Adversarial Threats to DeepFake Detection: A Practical Perspective
Open accessAbstract
Facially manipulated images and videos or DeepFakes can be used maliciously to fuel misinformation or defame individuals. Therefore, detecting DeepFakes is crucial to increase the credibility of social media platforms and other media sharing web sites. State-of-the art DeepFake detection techniques rely on neural network based classification models which are known to be vulnerable to adversarial examples. In this work, we study the vulnerabilities of state-of-the-art DeepFake detection methods from a practical stand point. We perform adversarial attacks on DeepFake detectors in a black box setting where the adversary does not have complete knowledge of the classification models. We study the extent to which adversarial perturbations transfer across different models and propose techniques to improve the transferability of adversarial examples. We also create more accessible attacks using Universal Adversarial Perturbations which pose a very feasible attack scenario since they can be easily shared amongst attackers. We perform our evaluations on the winning entries of the DeepFake Detection Challenge (DFDC) and demonstrate that they can be easily bypassed in a practical attack scenario by designing transferable and accessible adversarial attacks.1
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Frequency-based and blending-artifact methods are vulnerable to quality impairment and adversarial attacks.
“While these solutions provide some more insight on the type of manipulation performed, they are also very vulnerable to all quality impairment actions that disguise the low-level features they rely upon. These include not only casual image impairment processes, but also voluntary perturbations and adversarial attacks [27, 45] which are becoming more and more commonplace.”
From Audio-Visual Person-of-Interest DeepFake Detection (2023) · cites this paper as [45]
Sections 3.3 and 4.3 report successful adversarial attacks against the DeepFake detectors studied, supporting the adversarial-attack portion of the claim. Our copy does not establish that frequency-based or blending-artifact methods specifically are vulnerable, or that ordinary quality impairment defeats them; Section 3.4 uses resizing and noise to test the robustness of attacks, not to demonstrate those impairments defeat detectors. Page numbers are unavailable in our copy. (LLM, conf=0.84)
Experimental — accuracy not yet measuredDF detectors are increasingly vulnerable to adversarial attacks, which introduce carefully crafted perturbations into DF content to deceive detection systems while remaining imperceptible to humans.
“DF detectors are increasingly vulnerable to adversarial attacks, which introduce carefully crafted perturbations into DF content to deceive detection systems while remaining imperceptible to humans.”
From Deepfake detection across image, video, and audio: a comprehensive survey with empirical evaluation of generalization and robustness (2026) · cites this paper as [199]
The Abstract reports that adversarial attacks can bypass DeepFake detectors, and §4.3 (page unavailable) describes successful attacks with perturbations that are visually fairly imperceptible. The paper does not establish that detectors are becoming increasingly vulnerable over time; §4.4 also notes that some successful universal perturbations are more perceptible. (LLM, conf=0.87)
Experimental — accuracy not yet measuredNeekhara et al. (2021) provided a practical perspective focusing on adversarial threats to DeepFake detection; by studying commonalities between detection methods using gradient-based saliency maps, they can create adversarial examples highly transferable across different DeepFake detection methods, revealing vulnerabilities of DeepFake detectors.
“Neekhara et al. (2021) provided a practical perspective that focuses on the adversarial threats to DeepFake detection. By studying the commonalities between various DeepFake detection methods by interpreting the model decisions using gradient-based saliency maps, the authors can create adversarial examples that are highly transferable across different DeepFake detection methods, revealing the”
From Countering Malicious DeepFakes: Survey, Battleground, and Horizon (2022) · cites this paper as Neekhara et al. (2021)
Neekhara et al. (2021) find that input-preprocessing steps and face detection methods across DeepFake detectors make adversarial transferability difficult.
“Neekhara et al. (2021) further study the adversarial attack-based evasion methods on the more challenging DeepFake Detection Challenge (DFDC) dataset (Dolhansky et al. 2020) and find that the input-preprocessing steps, as well as face detection methods across DeepFake detectors, make the adversarial transferability difficult.”
From Countering Malicious DeepFakes: Survey, Battleground, and Horizon (2022) · cites this paper as Neekhara et al. 2021
Deep learning-based deepfake detectors are vulnerable to adversarial attacks, with detection performance degrading sharply even in black-box scenarios.
“It is also worth pointing out that deep learning-based methods are vulnerable to adversarial attacks with detection performance that degrades sharply even in a black-box scenario [13,27,45].”
From Audio-Visual Person-of-Interest DeepFake Detection (2023) · cites this paper as [45]
Adding adversarial noise to an image can easily fool a classifier, and this applies to deepfake detectors.
“Adding adversarial noise to an image can easily fool a classifier, and this has been shown to apply also to deepfake detectors [27, 45].”
From Audio-Visual Person-of-Interest DeepFake Detection (2023) · cites this paper as [45]
Recent studies have demonstrated that even SoTA detection models can be significantly compromised by adversarial examples.
“Recent studies have demonstrated that even SoTA detection models can be significantly compromised by adversarial examples (AEs) [21, 197-199].”
From Deepfake detection across image, video, and audio: a comprehensive survey with empirical evaluation of generalization and robustness (2026) · cites this paper as [199]
Many tested deepfake detectors fail to accurately identify deepfakes under adversarial attacks.
“The results reveal significant vulnerabilities in the tested detectors, with many failing to identify deepfakes under adversarial attacks accurately.”
From Deepfake forensics: a survey of digital forensic methods for multimodal deepfake identification on social media (2024) · cites this paper as Neekhara et al. (2021)
Existing works have investigated the evasion and transferability of adversarial deepfakes in the lab setting.
“existing works have investigated the evasion and transferability of adversarial deepfakes in the lab setting”
From DEEPFAKER: A Unified Evaluation Platform for Facial Deepfake and Detection Models (2024) · cites this paper as [46]
Adversarial deepfakes can evade detectors by adding a carefully crafted perturbation to the deepfake samples.
“there have been many related works demonstrating that adversarial deepfakes can evade detectors by adding a carefully crafted perturbation to the deepfake samples”
From DEEPFAKER: A Unified Evaluation Platform for Facial Deepfake and Detection Models (2024) · cites this paper as [46]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Xception: Deep Learning with Depthwise Separable Convolutions
Chollet, F. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.195 · Cited by 20,380 · see citing works
EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks
Tan, M., & Le, Q. V. (2019) · arXiv · doi:10.48550/arxiv.1905.11946 · Cited by 17,072 · see citing works
A Style-Based Generator Architecture for Generative Adversarial Networks
Karras, T., Laine, S., & Aila, T. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00453 · Cited by 11,714 · see citing works
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Joint Face Detection and Alignment Using Multitask Cascaded Convolutional Networks
Zhang, K., Zhang, Z., Li, Z., & Qiao, Y. (2016) · IEEE Signal Processing Letters · doi:10.1109/lsp.2016.2603342 · Cited by 6,214 · see citing works
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
Practical Black-Box Attacks against Machine Learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495 · see citing works
FaceForensics++: Learning to Detect Manipulated Facial Images
Rossler, A., Cozzolino, D., Verdoliva, L., Riess, C., Thies, J., & Niessner, M. (2019) · 2019 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00009 · Cited by 3,314 · see citing works
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,123 · see citing works
Universal Adversarial Perturbations
Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., & Frossard, P. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.17 · Cited by 2,680 · see citing works
MesoNet: a Compact Facial Video Forgery Detection Network
Afchar, D., Nozick, V., Yamagishi, J., & Echizen, I. (2018) · 2018 IEEE International Workshop on Information Forensics and Security (WIFS) · doi:10.1109/wifs.2018.8630761 · Cited by 1,872 · see citing works
RetinaFace: Single-Shot Multi-Level Face Localisation in the Wild
Deng, J., Guo, J., Ververas, E., Kotsia, I., & Zafeiriou, S. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00525 · Cited by 1,681 · see citing works
Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
Papernot, N., McDaniel, P., & Goodfellow, I. (2016) · arXiv · doi:10.48550/arxiv.1605.07277 · Cited by 1,326 · see citing works
The Emergence of Deepfake Technology: A Review
Westerlund, M. (2019) · Technology Innovation Management Review · doi:10.22215/timreview/1282 · Cited by 1,138 · see citing works
Media Forensics and DeepFakes: An Overview
Verdoliva, L. (2020) · IEEE Journal of Selected Topics in Signal Processing · doi:10.1109/jstsp.2020.3002101 · Cited by 979 · see citing works
Exposing DeepFake Videos By Detecting Face Warping Artifacts
Li, Y., & Lyu, S. (2018) · arXiv · doi:10.48550/arxiv.1811.00656 · Cited by 785 · see citing works
FSGAN: Subject Agnostic Face Swapping and Reenactment
Nirkin, Y., Keller, Y., & Hassner, T. (2019) · 2019 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00728 · Cited by 706 · see citing works
Few-Shot Adversarial Learning of Realistic Neural Talking Head Models
Zakharov, E., Shysheya, A., Burkov, E., & Lempitsky, V. (2019) · 2019 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00955 · Cited by 687 · see citing works
Li, J., Wang, Y., Wang, C., Tai, Y. Y., Qian, J., Yang, J., Wang, C., Li, J., & Huang, F. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00520 · Cited by 510 · see citing works
Synthesizing Robust Adversarial Examples
Athalye, A., Engstrom, L., Ilyas, A., & Kwok, K. (2018) · International Conference on Machine Learning · Cited by 432 · see citing works
The deepfake detection challenge (dfdc) dataset
Dolhansky, B., Bitton, J., Pflaum, B., Lu, J., Howes, R., Wang, M., & Ferrer, C. C. (2020) · arXiv · doi:10.48550/arxiv.2006.07397 · Cited by 427 · see citing works
Self-citationDeepfake Video Detection through Optical Flow Based CNN
Amerini, I., Galteri, L., Caldelli, R., & Del Bimbo, A. (2019) · 2019 IEEE/CVF International Conference on Computer Vision Workshop (ICCVW) · doi:10.1109/iccvw.2019.00152 · Cited by 424 · cited 5× · see citing works
“com/c/deepfake-detection-challenge ral Networks [1, 2, 19, 32, 34] to distinguish AI-generated fake videos from real videos.”
BackgroundInfluentialThe Deepfake Detection Challenge (DFDC) Preview Dataset
Dolhansky, B., Howes, R., Pflaum, B., Baram, N., & Ferrer, C. C. (2019) · arXiv · doi:10.48550/arxiv.1910.08854 · Cited by 413 · see citing works
Self-citationDistinguishing computer graphics from natural images using convolution neural networks
Rahmouni, N., Nozick, V., Yamagishi, J., & Echizen, I. (2017) · IEEE International Workshop on Information Forensics and Security · doi:10.1109/wifs.2017.8267647 · Cited by 335 · see citing works
Transferable Adversarial Perturbations
Zhou, W., Hou, X., Chen, Y., Tang, M., Huang, X., Gan, X., & Yang, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01264-9_28 · Cited by 256 · see citing works
Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples
Hussain, S., Neekhara, P., Jere, M., Koushanfar, F., & McAuley, J. (2021) · 2021 IEEE Winter Conference on Applications of Computer Vision (WACV) · doi:10.1109/wacv48630.2021.00339 · Cited by 204 · see citing works
Self-citationImproving Black-box Adversarial Attacks with a Transfer-based PriorPreprint
Cheng, S., Dong, Y., Pang, T., Su, H., & Zhu, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.06919 · Cited by 199 · see citing works
Evading Deepfake-Image Detectors with White- and Black-Box Attacks
Carlini, N., & Farid, H. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw50498.2020.00337 · Cited by 170 · see citing works
Adversarial Perturbations Fool Deepfake Detectors
Gandhi, A., & Jain, S. (2020) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn48605.2020.9207034 · Cited by 158 · see citing works
Fast Feature Fool: A data independent approach to universal adversarial perturbations
Mopuri, K. R., Garg, U., & Babu, R. V. (2017) · NOT FOUND REPOSITORY (Indian Institute of Science Bangalore) · doi:10.48550/arxiv.1707.05572 · Cited by 137 · see citing works
Universal Adversarial Perturbations for Speech Recognition Systems
Neekhara, P., Hussain, S., Pandey, P., Dubnov, S., McAuley, J., & Koushanfar, F. (2019) · Interspeech (USB) · doi:10.21437/interspeech.2019-1353 · Cited by 128 · see citing works
Self-citationUniversal Adversarial Attacks on Text Classifiers
Behjati, M., Moosavi-Dezfooli, S.-M., Baghshah, M. S., & Pascal Frossard, B. (2019) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2019.8682430 · Cited by 105 · see citing works
Curls & Whey: Boosting Black-Box Adversarial Attacks
Shi, Y., Wang, S., & Han, Y. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00668 · Cited by 103 · see citing works
Universal Adversarial Perturbation via Prior Driven Uncertainty Approximation
Liu, H., Ji, R., Li, J., Zhang, B., Gao, Y., Wu, Y., & Huang, F. (2019) · 2019 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00303 · Cited by 95 · see citing works
Ask, Acquire, and Attack: Data-Free UAP Generation Using Class Impressions
Mopuri, K. R., Uppala, P. K., & Babu, R. V. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-01240-3_2 · Cited by 86 · see citing works
Flagged first, then by citations
Research works printed but not linked: 7
- Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks. In International Conference on Learning Rep- resentations (ICLR), 2017. 3
- Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturba- tions. In Conference on Computer Vision and Pattern Recog- nition (CVPR), 2017. 3, 5
- Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Prac- tical black-box attacks against machine learning. In ACM on Asia Conference on Computer and Communications Se- curity, 2017. 3
- Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernan- des, Bo Li, Amir Rahmati, Florian Tramèr, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. In USENIX Workshop on Offensive Technologies, 2018. 3
- J.T. Springenberg, A. Dosovitskiy, T. Brox, and M. Ried- miller. Striving for simplicity: The all convolutional net. In International Conference on Learning Representations (ICLR), 2015. 2
- Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. In- triguing properties of neural networks. In International Con- ference on Learning Representations (ICLR), 2014. 1, 3
- Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xi- angqi Huang, Xiang Gan, and Yong Yang. Transferable ad- versarial perturbations. In European Conference on Com- puter Vision (ECCV), pages 452-467, 2018.
Cited by
Sorted by citations
Masood, M., Nawaz, M., Malik, K. M., Javed, A., Irtaza, A., & Malik, H. (2023) · Applied Intelligence · doi:10.1007/s10489-022-03766-z · Cited by 543 · see citing works
Deepfake video detection: challenges and opportunities
Kaur, A., Noori Hoshyar, A., Saikrishna, V., Firmin, S., & Xia, F. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10810-6 · Cited by 214 · see citing works
“So , there is an opportunity to develop deepfake detectors that are more resistant to changes made by adversaries (Hou et al. 2021; Rao et al. 2021; Neekhara et al. 2021).”
Countering Malicious DeepFakes: Survey, Battleground, and Horizon
Juefei-Xu, F., Wang, R., Huang, Y., Guo, Q., Ma, L., & Liu, Y. (2022) · International Journal of Computer Vision · doi:10.1007/s11263-022-01606-8 · Cited by 191 · see citing works
“Neekhara et al. (2021) further study the adversarial attack-based evasion methods on the more challenging DeepFake Detection Challenge (DFDC) dataset (Wikipedia, 2021a).”
BackgroundMethodAudio-Visual Person-of-Interest DeepFake Detection
Cozzolino, D., Pianese, A., Nießner, M., & Verdoliva, L. (2023) · 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw59228.2023.00101 · Cited by 104 · see citing works
Exploring Frequency Adversarial Attacks for Face Forgery Detection
Jia, S., Ma, C., Yao, T., Yin, B., Ding, S., & Yang, X. (2022) · 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52688.2022.00407 · Cited by 97 · see citing works
Evading DeepFake Detectors via Adversarial Statistical Consistency
Hou, Y., Guo, Q., Huang, Y., Xie, X., Ma, L., & Zhao, J. (2023) · 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52729.2023.01181 · Cited by 76 · see citing works
Qureshi, S. M., Saeed, A., Almotiri, S. H., Ahmad, F., & Al Ghamdi, M. A. (2024) · PeerJ Computer Science · doi:10.7717/peerj-cs.2037 · Cited by 71 · see citing works
DEEPFAKER: A Unified Evaluation Platform for Facial Deepfake and Detection Models
Wang, L., Meng, X., Li, D., Zhang, X., Ji, S., & Guo, S. (2024) · ACM Transactions on Privacy and Security · doi:10.1145/3634914 · Cited by 11 · see citing works
Liu, P., Tao, Q., & Zhou, J. (2024) · Proceedings of the 1st ACM Multimedia Workshop on Multi-modal Misinformation Governance in the Era of Foundation Models · doi:10.1145/3689090.3689386 · Cited by 3 · see citing works
Nguyen-Le, H.-H., Tran, V.-T., Nguyen, D.-T., & Le-Khac, N.-A. (2026) · Artificial Intelligence Review · doi:10.1007/s10462-026-11608-4 · Cited by 1 · see citing works
- Authors
- Neekhara, P., Dolhansky, B., Bitton, J., & Ferrer, C. C.
- Affiliations
- University of California San Diego (US)
- Venue
- 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW)
- Publisher
- IEEE
- Published
- 2021-06
- Pages
- 923-932
- OpenAlex
- W3101239181
- Cited by
- 117
- References
- 38
- Citations by year
- 2026: 17 · 2025: 27 · 2024: 30 · 2023: 14 · 2022: 20 · 2021: 7 · 2019: 1 · 2018: 1
- FWCI
- 8.20
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Keywords
- deepfake detection, adversarial attacks, black-box attacks, adversarial example transferability, universal adversarial perturbations, face manipulation, misinformation, DFDC, neural network vulnerabilities, social media credibility
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
