PaperlayerView exact revision on arXiv

Source-linked AI summary

Detecting and Simulating Artifacts in GAN Fake Images

Xu Zhang, Svebor Karaman, Shih-Fu Chang

arXiv:1907.06515v2cs.CVeess.IV

TL;DR

GAN fake-image detectors often require fake images from the attacker’s model, which may be unavailable. The paper introduces AutoGAN to simulate shared GAN artifacts and trains a spectrum-based classifier, achieving state-of-the-art detection on CycleGAN data without seeing its fake images.

  • Problem

    Fake-image classifiers typically require many real and fake images from the targeted GAN, but the attacker’s specific pre-trained model is often inaccessible.

  • Method

    AutoGAN simulates a common GAN generation pipeline using real images, while the classifier uses normalized frequency spectra rather than raw pixels as input.

  • Results

    A spectrum-based classifier trained with AutoGAN images achieves state-of-the-art performance on CycleGAN data without seeing fake images generated by CycleGAN.

  • Takeaways & Limitations

    The approach generalizes well to fake images from GANs with similar generator structures, while differing structures such as GauGAN remain challenging.

Abstract

from arXiv · show

To detect GAN generated images, conventional supervised machine learning algorithms require collection of a number of real and fake images from the targeted GAN model. However, the specific model used by the attacker is often unavailable. To address this, we propose a GAN simulator, AutoGAN, which can simulate the artifacts produced by the common pipeline shared by several popular GAN models. Additionally, we identify a unique artifact caused by the up-sampling component included in the common GAN pipeline. We show theoretically such artifacts are manifested as replications of spectra in the frequency domain and thus propose a classifier model based on the spectrum input, rather than the pixel input. By using the simulated images to train a spectrum based classifier, even without seeing the fake images produced by the targeted GAN model during training, our approach achieves state-of-the-art performances on detecting fake images generated by popular GAN models such as CycleGAN.

I. INTRODUCTION

The paper targets GAN-image detection when the attacker’s model and fake training images are unavailable. It introduces AutoGAN and spectrum-based classification to simulate and detect artifacts shared by popular GAN pipelines.

  • GANs enable near-realistic fake images, creating security and ethical concerns about treating visual media as trustworthy.
  • Conventional detectors collect many real and fake images from targeted GAN models, but attackers’ specific models are generally inaccessible.
  • The paper analyzes shared up-sampling layers and shows that their artifacts appear as spectrum replications in the frequency domain.
  • AutoGAN simulates the common GAN generation pipeline using only real images, producing simulated fake images for classifier training.
  • A spectrum-based classifier trained with simulated images achieves state-of-the-art performance on CycleGAN data without seeing CycleGAN-generated fakes.
  • The contribution combines a GAN simulator that emulates shared generation processes with classifier design based on spectrum input rather than raw pixels.

III. UP-SAMPLING ARTIFACTS IN GAN PIPELINES

Image-translation GAN generators encode inputs and decode low-resolution features into high-resolution outputs. The decoder’s up-sampling layers are therefore central to rendering the final image details.

  • Image-translation models use a discriminator and generator to learn mappings between source and target image categories.
  • The generator contains an encoder that extracts high-level information into a low-resolution feature tensor.
  • The decoder uses up-sampling layers to transform low-resolution feature tensors into high-resolution images.
  • The paper focuses on how the decoder’s up-sampler renders fine details in the final output image.

B. The Up-sampler

Common GAN up-samplers increase resolution by zero insertion followed by convolution, which can replicate spectra and create detectable frequency-domain artifacts. The paper uses this analysis to motivate spectrum-based classification.

  • Transposed convolution and nearest-neighbor interpolation share an up-sampling pipeline that inserts zeros and applies convolution, differing in whether the kernel is learnable or fixed.
  • Zero insertion replicates the low-resolution spectrum across high-frequency regions of the higher-resolution spectrum.
  • The analysis proves the replication property for a one-dimensional signal and states that it extends to two-dimensional images.
  • Subsequent convolution kernels generally need low-pass filtering to remove or reduce replicated high-frequency artifacts.
  • Transposed-convolution kernels are not guaranteed to be low-pass, so checkerboard artifacts can remain visible as bright spectral blobs.
  • The paper therefore trains fake-image classifiers on image spectra rather than raw pixels to detect up-sampling artifacts.

A. Classifier with Spectrum Input

The paper replaces raw-pixel inputs with frequency spectra to expose GAN up-sampling artifacts and proposes AutoGAN to synthesize those artifacts without access to target GAN models. AutoGAN-generated reconstructions can train classifiers using no fake images and accept images from any semantic category.

  • Spectrum-based classifier: Frequency-spectrum inputs replace raw pixels so classifiers can directly detect GAN-induced artifacts.The spectrum is computed from each RGB channel using the 2D DFT, with phase discarded and the logarithmic spectrum normalized to [−1, 1].
  • AutoGAN simulator: AutoGAN synthesizes GAN artifacts in images without accessing any pre-trained GAN model.It uses a generator with a GAN-like structure, including an up-sampling decoder, while assuming only general architectural knowledge.
  • AutoGAN simulator: AutoGAN combines adversarial training with an ℓ1-norm loss that matches generated outputs to their original input images.The discriminator distinguishes generator outputs from real images, while the ℓ1 term encourages input-output similarity.
  • AutoGAN simulator: The resulting reconstructions look similar to real images but retain artifacts, especially in the frequency domain, for classifier training.Training on real and reconstructed images is intended to focus the classifier on artifacts that generalize to other GAN fake images with similar artifacts.
  • AutoGAN simulator: AutoGAN requires no fake training images and accepts inputs from any semantic category, simplifying data collection compared with paired image-translation training.Its pipeline emulates GAN-induced artifacts in real images rather than requiring carefully selected category pairs.

A. Dataset

The experiments compare pixel- and spectrum-based classifiers trained with CycleGAN or AutoGAN images, using one semantic category or diverse data for training. Spectrum-based training improves cross-category generalization, while AutoGAN performance depends on frequency coverage and image diversity.

  • Classifier Setup: The study evaluates four classifiers: Img, Spec, A-Img, and A-Spec, differing by image source and whether pixels or spectra are used.Img and Spec use CycleGAN images; A-Img and A-Spec use AutoGAN reconstructions.
  • CycleGAN Training: Training and testing on the same semantic category gives the CycleGAN image classifier accuracy close to perfect.The evaluation uses all 14 CycleGAN semantic categories.
  • CycleGAN Training: The spectrum-based CycleGAN classifier generalizes better across categories than the pixel-based classifier.Apple, Orange, and Facades are exceptions because compression reduces high-frequency content; Map is an outlier because its satellite imagery differs substantially from other categories.
  • AutoGAN Training: AutoGAN pixel-based classification is inferior, whereas AutoGAN spectrum-based classification is promising for Horse, Summer, and Photo.The pixel-based method suffers from differences between AutoGAN and CycleGAN image quality, while the spectrum method captures shared artifacts.
  • AutoGAN Training: AutoGAN spectrum training requires diverse frequency coverage; zebra and winter images may be inadequate, while artwork categories remain unpromising.A diverse dataset such as MSCOCO provides sufficient coverage and yields reasonable performance without CycleGAN images during training.

D. Leave-One-Out Setting

Under the leave-one-out evaluation, spectrum-based classifiers trained with CycleGAN or AutoGAN images are competitive with state-of-the-art methods. A-Spec achieves this without seeing fake images from any pretrained CycleGAN model.

  • D. Leave-One-Out Setting: Spectrum-based classifiers trained with CycleGAN images and AutoGAN images are competitive with state-of-the-art methods.The comparison uses the leave-one-out setting with all images split into 10 folds.
  • D. Leave-One-Out Setting: A-Spec remains competitive despite never seeing fake images generated by any pretrained CycleGAN model.This result supports the effectiveness of the GAN simulator under the leave-one-out evaluation.

E. Effect of Different Frequency Bands

The frequency-band experiment isolates low-, middle-, and high-frequency components to assess which parts of the spectrum affect classifier performance.

  • E. Effect of Different Frequency Bands: The full spectrum is divided into low-, middle-, and high-frequency bands with approximately equal numbers of data points.Values outside the selected band are set to zero, and six classifiers are trained using CycleGAN and AutoGAN horse images.
  • E. Effect of Different Frequency Bands: The experiment compares classifier performance across frequency bands for models trained with CycleGAN and AutoGAN images.Results are reported in Fig. 7.
  • E. Effect of Different Frequency Bands: The band analysis is motivated by the proposed up-sampling artifact, whose frequency-domain behavior is examined through separated spectral regions.The supplied passages specify the comparison design but do not state which band produces the best performance.

F. Robustness to Post-Processing

Post-processing robustness is evaluated under JPEG compression and image resizing, using mismatched, retrained, and original models. These operations destroy the up-sampling artifact, so retraining on processed images improves performance.

  • F. Robustness to Post-Processing: The study evaluates JPEG compression and image resizing using randomly selected quality factors and target sizes.JPEG quality factors are 100, 90, 70, or 50; resize dimensions are 256, 200, 150, or 128.
  • F. Robustness to Post-Processing: Table III compares original, mismatched, and retrained models under post-processing.Mismatched models train without processing and test with it; retrained models train and test with processed images.
  • F. Robustness to Post-Processing: Models trained without post-processing do not generalize to JPEG-compressed or resized images because both operations destroy the up-sampling artifact.Retraining with randomly selected processing factors improves performance on processed images without assuming each test factor is known.
  • Generalization to Different Up-samplers: When training and testing use the same up-sampler, performance is very good; mismatched up-samplers cause noticeable degradation.The tested up-samplers are transposed convolution and nearest-neighbor interpolation.
  • Generalization to Different Up-samplers: Training with data generated by both up-samplers produces excellent performance for both up-samplers.The combined approach addresses differences in artifacts and the lower artifact level of nearest-neighbor outputs.

2) Generalization to Different Models:

Spectrum-based classifiers generalize from CycleGAN to StarGAN, while GauGAN remains outside the demonstrated generalization range because its generator structure differs substantially. AutoGAN supports this cross-model evaluation without requiring the target model's fake images for training.

  • Generalization to Different Models:: Spectrum-based classifiers generalize well from CycleGAN to StarGAN images, whereas the CycleGAN image classifier fails on StarGAN.StarGAN and CycleGAN use similar generators with two transposed-convolution up-samplers.
  • Generalization to Different Models:: All classifiers fail on GauGAN images because GauGAN uses five nearest-neighbor up-samplers instead of CycleGAN's structure.The result marks a boundary for generalization across substantially different generator architectures.
  • Generalization to Different Models:: The AutoGAN spectrum-based classifier generalizes well to fake images generated by GANs with similar structures without requiring fake images or specific GAN models as training data.AutoGAN simulates the common GAN pipeline and synthesizes artifacts in real images for classifier training.
Loading 1907.06515v2…