Authors: (1) Gonzalo J. Aniano Porcile, LinkedIn; (2) Jack Gindi, LinkedIn; (3) Shivansh Mundra, LinkedIn; (4) James R. Verbus, LinkedIn; (5) Hany Farid, LinkedIn and University of California, Berkeley. Table of Links Abstract and Intro Data sets Model Results Discussion, Acknowledgements, and References 5. Discussion For many image classification problems, large neural models – with appropriately representative data – are attractive for their ability to learn discriminating features. These models, however, can be vulnerable to adversarial attacks [4]. It remains to be seen if our model is as vulnerable as previous models in which imperceptible amounts of adversarial noise confound the model [3]. In particular, it remains to be seen if the apparent structural or semantic artifacts we seem to have learned will yield more robustness to intentional adversarial attacks. In terms of less sophisticated attacks, including laundering operations like transcoding and image resizing, we have shown that our model is resilient across a broad range of laundering operations. The creation and detection of AI-generated content is inherently adversarial with a somewhat predictable back and forth between creator and detector. While it may seem that detection is futile, it is not. By continually building detectors, we force creators to continue to invest time and cost to create convincing fakes. And while the sufficiently sophisticated creator will likely be able to bypass most defenses, the average creator will not. When operating on large online platforms like ours, this mitigation – but not elimination – strategy is valuable to creating safer online spaces. In addition, any successful defense will employ not one, but many different approaches that exploit various artifacts. Bypassing all such defenses will pose significant challenges to the adversary. By learning what appears to be a robust artifact that is resilient across resolution, quality, and a range of synthesis engines, the approach described here adds a powerful new tool to a defensive toolkit. Acknowledgements This work is the product of a collaboration between Professor Hany Farid and the Trust Data team at LinkedIn[10]. We thank Matya´s Bohacek for his help in creating the AI-generated faces. We thank the LinkedIn Scholars[11] program for enabling this collaboration. We also thank Ya Xu, Daniel Olmedilla, Kim Capps-Tanaka, Jenelle Bray, Shaunak Chatterjee, Vidit Jain, Ting Chen, Vipin Gupta, Dinesh Palanivelu, Milinda Lakkam, and Natesh Pillai for their support of this work. We are grateful to David Luebke, Margaret Albrecht, Edwin Nieda, Koki Nagano, George Chellapa, Burak Yoldemir, and Ankit Patel at NVIDIA for facilitating our work by making the StyleGAN generation software, trained models and synthesized images publicly available, and for their valuable suggestions. References [1] Stability AI. https://stability.ai. 1 [2] David Bau, Alex Andonian, Audrey Cui, YeonHwan Park, Ali Jahanian, Aude Oliva, and Antonio Torralba. Paint by word. arXiv:2103.10951, 2021. 1 [3] Nicholas Carlini and Hany Farid. Evading deepfake-image detectors with white-and black-box attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 658–659, 2020. 7 [4] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pages 39–57. IEEE, 2017. 7 [5] Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? Understanding properties that generalize. In European Conference on Computer Vision, pages 103–120, 2020. 2 [6] Eric R Chan, Connor Z Lin, Matthew A Chan, Koki Nagano, Boxiao Pan, Shalini De Mello, Orazio Gallo, Leonidas J Guibas, Jonathan Tremblay, Sameh Khamis, et al. Efficient geometry-aware 3D generative adversarial networks. In International Conference on Computer Vision and Pattern Recognition, pages 16123–16133, 2022. 2 [7] Franc¸ois Chollet. Xception: Deep learning with depthwise separable convolutions. arXiv:1610.02357, 2017. 4 [8] Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. On the detection of synthetic images generated by diffusion models. In International Conference on Acoustics, Speech and Signal Processing, pages 1–5. IEEE, 2023. 2, 5, 7 [9] Chengdong Dong, Ajay Kumar, and Eryun Liu. Think twice before detecting GAN-generated fake images from their spectral domain imprints. In International Conference on Computer Vision and Pattern Recognition, pages 7865– 7874, 2022. 2 [10] Hany Farid. Creating, using, misusing, and detecting deep fakes. Journal of Online Trust and Safety, 1(4), 2022. 2 [11] Joel Frank, Thorsten Eisenhofer, Lea Schonherr, Asja Fis- ¨ cher, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. arXiv:2003.08685, 2020. 2 [12] Diego Gragnaniello, Davide Cozzolino, Francesco Marra, Giovanni Poggi, and Luisa Verdoliva. Are GAN generated images easy to detect? A critical analysis of the state-of-theart. In IEEE International Conference on Multimedia and Expo, pages 1–6, 2021. 2 [13] Hui Guo, Shu Hu, Xin Wang, Ming-Ching Chang, and Siwei Lyu. Eyes tell all: Irregular pupil shapes reveal gan-generated faces. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 2904–2908. IEEE, 2022. 2 [14] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. arXiv: 1512.03385, 2015. 4 [15] Shu Hu, Yuezun Li, and Siwei Lyu. Exposing GANgenerated faces using inconsistent corneal specular highlights. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 2500–2504. IEEE, 2021. 2 [16] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of GANs for improved quality, stability, and variation. arXiv:1710.10196, 2017. 1 [17] Tero Karras, Miika Aittala, Samuli Laine, Erik Hark ¨ onen, ¨ Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Alias-free generative adversarial networks. In Neural Information Processing Systems, 2021. 1, 2 [18] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In International Conference on Computer Vision and Pattern Recognition, pages 4401–4410, 2019. 1, 2 [19] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of StyleGAN. In International Conference on Computer Vision and Pattern Recognition, pages 8110– 8119, 2020. 2 [20] David C Knill, David Field, and Daniel Kerstent. Human discrimination of fractal images. JOSA A, 7(6):1113–1123, 1990. 1 [21] Bo Liu, Fan Yang, Xiuli Bi, Bin Xiao, Weisheng Li, and Xinbo Gao. Detecting generated images by real images. In European Conference on Computer Vision, pages 95–110. Springer, 2022. 2 [22] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In IEEE/CVF International Conference on Computer Vision, 2021. 4 [23] Shivansh Mundra, Gonzalo J. Aniano Porcile, Smit Marvaniya, James R. Verbus, and Hany Farid. Exposing gangenerated profile photos from compact embeddings. In International Conference on Computer Vision and Pattern Recognition Workshop, 2023. 2, 7 [24] Sophie J Nightingale and Hany Farid. AI-synthesized faces are indistinguishable from real faces and more trustworthy. Proceedings of the National Academy of Sciences, 119(8):e2120481119, 2022. 2 [25] Javier Portilla and Eero P Simoncelli. A parametric texture model based on joint statistics of complex wavelet coefficients. International journal of computer vision, 40:49–70, 2000. 1 [26] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjorn Ommer. High-resolution image syn- ¨ thesis with latent diffusion models. In International Conference on Computer Vision and Pattern Recognition, pages 10684–10695, 2022. 1, 4 [27] Pawan Sinha, Benjamin Balas, Yuri Ostrovsky, and Richard Russell. Face recognition by humans: Nineteen results all computer vision researchers should know about. Proceedings of the IEEE, 94(11):1948–1962, 2006. 6 [28] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. arXiv: 1703.01365, 2017. 6 [29] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. Learning on gradients: Generalized artifacts representation for GAN-generated images detection. In International Conference on Computer Vision and Pattern Recognition, pages 12105–12114, 2023. 2 [30] Mingxing Tan and Quoc V. Le. Efficientnet: Rethinking model scaling for convolutional neural networks. arXiv: 1905.11946, 2020. 4 [31] Peter Thompson. Margaret Thatcher: A new illusion. Perception, 9(4):483–484, 1980. 6 [32] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. CNN-generated images are surprisingly easy to spot... for now. In International Conference on Computer Vision and Pattern Recognition, pages 8695– 8704, 2020. 2 [33] Xin Yang, Yuezun Li, and Siwei Lyu. Exposing deep fakes using inconsistent head poses. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 8261–8265. IEEE, 2019. 2 [34] Xin Yang, Yuezun Li, Honggang Qi, and Siwei Lyu. Exposing GAN-synthesized faces using landmark locations. In ACM Workshop on Information Hiding and Multimedia Security, pages 113–118, 2019. 2 [35] Xu Zhang, Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in GAN fake images. In IEEE International Workshop on Information Forensics and Security, pages 1–6, 2019. 2 This paper is available on arxiv under CC 4.0 license. [10] The model described in this work is not used to take action on any LinkedIn members. [11] https://careers.linkedin.com/scholars Authors: (1) Gonzalo J. Aniano Porcile, LinkedIn; (2) Jack Gindi, LinkedIn; (3) Shivansh Mundra, LinkedIn; (4) James R. Verbus, LinkedIn; (5) Hany Farid, LinkedIn and University of California, Berkeley. Authors: Authors: (1) Gonzalo J. Aniano Porcile, LinkedIn; (2) Jack Gindi, LinkedIn; (3) Shivansh Mundra, LinkedIn; (4) James R. Verbus, LinkedIn; (5) Hany Farid, LinkedIn and University of California, Berkeley. Table of Links Abstract and Intro Data sets Model Results Discussion, Acknowledgements, and References Abstract and Intro Abstract and Intro Data sets Data sets Model Model Results Results Discussion, Acknowledgements, and References Discussion, Acknowledgements, and References 5. Discussion For many image classification problems, large neural models – with appropriately representative data – are attractive for their ability to learn discriminating features. These models, however, can be vulnerable to adversarial attacks [4]. It remains to be seen if our model is as vulnerable as previous models in which imperceptible amounts of adversarial noise confound the model [3]. In particular, it remains to be seen if the apparent structural or semantic artifacts we seem to have learned will yield more robustness to intentional adversarial attacks. In terms of less sophisticated attacks, including laundering operations like transcoding and image resizing, we have shown that our model is resilient across a broad range of laundering operations. The creation and detection of AI-generated content is inherently adversarial with a somewhat predictable back and forth between creator and detector. While it may seem that detection is futile, it is not. By continually building detectors, we force creators to continue to invest time and cost to create convincing fakes. And while the sufficiently sophisticated creator will likely be able to bypass most defenses, the average creator will not. When operating on large online platforms like ours, this mitigation – but not elimination – strategy is valuable to creating safer online spaces. In addition, any successful defense will employ not one, but many different approaches that exploit various artifacts. Bypassing all such defenses will pose significant challenges to the adversary. By learning what appears to be a robust artifact that is resilient across resolution, quality, and a range of synthesis engines, the approach described here adds a powerful new tool to a defensive toolkit. Acknowledgements This work is the product of a collaboration between Professor Hany Farid and the Trust Data team at LinkedIn[10]. We thank Matya´s Bohacek for his help in creating the AI-generated faces. We thank the LinkedIn Scholars[11] program for enabling this collaboration. We also thank Ya Xu, Daniel Olmedilla, Kim Capps-Tanaka, Jenelle Bray, Shaunak Chatterjee, Vidit Jain, Ting Chen, Vipin Gupta, Dinesh Palanivelu, Milinda Lakkam, and Natesh Pillai for their support of this work. We are grateful to David Luebke, Margaret Albrecht, Edwin Nieda, Koki Nagano, George Chellapa, Burak Yoldemir, and Ankit Patel at NVIDIA for facilitating our work by making the StyleGAN generation software, trained models and synthesized images publicly available, and for their valuable suggestions. References [1] Stability AI. https://stability.ai. 1 [2] David Bau, Alex Andonian, Audrey Cui, YeonHwan Park, Ali Jahanian, Aude Oliva, and Antonio Torralba. Paint by word. arXiv:2103.10951, 2021. 1 [3] Nicholas Carlini and Hany Farid. Evading deepfake-image detectors with white-and black-box attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 658–659, 2020. 7 [4] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pages 39–57. IEEE, 2017. 7 [5] Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? Understanding properties that generalize. In European Conference on Computer Vision, pages 103–120, 2020. 2 [6] Eric R Chan, Connor Z Lin, Matthew A Chan, Koki Nagano, Boxiao Pan, Shalini De Mello, Orazio Gallo, Leonidas J Guibas, Jonathan Tremblay, Sameh Khamis, et al. Efficient geometry-aware 3D generative adversarial networks. In International Conference on Computer Vision and Pattern Recognition, pages 16123–16133, 2022. 2 [7] Franc¸ois Chollet. Xception: Deep learning with depthwise separable convolutions. arXiv:1610.02357, 2017. 4 [8] Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. On the detection of synthetic images generated by diffusion models. In International Conference on Acoustics, Speech and Signal Processing, pages 1–5. IEEE, 2023. 2, 5, 7 [9] Chengdong Dong, Ajay Kumar, and Eryun Liu. Think twice before detecting GAN-generated fake images from their spectral domain imprints. In International Conference on Computer Vision and Pattern Recognition, pages 7865– 7874, 2022. 2 [10] Hany Farid. Creating, using, misusing, and detecting deep fakes. Journal of Online Trust and Safety, 1(4), 2022. 2 [11] Joel Frank, Thorsten Eisenhofer, Lea Schonherr, Asja Fis- ¨ cher, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. arXiv:2003.08685, 2020. 2 [12] Diego Gragnaniello, Davide Cozzolino, Francesco Marra, Giovanni Poggi, and Luisa Verdoliva. Are GAN generated images easy to detect? A critical analysis of the state-of-theart. In IEEE International Conference on Multimedia and Expo, pages 1–6, 2021. 2 [13] Hui Guo, Shu Hu, Xin Wang, Ming-Ching Chang, and Siwei Lyu. Eyes tell all: Irregular pupil shapes reveal gan-generated faces. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 2904–2908. IEEE, 2022. 2 [14] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. arXiv: 1512.03385, 2015. 4 [15] Shu Hu, Yuezun Li, and Siwei Lyu. Exposing GANgenerated faces using inconsistent corneal specular highlights. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 2500–2504. IEEE, 2021. 2 [16] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of GANs for improved quality, stability, and variation. arXiv:1710.10196, 2017. 1 [17] Tero Karras, Miika Aittala, Samuli Laine, Erik Hark ¨ onen, ¨ Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Alias-free generative adversarial networks. In Neural Information Processing Systems, 2021. 1, 2 [18] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In International Conference on Computer Vision and Pattern Recognition, pages 4401–4410, 2019. 1, 2 [19] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of StyleGAN. In International Conference on Computer Vision and Pattern Recognition, pages 8110– 8119, 2020. 2 [20] David C Knill, David Field, and Daniel Kerstent. Human discrimination of fractal images. JOSA A, 7(6):1113–1123, 1990. 1 [21] Bo Liu, Fan Yang, Xiuli Bi, Bin Xiao, Weisheng Li, and Xinbo Gao. Detecting generated images by real images. In European Conference on Computer Vision, pages 95–110. Springer, 2022. 2 [22] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In IEEE/CVF International Conference on Computer Vision, 2021. 4 [23] Shivansh Mundra, Gonzalo J. Aniano Porcile, Smit Marvaniya, James R. Verbus, and Hany Farid. Exposing gangenerated profile photos from compact embeddings. In International Conference on Computer Vision and Pattern Recognition Workshop, 2023. 2, 7 [24] Sophie J Nightingale and Hany Farid. AI-synthesized faces are indistinguishable from real faces and more trustworthy. Proceedings of the National Academy of Sciences, 119(8):e2120481119, 2022. 2 [25] Javier Portilla and Eero P Simoncelli. A parametric texture model based on joint statistics of complex wavelet coefficients. International journal of computer vision, 40:49–70, 2000. 1 [26] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjorn Ommer. High-resolution image syn- ¨ thesis with latent diffusion models. In International Conference on Computer Vision and Pattern Recognition, pages 10684–10695, 2022. 1, 4 [27] Pawan Sinha, Benjamin Balas, Yuri Ostrovsky, and Richard Russell. Face recognition by humans: Nineteen results all computer vision researchers should know about. Proceedings of the IEEE, 94(11):1948–1962, 2006. 6 [28] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. arXiv: 1703.01365, 2017. 6 [29] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. Learning on gradients: Generalized artifacts representation for GAN-generated images detection. In International Conference on Computer Vision and Pattern Recognition, pages 12105–12114, 2023. 2 [30] Mingxing Tan and Quoc V. Le. Efficientnet: Rethinking model scaling for convolutional neural networks. arXiv: 1905.11946, 2020. 4 [31] Peter Thompson. Margaret Thatcher: A new illusion. Perception, 9(4):483–484, 1980. 6 [32] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. CNN-generated images are surprisingly easy to spot... for now. In International Conference on Computer Vision and Pattern Recognition, pages 8695– 8704, 2020. 2 [33] Xin Yang, Yuezun Li, and Siwei Lyu. Exposing deep fakes using inconsistent head poses. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 8261–8265. IEEE, 2019. 2 [34] Xin Yang, Yuezun Li, Honggang Qi, and Siwei Lyu. Exposing GAN-synthesized faces using landmark locations. In ACM Workshop on Information Hiding and Multimedia Security, pages 113–118, 2019. 2 [35] Xu Zhang, Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in GAN fake images. In IEEE International Workshop on Information Forensics and Security, pages 1–6, 2019. 2 This paper is available on arxiv under CC 4.0 license. This paper is available on arxiv under CC 4.0 license. available on arxiv [10] The model described in this work is not used to take action on any LinkedIn members. [11] https://careers.linkedin.com/scholars
