Source-linked AI summary
Do GANs leave artificial fingerprints?
Francesco Marra, Diego Gragnaniello, Luisa Verdoliva, Giovanni Poggi
TL;DR
Realistic GAN-generated multimedia may evade visual scrutiny, creating a need for forensic methods that can identify synthetic content. This paper extracts residual-based fingerprints from GAN outputs and evaluates their forensic value, finding distinctive marks that support highly accurate source attribution. The authors also identify robustness, scalability, and fingerprint-dependence questions for future work.
Problem
Realistic GAN manipulations may evade visual scrutiny, motivating forensic countermeasures against fake multimedia.
Method
The paper estimates GAN fingerprints from image residuals using an extraction pipeline analogous to PRNU analysis and averages residuals to form the fingerprint.
Results
GANs leave distinctive fingerprints that enable reliable forensic analysis across multiple architectures and training sets.
Takeaways & Limitations
GAN fingerprints provide a forensic signal for source identification and can complement deep-network detection in challenge data.
Takeaways & Limitations
The fingerprint’s dependence on architecture, parameters, datasets, and subsequent processing remains to be assessed.
Abstract
from arXiv · showhide
In the last few years, generative adversarial networks (GAN) have shown tremendous potential for a number of applications in computer vision and related fields. With the current pace of progress, it is a sure bet they will soon be able to generate high-quality images and videos, virtually indistinguishable from real ones. Unfortunately, realistic GAN-generated images pose serious threats to security, to begin with a possible flood of fake multimedia, and multimedia forensic countermeasures are in urgent need. In this work, we show that each GAN leaves its specific fingerprint in the images it generates, just like real-world cameras mark acquired images with traces of their photo-response non-uniformity pattern. Source identification experiments with several popular GANs show such fingerprints to represent a precious asset for forensic analyses.
1 Introduction
GANs can generate increasingly realistic images, creating a need for forensic tools that detect synthetic multimedia. The paper investigates whether GAN processing leaves stable, model-specific fingerprints that can support source identification.
- 1 Introduction: GANs can generate realistic images and convert existing images into new contexts, with progressive GANs supporting arbitrary resolutions.These capabilities increase the visual realism of generated content.
- 1 Introduction: Realistic GAN manipulations may evade visual scrutiny, motivating forensic tools for detecting fake multimedia.The introduction contrasts visibly flawed outputs with photorealistic results and warns that such images may soon consistently pass inspection.
- 1 Introduction: Unlike cameras, GANs do not leave camera-related marks, but their filtering processes may imprint distinctive marks on generated images.This motivates testing whether GAN outputs contain artificial fingerprints analogous to device fingerprints.
- 1 Introduction: The paper asks whether images from a given GAN share a common, stable pattern that reveals their origin and remains reliable, robust, and discriminative.These questions define the paper’s forensic investigation.
- 1 Introduction: Experiments with several GAN architectures and datasets show that GANs leave specific fingerprints usable for reliable forensic analyses.This is presented as the paper’s first answer to the motivating questions.
2 Related Work
Prior work detects GAN-generated images using visual, color, and learned features, but these approaches can depend strongly on the architecture being detected. The paper positions GAN-induced fingerprints as a distinct forensic signal not exploited by earlier deep-network discrimination methods.
- 2 Related Work: Earlier methods detect GAN-generated images through semantic, visual, and color inconsistencies such as mismatched eyes, teeth, contours, or eye colors.These cues exploit artifacts visible in generated content, especially faces.
- 2 Related Work: Performance can degrade sharply when a detector is applied to images generated by a different GAN architecture.This observation suggests that artifacts may be specific to individual GAN models.
- 2 Related Work: A deep network can discriminate images from different GAN architectures, but it requires intensive training on aligned data and does not exploit GAN-induced fingerprints.The paper distinguishes this learned discrimination approach from explicit fingerprint analysis.
3 Exposing GAN fingerprints
The paper estimates GAN fingerprints as stable disturbances in generated images, then tests whether correlations with those fingerprints support source identification. Fingerprints converge to quasi-periodical patterns and separate same-GAN from cross-GAN residuals with near-perfect ROC performance.
- Fingerprint estimation: The pipeline treats each GAN fingerprint as a deterministic residual component and estimates it by averaging residuals across generated images.The residual is modeled as fingerprint F plus random noise Wi; averaging suppresses the noise component.
- Fingerprint estimation: As N grows from 2 to 512 residuals, fingerprint estimates converge to stable quasi-periodical patterns as additive image-related noise vanishes.The N values tested are 2, 8, 32, 128, and 512.
- Fingerprint estimation: The fitted limiting fingerprint energies are 0.0377 for Cycle-GAN and 0.0088 for Pro-GAN.The energy curve fitting is reported as accurate for large N.
- Source identification: Source identification compares residual-to-fingerprint correlations, using normalized inner-product correlation indices and fingerprints estimated with N = 29.The method tests whether residuals correlate more with their same-GAN fingerprint than with a cross-GAN fingerprint.
- Source identification: Same-GAN correlations exceed cross-GAN correlations, whose distributions center around zero, enabling reliable discrimination between the two GAN sources.This separation is observed for both GAN directions.
- Source identification: The two source-identification ROC curves achieve AUC 0.990 and 0.998, respectively, while experiments across additional GANs yield similar results.The broader experiments vary architecture and/or training set.
4 Source identification experiments
Source-identification experiments found that residuals correlate most strongly with fingerprints from their own dataset, enabling highly accurate attribution across GANs and cameras. Fingerprints also show weaker architecture-family structure and remain effective after high-quality JPEG compression.
- Cycle-GAN, Pro-GAN, and Star-GAN datasets were used for larger-scale source-identification experiments, alongside real-camera data.
- Diagonal residual-fingerprint correlations exceed off-diagonal correlations, showing that each dataset matches its own fingerprint most strongly.Weaker correlations also appear among sibling datasets sharing a GAN architecture, especially Star-GAN datasets with shared generator weights.
- Attribution is very accurate across cases, except for the Star-GAN male and smiling networks.The ROC curves cluster in the upper-left corner, and the confusion matrix shows almost perfect attribution with the same exceptions.
- 90.3% to 90.1%: JPEG compression at QF=95 caused negligible attribution-accuracy loss for GAN-generated images.
- 0.999 AUC: fusing GAN-fingerprint information with a deep network improved accuracy in the Forensics GAN Challenge.The fingerprint analysis identified a large cluster of 1024×1024 images generated with the same GAN.
5 Conclusions and future work
The paper concludes that GAN fingerprints exist and support reliable forensic analyses, while identifying open questions about their dependence on networks and their broader forensic applicability. Future work targets fingerprint robustness, estimation requirements, and additional detection and localization tasks.
- The experiments provide sufficient evidence for GAN fingerprints and their value in reliable forensic analyses.
- Fingerprint dependence on architecture and filter weights remains an important question relevant to improving fingerprint quality and developing counterforensic measures.
- Further studies should assess discrimination of real versus GAN-generated images, localization of GAN-generated material in real images, and robustness to subsequent processing.The listed processing includes JPEG compression, resizing, blurring, and noising.
- Fingerprint-estimation performance still requires study across the number and size of images, including blind attribution and clustering.