# The Framework of Cross-Domain and Model Adversarial Attack against Deepfake
## 3 CDMAA
### Cross-Domain Adversarial Attack  
To extend the generalizability of the adversarial examples across various domains of the model, i.e., the optimization objective (5) is modified as  
\[\widetilde{\mathbf{x}}=\underset{\widetilde{\mathbf{x}}}{\text{argmax}}\{L(G( \widetilde{\mathbf{x}},c_{i}),G(\mathbf{x},c_{i}))|i=1\dots K\} \tag{6}\]  
where \(c_{i}\) denotes the \(i\)th conditional variable of model \(G\) and \(K\) denotes the total number of conditional variables. The gradient for each of the loss functions in the above optimization objectives is calculated by  
\[\mathbf{grad}_{i}=\
abla_{\mathbf{x}_{t}}L(G(\mathbf{x}_{t},c_{i}),G(\mathbf{x}  
where \(\mathbf{grad}^{(j)}\) denotes the cross-domain gradient of the \(j\)th model. Considering that these gradients come from different models, the large differences between models lead to a low similarity between the gradients, as shown in Figure 2b. Simply iterative traversing or uniform weighting these gradients is prone to a large fluctuation in the optimization process and generates an ineffective adversarial example [35].  
In order to derive a cross-model perturbation vector \(\mathbf{w}\) from the group of gradients \(\mathbf{grad}\) to update the adversarial example, the CDMAA framework draws on the idea of the Multiple Gradient Descent Algorithm (MGDA) to give an idea for finding \(\mathbf{w}\):  
\[\mathbf{w}=\underset{\mathbf{u}\in\overline{U}}{\arg\min}\|\mathbf{u}\|_{2}^{2} \tag{12}\]  
The space \(\overline{U}\) that the vector \(\mathbf{u}\) values in satisfies:  
\[\overline{U}=\left\{\mathbf{u}=\sum\limits_{j=1}^{J}a^{(j)}\cdot\mathbf{grad}^{(j)} \middle|a^{(j)}\,\geq 0,\forall j;\sum\limits_{j=1}^{J}a^{(j)}=1\right\} \tag{13}\]  
**Theorem 1**. : _The solution \(\mathbf{w}\) in (12) is the optimization direction in which the loss function corresponding to each model is increasing for the current adversarial example, i.e., it satisfies:_  
\[\mathbf{w}\cdot\mathbf{grad}^{(j)}>0,\forall j \tag{14}\]  
**Proof. ** Equation (12) is equivalent to the following optimization problem:  
\[\mathbf{a}_{0}=\underset{\mathbf{a}\in\overline{\mathcal{A}}}{\arg\min}\left|\left| \sum\limits_{j=1}^{J}a^{(j)}\cdot\mathbf{grad}^{(j)}\right|\right|_{2}^{2},\,s.t. \overline{A}=\left\{\mathbf{a}=\left(a^{(1)},\ldots,a^{(J)}\right)\in\mathbb{R}_ {+}^{J}\middle|\sum\limits_{j=1}^{J}a^{(j)}=1\right\} \tag{15}\]  
To solve this extreme value problem of a multivariate function under the linear constraint, construct the Lagrange function:  
\[L(\mathbf{a},\lambda)=\|\mathbf{u}\|_{2}^{2}+\lambda\left(\sum\limits_{j=1}^{J}a^{(j) }-1\right) \tag{16}\]  
since \(\mathbf{u}=\sum\limits_{j=1}^{J}a^{(j)}\cdot\mathbf{grad}^{(j)}\); hence \(\frac{\partial\mathbf{u}}{\partial a^{(j)}}=\mathbf{grad}^{(j)}\) and  
\[\frac{\partial L(\mathbf{a},\lambda)}{\partial a^{(j)}}=\frac{\partial\|\mathbf{u}\|_ {2}^{2}}{\partial a^{(j)}}+\lambda=2\mathbf{u}\cdot\frac{\partial\mathbf{u}}{\partial a ^{(j)}}+\lambda=2\mathbf{u}\cdot\mathbf{grad}^{(j)}+\lambda \tag{17}\]  
According to the Lagrange multiplier, the equation  
\[\frac{\partial L(\mathbf{a},\lambda)}{\partial a^{(j)}}=0,\forall j \tag{18}\]  
is a necessary condition for \(\mathbf{w}\) obtaining the minimum of \(\mathbf{u}\); hence,  
\[\mathbf{w}\cdot\mathbf{grad}^{(j)}=-\frac{\lambda}{2},\forall j \tag{19}\]  
considering that  
\[\|\mathbf{w}\|_{2}^{2}=\mathbf{w}\cdot\mathbf{w}=\mathbf{w}\cdot\sum\limits_{j=1}^{J}\left(a^ {(j)}\cdot\mathbf{grad}^{(j)}\right)=\sum\limits_{j=1}^{J}a^{(j)}\mathbf{w}\cdot\mathbf{ grad}^{(j)} \tag{20}\]In the actual adversarial attack scenario, since the dimension \(D\) is much larger than the number \(J\) of the gradients in \(\mathbf{grad}\), it is almost impossible for these gradients to be linearly dependent.