Source-linked AI summary
FakeSpotter: A Simple yet Robust Baseline for Spotting AI-Synthesized Fake Faces
Run Wang, Felix Juefei-Xu, Lei Ma, Xiaofei Xie, Yihao Huang, Jian Wang, Yang Liu
TL;DR
Robust detectors have not fully addressed the range of AI-synthesized fake faces and their robustness to perturbations. FakeSpotter monitors neuron behaviors in deep face-recognition systems to detect fakes. It reports high accuracy across four fake-face types and limited AUC loss under four perturbation attacks.
Problem
Earlier approaches had not fully covered four fake-face types while thoroughly evaluating robustness to perturbation attacks.
Source: §1 · p. 2Method
FakeSpotter uses a binary classifier on layer-by-layer neuron behaviors from deep face-recognition systems to distinguish real from fake faces.
Source: §1 · p. 2, §3.3 · p. 4Results
FakeSpotter outperforms AutoGAN, averages more than 90% detection accuracy across four fake-face types, and loses less than 3.77% average AUC under four perturbation attacks.
Source: §1 · p. 2Takeaways & Limitations
The neuron-coverage approach achieves high detection rates and low false alarm rates, and the authors suggest it could extend to fake speech detection.
Source: §5 · p. 6DFDC performance is less ideal because its fakes include voice swaps, while FakeSpotter considers facial images without voice.
Source: §4.5 · p. 6
Abstract
from arXiv · showhide
In recent years, generative adversarial networks (GANs) and its variants have achieved unprecedented success in image synthesis. They are widely adopted in synthesizing facial images which brings potential security concerns to humans as the fakes spread and fuel the misinformation. However, robust detectors of these AI-synthesized fake faces are still in their infancy and are not ready to fully tackle this emerging challenge. In this work, we propose a novel approach, named FakeSpotter, based on monitoring neuron behaviors to spot AI-synthesized fake faces. The studies on neuron coverage and interactions have successfully shown that they can be served as testing criteria for deep learning systems, especially under the settings of being exposed to adversarial attacks. Here, we conjecture that monitoring neuron behavior can also serve as an asset in detecting fake faces since layer-by-layer neuron activation patterns may capture more subtle features that are important for the fake detector. Experimental results on detecting four types of fake faces synthesized with the state-of-the-art GANs and evading four perturbation attacks show the effectiveness and robustness of our approach.
1 Introduction
FakeSpotter detects GAN-synthesized fake faces by monitoring neuron behaviors in deep face-recognition systems. It is evaluated across four fake-face types and perturbation attacks, with reported high detection accuracy and robustness.
1 Introduction
- The paper considers entire face synthesis, attribute editing, expression manipulation, and identity swaps, which raise security and privacy concerns.Source: §1 · p. 1
- Earlier approaches had not fully addressed all four fake-face types while thoroughly evaluating robustness to perturbation attacks.Source: §1 · p. 2
- FakeSpotter is presented as the first neuron-coverage-based fake detector, monitoring layer-by-layer behaviors in deep face-recognition systems with a binary classifier.The approach uses the representations learned by face-recognition systems to capture subtle differences between real and fake faces.Source: §1 · p. 2
- FakeSpotter outperforms AutoGAN, averages more than 90% detection accuracy across four fake-face types, and loses less than 3.77% average AUC under four perturbation attacks.The attacks are evaluated at various intensities.Source: §1 · p. 2
2 Related Work
The related work describes GANs for synthesizing and editing faces, then reviews detection approaches based on image forensics, learned representations, and image artifacts. It identifies sensitivity to perturbations and advancing GANs as unresolved challenges.
2.1 Image Synthesis
- GANs produce entire synthetic faces, edit attributes and expressions, and swap identities; these faces can be almost indistinguishable to humans.Source: §2.1 · p. 2
2.2 Fake Face Detection
- Fake-face detectors use pixel-level forensics, deep neural networks, and ad-hoc artifacts such as landmarks or GAN fingerprints.Examples include co-occurrence matrices, saturated-pixel frequencies, attention-based CNNs, and classifiers targeting up-sampling artifacts.Source: §2.2 · p. 2
- Prior approaches can be vulnerable to perturbations, and artifact-based methods may fail as GANs improve.Source: §2.2 · pp. 2–3
3 Our Method
FakeSpotter uses layer-wise neuron activations in deep face-recognition systems to distinguish real from synthesized faces. It sets activation thresholds per layer and trains a shallow binary classifier on counts of activated neurons.
3.1 Insight
- FakeSpotter monitors layer-by-layer neuron behavior in deep face-recognition systems because those activations may capture subtle differences between real and synthesized faces.The method uses a simple binary classifier rather than the final-layer output as its feature representation.Source: §3.1 · p. 3, Figure 2 · p. 3
3.2 Monitoring Neuron Behaviors
- The method sets a separate activation threshold for each layer, using the average neuron output for that layer across training inputs.MNC determines activation by checking whether a neuron's output exceeds its layer's threshold.Source: §3.2 · p. 3
3.3 Detecting Fake Faces
- The classifier uses general neuron behavior rather than raw pixels, which the paper notes could be perturbed by attackers and trigger erroneous behavior.The section describes the detector as a simple binary classifier.Source: §3.3 · pp. 3–4
- FakeSpotter forms each face's feature vector from the number of activated neurons in each layer, then uses a supervised binary classifier to predict real versus fake.At prediction time, the face is processed by the deep face-recognition system to extract these layer-wise features.Source: §3.3 · p. 4
4 Experiments
The experiments evaluate FakeSpotter on four types of GAN-synthesized fake faces, under common perturbation attacks, and on Celeb-DF(v2). They report strong detection results, robustness to the tested transformations, and limitations for cases involving voice manipulation.
4.1 Experimental Setup
- The experiments use diverse real and generated face sources, different identities for training and testing, and an independent Celeb-DF dataset for comparison.The monitoring system uses VGG-Face with a ResNet50 backend; robustness tests cover compression, resizing, noise, and blur.Source: §4.1 · pp. 4–5
4.2 Detection Performance
- FakeSpotter outperforms AutoGAN across four fake-face types, with high detection rates and low false-alarm rates.Table 2 reports performance for FakeSpotter and AutoGAN across entire synthesis, attribute editing, expression manipulation, and DeepFake.Source: §4.2 · p. 5, Table 2 · p. 6
- Advanced GANs and minor facial manipulations are harder to detect; accuracy is 91.8% for StyleGAN2 versus 98.6% for PGGAN.The authors also report that entire face synthesis is easier to spot than partial manipulation.Source: §4.2 · p. 5
4.3 Robustness Analysis
- Average AUC decreases by less than 3.77% across four perturbation attacks at five intensities.The authors report more noticeable variation for FaceForensics++ and StyleGAN expression manipulation.Source: §4.3 · p. 6
4.4 Performance on Celeb-DF(v2)
- On Celeb-DF(v2), FakeSpotter reaches 66.8% AUC and outperforms all listed methods.The result is reported for the dataset’s provided test set.Source: §4.4 · p. 6, Figure 5 · p. 6
4.5 Discussion
- DFDC performance is weaker because its fakes may combine face and voice swaps, while FakeSpotter analyzes facial images only.The authors note that voice swaps may cause false alarms and that adversarial noise could also evade detection.Source: §4.2 · p. 5, §4.5 · p. 6
5 Conclusion and Future Research Directions
FakeSpotter detects four typical SOTA fake-face types with high detection and low false-alarm rates, and is robust to four common perturbation attacks. The authors identify further directions including broader fake-face benchmarks and combining detection with localization.
5 Conclusion and Future Research Directions
- FakeSpotter achieves high detection and low false-alarm rates across four typical SOTA fake-face types and is robust against four common perturbation attacks.The authors describe neuron-coverage-based detection as a new insight that may extend to fake speech detection.Source: §5 · p. 6
- A public benchmark containing diverse, high-quality fake faces produced by SOTA GANs is still lacking.The authors identify building such a benchmark as future work.Source: §5 · p. 7
- Combining FakeSpotter with novel fake-localization methods is identified as a direction for future research.Source: §5 · p. 7
- The authors conjecture that FakeSpotter could work alongside nonadditive-noise adversarial attacks, whose attacked images do not reveal the noise pattern.Source: §5 · p. 7