Security of Facial Forensics Models Against Adversarial Attacks

TL;DR

This paper investigates the vulnerability of deep neural network-based facial forgery detection models to adversarial attacks, demonstrating that both individual and universal perturbations can cause misclassification with imperceptible changes.

Contribution

It introduces new methods for generating adversarial perturbations for facial forensic models, including a novel objective function for universal attacks without training data.

Findings

UAPs can transfer across different datasets and models.

Adversarial perturbations are visually negligible.

FFMs are vulnerable to both IAPs and UAPs.

Abstract

Deep neural networks (DNNs) have been used in digital forensics to identify fake facial images. We investigated several DNN-based forgery forensics models (FFMs) to examine whether they are secure against adversarial attacks. We experimentally demonstrated the existence of individual adversarial perturbations (IAPs) and universal adversarial perturbations (UAPs) that can lead a well-performed FFM to misbehave. Based on iterative procedure, gradient information is used to generate two kinds of IAPs that can be used to fabricate classification and segmentation outputs. In contrast, UAPs are generated on the basis of over-firing. We designed a new objective function that encourages neurons to over-fire, which makes UAP generation feasible even without using training data. Experiments demonstrated the transferability of UAPs across unseen datasets and unseen FFMs. Moreover, we conducted subjective assessment for imperceptibility of the adversarial perturbations, revealing that the crafted UAPs are visually negligible. These findings provide a baseline for evaluating the adversarial security of FFMs.