Abstract:As Generative Adversarial Networks advance, deepfakes have become increasingly realistic, thereby escalating societal, economic, and political threats. In confronting these heightened risks, the research community has identified two promising defensive strategies: proactive deepfake disruption and reactive deepfake detection. Typically, proactive and reactive defenses coexist, each addressing the shortcomings of the other. However, this paper brings to the fore a critical yet overlooked issue associated with the simultaneous deployment of these deepfake countermeasures. Genuine images gathered from the Internet, already imbued with disrupting perturbations, can lead to data poisoning in the training datasets of deepfake detection models, thereby severely affecting detection accuracy. We propose an improved training framework to address this problem in deepfake detection models. Our approach involves purifying the disrupting perturbations in disruptive images using a backward process of the denoising diffusion probabilistic model (DDPM). Images purified using our DDPM-based technique closely mimic the original, unperturbed images, thereby enabling the successful generation of deepfake images for training purposes. Moreover, our purification process outperforms DiffPure, a prominent adversarial purification method, in terms of speed. While conventional defensive techniques struggle to preserve detection accuracy in the face of a poisoned training dataset, our framework markedly reduces this accuracy drop, thus achieving superior performance across a range of detection models. Our experiments demonstrate that deepfake detection models trained using our framework exhibit an increase in detection accuracy ranging from 11.24%p to 45.72%p when compared to models trained with the DiffPure method. Our implementation is available at https://github.com/seclab-yonsei/Anti-disrupt.

Coexistence of Deepfake Defenses: Addressing the Poisoning Challenge

Mitigating Adversarial Attacks in Deepfake Detection: An Exploration of Perturbation and AI Techniques

FaceShield: Defending Facial Image against Deepfake Threats

Hiding Faces in Plain Sight: Defending DeepFakes by Disrupting Face Detection

Adversarial Threats to DeepFake Detection: A Practical Perspective

LEAT: Towards Robust Deepfake Disruption in Real-World Scenarios via Latent Ensemble Attack

Anti-Forgery: Towards a Stealthy and Robust DeepFake Disruption Attack Via Adversarial Perceptual-aware Perturbations

An Analysis of Recent Advances in Deepfake Image Detection in an Evolving Threat Landscape

Jointly Defending DeepFake Manipulation and Adversarial Attack Using Decoy Mechanism

Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Faces

The Tug-of-War Between Deepfake Generation and Detection

PGD-Trap: Proactive Deepfake Defense with Sticky Adversarial Signals and Iterative Latent Variable Refinement

Coherent Adversarial Deepfake Video Generation

Generative Transferable Universal Adversarial Perturbation for Combating Deepfakes

Real is not True: Backdoor Attacks Against Deepfake Detection

Deepfake Detection Fighting Against Noisy Label Attack

DifFilter: Defending Against Adversarial Perturbations with Diffusion Filter

FakeRetouch: Evading DeepFakes Detection Via the Guidance of Deliberate Noise

Anti-Forensics for Face Swapping Videos via Adversarial Training

Restricted Black-Box Adversarial Attack Against DeepFake Face Swapping

Crafting imperceptible and transferable adversarial examples: leveraging conditional residual generator and wavelet transforms to deceive deepfake detection