# The Framework of Cross-Domain and Model Adversarial Attack against Deepfake
## 4 Experiment and Analysis
### Ablation/Contrast Experiments  
#### 4.3.1 Cross-Domain Gradient Ablation/Contrast Experiment  
To verify that the method of uniformly weighted cross-domain gradients used by CDMAA can effectively expand the generalization of adversarial examples between various domains, we carry out the contrast attack experiment, where we keep other components of CDMAA unchanged and only change the way to handle different gradients in domains:  
Figure 4: Illustrations of adversarial attack. The first column shows the original images and its adversarial examples, and the next eight columns illustrate the output images of models in corresponding domains with the first column as the input.  
(1) Single gradient: \(\textbf{grad}^{(j)}=\textbf{grad}_{1}^{(j)}\), i.e., use the gradient of only one domain as the cross-domain gradients, without considering the generalization of the generated adversarial examples in other domains. This problem exists in most current studies [30; 32; 33].  
(2) **Iterative gradient: \(\textbf{grad}^{(j)}=\textbf{grad}_{\text{$t$ mod $K_{j}$}}^{(j)}\)**, i.e., iteratively use the gradient of each domain loss function as the cross-domain gradients [13]. (3) The **MGDA: \(\textbf{grad}^{(j)}=\underset{i=1,\dots,K_{j}}{\text{MGDA}}(\textbf{grad}_{i}^ {(j)})\)**, i.e., use the MGDA to generate cross-domain gradients. The results are shown in Table 2:  
Figure 5 shows the visual comparison of the result. Compared with existing research on adversarial attacks against deepfake, which only use single domain gradients or iterative gradients in each domain, the CDMAA framework, using the method of uniform weighting to generate cross-domain gradients, can achieve a higher attack success rate against each model, especially those with more domains, such as AttGAN, and effectively increase the generalization of adversarial attack examples between domains. The _average_\(L\) of some models using the method of single gradient or iterative gradient can exceed CDMAA, which shows that the effectiveness of the adversarial examples generated by these two methods on each domain varies greatly, which is not as well-balanced and stable as CDMAA. In addition, compared with using the MGDA to generate cross-domain gradients, the effectiveness of simply using uniform weighting is not quite different, but it can greatly reduce the time consumption (Section 3.5). Therefore, CDMAA uses the most efficient uniform weighting method to calculate the cross-domain gradients.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**Single Gradient**} & \multicolumn{2}{c}{**Iterative Gradient**} & \multicolumn{2}{c}{**MGDA**} & \multicolumn{2}{c}{**Uniform Weighting**} \\  & \(\textbf{Arg\_}L\uparrow\) & _Attack\_Rate\(\uparrow\)_ & \(\textbf{Arg\_}L\uparrow\) & _Attack\_Rate\(\uparrow\)_ & \(\textbf{Arg\_}L\uparrow\) & _Attack\_Rate\(\uparrow\)_ & \(\textbf{Arg\_}L\uparrow\) & _Attack\_Rate\(\uparrow\)_ \\ \hline StarGAN & 0.253 & 99.4\% & 0.207 & 98.8\% & 0.493 & 100\% & 0.200 & 100\% \\ AttGAN & 0.049 & 29.2\% & 0.067 & 48.4\% & 0.067 & 42.6\% & 0.094 & 55.4\% \\ STGAN & 0.064 & 47.6\% & 0.060 & 48.2\% & 0.057 & 53.6\% & 0.063 & 48.6\% \\ U-CAT-IT & 0.364 & 99\% & 0.242 & 97.0\% & 0.742 & 100\% & 0.220 & 100\% \\ \hline \hline \end{tabular}
\end{table}
Table 2: The effect of different cross-domain gradient calculation methods on adversarial attack. The last group “Uniform weighting” is used in CDMAA and the other three are contrast groups.  
Figure 5: Visual comparison of (**a**) _attack_rate_ and (**b**) model output disruption for different cross-model gradient calculation methods. The values of \(L\) below 0.05 in (**b**) have been marked red. Combining the attack rate of four models into consideration, “Uniform weighting” is superior to “Single gradient” and “Iterative gradient” and not far off from “MGDA”.