Exploring Frequency Adversarial Attacks for Face Forgery Detection

TL;DR

This paper introduces a novel frequency domain adversarial attack on face forgery detectors, using DCT and a fusion module to generate imperceptible perturbations that effectively fool both spatial and frequency-based detectors, improving attack transferability.

Contribution

It proposes a frequency adversarial attack method using DCT and a fusion module, and a hybrid attack combining spatial and frequency domains, advancing face forgery detection robustness testing.

Findings

The frequency attack fools both spatial and frequency-based detectors.

The method produces imperceptible perturbations without degrading image quality.

It enhances transferability of attacks across different face forgery detectors.

Abstract

Various facial manipulation techniques have drawn serious public concerns in morality, security, and privacy. Although existing face forgery classifiers achieve promising performance on detecting fake images, these methods are vulnerable to adversarial examples with injected imperceptible perturbations on the pixels. Meanwhile, many face forgery detectors always utilize the frequency diversity between real and fake faces as a crucial clue. In this paper, instead of injecting adversarial perturbations into the spatial domain, we propose a frequency adversarial attack method against face forgery detectors. Concretely, we apply discrete cosine transform (DCT) on the input images and introduce a fusion module to capture the salient region of adversary in the frequency domain. Compared with existing adversarial attacks (e.g. FGSM, PGD) in the spatial domain, our method is more imperceptible to human observers and does not degrade the visual quality of the original images. Moreover, inspired by the idea of meta-learning, we also propose a hybrid adversarial attack that performs attacks in both the spatial and frequency domains. Extensive experiments indicate that the proposed method fools not only the spatial-based detectors but also the state-of-the-art frequency-based detectors effectively. In addition, the proposed frequency attack enhances the transferability across face forgery detectors as black-box attacks.