Malicious applications of deepfakes (i.e., technologies generating target facial attributes or entire faces from facial images) have posed a huge threat to individuals' reputation and security. To mitigate these threats, recent studies have proposed adversarial watermarks to combat deepfake models, leading them to generate distorted outputs. Despite achieving impressive results, these adversarial watermarks have low image-level and model-level transferability, meaning that they can protect only one facial image from one specific deepfake model. To address these issues, we propose a novel solution that can generate a Cross-Model Universal Adversarial Watermark (CMUA-Watermark), protecting a large number of facial images from multiple deepfake models. Specifically, we begin by proposing a cross-model universal attack pipeline that attacks multiple deepfake models iteratively. Then, we design a two-level perturbation fusion strategy to alleviate the conflict between the adversarial watermarks generated by different facial images and models. Moreover, we address the key problem in cross-model optimization with a heuristic approach to automatically find the suitable attack step sizes for different models, further weakening the model-level conflict. Finally, we introduce a more reasonable and comprehensive evaluation method to fully test the proposed method and compare it with existing ones. Extensive experimental results demonstrate that the proposed CMUA-Watermark can effectively distort the fake facial images generated by multiple deepfake models while achieving a better performance than existing methods.
翻译:为了减轻这些威胁,最近的研究提出了对抗性水印,以打击深假模型,导致产生扭曲的产出。尽管取得了令人印象深刻的结果,但这些对抗性水印的图像水平和模型水平的可转移性都很低,这意味着它们只能保护一个面部图像,使其不受一个具体深度假象模式的影响。为了解决这些问题,我们提出了一个新的解决办法,可以产生一个跨模世界反面水标记(CMUA-Watermark),保护大量面部图像不受多种深假模型的影响。具体地说,我们首先提出跨模范通用攻击管道,对多个深假模型进行迭接式攻击。然后,我们设计一个两级的扰动性放大战略,以减轻不同面部图像和模型产生的对面面面面水标记之间的冲突。此外,我们用超常化方法解决跨模版优化跨模的面水标记(CMUA-Wamark)的关键问题,以自动找到不同模型的合适步势大小攻击。我们首先提出跨模的模型,然后进一步降低现有的实验性测试结果。最后,我们提出一个拟议的C型模型测试方法,然后用更精确地比较现有的试验结果。