Counterfactual Explanations for Face Forgery Detection via Adversarial Removal of Artifacts

TL;DR

This paper tackles the robustness and explainability gap in face forgery detection by introducing counterfactual explanations based on artifact removal in the StyleGAN latent space. By finetuning an e4e encoder and adversarially searching latent codes under detector supervision, the method produces artifact-removed counterfactuals that support two validation channels: human-friendly counterfactual trace visualizations and transferable adversarial attacks that generalize across detectors. Empirical results show strong attack success rates (over 90%) and improved transferability across multiple datasets and models, with ablations indicating the pivotal role of mid-level forgery artifacts. Overall, the approach offers a principled, generative-space mechanism for explaining detector decisions and diagnosing weaknesses, with practical implications for more robust and interpretable face forgery detection systems.

Abstract

Highly realistic AI generated face forgeries known as deepfakes have raised serious social concerns. Although DNN-based face forgery detection models have achieved good performance, they are vulnerable to latest generative methods that have less forgery traces and adversarial attacks. This limitation of generalization and robustness hinders the credibility of detection results and requires more explanations. In this work, we provide counterfactual explanations for face forgery detection from an artifact removal perspective. Specifically, we first invert the forgery images into the StyleGAN latent space, and then adversarially optimize their latent representations with the discrimination supervision from the target detection model. We verify the effectiveness of the proposed explanations from two aspects: (1) Counterfactual Trace Visualization: the enhanced forgery images are useful to reveal artifacts by visually contrasting the original images and two different visualization methods; (2) Transferable Adversarial Attacks: the adversarial forgery images generated by attacking the detection model are able to mislead other detection models, implying the removed artifacts are general. Extensive experiments demonstrate that our method achieves over 90% attack success rate and superior attack transferability. Compared with naive adversarial noise methods, our method adopts both generative and discriminative model priors, and optimize the latent representations in a synthesis-by-analysis way, which forces the search of counterfactual explanations on the natural face manifold. Thus, more general counterfactual traces can be found and better adversarial attack transferability can be achieved.

Figures (5)

• Figure 1: Comparisons with the previous counterfactual explanation method peng2022counterfactual for face forgery detection. Our method is able to not only provide more visualization to reveal the counterfactual traces, but also handle more forgeries instead of being limited to face swapping. The grey block shows forgery traces that are more human-eye-sensitive, while the blue block shows the artifacts that are less human-eye-sensitive. The residual images show the pixel differences between deepfake images and artifact-removed images (black&white parts mean small differences while colorful parts mean large differences). The Grad-CAM selvaraju2017grad heat-maps show the shift of model attention in the model discrimination before and after artifact removal.
• Figure 2: The overview of our method. We utilize a fine-tuned encoder and a pre-trained StyleGAN generator to optimize the latent codes of the target face forgery image or video. We generate their artifact-removed versions for counterfactual explanations.
• Figure 3: Visualization of the adversarial examples. The visualizations include the raw fake images and the results generated with MstatAttack hou2023evading, MIFGSM dong2018boosting, FGSM hussain2021adversarial, PGD madry2017towards, and ours. Only our proposed method can successfully remove the artifacts that we circle out.
• Figure 4: Changes of latent codes observed in images that successfully evade the detectors.
• Figure 5: Visualization results of our method.