{"id":25464554,"url":"https://github.com/natanielruiz/disrupting-deepfakes","last_synced_at":"2025-11-04T00:30:33.868Z","repository":{"id":44343678,"uuid":"246146943","full_name":"natanielruiz/disrupting-deepfakes","owner":"natanielruiz","description":"🔥🔥Defending Against Deepfakes Using Adversarial Attacks on Conditional Image Translation Networks","archived":false,"fork":false,"pushed_at":"2020-05-07T19:58:27.000Z","size":51630,"stargazers_count":269,"open_issues_count":1,"forks_count":45,"subscribers_count":9,"default_branch":"master","last_synced_at":"2023-11-07T17:20:02.154Z","etag":null,"topics":["adversarial-attacks","computer-vision","deep-learning","deepfake-detection","deepfakes","defending","defending-deepfakes","disrupting-deepfakes","face-swap","faceswap","fake-news","machine-learning"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/natanielruiz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-03-09T21:35:47.000Z","updated_at":"2023-10-27T15:59:09.000Z","dependencies_parsed_at":"2022-09-05T15:51:17.414Z","dependency_job_id":null,"html_url":"https://github.com/natanielruiz/disrupting-deepfakes","commit_stats":null,"previous_names":[],"tags_count":0,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/natanielruiz%2Fdisrupting-deepfakes","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/natanielruiz%2Fdisrupting-deepfakes/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/natanielruiz%2Fdisrupting-deepfakes/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/natanielruiz%2Fdisrupting-deepfakes/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/natanielruiz","download_url":"https://codeload.github.com/natanielruiz/disrupting-deepfakes/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239423377,"owners_count":19636156,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["adversarial-attacks","computer-vision","deep-learning","deepfake-detection","deepfakes","defending","defending-deepfakes","disrupting-deepfakes","face-swap","faceswap","fake-news","machine-learning"],"created_at":"2025-02-18T06:31:40.064Z","updated_at":"2025-11-04T00:30:33.825Z","avatar_url":"https://github.com/natanielruiz.png","language":"Python","funding_links":[],"categories":["二、实用工具与代码仓库"],"sub_categories":["（一）开发向：适合程序员/研究者"],"readme":"## Disrupting Deepfakes: Adversarial Attacks on Conditional Image Translation Networks\n**[[Paper]](https://arxiv.org/abs/2003.01279)** **[[Demo Video]](https://youtu.be/7_7r4Ng4-bE)**\n\n\u003cp align=\"center\"\u003e\u003cimg width=\"100%\" src=\"imgs/demo.gif\" /\u003e\u003c/p\u003e\n\u003cp align=\"center\"\u003e\u003cimg width=\"100%\" src=\"imgs/main_1.gif\" /\u003e\u003c/p\u003e\n\nOfficial PyTorch implementation of **[Disrupting Deepfakes](https://arxiv.org/abs/2003.01279)** (to be presented at the **CVPR 2020 Workshop on Adversarial Machine Learning in Computer Vision**). This repository contains code for adversarial attacks (disruptions) for (conditional) image translation networks. The StarGAN, GANimation, pix2pixHD and CycleGAN networks are included - and the attacks can be adapted to any image translation network. We include adaptations of FGSM, I-FGSM and PGD attacks. We also include our class transferable attacks, adversarial training for image translation networks and spread-spectrum evasion of blur defenses.\n\n\u003e **Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systems**\u003cbr\u003e\n\u003e [Nataniel Ruiz](https://natanielruiz.github.io), [Sarah Adel Bargal](https://cs-people.bu.edu/sbargal/), [Stan Sclaroff](http://www.cs.bu.edu/~sclaroff/)    \u003cbr/\u003e\n\u003e Boston University \u003cbr/\u003e\n\u003e https://arxiv.org/abs/2003.01279 \u003cbr\u003e\n\u003e\n\u003e **Abstract:** *Face modification systems using deep learning have become increasingly powerful and accessible. Given images of a person's face, such systems can generate new images of that same person under different expressions and poses. Some systems can also modify targeted attributes such as hair color or age. This type of manipulated images and video have been coined Deepfakes. In order to prevent a malicious user from generating modified images of a person without their consent we tackle the new problem of generating adversarial attacks against such image translation systems, which disrupt the resulting output image. We call this problem disrupting deepfakes. Most image translation architectures are generative models conditioned on an attribute (e.g. put a smile on this person's face). We are first to propose and successfully apply (1) class transferable adversarial attacks that generalize to different classes, which means that the attacker does not need to have knowledge about the conditioning class, and (2) adversarial training for generative adversarial networks (GANs) as a first step towards robust image translation networks. Finally, in gray-box scenarios, blurring can mount a successful defense against disruption. We present a spread-spectrum adversarial attack, which evades blur defenses.*\n\n## Datasets and Models\n**StarGAN Dataset**\n```\ncd stargan\nbash download.sh celeba\n```\n**StarGAN Models**\n```\nbash download.sh pretrained-celeba-256x256\n```\n\n**GANimation Dataset**\n```\ncd ganimation\nmkdir -p data/celeba/images_aligned/new_small\n```\nWe use a third-party public pre-processed (cropped faces) version of the CelebA dataset that can be found [here](https://drive.google.com/open?id=1MijMc6QnjrNFopT1G43WQFeei9ddcaza). Please download datasets/celebA/imgs.tar from this Google Drive folder, extract imgs.tar and move these images into ganimation/celeba/images_aligned/new_small\n\n**GANimation Models**\n\nThe pretrained models can be downloaded [here](https://www.dropbox.com/sh/108g19dk3gt1l7l/AAB4OJHHrMHlBDbNK8aFQVZSa?dl=0). They should be located at ganimation/models\n\n**CycleGAN Dataset and Models**\n\nFollow instruction in the [CycleGAN official repository](https://github.com/junyanz/pytorch-CycleGAN-and-pix2pix) for downloading their models and data.\n\n**pix2pixHD Dataset and Models**\n\nFollow instruction in the [pix2pixHD official repository](https://github.com/NVIDIA/pix2pixHD) for downloading their models and data.\n\n## Attack Testing\n\nHere are bash commands for testing our vanilla attacks on each different architecture.\n```\n# StarGAN Attack Test\ncd stargan\npython main.py --mode test --dataset CelebA --image_size 256 --c_dim 5 --selected_attrs Black_Hair Blond_Hair Brown_Hair Male Young --model_save_dir='stargan_celeba_256/models' --result_dir='stargan_celeba_256/results_test' --test_iters 200000 --batch_size 1\n\n# GANimation Attack Test\ncd ganimation\npython main.py --mode animation\n\n# pix2pixHD Attack Test\ncd pix2pixHD\npython test.py --name label2city_1024p --netG local --ngf 32 --resize_or_crop none\n\n# CycleGAN Attack Test\npython test.py --dataroot datasets/horse2zebra/testA --name horse2zebra_pretrained --model test --no_dropout\n```\n\nIf you want to change the attack method being used, look into the attack.py scripts in each architecture folder and change the number of iterations, attack magnitude and step size. You can also re-run the class transferring and blur evasion experiments on StarGAN by commenting/uncommenting lines 54-61 in stargan/main.py or modifying the stargan/solver.py script to change the attack type.\n\nIn order to change attack types for GANimation you can modify lines 386-470 by commenting out the vanilla attack and uncommenting the attack you want to run. \n\n## GAN Adversarial Training\nIn order to run G+D adversarial training on StarGAN run:\n```\n# StarGAN Adversarial Training\npython main.py --mode train --dataset CelebA --image_size 256 --c_dim 5 --sample_dir stargan_both/samples --log_dir stargan_both/logs --model_save_dir stargan_both/models --result_dir stargan_both/results --selected_attrs Black_Hair Blond_Hair Brown_Hair Male Young\n```\nIf you wish to run vanilla training or generator adversarial training, comment/uncomment the appropriate lines (l.44-49) in stargan/main.py\n\nThe G+D adversarially trained model we used in the paper can be downloaded [here](https://drive.google.com/open?id=1xMM7q4w3lczO6Iskj8CWwmNWHBer9RBP).\n\n## Image Translation Network Implementations\nWe use code from [StarGAN](https://github.com/yunjey/stargan), [GANimation](https://github.com/vipermu/ganimation), [pix2pixHD](https://github.com/NVIDIA/pix2pixHD), [CycleGAN](https://github.com/junyanz/pytorch-CycleGAN-and-pix2pix) and [advertorch](https://github.com/BorealisAI/advertorch). These are all great repositories and we encourage you to check them out and cite them in your work.\n\n## Citation\nIf you find this work useful for your research, please cite our [paper](https://arxiv.org/abs/2003.01279):\n```\n@article{ruiz2020disrupting,\n    title={Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systems},\n    author={Nataniel Ruiz and Sarah Adel Bargal and Stan Sclaroff},\n    year={2020},\n    eprint={2003.01279},\n    archivePrefix={arXiv},\n    primaryClass={cs.CV}\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnatanielruiz%2Fdisrupting-deepfakes","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnatanielruiz%2Fdisrupting-deepfakes","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnatanielruiz%2Fdisrupting-deepfakes/lists"}