Dodging DeepFake Detection via Implicit Spatial-Domain Notch Filtering

TL;DR

This work introduces DeepNotch, a learning-based pipeline that implicitly performs spatial-domain notch filtering to remove artifact patterns in DeepFake images without sacrificing visual quality. By first adding noise to disrupt periodic artifacts and then applying per-pixel deep image filtering (K predicted by a UNet and reconstruction \\hat{I} = K \\circledast I'), the method achieves detector evasion across three state-of-the-art detectors (GANFingerprint, DCTA, CNNDetector) over 16 DeepFake types. An adversarial-noise-guided variant further localizes noise to semantically meaningful regions, significantly reducing detection accuracy (e.g., up to ~98% in best cases) while maintaining high image fidelity (COSS/PSNR/SSIM near original). The results reveal that existing detectors rely heavily on artifact cues and highlight the need for more robust, artifact-agnostic detection methods; the technique also raises ethical considerations about responsible disclosure and defense enhancement. Overall, DeepNotch demonstrates a powerful evasion strategy and provides a framework to stress-test and improve future DeepFake detectors.

Abstract

The current high-fidelity generation and high-precision detection of DeepFake images are at an arms race. We believe that producing DeepFakes that are highly realistic and 'detection evasive' can serve the ultimate goal of improving future generation DeepFake detection capabilities. In this paper, we propose a simple yet powerful pipeline to reduce the artifact patterns of fake images without hurting image quality by performing implicit spatial-domain notch filtering. We first demonstrate that frequency-domain notch filtering, although famously shown to be effective in removing periodic noise in the spatial domain, is infeasible for our task at hand due to the manual designs required for the notch filters. We, therefore, resort to a learning-based approach to reproduce the notch filtering effects, but solely in the spatial domain. We adopt a combination of adding overwhelming spatial noise for breaking the periodic noise pattern and deep image filtering to reconstruct the noise-free fake images, and we name our method DeepNotch. Deep image filtering provides a specialized filter for each pixel in the noisy image, producing filtered images with high fidelity compared to their DeepFake counterparts. Moreover, we also use the semantic information of the image to generate an adversarial guidance map to add noise intelligently. Our large-scale evaluation on 3 representative state-of-the-art DeepFake detection methods (tested on 16 types of DeepFakes) has demonstrated that our technique significantly reduces the accuracy of these 3 fake image detection methods, 36.79% on average and up to 97.02% in the best case.

Figures (12)

• Figure 1: (a) DeepFake shows the checkerboard pattern and visible spike artifact in its spectrum (red arrows). (Top) Using deep image filtering to directly retouch the DeepFake image will still leave artifacts and it can be caught by DeepFake detectors (b). (Bottom) Performing implicit notch filtering with DeepNotch. By adding noise to the DeepFake, we can successfully reduce the artifact pattern (c). Then, deep image filtering is able to restore the image quality without adding artifacts (d), thus successfully evading DeepFake detectors.
• Figure 2: (L-R) Fake image produced by StarGAN choi2018stargan, CRN shi2016end, and SAN dai2019second and their corresponding spectrum.
• Figure 3: (a) StarGAN choi2018stargan DeepFake. The zoomed-in area shows a clear checkerboard pattern and the spectrum also shows artifacts. (b) An ideal notch filter $(r=4)$ is applied to eliminate frequency-domain noise. The corresponding partial and full images exhibit fewer checkerboard patterns. (c) An ideal notch filter $(r=10)$ is applied. The checkerboard patterns almost disappear. (d-e) We replace the ideal notch filter with a Gaussian notch filter $(\sigma=1)$, leading to similar performances as (b-c).
• Figure 4: (a) StarGAN choi2018stargan DeepFake of size 256 $\times$ 256 and its spectrum. The spectrum has clear artifact patterns. (b) We resize the image into size 512 $\times$ 512 and find that the artifact patterns of its spectrum shift obviously. (c) Based on the resize process in (b), we then rotate the image by 5 degrees and enlarge the image to 1.1 times. The artifact patterns in the spectrum also rotate.
• Figure 5: (L-R) Real, fake, noised, and deeply filtered image. Blobs are in the spectrum of the fake image selected from StarGAN. The noised image shows the result of adding Gaussian noise $(\sigma=5,\mu=0)$ to the fake image. It does not have blobs in the spectrum. In addition, the deeply filtered image using deep image filtering on the noised image also exhibits no artifact patterns.