Adversarial example is a rising way of protecting facial privacy security from deepfake modification. To prevent massive facial images from being illegally modified by various deepfake models, it is essential to design a universal deepfake disruptor. However, existing works treat deepfake disruption as an End-to-End process, ignoring the functional difference between feature extraction and image reconstruction, which makes it difficult to generate a cross-model universal disruptor. In this work, we propose a novel Feature-Output ensemble UNiversal Disruptor (FOUND) against deepfake networks, which explores a new opinion that considers attacking feature extractors as the more critical and general task in deepfake disruption. We conduct an effective two-stage disruption process. We first disrupt multi-model feature extractors through multi-feature aggregation and individual-feature maintenance, and then develop a gradient-ensemble algorithm to enhance the disruption effect by simplifying the complex optimization problem of disrupting multiple End-to-End models. Extensive experiments demonstrate that FOUND can significantly boost the disruption effect against ensemble deepfake benchmark models. Besides, our method can fast obtain a cross-attribute, cross-image, and cross-model universal deepfake disruptor with only a few training images, surpassing state-of-the-art universal disruptors in both success rate and efficiency.
翻译:反versarial 实例是保护面部隐私安全免遭深假变形的日益增强的方法。 为了防止大规模面部图像被各种深假模型非法修改,必须设计一个普遍的深假干扰器。 但是,现有的作品将深假干扰作为一种端到端的过程,忽视特征提取和图像重建之间的功能差异,从而难以产生一个跨模范的全局干扰器。 在这项工作中,我们提议针对深假网络采用一种新的特质-产出共合体(FOUND)来对付深假网络,这种网络探索一种新观点,认为攻击特征提取器是深假干扰器中更为关键和一般的任务。 我们开展一个有效的两阶段干扰过程。 我们首先通过多功能集聚和个人能力维护来破坏多模型特征提取器,然后开发一种梯度多元化算法,通过简化破坏多个端对端到端模型的复杂优化问题来增强破坏效果。 广泛的实验表明,FOUND能够大大地增强对可调深假的特征提取器的干扰效应,我们的方法可以快速地在深度建模中进行跨级的培训。</s>