Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Faces

TL;DR

This paper introduces a novel transformation-aware adversarial face defense mechanism that impedes GAN-based Deepfake generation by degrading the quality of synthesized faces and making them more detectable, thus providing a proactive security measure.

Contribution

The paper proposes a transformation-aware adversarial face generation method combined with ensemble techniques to robustly defend against GAN-based Deepfake attacks in black-box scenarios.

Findings

Adversarial faces significantly degrade Deepfake quality.

Synthesized faces show increased visual artifacts and detectability.

The ensemble approach enhances defense robustness.

Abstract

Deepfake represents a category of face-swapping attacks that leverage machine learning models such as autoencoders or generative adversarial networks. Although the concept of the face-swapping is not new, its recent technical advances make fake content (e.g., images, videos) more realistic and imperceptible to Humans. Various detection techniques for Deepfake attacks have been explored. These methods, however, are passive measures against Deepfakes as they are mitigation strategies after the high-quality fake content is generated. More importantly, we would like to think ahead of the attackers with robust defenses. This work aims to take an offensive measure to impede the generation of high-quality fake images or videos. Specifically, we propose to use novel transformation-aware adversarially perturbed faces as a defense against GAN-based Deepfake attacks. Different from the naive adversarial faces, our proposed approach leverages differentiable random image transformations during the generation. We also propose to use an ensemble-based approach to enhance the defense robustness against GAN-based Deepfake variants under the black-box setting. We show that training a Deepfake model with adversarial faces can lead to a significant degradation in the quality of synthesized faces. This degradation is twofold. On the one hand, the quality of the synthesized faces is reduced with more visual artifacts such that the synthesized faces are more obviously fake or less convincing to human observers. On the other hand, the synthesized faces can easily be detected based on various metrics.