[论文解读] Restricted Black-box Adversarial Attack Against DeepFake Face Swapping

Junhao Dong, Yuan Wang+2 more|arXiv (Cornell University)|Apr 26, 2022

Adversarial Robustness in Machine Learning被引用 4

一句话总结

本文提出了一种受限的黑盒对抗攻击方法，通过在不查询目标模型的情况下生成可迁移的对抗扰动，以干扰深度伪造人脸换脸系统。通过采用新颖的TCA-GAN框架训练替代模型并应用后正则化，该方法使生成的人脸换脸输出严重失真，导致检测准确率显著下降，即使在泛化到其他人脸操作模型时也表现出色。

ABSTRACT

DeepFake face swapping presents a significant threat to online security and social media, which can replace the source face in an arbitrary photo/video with the target face of an entirely different person. In order to prevent this fraud, some researchers have begun to study the adversarial methods against DeepFake or face manipulation. However, existing works focus on the white-box setting or the black-box setting driven by abundant queries, which severely limits the practical application of these methods. To tackle this problem, we introduce a practical adversarial attack that does not require any queries to the facial image forgery model. Our method is built on a substitute model persuing for face reconstruction and then transfers adversarial examples from the substitute model directly to inaccessible black-box DeepFake models. Specially, we propose the Transferable Cycle Adversary Generative Adversarial Network (TCA-GAN) to construct the adversarial perturbation for disrupting unknown DeepFake systems. We also present a novel post-regularization module for enhancing the transferability of generated adversarial examples. To comprehensively measure the effectiveness of our approaches, we construct a challenging benchmark of DeepFake adversarial attacks for future development. Extensive experiments impressively show that the proposed adversarial attack method makes the visual quality of DeepFake face images plummet so that they are easier to be detected by humans and algorithms. Moreover, we demonstrate that the proposed algorithm can be generalized to offer face image protection against various face translation methods.

研究动机与目标

• 为解决现有针对深度伪造人脸换脸的对抗攻击方法在实际应用中的局限性，这些方法通常依赖白盒访问或大量查询。
• 开发一种无需向目标模型查询任何信息的受限黑盒攻击，以实现真实场景下的可应用性。
• 通过新颖的生成框架和后正则化，提升对抗样本对未知深度伪造模型的可迁移性。
• 构建一个基准数据集，用于评估未来研究中针对深度伪造人脸换脸的对抗攻击。
• 证明对抗失真可显著提升现有深度伪造检测方法的性能。

提出的方法

• 提出一种可迁移循环对抗生成对抗网络（TCA-GAN），通过循环一致的方式模拟攻击与防御，以生成对抗扰动。
• 基于深度自编码器训练一个替代模型，用于重建人脸，以模拟未知深度伪造模型的行为。
• 在替代模型上生成对抗样本，并直接迁移至无查询的黑盒目标模型。
• 应用一种新颖的后正则化模块于生成的对抗样本，以增强其在多种人脸操作系统中的可迁移性和鲁棒性。
• 采用参考图像质量度量（SSIM、FSIM）和非参考度量（BRISQUE）对失真程度进行量化评估。
• 该方法可泛化至其他人脸图像转换模型，如StarGAN、GANImation、SaGAN和AttGAN，展现出广泛的适用性。

Figure 1: Illustration of the taxonomy of adversarial attacks against the target Deep Neural Network (DNN). “Training and inference Backward Propagation (BP)” are corresponding to the accessibility to backward gradients of the target model, which are related to training and inference of our adversar

实验结果

研究问题

• RQ1 当不允许向目标深度伪造模型进行任何查询时，受限的黑盒对抗攻击是否仍具有效性？
• RQ2 如何使对抗扰动对未知的深度伪造人脸换脸模型具有高度可迁移性？
• RQ3 对抗失真是否能显著降低人脸换脸图像的视觉质量，从而提升检测性能？
• RQ4 所提出方法在多大程度上可泛化至深度伪造人脸换脸以外的其他人脸操作模型？
• RQ5 后正则化是否能在受限黑盒设置下提升对抗样本的可迁移性和鲁棒性？

主要发现

• 所提方法将人脸换脸图像的SSIM降低至最低0.591，BRISQUE得分提升至49.51，表明存在严重的视觉失真。
• 在所提出的基准数据集上，对抗样本使检测准确率从Xception的67.1%降至71.4%，从CNNDetection的78.3%降至79.7%，显示出检测可识别性的显著提升。
• 该方法有效泛化至其他人脸图像转换模型，包括StarGAN、GANImation、SaGAN和AttGAN，所有模型均表现出一致的视觉质量下降。
• 后正则化显著提升了对抗样本的可迁移性，使其在未见目标模型上产生更强的干扰效果。
• 该方法诱导出的对抗样本提升了多种深度伪造检测模型的性能，证明其作为防御机制的实用性。
• 该方法在无需模型梯度或查询的情况下实现了强烈的视觉失真，证明其在实际受限黑盒场景下的有效性。

Figure 2: Comparison of DeepFake face swapping between the legitimate and the adversarial example. DeepFake aims to replace the source face in the original image with the fake face of the target identity. The adversarial example can be easily obtained by adding a visually undetectable adversarial pe