# Deepfake-Image Anti-Forensics with Adversarial Examples Attacks
## Materials and Methods
### PNDF for Binary Classifier  
Usually, for a given classifier, we define a minimum perturbation \(r\) sufficient to change the original classification label \(l\) as follows:  
\[\Delta(x;l)\min_{r}\parallel r\parallel_{2}\] \[\text{subject to }l(x+r)\
eq l(x) \tag{3}\]  
where \(x\) is an image and \(l(x)\) is the estimated label; further, we call \(\Delta(x;l)\) the robustness of \(l\) at point \(x\). [PERSON] et al. [26] proposed the computation of a minimal norm adversarial perturbation for a given image in an iterative manner called DeepFool. They assumed the original image is located in the region defined by the decision boundary, and a small vector is added each iteration. Until the image label changes, these vectors are accumulated to obtain the final perturbation. Specifically, assume \(l(x)\) = _sign(f(x))_, where \(f\) is an arbitrary scalar value image classification function, \(f:\ R^{n}\to R\). Firstly, we analyze the case where \(f\) is a linear classifier \(f(x)=\left\{w^{T}x+b\right\}\), and then generalize it to a general binary classifier. DeepFool can generate perturbations for binary classifiers and multi-classifiers. Because a multi-class classifier can be regarded as a collection of binary classifiers, and the goal of this work is to attack the binary classifiers, here we only discuss the algorithm of binary classifiers. When \(f\) is linear, it is easy to find the robustness of \(f\) at point \(x_{0}\), \(r_{*}(x)\) is equal to the distance from \(x\) to the boundary hyperplane \(\mathcal{F}=\left\{x:w^{T}x+b=0\right\}\) (Figure 2). At this time, the minimal perturbation that changes the classification result of the classifier is the orthogonal projection of \(x_{0}\) onto the hyperplane \(\mathcal{F}\). Assuming now that \(f\) is a general binary differentiable classifier, we adopt an iterative procedure to estimate the robustness \(\Delta(x_{0};f)\). However, DeepFool only considers the projection from the sample point to the hyperplane and ignores the perturbations' directionality. Moreover, the minimum perturbation is the orthogonal projection from the point to the hyperplane, which is a small probability event. It is difficult to ensure that every perturbation is just the orthogonal projection. Poisson noise is very small and obeys the regular Poisson distribution. In addition, because of its signal dependence and good performance in improving the signal-to-noise ratio, it can ensure better image quality when increasing noise to obtain directional perturbations. Therefore, considering the perturbations' directionality and generality, we add Poisson noise in the iterative update perturbation. When we update \(r_{*}(x)\), we draw a circle with \(x_{0}\) as the center and \(r_{*}(x)\) as the radius. In this case, the hyperplane \(\mathcal{F}\) is the tangent of the circle, and it forms a right triangle with the quarter circle, as shown in Figure 2. The coverage area of the smallest perturbation in the shadow part is defined as \(r_{s}\). Obviously, because both \(x_{0}\) and \(\mathcal{F}\) are fixed, \(r_{s}\) is only related to \(r_{*}(x)\). \(r_{s}\) is calculated as follows:  
\[r_{s}=\frac{\Big{(}x_{0}-\frac{y_{0}-b}{w^{T}}\Big{)}\big{(}w^{T}x_{0}+b-y_{0} \big{)}}{2}-\frac{\pi r_{*}^{2}(x_{0})}{4} \tag{4}\]  
We add Poisson noise to properly increase \(r_{*}(x)\) and decrease \(r_{s}\) to obtain the perturbation in different directions. The calculation formula of \(r_{*}(x)\) is updated as follows:  
\[r_{*}(x)=\mathcal{P}_{(x_{0}|(x_{0}))}\bigg{(}\underset{r}{\text{argmin}}\parallel r \parallel_{2}\bigg{)} \tag{5}\]  
where \(\mathcal{P}(\cdot)\) means to add Poisson noise at the sample point \(x_{0}\) with label \(l(x_{0})\). The Poisson noise DeepFool (PNDF) algorithm for binary classifiers is summarized in Algorithm 1. The algorithm is simple in theory and easy to implement.