Cited by 567Digital Media Forensic DetectionGenerative Adversarial Networks and Image SynthesisAdversarial Robustness in Machine Learning

Detecting and Simulating Artifacts in GAN Fake Images

Open access
Zhang, Xu, Karaman, Svebor, Chang, Shih-Fu·2019·2019 IEEE International Workshop on Information Forensics and Security (WIFS)

Abstract

To detect GAN generated images, conventional supervised machine learning algorithms require collecting a large number of real images as well as fake images generated by the targeted GAN model. However, the specific model used by the attacker is often unavailable. To address this, we propose a GAN simulator, AutoGAN, which can simulate the artifacts produced by the common pipeline shared by several popular GAN models. Additionally, we identify a unique artifact caused by the up-sampling component included in the common GAN pipelines. We show theoretically such artifacts are manifested as replications of spectra in the frequency domain and thus propose a classifier model based on the spectrum input, rather than the pixel input. By using the simulated images to train a spectrum based classifier, even without seeing the fake images produced by the targeted GAN model during training, our approach achieves state-of-the-art performances on detecting fake images generated by popular GAN models such as CycleGAN.

Integrity signals

Registry

Crossref · 10.1109/wifs47025.2019.9035107

Cites

20 of 20 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • GAN-based manipulation introduces invisible artifacts in the frequency domain.

    “Figure 7 represents the potentials of employing the frequency artifacts for detecting DeepFakes, where the GAN-based manipulation introduces invisible artifacts in the frequency domain.”

    From Countering Malicious DeepFakes: Survey, Battleground, and Horizon (2022) · cites this paper as Zhang et al. 2019

  • Due to limited data, network structure, and optimization algorithms, GANs can hardly fit the distribution of real data.

    “Due to limited data, network structure,8 and optimization algorithms,6 the GANs can hardly fit the distribution of real data.”
  • The most well-known artifact is the checkerboard effect due to image upsampling operation in GAN.

    “The most well-known artifact is the checkerboard effect due to the image upsampling operation in GAN.8”

Cites

Flagged first, then by citations

1 of the 21 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Authors
Zhang, X., Karaman, S., & Chang, S.-F.
Affiliations
Columbia University (US)
Venue
2019 IEEE International Workshop on Information Forensics and Security (WIFS)
Publisher
IEEE
Published
2019-12
Pages
1-6
ISSN
2157-4774 (ISSN-L)
OpenAlex
W3012472557
Cited by
567
References
21
Citations by year
2026: 60 · 2025: 113 · 2024: 89 · 2023: 100 · 2022: 84 · 2021: 81 · 2020: 39 · 2018: 1
FWCI
16.52
Type
conference paper
Language
en
Open access
Locations
  • IEEE International Workshop on Information Forensics and Security (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Generative Adversarial Networks and Image Synthesis
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
GAN-generated image detection, CycleGAN, adversarial image generation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review