Disclaimer: These are my personal notes on this paper. I am in no way related to this paper. All credits go towards the authors.

Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples

March 14, 2020 - Paper Link - Tags: Adversarial, Deepfake, Detection, Perturbation

Summary

Analysis

Notes

Methodology

Frame level attack
Considers two victim CNN classifiers: XceptionNet and MesoNet
Used the L_∞ distortion metric to measure the changes in the attacking frame vs the normal deepfake frame.
Problem Formulation: Classify deepfake frame as real and the change in the frame must be less than ε
Four different types of attack:

White-Box Attack

Used the iterative gradient sign method
Minimize the loss function where the loss equation was the max between 0 and the difference between the fake probability and the real probability before the softmax layer (equation 1)
Constrained the magnitude of the perturbation using equation 2 (clipped α by ε)

Robust White-Box Attack

NOTE: GREAT THING FOR US TO CITE since we do not use perturbation

Compressions and resizing often removes adversarial perturbation according to: Dziugaite et al., Das et al., and Guo et al.

To avoid the perturbation from being removed due to compressions, four input transformation functions are randomly used

Gaussian Blur
Gaussian Noise Addition
Translation (Shift the pixels horizontally and vertically)
Downsize and Upsize (downsize by a factor r and up-sample by the same factor using bilinear re-sampling)

They found that these transformations ensures robustness of adversarial samples against JPEG compression

Black-Box Attack

Has access to the output probability of Real or Fake
Uses NES (Natural Evolutionary Strategies) approach which maximizes the expected value of hte function under a search distribution π(θ|x)

Robust Black-Box Attack

Same as black-box attack with transformations
Algorithm given in Algorithm 1

Experiments

Used the Forensics++ dataset with the two best detectors in that paper: XceptionNet and MesoNet
Tested on uncompressed (raw) and compressed (frame level using MJPEG). Video level compression (H.264) was used with the robust white-box attack.
Table 2 shows the white-box attack. Does great on raw, poorly on compressed. Very little perturbation
Table 4 shows the robust white-box attack. Very little distortion and does very well on the compressed attack.
Table 5 shows the black-box attack. 10x more distortion than the white-box attack and 3x more than the robust white-box attack. Results similar to white-box attack
Table 6 shows the robust black-box attack. Similar distortion to the black-box attack. 83.94% success-rate for the compressed frames, which is pretty good.
Figure 4 shows the robust white-box attack vs temporal compression (instead of by frame). Had >80% success rate.

Interesting References

The FaceForensics++ paper "demonstrate that incorporation of domain knowledge helps improve classification accuracy as opposed to using the entire image as input to the classifier"
FaceForensics++ found XceptionNet and MesoNet to be the best performing classifiers.
Xie et al. found random operations (random cropping and JPEG compression) over input images to be an effective against adversarial attacks

Athalye et al A/B found these types of defenses to be vulnerable to attack algorithms that are aware of the randomized approach

Goodfellow et al.

Citation: Neekhara, Paarth, et al. "Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples." arXiv preprint arXiv:2002.12749 (2020).