# The Framework of Cross-Domain and Model Adversarial Attack against Deepfake
## 3 CDMAA
### Gradient Regularization  
In Section 3.3, if the gradients group \(\mathbf{grad}\) is regularized as  
\[\mathbf{grad}_{tor}^{(j)}=\mathbf{grad}^{(j)}/S^{(j)} \tag{23}\]  
and then the MGDA is used on the regularized gradients group \(\mathbf{grad}_{nor}\) to find a perturbation vector \(\mathbf{w}\), the result of (14) holds because  
\[\mathbf{w}\cdot\mathbf{grad}^{(j)}=\mathbf{w}\cdot\mathbf{grad}_{nor}^{(j)}\cdot S^{(j)}>0 \tag{24}\]  
where \(S^{(j)}>0\) is the regularization factor. Common regularization methods include \(L2\) regularization: \(S^{(j)}=\|\mathbf{grad}^{(j)}\|_{2}\), which scales the gradients to the unit vector; logarithmic gradients regularization: \(S^{(j)}=L^{(j)}\), which reduces the gradients by the factor of their corresponding loss function value. Due to the large difference in norms of each of the cross-domain gradients \(\mathbf{grad}^{(j)}\) which are calculated from various models, the resulting vector \(\mathbf{w}\) is expected to be mostly influenced by the gradients of small norms in \(\mathbf{grad}^{(j)}\). In addition, without some constraints and guidance methods, the generated adversarial example will form an obvious \"attack preference\" due to the different vulnerability of deepfake models, only achieving high attack effect on the vulnerable models, which eventually leads to a large difference of different models. To lead the cross-model perturbation vector in the direction of improving the effectiveness of attacks on models that are not vulnerable to adversarial attacks and maximize the success rate of adversarial attacks against all models, we propose a penalty-based gradient regularization method:  
\[S^{(j)}=\frac{1}{\max\bigl{(}L^{(j)},\varsigma\bigr{)}} \tag{25}\]  
where \(L^{(j)}\) denotes the cross-domain loss function of the \(j\)th model and \(\varsigma\) is a very small positive number to prevent the zero-denominator error of \(S^{(j)}\) when \(L^{(j)}=0\). (The value of the loss function \(L^{(j)}\) is 0 inevitably in the first iteration of the I-FGSM since the current adversarial example is the same as the original image). The significance of using this gradient regularization is as follows:  
According to (19), the \(\mathbf{w}\) derived from the regularized gradient \(\mathbf{grad}_{nor}\) satisfies  
\[\mathbf{w}\cdot\frac{\mathbf{grad}^{(j)}}{S^{(j)}}=\mathbf{w}\cdot\mathbf{grad}_{tor}^{(j)}=- \frac{\lambda}{2},\forall j \tag{26}\]Consider the first-order [PERSON] expansion of the loss function \(L^{(j)}(\mathbf{x}_{t})=L\Big{(}G^{(j)}(\mathbf{x}_{t},c),G^{(j)}(\mathbf{x},c)\Big{)}\) at the \(t\)th iteration:  
\[ \begin{array}{c}\Delta L^{(j)}=L^{(j)}(\mathbf{x}_{t}+a\cdot sign(\mathbf{w}))-L^{(j)} (\mathbf{x}_{t})\approx L^{(j)}(\mathbf{x}_{t}+a\cdot\mathbf{w})-L^{(j)}(\mathbf{x}_{t})\\ \approx\
abla_{\mathbf{x}_{t}}L^{(j)}(\mathbf{x}_{t})\cdot(a\cdot\mathbf{w})=a\cdot\mathbf{w} \cdot\mathbf{grad}^{(j)}\end{array}  \tag{27}\]  
where the first approximately equal sign ignores the effect of taking the sign function for \(\mathbf{w}\) on the result, and the second approximately equal sign ignores the remainder of the first-order Taylor formula for approximation. Uniting (26) and (27), there is  
\[\Delta L^{(j)}\approx a\cdot\mathbf{w}\cdot\mathbf{grad}^{(j)}=-\frac{a\lambda}{2} \cdot S^{(j)}=-\frac{a\lambda}{2}\cdot\frac{1}{L^{(j)}} \tag{28}\]  
The last equal sign of the above equation can be held by taking a sufficiently small \(\varsigma\). Since \(-\frac{a\lambda}{2}\) is a constant, each model's value of the loss function change \(\Delta L^{(j)}\) is inversely proportional to their current corresponding loss function value \(L^{(j)}\), implying that the smaller the value of the loss function, the larger the optimization gain can be obtained. In practical adversarial attacks, the adversarial examples achieve successful attacks on some vulnerable models after a small number of iterative steps, as their corresponding loss functions have reached the threshold. It is meaningless to further improve these loss functions.