On the Vulnerability of Deepfake Detectors to Attacks Generated by Denoising Diffusion Models
Open accessAbstract
The detection of malicious deepfakes is a constantly evolving problem that requires continuous monitoring of de-tectors to ensure they can detect image manipulations gen-erated by the latest emerging models. In this paper, we in-vestigate the vulnerability of single-image deepfake detec-tors to black-box attacks created by the newest generation of generative methods, namely Denoising Diffusion Models (DDMs). Our experiments are run on FaceForensics++, a widely used deepfake benchmark consisting of manipulated images generated with various techniques for face iden-tity swapping and face reenactment. Attacks are crafted through guided reconstruction of existing deepfakes with a proposed DDM approach for face restoration. Our findings indicate that employing just a single denoising diffusion step in the reconstruction process of a deepfake can signif-icantly reduce the likelihood of detection, all without intro-ducing any perceptible image modifications. While training detectors using attack examples demonstrated some effectiveness, it was observed that discriminators trained on fully diffusion-based deepfakes exhibited limited generalizability when presented with our attacks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Ivanovska and Struc (2024) show that even minor denoising diffusion model (DDM) adjustments may damage synthetic media detectors.
“Ivanovska and Struc (2024) discusses how denoising diffusion models (DDMs) can target deepfake detectors. It shows how even minor DDM adjustments may damage synthetic media detectors.”
From Deepfake video detection: challenges and opportunities (2024) · cites this paper as Ivanovska and Struc 2024
Cites
Spatial-Phase Shallow Learning: Rethinking Face Forgery Detection in Frequency Domain
Liu, H., Li, X., Zhou, W., Chen, Y., He, Y., Xue, H., Zhang, W., & Yu, N. (2021) · 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr46437.2021.00083 · Cited by 600 · see citing works
Detecting Deepfakes with Self-Blended Images
Shiohara, K., & Yamasaki, T. (2022) · 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52688.2022.01816 · Cited by 503 · see citing works
End-to-End Reconstruction-Classification Learning for Face Forgery Detection
Cao, J., Ma, C., Yao, T., Chen, S., Ding, S., & Yang, X. (2022) · 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52688.2022.00408 · Cited by 428 · see citing works
Diffused Heads: Diffusion Models Beat GANs on Talking-Face Generation
Stypułkowski, M., Vougioukas, K., He, S., Zięba, M., Petridis, S., & Pantic, M. (2023) · arXiv · doi:10.48550/arxiv.2301.03396 · Cited by 140
Flagged first, then by citations
Cited by
Sorted by citations
Deepfake video detection: challenges and opportunities
Kaur, A., Noori Hoshyar, A., Saikrishna, V., Firmin, S., & Xia, F. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10810-6 · Cited by 214 · see citing works
“Ivanovska and Struc (2024) discusses how denoising diffusion models (DDMs) can target deepfake detectors.”
Liu, P., Tao, Q., & Zhou, J. (2024) · Proceedings of the 1st ACM Multimedia Workshop on Multi-modal Misinformation Governance in the Era of Foundation Models · doi:10.1145/3689090.3689386 · Cited by 3 · see citing works
- Authors
- Ivanovska, M., & Štruc, V.
- Affiliations
- University of Ljubljana (SI)
- Venue
- 2024 IEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACVW)
- Publisher
- IEEE
- Published
- 2024-01-01
- Pages
- 1051-1060
- OpenAlex
- W4394862726
- Cited by
- 16
- References
- 4
- Citations by year
- 2026: 5 · 2025: 4 · 2024: 7
- FWCI
- 3.31
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACVW) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
- arXiv (Cornell University)
- Funders
- ARRS (P2-0250(B))
- Topics
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Generative Adversarial Networks and Image Synthesis
- Keywords
- deepfake detection, adversarial attacks, black-box attacks, denoising diffusion probabilistic models, face restoration, face swapping, face reenactment, FaceForensics++, detector robustness, generative adversarial training
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
