Existing image inpainting methods have achieved remarkable accomplishments in
generating visually appealing results, often accompanied by a trend toward
creating more intricate structural textures. However, while these models excel
at creating more realistic image content, they often leave noticeable traces of
tampering, posing a significant threat to security. In this work, we take the
anti-forensic capabilities into consideration, firstly proposing an end-to-end
training framework for anti-forensic image inpainting named SafePaint.
Specifically, we innovatively formulated image inpainting as two major tasks:
semantically plausible content completion and region-wise optimization. The
former is similar to current inpainting methods that aim to restore the missing
regions of corrupted images. The latter, through domain adaptation, endeavors
to reconcile the discrepancies between the inpainted region and the unaltered
area to achieve anti-forensic goals. Through comprehensive theoretical
analysis, we validate the effectiveness of domain adaptation for anti-forensic
performance. Furthermore, we meticulously crafted a region-wise separated
attention (RWSA) module, which not only aligns with our objective of
anti-forensics but also enhances the performance of the model. Extensive
qualitative and quantitative evaluations show our approach achieves comparable
results to existing image inpainting methods while offering anti-forensic
capabilities not available in other methods.

提出了一个用于反取证图像修复的端到端训练框架，名为 SafePaint，用于解决生成逼真图像内容时常出现痕迹的问题，并通过领域自适应方法实现反取证的目标

SafePaint：领域适应的反取证图像修复

SafePaint: Anti-forensic Image Inpainting with Domain Adaptation

Images synthesized by powerful generative adversarial network (GAN) based
methods have drawn moral and privacy concerns. Although image forensic models
have reached great performance in detecting fake images from real ones, these
models can be easily fooled with a simple adversarial attack. But, the noise
adding adversarial samples are also arousing suspicion. In this paper, instead
of adding adversarial noise, we optimally search adversarial points on face
manifold to generate anti-forensic fake face images. We iteratively do a
gradient-descent with each small step in the latent space of a generative
model, e.g. Style-GAN, to find an adversarial latent vector, which is similar
to norm-based adversarial attack but in latent space. Then, the generated fake
images driven by the adversarial latent vectors with the help of GANs can
defeat main-stream forensic models. For examples, they make the accuracy of
deepfake detection models based on Xception or EfficientNet drop from over 90%
to nearly 0%, meanwhile maintaining high visual quality. In addition, we find
manipulating style vector $z$ or noise vectors $n$ at different levels have
impacts on attack success rate. The generated adversarial images mainly have
facial texture or face attributes changing.

本研究提出一种新的反 - 取证攻击方法，该方法利用梯度下降算法在 Style-GAN 的潜空间中搜索对抗性潜向量，生成高质量的假人脸图像，并能够成功地欺骗主流取证模型，从而达到反 - 取证的目的。

探索人脸流形上的对抗性假图像

Exploring Adversarial Fake Images on Face Manifold

Recently, generative adversarial networks (GANs) can generate photo-realistic
fake facial images which are perceptually indistinguishable from real face
photos, promoting research on fake face detection. Though fake face forensics
can achieve high detection accuracy, their anti-forensic counterparts are less
investigated. Here we explore more \textit{imperceptible} and
\textit{transferable} anti-forensics for fake face imagery detection based on
adversarial attacks. Since facial and background regions are often smooth, even
small perturbation could cause noticeable perceptual impairment in fake face
images. Therefore it makes existing adversarial attacks ineffective as an
anti-forensic method. Our perturbation analysis reveals the intuitive reason of
the perceptual degradation issue when directly applying existing attacks. We
then propose a novel adversarial attack method, better suitable for image
anti-forensics, in the transformed color domain by considering visual
perception. Simple yet effective, the proposed method can fool both deep
learning and non-deep learning based forensic detectors, achieving higher
attack success rate and significantly improved visual quality. Specially, when
adversaries consider imperceptibility as a constraint, the proposed
anti-forensic method can improve the average attack success rate by around 30\%
on fake face images over two baseline attacks. \textit{More imperceptible} and
\textit{more transferable}, the proposed method raises new security concerns to
fake face imagery detection. We have released our code for public use, and
hopefully the proposed method can be further explored in related forensic
applications as an anti-forensic benchmark.

通过对抗性攻击，在转换的颜色域中考虑视觉感知，提出了一种新的反取证方法，即更难以察觉和更具可迁移性，可成功欺骗深度学习和非深度学习取证检测器，极大地提高了攻击成功率和视觉质量，为面部图像取证新的安全问题。