Imperceptible Adversarial Examples for Fake Image Detection

Authors: Quanyu Liao, Yuezun Li, Xin Wang, Bin Kong, Bin Zhu, Siwei Lyu, Youbing Yin, Qi Song, Xi Wu

Published: 2021-06-03 06:25:04+00:00

Comment: Accepted by ICIP 2021

AI Summary

This paper introduces Key Region Attack (KRA), a novel method for generating imperceptible adversarial examples to fool fake image detectors. KRA identifies and perturbs only key pixels crucial to the detector's decision, significantly reducing the L0 and L2 norms of adversarial perturbations. Experiments show KRA achieves state-of-the-art performance in both white-box and black-box attacks on public datasets.

Abstract

Fooling people with highly realistic fake images generated with Deepfake or GANs brings a great social disturbance to our society. Many methods have been proposed to detect fake images, but they are vulnerable to adversarial perturbations -- intentionally designed noises that can lead to the wrong prediction. Existing methods of attacking fake image detectors usually generate adversarial perturbations to perturb almost the entire image. This is redundant and increases the perceptibility of perturbations. In this paper, we propose a novel method to disrupt the fake image detection by determining key pixels to a fake image detector and attacking only the key pixels, which results in the $L_0$ and the $L_2$ norms of adversarial perturbations much less than those of existing works. Experiments on two public datasets with three fake image detectors indicate that our proposed method achieves state-of-the-art performance in both white-box and black-box attacks.

Key findings

KRA achieves state-of-the-art attack performance in both white-box and black-box scenarios, effectively reducing the accuracy of fake image detectors to near zero. Compared to existing methods, KRA significantly reduces both the L0 and L2 norms of adversarial perturbations, generating imperceptible adversarial examples. The method demonstrates good black-box transferability, with Attack Transfer Ratios (ATRs) within 50% ± 15% across different target detectors.

Approach

The Key Region Attack (KRA) identifies key pixels in an image that a fake image detector relies on by using Multi-layers Semantic Key Region Selection (MLSKRS), which combines gradient information from multiple convolutional layers. It then iteratively applies a chosen adversarial attack method (e.g., PGD, Deepfool) only to these key pixels. This approach minimizes both the L0 and L2 norms of the perturbations, making them sparse and imperceptible.

Datasets

FaceForensics++, CNN-Synthesis

Model(s)

ResNet50, XceptionNet (Xception), Inceptionv3, ResNet101

Author countries

China, USA

← Previous