Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples
Open accessAbstract
Recent advances in video manipulation techniques have made the generation of fake videos more accessible than ever before. Manipulated videos can fuel disinformation and reduce trust in media. Therefore detection of fake videos has garnered immense interest in academia and industry. Recently developed Deepfake detection methods rely on Deep Neural Networks (DNNs) to distinguish AI-generated fake videos from real videos. In this work, we demonstrate that it is possible to bypass such detectors by adversarially modifying fake videos synthesized using existing Deepfake generation methods. We further demonstrate that our adversarial perturbations are robust to image and video compression codecs, making them a real-world threat. We present pipelines in both white-box and black-box attack scenarios that can fool DNN based Deepfake detectors into classifying fake videos as real.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Frequency-based and blending-artifact methods are vulnerable to quality impairment and adversarial attacks.
“While these solutions provide some more insight on the type of manipulation performed, they are also very vulnerable to all quality impairment actions that disguise the low-level features they rely upon. These include not only casual image impairment processes, but also voluntary perturbations and adversarial attacks [27, 45] which are becoming more and more commonplace.”
From Audio-Visual Person-of-Interest DeepFake Detection (2023) · cites this paper as [27]
The attack results report that adversarial perturbations fooled the tested deepfake detectors, including on compressed videos (robust white-box attack results; page unavailable). But the cited paper does not establish that frequency-based or blending-artifact methods specifically are vulnerable, or that ordinary quality impairment disguises their low-level features. Its White-box Attack section instead says MJPEG compression weakened the initial attack. (LLM, conf=0.85)
Experimental — accuracy not yet measuredDeep learning-based deepfake detectors are vulnerable to adversarial attacks, with detection performance degrading sharply even in black-box scenarios.
“It is also worth pointing out that deep learning-based methods are vulnerable to adversarial attacks with detection performance that degrades sharply even in a black-box scenario [13,27,45].”
From Audio-Visual Person-of-Interest DeepFake Detection (2023) · cites this paper as [27]
Adding adversarial noise to an image can easily fool a classifier, and this applies to deepfake detectors.
“Adding adversarial noise to an image can easily fool a classifier, and this has been shown to apply also to deepfake detectors [27, 45].”
From Audio-Visual Person-of-Interest DeepFake Detection (2023) · cites this paper as [27]
Hussain et al. generated adversarial examples for each frame of a given fake video and combined them to synthesize an adversarially modified video that is classified as real by the victim DeepFake detector, which is XceptionNet and MesoNet.
“In this work, they generated adversarial examples for each frame of a given fake video and combined them to synthesize an adversarially modified video that is classified as real by the victim DeepFake detector, which is XceptionNet and MesoNet, and discussed two pipelines: white-box and black-box attack scenarios to classify the fake videos.”
From A Comprehensive Review of DeepFake Detection Using Advanced Machine Learning and Fusion Methods (2023) · cites this paper as [29]
Adversarial deepfakes can evade detectors by adding a carefully crafted perturbation to the deepfake samples.
“there have been many related works demonstrating that adversarial deepfakes can evade detectors by adding a carefully crafted perturbation to the deepfake samples”
From DEEPFAKER: A Unified Evaluation Platform for Facial Deepfake and Detection Models (2024) · cites this paper as [20]
This preprocessing increases the pixel level statistical similarity between real images and fake images and allows the forensic classifier to learn more intrinsic and meaningful features, which has better generalization capability than previous image forensics methods or image steganalysis networks.
“This increases the pixel level statistical similar- ity between real images and fake images and allows the forensic classifier to learn more intrinsic and meaning- ful features, which has better generalization capability than previous image forensics methods [75, 76] or im- age steganalysis networks [77].”
From Deep learning for deepfakes creation and detection: A survey (2022) · cites this paper as [76]
Split into 2 atoms — 0 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 61 · Cited by 204
Research works printed but not linked: 7
- R Bohme and M Kirchner. Digital image forensics: There is more to a picture than meets the eye, chapter counter- forensics: Attacking image forensics, 2013.
- Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and in- formation. In International Conference on Machine Learning, pages 2137-2146, 2018.
- Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial pertur- bations. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR), July 2017.
- Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernan- des, Bo Li, Amir Rahmati, Florian Tramèr, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. In 12th USENIX Workshop on Offensive Technologies (WOOT 18). USENIX Association, 2018.
- Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
- Justus Thies, Michael Zollhöfer, and Matthias Nießner. De- ferred neural rendering: Image synthesis using neural textures. ACM Transactions on Graphics (TOG), 38(4):1-12, 2019.
- Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through random- ization. In International Conference on Learning Representa- tions, 2018.
- Authors
- Hussain, S., Neekhara, P., Jere, M., Koushanfar, F., & McAuley, J.
- Affiliations
- University of California San Diego (US)
- Venue
- 2021 IEEE Winter Conference on Applications of Computer Vision (WACV)
- Publisher
- IEEE
- Published
- 2021-01
- Pages
- 3347-3356
- ISSN
- 2472-6737 (ISSN-L)
- OpenAlex
- W3008133425
- Cited by
- 204
- References
- 61
- Citations by year
- 2026: 20 · 2025: 30 · 2024: 44 · 2023: 35 · 2022: 39 · 2021: 23 · 2020: 12 · 2019: 1
- FWCI
- 11.51
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Winter Conference on Applications of Computer Vision (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Generative Adversarial Networks and Image Synthesis
- Keywords
- deepfake detection, adversarial examples, adversarial attacks, fake video detection, disinformation, video manipulation, adversarial perturbations, compression robustness, black-box attacks, white-box attacks, deep neural network robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
