The increasing prevalence of audio deepfakes poses significant security
threats, necessitating robust detection methods. While existing detection
systems exhibit promise, their robustness against malicious audio manipulations
remains underexplored. To bridge the gap, we undertake the first comprehensive
study of the susceptibility of the most widely adopted audio deepfake detectors
to manipulation attacks. Surprisingly, even manipulations like volume control
can significantly bypass detection without affecting human perception. To
address this, we propose CLAD (Contrastive Learning-based Audio deepfake
Detector) to enhance the robustness against manipulation attacks. The key idea
is to incorporate contrastive learning to minimize the variations introduced by
manipulations, therefore enhancing detection robustness. Additionally, we
incorporate a length loss, aiming to improve the detection accuracy by
clustering real audios more closely in the feature space. We comprehensively
evaluated the most widely adopted audio deepfake detection models and our
proposed CLAD against various manipulation attacks. The detection models
exhibited vulnerabilities, with FAR rising to 36.69%, 31.23%, and 51.28% under
volume control, fading, and noise injection, respectively. CLAD enhanced
robustness, reducing the FAR to 0.81% under noise injection and consistently
maintaining an FAR below 1.63% across all tests. Our source code and
documentation are available in the artifact repository
(this https URL).

音频深度伪造的广泛应用和威胁需要强大的检测方法。本研究首次全面调查了最常用的音频深伪造检测器对操纵攻击的敏感性，并提出了 CLAD 来改善其鲁棒性。通过对比学习和长度损失等技术，CLAD 显著提高了检测的准确性和鲁棒性。

对抗式学习的鲁棒音频深度伪造检测（CLAD）

CLAD: Robust Audio Deepfake Detection Against Manipulation Attacks with  Contrastive Learning

To ensure the usefulness of Reinforcement Learning (RL) in real systems, it
is crucial to ensure they are robust to noise and adversarial attacks. In
adversarial RL, an external attacker has the power to manipulate the victim
agent's interaction with the environment. We study the full class of online
manipulation attacks, which include (i) state attacks, (ii) observation attacks
(which are a generalization of perceived-state attacks), (iii) action attacks,
and (iv) reward attacks. We show the attacker's problem of designing a stealthy
attack that maximizes its own expected reward, which often corresponds to
minimizing the victim's value, is captured by a Markov Decision Process (MDP)
that we call a meta-MDP since it is not the true environment but a higher level
environment induced by the attacked interaction. We show that the attacker can
derive optimal attacks by planning in polynomial time or learning with
polynomial sample complexity using standard RL techniques. We argue that the
optimal defense policy for the victim can be computed as the solution to a
stochastic Stackelberg game, which can be further simplified into a
partially-observable turn-based stochastic game (POTBSG). Neither the attacker
nor the victim would benefit from deviating from their respective optimal
policies, thus such solutions are truly robust. Although the defense problem is
NP-hard, we show that optimal Markovian defenses can be computed (learned) in
polynomial time (sample complexity) in many scenarios.

为确保强化学习在真实系统中的可用性，需要保证其对噪声和对抗性攻击具有鲁棒性。本文研究在线操纵攻击的全类攻击形式，包括状态攻击、观察攻击、行动攻击和奖励攻击。我们通过马尔可夫决策过程（MDP）对隐藏在攻击交互中的元级环境进行建模，并展示了该攻击者设计隐蔽攻击以最大化其预期收益（通常对应于减小受害者价值）的问题。我们证明攻击者可以通过规划或使用标准强化学习技术进行学习，以多项式时间或多项式样本复杂度确定最优攻击策略。我们认为受害者的最优防御策略可以通过解决随机 Stackelberg 博弈获得，该博弈可以简化为部分可观察的交替轮流随机博弈（POTBSG）。攻击者和受害者都不会从偏离各自最优策略中获益，因此这些解决方案具有真正的鲁棒性。虽然防御问题是 NP 困难的，但我们证明在许多情况下最优马尔可夫防御策略可以在多项式时间（样本复杂度）内计算（学习）。

强化学习的最优攻击与防御

Optimal Attack and Defense for Reinforcement Learning

The rapid spread of false information and persistent manipulation attacks on
online social networks (OSNs), often for political, ideological, or financial
gain, has affected the openness of OSNs. While researchers from various
disciplines have investigated different manipulation-triggering elements of
OSNs (such as understanding information diffusion on OSNs or detecting
automated behavior of accounts), these works have not been consolidated to
present a comprehensive overview of the interconnections among these elements.
Notably, user psychology, the prevalence of bots, and their tactics in relation
to false information detection have been overlooked in previous research. To
address this research gap, this paper synthesizes insights from various
disciplines to provide a comprehensive analysis of the manipulation landscape.
By integrating the primary elements of social media manipulation (SMM),
including false information, bots, and malicious campaigns, we extensively
examine each SMM element. Through a systematic investigation of prior research,
we identify commonalities, highlight existing gaps, and extract valuable
insights in the field. Our findings underscore the urgent need for
interdisciplinary research to effectively combat social media manipulations,
and our systematization can guide future research efforts and assist OSN
providers in ensuring the safety and integrity of their platforms.

该研究综合来自不同学科的观点，全面分析了社交媒体操纵的景观，包括虚假信息、机器人和恶意活动，强调了跨学科研究有效打击社交媒体操纵的紧迫性，并为未来的研究提供指导。