Deepfake video detection method and system under adversarial conditions

Abstract

The present application belongs to the technical field of multimedia information processing, and particularly relates to a kind of deep fake video detection method and system under the condition of confrontation, first, construct deep fake video detection model set and carry out model training, wherein, deep fake video detection model set at least contains 3 neural network structure models for respectively carrying out true and false detection to input video;Then, the trained deep fake video detection model set is used to detect the authenticity of the video to be detected, and for the authenticity detection output of each model in the set, the principle of large number winning is used for centralized decision to determine the final authenticity detection result.The present application aims at the problem that the forger adds disturbance through techniques such as adversarial samples to interfere with deep fake video detection and affect detection accuracy, and improves the robustness of fake video detection based on multi-model detection, improves video authentication accuracy, and is convenient for practical scene application.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of multimedia information processing, and particularly relates to a deepfake video detection method and system under an adversarial condition. BACKGROUND

[0002] With the development of deep learning and its popularization in the field of computer vision, deepfake video technology based on deep learning has been widely applied, which improves the accuracy of deepfake video detection. However, the rapid development of adversarial samples and other adversarial technologies has brought new challenges to the detection of deepfake videos. In order to evade detection, the forger can add disturbances that are not easily perceived by the human eye to the generated fake video using adversarial sample technology, which brings trouble to the deepfake video detection model based on deep learning and affects the detection effect of the detection model on deepfake videos. SUMMARY

[0003] Therefore, the present application provides a deepfake video detection method and system under an adversarial condition, which aims to solve the problem of deepfake video detection interference and detection accuracy influence caused by the forger adding disturbances through adversarial samples and other technologies, improves the robustness of fake video detection based on multi-model detection, and improves the video authentication accuracy for practical scene application.

[0004] According to the design scheme provided by the present application, a deepfake video detection method under an adversarial condition is provided, which includes the following contents:

[0005] A set of deepfake video detection models is constructed and trained, wherein the set of deepfake video detection models includes at least three neural network structure models for respectively detecting the authenticity of input videos;

[0006] The trained set of deepfake video detection models is used to detect the authenticity of the video to be detected, and the majority rule is used to make a centralized decision on the authenticity detection output of each model in the set to determine the final authenticity detection result.

[0007] As the deepfake video detection method under an adversarial condition in the present application, further, different neural network structure models are used in the set of deepfake video detection models to detect the authenticity.

[0008] As the deepfake video detection method under an adversarial condition in the present application, further, in the model training, the open source deepfake dataset DFDC (according to the actual application scene, other datasets can also be used for training) is used to train the neural network structure models in the set.

[0009] As the deep fake video detection method under the anti-condition in the application, further, in the true and false detection using the neural network structure model in the set, first, for the video data to be input, N variants are performed on the video data, N is a natural number; then, the video data to be input and its N variants are respectively sent into the neural network structure model for detection, and a detection output sequence is obtained; finally, according to the detection output sequence, a final output of the neural network structure model is determined by comprehensive judgment through a preset threshold.

[0010] As the deep fake video detection method under the anti-condition in the application, further, the variant of the video data comprises the following modes: changing the color bit depth of each pixel in the video data and / or setting a smooth neighborhood value for spatial smoothing.

[0011] As the deep fake video detection method under the anti-condition in the application, further, in the comprehensive judgment through the preset threshold, the true and false threshold values T1, T2 and T3 are set, and T1>T2>T3, if the detection output sequence element corresponding to the input video data is greater than T1, it is determined that the input video data is a fake video, if the detection output sequence element corresponding to the input video data is less than T1 and greater than T2, the absolute value of the difference between the detection output sequence element corresponding to the input video data and other elements in the detection output sequence is calculated, the maximum value of the calculated absolute value of the difference is calculated, if the maximum value is greater than T3, it is determined that the input video data is a fake video, if the detection output sequence element corresponding to the input video data is less than T2, it is determined that the input video data is a real video.

[0012] As the deep fake video detection method under the anti-condition in the application, further, in the true and false detection using the neural network structure model in the set, the true and false threshold value is set, if the detection output sequence element corresponding to the input video data is greater than the threshold T1, it is determined that the input video data is a fake video, if it is less than the threshold T2, it is determined that the input video data is a real video, otherwise, N variants are performed on the video data to be input, the neural network structure model is used to perform true and false detection on the N variants to obtain a detection output sequence, if the detection output sequence element corresponding to the input video data is less than T1 and greater than T2, the absolute value of the difference between the detection output sequence element corresponding to the input video data and other elements in the detection output sequence is calculated, the maximum value of the calculated absolute value of the difference is calculated, if the maximum value is greater than T3, it is determined that the input video data is a fake video, otherwise, it is determined that the input video data is a real video.

[0013] Further, the application also provides a deep fake video detection system under the anti-condition, comprising: a model construction module and a detection output module, wherein,

[0014] The model building module is used to build a set of deepfake video detection models and train the models. The set of deepfake video detection models contains at least three neural network structure models for detecting the authenticity of input videos.

[0015] The detection output module is used to perform authenticity detection on the video to be detected using the trained deep fake video detection model set. For the authenticity detection output of each model in the set, the majority rule is used to make a centralized decision to determine the final authenticity detection result.

[0016] The beneficial effects of this invention are:

[0017] This invention improves the detection effect of deepfake videos under adversarial conditions by using multiple models to jointly perform video authenticity detection; and further improves the detection accuracy of deepfake videos under adversarial conditions by performing various transformations on the video frames to be detected. It has good application prospects and provides a solution for deepfake videos under adversarial conditions. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the deepfake video detection process under adversarial conditions in the embodiment;

[0019] Figure 2 This is a schematic diagram illustrating the principle of deepfake video detection attacks in the embodiment;

[0020] Figure 3 This is a schematic diagram illustrating the robust deepfake video detection principle based on multi-model collaboration in the embodiment;

[0021] Figure 4 This is a schematic diagram illustrating the detection principle of a single model with multiple variants in the embodiment;

[0022] Figure 5 This is a schematic diagram of the video frame to be detected in the embodiment. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0024] In the detection of deepfake videos, forgers use adversarial example techniques to add perturbations and interference to each frame of the forged video. See the embodiments of this invention. Figure 1 As shown, a method for detecting deepfake videos under adversarial conditions is provided, comprising:

[0025] S101. Construct a set of deepfake video detection models and train the models. The set of deepfake video detection models shall contain at least three neural network structure models for detecting the authenticity of input videos.

[0026] S102, using the trained deep fake video detection model set to detect the authenticity of the video to be detected, and for each model in the set, the authenticity detection output is used to make a centralized decision based on the principle of large numbers to determine the final authenticity detection result.

[0027] Referring to Figure 2 As shown in Figure 3 , considering that the adversarial sample may mainly affect one or a certain type of detection model, it is not possible to be effective for all detection models, so robust detection can be completed through the cooperation of multiple detection models. The main idea is to build a detection set through multiple detection models. During detection, each face region image is simultaneously sent to multiple detection models for detection, and then each detector votes according to its own detection result. According to the rule of large numbers, the final detection result is output. That is, if more than half of the detectors judge that a video frame is real, the detection result of the real video frame is output, and if more than half of the detectors judge that a video frame is deep fake, the detection result of the deep fake video frame is output.

[0028] As a preferred embodiment, further, in the authenticity detection using the neural network structure model in the set, first, for the video data to be input, N variants thereof are performed, N being a natural number; then, the video data to be input and its N variants are sent into the neural network structure model for detection, and a detection output sequence is obtained; finally, according to the detection output sequence, a comprehensive decision is made through a preset threshold to determine the final output of the neural network structure model.

[0029] In order to improve the robustness of the scheme, the detection process of each detection model can be set to be different from the general method. In the general detection method, the detection model directly detects the video frame to be detected and obtains the decision result. In the present scheme, the detection model can be set to not only detect the original video frame, but also detect various transformed forms of the video frame, and then make a final decision based on all the detection results. The detection process of Model A in Figure 3 will be described as an example, as shown in Figure 4 , the video frame to be detected and its N variants are sent into the same detection model to obtain an output sequence The process of comprehensive decision according to the output sequence is as follows:

[0030] (1) If , the video frame to be detected is determined as a deepfake video frame, and the output result is outputted.

[0031] (2) If , the absolute values of the differences between and other outputs are calculated respectively. The maximum value among d1, d2,..., d N is taken, and d (A) =max(d1, d2,..., d N ).

[0032] (3) If d (A) >T3, the video frame to be detected is determined as a deepfake video frame, and the output result is outputted.

[0033] In actual operation, in order to save the amount of calculation, the video frame to be detected can be sent into the detection model, and according to the above step (1), if , the deepfake video frame is determined and the detection is exited; if , the normal video frame is determined and the detection is exited; otherwise, various transformations are performed on the video frame to be detected, and then the various transformations are sent into the detection model for detection, and the above steps (2) and (3) are performed.

[0034] Further, based on the above method, the embodiment of the application further provides a deepfake video detection system under an adversarial condition, comprising a model construction module and a detection output module, wherein

[0035] The model construction module is used to construct a deepfake video detection model set and perform model training, wherein the deepfake video detection model set comprises at least three neural network structure models for respectively detecting the input video.

[0036] The detection output module is used to perform true-false detection on the video to be detected by using the trained deepfake video detection model set, and adopts the principle of majority wins to make centralized decision for the true-false detection output of each model in the set, so as to determine the final true-false detection result.

[0037] In order to verify the effectiveness of the scheme, the following actual cases are further explained and described:

[0038] Three different detection models are selected for multi-detection model. In this case, three representative CNN networks in the field of computer vision, ResNet34, xception and efficientNet, are taken as examples. The three detection models are trained on the open-source deepfake dataset DFDC. Since the forged regions of the videos in this dataset are concentrated in the face, the RetinaFace algorithm can be used to identify the face in each frame of the video and intercept the face region, which is saved separately as the input of the training set and the video to be detected. Figure 4 The two transformation methods in the above can be selected: the first is to reduce the color bit depth of each pixel, and in this case the depth can be set to 4; the second is spatial smoothing, and in this case the smoothing neighborhood size can be set to 10*10. Figure 4 The three thresholds of the comprehensive decision in the above can be set as: T1=0.95, T2=0.4, T3=0.3. For the original video frame, the video frame to be detected after adding interference by iterative_fgsm is shown in the following table: Figure 5 The output of the above three detection models is shown in the following table:

[0039]

[0040] The above experimental data can further illustrate that the multi-detection model in the embodiment can achieve better deepfake video detection effect, which is convenient for the detection of forged videos under adversarial conditions.

[0041] Unless specifically stated otherwise, the relative steps, numerical expressions and values of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0042] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between each embodiment can be referred to each other. For the system disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts are referred to the method part.

[0043] The units and method steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example are generally described in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation does not exceed the scope of the present application.

[0044] Those skilled in the art can understand that all or part of the steps in the foregoing method can be instructed by programs to the relevant hardware to complete, and the programs can be stored in a computer readable storage medium, such as a read-only memory, a magnetic disk or an optical disk. Alternatively, all or part of the steps of the foregoing embodiments can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the foregoing embodiments can be implemented in the form of hardware or in the form of a software functional module. The present application is not limited to any specific form of combination of hardware and software.

[0045] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present application, which are used to illustrate the technical solutions of the present application, rather than limit the same. The protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can make modifications or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features within the technical range disclosed by the present application. Such modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for detecting deepfake videos under adversarial conditions, characterized in that, Includes the following content: Construct a set of deepfake video detection models and train the models. The set of deepfake video detection models contains at least three neural network structure models for detecting the authenticity of input videos. The trained deepfake video detection model ensemble is used to detect the authenticity of the video to be detected. For the authenticity detection output of each model in the ensemble, the majority rule is used to make a centralized decision to determine the final authenticity detection result. In the process of using the neural network structure model in the set for authenticity detection, firstly, the video data to be input is subjected to N variants, where N is a natural number; then, the video data to be input and its N variants are respectively fed into the neural network structure model for detection, and the detection output sequence is obtained; finally, based on the detection output sequence, a comprehensive judgment is made through a preset threshold to determine the final output of the neural network structure model. Furthermore, in the comprehensive judgment through preset thresholds, true / false threshold values ​​T1, T2, and T3 are set, with T1 > T2 > T3. If the detected output sequence element corresponding to the input video data is greater than T1, the input video data is determined to be a fake video. If the detected output sequence element corresponding to the input video data is less than T1 but greater than T2, the absolute value of the difference between the detected output sequence element corresponding to the input video data and other elements in the detected output sequence is calculated. The maximum value of the calculated absolute difference is determined to be a fake video if it is greater than T3. If the detected output sequence element corresponding to the input video data is less than T2, the input video data is determined to be a real video.

2. The deepfake video detection method under adversarial conditions according to claim 1, characterized in that, The deepfake video detection model set uses neural network structure models with different structures to detect authenticity.

3. The deepfake video detection method under adversarial conditions according to claim 1 or 2, characterized in that, During model training, the open-source deep fake dataset DFDC was used to train the neural network structure models in the dataset.

4. The deepfake video detection method under adversarial conditions according to claim 1, characterized in that, Variations of acquiring video data include: changing the color bit depth of each pixel in the video data and / or setting a smoothing neighborhood value for spatial smoothing.

5. The deepfake video detection method under adversarial conditions according to claim 1, characterized in that, In the authenticity detection using the neural network structure model in the set, a authenticity threshold is set. If the detection output sequence element corresponding to the input video data is greater than the threshold T1, the input video data is determined to be a fake video; if it is less than the threshold T2, the input video data is determined to be a real video. Otherwise, the input video data is processed into N variants, and the neural network structure model is used to perform authenticity detection on each of the N variants to obtain the detection output sequence. If the detection output sequence element corresponding to the input video data is less than T1 and greater than T2, the absolute value of the difference between the detection output sequence element corresponding to the input video data and other elements in the detection output sequence is calculated. The maximum value of the calculated absolute difference is determined to be a fake video if it is greater than T3; otherwise, it is determined to be a real video.

6. A deepfake video detection system under adversarial conditions, characterized in that, It includes: a model building module and a detection output module, wherein, The model building module is used to build a set of deepfake video detection models and train the models. The set of deepfake video detection models contains at least three neural network structure models for detecting the authenticity of input videos. The detection output module utilizes a trained ensemble of deepfake video detection models to perform authenticity checks on the videos to be detected. For each model's output, a majority-rule decision is applied to determine the final authenticity result. Specifically, in the authenticity detection using the neural network structure models in the ensemble, firstly, the input video data is processed into N variants (N being a natural number); then, the input video data and its N variants are fed into the neural network structure models for detection, and a detection output sequence is obtained; finally, based on the detection output sequence, a comprehensive decision is made using a preset threshold to determine the optimal authenticity of the neural network structure model. The final output is determined by a comprehensive judgment based on preset thresholds. Threshold values ​​T1, T2, and T3 are set, where T1 > T2 > T3. If the detected output sequence element corresponding to the input video data is greater than T1, the input video data is determined to be a fake video. If the detected output sequence element corresponding to the input video data is less than T1 but greater than T2, the absolute value of the difference between the detected output sequence element corresponding to the input video data and other elements in the detected output sequence is calculated. The maximum value of the calculated absolute difference is determined. If this maximum value is greater than T3, the video is determined to be fake. If the detected output sequence element corresponding to the input video data is less than T2, the input video data is determined to be a real video.

7. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is configured to execute a program stored in memory and, when the program is executed, implement the method described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 5.

Images