TLDR: A new research paper introduces a “multiplicative attack” method that makes DeepFakes untraceable by fundamentally eliminating the unique digital fingerprints left by generative AI models. Unlike previous “additive attacks” that merely obscure these traces, this new approach makes it nearly impossible for forensic tools to identify the source model, even against advanced defensive measures. The method achieves a high success rate while maintaining image quality.
DeepFakes, realistic synthetic media created by artificial intelligence, have become increasingly sophisticated. While these advancements offer creative possibilities, they also raise concerns about misinformation and intellectual property infringement. To counter this, researchers have developed ‘DeepFakes attribution’ technologies, which aim to identify the specific generative AI model (GM) used to create a DeepFake by detecting unique digital ‘fingerprints’ left within the images.
However, a new research paper titled “Untraceable DeepFakes via Traceable Fingerprint Elimination” introduces a novel attack method that can make DeepFakes virtually untraceable, posing a significant challenge to current forensic capabilities. The paper, authored by Jiewei Lai, Lan Zhang, Chen Tang, Pengcheng Sun, and Xinming Wang from the University of Science and Technology of China, and Yunhao Wang from Lenovo Research, delves into the limitations of existing attack strategies and proposes a more fundamental approach.
The Problem with Existing Attacks
Previous attempts to evade DeepFakes attribution models (AMs) have largely relied on what the authors call ‘additive attacks.’ These methods work by adding small, carefully crafted perturbations (like noise) to a DeepFake image. While these perturbations can confuse attribution models, the underlying digital fingerprint of the generative model remains intact within the image. This makes additive attacks vulnerable to defensive measures, such as adversarial training, which can teach AMs to see through these added disturbances.
The researchers conducted experiments showing that additive attacks, like TraceEvader, saw their success rates drop significantly when faced with defensive mechanisms. Furthermore, frequency analysis revealed that images subjected to additive attacks still retained strong similarities in their frequency domain with the original DeepFakes, indicating the persistence of the model fingerprint.
Introducing the Multiplicative Attack
The core innovation of this paper is the concept of a ‘multiplicative attack.’ Unlike additive attacks that add to an image, a multiplicative attack fundamentally alters the image by applying an ‘adversarial matrix.’ This operation, in essence, eliminates the original traceable fingerprint within the DeepFake, rather than just obscuring it. By doing so, the altered fingerprint becomes distinct from the original, making it impossible for attribution models to trace the image back to its source GM.
The paper provides theoretical evidence for the existence of such multiplicative adversarial matrices and argues that defending against them is inherently difficult. Inverting a multiplicatively attacked image to recover the original content would require knowing the specific adversarial matrix used, which is computationally prohibitive and practically infeasible for defenders.
A Universal and Black-Box Framework
To implement this multiplicative attack, the researchers designed a universal and black-box attack framework. This means the attack method is applicable to DeepFakes generated by various GMs and can evade AMs without prior knowledge of their specific mechanisms. Crucially, the adversarial model is trained using only real data, eliminating the need for access to DeepFakes or generative models during its development.
The framework consists of two main modules: a data synthesis module and a model construction module. The data synthesis module creates synthetic data that mimics the characteristics of DeepFakes by introducing artificial fingerprints through sampling and transformation operations (like resizing, blurring, noise addition, and JPEG compression). The model construction module then trains an adversarial model to eliminate these artificial fingerprints from the synthetic data while preserving the visual quality of the images. This training involves optimizing a comprehensive loss function across perceptual, spatial, and frequency domains.
Once trained, this adversarial model acts as the multiplicative matrix. When applied to a DeepFake, it effectively eliminates the original GM’s fingerprint, rendering the image untraceable. An additional smoothing operation is applied to further enhance evasion capabilities and reduce any remaining imperfections.
Also Read:
- Protecting Your Data: New AI Method Generates Unlearnable Examples from Text Alone
- VideoGuard: A New Defense Against Unauthorized Video Editing
Outstanding Results and Future Challenges
The experimental results are compelling. The proposed multiplicative attack achieved an average attack success rate (ASR) of 97.08% against six advanced attribution models and DeepFakes generated by nine different generative models (including GANs and Diffusion Models). This significantly outperforms existing state-of-the-art methods.
Even more remarkably, the method demonstrated strong effectiveness against defensive mechanisms. In black-box scenarios (where the defender is unaware of this specific attack), the ASR remained over 72.39%. In white-box scenarios (where the defender has full knowledge of the attack), the ASR even reached 100% against certain defenses, highlighting the profound difficulty in countering this new approach.
The attack also successfully preserved image fidelity, with high SSIM and low LPIPS values, indicating that the untraceable DeepFakes are visually indistinguishable from their original counterparts. While the method requires more modifications to the image compared to additive attacks, these changes do not impact visual perception.
This research underscores the evolving arms race between DeepFake generation and detection/attribution. The introduction of multiplicative attacks presents a significant challenge for forensic technologies and emphasizes the urgent need for developing more robust and advanced attribution mechanisms to maintain accountability in the age of synthetic media. For more details, you can read the full paper here.
