PaperlayerView exact revision on arXiv

Source-linked AI summary

What makes fake images detectable? Understanding properties that generalize

Lucy Chai, David Bau, Ser-Nam Lim, Phillip Isola

arXiv:2008.10588v1cs.CV

TL;DR

Fake-image detectors must generalize beyond continually evolving synthesis methods, but it is unclear which artifacts transfer across sources. The paper uses limited-receptive-field patch classifiers to visualize such properties, exaggerates them, and tests adversarially finetuned generators. Patch-based detectors often generalize better to out-of-domain facial images, while finetuned generators still leave detectable patch-level artifacts.

  • Problem

    The paper asks which fake-image properties allow detectors to generalize to unseen images from evolving synthesis methods.

  • Method

    The authors use fully convolutional classifiers with limited receptive fields to analyze local patches, visualize detectable properties, and control preprocessing differences.

  • Results

    Patch-based classifiers often perform better than full-image classifiers on out-of-domain synthetic facial images, while finetuned generators still contain detectable patch-level mistakes.

  • Takeaways & Limitations

    Local artifacts can transfer across synthetic image sources, but creating coherent fake images without detectable local traces remains difficult.

  • Takeaways & Limitations

    The detector remains vulnerable to better generators, out-of-distribution images, and adversarial attacks, and preprocessing differences can otherwise create misleading generalization.

Abstract

from arXiv · show

The quality of image generation and manipulation is reaching impressive levels, making it increasingly difficult for a human to distinguish between what is real and what is fake. However, deep networks can still pick up on the subtle artifacts in these doctored images. We seek to understand what properties of fake images make them detectable and identify what generalizes across different model architectures, datasets, and variations in training. We use a patch-based classifier with limited receptive fields to visualize which regions of fake images are more easily detectable. We further show a technique to exaggerate these detectable properties and demonstrate that, even when the image generator is adversarially finetuned against a fake image classifier, it is still imperfect and leaves detectable artifacts in certain image patches. Code is available at https://chail.github.io/patch-forensics/.

1 Introduction

The paper studies which local properties make synthetic and manipulated images detectable and generalize across generators, datasets, and training variations. It uses patch-based classifiers and preprocessing controls to reveal detectable artifacts, including artifacts that remain after adversarial generator finetuning.

  • Motivation: The central question is which fake-image properties transfer to unseen generators and datasets rather than reflecting generator-specific content.The authors distinguish shared local artifacts from differences caused by global content, initialization, and other source-specific factors.
  • Approach: Limited-receptive-field, fully convolutional classifiers focus on local patches and produce patch-wise predictions that visualize detectable fake-image properties.The approach targets textures and other local artifacts instead of relying only on global image semantics.
  • Experimental control: Careful preprocessing reduces formatting differences so classifiers focus on inherent differences between real and generated or manipulated images.Minor codec or formatting differences can otherwise create misleadingly high apparent generalization.
  • Adversarial finetuning: Finetuned generators can evade a fixed detector, but a secondary classifier still detects mistakes in certain patches.The result suggests that producing coherent fake images without local artifacts remains difficult.
  • Limitations: The authors caution that no detector is completely bulletproof because better generators, out-of-distribution images, and adversarial attacks can defeat detection.The approach remains vulnerable to these shortcomings.
  • Generalization results: Patch-based classifiers often outperform full-image classifiers on out-of-domain synthetic facial images, and complex patches such as hair are detectable across sources.The experiments span fully generative models and facial manipulation methods.

2 Related Work

Prior work detects manipulation through image consistency, patch relationships, learned representations, and classifiers, while generalization across manipulation domains remains difficult. This paper situates local-receptive-field patch classification as a way to study transferable artifacts and visualize detector decisions.

  • Image manipulation: Image manipulation detection includes historical authenticity checks and modern techniques such as splicing, which combines multiple images into one composite.Splicing is directly relevant to face swapping, where a source face is blended onto a target background.
  • Automated detection: Automated detectors use metadata, low-level artifacts, patch embeddings, similarity graphs, RGB classifiers, and alternative image representations.Some methods combine CNN patch features with a separate prediction classifier.
  • Generalization: Because possible manipulations are too numerous to cover exhaustively, researchers study transfer across sources using spectral features, blur, noise, augmentation, warping, and simulated manipulated domains.The remaining question is which features enable transfer across domains.
  • Local receptive fields: Small receptive fields encourage classifiers to focus on local artifacts rather than global semantics and support patch-wise visualization of network decisions.Related work applies limited receptive fields to texture synthesis and fully convolutional semantic segmentation.

3 Using Patches for Image Forensics

The paper uses limited-receptive-field classifiers to detect and localize fake-image artifacts in patches, then aggregates patch predictions into an image-level decision. Careful preprocessing isolates generator artifacts from formatting differences.

  • Patch-based classification: Truncated backbones produce patch-level predictions, with earlier truncation yielding smaller receptive fields and later truncation yielding larger ones.The approach adds a 1x1 convolution after the truncated backbone; Xception blocks generally outperform ResNet blocks.
  • Patch-based classification: Limited-receptive-field classifiers predict whether localized image patches are real or fake, forcing the model to learn local distinguishing properties.The same model weights slide across the image, and each prediction depends only on a small receptive-field patch.
  • Patch-based classification: At inference, softmax-normalized patch predictions are averaged to form an ensemble image-level classification output.This aggregation applies whether the entire image is generated or only part of it is manipulated.
  • Dataset preparation: Real and fake images are passed through matched transforms and saved in identical PNG pipelines so remaining differences reflect generator artifacts.The real dataset uses the generator’s data-loading pipeline before lossless PNG saving, while fake outputs are also saved as PNGs.
  • Dataset preparation: Mismatched preprocessing can produce apparently strong generalization by allowing classifiers to learn formatting artifacts instead of inherent fake-image differences.The paper reports that codec differences can yield perfect average precision across test datasets.
  • Datasets and models: Experiments span fully generative models, facial manipulation methods, and full MesoInception4, ResNet, and Xception detector models.The fully generative models include PGAN, StyleGAN, StyleGAN2, and Glow; facial manipulation data include identity manipulation and expression transfer.

4 Experiments

The experiments test whether patch-based fake-image classifiers generalize across generator resolutions, random seeds, architectures, and datasets, then visualize and manipulate the image regions driving detection. Small receptive fields often improve cross-source detection, while hair, backgrounds, and other complex boundaries remain detectable even after adversarial generator finetuning.

  • Classification via patches: Training on 128px PGAN images, truncated models generally outperform full-model baselines on unseen generator resolutions.Performance declines as receptive field increases, except for a slight decline when the receptive field is too small; Xception Block 2 has the highest average AP across resolutions.
  • Classification via patches: Truncated models, MesoInception4, Xception, and blur/JPEG augmentation are more robust than full Resnet-18 to PGAN differences caused by random initialization seeds.Even when only the random seed changes, full Resnet-18 makes errors on fake images from other PGANs.
  • Classification via patches: Small receptive fields improve generalization from CelebA-HQ and PGAN to other generator architectures and the FFHQ dataset.They help models ignore global differences and focus on artifacts shared across generators and datasets, particularly for Style-based generators.
  • What properties of fake images generalize?: Average patch-prediction heatmaps for unseen sources concentrate on hair and background regions, which patch-wise models use to classify images.Heatmaps normalize predictions between 0 and 1, with fake values in blue and real values in red; red marks regions most indicative of the correct class.
  • What properties of fake images generalize?: The most predictive patches often lie in hair or background, with clothing, skin, and brows also common; many fake patches contain difficult hair-related boundary edges.Crisp boundaries occur naturally in real images, whereas generators struggle to imitate boundaries between hair and background or hair and skin.
  • Finetuning the generator: Latent-space shifts exaggerate detectable fake features such as hair and smiling with teeth, while opposite shifts reduce these difficult textures.The optimization uses classifier loss and a perceptual regularizer so modified images remain close to the originals.

D [LGAN(G, D) + Lreal(G, C)] ; (4)

The facial-manipulation experiments test cross-dataset generalization with patch classifiers and identify which facial regions remain predictive. Face2Face training generalizes best, while FaceSwap is hardest; predictive patches concentrate on facial features, especially the mouth.

  • The study trains on each FaceForensics++ dataset and evaluates on the remaining three, comparing receptive fields and localized predictive patches.
  • Face2Face training yields the best generalization, whereas FaceSwap generalizes poorly both to and from other manipulation methods.
  • Truncated patch classifiers generalize when trained on Face2Face or Deepfakes, and augmentation can improve results in some domains.
  • Mask supervision is not used here, although prior work reports improved generalization when this additional signal is provided.
  • Facial-manipulation classifiers focus on the face without explicit face-location supervision, unlike fully generative classifiers that tend to focus on backgrounds.
  • Face2Face-trained classifiers rely predominantly on the mouth for detecting Deepfakes and NeuralTextures, with eyes or nose secondary depending on the method.

5 Conclusion

The paper argues that carefully equalized preprocessing and limited receptive fields expose local artifacts that generalize across fake-image sources. It also shows that adversarial generator finetuning reduces but does not eliminate detectable artifacts.

  • Fake-image detection is highly sensitive to minor preprocessing details, so the study equalizes preprocessing between real and fake images.
  • Limited-receptive-field classifiers target local artifacts in hair, backgrounds, mouths, and eyes rather than global image semantics.
  • Patch classification supports generalization across model training parameters, generator architectures, and datasets while localizing potential manipulation areas.
  • Adversarially finetuned generators remain imperfect in certain patches and continue to leave detectable artifacts.

Supplementary Materials

The supplementary materials provide dataset-extraction and classifier-training details, along with additional experiments and visualizations. They emphasize that generated-image classifiers are extremely sensitive to preprocessing.

  • The supplement documents dataset extraction for real and fake images and classifier training and visualization procedures.
  • Additional supplementary experiments and visualizations cover training configurations and classifier behavior.
  • Generated-image classifiers are extremely sensitive to subtle preprocessing differences and can learn preprocessing artifacts.

6 Supplementary Methods

The supplementary methods describe how real and generated face datasets are extracted, transformed, and standardized for classifier evaluation. They cover CelebA-family data and several generative models.

  • CelebA-HQ images are extracted from TFRecords at the generator’s resolution for comparison with corresponding generated images.
  • FFHQ images are partitioned into training, validation, and testing sets, then resized to 128x128 PNG images using Lanczos interpolation.
  • CelebA preprocessing follows the GMM training pipeline, including face localization by cropping and bilinear resizing to 64 pixels before classifier evaluation.
  • PGAN experiments vary generator resolution, training dataset, and random initialization, then resize samples to 128x128 PNG images.
  • StyleGAN and StyleGAN2 samples are resized to 128x128 PNG images, with matched sample counts for corresponding real-data splits.
  • GMM and Glow samples are resized to 128x128 PNG images, while Glow additionally applies random attribute manipulations in the range [-1, 1].

FaceForensics

The FaceForensics++ data are prepared from compressed videos using the authors’ splits and landmark-based face alignment, while reprojected fake images are constructed to match real targets.

  • Dataset preparation: FaceForensics++ supplies Deepfakes, Face2Face, FaceSwap, NeuralTextures, and original videos in compressed format.The experiments use the dataset’s author-recommended training and validation splits.
  • Reprojected images: Reprojected fakes are generated by mapping a real image toward a generative model’s output manifold.An encoder is trained so that G(E(x)) approximates the input image, followed by a hybrid encoder-and-optimization procedure.
  • Model accounting: The paper reports receptive-field and parameter-count calculations for its models.These calculations support comparisons of classifier architecture in later experiments.

6.3 Patch Classifiers Architecture

Patch classifiers are truncated convolutional networks whose limited receptive fields reuse shared weights across image patches; the experiments use ResNet and Xception backbones with paired hard negatives in some datasets.

  • Architecture: Truncating a classifier reduces both its receptive field and parameter count while reusing the same weights across all input patches.This increases the ratio of data to model size.
  • Architecture: The patch classifiers use ResNet and Xception backbones truncated at shallow stages.The experiments often find truncation after ResNet’s first residual layer effective, while Xception models are truncated after the first five blocks.
  • Training: Models are optimized with Adam using a learning rate of 0.001 and batches containing 16 real and 16 fake images.Validation uses raw patch-wise accuracy, and training stops according to architecture-specific patience settings.
  • Training: Training with reprojected images samples paired originals and reprojected images within each batch to create hard negatives.A similar paired-example strategy is used for original and manipulated FaceForensics++ images, improving classification performance according to the passage.

6.5 Facial Segmentation Model

Patch decisions are interpreted through semantic face segmentation: each patch is assigned to the category with the highest normalized class proportion, enabling category-level analysis of predictive regions.

  • Segmentation: The visualization pipeline labels each image’s most predictive patch using a pretrained facial segmentation network.The BiSeNet was pretrained on CelebAMask-HQ and predicts 19 pixel-level categories.
  • Segmentation: A patch is assigned to the cluster whose segmentation class has the highest proportion after normalization by that class’s total image area.This weighting gives small features such as eyebrows appropriate influence when assigning patches.

7 Additional Experiments

Additional experiments show that preprocessing differences can create spurious generalization, while cropping, architecture, reprojection, patch location, and adversarial finetuning each affect detection behavior and interpretation.

  • 7.1 Preprocessing: Preprocessing differences between real and fake images can produce apparently high cross-dataset performance because classifiers learn formatting artifacts.Controlling image format, interpolation, and size reduces performance on different datasets, showing sensitivity to preprocessing during training and inference.
  • 7.2 Alignment vs Cropping: The experiments compare aligned faces, random crops, and random resized crops, with facial alignment supported by landmark structure and truncated models tolerating minor shifts.The crop comparisons are reported for FaceForensics++ and CelebA-HQ/FFHQ-related settings.
  • 7.3 Model size and receptive field: The extended Block 2 model increases parameter count without increasing receptive field to separate the effects of model size and receptive field.This comparison evaluates whether either factor affects generalization on test datasets.
  • 7.4 Training with reprojected image samples: Adding reprojected fake images generally improves test-dataset performance, but it harms classification for Glow fake images by more than 10% AP relative to random-sample training.Training only on reprojected images usually lowers test AP because evaluation uses unseen random generator samples, except for the GMM model where it is similar.
  • 7.5 Patch categories: Training with reprojected images shifts the classifier toward greater emphasis on background patches.This comparison uses classifiers trained on CelebA-HQ PGAN images and tested on various FFHQ generators.
  • 7.7 Example Images after Finetuning: After finetuning a face PGAN to evade a fakeness detector, detection accuracy falls from 100% to below 65%, yet a secondary classifier recovers classification accuracy.The finetuned images remain visually similar while retaining detectable artifacts.
Loading 2008.10588v1…