Abstract:The increasing use of deep neural networks exposes themselves to adversarial attacks in the real world drawn from closed-set and open-set, which poses great threats to their application in safety-critical sys-tems. Since adversarial attacks tend to mislead an original model by adding small perturbations into clean images, an intuitive idea of defensing adversarial attacks is eliminating perturbations as much as possi-ble to mitigate attacking effects. However, such elimination-based strategies unfortunately fail to achieve satisfactory robustness. Aiming to investigate the intrinsic reasons for this phenomenon, systematic ex-periments are carried out in this paper to indicate that even a 20% residual perturbation can still preserve and exhibit attacking effects as strong as a full one. Our study also indicates that there are strong cor-relations between perturbations and legitimate images. Thus, breaking the correlation across multiple bands is more effective in mitigating attacking effects. Based on these findings, this paper proposes an efficient defense strategy called "Frequency-Adaptive Compression and rEconstruction (FACE)" to improve the robustness of the model to adversarial attacks. Specifically, low-frequency bands containing semantic information are compressed by a down-sampling operation, while the channel width of high-frequency bands is squeezed and further compressed by adding noise before the Tanh activating function. Mean-while, attachment spaces of perturbations are also squeezed to the extent as much as possible. Finally, a clean output is obtained by upsampling together with expanded reconstruction. Experiments are ex-tensively conducted on widely used datasets to demonstrate the effectiveness of the proposed method. For closed-set attacks, FACE outperforms the STOA elimination-based methods on ImageNet, achieving a 27.9% improvement. For the MNIST open-set attacks, it not only reduces the success rate of targeted at-tack by a large margin (from 100% to 24.7%), but also mitigates attacking effects with an FPR-95 value of 0.3.(c) 2023 Elsevier Ltd. All rights reserved.

DF-RAP: A Robust Adversarial Perturbation for Defending Against Deepfakes in Real-world Social Network Scenarios

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

MDCF-Net: Multi-Scale Dual-Branch Network for Compressed Face Forgery Detection

Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Faces

Multi-domain awareness for compressed deepfake videos detection over social networks guided by common mechanisms between artifacts

Towards Compression-Resistant Privacy-Preserving Photo Sharing on Social Networks

Low-Mid Adversarial Perturbation against Unauthorized Face Recognition System

Restricted Black-Box Adversarial Attack Against DeepFake Face Swapping

ID-Guard: A Universal Framework for Combating Facial Manipulation via Breaking Identification

Defense Against Adversarial Attacks with Efficient Frequency-Adaptive Compression and Reconstruction

Information-containing Adversarial Perturbation for Combating Facial Manipulation Systems

Anti-Forensics for Face Swapping Videos via Adversarial Training

Adversarial Threats to DeepFake Detection: A Practical Perspective

A defensive framework for deepfake detection under adversarial settings using temporal and spatial features

Pixel Bleach Network for Detecting Face Forgery under Compression

Hiding Faces in Plain Sight: Defending DeepFakes by Disrupting Face Detection

Towards robust DeepFake distortion attack via adversarial autoaugment

MagDR: Mask-guided Detection and Reconstruction for Defending Deepfakes

FFR_FD: Effective and fast detection of DeepFakes via feature point defects

Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systems

Securing Facial Bioinformation by Eliminating Adversarial Perturbations