# The Framework of Cross-Domain and Model Adversarial Attack against Deepfake
## 4 Experiment and Analysis
### CDMAA Adversarial Attack Experiment  
We used CDMAA framework to attack the four deepfake models StarGAN, AttGAN, STGAN and U-GAT-IT at the same time. The results are shown in Table 1:  
The results show that the generated adversarial examples achieve certain effects on each domain of the four deepfake models. StarGAN and U-GAT-IT are relatively vulnerable to adversarial attacks because the _average_\(L\) values is much greater than the threshold and the success rate of attack is close to 100%, respectively. The success rates of attacks on AttGAN and StarGAN are relatively lower; AttGAN and StarGAN are relatively less affected by the adversarial attack.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline  & & & & & & & & & & \\ \hline \multicolumn{1}{c}{**(a) I-FGSM**} & \multicolumn{3}{c}{**(b) I-FGSM \(\tau\)=\(100\)**} & \multicolumn{3}{c}{**(c) I-FGSM \(\epsilon\)=\(0.06\)**} & \multicolumn{3}{c}{**(d) MI-FGSM**} & \multicolumn{3}{c}{**(e) APGD**} \\ \multicolumn{1}{c}{\multirow{-2}{*}{_Avg.-L_}} & \multirow{-2}{*}{_Attack\_Rate_} & \multirow{-2}{*}{_Avg.-L_} & \multirow{-2}{*}{_Attack\_Rate_} & \multirow{-2}{*}{_Avg.-L_} & \multirow{-2}{*}{_Attack\_Rate_} & \multirow{-2}{*}{_Avg.-L_} & \multirow{-2}{*}{_Attack\_Rate_} & \multirow{-2}{*}{_Avg.-L_} & \multirow{-2}{*}{_Attack\_Rate_} \\ \cline{2-2} \cline{5-10}  & & & & & & & & & & \\ \hline StarGAN & 0.211 & 98.8\% & 0.222 & 99.2\% & 0.259 & 99\% & 0.223 & 99.4\% & 0.244 & 99.8\% \\ AttGAN & 0.108 & 56.9\% & 0.114 & 60.7\% & 0.108 & 70.5\% & 0.112 & 59.5\% & 0.123 & 64.1\% \\ STGAN & 0.073 & 58.2\% & 0.080 & 62.2\% & 0.149 & 80.4\% & 0.074 & 61.2\% & 0.085 & 71.8\% \\ U-GAT-IT & 0.242 & 97\% & 0.261 & 98\% & 0.303 & 100\% & 0.267 & 98\% & 0.276 & 99\% \\ \hline \hline \end{tabular}
\end{table}
Table 1: Adversarial attack deepfake models with CDMAA. The results of five groups of experiments are listed as five columns. (a) Basic group. Set the default attack algorithm (I-FGSM) and parameters (\(T=80,\varepsilon=0.05,a=0.01\)). (b) Increase \(T\) to 100 times. (c) Expand \(\varepsilon\) to 0.06. (d) Use the MI-FGSM as the attack algorithm. (e) Use APGD as the attack algorithm.  
In addition, comparing the three groups of experiments (a), (b) and (c), we see the attack effect can be improved by relaxing the limit of algorithm parameters, such as increasing \(\varepsilon\) or \(T\) (at the expense of a more obvious perturbation or a larger computational cost). Comparing the three groups of experiments (a), (d) and (e), we find that using a better adversarial attack algorithm (the MI-FGSM is an improvement on the I-FGSM and APGD is an improvement on the MI-FGSM) can improve the attack effect. Both the MI-FGSM and APGD perform \(J\) gradient backpropagation in each iteration, which is the same as the I-FGSM. Therefore, they have the same algorithm time complexity O(\(T\)) and roughly similar computational cost. All this shows that the CDMAA framework is well compatible with adversarial attack algorithms, and the general improvement methods are also applicable to CDMAA.  
Figure 4 shows the attack effectiveness of some of the adversarial examples in the above experiment:  
Figure 4 shows that the difference between the adversarial example and the original image is so small that the human eye can hardly distinguish it. However, the difference between the output of the deepfake model, i.e., the distortion of the fake image, is large enough to be distinguished. Therefore, using the adversarial example instead of the original image can significantly deform the output of the deepfake model so as to effectively prevent the model from forging pictures.