## 5 Construction of Sample Adversarial Attacks and Defense Model  
Adversarial attack refers to the process of introducing adversarial perturbations into a model's original inputs, thereby creating adversarial examples that cause the model to make incorrect predictions. Adversarial perturbations involve making subtle modifications to the model inputs capable of misleading the model's output. IFGSM (Iterative Fast Gradient Sign Method) [34] is an iterative adversarial attack method used to generate adversarial samples within a model. It repeatedly plays out the game [35] within the model through multiple iterations to deeply generate adversarial samples. Consequently, to enhance the robustness of the deepfake video detection in this study, IFGSM was introduced to generate adversarial examples and mitigate their impact through adversarial training. The algorithm for generating IFGSM adversarial examples is depicted in Equation (18). As shown in Algorithm 1. \[x_{0}=x \tag{18}\] \[x_{t+1}=clip_{x}\varepsilon(x_{t}+\alpha\times sign(\
abla_{x_{t}}J(f(x_{ t},\theta),y)))(t\leq T)\]  
In Equation (18), \(x\) represents the original sample, and \(x_{t+1}\) denotes the adversarial example after \(t\) iterations, where \(t\) does not exceed the specified number of iterations \(T\). \(clip_{x}\varepsilon\) refers to the clipping function, which ensures that the updated adversarial example remains within an \(\varepsilon\) distance from the original sample, thereby preventing significant deviations between \(x_{t+1}\) and \(x\). Here, \(\|x_{t}-x\|\leq\varepsilon\), \(\varepsilon\) denotes the perturbation range, \(\alpha\) represents the learning rate, _sign_ indicates the sign function, \(J\) represents the cross-entropy loss function, \(f\) denotes the objective function, \(\theta\) stands for the model parameters, and \(y\) signifies the true label for the genuine face. The loss is computed using the cross-entropy between the output of the sample and the original output. According to Equation (18), by employing the IFGSM algorithm to generate adversarial examples, this study utilizes adversarial training to assess the model's robustness against adversarial attacks. The essence of adversarial training lies in generating effective adversarial examples and striking a balance between the significance of original samples and adversarial ones during the model training process. This methodology aims to bolster the model's robustness in the face of adversarial assaults [36]. Figure 13 outlines the schematic of the proposed method for defending against sample adversarial attacks in this paper. The primary workflow involves generating adversarial examples using the IFGSM algorithm, feeding them alongside original samples into SEAR-Net and TE-WSDAN-DDNet for adversarial training, and ultimately employing decision fusion to determine the authenticity of the results. Furthermore, in this paper, when the adversarial training method is adopted, the adversarial samples used are mixed with the original samples at a ratio of 1:1 for training. By replacing the original samples with adversarial samples, the model's robustness is enhanced while ensuring that the original data distribution is maintained. Meanwhile, the weighted cross-entropy is used as the loss function for adversarial training to balance  
Figure 13: Adversarial training approach for adversarial attack sample defense. the robustness and the original accuracy. Therefore, the formula for the cross-entropy in adversarial training is as follows. First, in the detection task, the model learns the true distribution of the data by minimizing the cross-entropy loss function, as shown in Equation (19). \[L_{CE}(x,y)=-\sum_{i=1}^{2}y_{i}\log(p_{i}(x)) \tag{19}\]  
Let \(x\) denote the input image, and \(\mathrm{y}=[y_{1},y_{2}]\) represent the ground-truth labels for authentic and forged categories, respectively. The predicted probability for class \(i\) is expressed as \(p_{i}(x)\). The adversarial perturbation \(\delta\) is generated via the IFGSM algorithm defined in Equation (20).