## 6 Experiment and Result Analysis
### Analysis of Sample Adversarial Attack and Defence Effectiveness  
Adversarial samples were generated using the IFGSM sample attack algorithm in this study. These samples were then trained along with the original dataset inputs on two models. This adversarial training approach effectively mitigates sample attacks and has demonstrated favorable outcomes. The following section presents an analysis of the results on adversarial attacks and defense. Adversarial sample generation algorithms require manual configuration of three hyperparameters: the number of iterations \(T\), the perturbation range \(\varepsilon\), and the learning rate \(\alpha\). Therefore, based on the experimental requirements of this study, the hyperparameters were set to \(T=100,\alpha=1/255,\varepsilon=24/255\) for generating adversarial samples. In this research, adversarial samples were evaluated using the average L1 loss and success rate metrics. \(\hat{L}^{l_{1}}\) denotes the average L1 loss between all adversarial sample frames and their corresponding original samples, as formulated in Equation (28). The success rate ASR represents the proportion of test results where the model predictions were successfully deceived. Thus, adversarial samples were generated, and adversarial training was conducted using four different datasets. The results of the adversarial attacks are presented in Table 6.  
\[\hat{L}^{l_{1}}=\frac{1}{N}{\sum_{i=1}^{N}}\|I_{i}-J_{i}\| \tag{28}\]  
In Equation (28), \(I\) and \(J\) are the original and adversarial images, respectively, and N is the total number of pixels in the image. From Table 6, it can be observed that the average L1 loss in this study was quite low, indicating that the differences between the original frames and the adversarial frames were minimal, and the effectiveness of generating adversarial samples was substantial. Additionally, the high sample attack success rate suggests that the robustness of the model needs improvement. Consequently, the model was trained using adversarial training to enhance its robustness against adversarial attacks. The ASR under adversarial training, as shown in Table 6, decreased, confirming that adversarial training is beneficial for defending against adversarial attacks and improving robustness. Specifically, the strategy reduced the success rates (ASR) of adversarial attacks on four datasets by (10.15%, 7.07%, 3.32%, and 1.24%), respectively, while still achieving high detection AUC and ACC under the premise of maintaining good robustness. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Metrics** & **Deepfakes** & **Face2 Face** & **FaceSwap** & **NeuralTextures** \\ \hline \(\hat{L}^{l_{1}}\) & 0.0039 & 0.0042 & 0.0040 & 0.0041 \\ ASR(\%) & 99.87 & 99.65 & 100.00 & 99.89 \\ Adv-ASR(\%) & 89.72 & 92.58 & 96.77 & 98.65 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Based on the results of the adversarial attacks using ifgsm. Figure 17 presents adversarial deepfake images from four datasets, randomly selected from successful attacks. The frames in the first row were correctly identified as Fake by the model, while the samples generated by the IFGSM attack algorithm were misclassified as Real. As depicted in the figure, the adversarial samples generated by the algorithm showed no noticeable differences from the original images but consistently resulted in misclassification during detection. This demonstrates the effectiveness of the IFGSM adversarial attack algorithm. Moreover, employing adversarial training as a defensive measure significantly improved the model's robustness, effectively countering adversarial sample attacks. To systematically assess the robustness of deepfake detection models under adversarial attack scenarios, controlled experiments were conducted to investigate the correlation between perturbation magnitude (\(\varepsilon\)) and attack success rates.