Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples

Hussain, Shehzeen; Neekhara, Paarth; Jere, Malhar; Koushanfar, Farinaz; McAuley, Julian

doi:10.48550/arxiv.2002.12749

Cited by 2 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This shows one of the vulnerabilities in deepfake detectors. Besides, the work by Hussain et al showed that DNN based deepfake detectors are not robust towards adversarially modified fake videos [7]. These types of adversarial perturbations possess infinite risks as they can be used to attack both image and video compression codecs [7].…”

Section: Related Workmentioning

confidence: 99%

“…Besides, the work by Hussain et al showed that DNN based deepfake detectors are not robust towards adversarially modified fake videos [7]. These types of adversarial perturbations possess infinite risks as they can be used to attack both image and video compression codecs [7]. In addition, adversarial perturbations have been shown to be transferable between different models [14].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Metamorphic Testing-based Adversarial Attack to Fool Deepfake Detectors

Lim¹,

Kuan²,

Pu³

et al. 2022

Preprint

View full text Add to dashboard Cite

Deepfakes utilise Artificial Intelligence (AI) techniques to create synthetic media where the likeness of one person is replaced with another. There are growing concerns that deepfakes can be maliciously used to create misleading and harmful digital contents. As deepfakes become more common, there is a dire need for deepfake detection technology to help spot deepfake media. Present deepfake detection models are able to achieve outstanding accuracy (>90%). However, most of them are limited to within-dataset scenario, where the same dataset is used for training and testing. Most models do not generalise well enough in cross-dataset scenario, where models are tested on unseen datasets from another source. Furthermore, stateof-the-art deepfake detection models rely on neural networkbased classification models that are known to be vulnerable to adversarial attacks. Motivated by the need for a robust deepfake detection model, this study adapts metamorphic testing (MT) principles to help identify potential factors that could influence the robustness of the examined model, while overcoming the test oracle problem in this domain. Metamorphic testing is specifically chosen as the testing technique as it fits our demand to address learning-based system testing with probabilistic outcomes from largely black-box components, based on potentially large input domains. We performed our evaluations on MesoInception-4 and TwoStreamNet models, which are the state-of-the-art deepfake detection models. This study identified makeup application as an adversarial attack that could fool deepfake detectors. Our experimental results demonstrate that both the MesoInception-4 and TwoStreamNet models degrade in their performance by up to 30% when the input data is perturbed with makeup.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Metamorphic Testing-based Adversarial Attack to Fool Deepfake Detectors

Lim¹,

Kuan²,

Pu³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Unfortunately, having these detectors is still not sufficient to prevent the aforementioned misuse of fake images due to the rise of adversarial machine learning attacks. It has been reported that fake image detectors are vulnerable to adversarial input attacks [48] whereby attackers inject noises to the fake images to mislead the detector into labeling the perturbed fake image as real. In this paper, we propose a new defensive mechanism targeting the above data poisoning attacks on the deepfake detectors.…”

Section: Dnn-based Deepfake Detection Modelmentioning

confidence: 99%

Detecting targeted data poisoning attacks on deep neural networks

Newman¹

View full text Add to dashboard Cite

Deep neural networks (DNNs) are widely used for various facial image-recognition purposes, including facial recognition and subsequent authentication, and the detection of altered facial images. Unfortunately, due to their widespread use, there have been many works that focus on attacking such DNN-based systems for nefarious purposes. One type of attack on DNNs is called a "targeted data poisoning" attack, which has the goal of injecting photos into the DNNs training set in such a way as to cause the DNN to learn malicious behavior. In the context of facial authentication, this could correspond to unauthorized users gaining access to a target's account, whereas, in deepfake detection, this could translate to causing the DNN to fail to identify when a target's face is the subject of a deepfake image. This report describes targeted data poisoning attacks and proposed defenses on DNN-based systems for facial authentication and deepfake detection, each achieving high accuracy ([greater than] 95 percent) in most cases.

show abstract

Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples

Cited by 2 publications

References 0 publications

Metamorphic Testing-based Adversarial Attack to Fool Deepfake Detectors

Metamorphic Testing-based Adversarial Attack to Fool Deepfake Detectors

Detecting targeted data poisoning attacks on deep neural networks

Contact Info

Product

Resources

About