An official implementation code for paper "Black-Box Attack against GAN-Generated Image Detector with Contrastive Perturbation"
The emergence of visually realistic GAN-generated facial images has raised concerns regarding potential misuse. In response, effective forensic algorithms have been developed to detect such synthetic images in recent years. However, the vulnerability of such forensic detectors to adversarial attacks remains an important issue that requires further investigation. In this paper, we propose a new black-box attack method against GAN-generated image detectors. It involves contrastive learning strategy to train an encoder–decoder anti-forensic network with a contrastive loss function. GAN-generated and corresponding simulated real images are constructed as positive and negative samples, respectively. By leveraging the trained attack model, we can apply imperceptible perturbation to input synthetic images for removing GAN fingerprint to some extent. GAN-generated image detectors may be deceived consequently. Extensive experimental results demonstrate that the proposed attack effectively reduces the accuracy of three state-of-the-art detectors on six popular GANs, while also achieving high visual quality of the attacked images.
Framework of BAttGAND.
The visual examples of GAN-generated images, corresponding attacked images under different attack methods. a, b, c, d, e, f is from ProGAN, StarGAN, StarGAN2, StyleGAN, StyleGAN2 and StyleGAN3, respectively.
- torch 1.7.0
- python 3.7
Wang detector: It is ResNet50 network trained on ProGAN and real image samples with strong data enhancement including compression and blur, which improves the generalization capability and robustness of detection.
Gragnaniello detector: It uses a variant Resnet50 backbone trained on ProGAN and real image samples with various types of content, such as animals, paintings and human faces. Its generalization performance is further improved with a suitable training strategy and network architectural changes, for example, removing the downsampling operation in the first layer.
Kitware detector: It is trained on StyleGAN2 and real images. Varied image representations (raw pixels and residual images) and deep learning backbones (ResNet, EfficientNet and VGG are compared experimentally and their performance keep approximate. Finally, ResNet101 is applied as backbone network in the Kitware detector.
the test dataset is collected with total 36,000 face images generated by 6 different GANs, therein 6,000 samples for each. The StyleGAN, StyleGAN2 and ProGAN images are downloaded from the public datasets shared by Nvidia Research Lab. The StarGAN, StarGAN2 and StyleGAN3 images are created by public pre-trained generators.
For example to train theBAttGAND:
python train.pyFor example to test theBAttGAND:
python test.pyIf you use this code for your research, please cite our paper
@article{lou2023black,
title={Black-box attack against GAN-generated image detector with contrastive perturbation},
author={Lou, Zijie and Cao, Gang and Lin, Man},
journal={Engineering Applications of Artificial Intelligence},
volume={124},
pages={106594},
year={2023},
publisher={Elsevier}
}
If you have any question, please feel free to contact us via [email protected].
Licensed under a Creative Commons Attribution-NonCommercial 4.0 International for Non-commercial use only. Any commercial use should get formal permission first.