# The Framework of Cross-Domain and Model Adversarial Attack against Deepfake
## 4 Experiment and Analysis
### Ablation/Contrast Experiments
#### 4.3.2 Cross-Model Perturbation Ablation/Contrast Experiment  
To verify that CDMAA uses the MGDA to calculate the cross-model perturbation vector \(\mathbf{w}\), which can effectively expand the generalization of adversarial examples between various models, we carry out the contrast attack experiment, where we keep other components of CDMAA unchanged and only change the way to process each cross-domain gradient: (1) Single gradient: \(\mathbf{w}=\mathbf{grad}^{(1)}\), i.e., only use the cross-domain gradients of one model to update the adversarial example, which is equivalent to ignoring whether the adversarial example has the generalization ability to attack other models. (2) **Iterative gradient**: \(\mathbf{w}=\mathbf{grad}^{(t\mod I)}\), i.e., iteratively use the cross-domain gradients of each model to update the adversarial example [12]. (3) **Uniform weighting**: \(\mathbf{w}=\frac{1}{J}\sum\limits_{j=1}^{J}\mathbf{grad}^{(j)}\), i.e., use the mean of the cross-domain gradients of each model to update the adversarial example [34]. The results are shown in Table 3:  
Figure 6 shows the visual comparison of the results. Although the methods of single gradient, iterative gradient and uniform weighting used in the current research can reach a high _average_\(L\) value on some models, such as StarGAN, their effectiveness on models that are robust against adversarial attacks (such as AttGAN and STGAN) are very poor. In fact, it is meaningless to reach such a high _average_\(L\) value: as long as the threshold \(\tau=0.05\) is exceeded, the output distortion is obvious enough and a successful adversarial attack is achieved. In contrast, the group \"MGDA\" can achieve a considerable attack success rate for each model. Therefore, we use the MGDA to calculate cross-model perturbation to improve the generalization of adversarial examples across models.  
Figure 6: Visual comparison of (**a**) _attack_rate_ and (**b**) model output disruption for different cross-model perturbation calculation methods. The values of \(L\) below 0.05 in (**b**) have been marked red. The last group “MGDA” can attack each model well, while the group “Single gradient” has a strong attack effect on only one model and the other two groups have limited attack effects on AttGAN and STGAN.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**Single Gradient**} & \multicolumn{2}{c}{**Iterative Gradient**} & \multicolumn{2}{c}{**Uniform Weighting**} & \multicolumn{2}{c}{**MGDA**} \\  & \(\mathbf{Arg_L\uparrow}\) & _Attack_Rate_\(\uparrow\) & _Arg_L\(\uparrow\)_ & _Attack_Rate_\(\uparrow\) & _Arg_L\(\uparrow\)_ & _Attack_Rate_\(\uparrow\) & _Agg_L\(\uparrow\)_ & _Attack_Rate_\(\uparrow\) \\ \hline StarGAN & 1.143 & 100\% & 0.851 & 100\% & 1.176 & 100\% & 0.199 & 99.4\% \\ AttGAN & 0.000 & 0.0\% & 0.033 & 18.3\% & 0.000 & 0.0\% & 0.099 & 59.7\% \\ STGAN & 0.000 & 0.0\% & 0.014 & 7.0\% & 0.000 & 0.0\% & 0.068 & 57.2\% \\ U-GAT-IT & 0.027 & 1.0\% & 1.002 & 100\% & 1.629 & 100\% & 0.216 & 99\% \\ \hline \hline \end{tabular}
\end{table}
Table 3: The effect of different cross-model perturbation calculation methods on adversarial attack. The last group “MGDA” is used in CDMAA and the other three are contrast groups.