Active Fake: DeepFake Camouflage
Pu Sun Honggang Qi Yuezun Li





Journal of  Class Files, Vol. 14, No. 8, August 2021
Shell et al.: A Sample Article Using IEEEtran.cls for IEEE Journals





Active Fake: DeepFake Camouflage
    Pu Sun, Honggang Qi, Member, IEEE,  Yuezun Li, Member, IEEE

        

Honggang Qi and Yuezun Li are Corresponding authors.
Pu Sun and Honggang Qi are with the University of Chinese Academy of Sciences, China. e-mail: (sunpu21@mails.ucas.ac.cn;hgqi@ucas.ac.cn).
Yuezun Li is with the School of Computer Science and
Technology, Ocean University of China, China. e-mail: (liyuezun@ouc.edu.cn). 


    
==============================================================================================================================================================================================================================================================================================================================================================================================================




§ ABSTRACT 
DeepFake technology has gained significant attention due to its ability to manipulate facial attributes with high realism, raising serious societal concerns. Face-Swap DeepFake is the most harmful among these techniques, which fabricates behaviors by swapping original faces with synthesized ones. Existing forensic methods, primarily based on Deep Neural Networks (DNNs), effectively expose these manipulations and have become important authenticity indicators. However, these methods mainly concentrate on capturing the blending inconsistency in DeepFake faces, raising a new security issue, termed Active Fake, emerges when individuals intentionally create blending inconsistency in their authentic videos to evade responsibility. This tactic is called DeepFake Camouflage. To achieve this, we introduce a new framework for creating DeepFake camouflage that generates blending inconsistencies while ensuring imperceptibility, effectiveness, and transferability. This framework, optimized via an adversarial learning strategy, crafts imperceptible yet effective inconsistencies to mislead forensic detectors. Extensive experiments demonstrate the effectiveness and robustness of our method, highlighting the need for further research in active fake detection.



DeepFake, AI Security, Active Fake.





§ INTRODUCTION

DeepFake is a recent AI generative technique that has drawn increasing attention. It manipulates facial attributes such as identity, expression, and movement with high realism, causing serious societal concerns, such as attacks on face recognition systems <cit.>, the spread of misinformations <cit.>, and threats to societal stability <cit.>. Among these techniques, Face-Swap DeepFake is particularly notable and harmful, as it can fabricate the behavior of target identities by swapping the original face with a synthesized target face <cit.>. This technique has matured, and many Face-Swap tools have become prevalent and user-friendly, , DeepFaceLab <cit.>, Faceshifter <cit.>,  FaceSwap <cit.>, Deepswap <cit.>, and Faceswapper <cit.>. Two major steps are usually employed to create a Face-Swap DeepFake face: Firstly, the central face area is cropped out from the original face image, which is used to synthesize a target face. Secondly, this face is blended back to the original face image. Fig. <ref> illustrates the pipeline of creating Face-Swap DeepFakes.
It is important to note that the current DeepFake attacks belong to Passive Fake, where attackers maliciously use photos of victims to create fake content without their consent. 

These DeepFakes are visually indistinguishable from the naked eye, necessitating dedicated forensics methods to protect potential victims. 

The mainstream forensics methods are developed on Deep Neural Networks (DNNs), leveraging their powerful feature-capturing capacities to expose manipulation traces <cit.>. These methods have been demonstrated highly effective and are indispensable for verifying the authenticity of faces. 
Many of them are trained specifically on Face-Swap DeepFakes, allowing models to learn the specific manipulation patterns <cit.>. Since blending operations are commonly used in creating Face-Swap DeepFakes, these manipulation patterns inherently contain blending inconsistency, , the discrepancy between blended face area and authentic surroundings (validated in Sec. <ref>).
Based on this, several advanced data augmentation strategies have been explored to improve the generalization of DeepFake detection. These methods typically create pseudo-fake faces by blending various faces <cit.>. This enables models to focus more on the inconsistency introduced by blending operations.




Despite their impressive performance, these methods face a new security problem that can be exploited maliciously, which we refer to as Active Fake. Since forensic methods rely on blending inconsistency as evidence of authenticity, individuals can intentionally create inconsistency in their authentic but inappropriate videos and release them publicly. If legislative institutions investigate and hold them accountable, they can falsely claim that these videos were manipulated by DeepFake. We refer to this tactic as 


    “DeepFake Camouflage”  


Fig. <ref> illustrates the idea of DeepFake camouflage.

Note that the adversarial attacks can also be used to mislead DNN models and have been explored in several anti-forensics methods for evading DeepFake detectors <cit.>. However, these methods are limited in practical applications: 1) they are often difficult to interpret because they are typically generated by disrupting classification objectives without considering the context of Face-Swap DeepFakes. 2) they are visible since they are not related to the face content. 3) they concentrate on specific models rather than the essence of DeepFake detection, making them more overfitted to specific models (See Sec. <ref>).

In this paper, we break away from previous methods and introduce a new framework for DeepFake camouflage. Our idea is to apply simple image operations with learned parameters on real faces to introduce blending inconsistency while satisfying three key criteria: 1) imperceptibility to human observers; 2) effectiveness in deceiving the DeepFake detectors; 3) transferability across various mainstream DeepFake detectors.  

To achieve this, we propose Camouflage GAN (CamGAN), a framework designed to generate blending inconsistency that evades DeepFake detectors. Our framework comprises four key components: a configuration generator, a camouflage module, a visual discriminator, and a DeepFake detector (See Fig. <ref>). Specifically, we employ two operations to create inconsistency, Gaussian noising and Gaussian filtering. The configuration generator determines the intensity of these operations by learning to craft the appropriate parameters based on the input image. 
The camouflage module preprocesses the face area with these learned parameters and blends it into the original face image using a blending mask derived from facial landmarks. It enhances visual quality by minimizing artifacts around the blending boundary through Gaussian filtering, with parameters generated by the configuration generator. 
Training the configuration generator involves adversarial learning <cit.> with two discriminators: a visual discriminator, which ensures the camouflaged face appears visually real, and a DeepFake detector, which validates if the camouflaged face can mislead the detector. This training process is challenging as the operations within the camouflage module are not differentiable, making gradient back-propagation inapplicable. Thus, we describe a reinforcement learning-based scheme to optimize the framework. During inference, only the configuration generator and the camouflage module are needed to create camouflaged faces. 



Our contributions are summarized as follows:

    
  * We introduce a new approach, DeepFake Camouflage, to evade DeepFake detectors. Unlike conventional passive fake methods, this approach allows attackers to release authentic but inappropriate videos publicly while avoiding accountability. 
    
    
  * We propose a new generative framework (CamGAN) to achieve DeepFake Camouflage. CamGAN learns to generate appropriate preprocessing parameters to create blending inconsistency on authentic face images. This framework is adversarially trained and optimized using a reinforcement learning mechanism.
    
    
  * Extensive experiments on standard datasets, in comparison to various adversarial attacks, demonstrate the effectiveness of our method in multiple scenarios. We also thoroughly study the effect of each component, offering insights for future research in active fake.











§ BACKGROUND AND RELATED WORK



 §.§ DeepFake

DeepFake, a combination of Deep Learning and Fake Face, first appeared on Reddit in 2017<cit.>. Originally, DeepFake referred to a face-swap technique capable of generating highly realistic target identity faces and replacing the source identity faces in videos while maintaining consistent facial attributes such as expressions and orientation, as illustrated in Fig. <ref>. Nowadays, the term DeepFake has expanded to encompass all AI-generated faces, including whole face synthesis (created by GANs <cit.> and diffusion models <cit.>), face editing <cit.>, and face reenactment <cit.>. Nevertheless, among these forms, Face-Swap DeepFake has gained the most attention due to its significant negative social impacts, such as the creation of revenge porn videos <cit.>, the fabrication of inappropriate behavior by public figures <cit.>, and economic fraud <cit.>. The availability of user-friendly tools for Face-Swap DeepFakes has further lowered the barrier to making fake videos, thereby exacerbating the security risks. Therefore, this paper focuses specifically on the Face-Swap DeepFakes. 



 §.§ DeepFake Detection

To curb the misuse of DeepFake algorithms, DeepFake Detection algorithms have flourished in recent years. DeepFake Detection aims to perform binary classification on input images or videos to determine their authenticity. They could be roughly categorized as naive, spatial and frquency detectors <cit.>. Many CNN-based models are utilized in DeepFake Detection,  with data-driven training <cit.> and various strategies, such as new designed architectures <cit.>, augmentations <cit.> and preprocessing <cit.>.   <cit.> create pseudo-fake faces by blending different faces as s special data augmentation. Some DeepFake detectors specifically utilize the spatial information of images <cit.>. <cit.> introduce disentanglement learning into DeepFake detection. Nguyen  <cit.> locates the forgery region besides classify the image. <cit.> utilize capsule network to detect the images. Some other detectors fully utilize the information in  frequency domain for detection <cit.>. Qian   <cit.> propose to learn the subtle forgery patterns through frequency components partition. SPSL <cit.> utilize phase spectrum analysis to improve the classification. SRM <cit.> notice the high-frequency noise could boost the performance. To fully prove the effectiveness of our method, we perform experiments on naive, spatial, and frequency detectors.




 §.§ Evading DeepFake Detection

Existing methods for evading DeepFake detection <cit.> commonly use adversarial attacks <cit.> to add noise to the images, misleading DeepFake detectors to make incorrect predictions. While these approaches have shown promise, they suffer from several significant limitations that hinder their practical application: 1) Poor interpretability: Adversarial perturbations are typically generated by disrupting classification objectives and back-propagating gradients to the input face image. These perturbations often have little connection to the context of Face-Swap DeepFakes, making them difficult to interpret. 2) High visibility: The visibility of adversarial perturbations is closely tied to the content of the face image. However, because these attacks are designed without considering the specific facial content, they often result in highly visible artifacts. 3) Limited transferability: Adversarial attacks generally focus on targeting specific models, which can lead to overfitting and poor transferability to other models. Despite attempts to address this issue, this limitation is inherent because the design of these attacks does not align with the fundamental nature of DeepFake detection. Therefore, we depart from these existing methods and introduce a new framework to achieve DeepFake Camouflage.









§ ACTIVE FAKE: DEEPFAKE CAMOUFLAGE








 §.§ Inspiration and Preliminary Analysis


To verify the feasibility of our idea, we employ Xception <cit.> as the DeepFake detector and train it using Face-Swap DeepFake faces. As shown in Fig. <ref>, we visualize the attention of Xception on DeepFake faces using Grad-CAM <cit.>. Row (a) indicates the DeepFake faces and Row (b) exhibits corresponding Grad-CAM maps. These visualizations demonstrate that the detector mainly concentrates on the manipulated face area. In contrast, the real face images, as shown in Row (c, d), have scattered attention over the backgrounds. 

To demonstrate whether the detectors treat the blending inconsistency as important evidence of authenticity, we manually create an inconsistency by manually applying intense Gaussian filtering to the central face area of real images. The visual examples are shown in Row (e). We send these images into the detector and visualize the Grad-CAM maps. As shown in Row (f), these images are successfully identified as fake and are highlighted on the processed face area as in Row (b), demonstrating the feasibility of disrupting the detectors by introducing inconsistency. 

Nevertheless, manually designing the inconsistency is infeasible, as it can hardly maintain imperceptibility, effectiveness, and transferability. Thus we describe a learnable framework to create blending inconsistency.













 §.§ Problem Setup & Overview


Denote x_r ∈ℝ^H × W × 3 as a real clean face image and x^*_r as the camouflaged face image. Let a DeepFake detector as D. Our goal is to create imperceptible blending inconsistency on real faces, causing them to be classified as fake. This goal can be written as

    min_w ‖x^*_r -  x_r ‖_p,  s.t. D (x^*_r  ) = 0,

where ‖·‖ indicates the magnitude of the inconsistency, {0, 1} represents fake and real, respectively.

Denote the camouflage module as C. The camouflaged face can be denoted as x^*_r = C(x_r; w), where w represents the parameters learned in process. The camouflage module C
involves two steps: creating inconsistency and blending inconsistency. 


Creating Inconsistency.
To create inconsistency, we adopt two image operations: Gaussian noising and Gaussian filtering. Denote the parameters for Gaussian noising as w_gn = (μ_gn, σ_gn), where μ_gn, σ_gn correspond to the mean and standard variance. 
After adding Gaussian noise, we then apply Gaussian filtering. This operation blurs the images using a Gaussian kernel. The parameters for Gaussian filtering is denoted as w_gf = (k_gf, σ_gf), where k_gf, σ_gf correspond to the kernel size and standard variance. Denote x'_r as the face image after adding inconsistency.


Blending Inconsistency.

We blend the facial region of x'_r into the original face image x_r using a mask ℳ. This process can be described as

    x^*_r = x'_r·ℳ + x_r· (1 - ℳ).

Straightforwardly, the mask ℳ is the convex hull that includes all the facial contour landmarks, where the pixels inside the mask are set to 1 and those outside the mask are set to 0 (see Fig.<ref>). 
However, simply using this mask can introduce visible artifacts around the blending boundary, due to the color or texture discrepancy between x'_r and x_r. Inspired by <cit.>, we convert the binary mask into a soft mask by applying Gaussian filtering on mask boundary and use it for face blending. Denote the parameters for Gaussian filtering on mask as w_bl = (k_bl, σ_bl). Note that these parameters are also learned.




























 §.§ Camouflage GAN





To determine the values of parameters w = (w_gn,w_gf,w_bl), we propose a Camouflage GAN (CamGAN) that learns to generate parameters adaptive to the different face images. 



Overview and Architectures.
As shown in Fig. <ref>, this framework is composed of four key components: a configuration generator G, a camouflage module C, a visual discriminator V, and a DeepFake detector D. 

    
  - Configuration Generator. This generator is designed to create all learnable parameters w= (σ_gn, μ_gn, σ_gf, k_gf, σ_bl, k_bl). This generator is developed on Xception <cit.> with six additional parallel fully connected layers for predicting corresponding parameters. 

    
  - Camouflage Module. Given a clean real face x_r, we first apply Gaussian noising and Gaussian filtering with the learned parameters (σ_gn, μ_gn, σ_gf, k_gf). Then we create a blending mask ℳ using the following steps: We first obtain a binary mask by drawing a convex hull including all facial boundary landmarks. We then apply Gaussian filtering with the learned parameters σ_bl, k_bl  to this binary mask to obtain a soft mask as blending mask ℳ. The whole process is shown in Fig. <ref> (yellow box).
    
    
  -Visual Discriminator. This discriminator is designed to simulate the human eyes, distinguishing between images with inconsistency and not. We also employ the Xception network and output a binary classification, , whether the input face having inconsistency. The camouflaged face x^*_r and DeepFake face x_f are expected to have inconsistency, while real images x_r are not. 

    
  - DeepFake Detector. This detector serves as a discriminator for distinguishing whether a face is real or fake. Note that the camouflaged faces should be detected as fake. In our method, we directly employ the well-trained DeepFake detectors.





























 §.§ Loss functions and Training



Denote the configuration generator, the visual discriminator, and the DeepFake detector as G, V, and D, respectively. To effectively instruct the learning of CamGAN, we introduce three simple loss terms: detector spoofing loss ℒ_ ds, visual inspection loss ℒ_ vi, and visual constraint loss ℒ_ vc.

Detector Spoofing Loss.
We expect that the camouflaged face x_r^* should be able to spoof the DeepFake detector D, , misleading the prediction of x_r^* as fake. Denote 0 and 1 correspond to fake and real respectively. Therefore, the detector spoofing loss can be defined as

    L_ ds = logD(x_r^*),

where D(x_r^*) represents the probability of x_r^* being real. Minimizing this loss term can decrease the real probability of x_r^*, , being closer to label 0. Note that we directly employ well-trained DeepFake detectors and fix their parameters during training.

Visual Inspection Loss.
The visual discriminator V is designed to determine whether the given face is visually manipulated. We employ this discriminator to improve the synthesized quality in a way of adversarial learning. Specifically, given the camouflaged face x_r^*, we anticipate it can mislead this discriminator V, , being classified as real. Denote y ∈{0, 1} correspond to the label of visually fake and real respectively. This loss term can be defined as

    L_ vi =  -y logV(x_r) + (1 - y) logV(x_f) + logV(x_r^*),

where x_r and x_f denote the wild real and fake faces, and V(·) represents the probability of input face being real. By minimizing this discriminator, the camouflaged face x_r^* can be classified as fake. 


Visual Constraint Loss.
To ensure the camouflaged faces are visually similar to real faces, we design a visual constraint loss to restrict the strength of distortions. This loss term can be formulated as the ℓ_p norm distance between x_r^* and x_r, as

    ℒ_ vc = ‖x_r^* - x_r‖_p,


Overall Loss and Optimization. With these loss terms, we train CamGAN in the way of adversarial learning, which is expressed as 

    min_Gmax_V L_ ds + L_ vc - L_ vi.

Note that L_ ds, L_ vc only involve optimizing the configuration generator G, while L_ vi involves optimizing the configuration generator G and the visual discriminator V. We employ the scheme of adversarial training, which alternately optimizes G,V.

    
  * When fixing the configuration generator G, both L_ ds and L_ vc remain unchanged. During this process, we maximize -L_ vi, leading to the reduction of V(x_r^*), corresponding to classify x_r^* as fake. 

    
  * When fixing discriminator V, we minimize L_ ds + L_ vc - L_ vi by optimizing the generator G. This means that the camouflaged faces aim to 1) spoof the DeepFake detector D, , being classified as fake, 2) have minimal distortions, and 3) deceive the visual discriminator V, , being classified as real.


Reinforcement Learning Based Optimization.
It is important to note that the process in the face synthesizer is typically not differentiable, leading to gradient interruption. This challenge affects the optimization of the configuration generator G, preventing it from being optimized by standard gradient back-propagation. To resolve this, we adopt the strategy in reinforcement learning <cit.> to optimize the configuration generator G. 

Specifically, we reformulate the visual constraint loss L_ vc by disconnecting the configuration generator G with the face synthesizer and directly restricting the output of the configuration generator G. Since the generated operation parameters control the magnitude of face distortion, restricting them helps ensure the visual similarity between the camouflaged faces and real faces. 

The configuration generator G is crafted to output three sets of operation parameters as w = (w_ gn, w_ gf, w_ bl), corresponding to the Gaussian noising and Gaussian
filtering in creating inconsistency step and the Gaussian masking in blending inconsistency step. The larger magnitude of w_ gn, w_ gf introduces more intense distortions. On the contrary, the smaller magnitude of w_ bl denotes the boundary of the blending mask is sharper, introducing more blending artifacts. Therefore, the visual constraint loss is reformulated to enlarge w_ gn, w_ gf while restricting w_ bl, as expressed by

    ℒ_ vc = log (w_ gf) + log (w_ gn) - log (w_ bl).

Minimizing this equation corresponds to the better visual quality of camouflaged faces. 
We then optimize G using the following equation as

    θ_t+1 = θ_t - η·exp(ϕ(L_ ds - L_ vi))·∇_θ_tℒ_ vc,

where η is an optimization step and e^ϕ(L_ ds - L_ vi) is the penalty term, where ϕ(L_ ds - L_ vi) is a monotonically increasing function defined as

    ϕ(L_ ds - L_ vi) = sigmoid(L_ ds - L_ vi)

This approach allows the penalty term exp(ϕ(L_ ds - L_ vi)) to influence the parameters of G by optimizing Eq.(<ref>), thereby approximating the process described in Eq.(<ref>).






























 









§ EXPERIMENTS




 §.§ Experimental Setups


Datasets.
We use the training set of FaceForensics++ <cit.> to train our model. In the testing phase, for FaceForensics++ <cit.> dataset, we directly use the real faces in its testing set. Since there is no division into training and testing sets for the Celeb-DF <cit.> dataset, we choose the real faces of 10 identities as the testing set. All the faces have the size of 256 × 256 as DeepFakeBench <cit.>. 

Metrics.
We use four metrics for evaluation: ACC, SSIM, PSNR, and FID.
(1)ACC is the accuracy of the DeepFake detector in predicting whether an image is real or fake. We calculate the accuracy of various DeepFake detectors on real clean images and their corresponding camouflaged images. The greater the decrease in accuracy, the stronger the misleading effect our method has on the DeepFake detector. (2) SSIM, PSNR, and FID <cit.> are calculated between real clean images and their corresponding camouflaged images. They are used to measure the quality of camouflaged face images and how much our method has impacted the quality of the images. Higher SSIM and PSNR values, along with lower FID values, indicate smaller noise added to the camouflaged images.

Implementation Details.
We train the DeepFake detectors, Xception <cit.>, FFD <cit.>, SPSL <cit.>, and SRM <cit.>, using DeepfakeBench <cit.> with FaceForensics++ <cit.> dataset and fix their parameters as well-trained DeepFake detectors for all the subsequent experiments. These DeepFake detectors encompass naive, spatial, and frequency detectors.  Our method for Camouflage GAN is implemented using PyTorch 1.9.0 on Ubuntu 20.04 with an Nvidia 3090 GPU. In the experiments, the batch size is set as 1, for optimizer we utilize RMSProp optimizer <cit.>, the initial learning rate is set as 1.0×10^-5. When adding Gaussian noise to an image, we first normalize the image to the range of 0.0 to 1.0 by dividing 255.0. After adding Gaussian noise, we then multiply the image by 255.0.



 §.§ Results












Quantitative Results.
We conduct quantitative evaluations on our method as well as four adversarial attacks, , CW <cit.>, Jitter <cit.>, PGD <cit.>, and Pixle <cit.>, and the results are presented in Table <ref>, Table <ref>, Table <ref>, and Table <ref>. The left column in each table denotes the attack methods, , Ours-FFD represents our CamGAN trained with FFD as the DeepFake detector, and CW-FFD represents using CW to attack FFD. The top row of  Table <ref> and Table <ref> denotes which DeepFake detector is used in testing. It can be observed that our method outperforms those four adversarial attacks in terms of both white-box[The DeepFake detector being attacked and the one being tested are the same.] and black-box[The DeepFake detector being attacked and the one being tested are NOT the same.] attacks, as well as visual fidelity. Our method has a much smaller impact on image quality compared to those adversarial attacks, yet it achieves superior performance in attacking DeepFake detectors. From Table <ref> and Table <ref> we could observe that the performances of the four adversarial attacks are not stable, ,  in many black-box scenarios, the accuracy of images perturbed by other attacks tend to increase. Only CW and PGD could compare with our method in white-box scenarios, but their performance in black-box scenarios is inferior to ours. Jitter and Pixel perform worse than our method in both white-box and black-box scenarios. In contrast, our method consistently interferes with the decision-making of the DeepFake detector, especially showing stable performance in all the black-box scenarios. The stability of our approach may be attributed to the way we add noise. We use Gaussian noising and Gaussian filtering for all the camouflage operations, which are independent of the specific architecture of DeepFake detector. This reduces the risk of overfitting to a particular detector type, making our method inherently detector-agnostic.

Both qualitative and quantitative results strongly prove the superiority of our method in terms of imperceptibility, effectiveness, and transferability.








Qualitative Results. Row(a) and Row (b) in
Fig. <ref> show examples where images are classified as real before camouflage and are classified as fake after camouflage. Row (c)-(f) are images attacked by CW,
Jitter, PGD, and Pixle, respctively. From Row (b) we could observe that images processed by our method have no obvious visual artifacts. Without a close comparison with the real clean face images, it is challenging to discern artifacts in the images from Row (b).  In contrast, the images in Row (d) and Row (e) exhibit grain-like noise(which is typical of adversarial attacks) in the entire image. Although the noise in the images of Row (c) does not appear obvious and the noise in Row (f) consists of sporadic white spots, their attack success rates are not very high either. Additionally, none of these attack methods could surpass our camouflage in terms of attack success rate(See Table <ref> and Table <ref> for details). We could also observe that in our method, the noise is concentrated only in the facial region, whereas in the images processed by adversarial attacks, noise is distributed across the entire image. The visual quality of our method far exceeds or matches that of the adversarial attacks (Table <ref> and Table <ref>). The main reasons are as follows: 1) Our noise is closely related to facial texture, making it easier to be visually concealed. 2) The noise we add is Gaussian noise and through Gaussian filtering, which, compared to the irregular noise addition of the adversarial attack, appears more natural to the human eyes.




Fig. <ref> shows the different Grad-CAM maps for real clean images and those after being processed by our method. As depicted, our method successfully produce the camouflage described in Sec. <ref>. The camouflage is subtle enough not to be noticeable to the human eye but effective in deceiving the DeepFake detector. Our method causes the detector to focus on the facial region, producing Grad-CAM maps similar to those in Fig. <ref>, ultimately leading to incorrect classification. Our method effectively simulates the effects of DeepFake tampering without compromising the images' quality or any information.












 §.§ Ablation Study




Other operations to create inconsistency.
Row (a) in Fig. <ref> represents camouflaged images with affine and elastic transforms <cit.> in camouflage process. We incorporated affine and elastic transforms into the camouflage process during both training and inference stages, with their essential parameters learned by the configuration generator. As observed in Row (a), Fig. <ref>, some images exhibit more pronounced facial edge artifacts than others, reflecting variations in the parameters obtained from different image inputs to the configuration generator. Table <ref> shows that  after adding the affine and elastic transforms, the performance of our method decreases. Table <ref> also indicates a significant degradation in image quality after incorporating affine and elastic transforms. In summary, our camouflage method is already effective in evading DeepFake detectors while preserving image quality well, as demonstrated by both quantitative and qualitative tests. 













Without Visual Discriminator.
After removing the visual discriminator during the training phase, we utilized the obtained configuration generator to camouflage the images, resulting in images as shown in Row (b), Fig. <ref>. Visually, the Gaussian noise values in the facial regions of  images in Row (b) have increased, noticeably affecting visual quality. As indicated in Table <ref>, there is a slight decrease in image quality of camouflaged images after removing the visual discriminator during training. Table <ref> suggests a noticeable negative impact on accuracy, emphasizing the crucial role of the visual discriminator in successful camouflages. This also implies that better attack performance does not necessarily correlate with poorer image quality.




































 §.§ Further Analysis





Robustness.
The robustness of methods is also crucial in real-world scenarios, as images will inevitably undergo various degradations, such as compression during transmission over the 
Internet. To test the robustness our method, we apply post-processing operations to images camouflaged by our method and images perturbed by the four adversarial attacks. Specifically, we use three kinds of post-processing operations, which are JPEG compression (quality factor as 75), Gaussian filtering(sigma 0.5, kernel size 5 × 5), and Gaussian noising (sigma 0.01, mean value 0.0) respectively. We then test the accuracy of the DeepFake detectors on these post-processed images and compared it to the accuracy on the images without post-processing operations. The results are shown in Fig. <ref>. The closer the bars are to the X-axis, the lower the accuracy of the images is. Fig. <ref> shows that our method achieves the best accuracy before and after post-processing and the highest robustness. Although PGD performs slightly better than our method in some cases, overall, our approach is much more stable. In almost all cases, the robustness of our method remains relatively stable without significant fluctuations. Additionally, our method sacrifices far less in terms of visual quality compared to PGD(See Table <ref> and Table <ref>).


Handcrafted Camouflage.
To demonstrate the effectiveness of our method, we experiment with manually configuring the camouflage parameters. We randomize parameter settings for camouflaging images. The values for σ_gn, μ_gn, σ_gf, k_gf, σ_bl, and k_bl are generated completely at random.  As shown in Table <ref> and Table <ref>, there is a significant difference in the effectiveness between randomly set parameters and those generated by our trained model, demonstrating  the significance of configuration generator. 











§ CONCLUSION


This paper describes a new active fake method named DeepFake Camouflage to
evade DeepFake detectors. Specifically, we create and blend imperceptible inconsistency to the facial regions of the real images, making them be misclassified as fake. We design a new generative framework, CamGAN, for creating and blending the inconsistency. We design a strategy based on adversarial learning and reinforcement learning to train the framework. Extensive experiments on the FaceForensics++ and Celeb-DF datasets demonstrate the efficacy and superiority of our method.



Acknowledgments.
This material is based upon work supported by National Natural Science Foundation of China, NSFC No.62271466.

IEEEtran


