Black-Box Attack against GAN-Generated Image Detector with Contrastive Perturbation
This addresses security concerns for forensic systems detecting synthetic facial images, though it is an incremental improvement in adversarial attacks.
The paper tackles the vulnerability of GAN-generated image detectors by proposing a black-box attack method that uses contrastive learning to apply imperceptible perturbations, reducing the accuracy of three state-of-the-art detectors on six GANs.
Visually realistic GAN-generated facial images raise obvious concerns on potential misuse. Many effective forensic algorithms have been developed to detect such synthetic images in recent years. It is significant to assess the vulnerability of such forensic detectors against adversarial attacks. In this paper, we propose a new black-box attack method against GAN-generated image detectors. A novel contrastive learning strategy is adopted to train the encoder-decoder network based anti-forensic model under a contrastive loss function. GAN images and their simulated real counterparts are constructed as positive and negative samples, respectively. Leveraging on the trained attack model, imperceptible contrastive perturbation could be applied to input synthetic images for removing GAN fingerprint to some extent. As such, existing GAN-generated image detectors are expected to be deceived. Extensive experimental results verify that the proposed attack effectively reduces the accuracy of three state-of-the-art detectors on six popular GANs. High visual quality of the attacked images is also achieved. The source code will be available at https://github.com/ZXMMD/BAttGAND.