Source-linked AI summary
Misleading Deep-Fake Detection with GAN Fingerprints
Vera Wesselkamp, Konrad Rieck, Daniel Arp, Erwin Quiring
TL;DR
Existing deep-fake detectors can use GAN artifacts, but earlier counterattacks may require detector interaction or GAN adaptation. This paper removes GAN fingerprints directly in the frequency spectrum; its evaluations show that attacks can mislead detectors, with success varying by detector, dataset, and GAN.
Problem
Earlier counterattacks can require interaction with the detection method or direct GAN adaptation, while frequency artifacts have enabled almost-perfect detection.
Source: §I · p. 1Method
The attacks identify and remove GAN fingerprints directly from generated images’ frequency spectra, using variants from high-frequency filtering to more targeted artifact removal.
Source: §I · p. 1Results
The attacks can mislead detection methods, but no single variant works universally: the most effective attack depends on the detector and setup.
Source: §I · p. 1, E. Summary of Results · p. 6, §V · p. 6Takeaways & Limitations
The evaluation provides evidence that current deep-fake detection approaches can be evaded with attacks selected for the dataset, GAN, and detector combination.
Source: §VII · p. 6Counter-defenses, including adding modified deep fakes to detector training, are left to future work.
Source: §V · p. 6
Abstract
from arXiv · showhide
Generative adversarial networks (GANs) have made remarkable progress in synthesizing realistic-looking images that effectively outsmart even humans. Although several detection methods can recognize these deep fakes by checking for image artifacts from the generation process, multiple counterattacks have demonstrated their limitations. These attacks, however, still require certain conditions to hold, such as interacting with the detection method or adjusting the GAN directly. In this paper, we introduce a novel class of simple counterattacks that overcomes these limitations. In particular, we show that an adversary can remove indicative artifacts, the GAN fingerprint, directly from the frequency spectrum of a generated image. We explore different realizations of this removal, ranging from filtering high frequencies to more nuanced frequency-peak cleansing. We evaluate the performance of our attack with different detection methods, GAN architectures, and datasets. Our results show that an adversary can often remove GAN fingerprints and thus evade the detection of generated images.
I. INTRODUCTION
The paper proposes frequency-spectrum attacks that remove GAN fingerprints without adapting the GAN or interacting with a detector. Across detection methods, GANs, and datasets, the attacks can reduce detection, though effectiveness varies by detector and attack variant.
I. INTRODUCTION
- Prior counterattacks can require detector interaction or direct GAN adaptation, limiting their practicality.Frequency-domain artifacts have also enabled almost-perfect detection.Source: §I · p. 1
- The attack estimates a GAN fingerprint and removes it from a target image without adapting the GAN or knowing or interacting with the detector.The four variants range from high-frequency removal to mean-spectrum differences, frequency-peak removal, and regression-estimated patterns.Source: §I · p. 1
- Fingerprint-removal attacks mislead all evaluated detection methods, with the most effective variant depending on the detector.Mean-spectrum removal is highly effective against Joslin and Hao, while high-frequency or frequency-peak removal evades Frank et al. [9] in most cases.Source: §I · p. 1
- Removing characteristic frequency-spectrum artifacts is presented as a simple, effective counterattack against deep-fake detection.The four manipulation strategies span high-frequency removal through more nuanced artifact removal.Source: §I · p. 2
- The evaluation covers three detection methods, four GAN architectures, and two datasets; one attack considerably reduces each GAN’s detection rate.The attacks are evaluated while image quality is fixed at 30 dB, and the results show deep fakes classified as actual images.Source: §I · p. 2
II. DEEP FAKE DETECTION
Deep-fake detectors may check image consistency or generation artifacts; this section focuses on artifact-based detection. GAN fingerprints are consistent within a model but differ across models, and arise in part from up-sampling operations.
A. GAN Artifacts and Fingerprints
- GAN-generated images exhibit characteristic frequency artifacts that vary by model, including grid-like patterns for SNGAN and elevated values across frequencies for ProGAN.Figure 2 compares averaged DCT spectra from natural images and four GANs on CelebA.Source: A. GAN Artifacts and Fingerprints · p. 2, Figure 2 · p. 2
- Up-sampling can produce detectable frequency patterns: interpolation avoids strong spatial artifacts, but different interpolation methods still leave frequency-domain patterns.Earlier transposed convolutions could produce checkerboard artifacts when kernel size was not divisible by stride.Source: A. GAN Artifacts and Fingerprints · p. 2
- A GAN fingerprint is a frequency artifact pattern consistent across images from one GAN model but different across models.This consistency motivates attacks that remove or suppress the fingerprint to bypass detection.Source: A. GAN Artifacts and Fingerprints · p. 2
B. Detection Methods
The paper evaluates frequency-based detectors and introduces fingerprint-removal attacks under a black-box threat model. The attacks target different frequency artifacts because no single removable fingerprint fools every detection approach.
B. Detection Methods
- The evaluated detectors are Joslin and Hao’s FFT fingerprint method and Frank et al.’s DCT-based Ridge regression and CNN classifiers.The CNN distinguishes natural images and four GAN models; the regression is a binary classifier trained separately for each GAN.Source: B. Detection Methods · p. 2
III. COUNTERATTACKS
- The counterattack modifies generated images only, requiring neither GAN adaptation nor detailed detector knowledge or interaction.The threat model assumes the adversary can use a GAN but cannot inspect or interact with the detector; adapting the GAN is costly.Source: §III · pp. 2–3
- No universal fingerprint removal fools all detectors, so the paper develops variants that progress from high-frequency removal to targeting specific frequency patterns.The variants increase in complexity as they focus removal more precisely.Source: §III · p. 3
A. Untargeted Fingerprint Removal
The untargeted attack removes high-frequency DCT content without needing a fingerprint, but can alter image details and leave lower-frequency artifacts. Targeted variants instead estimate a GAN fingerprint and suppress it in generated images.
A. Untargeted Fingerprint Removal
- The frequency-bars attack zeros high-frequency DCT bands, a simple fingerprint-independent filter that can affect image details and leave lower-frequency artifacts.Its bar width provides finer control over removed information than blurring.Source: A. Untargeted Fingerprint Removal · p. 3
B. Targeted Fingerprint Removal
- The mean-spectrum attack subtracts a strength-scaled fingerprint derived from differences between natural-image and GAN-image mean spectra.The targeted variants extract a GAN model’s frequency fingerprint before suppressing it in generated images.Source: B. Targeted Fingerprint Removal · p. 3
- The frequency-peaks attack uses log-scaled mean spectra to identify dominant frequency patterns, then thresholds and scales the retained fingerprint values.Clipping the scaled values to [0, 1] avoids sign changes during removal.Source: B. Targeted Fingerprint Removal · p. 3
- The regression-weights attack uses Lasso-learned feature weights as a frequency fingerprint and changes corresponding coefficients antiproportionally.The weights correspond directly to frequency coefficients; the fingerprint is clipped to [-1, 1].Source: B. Targeted Fingerprint Removal · p. 3
IV. EVALUATION
The evaluation tests whether attack variants reduce deep-fake detection while preserving visible image quality. It also compares their success with previously used perturbation-based attacks.
IV. EVALUATION
- The evaluation measures detection-rate reduction for each GAN model, visible image impact, and success relative to previously used perturbation-based attacks.The authors describe the image impact as minor and the counterattacks’ success rate as higher than prior perturbation-based attacks.Source: §IV · p. 4
A. Experimental Settings
The experiments cover four GAN architectures across CelebA and LSUN bedrooms, using multiple detector setups and measures of attack success and image quality. Baseline detection is nearly perfect for Frank et al.’s method, while Joslin and Hao’s performance varies by GAN architecture.
A. Experimental Settings
- The setup evaluates ProGAN, SNGAN, MMDGAN, and CramerGAN on CelebA and LSUN bedrooms, yielding eight architecture–dataset combinations.Images are 128×128×3 pixels.Source: A. Experimental Settings · p. 4
- The multi-class detector distinguishes four GAN classes and natural images; binary classifiers are created for each architecture–dataset combination.The multi-class setup uses one detector per dataset.Source: Table I · p. 4, A. Experimental Settings · p. 4
- Frank et al. [9] achieves almost perfect detection on unmodified fakes, while Joslin and Hao varies substantially across GAN architectures.Joslin and Hao has its best detection rate for SNGAN.Source: A. Experimental Settings · p. 4
- The frequency-peaks threshold and Lasso regression weights are calibrated on a separate hold-out dataset.The threshold is selected by grid search for each GAN model.Source: A. Experimental Settings · p. 4
- Attack success is the fraction of generated images classified as natural; in the multi-class setting, a wrong GAN-class prediction alone does not count.Image quality is measured by PSNR, with 30 dB treated as an acceptable lower bound after visual inspection.Source: A. Experimental Settings · p. 4
B. Attack Success Rate
At 30 dB image quality, fingerprint-based attacks considerably reduce deep-fake detection rates, but their effectiveness depends on the detector and attack variant. Frequency-bars, mean-spectrum, peak-extraction, and regression-weights attacks show distinct outcomes.
B. Attack Success Rate
- The experiment applies attacks to 1,000 images from each GAN model and calibrates their strength to an average PSNR of 30 dB.The attacks are tested against three detection methods.Source: B. Attack Success Rate · p. 4
- Frequency-bars attacks work well against Frank et al.’s CNN and regression classifiers but have low success against Joslin and Hao’s detector.The results suggest the Frank et al. classifiers rely mainly on high-frequency information, while low-frequency artifacts are also relevant to Joslin and Hao’s approach.Source: B. Attack Success Rate · p. 4
- Mean-spectrum attacks work considerably well against Joslin and Hao but fail to circumvent Frank et al.’s classifiers.The authors attribute the low success against Frank et al. to those classifiers’ use of log-scaled spectra, which the attack’s non-scaled manipulations ignore.Source: B. Attack Success Rate · p. 4
- Peak-extraction attacks rely on log-scaled spectra and work almost perfectly against ProGAN and SNGAN, whose spectra have strong peaks throughout.Removing each GAN instance’s own fingerprint is more successful for each classifier than cross-removing another instance’s fingerprint.Source: B. Attack Success Rate · p. 4
- At 30 dB image quality, the attacks considerably reduce detection rates, allowing deep fakes to be classified as actual images.Table II reports attack success rates by dataset, detection method, and GAN model; the supplied text does not state individual cell values.Source: B. Attack Success Rate · p. 4, Table II · p. 5
- Regression-weights attacks are rarely successful, even against a regression model, and their manipulation of lower frequencies substantially reduces image quality.The computed fingerprints span the frequency spectrum, so this attack also changes lower-frequency bands.Source: B. Attack Success Rate · p. 5
C. Image Quality
The attacks generally have a minor impact on visual quality, though their visible effects differ. Peak extraction preserves details particularly well, while frequency-bars attacks can remain effective at higher image quality.
C. Image Quality
- The authors examine image quality because visible spatial artifacts might reveal the attack and provide new ground for detection.Source: C. Image Quality · p. 5
- Peak extraction preserves image details particularly well, but yields only moderate success rates.The examples in Figure 4 use roughly 30 dB PSNR.Source: C. Image Quality · p. 5, Figure 4 · p. 5
- Frequency-bars attacks introduce more visible artifacts but achieve the highest success rates against two detection methods, with stable results up to 37 dB PSNR.The authors report that artifacts are rarely visible at those higher PSNR values.Source: C. Image Quality · p. 5
- All attack variants are effective with minor impact on visual quality in most cases, including frequency-bars on the examined data.Figure 4 shows modified CelebA SNGAN and ProGAN examples at a fixed image quality of 30 dB.Source: C. Image Quality · p. 5, Figure 4 · p. 5
D. Comparison to Image Perturbations
The comparison tests the counterattacks against cropping, noise addition, blurring, and JPEG compression at about 30 dB average image quality. The proposed counterattacks are more effective overall, though baseline success varies by setting.
D. Comparison to Image Perturbations
- The comparison applies cropping, noise addition, blurring, and JPEG compression at strengths that reduce average image quality to about 30 dB.Source: D. Comparison to Image Perturbations · p. 5
- Blurring achieves high success across all settings, while the other perturbations have mixed success depending on dataset, detector, and GAN class or model.Source: D. Comparison to Image Perturbations · p. 5
- The proposed counterattacks are more effective than the image perturbations in comparison, motivating their use as additional baselines in future work.Source: D. Comparison to Image Perturbations · p. 5
E. Summary of Results
The attack variants outperform prior perturbation attacks without significantly affecting visual quality, but no single strategy succeeds universally. The discussion relates these differences to frequency relevance across models and datasets and notes the study’s scope and open counter-defenses.
E. Summary of Results
- The variants outperform previous perturbation attacks without significantly affecting visual quality, but their success varies and no universal strategy exists.Mean-spectrum works best against Joslin and Hao, while frequency-bars and peak-extraction work best against the other two detectors.Source: E. Summary of Results · p. 6
V. DISCUSSION
- LRP explanations of the CNN classifier’s predictions vary across GAN models and datasets, consistent with characteristic GAN artifacts.The analysis averages explanations over 1,000 unmodified deep-fake images.Source: §V · p. 6, Figure 5 · p. 6
- Frequency relevance differs by GAN and dataset: the classifier considers the whole spectrum for ProGAN and SNGAN but focuses mainly on higher frequencies for CramerGAN and MMDGAN.These differences might help explain variation in attack success across datasets.Source: §V · p. 6
- Counter-defenses remain open work; the authors suggest adding modified deep fakes to detector training, similar to adversarial training.Source: §V · p. 6
- The study focuses solely on frequency-based detectors; preliminary results against Yu et al. suggest frequency-based attacks might be less effective against spatial detectors.The authors leave spatial-domain fingerprint counterattacks for future research.Source: §V · p. 6
VI. RELATED WORK
Prior evasion methods modify images, GAN training, or use learned systems, while this paper’s attacks directly manipulate GAN fingerprints in the frequency spectrum. The conclusion reports that these attacks can mislead detectors across dataset, GAN, and detection-method combinations.
VI. RELATED WORK
- Prior evasion approaches include adversarial examples, GAN-training changes, and learned image modification; some fingerprint-removal methods introduce new artifacts.Huang et al. propose shallow reconstruction using a dictionary model learned on natural images to address artifacts introduced by earlier methods.Source: §VI · p. 6
- The attack class directly targets GAN fingerprints in the frequency spectrum, operating with access to GAN images without GAN adjustment or sophisticated learned systems.The paper distinguishes this black-box approach from prior attacks that modify GAN training or use learning-based systems.Source: §VI · p. 6
VII. CONCLUSION
- Depending on the dataset, GAN, and detection method, an adversary can use one of the attacks to mislead detection, indicating current approaches remain vulnerable.The conclusion describes the attacks as evidence that current deep-fake detection approaches are far from robust and can be evaded easily.Source: §VII · p. 6