Dear Fellow Scholars, this is Two Minute Papers with Dr. Károly Zsolnai-Fehér.
With the ascendancy of neural network-based learning algorithms, we are now able to take
on, and defeat problems that sounded completely impossible just a few years ago.
For instance, now, we can create deepfakes, or, in other words, we can record a short
video of ourselves, and transfer our gestures to a target subject, and this particular technique
is so advanced, that we don’t even need a video of our target, just one still image.
So, we can even use paintings, images of sculptures, so yes, even the Mona Lisa works!
However, don’t despair, it’s not all doom and gloom.
A paper by the name FaceForensics contains a large dataset of original and manipulated
video pairs.
As this offered a ton of training data for real and forged videos, it became possible
to use these to train a deepfake detector.
You can see it here in action as these green to red colors showcase regions that the AI
correctly thinks were tampered with.
However, if we have access to a deepfake detector, we can also use it to improve our deepfake
creating algorithms.
And with this, an arms race has begun.
The paper we are looking at today showcases this phenomenon.
If you look here, you see this footage which is very visibly fake, and the algorithm correctly
concludes that.
Now, if you look at this video, which, for us, looks like if it were the same video,
yet it suddenly became real, at least the AI thinks that, of course, incorrectly.
This is very confusing.
So what really happened here?
To understand what is going on here, we first have to talk about ostriches.
So what do ostriches have to do with this insanity?
Let me try to explain that.
An adversarial attack on a neural network can be performed as follows.
We present such a classifier network with an image of a bus, and it will successfully
tell us that yes, this is indeed a bus.
Nothing too crazy here.
Now, we show it not an image of a bus, but a bus plus some carefully crafted noise that
is barely perceptible, that forces the neural network to misclassify it as an ostrich.
I will stress that this is not any kind of noise, but the kind of noise that exploits
biases in the neural network, which is, by no means trivial to craft.
However, if we succeed at that, this kind of adversarial attack can be pulled off on
many different kinds of images.
Everything that you see here on the right will be classified as an ostrich by the neural
network these noise patterns were crafted for.
And, this can now be done not only on images, but videos as well, hence, what happened a
minute ago is that the deepfake video has been adversarially modified with noise to
bypass such a detector.
If you look here, you see that the authors have chosen excellent examples, because some
of these are clearly forged videos, which is initially recognized by the detector algorithm,
but after adding the adversarial noise to it, the detector fails spectacularly.
To demonstrate the utility of their technique, they have chosen the other examples to be
much more subtle.
Now, let’s talk about one more question.
We are talking about a detector algorithm.
But there is not one detector out there, there are many, and we can change the wiring of
these neural networks to have even more variation.
So what does it mean to fool a detector?
Excellent question.
The success rate of these adversarial videos indeed depends on the deepfake detector we
are up against, but, hold on to your papers, because this success rate on uncompressed
videos is over 98%, which is amazing, but, note that when using video compression, this
success rate may drop to 58 to 92% depending on the detector.
This means that video compression and some other tricks involving image transformations
still help us in defending against these adversarial attacks.
What I also really like about the paper is that it discusses white and black-box attacks
separately.
In the white-box case, we know everything about the inner workings of the detector,
including the neural network architecture and parameters, this is typically the easier
case.
But, the technique also does really well in the black-box case, where we are not allowed
to look under the hood of the detector, but we can show it a few videos and see how it
reacts to them.
This is a really cool work that gives us a more nuanced view about the current state
of the art around deepfakes and deepfake detectors.
I think it is best if we all know about the fact that these tools exist.
If you wish to help us with this endeavor, please make sure to share this with your friends.
Thank you.
This episode has been supported by Lambda.
If you're a researcher or a startup looking for cheap GPU compute to run these algorithms,
check out Lambda GPU Cloud.
I've talked about Lambda's GPU workstations in other videos and am happy to tell you that
they're offering GPU cloud services as well.
The Lambda GPU Cloud can train Imagenet to 93% accuracy for less than $19! Lambda's web-based
IDE lets you easily access your instance right in your browser.
And finally, hold on to your papers, because the Lambda GPU Cloud costs less than half
of AWS and Azure.
Make sure to go to lambdalabs.com/papers and sign up for one of their amazing GPU instances
today.
Our thanks to Lambda for helping us make better videos for you.
Thanks for watching and for your generous support, and I'll see you next time!