Abstract:The non-consensual exploitation of facial manipulation has emerged as a pressing societal concern. In tandem with the identification of such fake content, recent research endeavors have advocated countering manipulation techniques through proactive interventions, specifically the incorporation of adversarial noise to impede the manipulation in advance. Nevertheless, with insufficient consideration of robustness, we show that current methods falter in providing protection after simple perturbations, e.g., blur. In addition, traditional optimization-based methods face limitations in scalability as they struggle to accommodate the substantial expansion of data volume, a consequence of the time-intensive iterative pipeline. To solve these challenges, we propose a learning-based model, Adversarial Robust Safeguard (ARS), to generate desirable protection noise in a single forward process, concurrently exhibiting a heightened resistance against prevalent perturbations. Specifically, our method involves a two-way protection design, characterized by a basic protection component responsible for generating efficacious noise features, coupled with robust protection for further enhancement. In robust protection, we first fuse image features with spatially duplicated noise embedding, thereby accounting for inherent information redundancy. Subsequently, a combination comprising a differentiable perturbation module and an adversarial network is devised to simulate potential information degradation during the training process. To evaluate it, we conduct experiments on four manipulation methods and compare recent works comprehensively. The results of our method exhibit good visual effects with pronounced robustness against varied perturbations at different levels.

Frequency-constrained transferable adversarial attack on image manipulation detection and localization

Exploring Frequency Adversarial Attacks for Face Forgery Detection

Analysis of adversarial attacks against CNN-based image forgery detectors

Transferable Adversarial Attack on Image Tampering Localization

A Transferable Anti-Forensic Attack on Forensic CNNs Using A Generative Adversarial Network

LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbations

On the Transferability of Adversarial Examples Against CNN-Based Image Forensics

FP-Net: frequency-perception network with adversarial training for image manipulation localization

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

TAFIM: Targeted Adversarial Attacks against Facial Image Manipulations

Reaching a Better Trade-Off Between Image Quality and Attack Success Rates in Transfer-Based Adversarial Attacks

Low Frequency Sparse Adversarial Attack

Adversarial Attack on Deep Learning-Based Splice Localization

Perception Matters: Exploring Imperceptible and Transferable Anti-forensics for GAN-generated Fake Face Imagery Detection

Local Adaptive Gradient Variance Attack for Deep Fake Fingerprint Detection

Exploiting vulnerabilities of deep neural networks for privacy protection

Increased-confidence Adversarial Examples for Improved Transferability of Counter-Forensic Attacks.

Anti-Forgery: Towards a Stealthy and Robust DeepFake Disruption Attack Via Adversarial Perceptual-aware Perturbations

Adversarial Threats to DeepFake Detection: A Practical Perspective

A New Defense Against Adversarial Images: Turning a Weakness into a Strength

Detecting Adversarial Data via Perturbation Forgery