The pervasive prevalence of DeepFakes poses a profound threat to individual privacy and the stability of society. Believing the synthetic videos of a celebrity and trumping up impersonated forgery videos as authentic are just a few consequences generated by DeepFakes. We investigate current detectors that blindly deploy deep learning techniques that are not effective in capturing subtle clues of forgery when generative models produce remarkably realistic faces. Inspired by the fact that synthetic operations inevitably modify the regions of eyes and mouth to match the target face with the identity or expression of the source face, we conjecture that the continuity of facial movement patterns representing expressions that existed in the veritable faces will be disrupted or completely broken in synthetic faces, making it a potentially formidable indicator for DeepFake detection. To prove this conjecture, we utilize a dual‐branch network to capture the inconsistent patterns of facial movements within eyes and mouth regions separately. Extensive experiments on popular FaceForensics++, Celeb‐DF‐v1, Celeb‐DF‐v2, and DFDC‐Preview datasets have demonstrated not only effectiveness but also the robust capability of our method to outperform the state‐of‐the‐art baselines. Moreover, this work represents greater robustness against adversarial attacks, achieving ASR of 54.8% in the I‐FGSM attack and 43.1% in the PGD attack on the DeepFakes dataset of FaceForensics++, respectively.

The proliferation of photorealistic images synthesized by generative adversarial networks (GANs) has posed serious threats to society. Therefore a new challenge task, named image attribution, is arising to attribute fake images to a specific GAN. However, existing approaches focus on model‐specific features but neglect the misguidance of semantic‐relevant features in image attribution, which leads to a significant performance decrease in cross‐dataset evaluation. To tackle the above problem, we propose a semantic‐agnostic fake image attribution (SFIA) method, which effectively distinguishes fake images by disentangling the GANs fingerprint and semantic‐relevant features in latent space. Specifically, we design a semantic eliminator based on residual block with skip connections that take images as input and outputs GAN fingerprint features. A classifier with an attention module for feature refinement is introduced to make the final decision. In addition, we develop a well‐trained reconstructor and classifier which supervise the semantic eliminator to achieve semantic‐agnostic feature extraction. Moreover, we propose an improved data augmentation combined with meta‐learning to enhance the model’s generalization in detecting unseen image categories. Comprehensive experiments on various datasets, namely, CelebA, LSUN‐church, and LSUN‐bedroom, demonstrate the effectiveness of our proposed SFIA. It achieves over 95% accuracy on three datasets and exhibits superior performance in terms of generalization to unseen data.

State-of-the-art adversarial attacks in the text domain have shown their power to induce machine learning models to produce abnormal outputs. The samples generated in these attacks have three important attributes: attack ability, transferability, and imperceptibility. However, compared with the other two attributes, the imperceptibility of adversarial examples has not been well investigated. Unlike the pixel-level perturbations in images, adversarial perturbations in the text are usually traceable, reflecting changes in characters, words, or sentences. The generation of imperceptible samples in texts is more difficult than in images. Therefore, how to constrain adversarial perturbations added in the text is a crucial step to construct more natural adversarial texts. Unfortunately, recent studies merely select measurements to constrain the added adversarial perturbations, but none of them explain where these measurements are suitable, which one is better, and how they perform in different kinds of adversarial attacks. In this paper, we fill this gap by comparing the performance of these metrics in various attacks. Furthermore, we propose a stricter constraint for word-level attacks to obtain more imperceptible samples. It is also helpful to enhance existing word-level attacks for adversarial training.

Fuzzing is considered to be an essential approach to guarantee the reliability of deep neural networks (DNNs) based systems. The DNN fuzzing leverages various inputs prioritization methods to guide the testing process. The current research mainly focus on constructing testing metrics that symbolize the logical representation of the DNN to guide the generation of test cases, which neglects the potential performance brought by implementing heuristic algorithm. Moreover, the straightforward implementation of queue structure can not represent the metamorphic relationships between generated inputs in DNN fuzzing. Therefore, developing the appropriate heuristic algorithm-based inputs prioritization method is critical to improve the performance of DNN fuzzers. In this paper, we propose a Monte Carlo Tree Search (MCTS) based inputs prioritization method called E x 2 $E{x}^{2}$ (Exploration and Exploitation) that formulates DNN testing exploration as the sequential decision process. The technique introduces an innovative tree-structure design that schedules inputs from the statistical perspective. Different from traditional DNN testing, the batch pool is maintained in the form of nodes in MCTS. The links between nodes precisely represent the metamorphic relationship between input batches, which indicates the potential value for in-depth search. Furthermore, a novel simulation mechanism is implemented to adapt MCTS in DNN testing, which attain better coverage feedback. The effectiveness of our method is comprehensively investigated on six popular deep learning models from LeNet and VGG families. The comparison experiments are conducted between DeepHunter, TensorFuzz, and DeepSmartFuzzer to demonstrate efficacy on various testing metrics. The experimental results show that the E x 2 $E{x}^{2}$ significantly enhance the coverage gain of DNN fuzzing up to 30% against the best performance in comparison groups.