Towards robust DeepFake distortion attack via adversarial autoaugment

Abstract

Face forgery by DeepFake is posing a potential threat to society. Previous studies have shown that adversarial examples can effectively disrupt DeepFake models. However, the practical application of adversarial examples to defend against DeepFake is limited due to the existence of various input transformations. To address this issue, we propose a Robust DeepFake Distortion Attack (RDDA) method from the perspective of data augmentation, which uses adversarial autoaugment to generate robust and generalized adversarial examples to disrupt DeepFake. Specifically, we design an adversarial autoaugment module to synthesize diverse and challenging input transformations. Through coping with these transformations, the robustness and generalization ability of the adversarial examples in disrupting DeepFake models are greatly enhanced. In addition, we further improve the generalization ability of adversarial examples in handling specific input transformations by incremental learning. With RDDA and incremental learning, our generated adversarial examples can effectively protect personal privacy from being violated by DeepFake. Extensive experiments on public benchmarks demonstrate that our DeepFake defense method has better robustness and generalization ability than state-of-the-arts.