[论文解读] Mitigating Adversarial Attacks in Deepfake Detection: An Exploration of Perturbation and AI Techniques

Saminder Dhesi, Laura Fontes+4 more|arXiv (Cornell University)|Feb 22, 2023

Adversarial Robustness in Machine Learning被引用 4

一句话总结

本文提出一种针对深度伪造检测的定制卷积神经网络（CNN），通过基于白盒扰动的防御方法增强模型对对抗性攻击的鲁棒性。该模型在DFDC数据集上达到76.2%的精确率，并显著降低对抗性攻击下的分类置信度，展现出对逃避攻击的更强抗性。

ABSTRACT

Deep learning constitutes a pivotal component within the realm of machine learning, offering remarkable capabilities in tasks ranging from image recognition to natural language processing. However, this very strength also renders deep learning models susceptible to adversarial examples, a phenomenon pervasive across a diverse array of applications. These adversarial examples are characterized by subtle perturbations artfully injected into clean images or videos, thereby causing deep learning algorithms to misclassify or produce erroneous outputs. This susceptibility extends beyond the confines of digital domains, as adversarial examples can also be strategically designed to target human cognition, leading to the creation of deceptive media, such as deepfakes. Deepfakes, in particular, have emerged as a potent tool to manipulate public opinion and tarnish the reputations of public figures, underscoring the urgent need to address the security and ethical implications associated with adversarial examples. This article delves into the multifaceted world of adversarial examples, elucidating the underlying principles behind their capacity to deceive deep learning algorithms. We explore the various manifestations of this phenomenon, from their insidious role in compromising model reliability to their impact in shaping the contemporary landscape of disinformation and misinformation. To illustrate progress in combating adversarial examples, we showcase the development of a tailored Convolutional Neural Network (CNN) designed explicitly to detect deepfakes, a pivotal step towards enhancing model robustness in the face of adversarial threats. Impressively, this custom CNN has achieved a precision rate of 76.2% on the DFDC dataset.

研究动机与目标

• 为应对深度伪造检测系统中日益增长的对抗性攻击威胁，此类攻击会损害模型的可靠性与可信度。
• 提升深度伪造检测模型对细微、难以察觉的扰动的鲁棒性，此类扰动会导致误分类。
• 通过白盒对抗性攻击开发防御机制，以主动训练和评估模型的抗干扰能力。
• 探讨深度伪造在媒体真实性、声誉管理与网络安全部署中的伦理与实际影响。
• 将检测框架的适用范围从视频取证扩展至更广泛领域，如机器人技术中的3D目标定位。

提出的方法

• 设计一种专为真实与虚假视频二分类任务定制的卷积神经网络（CNN）架构。
• 使用目标性扰动实施白盒对抗性攻击，以模拟现实世界中的逃避尝试并评估模型鲁棒性。
• 采用逐帧分析方法捕捉视频序列中的时间依赖性，提升检测准确率。
• 在训练过程中应用差分隐私技术，以在模型准确率与数据隐私之间取得平衡。
• 通过裁剪、压缩及子采样网络评估方法，评估并提升模型对对抗性输入的鲁棒性。
• 利用DFDC和与COVID-19相关的数据集进行训练与评估，统一输入维度以确保一致性。

Figure 1: Customised 7-layer CNN architecture. The network is composed of 3 convolutional layers, 3 fully connected layer and the classification layer.

实验结果

研究问题

• RQ1 与标准模型相比，定制CNN在对抗性扰动下检测深度伪造的效率如何？
• RQ2 目标性白盒对抗性攻击在多大程度上降低了深度伪造检测系统的分类置信度？
• RQ3 通过扰动进行对抗性训练是否能提升深度伪造检测器对逃避攻击的鲁棒性？
• RQ4 在现实应用中部署基于AI的深度伪造检测系统，其伦理与社会影响是什么？
• RQ5 所提出的方法论如何扩展至检测音视频媒体中的对抗性篡改，以及自动驾驶系统等其他领域？

主要发现

• 所提出的CNN在DFDC数据集上实现了76.2%的精确率，表明其在深度伪造检测中具备出色的基线性能。
• 在白盒对抗性攻击下，真实与虚假数据集的分类概率从10.9降至2.26e-18，表明模型存在严重脆弱性。
• 在对抗性扰动下，COVID-19数据集的分类概率从11.1降至1.46e-16，证实了模型性能的一致性退化。
• 在训练中使用对抗性扰动显著降低了模型对正确预测的置信度，凸显了构建鲁棒防御机制的必要性。
• 差分隐私与数据清洗技术的结合有助于缓解信息泄露问题，并提升了模型的泛化能力。
• 该方法论在音频深度伪造检测及机器人应用中的3D目标定位方面展现出扩展潜力，表明其具备更广泛的应用前景。

Figure 2: The epochs and Accuracy on Real vs. Fake dataset with CNN model