A model ensemble based deep fake detector adversarial robustness evaluation method

Abstract

The application discloses a kind of based on model integration's deep counterfeit detector confrontation robustness evaluation method, belong to computer vision and information security technical field.For the problem that existing deep counterfeit detector confrontation sample migration is poor, compression robustness is insufficient, the application generates confrontation sample by integrating multiple deep counterfeit detection models of different structures using momentum iteration-common weak point attack algorithm, while embedding differentiable JPEG compression module to simulate real compression process.The technical scheme includes: selecting multiple counterfeit detection models to construct evaluation sample set;generate basic confrontation sample using model integration strategy;generate compression robust confrontation sample in combination with differentiable compression;system evaluates the attack effect of confrontation sample under different compression intensities.The application improves the migration and compression robustness of confrontation sample, and can comprehensively evaluate the security vulnerabilities of deep counterfeit detection system.

Description

Technical Field

[0001] This invention belongs to the fields of computer vision and information security technology, and in particular relates to a method for evaluating the adversarial robustness of a deepfake detector based on model ensemble. Background Technology

[0002] Deepfake detection technology can determine the authenticity of images, aiming to address privacy threats and authenticity crises caused by the misuse of deepfake technology. Existing adversarial robustness assessment methods mainly fall into two categories: one is pixel-level perturbation-based methods, such as the Fast Gradient Sign Method (FGRM) which adds perturbations to the pixel space. While effective against specific detectors, the generated adversarial examples have poor transferability to other detector structures. The other is latent space optimization-based methods, such as adding perturbations to the StyleGAN latent space. Although maintaining high visual quality, the high-dimensional complexity of the latent space can easily lead to uncontrollable changes in identity features, affecting the stability of the attack. In practical applications, deepfake content often requires network transmission and storage compression. Traditional adversarial examples show a significant decrease in attack effectiveness after lossy compression such as JPEG. Existing techniques, such as those using Gaussian blur and noise addition to simulate image compression, differ from real compression algorithms and cannot accurately assess the robustness of detectors in real-world scenarios. Furthermore, current evaluation methods often target single detection models, making it difficult to comprehensively reflect the overall security of different types of detection systems. These issues make it difficult for existing evaluation methods to provide reliable adversarial robustness references for the actual deployment of deepfake detection systems. There is an urgent need for an evaluation method that can generate highly mobile and highly compressed robust adversarial samples to fully reveal the potential vulnerabilities of the detection system in real-world application environments. Summary of the Invention

[0003] To address the aforementioned technical problems, this invention proposes a model ensemble-based method for evaluating the adversarial robustness of deepfake detectors, thereby resolving the issues present in the prior art.

[0004] Firstly, to achieve the above objectives, this invention provides a method for evaluating the adversarial robustness of a deepfake detector based on model ensemble, comprising the following steps:

[0005] Multiple deepfake detection models with different structures were selected, and a sample set of fake images was constructed.

[0006] A model ensemble strategy is adopted, which calculates the ensemble loss based on the output information of multiple deepfake detection models, and generates adversarial examples in the pixel space through gradient optimization.

[0007] By embedding a differentiable JPEG compression module into the adversarial example generation process, compressed robust adversarial examples that can still maintain the effectiveness of the attack after image compression are generated.

[0008] The classification accuracy of each deepfake detector is tested using generated adversarial examples to evaluate its adversarial robustness.

[0009] Optionally, the model ensemble strategy adopts the logits ensemble method, which integrates the output information of multiple deepfake detection models and calculates the ensemble loss.

[0010] Optionally, the gradient optimization process includes:

[0011] The momentum iteration algorithm is used to stabilize the gradient direction so that the adversarial examples are located in the flat loss landscape region;

[0012] By exploiting common weaknesses, the distance between adversarial examples and the local optima of each model is optimized, ensuring simultaneous attacks on multiple deepfake detectors.

[0013] Optionally, the differentiable JPEG compression module uses an approximately differentiable function to replace the rounding operation in traditional JPEG compression, ensuring that the compression process is differentiable.

[0014] Optionally, the embedding method of the differentiable JPEG compression module includes outer ring embedding or simultaneous embedding of the outer ring and inner ring.

[0015] Optionally, the process of evaluating the adversarial robustness includes:

[0016] Test the attack success rate of adversarial samples under uncompressed and different JPEG compression strengths;

[0017] Compare the attack performance differences between basic adversarial examples and compressed robust adversarial examples.

[0018] Secondly, the present invention also provides a model ensemble-based deepfake detector adversarial robustness evaluation system, for implementing a model ensemble-based deepfake detector adversarial robustness evaluation method, the system comprising:

[0019] The model ensemble module is used to select multiple deepfake detection models with different structures and calculate the ensemble loss based on their output information;

[0020] An adversarial example generation module is used to generate adversarial examples in pixel space through gradient optimization and embed differentiable JPEG compression processing.

[0021] The robustness evaluation module is used to test the classification accuracy of each deepfake detector using generated adversarial examples, and to evaluate its adversarial robustness.

[0022] Thirdly, the present invention also provides a computer terminal device, comprising:

[0023] One or more processors;

[0024] A memory, coupled to the processor, for storing one or more programs;

[0025] When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the model ensemble-based deepfake detector adversarial robustness evaluation method in the first aspect above.

[0026] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the model ensemble-based deepfake detector adversarial robustness evaluation method in the first aspect described above.

[0027] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the model ensemble-based deepfake detector adversarial robustness assessment method described in the first aspect.

[0028] Compared with the prior art, the present invention has the following advantages and technical effects:

[0029] This invention provides a model ensemble-based method for evaluating the adversarial robustness of deepfake detectors. By integrating multiple deepfake detection models with different structures, this invention significantly improves the transferability of adversarial examples, enabling them to simultaneously mislead multiple detectors. The introduction of a differentiable JPEG compression module ensures that the generated adversarial examples retain their attack effectiveness even after image compression, enhancing robustness in practical applications. The system evaluation process covers both uncompressed and compressed scenarios, comprehensively revealing potential vulnerabilities in deepfake detectors. The combination of flat loss landscape optimization and common weakness attack strategies makes the attack process more stable and controllable while maintaining the visual quality of the adversarial examples. This method provides a more reliable solution for the security evaluation of deepfake detection systems. Attached Figure Description

[0030] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0031] Figure 1 This is a flowchart of the adversarial robustness evaluation method for a deepfake detector based on model ensemble, according to an embodiment of the present invention.

[0032] Figure 2 These are landscape images showing flat and steep loss patterns according to an embodiment of the present invention, wherein the left image is a landscape image showing flat loss patterns and the right image is a landscape image showing steep loss patterns.

[0033] Figure 3 Embodiments of the present invention To each Distance visualization;

[0034] Figure 4 This is a flowchart illustrating the basic adversarial sample generation process in an embodiment of the present invention.

[0035] Figure 5 This is a flowchart illustrating the adversarial robustness of a forgery detector in the basic adversarial example evaluation of an embodiment of the present invention.

[0036] Figure 6 This is a flowchart of the compression robust adversarial sample generation process using outer ring embedding of JPEGdiff according to an embodiment of the present invention;

[0037] Figure 7 This is a flowchart of the compression robust adversarial sample generation process in an embodiment of the present invention, in which both the outer and inner rings are embedded with JPEGdiff.

[0038] Figure 8 This is a flowchart illustrating the compression robustness of the forgery detector in an embodiment of the present invention.

[0039] Figure 9 A flowchart for evaluating the adversarial robustness of a forgery detector based on basic adversarial examples in this invention (considering image compression);

[0040] Figure 10 This is a flowchart illustrating the compression robustness of an adversarial sample evaluation for a forgery detector (considering image compression) according to an embodiment of the present invention. Detailed Implementation

[0041] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0042] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0043] Example 1

[0044] like Figure 1 As shown, this embodiment provides a method for evaluating the adversarial robustness of a deepfake detector based on model ensemble, including:

[0045] Multiple deepfake detection models with different structures were selected, and a sample set of fake images was constructed.

[0046] A model ensemble strategy is adopted, which calculates the ensemble loss based on the output information of multiple deepfake detection models, and generates adversarial examples in the pixel space through gradient optimization.

[0047] By embedding a differentiable JPEG compression module into the adversarial example generation process, compressed robust adversarial examples that can still maintain the effectiveness of the attack after image compression are generated.

[0048] The classification accuracy of each deepfake detector is tested using generated adversarial examples to evaluate its adversarial robustness.

[0049] Specifically, to improve the attack transfer capability against different types of forgery detectors, enhance the stability of the attack process, and maintain robustness to image compression, our method's flow is as follows: Figure 1 As shown, there are four main steps:

[0050] 1. Select deep forgery detection models with different structures, then select forged images from the forged image dataset to construct an evaluation sample set, and perform standard preprocessing on the images.

[0051] 2. Integrate the deepfake detection models selected in step 1 using the MI-CWA algorithm to generate a basic adversarial sample set (without considering compression) in the pixel space, and use it to test the classification accuracy of each deepfake detector.

[0052] 3. The JPEGdiff module is used to embed the MI-CWA attack process to generate a compressed robust adversarial sample set for evaluation (compression not considered), which is then used to test the classification accuracy of each depth forgery detector.

[0053] 4. Compress the adversarial examples obtained in S2 and S3, and then use them to test the classification accuracy of each deep faker detector.

[0054] S1. Model selection and construction of the evaluation sample set;

[0055] Current mainstream forgery detection models differ significantly in their structural design and focus on different dimensions of forgery features, such as frequency domain features, texture features, local features, or global features. Adversarial examples generated using only a single forgery detector exhibit poor transferability and may overfit to a specific detector. Therefore, this invention employs a model ensemble strategy to generate adversarial examples. When constructing the evaluation sample set, it is necessary to ensure that the selected forgery images are representative and diverse. Therefore, this invention selects multiple mainstream forgery datasets to choose the forgery images needed to construct the sample set, and then performs standard preprocessing on the images. The steps are as follows:

[0056] Step 1-1: Select six different state-of-the-art models with varying architectures for model ensemble, including XceptionNet, FFD, Patch-forensics, CNNDetection, Gram-Net, and... -Net.

[0057] Steps 1-2: Construct an evaluation sample set by selecting the same number of fake images from the FaceForensics++, StyleGAN, and ForgeryNet datasets. Standardize the image size in the sample set to ensure applicability to all detectors. Standardize the labels for all images, setting all fake images to 1 and real images to 0. Since there are no real images in the evaluation sample set, the real image labels are set to 0 because the label y in the loss function below needs to be set to the real image labels.

[0058] As one implementation method in this embodiment, the model ensemble strategy adopts the logits ensemble method, which integrates the output information of multiple deepfake detection models and calculates the ensemble loss.

[0059] As one implementation method in this embodiment, the gradient optimization process includes:

[0060] The momentum iteration algorithm is used to stabilize the gradient direction so that the adversarial examples are located in the flat loss landscape region;

[0061] By exploiting common weaknesses, the distance between adversarial examples and the local optima of each model is optimized, ensuring simultaneous attacks on multiple deepfake detectors.

[0062] Specifically, S2 generates basic adversarial examples for evaluation (compression not considered).

[0063] Each forged image in the constructed sample set is fed into six forgery detection models. Then, the six forgery detection models are integrated using the existing MI-CWA algorithm, and the loss is calculated to obtain the gradient. Finally, a basic adversarial example set is generated in pixel space, and then used to test the classification accuracy of each deep forgery detector, evaluating the robustness of each deep forgery detector to adversarial examples. The steps are as follows:

[0064] Step 2-1: First, explain the MI-CWA algorithm, illustrating how it integrates multiple models to generate adversarial examples. The MI-CWA algorithm stands for Momentum Iterative - Common Weakness Attack. The purpose of momentum iteration is to introduce momentum-stabilized gradient directions, and the common weakness is defined as a point located in a flat loss region that is close to the local optimum of each model.

[0065] This invention aims to create an adversarial example that can mislead multiple deepfake detectors. The optimization objective is shown in Equation (1), which is to minimize the expected value of the output loss of multiple models. The constraint is: adversarial examples and the original forged image Between norm within the allowable range Inside. Among them Let y be the cross-entropy loss function, and y be the label of the real image. Represents the set of all possible deepfake detectors, each detector Output the logits for true and false categories.

[0066]

[0067] because It is a set containing all potential spoofing detectors, which is difficult to solve completely. In order to save computational resources, this invention uses a finite number of spoofing detector sets (the six selected above). To approximate the optimization objective. Formula (1) can be used... (loss integration) or (logits ensemble) is used as an approximation. Previous studies have shown that the logits ensemble produces better attack effects than loss ensemble in various attack methods, so the present invention uses the logits ensemble.

[0068] Returning to formula (1), let For the current adversarial sample Recently, it can make the first A model The input point where the loss reaches a local minimum. express exist The Hessian matrix at that location. Then for each model... A second-order Taylor expansion is used to approximate... Formula (1) at the given location yields an approximate result as shown in Formula (2). Since... It is a local optimum, so The first derivative is 0, and is omitted in formula (2).

[0069]

[0070] The optimization objective becomes the expectation shown in formula (2), which consists of two terms. and For the second term, its upper bound can be obtained, as shown in formula (3):

[0071]

[0072] and The smaller, The smaller the upper bound, the smaller the expectation in formula (2), thus minimizing the expectation of the output loss of multiple models and achieving the optimization goal. The smaller the value, the flatter the corresponding loss landscape. In other words, if adversarial examples can be made... It landed on a flat, damaged landscape. It will become smaller. The SAM algorithm can effectively obtain a flat loss landscape. Below is a brief introduction to the SAM algorithm suitable for adversarial example generation. In the t-th iteration of the adversarial attack, the SAM algorithm first... Execute a step size of The gradient ascent is obtained As shown in formula (4). Then... Execute a step size of Gradient descent yields As shown in formula (5). This process is repeated to create adversarial samples. It will fall on a flat, damaged landscape, thus allowing It gets smaller.

[0073]

[0074]

[0075] For an explanation of the flatness and steepness of the lost landscape, see [link to relevant documentation]. Figure 2 In the left figure, the different curves represent the loss of a fake detector on a flat surface, while the right figure represents the steep surface.

[0076] Indicates the current adversarial example To the A model Local optima of loss The distance for each model The losses all have multiple local optima, among which It is the distance from the current adversarial sample The most recent one. For The smaller it is, the stronger the current adversarial example. The closer it is to the local optimum of each forgery detection model, the better. Precisely because... Distance from each Because they are all close together, it has good attack capability against multiple spoofing detectors at the same time. Figure 3 This illustrates the point more intuitively. You can find one in the left image. Distance from each (The lowest points of each curve in the figure) are very close together, which ensures that adversarial examples have good attack power on all models, thus guaranteeing the transferability of adversarial examples. The right figure is... In a larger case.

[0077] Then, the CSE optimization algorithm is used for optimization. To reduce its size, the CSE algorithm is introduced below. As shown in formulas (6) and (7), firstly... Each model in the collection With step size Perform gradient descent continuously, then with a step size of [missing value]. Calculate the final adversarial example. Wherein... , The representatives conducted The result after gradient descent.

[0078]

[0079]

[0080] Finally, the SAM and CSE algorithms are combined, with the CSE algorithm replacing the second step of the SAM algorithm. MI is incorporated into both the outer and inner loops to obtain the final MI-CWA algorithm. The MI-CWA algorithm is as follows: Figure 4 As shown, forged image After applying the MI-CWA algorithm, an adversarial example can be obtained. .in It is the attenuation factor. , and It's the step length. It represents the number of iterations. It refers to the number of ensemble models in this invention. In the picture This represents the cross-entropy loss function.

[0081] Step 2-2: Feed each forged image from the original sample set into the MI-CWA algorithm to obtain a basic adversarial sample set, and then use it to test the classification accuracy of each deep forgery detector, evaluating the robustness of each deep forgery detector to adversarial samples. For example... Figure 5 As shown, each adversarial sample obtained The attack targets multiple spoofing detectors. The white-box attack targets the six spoofing detectors used in the ensemble, while the black-box attack targets two callable online black-box spoofing detectors, including existing spoofing detection APIs. The detection results of each model against the adversarial examples are recorded, and then the attack success rate of the base adversarial example set against each model is calculated. Based on the attack success rate of the adversarial example set against each model, the deception performance of the adversarial examples against each model can be obtained; the higher the deception performance, the worse the adversarial robustness of the spoofing detector.

[0082] As one implementation method in this embodiment, the differentiable JPEG compression module uses an approximately differentiable function to replace the rounding operation in traditional JPEG compression, ensuring that the compression process is differentiable.

[0083] As one implementation method in this embodiment, the embedding method of the differentiable JPEG compression module includes outer ring embedding or simultaneous embedding of outer ring and inner ring.

[0084] Specifically, S3, considering that image compression is performed before forgery detection in real-world scenarios, this invention embeds the JPEGdiff module into the MIS-CWA attack process to generate compressed robust adversarial examples for evaluation, and then tests their uncompressed spoofing performance and transferability. The steps are as follows:

[0085] Step 3-1: First, a brief introduction to JPEGdiff compression. JPEGdiff compression consists of six steps: ① color space conversion, ② chroma downsampling, ③ block partitioning, ④ discrete cosine transform (DCT), ⑤ quantization, and ⑥ decoding. In traditional JPEG compression, the quantization step uses a rounding function. To maintain the differentiability of the entire JPEG process, JPEGdiff compression uses an approximate function: . There is a non-zero derivative almost everywhere, and it is very close to zero. .use This represents the JPEGdiff compression process, where It's about the quality level. A smaller value indicates a higher degree of compression and lower image quality. JPEGdiff is embedded into the MIS-CWA attack process to generate robust adversarial examples for evaluation. This invention considers two embedding methods: outer-loop embedding and simultaneous outer-loop and inner-loop embedding, to find the optimal solution. Each embedding method considers three quality levels for image compression: 75, 50, and 25. The robust adversarial example generation process for outer-loop JPEGdiff embedding is as follows: Figure 6 Forged images After the entire process, compressed robust adversarial samples are obtained. The robust adversarial example generation process, in which both the outer and inner rings embed JPEGdiff, is as follows: Figure 7 Forged images After the entire process, compressed robust adversarial samples are obtained. .

[0086] Step 3-2: Similar to generating the basic adversarial example set, each forged image in the original sample set is fed into... Figure 6 , Figure 7 The process yields a compressed robust adversarial sample set. Considering different embedding methods and quality levels, a total of six compressed robust adversarial sample sets were obtained. Then, the deception performance and transferability of the uncompressed compressed robust adversarial samples were tested. The process for evaluating the adversarial robustness of the forgery detector using compressed robust adversarial samples is as follows: Figure 8 As shown, each compressed robust adversarial sample and Attack multiple fake detectors. The subsequent process is the same as step 2-2, and will not be repeated here.

[0087] Step 3-3: Compare the attack success rates of the basic adversarial sample set and the compressed robust adversarial sample set in the uncompressed state, and analyze the impact of embedding JPEGdiff. Finally, compare the attack success rates of different embedding methods and different quality levels, and analyze the attack effects of different embedding methods and different quality levels. The adversarial sample set with a higher attack success rate can more effectively evaluate the adversarial robustness of the forgery detector.

[0088] As one implementation method in this embodiment, the process of evaluating the anti-robustness includes:

[0089] Test the attack success rate of adversarial samples under uncompressed and different JPEG compression strengths;

[0090] Compare the attack performance differences between basic adversarial examples and compressed robust adversarial examples.

[0091] Specifically, S4, finally, to determine whether the compressed robust adversarial examples possess compression robustness, and whether the attack on the base adversarial examples becomes ineffective after image compression, this invention compresses their images and then tests their attack success rate, i.e., tests their compression robustness. Analyzing the attack success rate of the compressed robust adversarial examples under image compression conditions can verify whether the evaluation method of this invention can effectively evaluate the adversarial robustness of deepfake detectors in real-world scenarios. The steps are as follows:

[0092] Step 4-1: Extract each adversarial sample from the basic adversarial sample set. After image compression, the attacks target multiple forgery detectors. Traditional JPEG compression is used, with three quality levels: high, medium, and low. Three quality levels (75, 50, and 25) are also considered. The attack success rate is calculated for each condition. The process is as follows: Figure 9 As shown.

[0093] Step 4-2: Extract each adversarial sample from the six compressed robust adversarial sample sets. and After image compression, the attacks target multiple fake detectors. Traditional JPEG compression is used, with the quality level corresponding to that used when generating robust adversarial examples. The attack success rate is calculated for each case, as follows: Figure 10 As shown.

[0094] Step 4-3: Compare the attack success rates of the basic adversarial example and the compressed robust adversarial example under image compression conditions, and analyze the impact of embedding JPEGdiff. Finally, under image compression conditions, compare the attack success rates of different embedding methods and different quality levels, and analyze the attack effects of different embedding methods and different quality levels.

[0095] Based on this, embodiments of the present invention provide a method for evaluating the adversarial robustness of a deepfake detector based on model ensemble.

[0096] 1. This invention generates adversarial samples that are more versatile by fusing multiple deepfake detection models with different structures. These samples can mislead multiple detectors simultaneously, thereby significantly improving the transferability of adversarial attacks.

[0097] 2. This invention introduces a differentiable JPEGdiff module, which embeds image compression simulation during the adversarial sample generation process, so that the generated samples can still maintain attack effectiveness after image compression, thus improving stability in practical applications.

[0098] 3. The present invention not only tests the attack performance on uncompressed images, but also systematically evaluates the attack performance under image compression, and comprehensively reveals the potential vulnerabilities of deepfake detection systems.

[0099] This invention utilizes multiple forgery detectors for model integration. The adversarial examples generated by the MI-CWA algorithm can simultaneously target common weaknesses in multiple models, enabling the adversarial examples to mislead multiple models at the same time and improving attack transferability.

[0100] This invention simulates the image compression process during the attack, ensuring that the generated adversarial sample retains its attack effect after JPEG encoding compression, thus enhancing its reliability in practical application scenarios.

[0101] In addition to standard uncompressed images, this invention also evaluates the attack success rate under different JPEG compression intensities (q=25, 50, 75), revealing the vulnerability of deepfake detection systems in real-world deployment scenarios.

[0102] Example 2

[0103] In this embodiment, a computer terminal device is provided, including:

[0104] One or more processors;

[0105] A memory, coupled to the processor, for storing one or more programs;

[0106] When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the above-described model ensemble-based deepfake detector robustness evaluation method.

[0107] In this embodiment, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the above-described method for evaluating the robustness of a deepfake detector based on model ensemble.

[0108] In this embodiment, an electronic device is also provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to perform the steps of the above-described model ensemble-based deepfake detector robustness assessment method.

[0109] In this embodiment, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the above-described model ensemble-based deepfake detector robustness assessment method.

[0110] The aforementioned program can run on a processor or be stored in memory (or a computer-readable medium). Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0111] These computer programs may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes can be implemented by different modules for different steps.

[0112] This embodiment provides such an apparatus or system. The system, referred to as a model ensemble-based deepfake detector adversarial robustness evaluation system, includes:

[0113] The model ensemble module is used to select multiple deepfake detection models with different structures and calculate the ensemble loss based on their output information;

[0114] An adversarial example generation module is used to generate adversarial examples in pixel space through gradient optimization and embed differentiable JPEG compression processing.

[0115] The robustness evaluation module is used to test the classification accuracy of each deepfake detector using generated adversarial examples, and to evaluate its adversarial robustness.

[0116] As one implementation method in this embodiment, the model integration module includes:

[0117] The model selection unit is used to select deepfake detection models with various structures.

[0118] The loss calculation unit is used to fuse the output information of each model using the logits ensemble method to generate the ensemble loss.

[0119] As one implementation method in this embodiment, the adversarial sample generation module includes:

[0120] The gradient optimization unit is used to stabilize the gradient direction using a momentum iteration algorithm, so that the adversarial example is located in a flat loss landscape region.

[0121] The vulnerability attack unit is used to optimize the distance between adversarial examples and the local optima of each model, ensuring that multiple detectors are attacked simultaneously.

[0122] As one implementation method in this embodiment, the adversarial sample generation module further includes:

[0123] Differentiable compression unit is used to replace the rounding operation in traditional JPEG compression with an approximately differentiable function to achieve differentiable compression processing.

[0124] As one implementation method in this embodiment, the embedding method of the differentiable compression unit includes embedding the outer ring alone or embedding the outer ring and the inner ring simultaneously.

[0125] As one implementation method in this embodiment, the robustness evaluation module includes:

[0126] The compression test unit is used to test the attack success rate of adversarial samples under uncompressed and different JPEG compression strengths;

[0127] The performance analysis unit is used to compare the attack performance differences between the basic adversarial sample and the compressed robust adversarial sample.

[0128] The system or apparatus is used to implement the functions of the methods in the above embodiments. Each module in the system or apparatus corresponds to each step in the method, as has been described in the method and will not be repeated here.

[0129] The above implementation method solves the problem of robustness assessment of deepfake detectors based on model ensemble in related technologies, thereby ensuring that the problems existing in the prior art are resolved.

[0130] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for evaluating the adversarial robustness of a deepfake detector based on model ensemble, characterized in that, The method comprises the following steps: selecting multiple deepfake detection models with different structures, and constructing a deepfake image sample set; adopting a model integration strategy to calculate an integrated loss based on the output information of the multiple deepfake detection models, and generating an adversarial sample in a pixel space through gradient optimization; embedding a differentiable JPEG compression module into the adversarial sample generation process to generate a compression-robust adversarial sample that remains effective after image compression; testing the classification accuracy of each deepfake detector using the generated adversarial sample to evaluate its adversarial robustness; the process of gradient optimization comprises: adopting a momentum iterative algorithm to stabilize the gradient direction, so that the adversarial sample is located in a flat loss landscape region; optimizing the distance between the adversarial sample and the local optimum of each model through common weak point attacks to ensure that multiple deepfake detectors are attacked at the same time; the embedding method of the differentiable JPEG compression module comprises outer ring embedding or simultaneous outer ring and inner ring embedding.

2. The method of claim 1, wherein, The model integration strategy adopts a logits integration method to fuse the output information of multiple deepfake detection models and calculate an integrated loss.

3. The method of claim 1, wherein, The differentiable JPEG compression module replaces the rounding operation in traditional JPEG compression with an approximately differentiable function to ensure that the compression process is differentiable.

4. The method of claim 1, wherein, The process of evaluating the adversarial robustness comprises: testing the attack success rate of the adversarial sample under different JPEG compression intensities; comparing the attack performance difference between the basic adversarial sample and the compression-robust adversarial sample.

5. A model ensemble based deepfake detector adversarial robustness evaluation system, characterized in that, The system for implementing the method of any one of claims 1-4 comprises: a model integration module for selecting multiple deepfake detection models with different structures and calculating an integrated loss based on the output information thereof; an adversarial sample generation module for generating an adversarial sample in a pixel space through gradient optimization and embedding a differentiable JPEG compression process; a robustness evaluation module for testing the classification accuracy of each deepfake detector using the generated adversarial sample to evaluate its adversarial robustness.

6. A computer terminal device, characterized by comprise: one or more processors; a memory coupled to the processors therefor storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method of any one of claims 1-4.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-4.

8. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-4.

Images