[Paper Review] Attributing Fake Images to GANs: Analyzing Fingerprints in Generated Images.

Ning Yu, Larry S. Davis+1 more|arXiv (Cornell University)|Nov 20, 2018

Digital Media Forensic DetectionComputer Science19 references40 citations

TL;DR

This paper introduces a method to learn and leverage unique, stable fingerprints in GAN-generated images for model attribution and source identification. By analyzing latent patterns across image frequencies and patches, the approach accurately classifies images as real or GAN-generated and traces them to specific GAN models, even under adversarial perturbations, outperforming existing baselines.

ABSTRACT

Recent advances in Generative Adversarial Networks (GANs) have shown increasing success in generating photorealistic images. But they also raise challenges to visual forensics and model attribution. We present the first study of learning GAN fingerprints towards image attribution and using them to classify an image as real or GAN-generated. For GAN-generated images, we further identify their sources. Our experiments show that (1) GANs carry distinct model fingerprints and leave stable fingerprints in their generated images, which support image attribution; (2) even minor differences in GAN training can result in different fingerprints, which enables fine-grained model authentication; (3) fingerprints persist across different image frequencies and patches and are not biased by GAN artifacts; (4) fingerprint finetuning is effective in immunizing against five types of adversarial image perturbations; and (5) comparisons also show our learned fingerprints consistently outperform several baselines in a variety of setups.

Motivation & Objective

• To address the growing challenge of attributing fake images to their source GAN models in visual forensics.
• To investigate whether GANs leave stable, distinguishable fingerprints in their generated images that can be used for attribution.
• To develop a method that enables fine-grained model authentication based on subtle training differences in GANs.
• To evaluate the robustness of learned fingerprints against five types of adversarial image perturbations.
• To compare the performance of the proposed fingerprinting method against multiple baseline approaches in diverse settings.

Proposed method

• The method learns model-specific fingerprints from GAN-generated images by analyzing statistical patterns across different image frequencies and spatial patches.
• It uses a deep learning-based classifier to detect and extract stable, discriminative features that correlate with the source GAN architecture and training configuration.
• The fingerprint representation is designed to be invariant to common GAN artifacts and robust across image regions and frequency bands.
• The approach incorporates adversarial training to fine-tune fingerprints, enhancing resilience against five types of image perturbations.
• A contrastive learning strategy is employed to strengthen the discriminative power of fingerprints across different GAN models.
• The method enables both binary classification (real vs. GAN-generated) and multi-class attribution (specific GAN model identification).

Experimental results

Research questions

• RQ1 Can distinct, stable fingerprints be learned from GAN-generated images that uniquely identify their source model?
• RQ2 Do minor variations in GAN training procedures lead to detectably different fingerprints, enabling fine-grained model authentication?
• RQ3 Are the learned fingerprints robust across different image frequencies, spatial patches, and image regions?
• RQ4 Can the fingerprinting method maintain accuracy under five types of adversarial image perturbations?
• RQ5 How does the performance of the proposed fingerprinting method compare to existing baselines in image attribution and classification tasks?

Key findings

• GANs consistently leave stable, distinguishable fingerprints in their generated images, enabling reliable image attribution across diverse image regions and frequency bands.
• Subtle differences in GAN training configurations produce detectably different fingerprints, supporting fine-grained model authentication.
• The learned fingerprints are robust to GAN artifacts and remain effective across different image patches and spectral components.
• Fingerprint fine-tuning significantly improves resilience against five types of adversarial perturbations, maintaining high attribution accuracy.
• The proposed method consistently outperforms multiple baseline approaches in both image source classification and attribution tasks across various experimental setups.
• The fingerprints persist even when images are modified by common image processing techniques, indicating strong generalization capability.