Exploring the Adversarial Robustness of Face Forgery Detection with Decision-based Black-box Attacks
This work addresses security concerns in applications like electronic payment and identity verification by exposing vulnerabilities in deployed face forgery detection systems, though it is incremental as it builds on existing attack methods.
The paper tackles the vulnerability of face forgery detectors to adversarial attacks by proposing decision-based black-box attacks that overcome initialization and quality issues, achieving state-of-the-art performance on benchmarks like FaceForensics++ and CelebDF with high query efficiency and maintained image quality.
Face forgery generation technologies generate vivid faces, which have raised public concerns about security and privacy. Many intelligent systems, such as electronic payment and identity verification, rely on face forgery detection. Although face forgery detection has successfully distinguished fake faces, recent studies have demonstrated that face forgery detectors are very vulnerable to adversarial examples. Meanwhile, existing attacks rely on network architectures or training datasets instead of the predicted labels, which leads to a gap in attacking deployed applications. To narrow this gap, we first explore the decision-based attacks on face forgery detection. We identify challenges in directly applying existing decision-based attacks, such as perturbation initialization failure and reduced image quality. To overcome these issues, we propose cross-task perturbation to handle initialization failures by utilizing the high correlation of face features on different tasks. Additionally, inspired by the use of frequency cues in face forgery detection, we introduce the frequency decision-based attack. This attack involves adding perturbations in the frequency domain while constraining visual quality in the spatial domain. Finally, extensive experiments demonstrate that our method achieves state-of-the-art attack performance on FaceForensics++, CelebDF, and industrial APIs, with high query efficiency and guaranteed image quality. Further, the fake faces by our method can pass face forgery detection and face recognition, which exposes the security problems of face forgery detectors.