Adversarial Perturbations Fool Deepfake Detectors

Gandhi, Apurva; Jain, Shomik

doi:10.48550/arxiv.2003.10596

Cited by 8 publications

(10 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the field of deepfake detection, neural networks are widely used to distinguish forgery videos. However, due to inherent defects, neural networks cannot resist attacks of adversarial samples [86][87][88]. To this end, researchers need to design more robust algorithms that can In recent years, deepfake technologies, which rely on deep learning, are developing at an unprecedented rate.…”

Section: Antiforensicsmentioning

confidence: 99%

A Survey on Deepfake Video Detection

et al. 2021

View full text Add to dashboard Cite

Recently, deepfake videos, generated by deep learning algorithms, have attracted widespread attention. Deepfake technology can be used to perform face manipulation with high realism. So far, there have been a large amount of deepfake videos circulating on the Internet, most of which target at celebrities or politicians. These videos are often used to damage the reputation of celebrities and guide public opinion, greatly threatening social stability. Although the deepfake algorithm itself has no attributes of good or evil, this technology has been widely used for negative purposes. To prevent it from threatening human society, a series of research have been launched, including developing detection methods and building large-scale benchmarks. This review aims to demonstrate the current research status of deepfake video detection, especially, generation process, several detection methods and existing benchmarks. It has been revealed that current detection methods are still insufficient to be applied in real scenes, and further research should pay more attention to the generalization and robustness.This is an open access article under the terms of the Creative Commons Attribution-NoDerivs License, which permits use and distribution in any medium, provided the original work is properly cited and no modifications or adaptations are made.

show abstract

Section: Antiforensicsmentioning

confidence: 99%

A Survey on Deepfake Video Detection

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Deep-Fake algorithms can be used for malicious activities that may cause psychological, political, monetary, and physical harm. Given such implications, defenses have been developed using machine learning models to differentiate between real and fake videos (DeepFakes) [13,15].…”

Section: Novel Defense Directionsmentioning

confidence: 99%

TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack

Sharon¹,

Berend²,

Liu³

et al. 2021

Preprint

View full text Add to dashboard Cite

Network intrusion attacks are a known threat. To detect such attacks, network intrusion detection systems (NIDSs) have been developed and deployed. These systems apply machine learning models to high-dimensional vectors of features extracted from network traffic to detect intrusions. Advances in NIDSs have made it challenging for attackers, who must execute attacks without being detected by these systems. Prior research on bypassing NIDSs has mainly focused on perturbing the features extracted from the attack traffic to fool the detection system, however, this may jeopardize the attack's functionality. In this work, we present TANTRA, a novel endto-end Timing-based Adversarial Network Traffic Reshaping Attack that can bypass a variety of NIDSs. Our evasion attack utilizes a long short-term memory (LSTM) deep neural network (DNN) which is trained to learn the time differences between the target network's benign packets. The trained LSTM is used to set the time differences between the malicious traffic packets (attack), without changing their content, such that they will "behave" like benign network traffic and will not be detected as an intrusion. We evaluate TANTRA on eight common intrusion attacks and three state-of-the-art NIDS systems, achieving an average success rate of 99.99% in network intrusion detection system evasion. We also propose a novel mitigation technique to address this new evasion attack.

show abstract

Section: Prior Work On Fooling Deepfake Detectorsmentioning

confidence: 99%

“…Recently, gradient-based adversarial attacks have also been applied on CNN-based DeepFake detection systems to expose their vulnerabilities to adversarial examples [5,13,24]. While some of this past work [5,13] focuses on attacks on image classification models, the authors of [24] study the vulnerability of video DeepFake detection methods which follow the same detection pipeline as the methods studied in our work. While this past work demonstrates that adversarial examples can fool video DeepFake detectors, designing such adversarial videos requires complete access to the victim model architecture and parameters (white-box attack).…”

Section: Prior Work On Fooling Deepfake Detectorsmentioning

confidence: 99%

“…The best performing methods model the DeepFake detection problem as a per-frame classification problem. While such methods achieve promising results in terms of detection accuracy, they are vulnerable to adversarial examples [40] and can be evaded by adding a carefully crafted perturbation to each frame of a given input video [5,13,24]. Since DeepFakes have the potential to be very damaging, attacks designed to evade DeepFake detectors can cause outsized harm when compared to other attack scenarios.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Adversarial Threats to DeepFake Detection: A Practical Perspective

Neekhara¹,

Dolhansky²,

Bitton³

et al. 2020

Preprint

View full text Add to dashboard Cite

Facially manipulated images and videos or DeepFakes can be used maliciously to fuel misinformation or defame individuals. Therefore, detecting DeepFakes is crucial to increase the credibility of social media platforms and other media sharing web sites. State-of-the art DeepFake detection techniques rely on neural network based classification models which are known to be vulnerable to adversarial examples. In this work, we study the vulnerabilities of state-of-the-art DeepFake detection methods from a practical stand point. We perform adversarial attacks on DeepFake detectors in a black box setting where the adversary does not have complete knowledge of the classification models. We study the extent to which adversarial perturbations transfer across different models and propose techniques to improve the transferability of adversarial examples. We also create more accessible attacks using Universal Adversarial Perturbations which pose a very feasible attack scenario since they can be easily shared amongst attackers. We perform our evaluations on the winning entries of the DeepFake Detection Challenge (DFDC) and demonstrate that they can be easily bypassed in a practical attack scenario by designing transferable and accessible adversarial attacks. 1

show abstract

Adversarial Perturbations Fool Deepfake Detectors

Cited by 8 publications

References 0 publications

A Survey on Deepfake Video Detection

A Survey on Deepfake Video Detection

TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack

Adversarial Threats to DeepFake Detection: A Practical Perspective

Contact Info

Product

Resources

About