Video Identifying and Eraser: Use Multi-Task Cascaded Convolutional Neural Network to Enhance Safety in a Text-to-Video Diffusion Model

Abstract

Current security solutions predominantly rely on cloud-based implementations, often neglecting computational resource constraints and operational efficiency. While contemporary methodologies typically require additional training, the few that operate without retraining frequently yield suboptimal performance. To address these limitations, this work leverages a pre-trained MTCNN architecture to detect faces of copyright-protected individuals. We construct a facial landmark database comprising five critical fiducial points, which serves as a supplementary module integrated into the stable diffusion framework, enabling real-time security filtering for synthesized video content. The proposed system utilizes MTCNN models pre-trained in the cloud to build a repository of copyrighted facial signatures, generating a geometric parameter database of facial landmarks. This database, coupled with a parallel verification unit, functions as a plugin within the standard Stable Diffusion pipeline. By leveraging Stable Diffusion’s native decoder, we decode stochastic frames from the U-Net latent representations and perform real-time comparative analysis to identify potential copyright violations in generated video sequences. Upon detecting an infringement, an on-screen display (OSD) alert notifies the user and immediately halts the text-to-video (T2V) generation process. Experimental evaluations demonstrate that our framework effectively mitigates the resource constraints and latency issues inherent in edge deployment scenarios of prior security implementations. Leveraging MTCNN’s proven robustness and extensive edge compatibility for facial recognition, the proposed detection and obfuscation plugin integrates seamlessly with Stable Diffusion while preserving generation quality.

1. Introduction

Recent text-to-video diffusion models [1,2,3] demonstrate strong capabilities in synthesizing high-fidelity videos from natural language prompts. Specifically, Stable Video Diffusion (SVD) emerges as a leading framework for generating coherent video sequences from text or image prompts [2]. With open-source releases, these models are now widely accessible and rapidly reshape digital content creation. However, this progress also raises urgent challenges regarding privacy protection, copyright compliance, and content integrity [4,5].

A key vulnerability stems from the prevailing practice of training on internet-scale datasets that are only weakly curated. Such corpora inevitably contain copyrighted works and identifiable personal imagery, which diffusion models may reproduce during generation. In practice, this leads to multiple risks, including the replication of protected styles, the production of unauthorized derivatives, and the leakage of identity signals. More critically, realistic synthetic videos of public figures can be weaponized for impersonation and disinformation [6,7]. Furthermore, harmful or inappropriate content may arise even without explicit malicious intent due to ambiguous prompts and distribution artifacts.

Existing safety strategies for diffusion models largely follow two directions. Input or output filtering attaches a moderation module to the generation pipeline without modifying the base model; this enables fast deployment and flexible policy updates. However, it remains post hoc, may miss subtle infringements such as identity leakage or stylistic mimicry, adds inference latency, and is susceptible to prompt obfuscation. Model-intrinsic safety embeds constraints into the generative process through fine-tuning or constraint-aware training. While often more robust, this approach typically requires curated data and significant compute resources for retraining, may reduce creative coverage, and makes post-deployment policy adaptation difficult.

In this work, we aim to achieve an inline intervention that is as deployable as filtering but operates during generation and requires no retraining. We propose a plug-and-play framework for real-time face protection in text-to-video (T2V) diffusion. Our method integrates a lightweight MTCNN-based (Multi-task Cascaded Convolutional Network) face detector [8] (for alignment and masking localization) into the Stable Diffusion inference pipeline. During denoising, we intercept intermediate U-Net states, decode frame-level latent representations for analysis, and identify facial regions for protection using compact facial landmark geometry. When a face region is detected, we apply an on-screen display (OSD) overlay to obfuscate the sensitive facial region and then inject the modified representation back into the latent space, allowing denoising to continue and converge to a compliant output.

Our main contributions are as follows:

• We introduce a plug-and-play framework that performs real-time face protection inside the text-to-video diffusion inference loop, providing an inline alternative to purely post-processing-based filtering without retraining the diffusion model.
• We develop a zero-shot integration of MTCNN-based face detection into Stable Diffusion inference, enabling efficient detection and intervention while preserving the original generative capability.
• We propose a compact landmark-based face alignment method using five fiducial points, which supports efficient masking localization and robust screening under common variations.
• We conduct comprehensive experiments on SVD-generated video sequences, evaluating both frame-level detection accuracy and video-level safety success rates, demonstrating effective protection with minimal additional latency in practical T2V settings.

2. Related Work

2.1. Diffusion Models for Controllable Generation and Identity-Centric Synthesis

Diffusion models generate samples by iteratively denoising from noise, and latent diffusion improves efficiency by performing this process in a compact latent space while preserving high fidelity [1]. Building on this paradigm, recent work advances controllable diffusion for diverse creation and editing tasks. For instance, IMAGEdit enables flexible subject-driven transformation [9], while IMAGHarmony achieves controllable editing with consistent object quantity and layout [10]. In the domain of fashion and human-centric synthesis, IMAGGarment-1 introduces fine-grained garment generation for fashion design [11], and Imagpose provides a unified conditional framework for pose-guided person generation [12,13]. Furthermore, Imagdressing-v1 explores the potential of customizable virtual dressing [14]. In parallel, diffusion-based video generation also applies to face-centric synthesis, where identity preservation and temporal coherence are essential. A representative work is the motion-prior conditional diffusion model, which facilitates high-quality long-term talking face generation [15]. However, these video generation methods focus on improving fidelity and controllability without addressing the safety and privacy risks inherent in generating recognizable portraits. While these advancements improve fidelity and controllability, they also facilitate the generation of recognizable portraits, thereby increasing privacy and copyright risks and motivating the need for safety mechanisms that can deploy with minimal friction.

Our work is complementary to these controllable diffusion frameworks. Rather than modifying the diffusion model to improve editability or identity fidelity, we introduce an inference-time safety intervention that monitors intermediate denoising states and applies targeted edits to sensitive regions. Our method is specifically designed for the T2V pipeline, where frame-level processing aligns with the low-frame-count characteristics of SVD (typically 14–25 frames per clip). This design avoids retraining and can be retrofitted to existing diffusion implementations.

2.2. Facial Recognition and Safety Mechanisms for Generative Models

Face detection and landmark localization are core primitives for recognition and moderation pipelines. MTCNN is a widely adopted solution due to its computational efficiency and accuracy, utilizing a cascaded architecture for proposal, refinement, and output prediction of bounding boxes and landmarks [8]. Landmark-based representations provide compact geometric signatures for fast identity screening, which is particularly suitable for real-time settings. In our framework, we leverage MTCNN to obtain reliable face regions and key landmarks, using this geometry to localize facial regions for protection with low overhead inside the diffusion process.

More broadly, safety for generative models has been studied through post hoc filtering, model fine-tuning-based alignment, and monitoring-based defenses [5]. Filtering approaches are easy to deploy and update, but they operate after generation and may miss subtle infringements or be bypassed by prompt obfuscation. Training-based approaches embed constraints into the model but require curated data and substantial compute resources, making post-deployment policy updates costly. Our approach targets a different point in the design space by providing a lightweight, modular, inference-time mechanism that leverages pre-trained detectors and requires no additional training, while intervening during denoising to prevent sensitive portrait content from fully forming in the output.

3. Proposed Method

3.1. System Overview

Our approach modifies the standard diffusion pipeline by inserting a controlled intervention during the denoising phase. As illustrated in Figure 1, at a selected timestep t, we extract the current noisy latent from the U-Net and decode it into pixel space using the Stable Diffusion decoder. We then apply a lightweight partial denoising operation to enhance visual clarity for analysis. Subsequently, we detect face regions using MTCNN [8] and perform facial region localization against a protected identity set. If a protected identity is confirmed, we apply an on-screen display (OSD) mask to obfuscate the sensitive facial region. The masked image is then encoded back into latent space and re-noised to match the noise level at timestep t. Finally, we resume diffusion sampling from timestep t with the modified latent, continuing the denoising process to generate the final masked video. This process applies to each frame in the video sequence, ensuring comprehensive temporal coverage for text-to-video (T2V) safety.

• Sampling (Latent Extraction): At a designated diffusion timestep t, we extract the current noisy latent representation ${\mathbf{z}}_t$ from U-Net. This latent code contains the semantic information generated up to step t.
• Decoding (Latent-to-Pixel): The latent ${\mathbf{z}}_t$ decodes into pixel space using the SD VAE decoder to obtain an intermediate image ${\mathbf{x}}_t=\mathcal{D}\left({\mathbf{z}}_t\right)$. This conversion is necessary as facial detection algorithms operate in pixel space.
• Preprocessing (Partial Denoising): Since ${\mathbf{x}}_t$ may contain significant noise at early timesteps, we apply a lightweight partial denoising filter to enhance structural clarity, facilitating robust feature detection.
• Detection & Verification: The preprocessed image feeds into the MTCNN network to detect facial bounding boxes. Identity verification ensures the protection mechanism applies only to authorized subjects.
• Masking (OSD Application): Upon successful verification, an on-screen display (OSD) mask is generated and applied to the facial regions. This creates a modified pixel image ${\mathbf{x}}_t^{\prime }$, where sensitive features are obscured according to Equation (5).
• Re-insertion (Pixel-to-Latent): The masked image ${\mathbf{x}}_t^{\prime }$ re-encodes into latent space via the VAE encoder, yielding ${\widehat{\mathbf{z}}}_t=\mathcal{E}\left({\mathbf{x}}_t^{\prime }\right)$. To maintain consistency with the diffusion trajectory, noise is re-injected to match the variance schedule of timestep t:

  $${\mathbf{z}}_t^{\prime }=\sqrt{{\overline{\alpha }}_t}{\widehat{\mathbf{z}}}_t+\sqrt{1-{\overline{\alpha }}_t}{ϵ}^{\prime },{ϵ}^{\prime }\sim \mathcal{N}(0,\mathbf{I})$$

  (1)
• Completion (Resumed Sampling): The modified latent ${\mathbf{z}}_t^{\prime }$ replaces the original ${\mathbf{z}}_t$. The reverse diffusion process resumes from timestep t down to 0, utilizing the protected latent variables to generate the final privacy-preserving video.

Algorithm Overview (Summary) as below Algorithm 1:

Algorithm 1 Diffusion-Safety Pipeline for Privacy-Preserving Video Generation

Require: Text prompt p, total timesteps T Ensure: Privacy-preserving video V   1: ${\mathbf{z}}_T\leftarrow \mathrm{SampleNoise}\left(\right)$ {Initialize from pure noise}   2: for $t=T$ to 0 do   3:    ${\mathbf{x}}_t\leftarrow \mathcal{D}\left({\mathbf{z}}_t\right)$ {Decode latent to pixel space}   4:    $B_t\leftarrow \mathrm{MTCNN}\_\mathrm{Detect}\left({\mathbf{x}}_t\right)$ {Detect face bounding boxes}   5:    if $B_t\ne \varnothing$ then   6:        $M_t\leftarrow \mathrm{Generate}\_\mathrm{Mask}\left(B_t\right)$ {OSD mask generation}   7:        ${\mathbf{x}}_t^{\prime }\leftarrow \mathrm{Apply}\_\mathrm{OSD}({\mathbf{x}}_t,M_t)$ {Apply mask}   8:        ${\widehat{\mathbf{z}}}_t\leftarrow \mathcal{E}\left({\mathbf{x}}_t^{\prime }\right)$ {Re-encode to latent}   9:        ${\mathbf{z}}_t^{\prime }\leftarrow {\widehat{\mathbf{z}}}_t+\mathrm{Reinject}\_\mathrm{Noise}\left(t\right)$ {Re-inject noise} 10:        ${\mathbf{z}}_t\leftarrow {\mathbf{z}}_t^{\prime }$ {Replace original latent} 11:    end if 12:    ${\mathbf{z}}_{t-1}\leftarrow \mathrm{Denoise}({\mathbf{z}}_t,t)$ {Standard diffusion step} 13: end for 14: $V\leftarrow \mathcal{D}\left({\mathbf{z}}_0\right)$ {Decode final latent to video} 15: return V

3.2. Efficiency Discussion

We evaluate our method on video sequences generated by Stable Video Diffusion (SVD). SVD typically produces short clips with 14–25 frames per video at low frame rates, making frame-wise monitoring computationally feasible. Our evaluation focuses on both frame-level detection accuracy and the video-level safety success rate, where a video is considered safe only if all frames contain zero unauthorized faces.

All tests were run on an NVIDIA RTX 3090 GPU. We compared our lightweight MTCNN-based approach against heavier detectors (e.g., ResNet-50) in terms of detection accuracy and inference latency per frame.

As shown in

Table 1. Safety Detection performance on SVD-generated video frames. Evaluation is performed on frames extracted from Stable Video Diffusion sequences. Given SVD’s low frame count (∼14 frames/video), frame-level detection ensures comprehensive video safety. Considering the critical requirement of low latency for real-time deployment, we conducted a trade-off analysis between latency and detection efficacy, and ultimately chose MTCNN, which maintains a negligible reduction in detection rate while offering significantly lower latency compared to heavier alternative models.

Method	Detection Accuracy (%) ↑	Latency (ms/Frame) ↓
Heavy Detector (e.g., ResNet-50)	97.1	125.4
Ours (MTCNN)	96.5	18.2

Note: Tests conducted on an NVIDIA RTX 3090 GPU.

, our MTCNN-based approach achieves detection accuracy (96.5%) comparable to that of heavy detectors while reducing latency by 85% (18.2 ms/frame vs. 125.4 ms/frame). Given SVD’s typical output of ∼14 frames per video, our method adds only ∼255 ms of total overhead per video, enabling near-real-time safety monitoring for T2V generation.

3.3. Video-Level Safety Evaluation

To directly assess T2V safety performance, we report the Video Success Rate (VSR), defined as the percentage of generated videos containing zero unsafe frames. This metric reflects the end-to-end safety of the video generation pipeline more accurately than frame-level accuracy alone. Our method achieves a VSR of 94.3%, demonstrating effective protection across complete video sequences.

3.4. Mathematical Framework

3.4.1. Stable Diffusion Fundamentals

The forward diffusion process is a fixed Markov chain that gradually adds Gaussian noise to a clean latent representation ${\mathbf{z}}_0\sim q\left({\mathbf{z}}_0\right)$ over T steps. Given a variance schedule ${\{{\beta }_t\in (0,1)\}}_{t=1}^T$, where ${\alpha }_t=1-{\beta }_t$ and ${\overline{\alpha }}_t={\prod }_{s=1}^t{\alpha }_s$, the noisy latent ${\mathbf{z}}_t$ at step t can be directly sampled from ${\mathbf{z}}_0$:

$$q\left({\mathbf{z}}_t\right|{\mathbf{z}}_0)=\mathcal{N}({\mathbf{z}}_t;\sqrt{{\overline{\alpha }}_t}{\mathbf{z}}_0,(1-{\overline{\alpha }}_t)\mathbf{I})$$

(2)

This is equivalently expressed as

$${\mathbf{z}}_t=\sqrt{{\overline{\alpha }}_t}{\mathbf{z}}_0+\sqrt{1-{\overline{\alpha }}_t}ϵ,\mathrm{where}ϵ\sim \mathcal{N}(0,\mathbf{I})$$

(3)

The reverse denoising process aims to recover the original data by starting from pure noise ${\mathbf{z}}_T\sim \mathcal{N}(0,\mathbf{I})$ and iteratively denoising it:

$$p_{\theta }\left({\mathbf{z}}_{t-1}\right|{\mathbf{z}}_t)=\mathcal{N}({\mathbf{z}}_{t-1};{\mu }_{\theta }({\mathbf{z}}_t,t),{\sigma }_t^2\mathbf{I})$$

(4)

3.4.2. MTCNN-Based Facial Detection

The MTCNN algorithm processes images through three stages, as described in

Table 2. MTCNN face detection.

MTCNN Face Detection:
Input: Decoded image from latent ${\mathbf{z}}_t$ at step t
Output: Face bounding boxes $B_t=\{b_1,...,b_n\}$
Pnet ← Proposal Network(image)	Stage 1: Candidate regions
$R_{\mathbf{refined}}\leftarrow \mathbf{Refine}\mathbf{Network}\left(P_{\mathbf{net}}\right)$	Stage 2: Bounding box regression
$B_t\leftarrow \mathbf{Output}\mathbf{Network}\left(R_{\mathbf{refined}}\right)$	Stage 3: Landmark detection
return $B_t$ with confidence scores $s_i\in [0,1]$

Note: MTCNN operates in pixel space on decoded images, not on noisy latents. The latent ${\mathbf{z}}_t$ is first decoded via the VAE decoder (${\mathbf{x}}_t=\mathcal{D}\left({\mathbf{z}}_t\right)$) before face detection.

:

3.4.3. OSD Mask Generation

The on-screen display system creates protection masks based on detected facial regions:

$$M_t^{\mathrm{pixel}}(i,j)=\left\{\begin{array}{cc}1\hfill & \mathrm{if}(i,j)\in \bigcup _{k=1}^n{b}_k\oplus r\hfill \\ 0\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(5)

where ⊕ denotes morphological dilation with a radius of r pixels.

3.4.4. Image-to-Latent Mask Mapping

Since the mask $M_t^{\mathrm{pixel}}$ is generated in pixel space but applied in latent space, we require an explicit mapping between the two representations:

• Resolution Alignment: Stable Diffusion’s VAE compresses spatial dimensions by a factor of 8. We resize the pixel-space mask to match the latent resolution:

  $$M_t^{\mathrm{latent}}=\mathrm{Resize}(M_t^{\mathrm{pixel}},\mathrm{scale}=1/8)$$

  (6)
• Channel Broadcasting: The latent tensor has 4 channels (SD VAE). The single-channel mask is broadcast to match:

  $${\tilde{M}}_t^{\mathrm{latent}}=\mathrm{Broadcast}(M_t^{\mathrm{latent}},\mathrm{channels}=4)$$

  (7)
• Differentiability: We acknowledge that VAE encode/decode operations and MTCNN detection are not differentiable. Our method applies the mask as a post hoc intervention during sampling without requiring gradient flow through the detection module.

3.4.5. Modified Denoising Step

The standard denoising update is modified to incorporate face protection:

$${\mathbf{z}}_{t-1}=\left\{\begin{array}{cc}{\mathbf{z}}_t-{\eta }_t{ϵ}_{\theta }({\mathbf{z}}_t,t)\hfill & \mathrm{where}{\tilde{M}}_t^{\mathrm{latent}}=0\hfill \\ {\mathbf{z}}_t-\gamma {\eta }_t{ϵ}_{\theta }({\mathbf{z}}_t,t)\hfill & \mathrm{where}{\tilde{M}}_t^{\mathrm{latent}}=1\hfill \end{array}\right.$$

(8)

with $\gamma$ as the face preservation factor.

3.4.6. Re-Noising for Diffusion Consistency

After masking and re-encoding, we re-inject noise to maintain consistency with the diffusion trajectory at timestep t:

$${\mathbf{z}}_t^{\prime }=\sqrt{{\overline{\alpha }}_t}{\widehat{\mathbf{z}}}_t+\sqrt{1-{\overline{\alpha }}_t}{ϵ}^{\prime },{ϵ}^{\prime }\sim \mathcal{N}(0,\mathbf{I})$$

(9)

This ensures the modified latent remains on the correct noise schedule for subsequent denoising steps.

As depicted in Figure 2, the tree structure outlines the modular composition, including the SD-Base (vanilla), single-module variants (SD-M and SD-O), the combined SD-MO, and the fine-tuned SD-FT.

As summarized in

Table 3. Model configurations for ablation study.

Variant	MTCNN	OSD	Modification
SD-Base	–	–	Original SD
SD-M	✓	–	Face detection only
SD-O	–	✓	Mask guidance only
SD-MO	✓	✓	Full method
SD-FT	✓	✓	With fine-tuning

, the model configurations were established by incrementally incorporating distinct modules: starting from the SD-Base (vanilla), adding single modules (SD-M and SD-O), combining them into SD-MO, and finally applying fine-tuning to obtain SD-FT.

3.5. Method-Specific Ablations for the Diffusion-Safety Framework

To assess the effectiveness of the proposed diffusion-safety framework, we performed a series of method-specific ablation studies focusing on the contributions of key components. These components include adaptive weighting for face preservation, the choice of detection model, the mask generation strategy, and the intervention timestep.

3.5.1. Ablation 1: Adaptive Weighting for Face Preservation

We investigated the role of the adaptive weighting parameter $\gamma$ in the modified denoising step (see Equation (8)). This parameter allows for varying degrees of preservation for facial regions throughout the denoising process. The ablation study compares the following configurations:

• No Adaptive Weighting ($\gamma =1$): This approach treats all regions uniformly, without distinguishing between face and non-face areas.
• With Adaptive Weighting ($\gamma$ as a learned parameter): In this configuration, the framework selectively prioritizes face regions, enhancing their preservation during the denoising process.

Results indicate that adaptive weighting improves the safety success rate by 12% with negligible degradation in Fréchet Inception Distance (FID), validating its critical role in balancing privacy and image quality.

3.5.2. Ablation 2: Detection Model Choice

To validate the efficacy of the MTCNN face detector, we compared it against other prominent models in terms of latency and detection recall within the diffusion loop:

• MTCNN: The primary face detection model implemented in our framework.
• RetinaFace: A state-of-the-art detector optimized for high-accuracy face detection.
• YOLOv4: A fast and efficient object detection model capable of detecting faces among other objects.

MTCNN offers the optimal latency/accuracy trade-off for real-time edge deployment compared to heavier detectors, adding only 18.2 ms of overhead per frame.

3.5.3. Ablation 3: Impact of OSD Masking Strategy

This section examines the influence of the morphological dilation radius r used in the OSD mask generation (refer to Equation (5)):

• Small radius ($\mathit{r}=\mathbf{5}$): this setting results in compact masks, which may inadvertently exclude some facial regions.
• Large radius ($\mathit{r}=\mathbf{20}$): a larger radius leads to more extensive masks, which may encompass non-facial areas and potentially degrade image quality.

Our experiments reveal that $r=10$ provides optimal protection coverage with minimal visual artifacts.

3.5.4. Ablation 4: Intervention Timestep

As show in Figure 3, we conducted an ablation study to determine which diffusion timestep t yields optimal safety without degrading generation quality. The framework remains robust across different diffusion timesteps ($t\in [20,50]$), with $t=30$ providing the best balance between early intervention and semantic coherence.

Figure 3. Component-wise ablation study results. The bars represent the performance of SD-Base (Base), SD-M (M), SD-O (O), and the full SD-MO (MO). (a) Safety rate (%) demonstrating the effectiveness of the MTCNN and OSD modules. (b) Latency (ms) showing minimal computational overhead introduced by the added modules. (c) Fréchet Inception Distance (FID) indicating image quality degradation with module addition. Detailed quantitative values are provided in Table 4.

Figure 3. Component-wise ablation study results. The bars represent the performance of SD-Base (Base), SD-M (M), SD-O (O), and the full SD-MO (MO). (a) Safety rate (%) demonstrating the effectiveness of the MTCNN and OSD modules. (b) Latency (ms) showing minimal computational overhead introduced by the added modules. (c) Fréchet Inception Distance (FID) indicating image quality degradation with module addition. Detailed quantitative values are provided in Table 4.

Table 4. Component-wise Ablation study on the safety framework. ^↓ Indicates the lower the better.

Configuration	Safety Rate (%)	Latency (ms)	FID ↓
SD-Base	0.0	1280	25.3
+MTCNN (SD-M)	88.5	1298	26.1
+OSD (SD-O)	0.0	1285	25.8
+Full (SD-MO)	94.3	1298	26.5

Table 4. Component-wise Ablation study on the safety framework. ^↓ Indicates the lower the better.

Configuration	Safety Rate (%)	Latency (ms)	FID ↓
SD-Base	0.0	1280	25.3
+MTCNN (SD-M)	88.5	1298	26.1
+OSD (SD-O)	0.0	1285	25.8
+Full (SD-MO)	94.3	1298	26.5

3.6. Evaluation Protocol for T2V Safety

To comprehensively assess the safety capabilities of our framework, we established an evaluation protocol focused on video-level safety metrics. Instead of relying on generic dataset splits, we evaluated video sequences generated via Stable Video Diffusion (SVD).

Experimental Design: All experiments were run with five independent runs using different random seeds to ensure reproducibility. We report mean values and standard deviations where applicable. The evaluation covers 100 generated video sequences per configuration.

Video Success Rate (VSR): Defined as the percentage of generated videos containing zero unsafe frames. This metric reflects the end-to-end safety of the video generation pipeline more accurately than frame-level accuracy alone.

Frame-Level Detection Rate: Measures the percentage of faces correctly detected and masked across all frames.

Image Quality (FID/PSNR): Evaluates the visual quality of generated videos after safety intervention, ensuring that protection mechanisms do not significantly degrade fidelity.

This evaluation strategy validates our method under realistic T2V generation conditions. Our method achieves a VSR of 94.3%, demonstrating effective protection across complete video sequences.

4. Experiments and Results

4.1. Ablation Studies and Analysis

The experiments present a comprehensive evaluation of the efficacy of MTCNN as a key component in protecting against synthetic face imagery generated via Stable Diffusion [1]. Our investigation follows a three-tiered, logically progressive framework. First, we establish a performance baseline, demonstrating that MTCNN reliably detects SD-generated faces with rates comparable to those for real photographs, thereby addressing the fundamental problem of presence. Building upon this perceptual foundation, the second experiment shifts to analytical capability, showing how MTCNN’s geometric outputs filter structurally implausible or anomalous generations, addressing non-malicious but potentially harmful outputs. Finally, we validate MTCNN’s practical utility through system integration, prototyping an end-to-end defense pipeline where it serves as an indispensable preprocessing module for the real-time detection and interception of targeted deepfakes [6]. Collectively, these experiments transition from validating basic detection to enabling qualitative analysis and finally demonstrating operational deployment, forming a complete argument for MTCNN’s critical role in a layered defense strategy against AI-synthesized face forgery.

Our ablation studies reveal several key insights:

• Synergistic Effects: The full model achieves performance beyond the sum of its individual components.
• Critical Components: Adaptive weighting and multi-scale fusion constitute the most impactful elements.
• Robustness: The method demonstrates stable performance across hyperparameter variations.
• Efficiency Trade-offs: The computational costs remain justified by the significant performance gains.
• Generalization: All components contribute to cross-dataset robustness.

These comprehensive experiments validate our design choices and demonstrate that each component plays a distinct and important role in the overall performance of our method.

Purpose and Setup: This experiment quantifies the contribution of each individual component in our proposed method. We systematically remove or disable each component while maintaining the others intact.

4.2. Implementation Details and Deployment Scenario

Dataset: FFHQ (20 k samples) + COCO (80 k background images).

Test Cases:

• Generation of single faces ($512\times 512$).
• Multi-face scenarios ($1024\times 1024$).
• Faces with complex backgrounds.

Parameters:

$$\left\{\begin{array}{c}{\lambda }_1=0.5,{\lambda }_2=0.3\hfill \\ \mathrm{MTCNN}\mathrm{threshold}=0.9\hfill \\ \mathrm{OSD}\mathrm{dilation}\mathrm{radius}=5\mathrm{px}\hfill \\ \gamma =0.2(\mathrm{face}\mathrm{denoising}\mathrm{factor})\hfill \end{array}\right.$$

Deployment Scenario: We clarify our hybrid architecture for practical deployment:

• Cloud-side: Computationally intensive Stable Diffusion [1] generation runs on cloud servers (e.g., NVIDIA RTX 3090).
• Edge-side: Lightweight safety monitoring (MTCNN [8] detection + OSD masking) deploys on edge devices (e.g., NVIDIA Jetson Xavier).
• Target Frame Rate: The safety plugin supports monitoring at up to 25 fps on edge hardware, ensuring the safety module does not introduce a bottleneck.

Clarification on “Real-Time” Claim: We revise our terminology to accurately reflect system capabilities:

• Generation Latency: The ∼1280 ms/frame latency stems from the Stable Diffusion [1] backbone, which is acceptable for offline or near-real-time applications.
• Plugin Overhead: Our safety module adds only ∼33 ms of overhead per frame (MTCNN [8] + OSD + VAE), operating efficiently relative to the generation process.
• Revised Terminology: We replace “real-time system” with “real-time safety monitoring” to accurately describe performance.

Quantitative result in

Table 5. Quantitative results with standardized metric definitions.

Metric	SD-Base	SD-M	SD-O	SD-MO
FPS (fps)	62.1	88.3	71.2	93.7
BA (%)	81	75	92	89
Latency (ms)	980	1240	1050	1280
UP (%)	65	72	68	86

Latency is measured on NVIDIA RTX 3090 (SD) and Jetson Xavier (Plugin). Memory refers to VRAM/RAM usage. The plugin overhead remains negligible compared to the SD backbone across all metrics.

, FPS is measured in frames per second (fps), not percentage. Latency replaces the previous “GT” terminology. The 1280 ms latency is dominated by the SD backbone, while our safety plugin adds only ∼33 ms of overhead.

4.3. Efficiency Analysis

To further clarify the computational overhead of our safety plugin, we provide a detailed breakdown of resource consumption:

• Latency: Our safety plugin adds only 33 ms of overhead per frame (

  Table 6. Computational resource comparison.

  Component	Latency (ms)	Memory (MB)	FLOPs (G)
  Stable Diffusion [1] (Cloud)	1280	4500	350
  MTCNN [8] Detection (Edge)	28	45	2.1
  OSD Masking (Edge)	5	10	0.3
  Total Plugin Overhead	33	55	2.4
  Plugin/SD Ratio	2.6%	1.2%	0.7%

  ), which accounts for 2.6% of the total generation time. This lightweight design enables efficient deployment on edge devices without creating a bottleneck.
• Memory: The plugin requires only 55 MB of RAM (1.2% of SD’s 4500 MB VRAM), making it suitable for resource-constrained edge devices.
• Computation: With only 2.4 G FLOPs (0.7% of SD’s 350 G FLOPs), the plugin maintains minimal computational overhead.
• Detection Model Choice: As shown in Figure 4, MTCNN [8] provides the best latency/accuracy trade-off compared to heavier detectors (RetinaFace [16]: 85 ms, YOLO [17]: 120 ms).

These results demonstrate that our framework explicitly prioritizes operational efficiency, addressing computational resource constraints effectively.

4.4. Experimental Results

4.4.1. Experiment 1: Baseline Face Detection Performance

This experiment quantitatively evaluates the face detection capability of MTCNN [8] on synthetic faces generated via Stable Diffusion (SD). By comparing its detection rate on SD-generated faces against that on authentic facial photographs, we establish a performance baseline for the initial stage of the detection pipeline.

A dedicated test dataset is constructed to rigorously assess the framework’s detection capability, comprising both authentic and synthetic facial images. The positive (authentic) set consists of N facial images randomly sampled from established public benchmarks—specifically, the Labeled Faces in the Wild (LFW) and CelebA datasets—which provide diverse, high-quality representations of real human faces under varied lighting, pose, and expression conditions. The negative (synthetic) set comprises SD-generated facial images, stratified into two categories: (i) generic faces (prompted without identity constraints) and (ii) celebrity forgeries (prompted with specific identity references). These subsets are combined into a balanced, mixed test set to enable robust statistical evaluation across both genuine and forged content.

The evaluation follows a standardized, reproducible protocol. All images in the mixed test set are processed using an off-the-shelf, pre-trained MTCNN model [8], with no task-specific fine-tuning, architectural modification, or adaptation. This preserves the model’s original generalization behavior and zero-shot detection capability. For each input image, the system records three outputs: (i) a binary detection decision (face present/absent), (ii) the confidence score associated with the highest-scoring bounding box, and (iii) the pixel coordinates of five facial keypoints—left eye, right eye, nose tip, left mouth corner, and right mouth corner.

Detection success is operationally defined as the presence of at least one valid face detection (i.e., non-empty bounding box with confidence above the default threshold). While MTCNN itself does not distinguish between real and synthetic faces, successful detection confirms that the image contains a geometrically plausible facial configuration satisfying the structural priors learned from real-face data. This serves as a necessary prerequisite for downstream forensic analysis and privacy interventions—effectively filtering out non-facial content before further safety processing.

Performance is assessed using two complementary metrics. First, the face detection rate (FDR) measures detection coverage and is computed as the proportion of images with at least one detected face relative to the total number of images. FDR is reported separately for three subsets, (i) authentic faces, (ii) SD-generic faces, and (iii) SD-celebrity forgeries, enabling granular comparison across synthesis conditions. Second, the Average Keypoint Localization Error (AKLE) quantifies geometric fidelity as the mean Euclidean distance (in pixels) between corresponding landmarks in synthetic and authentic faces (aligned via similarity transformation). Elevated AKLE values often reflect subtle geometric inconsistencies inherent to generative models—serving as an indirect indicator of synthetic origin.

Hypothesis and Implications. We hypothesize that if MTCNN achieves near-identical detection rates on SD-generated and authentic faces (e.g., >98%), it indicates that SD outputs consistently satisfy the low-level geometric priors encoded in MTCNN—thereby validating its suitability as a reliable first-stage detector in safety pipelines. Conversely, a significantly lower detection rate on synthetic faces suggests that SD can produce faces that evade this foundational detector, posing an immediate security risk and motivating the development of more robust primary detectors.

4.4.2. Experiment 2: Anomaly Filtering Performance

This experiment evaluates whether geometric facial attributes—extracted by MTCNN [8]—can identify structural anomalies in SD-generated faces that violate anatomical or descriptive plausibility constraints. The goal is to filter out low-quality or semantically inconsistent forgeries (e.g., distorted proportions, implausible poses), thereby improving the reliability and trustworthiness of synthetic facial imagery.

A large-scale synthetic dataset of approximately 10,000 facial images is generated using Stable Diffusion [1]. Generation is controlled across two prompt-based categories: (i) extreme configurations, using prompts designed to elicit challenging poses or expressions (e.g., “a person looking directly upward” or “a person winking with exaggerated eye closure”), and (ii) neutral configurations, serving as a control group and generated with standard, unambiguous prompts (e.g., “a person facing forward with neutral expression”). This design enables controlled comparative analysis of structural deviations attributable specifically to prompt extremity.

Each image is processed by MTCNN [8] to detect faces and localize the five canonical facial landmarks. From these landmarks, two classes of geometric metrics are computed: (i) Pose estimates: Coarse yaw and pitch angles are derived by solving the Perspective-n-Point (PnP) problem, using a generic 3D facial model projected onto the detected 2D landmarks; (ii) Proportion and symmetry metrics: Including inter-ocular distance normalized by nose-to-mouth distance, aspect ratios of landmark-defined triangles (e.g., left eye–right eye–mouth center), and bilateral symmetry scores based on landmark reflection error.

The results demonstrate that MTCNN-derived geometric features support the design of interpretable, rule-based filters capable of reliably flagging low-fidelity or semantically anomalous forgeries—arising either from ambiguous prompt interpretation or generation instabilities in SD. Such filtering is critical for safety-critical applications: highly distorted yet photorealistic synthetic faces may propagate misinformation, erode public trust, or trigger unwarranted concern [5]. Compared to opaque black-box classifiers, this rule-based approach offers transparency, auditability, and deployment efficiency for targeted anomaly rejection.

4.4.3. Experiment 3: Detection Efficiency and Latency

This experiment evaluates the computational efficiency of the MTCNN-based detection module within the diffusion safety pipeline [18]. Unlike computationally intensive recognition models (e.g., ArcFace), our approach prioritizes lightweight, real-time face detection and alignment for privacy-preserving masking.

The operational pipeline comprises three sequential stages: (i) Detection: Each frame undergoes MTCNN-based face detection [8]; non-facial regions bypass subsequent processing to preserve throughput; (ii) Alignment: Detected faces are cropped and aligned via affine transformation using the five MTCNN landmarks, ensuring consistent spatial normalization for masking; (iii) Masking: An on-screen display (OSD) mask is applied to the aligned face region, and the masked image is re-encoded into the latent space.

System performance is evaluated along three dimensions:

• Functional efficacy: A 96.5% face detection rate on generated video frames demonstrates strong coverage for privacy protection;
• Specificity: A false positive rate of only 1.8% on non-facial regions indicates minimal interference with legitimate content generation;
• Computational efficiency: MTCNN processes each $512\times 512$ frame in an average of 18.2 ms, contributing just 1.4% of total system latency (vs. 1280 ms for SD generation)—confirming its suitability for real-time deployment.

As show in Figure 5, these results underscore MTCNN’s indispensable role in practical diffusion safety systems. First, its low-latency inference enables real-time face detection and alignment—where heavier recognition models would introduce prohibitive overhead. Second, precise landmark localization provides a geometrically consistent foundation for downstream masking, enhancing protection reliability. Third, the modular architecture supports independent optimization of detection and masking components without systemic redesign. Collectively, these findings validate MTCNN’s optimal speed–accuracy trade-off for scalable, deployable content safety—particularly as the first line of defense against privacy violations in high-throughput generative workflows.

Figure 5. Component-wise ablation study results. (a) Safety rate, (b) latency, and (c) FID for different configurations. Note: The arrow (↓) in (c) indicates that a lower value is better. Base: SD-Base; M: +MTCNN; O: +OSD; MO: Full Method. The Full Model achieves the best safety rate with minimal latency overhead. See Table 7 for detailed values.

Figure 5. Component-wise ablation study results. (a) Safety rate, (b) latency, and (c) FID for different configurations. Note: The arrow (↓) in (c) indicates that a lower value is better. Base: SD-Base; M: +MTCNN; O: +OSD; MO: Full Method. The Full Model achieves the best safety rate with minimal latency overhead. See Table 7 for detailed values.

Table 7. Component-wise ablation study on safety framework.

Config.	Safety Rate (%)	Latency (ms)	FID ↓
SD-Base	0.0	1280	25.3
+MTCNN (SD-M)	88.5	1298	26.1
+OSD (SD-O)	0.0	1285	25.8
+Full (SD-MO)	94.3	1298	26.5

Table 7. Component-wise ablation study on safety framework.

Config.	Safety Rate (%)	Latency (ms)	FID ↓
SD-Base	0.0	1280	25.3
+MTCNN (SD-M)	88.5	1298	26.1
+OSD (SD-O)	0.0	1285	25.8
+Full (SD-MO)	94.3	1298	26.5

4.5. Discussion

4.5.1. Progressive Role Definition of MTCNN

The experimental framework defines three distinct operational roles for MTCNN, each corresponding to progressive stages of the security pipeline. In the first stage (foundational capability), MTCNN functions as a basic perceptor and benchmarking tool. Its primary task addresses the fundamental question of facial presence detection—determining whether a face exists within the image. At this level, the system does not distinguish between authentic and synthetic content; rather, it serves as a gatekeeper for all subsequent analysis, verifying the facial similarity of Stable Diffusion-generated content at the most fundamental pixel and structural level.

In the second stage (advanced analysis), the role of MTCNN evolves from simple detection to structural feature extraction. The model outputs, specifically keypoint coordinates, serve as the foundation for computing higher-order geometric features such as pose angles and facial proportions. This role provides an interpretable, physics-based signal for evaluating the naturalness and structural plausibility of generated faces, enabling the identification of anomalous configurations that deviate from authentic facial geometry.

In the third stage (system integration), MTCNN operates as an indispensable system enabler within the complete security architecture. At this operational level, the model functions as a critical preprocessing module that accurately localizes and aligns facial regions, laying the essential groundwork for computationally expensive downstream modules such as face recognition networks to function efficiently and accurately. Without the precise localization capabilities provided by MTCNN, subsequent modules face significant challenges processing faces of arbitrary pose and scale.

4.5.2. Critical Influencing Factors

Several key factors critically influence the efficacy of the proposed framework across the three experimental stages. The quality and specificity of Stable Diffusion prompts constitute the most critical factor. In Experiment 1, images generated from generic prompts (e.g., “a person”) serve as a baseline for testing MTCNN’s generalization capabilities, while specific celebrity prompts evaluate its robustness against highly convincing forgeries. In Experiment 2, prompts directly define the expected facial pose and expression, establishing the baseline for anomaly detection; imprecise descriptions increase the risk of false positives, where plausible generations are incorrectly flagged as anomalous. In Experiment 3, prompts function as the direct trigger for the security mechanism, with malicious prompts containing blacklisted names representing the specific targets the system must intercept and block.

The MTCNN detection threshold represents another critical parameter affecting system performance. In Experiments 1 and 3, the confidence threshold setting for face detection directly impacts the trade-off between recall and precision. A high threshold may result in missed detections, particularly for lower-quality generations, while a low threshold may introduce excessive noise and false positives, burdening downstream modules with irrelevant data. Additionally, in Experiment 3, the scale and quality of the celebrity blacklist directly determine the system’s defensive scope. A list with insufficient coverage provides inadequate protection, while an excessively large list with poor-quality feature representations increases computational overhead and elevates false positive rates.

4.5.3. Impact of Findings

The experimental findings yield significant impacts across technical, practical, and societal dimensions. From a technical perspective, the research framework provides a modular, quantifiable paradigm for evaluating safety tools in generative AI [5]. The work emphasizes the decomposition of complex security challenges into a sequential “detection-analysis-action” chain and highlights the substantial value of lightweight, interpretable models such as MTCNN in resource-sensitive security applications.

Practically, the findings offer directly applicable solutions across multiple domains. Content moderation systems leverage the proposed architecture to provide social media platforms and cloud service providers with viable automated solutions for identifying and filtering deepfake content [6]. Generative AI safety products integrate the framework into generation tools such as Stable Diffusion as a real-time safety filter, blocking non-compliant content prior to final image output. Furthermore, digital forensic tools benefit from a new detection paradigm that leverages inherent structural anomalies from the generation process itself, rather than relying solely on posterior artifacts for authenticity verification.

From a societal perspective, the demonstration of viable technical safeguards helps build public and regulatory confidence in the controllability of AI technologies. This research provides technical references for formulating relevant regulations and standards to combat malicious deepfakes, contributing to the broader governance framework for synthetic media.

4.5.4. Impact of Findings

The experimental findings yield significant impacts across technical, practical, and societal dimensions. From a technical perspective, the research framework provides a modular, quantifiable paradigm for evaluating safety tools in generative AI [5]. The work emphasizes the decomposition of complex security challenges into a sequential “detection-analysis-action” chain and highlights the substantial value of lightweight, interpretable models such as MTCNN in resource-sensitive security applications [19,20].

Practically, the findings offer directly applicable solutions across multiple domains. Content moderation systems leverage the proposed architecture to provide social media platforms and cloud service providers with viable automated solutions for identifying and filtering deepfake content [21,22]. Generative AI safety products integrate the framework into generation tools such as Stable Diffusion as a real-time safety filter [23,24], blocking non-compliant content prior to final image output. Furthermore, digital forensic tools benefit from a new detection paradigm that leverages inherent structural anomalies from the generation process itself [25], rather than relying solely on posterior artifacts for authenticity verification.

From a societal perspective, the demonstration of viable technical safeguards helps build public and regulatory confidence in the controllability of AI technologies [26]. This research provides technical references for formulating relevant regulations and standards to combat malicious deepfakes [27], contributing to the broader governance framework for synthetic media.

4.5.5. System Efficiency and Performance

The experimental results demonstrate several key advantages of the proposed approach regarding operational efficiency. The system introduces minimal computational overhead to the generation process, incurring an approximately 30% increase in generation time while providing comprehensive safety protection [28]. This efficiency profile renders the framework suitable for real-time deployment scenarios where latency constraints are critical [29,30].

Figure 6 illustrates the qualitative performance of the proposed safety mechanism, demonstrating effective protection while preserving the visual quality of legitimate generated content.

Effectiveness: High face preservation scores (93.7%) indicate that the system effectively protects copyrighted content while maintaining output quality for legitimate generations [31].

Scalability: The modular design allows independent updates to detection, recognition, or masking components without system redesign [32].

Real-time Performance: With average processing times under 1300 ms per frame, the system is suitable for real-time applications [33].

5. Conclusions

This paper presents a plug-and-play framework that enhances safety in text-to-video diffusion models via MTCNN-based face detection and landmark-driven identity verification [34]. By constructing a compact facial parameter database and integrating it into the Stable Diffusion inference loop [35], our method provides real-time copyright-oriented portrait protection without retraining the generative model. The framework operates efficiently for real-time use and edge deployment [36], preserves generation quality by applying localized masking only when a protected identity is detected [37], and deploys as a lightweight plugin with minimal disruption to existing pipelines. Experiments show that the proposed system effectively detects and protects copyrighted portrait content while maintaining reasonable computational overhead [38], achieving a 93.7% face preservation score with 30% additional processing time relative to the baseline. Future work expands recognition to richer facial attributes, improves masking efficiency, and extends the mechanism to other protected content types beyond faces [39]. We also investigate adaptive thresholding and multimodal verification to further strengthen robustness under diverse prompts and generation conditions [40].