[Paper Review] Imperceptible Adversarial Examples for Fake Image Detection

Quanyu Liao, Yuezun Li+7 more|arXiv (Cornell University)|Jun 3, 2021

Adversarial Robustness in Machine Learning19 references4 citations

TL;DR

This paper proposes Key Region Attack (KRA), a novel method to generate imperceptible adversarial examples for fooling fake image detectors by targeting only the most critical pixels identified through multi-layer feature maps. By minimizing both $L_0$ and $L_2$ norms of perturbations, KRA achieves state-of-the-art attack success rates with significantly reduced perceptibility compared to existing methods.

ABSTRACT

Fooling people with highly realistic fake images generated with Deepfake or GANs brings a great social disturbance to our society. Many methods have been proposed to detect fake images, but they are vulnerable to adversarial perturbations -- intentionally designed noises that can lead to the wrong prediction. Existing methods of attacking fake image detectors usually generate adversarial perturbations to perturb almost the entire image. This is redundant and increases the perceptibility of perturbations. In this paper, we propose a novel method to disrupt the fake image detection by determining key pixels to a fake image detector and attacking only the key pixels, which results in the $L_0$ and the $L_2$ norms of adversarial perturbations much less than those of existing works. Experiments on two public datasets with three fake image detectors indicate that our proposed method achieves state-of-the-art performance in both white-box and black-box attacks.

Motivation & Objective

• To address the limitations of existing adversarial attacks that apply perturbations across entire images, increasing perceptibility and computational cost.
• To reduce both $L_0$ and $L_2$ norms of adversarial perturbations simultaneously for improved imperceptibility.
• To identify and target only the most semantically relevant pixels that fake detectors rely on for classification.
• To develop a flexible framework that integrates various attack methods (e.g., FGSM, DeepFool) for efficient and effective evasion.
• To achieve high attack success in both white-box and black-box settings while maintaining low perceptibility.

Proposed method

• KRA identifies key pixels using Multi-Layers Key Semantic Region Selection (MLSKRS), which combines heatmaps from multiple convolutional layers to locate regions critical to detection.
• MLSKRS uses spatial and gradient information from both shallow and deep layers to generate a compact, high-impact mask $\mathcal{M}$ of key pixels.
• The method reformulates the attack problem to minimize $||r||_2 + ||\mathcal{M}||_0$, where $r$ is the perturbation and $\mathcal{M}$ is the set of key pixels, ensuring sparsity and low distortion.
• KRA is designed as a container that integrates standard adversarial attack methods (e.g., PGD, DeepFool) to generate perturbations only on the selected key pixels.
• The framework applies gradient-based optimization only on the masked key regions, drastically reducing the number of modified pixels and computational cost.
• A thresholding strategy with parameters $t_\alpha = 0.8$, $t' = 0.1$, and $\beta = 0.1$ is used to refine the final key pixel mask.

Experimental results

Research questions

• RQ1 Can targeting only a small set of key pixels significantly disrupt fake image detection while minimizing perceptibility?
• RQ2 Can combining feature maps from multiple convolutional layers improve the accuracy and sparsity of key pixel detection compared to using only the final layer?
• RQ3 Does reducing both $L_0$ and $L_2$ norms of perturbations lead to more imperceptible adversarial examples without sacrificing attack success?
• RQ4 Can the proposed method achieve strong transferability in black-box attack scenarios?
• RQ5 How does the integration of different attack algorithms (e.g., PGD, DeepFool) affect performance when restricted to key pixels?

Key findings

• KRA achieves state-of-the-art white-box attack success rates, reducing the accuracy of three fake detectors (Xception, Inception-v3, ResNet) to below 0.01.
• The $L_2$ norm of KRA-generated perturbations is reduced by 10 times compared to PGD-based attacks and 100 times compared to $L_2$-minimizing baselines.
• The $L_0$ norm of KRA perturbations is 10 times lower than that of $L_0$-based attack methods, indicating significantly sparser perturbations.
• In black-box attacks, KRA maintains strong transferability with Attack Transfer Ratios (ATR) within 50% ± 15%, demonstrating robust generalization.
• Qualitative results show that perturbations are localized only on key regions and are imperceptible to human observers, even when normalized to [0,255].
• The method achieves high efficiency by restricting perturbations to a small, semantically meaningful subset of pixels, reducing both computation and perceptibility.