Depth forgery detector anti-robustness evaluation method based on model integration

Abstract

The invention discloses a model integration-based deep forgery detector anti-robustness evaluation method, and belongs to the technical field of computer vision and information security. In order to solve the problems of poor migration of adversarial samples and insufficient compression robustness of an existing deep forgery detector, multiple deep forgery detection models of different structures are integrated, an adversarial sample is generated by adopting a momentum iteration-common weakness attack algorithm, and meanwhile, a differentiable JPEG compression module is embedded to simulate a real compression process. According to the technical scheme, the method comprises the steps of selecting multiple counterfeit detection models to construct an evaluation sample set; generating a basic confrontation sample by using a model integration strategy; generating a compressed robust confrontation sample in combination with differentiable compression; and the system evaluates the attack effect of the confrontation sample under different compression strengths. According to the method, the mobility and the compression robustness of the adversarial sample are improved, and the security vulnerability of the deep counterfeit detection system can be comprehensively evaluated.

Description

Technical Field

[0001] The present invention belongs to the field of computer vision and information security technology, and in particular relates to a method for evaluating the adversarial robustness of a deep fake detector based on model integration. Background Art

[0002] Deepfake detection technology can determine the authenticity of images and aims to address privacy threats and authenticity crises caused by the misuse of deepfake technology. Existing adversarial robustness assessment methods fall into two main categories: One type relies on pixel-level perturbations, such as the Fast Signed Gradient Method (FSG), which adds perturbations to the pixel space. While these methods can effectively attack specific detectors, the generated adversarial examples have poor transferability to other structural detectors. The other type relies on latent space optimization, such as adding perturbations to the StyleGAN latent space. While these methods maintain high visual quality, the high-dimensional complexity of the latent space can easily lead to uncontrollable changes in identity features, compromising the stability of the attack. In practical applications, deepfake content often requires network transmission and storage compression. The effectiveness of traditional adversarial examples is significantly reduced after lossy compression, such as JPEG. Existing methods that simulate image compression processes, such as Gaussian blurring and noise addition, differ from actual compression algorithms and cannot accurately assess the robustness of detectors in real-world scenarios. Furthermore, current assessment methods often focus on a single detection model, failing to fully reflect the overall security of different detection systems. These problems make it difficult for existing evaluation methods to provide reliable adversarial robustness references for the actual deployment of deep fake detection systems. There is an urgent need for an evaluation method that can generate highly transferable and highly compressible robust adversarial samples to fully reveal the potential vulnerabilities of the detection system in real application environments. Summary of the Invention

[0003] In order to solve the above technical problems, the present invention proposes a deep fake detector adversarial robustness evaluation method based on model integration to solve the problems existing in the above-mentioned prior art.

[0004] In a first aspect, to achieve the above-mentioned objectives, the present invention provides a method for evaluating the robustness of a deep fake detector based on model integration, comprising the following steps:

[0005] Select multiple deepfake detection models with different structures and construct a sample set of fake images;

[0006] A model ensemble strategy is used to calculate the ensemble loss based on the output information of multiple deepfake detection models, and adversarial examples are generated in pixel space through gradient optimization.

[0007] Embed a differentiable JPEG compression module into the adversarial sample generation process to generate compression-robust adversarial samples that remain effective even after image compression.

[0008] The generated adversarial samples are used to test the classification accuracy of each deep fake detector and evaluate its adversarial robustness.

[0009] Optionally, the model integration strategy adopts a logits integration method to fuse the output information of multiple deep fake detection models and calculate the integration loss.

[0010] Optionally, the gradient optimization process includes:

[0011] A momentum iteration algorithm is used to stabilize the gradient direction so that the adversarial examples are located in a flat loss landscape area.

[0012] By attacking common weaknesses, the distance between the adversarial samples and the local optimal points of each model is optimized to ensure that multiple deep fake detectors are attacked at the same time.

[0013] Optionally, the differentiable JPEG compression module uses an approximately differentiable function to replace the rounding operation in traditional JPEG compression to ensure that the compression process is differentiable.

[0014] Optionally, the embedding method of the differentiable JPEG compression module includes outer ring embedding or simultaneous embedding of the outer ring and the inner ring.

[0015] Optionally, the process of evaluating the adversarial robustness includes:

[0016] Test the attack success rate of adversarial samples under uncompressed and different JPEG compression strengths;

[0017] Compare the attack performance differences between basic adversarial samples and compressed robust adversarial samples.

[0018] In a second aspect, the present invention further provides a system for evaluating the robustness of a deep fake detector based on model integration, which is used to implement a method for evaluating the robustness of a deep fake detector based on model integration. The system includes:

[0019] A model integration module, which selects multiple deepfake detection models with different structures and calculates the integration loss based on their output information;

[0020] Adversarial sample generation module, which is used to generate adversarial samples in pixel space through gradient optimization and embed differentiable JPEG compression processing;

[0021] The robustness evaluation module is used to use the generated adversarial samples to test the classification accuracy of each deep fake detector and evaluate its adversarial robustness.

[0022] In a third aspect, the present invention further provides a computer terminal device, comprising:

[0023] one or more processors;

[0024] a memory, coupled to the processor, for storing one or more programs;

[0025] When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method for evaluating the adversarial robustness of deep fake detectors based on model integration in the above-mentioned first aspect.

[0026] In a fourth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method for evaluating the robustness of a deep fake detector based on model integration in the above-mentioned first aspect are implemented.

[0027] In a fifth aspect, the present invention also provides a computer program product, comprising a computer program which, when executed by a processor, implements the steps of the method for evaluating the adversarial robustness of a deep fake detector based on model integration in the above-mentioned first aspect.

[0028] Compared with the prior art, the present invention has the following advantages and technical effects:

[0029] The present invention provides a method for evaluating the adversarial robustness of deepfake detectors based on model integration. By integrating multiple deepfake detection models with different structures, the present invention significantly improves the portability of adversarial samples, enabling them to mislead multiple detectors at the same time. The introduction of a differentiable JPEG compression module ensures that the generated adversarial samples still maintain attack effectiveness after image compression, thereby enhancing the robustness in practical applications. The system evaluation process covers both uncompressed and compressed scenarios, comprehensively revealing the potential vulnerabilities of deepfake detectors. The combination of flat loss landscape optimization and common weakness attack strategy makes the attack process more stable and controllable while maintaining the visual quality of the adversarial samples. This method provides a more reliable solution for the security evaluation of deepfake detection systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which constitute part of the present invention, are provided to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are provided to explain the present invention and do not constitute an undue limitation of the present invention. In the accompanying drawings:

[0031] Figure 1 This is a flow chart of a method for evaluating the robustness of a deep fake detector based on model integration according to an embodiment of the present invention;

[0032] Figure 2 The flat and steep loss landscapes of an embodiment of the present invention are shown in FIG. 1 , wherein the left image is a flat loss landscape and the right image is a steep loss landscape;

[0033] Figure 3 For the embodiment of the present invention To each Distance visualization graph;

[0034] Figure 4 A flowchart for generating basic adversarial samples according to an embodiment of the present invention;

[0035] Figure 5 Flowchart for evaluating the adversarial robustness of a forged detector using basic adversarial examples according to an embodiment of the present invention;

[0036] Figure 6 A flowchart for generating compression robust adversarial samples for outer loop embedding JPEGdiff according to an embodiment of the present invention;

[0037] Figure 7 A flowchart for generating a compression robust adversarial sample with both the outer and inner loops embedded in JPEGdiff according to an embodiment of the present invention;

[0038] Figure 8 A flowchart for evaluating the adversarial robustness of a forged detector using a compressed robust adversarial sample according to an embodiment of the present invention;

[0039] Figure 9 Flowchart for evaluating the adversarial robustness of a forgery detector (considering image compression) based on basic adversarial examples according to an embodiment of the present invention;

[0040] Figure 10 Flowchart for evaluating the adversarial robustness of a forgery detector for compression-robust adversarial examples (considering image compression) according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0042] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0043] Example 1

[0044] like Figure 1 As shown, this embodiment provides a method for evaluating the robustness of a deep fake detector based on model integration, including:

[0045] Select multiple deepfake detection models with different structures and construct a sample set of fake images;

[0046] A model ensemble strategy is used to calculate the ensemble loss based on the output information of multiple deepfake detection models, and adversarial examples are generated in pixel space through gradient optimization.

[0047] Embed a differentiable JPEG compression module into the adversarial sample generation process to generate compression-robust adversarial samples that remain effective even after image compression.

[0048] The generated adversarial samples are used to test the classification accuracy of each deep fake detector and evaluate its adversarial robustness.

[0049] Specifically, in order to improve the attack migration capability of different types of forgery detectors, enhance the stability of the attack process, and maintain robustness to image compression, the process of our method is as follows: Figure 1 As shown, there are four main steps:

[0050] 1. Select deep fake detection models with different structures, then select fake images from the fake image dataset to construct an evaluation sample set, and perform standard preprocessing on the images.

[0051] 2. Use the MI-CWA algorithm to integrate the deepfake detection model selected in step 1 to generate a basic adversarial sample set in pixel space (without considering compression), and use it to test the classification accuracy of each deepfake detector.

[0052] 3. Use the JPEGdiff module to embed the MI-CWA attack process to generate a set of compression robust adversarial samples for evaluation (without considering compression), and use it to test the classification accuracy of each deep fake detector.

[0053] 4. Compress the adversarial samples obtained in S2 and S3, and then use them to test the classification accuracy of each deep fake detector.

[0054] S1. Model selection and evaluation sample set construction;

[0055] The current mainstream forgery detection models have large differences in structural design, and the dimensions of forgery features that they focus on are also different, such as frequency domain features, texture features, local features, or global features. The adversarial samples generated using only a single forgery detector have poor transferability and may be overfit to a specific forgery detector. Therefore, the present invention adopts a model integration strategy to generate adversarial samples. When constructing an evaluation sample set, it is necessary to ensure that the selected forged images are representative and diverse. Therefore, the present invention selects multiple mainstream forgery data sets to select the forged images required to construct the sample set, and then performs standard preprocessing on the images. The steps are as follows:

[0056] Step 1-1: Select six models with different structures and advanced performance for model integration, including XceptionNet, FFD, Patch-forensics, CNNDetection, Gram-Net and -Net.

[0057] Step 1-2: Construct an evaluation set of forged images from the FaceForensics++, StyleGAN, and ForgeryNet datasets. Unify the image sizes in the set to ensure compatibility with all detectors. Unify the labels for all images, setting all forged images to 1 and all real images to 0. There are no real images in the evaluation set; the labels for real images are set to 0 because the label y in the loss function below requires the real image label.

[0058] As an implementation method in this embodiment, the model integration strategy adopts the logits integration method to fuse the output information of multiple deep fake detection models and calculate the integration loss.

[0059] As an implementation method in this embodiment, the gradient optimization process includes:

[0060] A momentum iteration algorithm is used to stabilize the gradient direction so that the adversarial examples are located in a flat loss landscape area.

[0061] By attacking common weaknesses, the distance between the adversarial samples and the local optimal points of each model is optimized to ensure that multiple deep fake detectors are attacked at the same time.

[0062] Specifically, S2,generates basic adversarial examples for evaluation (without considering compression);

[0063] Each forged image in the constructed sample set is fed into six forgery detection models. These models are then integrated using the existing MI-CWA algorithm, and the loss is calculated to obtain the gradient. Finally, a basic adversarial sample set is generated in pixel space. This is then used to test the classification accuracy of each deepfake detector and evaluate its robustness to adversarial samples. The steps are as follows:

[0064] Step 2-1: First, explain the MI-CWA algorithm and how it integrates multiple models to generate adversarial examples. The MI-CWA algorithm stands for Momentum Iterative - Common Weakness Attack. The purpose of momentum iteration is to introduce momentum-stabilized gradient directions. Common weaknesses are defined as points in a flat loss region that are close to the local optimal solution of each model.

[0065] This invention aims to create an adversarial example that can mislead multiple deep fake detectors , the optimization objective is as shown in formula (1), which is to minimize the expected output loss of multiple models, and the constraints are: adversarial samples and the original forged image between Norm within the allowable range Inside. is the cross entropy loss function, and y is the label of the real image. represents the set of all possible deepfake detectors, each detector Output the logits for true and false categories.

[0066]

[0067] because is a set of all potential forgery detectors, which is difficult to solve completely. In order to save computing resources, this paper uses a limited number of forgery detector sets (the six selected above) To approximate the optimization objective. Formula (1) can be used (loss integration) or (logits integration) is used to approximate. Previous studies have shown that the attack effect of logits integration in various attack methods is better than loss integration, so this invention uses logits integration.

[0068] Returning to formula (1), let To be away from the current adversarial sample Recently, the Model The input point where the loss reaches a local minimum, express exist The Hessian matrix at . Then for each model , using a second-order Taylor expansion to approximate The approximate result of formula (1) is shown in formula (2). is a local optimum, so The first derivative of is 0 and is omitted in formula (2).

[0069]

[0070] The optimization goal becomes the expectation shown in formula (2), which is divided into two items: and For the second term, its upper bound can be obtained as shown in formula (3):

[0071]

[0072] and The smaller, The smaller the upper bound of , the smaller the expectation in formula (2), so that the expectation of the output loss of multiple models can be minimized to achieve the optimization goal. The smaller it is, the flatter the corresponding loss landscape is. In other words, if the adversarial sample Falling on the flat landscape of loss, The SAM algorithm can effectively obtain a flat loss landscape. The following briefly introduces the SAM algorithm suitable for generating adversarial samples. In the tth iteration of the adversarial attack, the SAM algorithm first generates the adversarial sample. Execute a step of The gradient ascent gets , as shown in formula (4). Then Execute a step of Gradient descent yields , as shown in formula (5). This process is repeated to create adversarial samples. will fall on a flat loss landscape, allowing Become smaller.

[0073]

[0074]

[0075] For an explanation of the flatness and steepness of the loss landscape, see Figure 2 ,The different curves in the left figure represent the loss of a fake detector in the flat area, and the right figure represents the steep situation.

[0076] Represents the current adversarial sample To Model Local optimum of loss The distance of each model The loss has multiple local optimal points, among which is the distance to the current adversarial sample The closest one. , the smaller it is, the better the current adversarial sample The closer it is to the local optimum of each forgery detection model. Distance from each are close, so it has good attackability against multiple forgery detectors at the same time. Figure 3 This is more intuitive. In the left picture, you can find a Distance from each (The lowest point of each curve in the figure) is very close, which ensures that the adversarial sample has good offensiveness against all models, that is, it ensures the transferability of the adversarial sample. Larger situation.

[0077] Then the CSE optimization algorithm is used to optimize , so that it becomes smaller, the CSE algorithm is introduced below. As shown in formula (6) and formula (7), first Each model in the collection By step length Perform gradient descent continuously, then with a step size Calculate the final adversarial sample. , The representative conducted The result after subgradient descent.

[0078]

[0079]

[0080] Finally, the SAM algorithm and the CSE algorithm are combined, and the CSE algorithm is used to replace the second step of the SAM algorithm. MI is combined in both the outer loop and the inner loop to obtain the final MI-CWA algorithm. Figure 4 As shown, the forged image After the MI-CWA algorithm, we can get an adversarial sample .in is the attenuation factor, 、 and is the step length, is the number of iterations. is the number of integrated models, in this invention , in the figure represents the cross entropy loss function.

[0081] Step 2-2: Use each forged image in the original sample set to feed the MI-CWA algorithm to obtain the basic adversarial sample set, and then use it to test the classification accuracy of each deep fake detector to evaluate the robustness of each deep fake detector to adversarial samples. Figure 5 As shown, each adversarial sample obtained We attack multiple forgery detectors. White-box attacks target the six forgery detectors used in the ensemble, while black-box attacks target two callable online black-box forgery detectors, including existing forgery detection APIs. We record each model's detection results against adversarial examples and then calculate the success rate of attacks against each model using the basic adversarial example set. Based on the success rate of the adversarial example set against each model, we can derive the deception performance of the adversarial example against each model. Higher deception indicates lower adversarial robustness of the forgery detector.

[0082] As an implementation method in this embodiment, the differentiable JPEG compression module uses an approximately differentiable function to replace the rounding operation in traditional JPEG compression to ensure that the compression process is differentiable.

[0083] As an implementation method of this embodiment, the embedding method of the differentiable JPEG compression module includes outer ring embedding or simultaneous embedding of the outer ring and the inner ring.

[0084] Specifically, in S3, considering that in real-world scenarios, image compression is performed before forgery detection, to ensure the compression robustness of adversarial samples, this paper embeds the JPEGdiff module into the MI-CWA attack process to generate compression-robust adversarial samples for evaluation, and then tests their uncompressed deception performance and migration capabilities. The steps are as follows:

[0085] Step 3-1: First, briefly introduce JPEGdiff compression. JPEGdiff compression consists of six steps: ① color space conversion, ② chroma downsampling, ③ block segmentation, ④ discrete cosine transform (DCT), ⑤ quantization, and ⑥ decoding. In traditional JPEG compression, the quantization step uses a rounding function. In order to maintain the differentiability of the entire JPEG process, JPEGdiff compression uses an approximate function: . There are non-zero derivatives almost everywhere, and they are close to .use Represents the JPEGdiff compression process, where is the quality level, The smaller the value, the greater the compression degree and the worse the image quality. JPEGdiff is embedded in the MI-CWA attack process to generate compression robust adversarial samples for evaluation. The present invention considers two embedding methods, outer loop embedding and outer loop and inner loop embedding simultaneously, to find the optimal solution. Each embedding method considers three quality levels to compress the image, namely 75, 50 and 25. The compression robust adversarial sample generation process of outer loop embedding JPEGdiff is as follows: Figure 6 , fake images After the entire process, we get a compressed robust adversarial sample. The outer and inner rings are embedded in the JPEGdiff compression robust adversarial sample generation process as follows Figure 7 , fake images After the entire process, we get a compressed robust adversarial sample. .

[0086] Step 3-2: Similar to generating a basic adversarial sample set, each forged image in the original sample set is fed into Figure 6 、 Figure 7 The compressed robust adversarial sample set is obtained by the following process. Considering different embedding methods and different quality levels, a total of six compressed robust adversarial sample sets are obtained. Then the deception performance and transfer ability of the compressed robust adversarial samples are tested. The process of evaluating the adversarial robustness of the forgery detector using compressed robust adversarial samples is as follows: Figure 8 As shown, with each compression robust adversarial sample and To attack multiple counterfeit detectors. The subsequent process is the same as step 2-2 and will not be repeated here.

[0087] Step 3-3: Compare the attack success rates of the uncompressed basic adversarial example set and the compression-robust adversarial example set to analyze the impact of embedding in JPEGdiff. Finally, compare the attack success rates of different embedding methods and quality levels to analyze the attack effectiveness of different embedding methods and quality levels. Adversarial example sets with higher attack success rates are more effective in evaluating the adversarial robustness of forgery detectors.

[0088] As an implementation method of this embodiment, the process of evaluating the adversarial robustness includes:

[0089] Test the attack success rate of adversarial samples under uncompressed and different JPEG compression strengths;

[0090] Compare the attack performance differences between basic adversarial samples and compressed robust adversarial samples.

[0091] Specifically, S4, finally, in order to determine whether the compression robust adversarial samples are compression robust, and whether the attack of the basic adversarial samples will fail after image compression. The present invention compresses them and then tests their attack success rate, that is, tests their compression robustness. By analyzing the attack success rate of the compression robust adversarial samples under image compression, it can be verified whether the evaluation method of the present invention can effectively evaluate the adversarial robustness of the deep fake detector in real scenarios. The steps are as follows:

[0092] Step 4-1: Each adversarial example in the basic adversarial example set After the image is compressed, it is used to attack multiple forgery detectors. The compression used is traditional JPEG compression, with three quality levels of high, medium and low quality. Three quality levels of 75, 50 and 25 are also considered. The attack success rate in each case is calculated. The process is as follows: Figure 9 shown.

[0093] Step 4-2: Compress each adversarial example in the six robust adversarial example sets and After the image is compressed, it is used to attack multiple forgery detectors. The compression used is traditional JPEG compression, where the quality level corresponds to the quality level used when generating compression robust adversarial samples. The attack success rate in each case is calculated. The process is as follows Figure 10 shown.

[0094] Step 4-3: Compare the attack success rates of the basic adversarial example and the compression-robust adversarial example in the presence of image compression, analyzing the impact of embedding JPEGdiff. Finally, compare the attack success rates of different embedding methods and at different quality levels in the presence of image compression, analyzing the attack effectiveness of different embedding methods and quality levels.

[0095] Based on this, an embodiment of the present invention provides a method for evaluating the robustness of deep fake detectors based on model integration.

[0096] 1. By fusing multiple deep fake detection models with different structures, the adversarial samples generated by this invention are more versatile and can mislead multiple detectors at the same time, thereby significantly improving the migration capability of adversarial attacks.

[0097] 2. This paper introduces a differentiable JPEGdiff module and embeds image compression simulation in the adversarial sample generation process, so that the generated samples can still maintain attack effectiveness after image compression, thereby improving the stability in practical applications.

[0098] 3. This solution not only tests the attack performance on uncompressed images, but also systematically evaluates the attack performance under image compression, comprehensively revealing the potential vulnerabilities of the deep fake detection system.

[0099] This paper utilizes multiple forgery detectors for model integration. The adversarial examples generated by the MI-CWA algorithm can simultaneously exploit the common weaknesses of multiple models, enabling adversarial examples to produce misleading effects on multiple models simultaneously, improving attack portability.

[0100] The present invention simulates the image compression process during the attack process, ensuring that the generated adversarial samples still retain the attack effect after JPEG encoding compression, thereby enhancing the reliability in actual application scenarios.

[0101] In addition to standard uncompressed images, this paper also evaluates the attack success rate under different JPEG compression strengths (q=25, 50, 75), revealing the vulnerability of the deep fake detection system under real-world deployment scenarios.

[0102] Example 2

[0103] In this embodiment, a computer terminal device is provided, including:

[0104] one or more processors;

[0105] a memory, coupled to the processor, for storing one or more programs;

[0106] When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the above-mentioned method for evaluating the adversarial robustness of deep fake detectors based on model integration.

[0107] In this embodiment, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for evaluating the adversarial robustness of deep fake detectors based on model integration are implemented.

[0108] In this embodiment, an electronic device is also provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps of the above-mentioned model integration-based deep fake detector adversarial robustness evaluation method.

[0109] In this embodiment, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for evaluating the adversarial robustness of deep fake detectors based on model integration.

[0110] The above program can be executed in a processor or stored in a memory (or computer-readable medium). Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and can be implemented using any method or technology to store information. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0111] These computer programs can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a block or multiple blocks can be implemented by different modules corresponding to different steps.

[0112] This embodiment provides such a device or system. The system is called a deep fake detector adversarial robustness assessment system based on model integration, and includes:

[0113] A model integration module, which selects multiple deepfake detection models with different structures and calculates the integration loss based on their output information;

[0114] Adversarial sample generation module, which is used to generate adversarial samples in pixel space through gradient optimization and embed differentiable JPEG compression processing;

[0115] The robustness evaluation module is used to use the generated adversarial samples to test the classification accuracy of each deep fake detector and evaluate its adversarial robustness.

[0116] As an implementation method in this embodiment, the model integration module includes:

[0117] A model selection unit, used to select deep fake detection models with various structures;

[0118] The loss calculation unit is used to fuse the output information of each model using the logits integration method to generate the integrated loss.

[0119] As an implementation method of this embodiment, the adversarial sample generation module includes:

[0120] Gradient optimization unit, which uses momentum iteration algorithm to stabilize the gradient direction so that the adversarial example is located in the flat loss landscape area;

[0121] The weakness attack unit is used to optimize the distance between the adversarial sample and the local optimal point of each model to ensure that multiple detectors can be attacked simultaneously.

[0122] As an implementation method of this embodiment, the adversarial sample generation module further includes:

[0123] The differentiable compression unit is used to replace the rounding operation in traditional JPEG compression with an approximately differentiable function to achieve differentiable compression processing.

[0124] As an implementation method of this embodiment, the embedding method of the differentiable compression unit includes embedding the outer ring alone or embedding the outer ring and the inner ring at the same time.

[0125] As an implementation in this embodiment, the robustness evaluation module includes:

[0126] Compression test unit, used to test the attack success rate of adversarial samples under uncompressed and different JPEG compression strengths;

[0127] Performance analysis unit, used to compare the attack performance differences between basic adversarial samples and compressed robust adversarial samples.

[0128] The system or device is used to implement the functions of the method in the above-mentioned embodiment. Each module in the system or device corresponds to each step in the method, which has been explained in the method and will not be repeated here.

[0129] Through the above implementation, the problem of robustness evaluation of deep fake detectors based on model integration in the related art is solved, thereby ensuring that the problems existing in the existing technology are solved.

[0130] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for evaluating the robustness of deepfake detectors based on model ensemble, characterized in that: The following steps are involved: Select multiple deepfake detection models with different structures and construct a sample set of fake images; A model ensemble strategy is used to calculate the ensemble loss based on the output information of multiple deepfake detection models, and adversarial examples are generated in pixel space through gradient optimization. Embed a differentiable JPEG compression module into the adversarial sample generation process to generate compression-robust adversarial samples that remain effective even after image compression. The generated adversarial samples are used to test the classification accuracy of each deep fake detector and evaluate its adversarial robustness.

2. The method according to claim 1, characterized in that The model integration strategy adopts the logits integration method to fuse the output information of multiple deep fake detection models and calculate the integration loss.

3. The method according to claim 1, characterized in that The gradient optimization process includes: A momentum iteration algorithm is used to stabilize the gradient direction so that the adversarial examples are located in a flat loss landscape area. By attacking common weaknesses, the distance between the adversarial samples and the local optimal points of each model is optimized to ensure that multiple deep fake detectors are attacked at the same time.

4. The method according to claim 1, wherein The differentiable JPEG compression module adopts an approximately differentiable function to replace the rounding operation in traditional JPEG compression, thereby ensuring that the compression process is differentiable.

5. The method according to claim 1, wherein The embedding method of the differentiable JPEG compression module includes outer ring embedding or outer ring and inner ring embedding simultaneously.

6. The method according to claim 1, characterized in that The process of evaluating the adversarial robustness includes: Test the attack success rate of adversarial samples under uncompressed and different JPEG compression strengths; Compare the attack performance differences between basic adversarial samples and compressed robust adversarial samples.

7. A deep fake detector adversarial robustness evaluation system based on model integration, characterized by: The system comprises: A model integration module, which selects multiple deepfake detection models with different structures and calculates the integration loss based on their output information; Adversarial sample generation module, which is used to generate adversarial samples in pixel space through gradient optimization and embed differentiable JPEG compression processing; The robustness evaluation module is used to use the generated adversarial samples to test the classification accuracy of each deep fake detector and evaluate its adversarial robustness.

8. A computer terminal device, characterized in that: include: one or more processors; a memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images