Hiding Faces in Plain Sight: Disrupting AI Face Synthesis with Adversarial Perturbations

Abstract

Recent years have seen fast development in synthesizing realistic human faces using AI technologies. Such fake faces can be weaponized to cause negative personal and social impact. In this work, we develop technologies to defend individuals from becoming victims of recent AI synthesized fake videos by sabotaging would-be training data. This is achieved by disrupting deep neural network (DNN) based face detection method with specially designed imperceptible adversarial perturbations to reduce the quality of the detected faces. We describe attacking schemes under white-box, gray-box and black-box settings, each with decreasing information about the DNN based face detectors. We empirically show the effectiveness of our methods in disrupting state-of-the-art DNN based face detectors on several datasets.

References in corpus (11)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• MesoNet: a Compact Facial Video Forgery Detection Network
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• FaceForensics: A Large-scale Video Dataset for Forgery Detection in Human Faces
• Black-box Adversarial Attacks with Limited Queries and Information
• In Ictu Oculi: Exposing AI Generated Fake Face Videos by Detecting Eye Blinking
• Face Detection through Scale-Friendly Deep Convolutional Networks
• Adversarial Examples that Fool Detectors
• Physical Adversarial Examples for Object Detectors
• Query-Efficient Black-box Adversarial Examples (superceded)

Cited by in corpus (6)

• Media Forensics and DeepFakes: an overview
• Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
• Fake face detection via adaptive manipulation traces extraction network
• Design and Interpretation of Universal Adversarial Patches in Face Detection
• Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Faces
• Landmark Breaker: Obstructing DeepFake By Disturbing Landmark Extraction