Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints

Abstract

Recent advances in Generative Adversarial Networks (GANs) have shown increasing success in generating photorealistic images. But they also raise challenges to visual forensics and model attribution. We present the first study of learning GAN fingerprints towards image attribution and using them to classify an image as real or GAN-generated. For GAN-generated images, we further identify their sources. Our experiments show that (1) GANs carry distinct model fingerprints and leave stable fingerprints in their generated images, which support image attribution; (2) even minor differences in GAN training can result in different fingerprints, which enables fine-grained model authentication; (3) fingerprints persist across different image frequencies and patches and are not biased by GAN artifacts; (4) fingerprint finetuning is effective in immunizing against five types of adversarial image perturbations; and (5) comparisons also show our learned fingerprints consistently outperform several baselines in a variety of setups.

arXiv commentAccepted to ICCV'19

References in corpus (23)

• GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium
• Large Scale GAN Training for High Fidelity Natural Image Synthesis
• Spectral Normalization for Generative Adversarial Networks
• Self-Attention Generative Adversarial Networks
• MesoNet: a Compact Facial Video Forgery Detection Network
• LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loop
• Toward Multimodal Image-to-Image Translation
• Stealing Machine Learning Models via Prediction APIs
• Embedding Watermarks into Deep Neural Networks
• FaceForensics: A Large-scale Video Dataset for Forgery Detection in Human Faces
• The Cramer Distance as a Solution to Biased Wasserstein Gradients
• ForensicTransfer: Weakly-supervised Domain Adaptation for Forgery Detection
• Non-Stationary Texture Synthesis by Adversarial Expansion
• GAN Dissection: Visualizing and Understanding Generative Adversarial Networks
• Texture Synthesis with Spatial Generative Adversarial Networks
• Practical Black-Box Attacks against Machine Learning
• Character-level and Multi-channel Convolutional Neural Networks for Large-scale Authorship Attribution
• Stealing Hyperparameters in Machine Learning
• A Survey of Digital Watermarking Techniques and its Applications
• Author Identification using Multi-headed Recurrent Neural Networks
• Towards Reverse-Engineering Black-Box Neural Networks
• Neural Face Editing with Intrinsic Image Disentangling
• Noiseprint: a CNN-based camera model fingerprint

Cited by in corpus (5)

• Detecting and Simulating Artifacts in GAN Fake Images
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• GANprintR: Improved Fakes and Evaluation of the State of the Art in Face Manipulation Detection
• Decentralized Attribution of Generative Models
• Towards transformation-resilient provenance detection of digital media