Exploring Adversarial Fake Images on Face Manifold

Li, Dongze; Wang, Wei; Fan, Hong-Xing

doi:10.1109/cvpr46437.2021.00573

Cited by 27 publications

(13 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Huang et al [70] showed the existence of both individual and universal adversarial perturbations that can cause well-performing deepfake classifiers to misbehave. Li et al [71] demonstrated that fake facial images generated using adversarial points on a face manifold can defeat two strong forensic classifiers. Even methods that won the Deepfake Detection Challenge (DFDC) [72] were easily bypassed in a practical attack scenario using transferable and accessible adversarial attacks [73].…”

Section: Robust Deepfake Detectionmentioning

confidence: 99%

Robust Deepfake On Unrestricted Media: Generation And Detection

Le¹,

Nguyen²,

Yamagishi³

et al. 2022

Preprint

View full text Add to dashboard Cite

Recent advances in deep learning have led to substantial improvements in deepfake generation, resulting in fake media with a more realistic appearance. Although deepfake media have potential application in a wide range of areas and are drawing much attention from both the academic and industrial communities, it also leads to serious social and criminal concerns. This chapter explores the evolution of and challenges in deepfake generation and detection. It also discusses possible ways to improve the robustness of deepfake detection for a wide variety of media (e.g., in-the-wild images and videos). Finally, it suggests a focus for future fake media research.

show abstract

Section: Robust Deepfake Detectionmentioning

confidence: 99%

Robust Deepfake On Unrestricted Media: Generation And Detection

Le¹,

Nguyen²,

Yamagishi³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…For adversarial attacks in face forgery detection, some works [4,13,21,26,34] explore the robustness of models in different settings. Li et al [26] manipulate the noise vectors and latent vectors of Style-GAN [48] with gradients to fool the face forgery models. Neekhara et al [34] perform adversarial attacks in a black-box setting for face forgery detection.…”

Section: Adversarial Attackmentioning

confidence: 99%

“…For instance, a forged face image that is classified correctly as fake by adding adversarial perturba-tions can fool the detector to make a wrong decision as real. Existing works [4,13,21,26,34] have explored the robustness of face forgery detection methods, but these methods add adversarial perturbations or patches on the original images, which are easily recognized by human eyes. In brief, the adversarial examples aim to fool a face forgery detector, while the objective of face forgery generation is to fool humans.…”

Section: Introductionmentioning

confidence: 99%

Exploring Frequency Adversarial Attacks for Face Forgery Detection

Jia¹,

Ma²,

Yao³

et al. 2022

Preprint

View full text Add to dashboard Cite

Various facial manipulation techniques have drawn serious public concerns in morality, security, and privacy. Although existing face forgery classifiers achieve promising performance on detecting fake images, these methods are vulnerable to adversarial examples with injected imperceptible perturbations on the pixels. Meanwhile, many face forgery detectors always utilize the frequency diversity between real and fake faces as a crucial clue. In this paper, instead of injecting adversarial perturbations into the spatial domain, we propose a frequency adversarial attack method against face forgery detectors. Concretely, we apply discrete cosine transform (DCT) on the input images and introduce a fusion module to capture the salient region of adversary in the frequency domain. Compared with existing adversarial attacks (e.g. FGSM, PGD) in the spatial domain, our method is more imperceptible to human observers and does not degrade the visual quality of the original images. Moreover, inspired by the idea of meta-learning, we also propose a hybrid adversarial attack that performs attacks in both the spatial and frequency domains. Extensive experiments indicate that the proposed method fools not only the spatial-based detectors but also the state-ofthe-art frequency-based detectors effectively. In addition, the proposed frequency attack enhances the transferability across face forgery detectors as black-box attacks.

show abstract

“…Regarding anti-forensics, in recent years, it has been shown that forensic detectors based on deep neural networks (DNNs) are vulnerable to adversarial perturbations [17][18][19][20][21]. By adding carefully designed and imperceptible anti-forensic noise to the fake face image, the forensic detectors are rendered ineffective.…”

Section: Introductionmentioning

confidence: 99%

“…By adding carefully designed and imperceptible anti-forensic noise to the fake face image, the forensic detectors are rendered ineffective. However, the existing attack-based methods [17][18][19][20][21] use the method of perturbing all pixels, and there are many redundant and meaningless perturbations. In addition, the transferability of these methods is still insufficient.…”

Section: Introductionmentioning

confidence: 99%

A Local Perturbation Generation Method for GAN-Generated Face Anti-Forensics

Zhang

Chen

Wang

et al. 2023

IEEE Trans. Circuits Syst. Video Technol.

View full text Add to dashboard Cite

Although the current generative adversarial networks (GAN)-generated face forensic detectors based on deep neural networks (DNNs) have achieved considerable performance, they are vulnerable to adversarial attacks. In this paper, an effective local perturbation generation method is proposed to expose the vulnerability of state-of-the-art forensic detectors. The main idea is to mine the fake faces' areas of common concern in multiple-detectors' decision-making, then generate local anti-forensic perturbations by GANs in these areas to enhance the visual quality and transferability of anti-forensic faces. Meanwhile, in order to improve the anti-forensic effect, a doublemask (soft mask and hard mask) strategy and a three-part loss (the GAN training loss, the adversarial loss consisting of ensemble classification loss and ensemble feature loss, and the regularization loss) are designed for the training of the generator. Experiments conducted on fake faces generated by StyleGAN demonstrate the proposed method's advantage over the state-of-the-art methods in terms of anti-forensic success rate, imperceptibility, and transferability. The source code is available at https://github.com/imagecbj/A-Local-Perturbation-Generation-Method-for-GAN-generated-Face-Anti-forensics.

show abstract

Exploring Adversarial Fake Images on Face Manifold

Cited by 27 publications

References 19 publications

Robust Deepfake On Unrestricted Media: Generation And Detection

Robust Deepfake On Unrestricted Media: Generation And Detection

Exploring Frequency Adversarial Attacks for Face Forgery Detection

A Local Perturbation Generation Method for GAN-Generated Face Anti-Forensics

Contact Info

Product

Resources

About