- Thank you, it's good to be here.
I'm gonna talk today about deep fakes.
It's probably a term you've heard about.
But before I dive into deep fakes,
I wanna just give you a little bit of history
of photo manipulation and media manipulation.
And it is not something new.
And arguably, it's we've been manipulating images
and photographs as long as photography has been around.
Stalin, for example, famously airbrushed people
out of photos that fell out of favor.
But really starting in the 1990s,
we started to see a revolution in digital imaging,
and much of that has been driven by digital cameras,
ubiquitous computing, and of course programs
like Adobe Photoshop, which have made it easier and easier
to alter and manipulate photographs.
And so in this 25 year period,
we saw this rise of photo manipulation.
And in 2015, we started to be able to do
some pretty fun things with photographs like this.
Where for example, we would swap President Obama
and Michelle Obama's face and
relatively straightforward to do this
in a program like Photoshop.
And we've also started to be able to manipulate videos
in the mid 2000s, and do things like this,
- If I push into the tenor of the conversations.
I think it will actually yield results
before the end of the year.
And I look forward to continuing this dialogue
in the months ahead.
Thank you very much, everybody.
(door banging)
- By around the mid 2000s,
we've already started to see photo and video manipulation,
in many cases, they were like the two last images
and videos that I showed you, which is sort of fun.
And we wanted to be able to poke fun or have humor
or spoof presidents, for example.
But since 2015, we started to see
a new age of digital manipulation
and that's what we're gonna talk about today,
so called Deep fakes.
So if you navigate to the website,
thispersondoesnotexist.com,
true to the name of that URL
you will be presented with a face of a person well,
who doesn't exist.
So these six people that you see here
were completely 100% synthesized by computer algorithm,
they don't exist.
And you can see that they cover gender, race,
age, facial hair, and glasses.
And computers can now whole cloth synthesize images.
And as I'll show you, in a little bit video
of people who don't exist are people doing things
that they never did.
And this is a bit of a game changer.
And that's what we're going to talk about today.
So let's talk about how this person does not exist works.
So this is a so called these are created
with a so called GAN, a Generative Adversarial Network.
And here's the basic workings of how it works.
Up in the top, you start with a random image.
And when I say random image,
I literally mean you drop down a bunch of pixels
into an image.
And that goes into a generator.
That's the generators responsibility's
to create the image of the person who doesn't exist.
And so it takes that image of random pixels
and enhance it to a discriminator.
And the discriminator has access to images
of, well, people. Actual people.
And the discriminator's job is to ask,
can I distinguish that image provided to me
from the generator from these images of actual people?
And in this case, the answer is, of course, yes.
And so it goes back to the generator and says,
"Please try again."
And the generated makes modifications to those pixels,
sends it back to the discriminator,
the discriminator checks again,
and it does that millions and millions of millions of times
in a very tight loop very, very rapidly.
And this is why it's called
a generative adversarial network.
Generative because it's making something,
adversarial because you're pitting that generator
with the discriminator.
And network because the underlying mechanism
for the generator and the discriminator
is a so called deep neural network.
And when you run this simple mechanism
and millions and millions of iterations,
it will eventually create an image
with the discriminator will look at and say yep,
I can't tell that this is not a person.
And now you have this person does not exist.
Now we can do something a little bit different with this,
we can change identities
with the same basic underlying mechanism.
So now let's say I wanna change one person's identity
in the top left here to another person's identity.
Let's say Steve Buscemi.
So the generators job is to modify pixels in the face,
hand back to the discriminator.
And the discriminator's job is not "Is this a person?"
The discriminator's job is now to ask,
Is this Steve Buscemi
or whoever's identity you want to swap?
If the answer is no, it sends it back to the generator
and again, they work in a very tight loop
until the generator makes modifications
that the discriminator cannot detect.
And then when you do that,
frame after frame after frame in a video,
you get something that looks a little bit like this.
- I expected Amy to win so I just like it was
just I this was this was very, truly surprising for me.
So what you're seeing on the left is the original video,
Jennifer Lawrence of course accepting an award.
And on the right is a so called "face swap" deep fake,
where on every frame again a generative adversarial network
made the modifications that I was just talking about
to replace Jennifer Lawrence's face
with Steve Buscemi's face.
And again, the power of this technology
is that it is fully automatic.
You provide the content that you want as original source,
you provide the images of the face,
you want to swap and the computer takes over.
So there's no Photoshop, there's no after effects.
There's none of the skilled labor
that is typically required to do this.
And so let's look at a couple of examples
of the things that you might be able to do
with this type of face swap deep fake.
- Obama stole my microphone that
they took my microphone to Kenya
and they broke it and now it's broken.
Can you hear that? I'm speaking of
somebody sniffing here. I think it's her sniffs.
- So of course, that's Alec Baldwin on Saturday Night Live
and what we've done is replaced his face with
that of President Trump's and you can now see the power
of this technology and the ability to make it look
like one person is saying something
or doing something they never did.
Let me show you just one more example.
- But listen, America, Donald Trump cannot be president,
he would be a disaster, a failure, a complete F
and America you deserve better than an F.
So on November 8, vote for me
and I promise I will be a stone cold B.
- So those are called so called "face swap" deep fakes
where you've taken one actor or impersonator,
and you've replaced one face with another face.
And you can see the power of that technology
to impersonate a president, a candidate, CEO,
whomever you like.
Now, this is a slightly different type of deep fake
and I just want to mention, we're going to be talking about
it a little bit in a little bit.
So let's go ahead and watch this
and I'll explain what you're seeing.
- Now, you see, I would never say these things.
At least not in a public address,
but someone else would,
someone like Jordan Peele.
This is a dangerous time.
Moving forward, we need to be more vigilant
with what we trust from the Internet.
- Okay, so what you're seeing there
is a fully authentic video of President Obama.
But what you're hearing is Jordan Peele.
And the manipulation now is not replacing an entire face,
but simply synthesizing the mouth to be consistent
with a new audio track.
And again, this is a very similar type of the goal
is very similar, which is to create a video of a person
saying something they never did.
But the underlying mechanism is slightly different
because we take an original video
and modify only the mouth and the speech.
These are so called "lip sync" deep fakes.
And so where where do we worry about this
type of technology, obviously,
lots of fun things you can do with it.
They're highly humorous and for political commentary,
but there's also a darker side to this technology.
And where we are seeing the biggest harm today
is in the form of non consensual pornography,
taking one person's likeness and inserting it
into sexually explicit material
and then distributing that on the Internet.
And that is probably today the most common use
of deep fake technology, which again is yet another example
of the weaponization of technology against women
and something that I think we need to get a handle on.
Coming up into the 2020 elections here in the US,
we are very concerned about misinformation campaigns
in all forms, and one of them is in the creation
of a video of a candidate saying something inappropriate
or offensive, and how that might affect an election.
Obviously, in the courts as we begin to rely
more and more on digital evidence,
can we trust body cam footage?
Can we trust surveillance footage?
Can we trust footage taken from an iPhone
if that footage can be manipulated?
How do we get our handle on evidence in courts of law?
There are huge national security implications
when we rely on video of events happening around the world
to make life altering global decisions,
and of course, in the form of fraud.
So what happens for example, when I create a video
of Mark Zuckerberg saying that profits are down 10%.
I leave that on the Internet, I can manipulate
the stock market to the tune of billions of dollars
before anybody else figures out that it's fake.
So when you have the ability to make people say and do
things that they never did, you can see
that you have this long list of potential threats.
And the things that we want to think about are now
how do we protect against that, from a policy perspective,
from a legal perspective,
from from an education perspective,
and from my world from the technology side,
and what I'm going to talk about next are
some of the technologies that we are developing
in order to detect these types of deep fakes
so we can protect ourselves against
a long list of potential threats.
Let me start by way of motivation.
I'm going to show you a series of clips of President Obama
And and just pay attention,
see if you notice anything, yeah?
Hi, everybody. Hi, everybody.
Hi, everybody.
- So those are all separate clips
of President Obama at the beginning of his weekly address.
And what you probably noticed
is that whenever he said "Hi everybody,"
he tilted his head up into his right,
so "Hi, everybody. Hi, everybody."
And what you may not have noticed,
but you can see it on this frame right here
is that when he comes down,
he purses his lips and he begins, he starts talking.
And it's really consistent.
He does this over and over and over again.
And it's it's something you could tell,
a mannerism, a behavioral tic that he has.
And we all have it, the way I raise my eyebrow
when I emphasize something, for example,
or the way I turn my head when I talk,
and we're going to use those mannerisms
to try to detect the fakes.
So let me show you an example of that.
So I'm showing you the top row is one frame
of an authentic Obama video.
And that graph that you see is showing two things.
Along the horizontal axis is time.
That's about 10 seconds of video.
And on the vertical axis, I'm showing you two motions
that he makes.
One in blue is how he rotates his head up and down
along the horizontal axis.
And in orange is how he turns down the sides of his mouth
as if he's frowning.
And these are computed averaged over hours and hours
of video President Obama speaking, and what do you notice?
They're correlated. So when he turns his head down,
he tends to frown or when he frowns he tends
to turn his head down, and vice versa.
And you notice this when President Obama speaks
when he's delivering bad news, sad news,
when he's upset when he's angry, he tends to frown
and he's head turns down to ever so little.
It's a towel. It's a mannerism, it's a tic, if you will.
Now below, what you're seeing is a lip sync deep fake,
similar to the Jordan Peele video that I showed you earlier.
And what do you notice here is that they're decoupled?
Well, why is that? Well, in this video,
the mouth is saying something,
whatever the impersonator wants him to say.
But the head is saying something else.
The head doesn't know what the mouth is saying.
So we've decoupled and we've disrupted the mannerism
that is typical of the way President Obama speaks.
Now, that's President Obama's mannerism, that's his tell.
That's his tic. Other people have different ones.
So here, for example, is President Trump on the top
And now the blue corresponds to the chin pucker.
And the orange corresponds to how wide the mouth is.
And you see here that they are D correlated.
So when he does that chin pucker,
his mouth is closed and vice versa.
On the bottom row is Alec Baldwin who does
a very funny impersonation on Saturday Night Live.
And here you can see that those two mannerisms
are now coupled, they're correlated.
So Alec Baldwin took two tics of President Trump,
the chin pucker, and the mouth open.
And he created a caricature of it, but he did it wrong.
He got the dynamics of it wrong.
And so we can use that to detect that something is wrong
with the video. Okay. And everybody's different.
Elizabeth Warren, Hillary Clinton, President Trump,
President Obama, Vice President Biden,
they all have different mannerisms.
And what we do is we learn them,
and we learn them by looking at hours of video
of each of these individuals, extracting those patterns
and then using that to identify
whether somebody's impersonating them through a deep fake.
So let me show you just very quickly how we do that.
So we start with the video and we do
some very basic head and face tracking.
So what that blue box you're seeing is telling me
the three dimensional rotation
of President Obama's head as he speaks.
The green lasers coming out of the eyes are telling me
where he's looking.
And all the dots on the face are tracking
his facial expressions.
We take all of that information,
and we extract 190 measurements,
which I won't talk in detail about.
And now I'm going to project those onto
a two dimensional space just so you can visualize them.
So each dot in this in this graph here is corresponding
to a 10 second video clip of Kamala Harris, Hillary Clinton,
Elizabeth Warren, Cory Booker, and so on and so forth.
These are obviously done at the height
of the Democratic primary.
And you notice a couple of things.
One is, everybody's off in their own corner.
So all of the Obama videos are distinct
from the Trump videos, which are distinct
from the Elizabeth Warren videos.
And so what that means is that when we now get a new video,
we project it into the space and we simply ask
"Well does this have the characteristics of
Vice President Biden, Elizabeth Warren, Hillary Clinton,
Kamala Harris, and so on and so forth?"
And then we can detect whether something
is a deep fake or an impersonation.
So that's one technique that we've developed,
and you can see that it's very specific to an individual.
Very good for high profile people like candidates,
but not so good for, well, people like me,
where you don't have hours and hours of video footage,
where you can measure my various mannerisms.
So this is good for doing things
like protecting our elections,
but not so good for the day to day
run of the mill people, people like me.
So let's talk about another technique that we're developing.
So what I'm showing you on this graph
on this figure, rather, is a mapping
between phonemes the sounds that you make,
and visemes, which is the shape of your mouth.
So let's look in the bottom left hand corner
MBP mother, brother, parent. Try saying this at home.
Try saying mother and notice that your mouth has to close.
And now try saying it without closing your mouth.
Try saying "mother."
Now if you're a ventriloquist, you'll be able to do this.
Everybody else, you will sound like you're
not in enunciating the word properly.
My other favorite one is F and V
in the top row, "favor," "Victor,"
your lower lip curves in ever so slightly
and your top teeth come down. "Favor" and "Victor."
So when you make certain sounds,
your mouth has to have a certain shape.
This is the phoneme to viseme mapping.
And when we create things like lip sync deep fakes
those mechanisms that GAN that I told you about earlier,
the generative adversarial network,
doesn't know anything about phonemes.
It doesn't know anything about vizemes.
All it knows is about pixels, and these classifiers.
And so we can leverage that ignorance in order
to determine whether the mouth is making the proper shape
to say a particular phoneme.
So let me give you a couple examples of that.
So what I'm going to show you here is a slow motion version
of President Trump saying "I'm" "I am."
Okay, so let's go and watch that video.
So you see him saying "I'm"
and I'm going to just show you it in frame by frame
so you can see what happens to his mouth.
So frame one of six, two of six, three of six,
four of six, five of six, and six of six.
And now his mouth is entirely closed. "I'm".
There's that M phoneme and then the viseme is correct.
So this is an authentic clip.
Let me show you now a segment of a lip sync deep fake
where again he's saying "I'm"
and you're gonna hear the beginning of the next words.
You're gonna see "I'm so" "I'm so."
I'm going to put in that s so you can see
I'm closing off the phoneme ap.
So let's go ahead and watch this.
(audio distortion of "I'm so")
Okay, now let's do it in slow motion again.
One of four, two of four, three of four, four of four.
So, "I'm s-". And you can see his mouth never closed.
And if his mouth never closed,
something is almost certainly wrong
because it's very, very difficult, if not impossible,
to say "mother, I'm" without closing your mouth.
So what we've been doing is building models
of these phoneme viseme matchings, pairings rather,
and then going back in and making sure
that the mouth has the proper shape,
and exposing things like lip sync deep fakes,
which are simply ignorant of these types of mappings
because of the nature of the way GANs work.
So I've described two techniques that we've developed
for detecting deep fakes and I've described the threat
of deep fakes, and I've described how deep fakes are made.
And if you invite me back next year,
almost certainly everything will have changed.
The nature of the creation of deep fakes,
the risk of deep fakes, and the detection
of deep fakes is changing. It is a fast moving field.
And we have to start thinking seriously and carefully
about the threat of misinformation.
We are living through an unprecedented time,
where we are relying more and more on the Internet
for information. For information that affects our health,
our societies, our democracies, and our economies.
And when we can't trust the media
that we see, hear, and read on a daily basis,
we are in trouble as a society
and we are in trouble as a democracy.
And while I focused on the technology,
we also have to get serious about the policies
we have to get serious about the regulation.
The tech companies that allow this misinformation
and disinformation to proliferate
through their networks have to get more serious
about how their their platforms are being weaponized.
Our regulators have to get more serious
about how to get control over missing disinformation
that is designed to sow civil unrest, tear societies apart
and disrupt our democracies.
And we have to do all of that, by the way, quickly,
and with respecting freedom of expression
and freedom of free speech
and a vigorous debate online about people who disagree.
And I think that there is a middle ground there,
but we have gone too far in one direction
where we simply can't trust anymore,
what we see, hear, and read online
and we need to regain some trust
in order to have a sound democracy, society, and economy.
Thanks very much, everybody.