PaperlayerView exact revision on arXiv

Source-linked AI summary

FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Tracking

Run Wang, Felix Juefei-Xu, Meng Luo, Yang Liu, Lina Wang

arXiv:2009.09869v3cs.CR

TL;DR

DeepFake detectors face challenges with unseen GAN techniques and image degradations. FakeTagger embeds messages in facial images and uses redundant coding to recover them after manipulation. It reports more than 95% average recovery accuracy across four DeepFake types, while noting tradeoffs and costs.

  • Problem

    Existing DeepFake detection struggles with rapidly changing GANs, especially under adversarial conditions, while provenance can provide clues to track DeepFake sources.

    Source: §1 · pp. 1–2

  • Method

    FakeTagger uses an encoder-decoder with channel coding to embed a message in a facial image and recover it after GAN-based transformation.

    Source: §1 · p. 2

  • Results

    More than 95% average accuracy was reported for recovering embedded messages over four types of DeepFakes.

    Source: §6.1 · p. 6

  • Takeaways & Limitations

    The authors conclude that message tagging can support DeepFake provenance by embedding and recovering identity-related messages in facial images after manipulation.

    Source: §7 · p. 8

    Adversarial noise can disrupt embedded messages, and redundant messages add computation costs and may be observable to machines.

    Source: §6.5 · p. 8

Abstract

from arXiv · show

In recent years, DeepFake is becoming a common threat to our society, due to the remarkable progress of generative adversarial networks (GAN) in image synthesis. Unfortunately, existing studies that propose various approaches, in fighting against DeepFake and determining if the facial image is real or fake, is still at an early stage. Obviously, the current DeepFake detection method struggles to catch the rapid progress of GANs, especially in the adversarial scenarios where attackers can evade the detection intentionally, such as adding perturbations to fool the DNN-based detectors. While passive detection simply tells whether the image is fake or real, DeepFake provenance, on the other hand, provides clues for tracking the sources in DeepFake forensics. Thus, the tracked fake images could be blocked immediately by administrators and avoid further spread in social networks. In this paper, we investigate the potentials of image tagging in serving the DeepFake provenance tracking. Specifically, we devise a deep learning-based approach, named FakeTagger, with a simple yet effective encoder and decoder design along with channel coding to embed message to the facial image, which is to recover the embedded message after various drastic GAN-based DeepFake transformation with high confidence. The embedded message could be employed to represent the identity of facial images, which further contributed to DeepFake detection and provenance. Experimental results demonstrate that our proposed approach could recover the embedded message with an average accuracy of more than 95% over the four common types of DeepFakes. Our research finding confirms effective privacy-preserving techniques for protecting personal photos from being DeepFaked.

1 INTRODUCTION

FakeTagger embeds messages in facial images so they can be recovered after DeepFake manipulation, supporting detection and provenance. The approach targets challenges in generalization to unseen GANs, image degradation, and tag stealthiness.

1 INTRODUCTION

  • Existing detectors struggle with unseen synthesis techniques and real-world degradations; the cited DFDC competition's best result was below 70% accuracy.The paper identifies poor generalization and robustness to image-quality degradation as two key challenges.Source: §1 · p. 2
  • FakeTagger embeds a message in a face image and aims to recover it after GAN manipulation, enabling detection and source-identity tracking.The authors motivate this as proactive provenance rather than passive real-versus-fake detection.Source: §1 · p. 2
  • The design targets diverse, potentially unseen GANs, common post-manipulation transformations, and tags imperceptible to human observers.The paper frames these as three challenges for image tagging.Source: §1 · p. 2
  • Nearly 95% average accuracy was reported for recovering embedded messages across four types of DeepFakes.The types are identity swap, face reenactment, attribute editing, and entire synthesis.Source: §1 · p. 2
  • A jointly trained encoder and decoder embed and recover messages, while channel coding adds redundancy to improve resistance to DeepFake transformations.The reported evaluation spans four DeepFake types and both white-box and black-box settings.Source: §1 · p. 2
  • The authors present image tagging as a direction for DeepFake provenance and tracking, with recovered messages intended to aid forensics.They describe the work as the first to propose image tagging for this purpose.Source: §1 · p. 2

2 RELATED WORK

The related work covers GAN-based DeepFake creation and artifact detection, proactive disruption methods, and digital watermarking. The paper contrasts its message-tagging approach with prior disruption and watermarking methods.

2.1 DeepFake Creation and Detection

  • GANs produce entire or partial facial-image synthesis, while artifact-based detection uses observable or learned image cues; performance on unknown GANs remains unclear.The reviewed work includes behavioral, visible-artifact, and frequency-domain detection approaches.Source: §2.1 · p. 3

2.2 DeepFake Disruption and Evasion

  • Prior disruption methods perturb inputs to alter GAN outputs, but can be detectable and often require knowledge of the synthesis technique; FakeTagger is described as black-box and stealthy.The paper also notes related work targeting image- and frequency-level evasion of detection.Source: §2.2 · p. 3

2.3 Digital Watermarking

  • Watermarking embeds information in spatial or frequency domains, and newer end-to-end methods jointly train neural encoders and decoders.The review describes spatial methods as easier to implement but vulnerable to pixel perturbations.Source: §2.3 · p. 3

3 PROBLEM STATEMENT

The problem statement describes a social-media pipeline in which personal photos can be manipulated and reposted as DeepFakes. FakeTagger tags images before sharing and uses the recovered message to flag mismatched identities when manipulated images are uploaded.

3 PROBLEM STATEMENT

  • A malicious actor can take a user's public photo, manipulate it with DeepFake technology, and repost it to impersonate the user or pursue other malicious activity.The described scenario lacks a mechanism for distinguishing a legitimate face image from a DeepFake.Source: §3 · p. 4
  • FakeTagger embeds a message, usually a UID, before sharing and aims to recover it after DeepFake reconstruction.An upload with a UID that does not match the uploader's identity can trigger an alarm and support blocking or flagging the image.Source: §3 · pp. 3–4

4 METHODOLOGY

FakeTagger uses message tagging to track facial images through DeepFake transformations, addressing weaknesses of artifact-based detection. Its pipeline combines an encoder-decoder, simulated GAN manipulations, redundant message coding, and losses for message recovery and image quality.

4.1 Insight

  • Artifact-based detectors are described as weak on unknown GANs and vulnerable to adversarial perturbations and common image transformations, motivating proactive tagging.The paper identifies robustness to GAN transformations and stealthiness as desired properties.Source: §4.1 · p. 4

4.2.1 Overview.

  • The five-component pipeline generates a message, embeds it in a face image, simulates GAN manipulation, decodes the message, and produces the final message.The encoder targets perceptual similarity, and the decoder is intended to recover the UID after manipulation.Source: §4.2.1 · p. 4

4.2.2 Image tagging encoder-decoder training.

  • A jointly trained DNN encoder embeds an arbitrary message imperceptibly, and a decoder retrieves it after GAN manipulation.The embedded message indicates an n-bit UID and can be extended to arbitrary binary bits.Source: §4.2.2 · pp. 4–5, Figure 2 · p. 5

4.2.3 GAN-based manipulation.

  • A GAN simulator connects the encoder and decoder so the decoder learns to recover messages after identity swap, face reenactment, attribute editing, or entire synthesis.The simulator represents manipulations of the encoded facial image.Source: §4.2.3 · p. 5

4.2.4 Channel coding.

  • Channel coding adds redundant bits to the message so it can better tolerate errors introduced by GAN transformations, modeled as a noisy channel.The experiments use a binary symmetric channel in which each bit is independently flipped with probability p.Source: §4.2.4 · p. 5, Figure 3 · p. 5

4.2.5 Losses.

  • Training combines message loss with image loss to balance message recovery and similarity between encoded and input images.The image loss includes an L2 term and a GAN loss with spectral normalization.Source: §4.2.5 · p. 5

5.1 Data Preparation

The experiments use four GAN systems to represent distinct DeepFake manipulations and CelebA-HQ facial images to evaluate performance across input sizes.

5.1.1 GANs.

  • Four systems cover identity swapping, face reenactment, attribute editing, and entire-face synthesis: DeepFaceLab, Face2Face, STGAN, and StyleGAN.The paper assigns each system to its corresponding manipulation type.Source: §5.1.1 · p. 5

5.1.2 Dataset.

  • CelebA-HQ supplies 30,000 facial images in multiple resolutions, including 128 × 128, 512 × 512, and 1,024 × 1,024.The experiments examine FakeTagger with different input image sizes.Source: §5.1.2 · p. 5

5.2 Baseline

The evaluation uses a deep-learning embedding method without redundant message injection as its baseline; initial LSB and DWT watermarking trials failed after all four DeepFake manipulations.

5.2 Baseline

  • The baseline is a deep-learning embedding technique without redundant message injection.This is the baseline used in the experiments.Source: §5.2 · p. 6
  • Initial LSB and DWT watermarking trials both failed to recover messages after the four DeepFake manipulations.The authors considered spatial- and frequency-domain watermarking as conventional baselines before selecting the deep-learning baseline.Source: §5.2 · p. 6

5.3 Evaluation Metrics

The evaluation measures message recovery after GAN manipulation and the visual similarity between input and encoded facial images.

5.3 Evaluation Metrics

  • Accuracy measures the recovered message after GAN-based manipulation.The paper defines accuracy as the full message retrieval rate (FMRR).Source: §5.3 · p. 6
  • PSNR measures similarity between the input and FakeTagger-encoded facial images.Source: §5.3 · p. 6
  • SSIM measures similarity between the input and FakeTagger-encoded facial images.Source: §5.3 · p. 6

5.4 Implementation

FakeTagger embeds messages with an encoder and retrieves them with a decoder, using GAN simulators and channel coding to support recovery after manipulation. The encoder and decoder are trained jointly on randomly generated messages and facial images.

5.4.1 Encoder.

  • The U-Net-style encoder embeds messages in carrier images while aiming to preserve their perceptual similarity to the inputs.The experiments vary carrier-image sizes, message lengths, and embedding levels.Source: §5.4.1 · p. 6

5.4.2 Decoder.

  • The decoder retrieves the embedded message from encoded images and outputs a message of the same length.It consists of seven convolutional layers, one dense layer, and a sigmoid output.Source: §5.4.2 · p. 6

5.4.3 GAN simulator.

  • White-box simulation uses DeepFaceLab, Face2Face, STGAN, and StyleGAN; black-box simulation uses the AutoGAN simulator.Source: §5.4.3 · p. 6

5.4.4 Channel coding.

  • NECST supplies source and channel coding without requiring noise-length estimation, unlike the described LDPC option.The channel-coding model uses BSC distortion and is trained separately from the encoder and decoder to avoid co-adaptation to specific manipulations and resulting overfitting.Source: §5.4.4 · p. 6

5.4.5 Encoder and decoder training.

  • The encoder and decoder are jointly trained using randomly generated messages and CelebA-HQ images, with four input image sizes.The training explores performance on faces of different sizes.Source: §5.4.5 · p. 6

6 EXPERIMENTAL RESULTS

The experiments evaluate message recovery across white-box and black-box DeepFake transformations, robustness to common image perturbations, visual quality, message size, and limitations. The reported results cover four DeepFake types and examine how manipulation, image size, and message redundancy relate to performance.

6.1 Effectiveness Results (RQ1)

  • Larger input images and redundant messages were associated with better recovery, while larger manipulation regions and more drastic changes were associated with weaker performance.The white-box results identify skin-color editing as more difficult than the other tested attribute edits.Source: §6.1 · pp. 6–7
  • FakeTagger achieved average message-recovery accuracy above 95% across four DeepFake types, and average accuracy above 88.95% across those four types in the black-box setting, where manipulation knowledge was unknown.Source: §6.1 · pp. 6–7, Table 3 · p. 7

6.2 Evaluation on Robustness (RQ2)

  • FakeTagger showed minor performance fluctuations as compression, resizing, blur, and Gaussian-noise intensity increased; entire synthesis was more sensitive, especially to compression and Gaussian noise.The evaluation used 256×256 images and mustache editing; Figure 4 covers the four degradations.Source: §6.2 · p. 7, Figure 4 · p. 8

6.5 Discussion

  • The evaluation assumes full bit recovery; adversarial noise may disrupt tags, and redundancy adds computation costs and may be observable to machines.The discussion also notes a trade-off between imperceptible images and successful disruption.Source: §6.2 · p. 7, §6.5 · p. 8

6.3 Measuring the Stealthiness (RQ3)

  • PSNR exceeded 30 dB and SSIM exceeded 0.93 across the four DeepFake types, indicating high visual quality for encoded images.Entire synthesis had the best reported image-quality performance among the four types.Source: §6.3 · p. 7, Table 4 · p. 7

6.4 Ablation Study

  • More than 95% accuracy was achieved with 20-bit messages and 750% redundancy, while accuracy fell below 90% with 45-bit messages and 333.3% redundancy.The authors state that 30 bits represent more than 1 billion UIDs and 35 bits more than 34 billion UIDs; Figure 5 relates message length to recovery accuracy.Source: §6.4 · p. 8, Figure 5 · p. 8

7 CONCLUSION

FakeTagger embeds messages in facial images for DeepFake provenance and recovers them after drastic GAN-based transformations. The conclusion presents this proactive approach as an alternative to artifact-based detection and identifies other attack modalities for future exploration.

7 CONCLUSION

  • Experiments on four common DeepFakes demonstrate FakeTagger’s effectiveness, robustness, and stealthiness in embedding and recovering messages after drastic GAN-based transformation.The evaluated types include identity swap, face reenactment, attribute editing, and entire synthesis.Source: §7 · p. 8
  • Artifact-based detection is described as insufficient against DeepFakes, particularly as its domain knowledge may become invalid for unseen GANs.The paper frames proactive image tagging as a new approach rather than relying on synthesized-image artifacts.Source: §7 · p. 8
  • The authors identify tracking provenance across other adversary modalities as a direction for future work, including weather and image-degradation-mimetic attacks.Examples include rain, haze, adversarial exposure, vignetting, blur, and color jittering.Source: §7 · p. 8

Related papers

Loading 2009.09869v3…