Sure, DeepFake Detectors Exist - But Can They Be Fooled?

Dear fellow scholars, this is two minute papers with Dr. Zsolnai. With the ascendancy of neural network based learning algorithms, we are now able to take on and defeat problems that sounded completely impossible just a few years ago. For instance, now we can create deepfakes, or in other words, we can record a short video of ourselves and transfer our gestures to a target subject. And this particular technique is so advanced that we don't even need a video of our target, just one still image. So we can even use paintings, images of sculptures. So yes, even the Mona Lisa works. However, don't despair, it's not all doom and gloom. A paper by the name faceforensics contains a large dataset of original and manipulated video pairs. As this offered a ton of training data for real and forged videos, it became possible to use these to train a deepfake detector. You can see it here in action as these green to red colors showcase regions that the AI correctly thinks were tampered with. However, if we have access to a deepfake detector, we can also use it to improve our deepfake creating algorithms. And with this, an arms race has begun. The paper we are looking at today showcases this phenomenon. If you look here, you see this footage, which is very visibly fake. And the algorithm correctly concludes that. Now if you look at this video, which for us looks like if it were the same video, yet it suddenly became real. At least the AI thinks that, of course, incorrectly. This is very confusing. So what really happened here? To understand what is going on here, we first have to talk about ostriches. So what do ostriches have to do with this insanity? Let me try to explain that an adversarial attack on a neural network can be performed as we present such a classifier network with an image of a bus. And it will successfully tell us that yes, this is indeed a bus. Nothing too crazy here. Now we show it not an image of a bus, but a bus, plus some carefully crafted noise that is barely perceptible that forces the neural network to misclassify it as an ostrich. I will stress that this is not any kind of noise, but the kind of noise that exploits biases in the neural network, which is by no means trivial to craft. However, if we succeed at that, this kind of adversarial attack can be pulled off on many different kinds of images. Everything that you see here on the right will be classified as an ostrich by the neural network these noise patterns were created for. And this can now be done not only on images, but but videos as well. Hence, what happened a minute ago is that the deepfake video has been adversarially modified with noise to bypass such a detector. If you look here, you see that the authors have chosen excellent examples because some of these are clearly forged videos which is initially recognized by the detector algorithm. But after adding the adversarial noise to it, the detector fails spectacularly to demonstrate the utility of their technique, they have chosen the other examples to be much more subtle. Now let's talk about one more question. We were talking about a detector algorithm, but there is not one detector out there, there are many, and we can change the wiring of these neural networks to have even more variation. So what does it mean to fool a detector? Excellent question. The success rate of these adversarial videos indeed depends on the deepfake detector we are up against and but hold on to your papers because this success rate on uncompressed videos is over 98%, which is amazing. But note that when using video compression this success rate may drop to 58 to 92% depending on the detector. This means that video compression and some other tricks involving image transformations still help us in defending against these adversarial attacks. What I also really like about the paper is that it discusses white and black box attacks separately. In the white box case we know everything about the inner workings of the detector, including the neural network architecture and parameters. This is typically the easier case, but the technique also does really well in the black box case where we are not allowed to look under the hood of the detector, but we can show it a few videos and see how it reacts to them. This is a really cool work that gives us a more nuanced view about the current state of the art around deepfakes and deepfake detectors. I think it is best if we all know about the fact that these tools exist. If you wish to help us with this endeavor, please make sure to share this with your friends. Thank you. This episode has been supported by Lamda. If you are a researcher or a startup looking for cheap GPU compute to run these algorithms, check out Lambda GPU Cloud. I've talked about Lambda's GPU workstations in other videos and I'm happy to tell you that they are offering GPU cloud services as well. The Lambda GPU Cloud can train ImageNet to 93% accuracy for less than $19. Lambda's web based IDE lets you easily access your instance right in your browser and finally hold on to your papers. Because the Lambda GPU cloud costs less than half of AWS and and Azure. Make sure to go to lambdalabs.compapers and sign up for one of their amazing GPU instances today. Our thanks to Lambda for helping us make better videos for you. Thanks for watching and for your generous support, and I'll see you next time.