## 3 Data Augmentation and Model Design
### Adversarial Dual-Branch Data Augmentations Framework  
In previous deepfake image detection studies, researchers usually used or modified deep neural network models on standard datasets to explore results. However, when deploying detection models to a specific application environment, the samples to be detected are not as evenly distributed as the experimental datasets, and most counterfeit face images detected are dirty. These problems that contain noise and anomalies are mainly reflected in the inaccuracy and inconsistency of the forged images, including natural corruptions (e.g., camera blur or noise), sensory disturbance (e.g., loss in the transmission, electromagnetic interference), domain shifts (e.g., summer \(\rightarrow\) winter), and human interference (e.g., confrontation sample). The limited forged image datasets cannot cover enough realistic scenes. Furthermore, the existing detection models are vulnerable to detecting the images subjected to natural destruction or elaborate design. They are easily influenced to make misclassification. These unforeseeable changes in sample distribution seriously affect the reliability of detection models and make them challenging to play the expected effect in practice. To deal with the enormous risks brought by the continuous development of deepfake, more reliable and robust deepfake image detection algorithms urgently need to be proposed. Several existing techniques to consolidate model robustness include using robust data augmentations, stability training, pre-training, and building robust network structures. Among these, data augmentations have the characteristics of easy implementation, low computing cost, high reliability, and plug-and-play. Therefore, the data augmentation methods are used to construct a more diverse and hardened training sample, thus improving the model's resistance to interference. Image augmentations algorithms include two main categories. The first category is to increase the diversity of training samples by combining multiple random transformations, such as the Augmix algorithm. The other is to use the idea of the adversarial sample and induce the error of detection model decision by sampling from the worst-case samples to improve the hardness of the training data. A common way to obtain the adversarial samples is to add an adversarial perturbation. This paper designed a dual-branch data augmentation framework to enhance the forged image by combining Augmix and Augmax. First, use Augmix to enhance the standard input images, improving the robustness and uncertainty estimation of the image classification model by creating a new synthetic image from a clean image sample. Illustrate the specific implementation process in Figure 3.  
The multi-branch transformations and select single or multiple augmentation operators are set up in each branch to transform the input image \(x\) separately. Then, the multi-branch data mixing results are combined with the original image by randomly sampling linear parameters \(m\) and \(\mathbf{w}\) to obtain the enhanced sample \(x^{\star}\). The enhanced datasets are more widely distributed and diverse, but their hardness still needs improvement. The datasets generated by simply combining random transformations are not sufficiently stiff to influence the final decision of detection models. Therefore, the latest data enhancement algorithm, Augmax, is introduced in the second augmentation branch. It can unify the diversity and hardness of samples in an augmentation framework by combining the random sampling augmentation method and the adversarial sample idea. The structure of Augmax is depicted in Figure 4.  
The Augmax framework adds an optimization process to the original random transform hybrid framework for selecting image blending weights \(m\) and \(\mathbf{w}\) by introducing the PGD attack.