cost rather than guaranteeing safety. For cloned voices rather than faces, see how to protect your voice from AI cloning.
Separate likeness from style and voice
A likeness threat is not the same as an art-style threat. Glaze and Nightshade target style mimicry in art models; the tools here target your face. It is also not the same as a voice threat, which has its own tools in DeFake, AntiFake and Voice Guard, explained. This guide is about visual likeness: face photos, profile images, headshots, and pictures that help someone recognize, locate or impersonate you. The realistic goal is to break the chain that leads to a face deepfake, which runs from scraping your photos, to recognizing and collecting more of you, to fine-tuning a model on your face, to generating or editing images.
| Layer | Tool or step | Limit |
|---|---|---|
| Cloak against recognition | Fawkes, LowKey | Weakens if clean photos leak |
| Protect posted photos | Anti-DreamBooth, PhotoGuard, FaceShield | Platform JPEG strips much of it |
| Non-technical | Limit face shots, takedown, legal recourse | Mostly acts after the fact |
Cloak your face against recognition
Face cloaks add a perturbation to your photos that shifts how a facial-recognition model sees you, so a system cannot reliably match your images or gather more of them. Fawkes (Shan, Wenger, Zhang, Li, Zheng, Zhao, USENIX Security 2020), from the same University of Chicago lab behind Glaze, adds what its authors call “imperceptible pixel-level changes (‘cloaks’)” and reports “95+% protection” against models trained on cloaked photos. LowKey (Cherepanova, Goldblum, Foley, Duan, Dickerson, Taylor, Goldstein, ICLR 2021) is built for commercial systems and reports degrading Amazon Rekognition and the Microsoft Azure Face API “to below 1%,” with rank-1 recognition falling from 93.7% to 0.6% on Rekognition and from 90.5% to 0.1% on Azure. These target the recognition step, which is what lets someone find and assemble a training set of your face in the first place.
Protect the photos you do post
For images you publish, a second class of tools disrupts the fine-tuning and editing that turn photos into deepfakes. Anti-DreamBooth (Van Le, Phung, Nguyen, Dao, Tran, Tran, ICCV 2023) targets personalization: it “aims to add subtle noise perturbation to each user’s image before publishing in order to disrupt the generation quality of any DreamBooth model trained on these perturbed images.” PhotoGuard (Salman, Khaddaj, Leclerc, Ilyas, Mądry, ICML 2023) immunizes a photo against AI image-to-image and inpainting edits, so an attempt to alter it produces a visibly broken result. MetaCloak (Liu, Fan, Dai, Chen, Zhou, Sun, CVPR 2024) hardens the personalization defense against simple transforms, and FaceShield (Jeong, In, Kim et al., ICCV 2025) is a dedicated defense against diffusion-model deepfakes.
The non-technical layer
Technical cloaks are only part of it. Limit the number of high-resolution, front-on face photos you post publicly, since those are the ideal training input, and keep a clean, dated original private so you can prove a public image came from you. Search for misuse of your likeness periodically, and use platform reporting routes when you find it. Many places recognize a right of publicity or personality right over commercial use of your image, and most large platforms now have reporting paths for non-consensual or synthetic intimate imagery, but these vary widely by country and platform and mostly act after the fact, so treat them as recourse rather than prevention and check what applies where you live.
Why face cloaks are deterrents, not walls
Assume a face cloak can be weakened. Fawkes itself reports that when clean, uncloaked photos of you leak to a tracker, protection falls to an “80+% protection success rate,” so a cloak only helps if most of your public images carry it. LowKey exists precisely because earlier cloaks “fail on full-scale systems and commercial APIs,” a reminder that a tool validated on one system can fail on another. The editing defenses have a known weak point too: a 2026 study by Fardin, Alam and Fahim found that PhotoGuard, Anti-DreamBooth and MetaCloak lose 60 to 80% of their protective signal to the JPEG compression that every major platform applies before an image is ever downloaded. Recognition and generation models also keep improving, so a cloak that works today may not next year.
Protecting your likeness is the same layered game as protecting art or a voice: cloak your face against recognition, protect the photos you post against fine-tuning and editing, keep high-resolution face shots scarce, and know your after-the-fact recourse. No single layer is a wall, and any one of them may be removable, but together they make a convincing deepfake of you slower and more expensive to build. For voice deepfakes, see DeFake, AntiFake and Voice Guard, explained; for how these tools hold up overall, see the AI poisoning tools scorecard.
Sources
- Shan, Wenger, Zhang, Li, Zheng, Zhao (2020). Fawkes: Protecting Privacy against Unauthorized Deep Learning Models. USENIX Security 2020.
- Cherepanova, Goldblum, Foley, Duan, Dickerson, Taylor, Goldstein (2021). LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition. ICLR 2021.
- Van Le, Phung, Nguyen, Dao, Tran, Tran (2023). Anti-DreamBooth: Protecting Users from Personalized Text-to-Image Synthesis. ICCV 2023.
- Salman, Khaddaj, Leclerc, Ilyas, Mądry (2023). Raising the Cost of Malicious AI-Powered Image Editing (PhotoGuard). ICML 2023.
- Liu, Fan, Dai, Chen, Zhou, Sun (2024). MetaCloak: Preventing Unauthorized Subject-driven Text-to-image Diffusion-based Synthesis via Meta-learning. CVPR 2024.
- Jeong, In, Kim (2025). FaceShield: Defending Facial Image against Deepfake Threats. ICCV 2025.
- Fardin, Alam, Fahim (2026). MetaCloak-JPEG: JPEG-Robust Adversarial Perturbation for Preventing Unauthorized DreamBooth-Based Deepfake Generation.
New protection tests, breakdowns and how-long-does-it-hold checks. No spam, unsubscribe anytime.