Initiative Defense against Facial Manipulation

Abstract

Benefiting from the development of generative adversarial networks (GAN), facial manipulation has achieved significant progress in both academia and industry recently. It inspires an increasing number of entertainment applications but also incurs severe threats to individual privacy and even political security meanwhile. To mitigate such risks, many countermeasures have been proposed. However, the great majority methods are designed in a passive manner, which is to detect whether the facial images or videos are tampered after their wide propagation. These detection-based methods have a fatal limitation, that is, they only work for ex-post forensics but can not prevent the engendering of malicious behavior. To address the limitation, in this paper, we propose a novel framework of initiative defense to degrade the performance of facial manipulation models controlled by malicious users. The basic idea is to actively inject imperceptible venom into target facial data before manipulation. To this end, we first imitate the target manipulation model with a surrogate model, and then devise a poison perturbation generator to obtain the desired venom. An alternating training strategy are further leveraged to train both the surrogate model and the perturbation generator. Two typical facial manipulation tasks: face attribute editing and face reenactment, are considered in our initiative defense framework. Extensive experiments demonstrate the effectiveness and robustness of our framework in different settings. Finally, we hope this work can shed some light on initiative countermeasures against more adversarial scenarios.

An Attack on a Non-Interactive Key Exchange from Code Equivalence

“…The proposed attack is described and benchmarked in Section 4. Notice that the existence of this attack does not imply that code-equivalence is not secure; indeed, as we show in Section 4, the reduction considered in [15] is not meaningful for an average code-equivalence instance. Finally, in Section 5, we draw some concluding remarks.…”

“…In [15], the authors claim that, by using an alternative version of the code equivalence problem, it is possible to develop a non-interactive key-based protocol, à-la Diffie-Hellman. Their method, in a nutshell, proposes to split the action of the permutation defining the equivalence into two, disjoint sets, so that composing permutations from the two sets is commutative.…”

“…By doing this, Alice and Bob end up with the same code, which is then used to compute the same shared key. Note that the associated hard problem is not code equivalence anymore, due to the presence of fixed points: the authors in [15] call it sub-LCE and propose a reduction to the canonical code-equivalence problem.…”

“…Once it has been obtained, retrieving the transformations is a trivial task. We have tested our attack, using Magma, on the parameters recommended in [15]: our implementation can break all the proposed instances in just a few milliseconds. This shows that the scheme in [15] is completely insecure.…”

“…In Section 2, we establish the notation we use throughout the paper and recall basic concepts about code equivalence. In Section 3, we briefly present the scheme proposed in [15]. The proposed attack is described and benchmarked in Section 4.…”