CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes

Authors

  • Hao Huang Peking University State Key Laboratory of Media Convergence Production Technology and Systems
  • Yongtao Wang Peking University State Key Laboratory of Media Convergence Production Technology and Systems
  • Zhaoyu Chen Fudan University
  • Yuze Zhang Peking University
  • Yuheng Li Peking University
  • Zhi Tang Peking University State Key Laboratory of Media Convergence Production Technology and Systems
  • Wei Chu Ant Group
  • Jingdong Chen Ant Group
  • Weisi Lin Nanyang Technological University, Singapore
  • Kai-Kuang Ma Nanyang Technological University, Singapore

DOI:

https://doi.org/10.1609/aaai.v36i1.19982

Keywords:

Computer Vision (CV), Philosophy And Ethics Of AI (PEAI)

Abstract

Malicious applications of deepfakes (i.e., technologies generating target facial attributes or entire faces from facial images) have posed a huge threat to individuals' reputation and security. To mitigate these threats, recent studies have proposed adversarial watermarks to combat deepfake models, leading them to generate distorted outputs. Despite achieving impressive results, these adversarial watermarks have low image-level and model-level transferability, meaning that they can protect only one facial image from one specific deepfake model. To address these issues, we propose a novel solution that can generate a Cross-Model Universal Adversarial Watermark (CMUA-Watermark), protecting a large number of facial images from multiple deepfake models. Specifically, we begin by proposing a cross-model universal attack pipeline that attacks multiple deepfake models iteratively. Then, we design a two-level perturbation fusion strategy to alleviate the conflict between the adversarial watermarks generated by different facial images and models. Moreover, we address the key problem in cross-model optimization with a heuristic approach to automatically find the suitable attack step sizes for different models, further weakening the model-level conflict. Finally, we introduce a more reasonable and comprehensive evaluation method to fully test the proposed method and compare it with existing ones. Extensive experimental results demonstrate that the proposed CMUA-Watermark can effectively distort the fake facial images generated by multiple deepfake models while achieving a better performance than existing methods. Our code is available at https://github.com/VDIGPKU/CMUA-Watermark.

Downloads

Published

2022-06-28

How to Cite

Huang, H., Wang, Y., Chen, Z., Zhang, Y., Li, Y., Tang, Z., Chu, W., Chen, J., Lin, W., & Ma, K.-K. (2022). CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes. Proceedings of the AAAI Conference on Artificial Intelligence, 36(1), 989-997. https://doi.org/10.1609/aaai.v36i1.19982

Issue

Section

AAAI Technical Track on Computer Vision I