# A Novel Defensive Strategy for Facial Manipulation Detection Combining Bilateral Filtering and Joint Adversarial Training

Authors: Yifan Luo; Feng Ye; Bin Weng; Shan Du; Tianqiang Huang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Facial manipulation enables facial expressions to be tampered with or facial identities to be replaced in videos. The fake videos are so realistic that they are even difficult for human eyes to distinguish. This poses a great threat to social and public information security. A number of facial manipulation detectors have been proposed to address this threat. However, previous studies have shown that the accuracy of these detectors is sensitive to adversarial examples. The existing defense methods are very limited in terms of applicable scenes and defense effects. This paper proposes a new defense strategy for facial manipulation detectors, which combines a passive defense method, bilateral filtering, and a proactive defense method, joint adversarial training, to mitigate the vulnerability of facial manipulation detectors against adversarial examples. The bilateral filtering method is applied in the preprocessing stage of the model without any modification to denoise the input adversarial examples. The joint adversarial training starts from the training stage of the model, which mixes various adversarial examples and original examples to train the model. The introduction of joint adversarial training can train a model that defends against multiple adversarial attacks. The experimental results show that the proposed defense strategy positively helps facial manipulation detectors counter adversarial examples.


---

## Body

## 1. Introduction

Facial manipulation refers to swapping the target face with the source face, containing both forms of identity exchange and expression exchange. Identity exchange means swapping the entire face of the target and the source characters, which can change the identity. The expression exchange, on the other hand, only changes the facial expression but does not change the identity. Figure1 shows two examples of real-world applications of facial manipulation [1, 2]. These two examples in Figure 1 reveal the threat posed by facial manipulation videos to the field of security detection. With the continuous evolvement of facial manipulation, the techniques required for facial manipulation methods are becoming cheaper; the training data sets required are becoming smaller; and the resulting fake videos are becoming more realistic. Timely and effective countermeasures are needed; otherwise, the consequences will be unbearable.Figure 1
Examples of facial manipulation technology in reality. The first row contains screenshots applying the expression exchange technique. The expression action in (b) is migrated to (a) by Adobe After Effects and the facial manipulation tool, FakeApp. Screenshots of the second row refer to the identity exchange technology. The face in (a) is swapped to the face in (b) using FaceSwap.
(a)(b)To cope with the threat posed by facial manipulation videos, a number of facial manipulation detectors have been proposed. Facial manipulation detectors can be grouped into two broad categories. One is based on the manual feature extraction [3–5], and the other is on various deep neural networks [6–10]. Compared with traditional feature extraction methods, deep neural network-based methods generally have better detection performance. However, existing deep neural network-based facial manipulation detection models [11–13] are highly vulnerable to adversarial attacks. Obviously, the deep neural network models of facial manipulation detection have security vulnerabilities. Because of the security problem of detection, there are five adversarial attack methods are used in the paper [13] to attack two kinds of networks [3, 14]. Gandhi and Jain [11] used the classic fast gradient sign method (FGSM) [15] and the Carlini and Wagner Attack (C&W) [16] methods against facial manipulation detectors, ResNet [17] and VGG [18]. Neekhara et al. [12] performed white- and black-box attacks on XceptionNet [19] and MesoNet [7] using a gradient sign-based approach for perturbation optimization. If these models are applied, they will inevitably entail huge risks and irreparable losses. Therefore, it is necessary to improve the security of facial manipulation detectors. However, Gandhi and Jain [11] only applied two defense methods, Lipschitz regularization and deep image prior (DIP), to enhance the security of face swap detectors. And the accuracy that these two methods can improve is very limited. There is no other defense against adversarial attacks. Therefore, the research on defense strategies for facial manipulation detectors needs to be further explored.To address the above problems, this paper proposes a new defense strategy for facial manipulation detectors. This strategy designs effective methods to defend against adversarial example attacks from passive and proactive defenses. Passive defense means defending against the adversarial attacks without modifying the structure and parameters of the model, while proactive defense needs to train a new model so that the new model can exhibit strong robustness against the attacks. The defense strategy proposed in this paper is a passive defense method based on bilateral filtering and a proactive defense method based on joint adversarial training. The contributions of this work can be summarized as follows:(1)
Three adversarial attack methods, basic iterative method (BIM) [20], projected gradient descent (PGD) [21], and fast FGSM (FFGSM) [22], have been used to perform white- and black-box attacks on the trained Xception model [19].(2)
The bilateral filtering method is introduced as the passive defense method in our proposed defense strategy. It does not require additional model training and only simple processing of input data in the data preprocessing stage. To the best of our knowledge [11], we are the first ones to propose a passive defense method for facial manipulation detectors.(3)
The joint adversarial training method is the proactive defense method in our proposed defense strategy. This method enables facial manipulation detectors to have the ability to defend against multiple adversarial attacks.The results show the state-of-art performance for the security for the facial manipulation detectors.


## 2. Related Works

### 2.1. Facial Manipulation Methods

In terms of identity exchange, classic facial manipulation algorithms include DeepFakes [23], FaceSwap [24], FSGAN [25], FaceShifter [26], and so forth. Among them, DeepFakes [23] was designed based on VAE (variational autoencoder) and GAN (generative adversarial networks). The idea of this algorithm was based on the unsupervised image-to-image transformation proposed by Liu et al. [27]. However, this method needs to train a model with a large number of facial images specifically for both target and source characters, which is very time-consuming. FaceSwap [24] was based on the traditional method of facial region extraction and exchange, which was more lightweight compared to DeepFakes. FSGAN [25] was a recursive neural network-based face reconstruction algorithm. It can transform the target face based on the source face on the pretrained face model with high efficiency and convenience. FaceShifter [26] can fully extract and adaptively integrate target attributes to generate a realistic face by extracting multilevel target face attributes and adding adaptive attentional denormalization layers. It also introduces a heuristic error acknowledging refinement network that can effectively solve the face occlusion problem.In terms of expression exchange, Thies et al. [28] used an RGB-D camera to track and reconstruct 3D models of two people’s faces and realized facial reconstruction and expression exchange. Face2Face [29] optimized the expression exchange algorithm by combining 3D reconstruction and video reproduction technology. Thies et al. [30] further proposed another neural texture method; this method made the expression exchange more realistic and natural by re-rendering the 3D content.With the improvement of the reconstruction quality of the facial manipulation algorithms, the generated fake videos have reached the level of genuine ones. It is hard to identify accurately the authenticity of these videos with the human eye alone. This poses a threat to the information security of society and the public. If effective measures are not taken, it will certainly bring great harm to social security and stability. Therefore, facial manipulation video detection technology is a hot research content with certain social and practical value.


### 2.2. Facial Manipulation Detection

Facial manipulation detection algorithms have been developed to address the threat from facial manipulation videos. Some of the researchers detect fake videos by manual feature extraction. Li et al. [31] detected facial manipulation videos based on the biological signal of blink in the videos. Yang et al. [32] suggested that by estimating the 3D head pose in facial images, combined with SVM (support vector machine), classifier can effectively detect fake videos. Amerini et al. [33] used the optical flow method to detect facial manipulation videos. Durall et al. [34] found that facial manipulation videos can be detected by simple frequency domain analysis only.On the other hand, deep neural networks have also been applied in detecting face-manipulated videos. Li et al. [35] proposed to use the convolutional neural network (CNN) to detect artifacts generated during facial manipulation. Mesonet [7], inspired by InceptionNet, effectively detected fake videos generated by DeepFakes [23] and Face2Face [29]. Nguyen et al. [10] proposed to use the capsule network [36] for facial manipulation video detection, which can effectively detect multiple types of fake videos. In [37], the authors used Xception to detect face-manipulated videos and showed excellent results, so Xception is also one of the basic models used by various new methods for comparison [38–41]. Compared with the methods based on artificial features, the methods based on the deep neural network generally have higher detection accuracy [42–44].


### 2.3. Adversarial Attacks and Defenses

The adversarial attack [15] is when an attacker generates a corresponding adversarial example [45] by maliciously adding a small perturbation to the original example. Such perturbations are not only undetectable by human eyes but also can lead to misclassification of trained models. Deep neural networks and many other pattern recognition models were found to be vulnerable to adversarial attacks in previous studies [15]. It is also verified that in the field of facial manipulation detection, various methods are also vulnerable to attacks from adversarial examples. Neekhara et al. [12] used the L∞ distortion metric as the constraint for adding perturbations and optimized it using a gradient sign-based approach. They studied robust attack methods for facial manipulation detection networks from two aspects of white- and black-box attacks. Gandhi and Jain [11] used the classical FGSM and CW attack methods to attack VGG [18] and ResNet [17], which found that the classification accuracy of the two networks was reduced to less than 27%. By modifying the potential space of the generator, Carlini and Farid [13], respectively, carried out white- and black-box attacks against two kinds of networks [3, 14]. Similarly, the accuracy of classification is obviously reduced by this method. Most of the above methods apply classical adversarial attack methods, such as FGSM [15], which are prone to generate visible noise when generating adversarial examples, while methods such as CW [16] are less efficient in attacking. In this paper, we use three improved methods, BIM [20], PGD [21], and FFGSM [22], to attack the facial manipulation detectors. These three methods not only generate less noisy adversarial examples but also are more efficient and thus more difficult to defend.In order to defend against adversarial attacks effectively, a variety of defense methods have been investigated. Wang et al. [46] defended against adversarial examples by randomly ablating features in the original examples. Papernot et al. [47] used a distillation network for soft label training, which can effectively defend against examples. Goodfellow et al. [15] first proposed that adversarial training could be performed by adding adversarial examples to the training set to enhance the robustness of the models. Bhagoji et al. [48] proposed to use dimension-reduction techniques such as principal component analysis (PCA) for defense. However, in the field of facial manipulation detection, only Gandhi and Jain [11] applied Lipschitz regularization [49] and depth image prior (DIP) [50] to resist the attacks of adversarial examples. The Lipschitz regularization method [49] enhances the robustness of the models against adversarial attacks by constraining the gradient of the detector with respect to the inputs. However, this method is limited by the gradient calculation method and can only be applied to part of the networks (only to ResNet in the paper). Moreover, the accuracy improvement of this method is very limited (only a 10% improvement in detection accuracy), and there is a bottleneck in the application of real scenarios. The DIP method [50] was an unsupervised technique to eliminate interference by preprocessing the data before feeding it to the classifier. However, the optimal accuracy can only be achieved after 6,000 iterations of the model, so it is very time-consuming. The defense methods mentioned above are only considered from the perspective of proactive defense of the models, which suffered from time-consuming, limited application scenarios and accuracy improvement. In this paper, we propose a new defense strategy. This strategy designs two effective defense methods, the bilateral filtering and the joint adversarial training, from the perspectives of both passive and proactive defenses, respectively.


## 2.1. Facial Manipulation Methods

In terms of identity exchange, classic facial manipulation algorithms include DeepFakes [23], FaceSwap [24], FSGAN [25], FaceShifter [26], and so forth. Among them, DeepFakes [23] was designed based on VAE (variational autoencoder) and GAN (generative adversarial networks). The idea of this algorithm was based on the unsupervised image-to-image transformation proposed by Liu et al. [27]. However, this method needs to train a model with a large number of facial images specifically for both target and source characters, which is very time-consuming. FaceSwap [24] was based on the traditional method of facial region extraction and exchange, which was more lightweight compared to DeepFakes. FSGAN [25] was a recursive neural network-based face reconstruction algorithm. It can transform the target face based on the source face on the pretrained face model with high efficiency and convenience. FaceShifter [26] can fully extract and adaptively integrate target attributes to generate a realistic face by extracting multilevel target face attributes and adding adaptive attentional denormalization layers. It also introduces a heuristic error acknowledging refinement network that can effectively solve the face occlusion problem.In terms of expression exchange, Thies et al. [28] used an RGB-D camera to track and reconstruct 3D models of two people’s faces and realized facial reconstruction and expression exchange. Face2Face [29] optimized the expression exchange algorithm by combining 3D reconstruction and video reproduction technology. Thies et al. [30] further proposed another neural texture method; this method made the expression exchange more realistic and natural by re-rendering the 3D content.With the improvement of the reconstruction quality of the facial manipulation algorithms, the generated fake videos have reached the level of genuine ones. It is hard to identify accurately the authenticity of these videos with the human eye alone. This poses a threat to the information security of society and the public. If effective measures are not taken, it will certainly bring great harm to social security and stability. Therefore, facial manipulation video detection technology is a hot research content with certain social and practical value.


## 2.2. Facial Manipulation Detection

Facial manipulation detection algorithms have been developed to address the threat from facial manipulation videos. Some of the researchers detect fake videos by manual feature extraction. Li et al. [31] detected facial manipulation videos based on the biological signal of blink in the videos. Yang et al. [32] suggested that by estimating the 3D head pose in facial images, combined with SVM (support vector machine), classifier can effectively detect fake videos. Amerini et al. [33] used the optical flow method to detect facial manipulation videos. Durall et al. [34] found that facial manipulation videos can be detected by simple frequency domain analysis only.On the other hand, deep neural networks have also been applied in detecting face-manipulated videos. Li et al. [35] proposed to use the convolutional neural network (CNN) to detect artifacts generated during facial manipulation. Mesonet [7], inspired by InceptionNet, effectively detected fake videos generated by DeepFakes [23] and Face2Face [29]. Nguyen et al. [10] proposed to use the capsule network [36] for facial manipulation video detection, which can effectively detect multiple types of fake videos. In [37], the authors used Xception to detect face-manipulated videos and showed excellent results, so Xception is also one of the basic models used by various new methods for comparison [38–41]. Compared with the methods based on artificial features, the methods based on the deep neural network generally have higher detection accuracy [42–44].


## 2.3. Adversarial Attacks and Defenses

The adversarial attack [15] is when an attacker generates a corresponding adversarial example [45] by maliciously adding a small perturbation to the original example. Such perturbations are not only undetectable by human eyes but also can lead to misclassification of trained models. Deep neural networks and many other pattern recognition models were found to be vulnerable to adversarial attacks in previous studies [15]. It is also verified that in the field of facial manipulation detection, various methods are also vulnerable to attacks from adversarial examples. Neekhara et al. [12] used the L∞ distortion metric as the constraint for adding perturbations and optimized it using a gradient sign-based approach. They studied robust attack methods for facial manipulation detection networks from two aspects of white- and black-box attacks. Gandhi and Jain [11] used the classical FGSM and CW attack methods to attack VGG [18] and ResNet [17], which found that the classification accuracy of the two networks was reduced to less than 27%. By modifying the potential space of the generator, Carlini and Farid [13], respectively, carried out white- and black-box attacks against two kinds of networks [3, 14]. Similarly, the accuracy of classification is obviously reduced by this method. Most of the above methods apply classical adversarial attack methods, such as FGSM [15], which are prone to generate visible noise when generating adversarial examples, while methods such as CW [16] are less efficient in attacking. In this paper, we use three improved methods, BIM [20], PGD [21], and FFGSM [22], to attack the facial manipulation detectors. These three methods not only generate less noisy adversarial examples but also are more efficient and thus more difficult to defend.In order to defend against adversarial attacks effectively, a variety of defense methods have been investigated. Wang et al. [46] defended against adversarial examples by randomly ablating features in the original examples. Papernot et al. [47] used a distillation network for soft label training, which can effectively defend against examples. Goodfellow et al. [15] first proposed that adversarial training could be performed by adding adversarial examples to the training set to enhance the robustness of the models. Bhagoji et al. [48] proposed to use dimension-reduction techniques such as principal component analysis (PCA) for defense. However, in the field of facial manipulation detection, only Gandhi and Jain [11] applied Lipschitz regularization [49] and depth image prior (DIP) [50] to resist the attacks of adversarial examples. The Lipschitz regularization method [49] enhances the robustness of the models against adversarial attacks by constraining the gradient of the detector with respect to the inputs. However, this method is limited by the gradient calculation method and can only be applied to part of the networks (only to ResNet in the paper). Moreover, the accuracy improvement of this method is very limited (only a 10% improvement in detection accuracy), and there is a bottleneck in the application of real scenarios. The DIP method [50] was an unsupervised technique to eliminate interference by preprocessing the data before feeding it to the classifier. However, the optimal accuracy can only be achieved after 6,000 iterations of the model, so it is very time-consuming. The defense methods mentioned above are only considered from the perspective of proactive defense of the models, which suffered from time-consuming, limited application scenarios and accuracy improvement. In this paper, we propose a new defense strategy. This strategy designs two effective defense methods, the bilateral filtering and the joint adversarial training, from the perspectives of both passive and proactive defenses, respectively.


## 3. Materials and Methods

### 3.1. Adversarial Attack

Adversarial attacks against machine learning models can be classified into two types, namely white- and black-box attacks. The classification of the two depends on whether the attacker has access to the prior knowledge of the models. Specifically, adversarial examples are generated by model A to attack model B. If both are the same model, it is a white-box attack; otherwise, it is a black-box attack.In this paper, we use the following three typical adversarial attack methods on facial manipulation detectors.The basic iterative method (BIM) [20] is also known as the iterative FGSM (I-FGSM) algorithm. Compared with the classical FGSM, this method uses an iterative approach to find the perturbations of each pixel, rather than making all the pixels change greatly at once. BIM can effectively reduce the disturbance noise.The projected gradient descent (PGD) [21] is also an iterative implementation of the FGSM algorithm. However, compared with BIM, PGD further increases the number of iterations and adds a layer of randomization, which was initialized with uniform random noise. PGD is very effective against both linear and nonlinear models. And it is one of the most powerful first-order attack methods available.Wong et al. [22] proposed fast FGSM (FFGSM) attack method, which was used in the fast adversarial training method using the FGSM attack. Compared with the traditional FGSM algorithm, this method combines random initialization. Through simple random initialization operation, FFGSM not only can accelerate the generation of adversarial examples but also can have a strong attack effect.Figure2 shows the framework of the adversarial attack process in this paper. We use two types of attacks on the facial manipulation detectors, white- and black-box, respectively. In this case, the target model is Xception [19], and the substitute model in the black-box attack is MesoInception [7]. It is important to note that both the white- and the black-box attacks occur in the testing stage of the model. This means that both the substitute and the target models are trained models, and both are trained under the same training set to ensure the transferability of the generated adversarial examples.Figure 2
The overall framework of the adversarial attacks. The white-box attack process is shown in the blue dotted box, and the black-box attack process is shown in the yellow dotted box.In this paper, we propose a new defense strategy that can effectively defend against adversarial attacks for facial manipulation detectors. Specifically, we use bilateral filtering as the passive defense method and the joint adversarial training as the proactive defense method. We will describe the proposed approach in detail in the next section. The overall framework of the defense strategy proposed in this paper is shown in Figure3.Figure 3
The proposed framework of the defense strategy process. The orange dotted box denotes the proactive defense process based on the joint adversarial training method, and the green dotted box denotes the passive defense process based on the bilateral filtering method.


### 3.2. Passive Defense

In this paper, we use the bilateral filtering method as the passive defense method. Passive defense occurs in the preprocessing stage of the model on the inputs, and it is very simple and effective to enhance the robustness of the models without retraining.Bilateral filtering is a method of spatial smoothing. Its main purpose is to deal with image noise reduction. A bilateral filter is a kind of nonlinear filter. This filter is a combination of spatial proximity of images and similarity of pixel values. The bilateral filtering method considers both spatial proximity information and color similarity information. It removes noise and smoothes the image while maintaining edge detail. The formula is as follows:(1)gi,j=∑k,l∈Si,jfk,lwi,j,k,l∑k,l∈Si,jwi,j,k,l,where i,j is the corresponding pixel position, gi,j denotes the output image, fk,ldenotes the input image, and wi,j,k,l is the value calculated by the two Gaussian functions. The basic idea of the bilateral filter is that the weights calculated by spatial proximity and those calculated by pixel similarity are multiplied, and then the weights are convolved with the image to achieve the effect of keeping the edges to remove noise.Through comparative experiments, we found that the bilateral filtering method not only can retain the edge information of the image well but also has the best performance in enhancing the robustness of the detector. As shown in Figure4, compared with the original images, the images processed by median filtering, mean filtering, and Gaussian filtering show the phenomenon of edge blurring. However, the images processed by bilateral filtering can effectively retain the edge information while denoising.Figure 4
The original images and the images after four kinds of filtering processes: (a) original, (b) mean filter, (c) median filter, (d) Gaussian filter, and (e) bilateral filter.
(a)(b)(c)(d)(e)The specific defense process of the bilateral filtering method is shown in the green dotted box in Figure3. The attacker generates adversarial examples in the test stage of the target model. We add a bilateral filter in the data preprocessing stage so that the adversarial examples can pass the bilateral filter, so as to achieve noise reduction. The noise-reduced examples are then fed into the target model so that the target model can resist the attack of the adversarial examples.


### 3.3. Proactive Defense

In this paper, we use joint adversarial training as the active defense method. Its principle can be summarized as follows:(2)minθEZ,y∼Dmaxδ≤εLfθX+δ,y,where X is the input of the data, δ denotes the perturbation superimposed on the input, fθ is the neural network function, and y is the label of example. LfθX+δ,y is the loss obtained by superimposing a perturbation δ on example X and then comparing it with the label Y through the neural network function.maxL denotes the optimization goal, namely to find perturbation to maximize the loss function. The outer layer of formula (2) is the minimization formula optimized for the neural network, that is, when the perturbation is fixed, the training neural network model minimizes the loss of training data. In other words, the model has been made robust enough to accommodate such perturbations.The adversarial training method can only be trained for a particular adversarial attack method. After training, the model can only defend against this kind of adversarial attack method and cannot defend against other kinds of adversarial attack methods. Aiming at the defect of traditional adversarial training, this paper designs a proactive defense method that can defend against multiple adversarial attack methods, that is, joint adversarial training method.The framework of the joint adversarial training method is shown in the orange dotted box in Figure3. Specifically, in the training stage, we first carry out the first kind of adversarial attack on the model and mix the generated adversarial examples into the training set. After that, the second adversarial attack is performed on the model, and the generated adversarial examples are mixed into the training set, and until the N-th adversarial attack's adversarial examples are mixed. After mixing the original examples and the N kinds of adversarial examples, the model is then trained. The model trained by this method can effectively defend against multiple adversarial attacks at the same time, and the detection accuracy of the original examples is not affected much.


### 3.4. Experiment Setting

In the experiment, we use the FaceForensics++ benchmark [3] as the data set for model training and testing. FaceForensics++ contains 1,000 real videos and 5,000 fake videos generated by five facial manipulation algorithms, with the videos divided into three quality levels. We used three subsets of FaceForensics++. These three subsets are facial manipulation videos generated by three facial manipulation algorithms, namely DeepFakes (DF), Face2Face (F2F), and FaceSwap (FS). Each subset contains 1,000 fake videos. The data set has 1,000 real videos crawled from YouTube. We divided each subset of videos into the training set, testing set, and validation set in the ratio of 7:2:1, respectively, that is, they consist of 700, 200, and 100 real videos and fake videos generated by their corresponding facial manipulation algorithms. Then, we randomly extract some frames from the video. The face detector in the Dlib library is used to extract the images of the face region, which are used as the inputs for model training, validation, and testing. For the models, we use the Xception [4] as the target model for attack and defense and the MesoInception [5] as the substitute model for the Xception.During the white-box attack experiments, we first pretrained the target model using three subsets of FaceForensics++ separately. Then, in the test stage, BIM [6], PGD [7], and FFGSM [8] are, respectively, used to carry out white-box attacks on the trained target model and generate adversarial examples. In addition, we set the attack intensity of BIM, PGD, and FFGSM as ε=1/255, ε=1/255, and ε=1/255, respectively. During the black-box attack experiments, we first pretrained the target and substitute models using the same three subsets of FaceForensics++. Then three adversarial attack methods were used to carry out white-box attacks on the trained substitute model to generate adversarial examples. Since the black-box transfer attack is less effective than the white-box attack, we appropriately increase the attack intensity when carrying out the white-box attack on the substitute model to ensure the success of the black-box attack. Specifically, we increased the attack intensity of BIM, PGD, and FFGSM to ε=8/255, ε=8/255, and ε=8/255, respectively. Then, the black-box attack is carried out on the target model using the generated adversarial examples. The white-box attack effects of the three attack methods are shown in Figure 5. In this figure, rows represent the type of adversarial attacks to which the images are subjected, and columns represent the type of facial manipulation methods to which the images are subjected, where the first row is the original images that have not been attacked, and the first column is the real images. It can be seen that adversarial examples generated by the three attack methods all have minimal noise. The original examples and the adversarial examples cannot be distinguished by naked eyes only.Figure 5
The original examples of the real images and the facial manipulation images and the adversarial examples generated by the three attack methods.For the passive defense experiment, we carried out a comparative experiment of filtering in the test stage of the target model. In other words, the adversarial examples generated by attacking the target model are input into the target model with and without bilateral filtering to test its defensive performance. In the experiment, we set the neighborhood diameter of bilateral filtering as 9, and the standard deviations of spatial Gaussian function and gray similarity Gaussian function are both 75. For the proactive defense experiment, three attack methods, BIM, PGD, and FFGSM, are used in the training process of the target model to carry out joint adversarial training, that is, three adversarial examples are generated simultaneously in the training process. And the generated three adversarial examples are mixed with the original examples as the training set of the target model for joint adversarial training. After the training is completed, in the test stage, three kinds of adversarial attack methods are used to attack the model. The test evaluated the robustness of the target model that defends against adversarial attacks after joint adversarial training.


## 3.1. Adversarial Attack

Adversarial attacks against machine learning models can be classified into two types, namely white- and black-box attacks. The classification of the two depends on whether the attacker has access to the prior knowledge of the models. Specifically, adversarial examples are generated by model A to attack model B. If both are the same model, it is a white-box attack; otherwise, it is a black-box attack.In this paper, we use the following three typical adversarial attack methods on facial manipulation detectors.The basic iterative method (BIM) [20] is also known as the iterative FGSM (I-FGSM) algorithm. Compared with the classical FGSM, this method uses an iterative approach to find the perturbations of each pixel, rather than making all the pixels change greatly at once. BIM can effectively reduce the disturbance noise.The projected gradient descent (PGD) [21] is also an iterative implementation of the FGSM algorithm. However, compared with BIM, PGD further increases the number of iterations and adds a layer of randomization, which was initialized with uniform random noise. PGD is very effective against both linear and nonlinear models. And it is one of the most powerful first-order attack methods available.Wong et al. [22] proposed fast FGSM (FFGSM) attack method, which was used in the fast adversarial training method using the FGSM attack. Compared with the traditional FGSM algorithm, this method combines random initialization. Through simple random initialization operation, FFGSM not only can accelerate the generation of adversarial examples but also can have a strong attack effect.Figure2 shows the framework of the adversarial attack process in this paper. We use two types of attacks on the facial manipulation detectors, white- and black-box, respectively. In this case, the target model is Xception [19], and the substitute model in the black-box attack is MesoInception [7]. It is important to note that both the white- and the black-box attacks occur in the testing stage of the model. This means that both the substitute and the target models are trained models, and both are trained under the same training set to ensure the transferability of the generated adversarial examples.Figure 2
The overall framework of the adversarial attacks. The white-box attack process is shown in the blue dotted box, and the black-box attack process is shown in the yellow dotted box.In this paper, we propose a new defense strategy that can effectively defend against adversarial attacks for facial manipulation detectors. Specifically, we use bilateral filtering as the passive defense method and the joint adversarial training as the proactive defense method. We will describe the proposed approach in detail in the next section. The overall framework of the defense strategy proposed in this paper is shown in Figure3.Figure 3
The proposed framework of the defense strategy process. The orange dotted box denotes the proactive defense process based on the joint adversarial training method, and the green dotted box denotes the passive defense process based on the bilateral filtering method.


## 3.2. Passive Defense

In this paper, we use the bilateral filtering method as the passive defense method. Passive defense occurs in the preprocessing stage of the model on the inputs, and it is very simple and effective to enhance the robustness of the models without retraining.Bilateral filtering is a method of spatial smoothing. Its main purpose is to deal with image noise reduction. A bilateral filter is a kind of nonlinear filter. This filter is a combination of spatial proximity of images and similarity of pixel values. The bilateral filtering method considers both spatial proximity information and color similarity information. It removes noise and smoothes the image while maintaining edge detail. The formula is as follows:(1)gi,j=∑k,l∈Si,jfk,lwi,j,k,l∑k,l∈Si,jwi,j,k,l,where i,j is the corresponding pixel position, gi,j denotes the output image, fk,ldenotes the input image, and wi,j,k,l is the value calculated by the two Gaussian functions. The basic idea of the bilateral filter is that the weights calculated by spatial proximity and those calculated by pixel similarity are multiplied, and then the weights are convolved with the image to achieve the effect of keeping the edges to remove noise.Through comparative experiments, we found that the bilateral filtering method not only can retain the edge information of the image well but also has the best performance in enhancing the robustness of the detector. As shown in Figure4, compared with the original images, the images processed by median filtering, mean filtering, and Gaussian filtering show the phenomenon of edge blurring. However, the images processed by bilateral filtering can effectively retain the edge information while denoising.Figure 4
The original images and the images after four kinds of filtering processes: (a) original, (b) mean filter, (c) median filter, (d) Gaussian filter, and (e) bilateral filter.
(a)(b)(c)(d)(e)The specific defense process of the bilateral filtering method is shown in the green dotted box in Figure3. The attacker generates adversarial examples in the test stage of the target model. We add a bilateral filter in the data preprocessing stage so that the adversarial examples can pass the bilateral filter, so as to achieve noise reduction. The noise-reduced examples are then fed into the target model so that the target model can resist the attack of the adversarial examples.


## 3.3. Proactive Defense

In this paper, we use joint adversarial training as the active defense method. Its principle can be summarized as follows:(2)minθEZ,y∼Dmaxδ≤εLfθX+δ,y,where X is the input of the data, δ denotes the perturbation superimposed on the input, fθ is the neural network function, and y is the label of example. LfθX+δ,y is the loss obtained by superimposing a perturbation δ on example X and then comparing it with the label Y through the neural network function.maxL denotes the optimization goal, namely to find perturbation to maximize the loss function. The outer layer of formula (2) is the minimization formula optimized for the neural network, that is, when the perturbation is fixed, the training neural network model minimizes the loss of training data. In other words, the model has been made robust enough to accommodate such perturbations.The adversarial training method can only be trained for a particular adversarial attack method. After training, the model can only defend against this kind of adversarial attack method and cannot defend against other kinds of adversarial attack methods. Aiming at the defect of traditional adversarial training, this paper designs a proactive defense method that can defend against multiple adversarial attack methods, that is, joint adversarial training method.The framework of the joint adversarial training method is shown in the orange dotted box in Figure3. Specifically, in the training stage, we first carry out the first kind of adversarial attack on the model and mix the generated adversarial examples into the training set. After that, the second adversarial attack is performed on the model, and the generated adversarial examples are mixed into the training set, and until the N-th adversarial attack's adversarial examples are mixed. After mixing the original examples and the N kinds of adversarial examples, the model is then trained. The model trained by this method can effectively defend against multiple adversarial attacks at the same time, and the detection accuracy of the original examples is not affected much.


## 3.4. Experiment Setting

In the experiment, we use the FaceForensics++ benchmark [3] as the data set for model training and testing. FaceForensics++ contains 1,000 real videos and 5,000 fake videos generated by five facial manipulation algorithms, with the videos divided into three quality levels. We used three subsets of FaceForensics++. These three subsets are facial manipulation videos generated by three facial manipulation algorithms, namely DeepFakes (DF), Face2Face (F2F), and FaceSwap (FS). Each subset contains 1,000 fake videos. The data set has 1,000 real videos crawled from YouTube. We divided each subset of videos into the training set, testing set, and validation set in the ratio of 7:2:1, respectively, that is, they consist of 700, 200, and 100 real videos and fake videos generated by their corresponding facial manipulation algorithms. Then, we randomly extract some frames from the video. The face detector in the Dlib library is used to extract the images of the face region, which are used as the inputs for model training, validation, and testing. For the models, we use the Xception [4] as the target model for attack and defense and the MesoInception [5] as the substitute model for the Xception.During the white-box attack experiments, we first pretrained the target model using three subsets of FaceForensics++ separately. Then, in the test stage, BIM [6], PGD [7], and FFGSM [8] are, respectively, used to carry out white-box attacks on the trained target model and generate adversarial examples. In addition, we set the attack intensity of BIM, PGD, and FFGSM as ε=1/255, ε=1/255, and ε=1/255, respectively. During the black-box attack experiments, we first pretrained the target and substitute models using the same three subsets of FaceForensics++. Then three adversarial attack methods were used to carry out white-box attacks on the trained substitute model to generate adversarial examples. Since the black-box transfer attack is less effective than the white-box attack, we appropriately increase the attack intensity when carrying out the white-box attack on the substitute model to ensure the success of the black-box attack. Specifically, we increased the attack intensity of BIM, PGD, and FFGSM to ε=8/255, ε=8/255, and ε=8/255, respectively. Then, the black-box attack is carried out on the target model using the generated adversarial examples. The white-box attack effects of the three attack methods are shown in Figure 5. In this figure, rows represent the type of adversarial attacks to which the images are subjected, and columns represent the type of facial manipulation methods to which the images are subjected, where the first row is the original images that have not been attacked, and the first column is the real images. It can be seen that adversarial examples generated by the three attack methods all have minimal noise. The original examples and the adversarial examples cannot be distinguished by naked eyes only.Figure 5
The original examples of the real images and the facial manipulation images and the adversarial examples generated by the three attack methods.For the passive defense experiment, we carried out a comparative experiment of filtering in the test stage of the target model. In other words, the adversarial examples generated by attacking the target model are input into the target model with and without bilateral filtering to test its defensive performance. In the experiment, we set the neighborhood diameter of bilateral filtering as 9, and the standard deviations of spatial Gaussian function and gray similarity Gaussian function are both 75. For the proactive defense experiment, three attack methods, BIM, PGD, and FFGSM, are used in the training process of the target model to carry out joint adversarial training, that is, three adversarial examples are generated simultaneously in the training process. And the generated three adversarial examples are mixed with the original examples as the training set of the target model for joint adversarial training. After the training is completed, in the test stage, three kinds of adversarial attack methods are used to attack the model. The test evaluated the robustness of the target model that defends against adversarial attacks after joint adversarial training.


## 4. Results and Discussion

We first tested the model accuracy of the trained Xception model under the original examples, and the results are shown in Tables1 and 2. We can see that the Xception model has great detection accuracy under all three unperturbed subsets of the FaceForensics++ data set. When we apply the three adversarial attack methods to white- and black-box attacks, we can find that the performance of the target model will decline sharply.Table 1
Performance comparison of using four filters to defend against white-box attacks of three adversarial attack methods.
AttackFilterDFF2FFSNoneNone96.1097.5998.22BIMNone35.7735.9332.25Mean filter77.4686.9975.79Median filter69.6782.5269.78Gaussian filter69.2681.9966.41Bilateral filter83.6188.6277.21PGDNone52.2151.2151.67Mean filter83.6188.6277.21Median filter74.7985.5872.38Gaussian filter74.7488.1871.00Bilateral filter86.6290.6987.98FFGSMNone5.597.248.49Mean filter60.4464.5566.84Median filter36.8753.3731.00Gaussian filter35.3247.3135.51Bilateral filter74.8082.4774.26Table 2
Performance of bilateral filtering defending against black-box attacks of three adversarial attack methods.
AttackFilterDFF2FFSNoneNone96.1097.5998.22BIMNone52.7058.3437.55Bilateral filter86.4990.4489.62PGDNone62.7459.5850.42Bilateral filter87.1090.8589.32FFGSMNone69.8059.2150.28Bilateral filter84.7589.1087.69Next, we will show the defensive performance of the bilateral filtering method and joint adversarial training method in resisting white- and black-box attacks, respectively, from the perspective of passive and proactive defenses.


### 4.1. Passive Defense

In the experiment, we first test the performance of four spatial smoothing methods, namely mean filtering, median filtering, Gaussian filtering, and bilateral filtering, in resisting the white-box attack. In Table1, boldfaced numbers indicate the best precision indexes. From Table 1, the four kinds of spatial filtering can improve the robustness of the target model that defends against white-box attacks. However, the bilateral filtering method shows the optimal effect under all kinds of adversarial attacks. Next, we further experiment with the effect of bilateral filtering defend against black-box attack. The results are shown in Table 2. Similarly, from Table 2, it can be found that the introduced bilateral filtering can well improve the robustness of the target model against black-box attack.When performing adversarial attacks, attackers usually try to introduce noise perturbation that is difficult to detect with naked eyes, causing the target model to misclassify. From the results of Tables1 and 2, the proposed passive defense method based on bilateral filtering can effectively perform noise reduction on the input images. The perturbations generated by the attacker are counteracted, thus rendering the adversarial attack ineffective.As we all know, the detection of existing facial manipulation detectors mostly relies on artifacts in the image, and the bilateral filtering method proposed in this paper is mainly used to denoise the image. Therefore, after the experiment, we conducted statistics on the detection of the samples. We found that the bilateral filtering method proposed in this paper does not increase the number of false-positive and false-negative samples.


### 4.2. Proactive Defense

One criterion for evaluating the performance of adversarial training is that the model after adversarial training is not only an effective defense against adversarial attacks but also has great classification accuracy for the original examples. At the same time, for our proactive defense experiment, we expect the model to have a good defense against all three adversarial attack methods after joint adversarial training. As shown in Tables3 and 4, the Xception model after joint adversarial training shows good accuracy against all three white- and black-box attacks while maintaining the classification accuracy of the original examples as much as possible. It can be seen that the use of joint adversarial training as a proactive defense method effectively improves the robustness of the Xception model.Table 3
Performance of Xception model after joint adversarial training on original examples and defending against white-box attacks.
AttackDFF2FFSOriginal examplesAdversarial examplesOriginal examplesAdversarial examplesOriginal examplesAdversarial examplesBIM93.3191.0494.2593.1794.1792.83PGD91.1992.8992.65FFGSM85.1986.9288.15Table 4
Performance of Xception model after joint adversarial training on defending against black-box attacks.
AttackDFF2FFSBIM89.2191.7991.72PGD90.6790.4293.25FFGSM90.1390.0492.79Finally, we test the performance of the two existing defense methods (the Lipschitz regularization method and the deep image prior method) and the proposed two defense methods against unseen adversarial attacks. To be specific, we used the FGSM attack method to carry out white- and black-box attacks on the Xception model and then used four defense methods against the attack. The experimental results are shown in Table5. It can be seen from the data in the table that the two defense methods proposed in this paper still have better defense effects against the unseen adversarial attack compared with the existing defense methods.Table 5
Performance of Xception model with defense methods on defending against FGSM attack.
AttackDefense methodDFF2FFSNoneNone96.1097.5998.22FGSM_white-boxNone54.3555.0351.25Lipschitz regularization56.2356.9155.84Deep image prior67.2868.1064.91Bilateral filter88.7092.1190.56Joint adversarial training74.3876.0973.80FGSM_black-boxNone65.2361.4455.71Lipschitz regularization66.8063.7861.02Deep image prior75.7172.1972.01Bilateral filter86.3989.8290.79Joint adversarial training78.6676.5076.12


## 4.1. Passive Defense

In the experiment, we first test the performance of four spatial smoothing methods, namely mean filtering, median filtering, Gaussian filtering, and bilateral filtering, in resisting the white-box attack. In Table1, boldfaced numbers indicate the best precision indexes. From Table 1, the four kinds of spatial filtering can improve the robustness of the target model that defends against white-box attacks. However, the bilateral filtering method shows the optimal effect under all kinds of adversarial attacks. Next, we further experiment with the effect of bilateral filtering defend against black-box attack. The results are shown in Table 2. Similarly, from Table 2, it can be found that the introduced bilateral filtering can well improve the robustness of the target model against black-box attack.When performing adversarial attacks, attackers usually try to introduce noise perturbation that is difficult to detect with naked eyes, causing the target model to misclassify. From the results of Tables1 and 2, the proposed passive defense method based on bilateral filtering can effectively perform noise reduction on the input images. The perturbations generated by the attacker are counteracted, thus rendering the adversarial attack ineffective.As we all know, the detection of existing facial manipulation detectors mostly relies on artifacts in the image, and the bilateral filtering method proposed in this paper is mainly used to denoise the image. Therefore, after the experiment, we conducted statistics on the detection of the samples. We found that the bilateral filtering method proposed in this paper does not increase the number of false-positive and false-negative samples.


## 4.2. Proactive Defense

One criterion for evaluating the performance of adversarial training is that the model after adversarial training is not only an effective defense against adversarial attacks but also has great classification accuracy for the original examples. At the same time, for our proactive defense experiment, we expect the model to have a good defense against all three adversarial attack methods after joint adversarial training. As shown in Tables3 and 4, the Xception model after joint adversarial training shows good accuracy against all three white- and black-box attacks while maintaining the classification accuracy of the original examples as much as possible. It can be seen that the use of joint adversarial training as a proactive defense method effectively improves the robustness of the Xception model.Table 3
Performance of Xception model after joint adversarial training on original examples and defending against white-box attacks.
AttackDFF2FFSOriginal examplesAdversarial examplesOriginal examplesAdversarial examplesOriginal examplesAdversarial examplesBIM93.3191.0494.2593.1794.1792.83PGD91.1992.8992.65FFGSM85.1986.9288.15Table 4
Performance of Xception model after joint adversarial training on defending against black-box attacks.
AttackDFF2FFSBIM89.2191.7991.72PGD90.6790.4293.25FFGSM90.1390.0492.79Finally, we test the performance of the two existing defense methods (the Lipschitz regularization method and the deep image prior method) and the proposed two defense methods against unseen adversarial attacks. To be specific, we used the FGSM attack method to carry out white- and black-box attacks on the Xception model and then used four defense methods against the attack. The experimental results are shown in Table5. It can be seen from the data in the table that the two defense methods proposed in this paper still have better defense effects against the unseen adversarial attack compared with the existing defense methods.Table 5
Performance of Xception model with defense methods on defending against FGSM attack.
AttackDefense methodDFF2FFSNoneNone96.1097.5998.22FGSM_white-boxNone54.3555.0351.25Lipschitz regularization56.2356.9155.84Deep image prior67.2868.1064.91Bilateral filter88.7092.1190.56Joint adversarial training74.3876.0973.80FGSM_black-boxNone65.2361.4455.71Lipschitz regularization66.8063.7861.02Deep image prior75.7172.1972.01Bilateral filter86.3989.8290.79Joint adversarial training78.6676.5076.12


## 5. Conclusions

Various facial manipulation detectors have been introduced to address the security issues associated with facial manipulation. However, most existing models are vulnerable to adversarial example attacks and obviously have security vulnerabilities. In this paper, a new defense strategy for facial manipulation detectors has been proposed to address the vulnerability of detectors defend against adversarial example attacks. Specifically, two defense methods, bilateral filtering and joint adversarial training, are introduced from both passive and proactive defenses. The bilateral filtering method can be used instantly without any modification to the model, which is very convenient and effective. While the joint adversarial training method can effectively defend against multiple adversarial attacks to make the facial manipulation detection model have better robustness. The effectiveness of the two methods is demonstrated through various comparative experiments as well as analyses. The reasons for the defense failure of a small number of adversarial examples are also analyzed qualitatively from the example perspective.For future work, we will continue to address the reasons for defense failures. And powerful defense methods will be introduced to make facial manipulation detection models more robust.



---

*Source: 4280328-2021-08-03.xml*