Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted

TL;DR

A trigger generator is developed, that can synthesize passcode-controlled, semantic-suppression, adaptive, and invisible trigger patterns, ensuring both the stealthiness and effectiveness of these triggers.

Abstract

With the advancement of AI generative techniques, Deepfake faces have become incredibly realistic and nearly indistinguishable to the human eye. To counter this, Deepfake detectors have been developed as reliable tools for assessing face authenticity. These detectors are typically developed on Deep Neural Networks (DNNs) and trained using third-party datasets. However, this protocol raises a new security risk that can seriously undermine the trustfulness of Deepfake detectors: Once the third-party data providers insert poisoned (corrupted) data maliciously, Deepfake detectors trained on these datasets will be injected ``backdoors'' that cause abnormal behavior when presented with samples containing specific triggers. This is a practical concern, as third-party providers may distribute or sell these triggers to malicious users, allowing them to manipulate detector performance and escape accountability. This paper investigates this risk in depth and describes a solution to stealthily infect Deepfake detectors. Specifically, we develop a trigger generator, that can synthesize passcode-controlled, semantic-suppression, adaptive, and invisible trigger patterns, ensuring both the stealthiness and effectiveness of these triggers. Then we discuss two poisoning scenarios, dirty-label poisoning and clean-label poisoning, to accomplish the injection of backdoors. Extensive experiments demonstrate the effectiveness, stealthiness, and practicality of our method compared to several baselines.

Figures (8)

• Figure 1: Overview of the security risk: Deepfake detectors face potential vulnerabilities from third-party data providers who could intentionally corrupt their data by adding passcode-controlled, representation-suppression, adaptive, and invisible triggers.
• Figure 2: Overview of the training of trigger generator. Note that Deepfake detector $\bm{F}$ and objective $\mathcal{L}_{sup}$ are only used for generating representation-suppression triggers in clean-label scenario.
• Figure 3: Illustration of passcode-controlled dirty-label poisoning and passcode-controlled clean-label poisoning.
• Figure 4: Visual comparison with visible trigger methods.
• Figure 5: Visual comparison with invisible trigger methods.