[Paper Review] Mitigating Adversarial Attacks in Deepfake Detection: An Exploration of Perturbation and AI Techniques

Saminder Dhesi, Laura Fontes+4 more|arXiv (Cornell University)|Feb 22, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a custom Convolutional Neural Network (CNN) for deepfake detection that enhances robustness against adversarial attacks through white-box perturbation-based defense. The model achieves 76.2% precision on the DFDC dataset and significantly reduces classification confidence under adversarial attacks, demonstrating improved resilience to evasion attempts.

ABSTRACT

Deep learning constitutes a pivotal component within the realm of machine learning, offering remarkable capabilities in tasks ranging from image recognition to natural language processing. However, this very strength also renders deep learning models susceptible to adversarial examples, a phenomenon pervasive across a diverse array of applications. These adversarial examples are characterized by subtle perturbations artfully injected into clean images or videos, thereby causing deep learning algorithms to misclassify or produce erroneous outputs. This susceptibility extends beyond the confines of digital domains, as adversarial examples can also be strategically designed to target human cognition, leading to the creation of deceptive media, such as deepfakes. Deepfakes, in particular, have emerged as a potent tool to manipulate public opinion and tarnish the reputations of public figures, underscoring the urgent need to address the security and ethical implications associated with adversarial examples. This article delves into the multifaceted world of adversarial examples, elucidating the underlying principles behind their capacity to deceive deep learning algorithms. We explore the various manifestations of this phenomenon, from their insidious role in compromising model reliability to their impact in shaping the contemporary landscape of disinformation and misinformation. To illustrate progress in combating adversarial examples, we showcase the development of a tailored Convolutional Neural Network (CNN) designed explicitly to detect deepfakes, a pivotal step towards enhancing model robustness in the face of adversarial threats. Impressively, this custom CNN has achieved a precision rate of 76.2% on the DFDC dataset.

Motivation & Objective

• To address the growing threat of adversarial attacks in deepfake detection systems that compromise model reliability and trustworthiness.
• To improve the robustness of deepfake detection models against subtle, imperceptible perturbations that cause misclassification.
• To develop a defense mechanism using white-box adversarial attacks to proactively train and evaluate model resilience.
• To explore the ethical and practical implications of deepfakes in media integrity, reputation management, and cybersecurity.
• To extend the applicability of the detection framework beyond video forensics to broader domains such as 3D object localization in robotics.

Proposed method

• Design a custom Convolutional Neural Network (CNN) architecture specifically trained for binary classification of real vs. fake videos.
• Apply white-box adversarial attacks using targeted perturbations to simulate real-world evasion attempts and evaluate model robustness.
• Utilize frame-by-frame analysis to capture temporal dependencies in video sequences, enhancing detection accuracy.
• Employ differential privacy techniques to balance model accuracy and data privacy during training.
• Apply cropping, compression, and sub-sampled network evaluation to assess and improve model resilience against adversarial inputs.
• Leverage the DFDC and COVID-19 related datasets for training and evaluation, standardizing input dimensions for consistency.

Figure 1: Customised 7-layer CNN architecture. The network is composed of 3 convolutional layers, 3 fully connected layer and the classification layer.

Experimental results

Research questions

• RQ1 How effective is a custom CNN in detecting deepfakes under adversarial perturbations compared to standard models?
• RQ2 To what extent do targeted white-box adversarial attacks reduce classification confidence in deepfake detection systems?
• RQ3 Can adversarial training through perturbation improve the robustness of deepfake detectors against evasion attacks?
• RQ4 What are the ethical and societal implications of deploying AI-based deepfake detection systems in real-world applications?
• RQ5 How can the proposed methodology be extended to detect adversarial manipulations in audio-visual media and other domains like autonomous systems?

Key findings

• The proposed CNN achieved a precision rate of 76.2% on the DFDC dataset, demonstrating strong baseline performance for deepfake detection.
• Under white-box adversarial attacks, the classification probability for the Real vs. Fake dataset dropped from 10.9 to 2.26e-18, indicating severe model vulnerability.
• The classification probability for the COVID-19 dataset decreased from 11.1 to 1.46e-16 under adversarial perturbations, confirming consistent model degradation.
• The use of adversarial perturbations during training significantly reduced model confidence in correct predictions, highlighting the need for robust defense mechanisms.
• The integration of differential privacy and data sanitation techniques helped mitigate information leakage and improved model generalization.
• The methodology shows potential for extension to audio deepfake detection and 3D object localization in robotic applications, suggesting broader applicability.

Figure 2: The epochs and Accuracy on Real vs. Fake dataset with CNN model