## 6 Experiment and Result Analysis
### Analysis of Sample Adversarial Attack and Defence Effectiveness
With iterative steps held constant, the perturbation range was progressively increased while monitoring the variation patterns of attack success rates across four deepfake datasets: Deepfakes, Face2 Face, FaceSwap, and NeuralTextures. The quantitative relationship between \(\varepsilon\) and detection vulnerability is demonstrated in Figure 18.  
Figure 17: IFGSM Adversarial Sample Examples from Four Forged Datasets. Figure 18: The attack success rate (ASR) variations of the I-FGSM adversarial attacks under different perturbation budgets (\(\varepsilon\)) across four deepfake datasets. The experimental results in Figure 18 reveal significant generation-method dependency in the model's adversarial robustness. Specifically, when the perturbation budget \(\varepsilon\) increased from 0.01 to 0.1, FaceSwap achieved rapid ASR saturation at 98.24% with \(\varepsilon=0.07\), and the ASR gain reached 29.78% for every 0.02 \(\varepsilon\) increase, which indicates that FaceSwap has a high ASR saturation, being 1.9 times faster than the saturation rate of NeuralTextures. This accelerated saturation pattern validates the heightened sensitivity of high-frequency artifact features to minor perturbations. Meanwhile, Deepfakes and Face2 Face demonstrated progressive ASR growth across the entire perturbation range, with Face2 Face showing 8.3 percentage points lower saturated ASR compared to other methods, indicating preserved detectability under subtle perturbations. Furthermore, to comprehensively validate the model's adversarial robustness, the evaluation framework was extended by incorporating Projected Gradient Descent (PGD) multi-step attacks [42] as a benchmark comparison. Under identical parameter configurations to I-FGSM (iterations, step size, learning rate, perturbation budgets), the attack success rates (ASR) and perturbation imperceptibilityL1-norm distortion) of single-step (I-FGSM) versus multi-step (PGD) attacks were systematically compared. This comparative analysis delineates the operational applicability boundaries of adversarial attack paradigms, with quantitative results detailed in Table 7.  
As detailed in Table 7, significant performance disparities were observed between I-FGSM and PGD adversarial attacks across four deepfake datasets under unified parameter configurations (T = 100, \(\alpha=1/255\), \(\varepsilon=24/256\)). The experimental results demonstrate that I-FGSM achieved good perturbation imperceptibility, with L1 distortion values being lower than those of PGD, confirming the enhanced stealthiness of single-step gradient-based perturbations in circumventing statistical anomaly detection. Although PGD exhibited marginal advantages in ASR metrics, its adversarial transferability showed notable degradation: The adversarial transfer attack success rates (Adv-ASR) for PGD on FaceSwap and NeuralTextures datasets were 90.25% and 93.47%, respectively, representing reductions of 6.52% and 5.18% compared to I-FGSM. This phenomenon is attributed to PGD's multi-step optimization process overfitting the decision boundaries of white-box models, whereas I-FGSM's single-step perturbations preserved stronger cross-model generalization capabilities, making them more suitable for practical black-box attack scenarios. Furthermore, I-FGSM demonstrated computational efficiency advantages critical for real-time deepfake detection systems requiring low-latency processing. Through balanced optimization of attack effectiveness, perturbation stealthiness, and transferability, I-FGSM emerged as the preferred baseline method for adversarial attack-defense tasks in our deepfake detection framework. In addition, accuracy experiments were also conducted in this paper under the conditions of with and without adversarial training to explore whether adversarial training would affect the performance of the model on clean samples.