基于三元组特征分布损失的GAN生成人脸反取证方法

doi:10.3969/j.issn.0255-8297.2026.05.007

摘要/Abstract

摘要： 针对现有生成对抗网络（generative adversarial network,GAN）生成人脸的反取证方法可转移性不强的问题，设计了三元组特征分布损失（triplet feature distribution loss,TriFDL），并据此提出一种基于TriFDL的GAN生成人脸反取证方法。该方法通过优化TriFDL训练反取证模型的扰动生成器，使扰动生成器输出的反取证人脸尽可能落入所有取证模型共同的真实人脸决策区域，从而实现对多个取证模型的欺骗并提升方法可转移性。此外，为了增强抵抗JPEG压缩的鲁棒性，在反取证模型训练过程中引入JPEG压缩模拟模块。在基于StyleGAN生成的人脸数据集上进行的实验表明，与7种已有方法相比，所提方法对黑盒模型的平均攻击效果最优，受JPEG压缩影响最小，这表明提出方法具有较强的可转移性和鲁棒性。

关键词: 生成人脸, 生成对抗网络, 反取证, JPEG压缩

Abstract: To address the limited transferability of existing anti-forensic methods for generative adversarial network (GAN)-generated faces, this study designed a triplet feature distribution loss (TriFDL) and proposed a TriFDL-based anti-forensic method for GANgenerated faces. The proposed method optimized TriFDL to train the perturbation generator in the anti-forensic model, enabling the anti-forensic faces generated by the perturbation generator to fall, as much as possible, within the common real-face decision region shared by all forensic models, thus deceiving multiple forensic models and improving transferability. In addition, to enhance robustness to JPEG compression, a JPEG compression simulation module was introduced during the training of the anti-forensic model. Experiments conducted on a dataset of StyleGAN-generated faces show that, compared with seven existing methods, the proposed method achieves the best average attack performance against black-box models and is the least affected by JPEG compression, demonstrating strong transferability and robustness.

Key words: generated face, generative adversarial network, anti-forensic, JPEG compression

中图分类号:

TP391.4

尚雨婷, 范春年, 陈北京. 基于三元组特征分布损失的GAN生成人脸反取证方法[J]. 应用科学学报, 2026, 44(5): 800-815.

SHANG Yuting, FAN Chunnian, CHEN Beijing. GAN-Generated Face Anti-forensic Method Based on Triplet Feature Distribution Loss[J]. Journal of Applied Sciences, 2026, 44(5): 800-815.

[1] Kang M, Zhu J Y, Zhang R, et al. Scaling up GANs for text-to-image synthesis [C]//IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023: 10124-10134.
[2] Karras T, Laine S, Aittala M, et al. Analyzing and improving the image quality of StyleGAN [C]//IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020: 8107- 8116.
[3] 吕婧淑, 操晓春, 杨培. 基于区块链和人脸识别的双因子身份认证模型[J]. 应用科学学报, 2019, 37(2): 164-178. Lü J S, Cao X C, Yang P. Two-factor identity authentication model based on blockchain and face recognition [J]. Journal of Applied Sciences, 2019, 37(2): 164-178. (in Chinese)
[4] 李晓龙, 俞能海, 张新鹏, 等. 数字媒体取证技术综述[J]. 中国图象图形学报, 2021, 26(6): 1216- 1226. Li X L, Yu N H, Zhang X P, et al. Overview of digital media forensics technology [J]. Journal of Image and Graphics, 2021, 26(6): 1216-1226. (in Chinese)
[5] Wang S Y, Wang O, Zhang R, et al. CNN-generated images are surprisingly easy to spot. . . for now [PP/OL]//V2. (2019-12-23) [2024-04-17]. https://arxiv.org/abs/1912.11035.
[6] Rossler A, Cozzolino D, Verdoliva L, et al. FaceForensics++: learning to detect manipulated facial images [C]//IEEE/CVF International Conference on Computer Vision (ICCV), 2019: 1- 11.
[7] Huang G, Liu Z, Van Der Maaten L, et al. Densely connected convolutional networks [C]//IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017: 2261-2269.
[8] Szegedy C, Ioffe S, Vanhoucke V, et al. Inception-v4, inception-ResNet and the impact of residual connections on learning [C]//AAAI Conference on Artificial Intelligence, 2017, 31(1): 4278-4284.
[9] Liu Z Z, Qi X J, Torr P H S. Global texture enhancement for fake face detection in the wild [C]//IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020: 8057- 8066.
[10] Wang C R, Deng W H. Representative forgery mining for fake face detection [C]//IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021: 14918-14927.
[11] 王灿军, 廖鑫, 陈嘉欣, 等. 基于卷积神经网络的面部图像修饰检测[J]. 应用科学学报, 2019, 37(5): 618-630. Wang C J, Liao X, Chen J X, et al. Research on facial modification detection algorithm based on convolutional neural network [J]. Journal of Applied Sciences, 2019, 37(5): 618-630. (in Chinese)
[12] Carlini N, Farid H. Evading deepfake-image detectors with white- and black-box attacks [C]//IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, 2020: 2804-2813.
[13] 何沛松, 李伟创, 张婧媛, 等. 面向GAN生成图像的被动取证及反取证技术综述[J]. 中国图象图形学报, 2022, 27(1): 88-110. He P S, Li W C, Zhang J Y, et al. Overview of passive forensics and anti-forensics techniques for GAN-generated image [J]. Journal of Image and Graphics, 2022, 27(1): 88-110. (in Chinese)
[14] Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks [DB/OL]. V1. (2017-06-19) [2024-04-17]. https://doi.org/10.48550/arXiv.1706.06083.
[15] Carlini N, Wagner D. Towards evaluating the robustness of neural networks [C]//IEEE Symposium on Security and Privacy, 2017: 39-57.
[16] Wang Y W, Ding X, Yang Y X, et al. Perception matters: exploring imperceptible and transferable anti-forensics for GAN-generated fake face imagery detection [J]. Pattern Recognition Letters, 2021, 146: 15-22.
[17] Yang B, Zhang H W, Li Z M, et al. Adversarial example generation with AdaBelief optimizer and crop invariance [J]. Applied Intelligence, 2023, 53(2): 2332-2347.
[18] Xiao C W, Li B, Zhu J Y, et al. Generating adversarial examples with adversarial networks [C]//International Joint Conference on Artificial Intelligence, 2018: 3905-3911.
[19] Bai T, Zhao J, Zhu J L, et al. AI-GAN: attack-inspired generation of adversarial examples [C]//IEEE International Conference on Image Processing (ICIP), 2021: 2543-2547.
[20] Zhao X W, Stamm M C. Making generated images hard to spot: a transferable attack on synthetic image detectors [PP/OL]. V1. (2021-04-25) [2024-04-17]. https://ar5iv.labs.arxiv.org/html/2104.12069.
[21] Zhang H T, Chen B J, Wang J W, et al. A local perturbation generation method for GANgenerated face anti-forensics [J]. IEEE Transactions on Circuits and Systems for Video Technology, 2023, 33(2): 661-676.
[22] Hou Y, Guo Q, Huang Y H, et al. Evading DeepFake detectors via adversarial statistical consistency [C]//IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023: 12271-12280.
[23] Dziugaite G K, Ghahramani Z, Roy D M. A study of the effect of JPG compression on adversarial images [PP/OL]. V1. (2016-08-02) [2024-04-17]. https://arxiv.org/abs/1608.00853.
[24] Das N, Shanbhogue M, Chen S T, et al. Keeping the bad guys out: protecting and vaccinating deep learning with JPEG compression [PP/OL]. V1. (2017-05-08) [2024-04-17]. https://arxiv.org/abs/1705.02900.
[25] Shin R, Song D. JPEG-resistant adversarial images [EB/OL]. [2024-04-17]. https://machinelearning-and-security.github.io/papers/mlsec17_paper_54.pdf.
[26] Liu Z W, Luo P, Wang X G, et al. Deep learning face attributes in the wild [C]//IEEE International Conference on Computer Vision (ICCV), 2015: 3730-3738.

基于三元组特征分布损失的GAN生成人脸反取证方法

GAN-Generated Face Anti-forensic Method Based on Triplet Feature Distribution Loss

PDF

可视化

摘要/Abstract

引用本文

使用本文

相关文章 12

编辑推荐

Metrics

本文评价

[1]	吴祥, 肖剑, 吉根林. 基于多尺度特征融合和注意力机制的视频异常检测方法[J]. 应用科学学报, 2025, 43(2): 234-244.
[2]	张梦君, 熊邦书. SAR-ATR系统复数对抗样本生成方法[J]. 应用科学学报, 2024, 42(5): 747-756.
[3]	王娜, 朱会娟, 宋香梅, 冯霞. 一种基于领域自适应的智能合约安全分析框架[J]. 应用科学学报, 2024, 42(4): 585-597.
[4]	秦静, 韩悦, 王立永, 季长清, 刘璐, 汪祖民. 基于GAN和MS-ResNet的房颤自动检测模型[J]. 应用科学学报, 2024, 42(1): 15-26.
[5]	张春森, 朱江乐, 张学芬, 刘旭东, 史书. 融合自注意力机制与生成对抗网络的DEM空洞填充[J]. 应用科学学报, 2023, 41(5): 789-800.
[6]	曾静, 李莹, 戚小莎, 吉根林. 多层记忆增强生成对抗网络二次预测的视频异常检测方法[J]. 应用科学学报, 2023, 41(1): 80-94.
[7]	聂江华, 肖永生, 黄丽贞, 贺丰收. 基于时频分析与深度学习的高分辨距离像雷达目标识别[J]. 应用科学学报, 2022, 40(6): 973-983.
[8]	雷前慧, 潘丽丽, 邵伟志, 胡海鹏, 黄瑶. 基于三重注意力机制的新冠肺炎病灶分割模型[J]. 应用科学学报, 2022, 40(1): 105-115.
[9]	刘星宏, 王英, 王鑫, 兰书梅. 基于生成对抗网络的异质信息网络表征学习[J]. 应用科学学报, 2021, 39(4): 532-544.
[10]	朱翌明, 陈帆, 和红杰, 陈鸿佑. 基于秘密信息驱动的正交GAN信息隐藏模型[J]. 应用科学学报, 2019, 37(5): 721-732.
[11]	刘明明, 张敏情, 刘佳, 高培贤, 张英男. 基于生成对抗网络的无载体信息隐藏[J]. 应用科学学报, 2018, 36(2): 371-382.
[12]	李晟;张新鹏. 利用JPEG压缩特性的合成图像检测[J]. 应用科学学报, 2008, 26(3): 281-281 .