Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints

By Ning Yu, Larry S. Davis, Mario Fritz. IEEE International Conference on Computer Vision, 2018

553 citations recorded by the source corpus.

Recent advances in Generative Adversarial Networks (GANs) have shown increasing success in generating photorealistic images. But they also raise challenges to visual forensics and model attribution. We present the first study of learning GAN fingerprints towards image attribution and using them to classify an image as real or GAN-generated. For GAN-generated images, we further identify their sources. Our experiments show that (1) GANs carry distinct model fingerprints and leave stable fingerprints in their generated images, which support image attribution; (2) even minor differences in GAN training can result in different fingerprints, which enables fine-grained model authentication; (3) fingerprints persist across different image frequencies and patches and are not biased by GAN artifacts; (4) fingerprint finetuning is effective in immunizing against five types of adversarial image perturbations; and (5) comparisons also show our learned fingerprints consistently outperform several baselines in a variety of setups.

Subfields: Computer Vision and Pattern Recognition, Law

View Paper: https://www.semanticscholar.org/paper/2399db634fd0527648244d3fcc82c377c0a2550f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Vision and Pattern Recognition

In Law

Citations in the corpus

Detection of AI-Generated Synthetic Faces (2022, methodology): “In fact, GANgenerated images have been shown to embed a sort of artificial fingerprints [36, 60], specific to each individual GAN architecture.”
Learning on Gradients: Generalized Artifacts Representation for GAN-Generated Images Detection (2023, background): “They mainly depend on local regions artifacts [4, 44], blending boundary [26], global textures [30], and frequency-level artifacts [13, 18, 19, 45].”
M2TR: Multi-modal Multi-scale Transformers for Deepfake Detection (2021, background): “It has been shown that artifacts in manipulated images and videos are no longer perceptible with compression approaches like JPEG compression [15, 24, 59, 65].”
On The Detection of Synthetic Images Generated by Diffusion Models (2022, background): “Previous work [7, 8] established the existence of GAN fingerprints and their dependence on both the GAN architecture (number and type of layers) and its specific parameters (filter weights).”
Leveraging Frequency Analysis for Deep Fake Image Recognition (2020, methodology): “…in their original representation (i. e., raw pixels) and after applying DCT: K-nearest-neighbor, Eigenfaces (Sirovich & Kirby, 1987)), a CNN-based classiﬁer developed by Yu et al. (2019a), and a steganalysis method based on photo-response non-uniformity (PRNU) patterns by Marra et al. (2019).”
Dual Contrastive Loss and Attention for GANs (2021, background): “Yet, behind the seemingly saturated performance of the state-of-the-art StyleGAN2 [43], there still persists open issues of GANs that make generated images surprisingly obvious to spot [95, 81, 21, 28].”
FakeSpotter: A Simple Baseline for Spotting AI-Synthesized Fake Faces (2019, background): “Therefore, some researchers investigate the unique fingerprints of GANs in image synthesis [21,22] by detecting fake images in a general way.”
Thinking in Frequency: Face Forgery Detection by Mining Frequency-aware Clues (2020, methodology): “Various methods [3,33,45,46,43,58,60,30] have been proposed to detect the forged media.”
DIRE for Diffusion-Generated Image Detection (2023, background): “As a sample x g from the generated distribution p g ( x ) and its reconstruction x ′ g belong to the same distribution, the DIRE value for x g would be relatively low.”
Media Forensics and DeepFakes: An Overview (2020, background): “A similar goal is pursued in [173] through a suitably trained CNN.”
What makes fake images detectable? Understanding properties that generalize (2020, background): “This suggests that fake images generated by different PGANs differ slightly between the different initialization seeds (as also noted in [35]).”
Frequency-aware Discriminative Feature Learning Supervised by Single-Center Loss for Face Forgery Detection (2021, background): “Ad-ditionally, feature distributions of manipulated faces vary from one manipulation method to another considering various GAN ﬁngerprints [47] and some unique operations, as shown in the left of Figure 1, making it nontrivial to aggregate all the manipulated faces.”
Pros and Cons of GAN Evaluation Measures: New Developments (2021, result): “Similar works have been reported in [58, 59].”
Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data (2020, methodology): “Unlike existing methods that detect intrinsic differences between the real and deepfake classes [49, 56, 46, 12], we, standing for model inventors, propose a proactive solution by embedding artificial fingerprints into generative models and consequently into the generated images.”
Domain Fingerprints for No-Reference Image Quality Assessment (2019, methodology): “Based on that, [27] replaces the hand-crafted ﬁngerprint formulation with a learning-based one, and classify an image as real or GAN-generated by learning GAN ﬁngerprints of different GAN models.”