Source-linked AI summary
GANprintR: Improved Fakes and Evaluation of the State of the Art in Face Manipulation Detection
João C. Neves, Ruben Tolosana, Ruben Vera-Rodriguez, Vasco Lopes, Hugo Proença, Julian Fierrez
TL;DR
Realistic GAN-generated facial images can expose limitations in manipulation detectors that rely on GAN fingerprints. The paper proposes an autoencoder-based fingerprint-removal method, evaluates detectors across conditions, and reports substantially reduced detection performance on unseen or transformed data, motivating more robust detection systems.
Problem
Increasingly realistic GAN-generated faces create a need to assess whether facial manipulation detectors remain effective beyond familiar sources and conditions.
Method
GANprintR trains an autoencoder on genuine face images and applies it to synthetic faces to reduce GAN fingerprints while preserving visual appearance.
Results
Detection performance is nearly perfect for fakes from training sources but decreases substantially on unseen databases and after image transformations such as reduced resolution.
Takeaways & Limitations
Existing facial fake detectors have poor generalisation and can be confounded by transformed fakes that maintain high visual similarity to the originals.
Takeaways & Limitations
The study’s conclusions are scoped to entire-face synthesis and the evaluated detector, database, and transformation conditions.
Abstract
from arXiv · showhide
The availability of large-scale facial databases, together with the remarkable progresses of deep learning technologies, in particular Generative Adversarial Networks (GANs), have led to the generation of extremely realistic fake facial content, raising obvious concerns about the potential for misuse. Such concerns have fostered the research on manipulation detection methods that, contrary to humans, have already achieved astonishing results in various scenarios. In this study, we focus on the synthesis of entire facial images, which is a specific type of facial manipulation. The main contributions of this study are four-fold: i) a novel strategy to remove GAN "fingerprints" from synthetic fake images based on autoencoders is described, in order to spoof facial manipulation detection systems while keeping the visual quality of the resulting images; ii) an in-depth analysis of the recent literature in facial manipulation detection; iii) a complete experimental assessment of this type of facial manipulation, considering the state-of-the-art fake detection systems (based on holistic deep networks, steganalysis, and local artifacts), remarking how challenging is this task in unconstrained scenarios; and finally iv) we announce a novel public database, named iFakeFaceDB, yielding from the application of our proposed GAN-fingerprint Removal approach (GANprintR) to already very realistic synthetic fake images. The results obtained in our empirical evaluation show that additional efforts are required to develop robust facial manipulation detection systems against unseen conditions and spoof techniques, such as the one proposed in this study.
I. INTRODUCTION
The paper addresses entire-face synthesis, where increasingly realistic GAN-generated fakes can be detected through GAN fingerprints. It introduces GANprintR, evaluates detection methods across conditions, and releases iFakeFaceDB.
- Entire-face synthesis uses GANs to generate non-existent faces by sampling learned human-face distributions.
- GAN fingerprints make synthetic faces comparatively easy for state-of-the-art detectors to distinguish from real images.
- GANprintR is an autoencoder-based approach designed to spoof facial manipulation detectors while preserving resulting-image visual quality.
- The study evaluates holistic deep networks, steganalysis, and local-artifact detectors on realistic GAN-generated fakes in controlled and in-the-wild scenarios.
- iFakeFaceDB is a public database produced by applying GANprintR to already realistic synthetic images.
II. RELATED WORK
Prior work detects entire-face synthesis using visual artifacts, deep representations, neuron behavior, attention mechanisms, and GAN fingerprints. Reported approaches span conventional classifiers, deep networks, and analyses of human detection difficulty and GAN-source attribution.
- The paper positions GANprintR within broader studies of entire-face synthesis detection and general GAN-based image manipulation.
- Existing detectors use colour features, facial-region artifacts, deep representations, and neuron-coverage behavior with classifiers such as SVMs and Random Forests.
- Attention-based CNN processing achieved a 0.05% EER on real CelebA, FFHQ, and FaceForensics++ faces with PGGAN- and StyleGAN-generated fakes.
- Human participants achieved 53.5% performance, with chance at 50%, when classifying real and artist- or Photoshop-generated face images.
- GAN-fingerprint attribution methods learn source-specific fingerprints to identify the GAN instance or real-world source associated with an image.
III. PROPOSED APPROACH:
GANprintR uses a convolutional autoencoder trained on real faces to reconstruct synthetic inputs while reducing high-frequency GAN fingerprints. The resulting transformed fakes are intended to retain visual appearance while becoming harder for detectors to distinguish.
- GANprintR treats GAN fingerprints as high-frequency signals and uses an autoencoder as a nonlinear low-pass filter to reduce them.
- The autoencoder encodes an input image X into latent representation l and decodes l into reconstructed image X′.
- Training minimizes reconstruction loss Lψ,γ(X, X′) = ||X − X′||2 over a development dataset.
- The convolutional autoencoder uses 3×3 filters, ReLU activations, 2×2 max-pooling, and a 28×28×8 bottleneck.
- The model is trained on real face images, then applied only to synthetic faces during evaluation to generate improved fakes with reduced GAN fingerprints.
IV. DATABASES
The experimental framework considers four public databases and one generated database, with examples presented in Figure 3.
- Four public databases and one generated database are included in the experimental framework.
1) CASIA-WebFace [39]:
The experimental framework combines large real-face databases with synthetic images generated by StyleGAN and PGGAN. These sources vary substantially in scale, subject diversity, pose, illumination, and background conditions.
- One database contains 494,414 face images from 10,575 IMDb actors and actresses, with random pose, illumination, expression, and resolution variations.
- Another database contains 3.31 million images from 9,131 subjects, with broad variation in pose, age, illumination, ethnicity, and profession.
- The synthetic datasets include 150,000 StyleGAN faces from FFHQ, 100,000 StyleGAN images from 29,000 photos of 69 models, and 80,000 PGGAN faces from CelebA-HQ.
V. EXPERIMENTAL SETUP
The experimental setup removes background and head-pose confounds, then evaluates three complementary state-of-the-art detectors: holistic deep learning, steganalysis, and local artifact analysis.
- Pre-processing: The authors curate datasets to remove confounding variables, focusing on background and head pose.
- Pre-processing: GAN-generated faces are usually frontal, so retaining only frontal real and synthetic images prevents non-frontal real faces from falsely improving detection performance.
- Pre-processing: The preprocessing extracts 68 landmarks and uses eye alignment plus pose estimation to remove background information and filter face orientation.
- Detection systems: The evaluated detectors are XceptionNet, pixel-channel co-occurrence steganalysis, and a local-artifact classifier targeting regions such as eyes, teeth, and facial contours.
C. Protocol
The protocol tests detection in controlled, in-the-wild, and GAN-fingerprint-removal conditions using separated development and evaluation data. GANprintR is trained independently to support an unbiased assessment.
- The protocol includes controlled scenarios, in-the-wild scenarios, and evaluation after GAN-fingerprint removal.
- Each database is split into 70% development and 30% evaluation data, with development further divided into 75% training and 25% validation.
- GANprintR is trained for 100 epochs with Adam, a 10^-3 learning rate, and mean squared error on MS-Celeb images disjoint from detector datasets.
VI. EXPERIMENTAL RESULTS
Controlled experiments show that detector performance depends strongly on the detection approach. XceptionNet performs nearly ideally, steganalysis is weaker, and local-artifact detection performs poorly.
- Controlled scenarios: Six controlled experiments evaluate development and evaluation setups using EER, while Fig. 4 tracks XceptionNet and steganalysis training in Exp. A.1.
- Controlled scenarios: 99% and 95% are the best validation accuracies for XceptionNet and steganalysis, respectively, in Exp. A.1.
- Controlled scenarios: EER values below 0.5% indicate almost ideal XceptionNet performance across the controlled experiments.
- Controlled scenarios: 16% EER is obtained for steganalysis in Exp. A.5, reflecting greater degradation than XceptionNet, especially on the 100K-Face database.
- Controlled scenarios: 35.5% average EER makes Local Artifacts the least efficient approach across the controlled experiments.
B. In-the-Wild Scenarios
In-the-wild evaluations reveal substantial degradation when detectors encounter different synthetic sources or simple image transformations. These results indicate poor generalisation to unseen conditions.
- Different databases: 11.2% average EER for XceptionNet rose from below 0.5% when synthetic databases changed between development and evaluation.Steganalysis reached 32.5% versus 9.8%, while Local Artifacts reached 42.4%, indicating degradation across detector types.
- Different databases: 9.3%, 32.3%, and 42.3% average EERs were obtained for XceptionNet, Steganalysis, and Local Artifacts when both real and synthetic databases differed.These values showed no significant gap from experiments changing only the synthetic evaluation set.
- Image transformations: Image transformations caused high detection-performance degradation, demonstrating vulnerability to unseen conditions even after simple modifications.The evaluation included resolution downsizing and low-pass filtering, with EER, Recall, PSRN, and SSIM reported.
- Image transformations: EER increased significantly as evaluation resolution decreased, although the model had been trained at raw resolution.This trend is shown for XceptionNet across progressively downsized images.
- Image transformations: Performance degradation exceeded 6% after resolution reduction and produced EERs above 15% at further reductions.These results support poor generalisation of state-of-the-art detectors to unseen conditions.
C. GAN-Fingerprint Removal
GANprintR transforms realistic synthetic faces to reduce detector performance while preserving visual similarity. Smaller autoencoder latent representations increase detection error without substantially changing image quality.
- GANprintR evaluation: 9.8% average EER followed GANprintR, compared with below 0.5% for original fakes.GANprintR produced higher fake-detection error than other attacks at similar or better visual quality.
- Latent representation: Smaller latent feature representations significantly increased EER while PSNR remained tightly ranged across reconstructed images.Face examples showed no substantial visual differences between original and transformed fakes.
- Fingerprint removal: GANprintR remained effective when detectors trained at different resolutions were tested on transformed fakes.Stable EER values across downsized training images support removal of GAN-fingerprint information rather than merely reducing resolution.
D. Impact of GANprintR on other Fake Detectors
GANprintR degrades all three evaluated detector families, extending beyond XceptionNet. The paper concludes that existing detectors generalise poorly and remain vulnerable to transformed synthetic images.
- Detector comparison: 9.65%, 14.68%, and 4.91% average absolute EER worsening occurred for XceptionNet, Steganalysis, and Local Artifacts, respectively.Local Artifacts was most robust, but already had 35.54% average EER on original fakes.
- Method and scope: The autoencoder removes high-frequency GAN fingerprints from synthetic faces while preserving their visual appearance.It models spatial correlations in genuine faces and produces manipulated synthetic images at test time.
- Conclusions: Existing detectors perform almost perfectly on same-source data but degrade substantially on unseen databases, reduced resolutions, and GANprintR-transformed images.The reported conclusion identifies poor generalisation across these conditions.
- Conclusions: The experiments suggest detectors are highly susceptible to simple transformations such as downsizing and compression while GANprintR maintains high visual similarity.The authors propose using improved fakes to harden future detectors.