Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systems

Face modification systems using deep learning have become increasingly\npowerful and accessible. Given images of a person's face, such systems can\ngenerate new images of that same person under different expressions and poses.\nSome systems can also modify targeted attributes such as hair color or age.\nThis type of manipulated images and video have been coined Deepfakes. In order\nto prevent a malicious user from generating modified images of a person without\ntheir consent we tackle the new problem of generating adversarial attacks\nagainst such image translation systems, which disrupt the resulting output\nimage. We call this problem disrupting deepfakes. Most image translation\narchitectures are generative models conditioned on an attribute (e.g. put a\nsmile on this person's face). We are first to propose and successfully apply\n(1) class transferable adversarial attacks that generalize to different\nclasses, which means that the attacker does not need to have knowledge about\nthe conditioning class, and (2) adversarial training for generative adversarial\nnetworks (GANs) as a first step towards robust image translation networks.\nFinally, in gray-box scenarios, blurring can mount a successful defense against\ndisruption. We present a spread-spectrum adversarial attack, which evades blur\ndefenses. Our open-source code can be found at\nhttps://github.com/natanielruiz/disrupting-deepfakes.\n