Adversarial Perturbations Fool Deepfake Detectors

I. INTRODUCTION

• Over 95% detector accuracy on unperturbed deepfakes fell to less than 27% on perturbed deepfakes.The perturbed image in Fig. 1 is classified as real although the original deepfake is classified as fake.Source: §I · p. 1, Figure 1 · p. 1
• Deepfake misuse can violate individuals' identity and propagate misinformation, including on social media.The passage describes both non-consensual image manipulation and deepfake profile pictures used to spread political messages.Source: §I · p. 1
• The proposed defenses are Lipschitz regularization and Deep Image Prior (DIP), which removes perturbations through unsupervised optimization of a generative CNN.Lipschitz regularization constrains the detector's gradient with respect to its input.Source: §I · p. 1

II. DEEPFAKE CREATION AND DETECTION

• In Fig. 2, perturbed deepfakes look similar to unperturbed deepfakes, and all shown adversarial examples fool both models.ResNet generates perturbations for the first three fake images and VGG for the last two.Source: Figure 2 · p. 2

A. Deepfake Creation

• The Few-Shot Face Translation GAN generated the 5,000 fake images from a single source and target image.It adds SPADE units to the FUNIT generator; FUNIT supports translation across numerous source and target domains and generalizes to unseen domains.Source: A. Deepfake Creation · p. 2

B. Detection Methods

• In tests on the dataset, using a 75%-25% train-test split after 5 epochs of training with batch size 16, VGG-16 and ResNet-18 achieved test accuracies of 99.7% and 93.2%, respectively.Source: B. Detection Methods · p. 2

III. ADVERSARIAL ATTACKS

• FGSM and CW-L2 test efficient and stronger, slower attacks, respectively, and the study perturbs fake images to make them classify as real.The work does not test perturbations of real images.Source: §III · p. 2

A. Fast Gradient Sign Method (FGSM)

• FGSM adds a scaled sign of the input-loss gradient to the image, choosing the perturbation that maximizes the linearized loss under its per-pixel magnitude control.The study used ϵ = 0.02, selected after evaluating attack effectiveness and visual distortions across values from 0.01 to 0.10.Source: A. Fast Gradient Sign Method (FGSM) · p. 3

B. Carlini and Wagner L2 Norm Attack (CW-L2)

• CW-L2 minimizes both the perturbation's L2 norm and an objective that encourages the incorrect-class logit to exceed the true-class logit.κ sets the required logit margin; the study used κ = 200 and a maximum of 1,000 optimization iterations.Source: B. Carlini and Wagner L2 Norm Attack… · p. 3
• CW-L2 changes variables from the perturbed image to ω and combines its objectives in an attack that keeps pixel values in the 0-to-1 range.The parameter c controls the relative strength of the objectives and is selected using a modified binary search; this search and iterative optimization make the attack slow.Source: B. Carlini and Wagner L2 Norm Attack… · p. 3

C. Attack Types

• In a whitebox attack, the adversary has complete access to the target model, including its architecture and parameters.The passage notes that parameter access may be unlikely, while detector architectures may be publicly known.Source: C. Attack Types · p. 3
• In a blackbox attack, the adversary has limited or almost no information, and this study transfers whitebox examples between ResNet and VGG.ResNet-generated examples attack VGG, and VGG-generated examples attack ResNet.Source: C. Attack Types · pp. 3–4

• Blackbox accuracy fell to 8.9% for VGG and 20.8% for ResNet with FGSM, and to 26.6% for VGG and 4.6% for ResNet with CW-L2.Source: D. Attack Results · p. 4
• Under whitebox CW-L2 attacks, accuracy fell from 99.7% for VGG and 95.2% for ResNet on unperturbed fake images to 0.0% for both models.Source: Table II · p. 4, D. Attack Results · p. 4
• Whitebox attacks were more effective than blackbox attacks, while CW-L2 was generally more effective than FGSM except for the blackbox attack on VGG.Source: Figure 3 · p. 4, D. Attack Results · p. 5

• The augmented loss adds L2 norms of logit gradients to the training loss, with λ controlling the regularization strength.Source: A. Lipschitz Regularization · p. 5
• Jaug denotes the augmented loss and J the unaugmented training loss; Z(x)i is the class-i pre-softmax logit, with C classes and N input dimensions.Source: A. Lipschitz Regularization · p. 5
• Linearization suggests minimizing logit-gradient norms can desensitize loss to small perturbations; zero norms make perturbed and original losses equal under the approximation.Source: A. Lipschitz Regularization · p. 5

B. Regularization Results

• Results cover ResNet models only because of computational constraints; tested regularization strengths were λ=5, 50, 500, and 5000, and CW-L2 took around two minutes per image.Source: B. Regularization Results · p. 5
• Unregularized and regularized models both achieved 93.2% accuracy on unperturbed test data on average.Source: B. Regularization Results · p. 5
• Blackbox accuracy rose from 20.8% to 31.5% for FGSM and from 4.6% to 14.3% for CW-L2 on average with regularization.Source: B. Regularization Results · p. 5
• Whitebox regularization raised accuracy from 7.5% to 12.5% for FGSM and from 0.0% to 0.5% for CW-L2 on average, but remained impractical.Source: B. Regularization Results · p. 5

V. DEEP IMAGE PRIOR

• DIP preprocesses inputs to remove perturbations using an unsupervised technique originally developed for image restoration.Source: §V · p. 5

A. Image Restoration with DIP

• Image restoration minimizes a corruption-to-reconstruction dissimilarity plus regularization, which encodes prior knowledge because recovery is generally ill-posed.The dissimilarity is domain-dependent; DIP replaces the reconstruction image with a function of network parameters.Source: A. Image Restoration with DIP · p. 5
• A generative CNN architecture supplies an image prior, allowing DIP to seek a good reconstruction without an explicit regularization term.The network can learn corruptions if optimized too long, so a good reconstruction may occur somewhere along the optimization trajectory.Source: A. Image Restoration with DIP · pp. 5–6
• As DIP optimization proceeds, generated images gain sharpness and detail, while adversarial perturbations become more apparent.The 9,000-iteration image is slightly noisier than those at 3,000 and 6,000 iterations.Source: Figure 5 · p. 6

B. Eliminating Adversarial Perturbations with DIP

• The defense classifies an intermediate DIP-generated image with an existing classifier, using that classifier output as the final image classification.The method replaces the corrupted-image input with the adversarial image and uses pixel-wise mean squared error as the dissimilarity metric.Source: B. Eliminating Adversarial… · p. 6
• The ResNet classifier received 10 additional training epochs with approximately 40% blurry training images to address the lower sharpness of DIP reconstructions.The blurry examples were produced with Gaussian blur kernels using σ values from 3.0 to 5.0; results were similar to those without this augmentation.Source: B. Eliminating Adversarial… · pp. 6–7
• As reconstruction sharpness increases, generated images can also regain adversarial perturbations.The 9,000-iteration reconstruction is slightly noisier than those at 3,000 and 6,000 iterations.Source: B. Eliminating Adversarial… · p. 7
• At iteration 6,000, the classifier predicts the correct class for perturbed fake, unperturbed fake, and real examples along the DIP path.For perturbed fakes, classifier output shifts toward real as perturbations enter the generated image; unperturbed fakes remain classified as fake, while real images reach a real prediction earlier.Source: B. Eliminating Adversarial… · p. 7, Figure 6 · p. 7

C. DIP Experiments

• DIP ran for 10,000 iterations on 100 test-set images, with iteration 6,000 selected after evaluating iterations from 2,500 to 7,500.The generative CNN used a U-Net architecture; each image took a little under 30 minutes on an NVIDIA Tesla K80 GPU.Source: C. DIP Experiments · p. 7
• The sample included 80 perturbed images split among blackbox and whitebox FGSM and CW-L2 cases, with 10 images each for fooled and correctly classified fakes.The 20 unperturbed images comprised 10 correctly classified fakes and 10 correctly classified real images.Source: C. DIP Experiments · p. 7
• All sampled images were correctly classified by the augmented-dataset ResNet in their unperturbed versions.The sampled categories distinguished perturbed fakes classified as real from those classified as fake.Source: C. DIP Experiments · p. 7

D. DIP Results

• At a 0.25 threshold, DIP achieved 95% accuracy on fooled perturbed fakes and 98% accuracy in other cases; overall accuracy was 97.0% and AUROC was 99.2%.The overall metrics applied to the 100-image subsample at both reported classification thresholds.Source: D. DIP Results · p. 8
• A 0.5 threshold yielded 100% recall for unperturbed and perturbed fakes but 70% recall for real images; at 0.25, real recall rose to 90% while fake recall fell to 97.8%.Whitebox FGSM fake-wrong accuracy decreased from 100% to 80% when the threshold changed to 0.25.Source: D. DIP Results · p. 8

VI. DISCUSSION AND LIMITATIONS

• The discussion reports 97.8% recall for perturbed and unperturbed fakes at 0.25, with at least 90.0% of the classifier’s performance retained on real images.Regularization improved robustness but could remain impractical; in whitebox CW-L2, the regularized model classified only 2.2% of perturbed fakes correctly.Source: §VI · p. 8
• The DIP results cover 100 tested images, and the authors call for experiments on adversarial attacks in other domains.Processing took a little under 30 minutes per image on an NVIDIA Tesla K80 GPU, potentially limiting resource-constrained, real-time, or high-volume use.Source: §VI · p. 8