{"type":"ScholarlyArticle","title":"Anti-Forgery: Towards a Stealthy and Robust DeepFake Disruption Attack via Adversarial Perceptual-aware Perturbations","authors":[{"name":"Run Wang","slug":"run-wang","given":"Run","family":"Wang","affiliation":"School of Cyber Science and Engineering , Wuhan University , China; Key Laboratory of Aerospace Information Security and Trusted Computing , Ministry of Education , China"},{"name":"Ziheng Huang","slug":"ziheng-huang","given":"Ziheng","family":"Huang","affiliation":"School of Cyber Science and Engineering , Wuhan University , China; Key Laboratory of Aerospace Information Security and Trusted Computing , Ministry of Education , China"},{"name":"Zhikai Chen","slug":"zhikai-chen","given":"Zhikai","family":"Chen","affiliation":"Tencent Zhuque Lab"},{"name":"Li Liu","slug":"li-liu","given":"Li","family":"Liu","affiliation":"Fudan Development Institute , Fudan University , China"},{"name":"Jing Chen","slug":"jing-chen","given":"Jing","family":"Chen","affiliation":"School of Cyber Science and Engineering , Wuhan University , China; Key Laboratory of Aerospace Information Security and Trusted Computing , Ministry of Education , China"},{"name":"Lina Wang","slug":"lina-wang","given":"Lina","family":"Wang","affiliation":"School of Cyber Science and Engineering , Wuhan University , China; Key Laboratory of Aerospace Information Security and Trusted Computing , Ministry of Education , China; Zhengzhou Xinda Institute of Advanced Technology"}],"abstract":"DeepFake is becoming a real risk to society and brings potential threats to both individual privacy and political security due to the DeepFaked multimedia are realistic and convincing. However, the popular DeepFake passive detection is an ex-post forensics countermeasure and failed in blocking the disinformation spreading in advance. To address this limitation, researchers study the proactive defense techniques by adding adversarial noises into the source data to disrupt the DeepFake manipulation. However, the existing studies on proactive DeepFake defense via injecting adversarial noises are not robust, which could be easily bypassed by employing simple image reconstruction revealed in a recent study MagDR. \r\n\r\nIn this paper, we investigate the vulnerability of the existing forgery techniques and propose a novel anti-forgery technique that helps users protect the shared facial images from attackers who are capable of applying the popular forgery techniques. Our proposed method generates perceptual-aware perturbations in an incessant manner which is vastly different from the prior studies by adding adversarial noises that is sparse. Experimental results reveal that our perceptual-aware perturbations are robust to diverse image transformations, especially the competitive evasion technique, MagDR via image reconstruction. Our findings potentially open up a new research direction towards thorough understanding and investigation of perceptual-aware adversarial attack for protecting facial images against DeepFakes in a proactive and robust manner. Code is available at https://github.com/AbstractTeen/AntiForgery.","doi":"10.24963/ijcai.2022/107","url":"https://ijcai.org/proceedings/2022/107","pdf":"https://ijcai.org/proceedings/2022/0107.pdf","markdown":"https://ijcai.org/proceedings/2022/107.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/107","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"AI Ethics, Trust, Fairness","track":"Main Track","number":107,"pages":{"first":761,"last":767},"keywords":["Multidisciplinary Topics and Applications: Security and Privacy","AI Ethics, Trust, Fairness: Societal Impact of AI"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986616","length_sec":101,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38984759","length_sec":563,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Carlini and Farid, 2020] Nicholas Carlini and Hany Farid. Evad- ing deepfake-image detectors with white-and black-box attacks. In CVPR Workshops, pages 658-659, 2020.","title":"Evading deepfake-image detectors with white-and black-box attacks","authors":"Farid Carlini, Nicholas Carlini, Hany Farid","year":"2020","venue":"CVPR Workshops","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Chen et al., 2021] Zhikai Chen, Lingxi Xie, Shanmin Pang, Yong He, and Bo Zhang. Magdr: Mask-guided detection and recon- struction for defending deepfakes. In CVPR, pages 9014-9023, 2021.","title":"Magdr: Mask-guided detection and reconstruction for defending deepfakes","authors":"Chen","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Choi et al., 2018] Yunjey Choi, Minje Choi, Munyoung Kim, Jung-Woo Ha, Sunghun Kim, and Jaegul Choo. Stargan: Uni- fied generative adversarial networks for multi-domain image-to- image translation. In CVPR, pages 8789-8797, 2018.","title":"Stargan: Unified generative adversarial networks for multi-domain image-toimage translation","authors":"Choi","year":"2018","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[He et al., 2019] Zhenliang He, Wangmeng Zuo, Meina Kan, Shiguang Shan, and Xilin Chen. Attgan: Facial attribute edit- ing by only changing what you want. TIP, 28(11):5464-5478, 2019.","title":"Attgan: Facial attribute editing by only changing what you want","authors":"He","year":"2019","venue":"TIP","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Hu et al., 2021] Shu Hu, Yuezun Li, and Siwei Lyu. Exposing gan- generated faces using inconsistent corneal specular highlights. In ICASSP, pages 2500-2504. IEEE, 2021.","title":"Exposing gangenerated faces using inconsistent corneal specular highlights","authors":"Shu Hu, Yuezun Li, Siwei Lyu","year":"2021","venue":"ICASSP","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Huang et al., 2020] Yihao Huang, Felix Juefei-Xu, Run Wang, Qing Guo, Lei Ma, Xiaofei Xie, Jianwen Li, Weikai Miao, Yang Liu, and Geguang Pu. Fakepolisher: Making deepfakes more detection-evasive by shallow reconstruction. In ACM Multime- dia, pages 1217-1226, 2020.","title":"Fakepolisher: Making deepfakes more detection-evasive by shallow reconstruction","authors":"Yihao Huang, Felix Juefei-Xu, Run Wang, Qing Guo, Lei Ma, Xiaofei Xie, Jianwen Li, Weikai Miao, Yang Liu, Geguang Pu","year":"2020","venue":"ACM Multimedia","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Huang et al., 2021] Qidong Huang, Jie Zhang, Wenbo Zhou, Weiming Zhang, and Nenghai Yu. Initiative defense against fa- cial manipulation. In AAAI, volume 35, pages 1619-1627, 2021.","title":"Initiative defense against facial manipulation","authors":"Qidong Huang, Jie Zhang, Wenbo Zhou, Weiming Zhang, Nenghai Yu","year":"2021","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Juefei-Xu et al., 2021] Felix Juefei-Xu, Run Wang, Yihao Huang, Qing Guo, Lei Ma, and Yang Liu. Countering malicious deepfakes: Survey, battleground, and horizon. arXiv preprint arXiv:2103.00218, 2021.","title":"Countering malicious deepfakes: Survey, battleground, and horizon","authors":"Felix Juefei-Xu, Run Wang, Yihao Huang, Qing Guo, Lei Ma, Yang Liu","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Lample et al., 2017] Guillaume Lample, Neil Zeghidour, Nicolas Usunier, Antoine Bordes, Ludovic Denoyer, and Marc'Aurelio Ranzato. Fader networks: Manipulating images by sliding at- tributes. arXiv preprint arXiv:1706.00409, 2017.","title":"Fader networks: Manipulating images by sliding attributes","authors":"Guillaume Lample, Neil Zeghidour, Nicolas Usunier, Antoine Bordes, Ludovic Denoyer, Marc'aurelio Ranzato","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Liu et al., 2019] Ming Liu, Yukang Ding, Min Xia, Xiao Liu, Errui Ding, Wangmeng Zuo, and Shilei Wen. Stgan: A unified selective transfer network for arbitrary image attribute editing. In CVPR, pages 3673-3682, 2019.","title":"Stgan: A unified selective transfer network for arbitrary image attribute editing","authors":"Ming Liu, Yukang Ding, Min Xia, Xiao Liu, Errui Ding, Wangmeng Zuo, Shilei Wen","year":"2019","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Meng and Chen, 2017] Dongyu Meng and Hao Chen. Magnet: a two-pronged defense against adversarial examples. In CCS, pages 135-147, 2017.","title":"Magnet: a two-pronged defense against adversarial examples","authors":"Dongyu Meng, Hao Chen","year":"2017","venue":"CCS","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Perov et al., 2020] Ivan Perov, Daiheng Gao, Nikolay Chervoniy, Kunlin Liu, Sugasa Marangonda, Chris Umé, Mr Dpfks, Carl Shift Facenheim, Luis RP, Jian Jiang, et al. Deepfacelab: A simple, flexible and extensible face swapping framework. arXiv preprint arXiv:2005.05535, 2020.","title":"Deepfacelab: A simple, flexible and extensible face swapping framework","authors":"Ivan Perov, Daiheng Gao, Nikolay Chervoniy, Kunlin Liu, Sugasa Marangonda, Chris Umé, Mr Dpfks, Carl Shift Facenheim, R P Luis, Jian Jiang","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Qian et al., 2020] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detec- tion by mining frequency-aware clues. In ECCV, pages 86-103. Springer, 2020.","title":"Thinking in frequency: Face forgery detection by mining frequency-aware clues","authors":"Qian","year":"2020","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Ruiz et al., 2020] Nataniel Ruiz, Sarah Adel Bargal, and Stan Sclaroff. Disrupting deepfakes: Adversarial attacks against con- ditional image translation networks and facial manipulation sys- tems. In ECCV, pages 236-251. Springer, 2020.","title":"Disrupting deepfakes: Adversarial attacks against conditional image translation networks and facial manipulation systems","authors":"Nataniel Ruiz, Sarah Adel Bargal, Stan Sclaroff","year":"2020","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Segalis, 2020] Eran Segalis. Disrupting deepfakes with an adver- sarial attack that survives training. arXiv e-prints, pages arXiv- 2006, 2020.","title":"Eran Segalis. Disrupting deepfakes with an adversarial attack that survives training","authors":"Segalis","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Thies et al., 2016] Justus Thies, Michael Zollhofer, Marc Stam- minger, Christian Theobalt, and Matthias Nießner. Face2face: Real-time face capture and reenactment of rgb videos. In CVPR, pages 2387-2395, 2016.","title":"Face2face: Real-time face capture and reenactment of rgb videos","authors":"Justus Thies, Michael Zollhofer, Marc Stamminger, Christian Theobalt, Matthias Nießner","year":"2016","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Tripathy et al., 2020] Soumya Tripathy, Juho Kannala, and Esa Rahtu. Icface: Interpretable and controllable face reenactment using gans. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 3385-3394, 2020.","title":"Icface: Interpretable and controllable face reenactment using gans","authors":"Soumya Tripathy, Juho Kannala, Esa Rahtu","year":"2020","venue":"Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Wang et al., 2020] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. In CVPR, pages 8695-8704, 2020.","title":"Cnn-generated images are surprisingly easy to spot","authors":"Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, Alexei A Efros","year":"2020","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Wang et al., 2021a] Run Wang, Felix Juefei-Xu, Meng Luo, Yang Liu, and Lina Wang. Faketagger: Robust safeguards against deepfake dissemination via provenance tracking. In ACM Multi- media, pages 3546-3555, 2021.","title":"Faketagger: Robust safeguards against deepfake dissemination via provenance tracking","authors":"Wang","year":"2021","venue":"ACM Multimedia","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Wang et al., 2021b] Run Wang, Felix Juefei-Xu, Lei Ma, Xiaofei Xie, Yihao Huang, Jian Wang, and Yang Liu. Fakespotter: a simple yet robust baseline for spotting ai-synthesized fake faces. In IJCAI, pages 3444-3451, 2021.","title":"Fakespotter: a simple yet robust baseline for spotting ai-synthesized fake faces","authors":"Wang","year":"2021","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2020/476"},{"position":21,"raw":"[Xiao et al., 2020] Kai Yuanqing Xiao, Logan Engstrom, Andrew Ilyas, and Aleksander Madry. Noise or signal: The role of image backgrounds in object recognition. In ICLR, 2020.","title":"Noise or signal: The role of image backgrounds in object recognition","authors":"Kai Yuanqing, Xiao, Logan Engstrom, Andrew Ilyas, Aleksander Madry","year":"2020","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Yang et al., 2020] Chaofei Yang, Lei Ding, Yiran Chen, and Hai Li. Defending against gan-based deepfake attacks via transformation-aware adversarial faces. arXiv preprint arXiv:2006.07421, 2020.","title":"Defending against gan-based deepfake attacks via transformation-aware adversarial faces","authors":"Chaofei Yang, Lei Ding, Yiran Chen, Hai Li","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Yeh et al., 2020] Chin-Yuan Yeh, Hsi-Wen Chen, Shang-Lun Tsai, and Sheng-De Wang. Disrupting image-translation-based deep- fake algorithms with adversarial attacks. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vi- sion Workshops, pages 53-62, 2020.","title":"Disrupting image-translation-based deepfake algorithms with adversarial attacks","authors":"Chin-Yuan Yeh, Shang-Lun Hsi-Wen Chen, Sheng-De Tsai, Wang","year":"2020","venue":"Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision Workshops","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}