## 3 Data Augmentation and Model Design
### Adversarial Dual-Branch Data Augmentations Framework
This paper chooses ResNet50 as the attacked model and induces it to  
Figure 4: The Augmax framework overview: The auto contrast, posterize, rotate, equalize, translate_x, translate_y, and shear_x are augmentation operators; the red dotted line represents the backpropagation process; PGD: the Project Gradient Descent attack. Figure 3: The Augmix framework overview: The brightness, posterize, color, equalize, and shear_x on each branch are augmentation operators; \(\oplus\): Element-wise summation. misjudgment during adversarial training. We can obtain new weights \(m^{*}\) and \(\mathbf{w}^{*}\) after the backpropagation for adversarial augmentation mixing. Given a standard deepfake dataset \(F\) over images \(x\in\mathbb{R}^{\text{d}}\) and labels \(y\in\mathbb{R}^{\text{d}}\), we need to train a classifier \(f:\mathbb{R}^{\text{d}}\rightarrow\mathbb{R}^{c}\) from \(x\) to output Softmax probabilities, parameterized by \(\theta\). The classifier \(f\) is robust for unforeseeable natural corruption and deliberate manufactured damage. The minimize experience loss is minimized in the training process, as shown in Equation (1). \[\min_{\theta}E(x,y)\sim{}_{F}\text{Loss}(f(x;\theta),y) \tag{1}\]  
where _Loss_ represents loss function (e.g., cross-entropy loss). The PGD algorithm is used to attack ResNet50 during adversarial training, constantly adjusting the parameters \(m^{*}\) and \(\mathbf{w}^{*}\) through backpropagation to generate hybrid-enhanced images, inducing the model to make misjudgments. Equation (2) shows the process of generating enhanced images. \[x^{*}=g(x;m^{*},\mathbf{w}^{*}) \tag{2}\]  
where \(g\) represents the confrontation training function and \(x\) represents the original image. The symbol \(x^{*}\) represents the image enhanced by adversarial augmentation, it not only has the characteristics of wide distribution and diversity of samples \(x^{*}\) in Figure 3, but also has higher data hardness. It is challenging to be recognized by detection models and can effectively simulate the \"dirty data\" encountered in the natural environment. The parameters \(\mathbf{w}^{*}\) and \(m^{*}\) maximize the experience loss and drive ResNet50 to make as many misjudgments as possible during adversarial training. The generation process of \(\mathbf{w}^{*}\) and \(m^{*}\) is depicted in Equation (3). \[\mathbf{w}^{*},m^{*}=\underset{\mathbf{w},m}{\text{argmax}}(Loss(f(g(x;m,\mathbf{w});\theta ),y)),s.t.m\in[0,1],\mathbf{w}\in[0,1]^{\text{b}},\mathbf{w}^{T}.1=1 \tag{3}\]  
Finally, the standard dataset and the two sets of enhanced data obtained after the dual-branch image augmentation framework are input into the backbone in parallel for training. The empirical loss of the training process is minimized, as shown in Equation (4). \[\min_{\theta}\text{E}(x,y)\sim{}_{F}\text{Loss}(f(x;\theta),y)+\lambda\,\text {S}(f(x;\theta),f(x^{*};\theta),f(x^{*};\theta)) \tag{4}\]  
The function JS denotes the Jensen-Shannon divergence consistency loss, which serves to regularize the enhanced images to have a similar model output to the original images and improve their feature similarity. The symbol \(\lambda\) is the trade-off parameter. Standard and robustness data enhanced by augmentations have different potential feature distributions and a higher feature heterogeneity, which significantly burdens the model normalization process during training. Therefore, this paper introduces a novel normalization layer named Dual Batch-and-Instance Normalization (DuBIN) [9]. The layer can separate the feature distribution of standard images and two types of enhanced images and carry out normalization operations on data of different distributions, effectively improving the model's efficiency.