Multi-attentional Deepfake Detection

Since the face forgery causes great threat to societal security, it is of paramount importance to develop effective countermeasures against it. Many works [46, 23, 4, 53, 34, 22, 33, 26, 45, 43] have been proposed. Early works [46, 23] detect the forgery through visual biological artifacts, e.g., unnatural eye blinking or inconsistent head pose.

As the learning based methods become mainstream, some works [53, 34] have proposed frameworks which extract features from spatial domain and have achieved excellent performances on specific datasets. Recently, more data domains have been considered by emerging methods. [45] detects tampered faces through Spatial, Steganalysis and Temporal features. It adds a stream of simplified Xception with a constrained convolution layer and an LSTM. [26] uses a two-branch representation extractor to combine information from the color domain and the frequency domain using a multi-scale Laplacian of Gaussian (LoG) operator. [33] uses frequency-aware decomposition and local frequency statistic to expose deepfake artifacts in frequency domain and achieves state-of-the-art performance.

Most existing methods treat the deepfake detection as a universal binary classification problem. They focus on how to construct sophisticated feature extractors and then a dichotomy to distinguish the real and fake faces. However, the photo-realistic counterfeits bring significant challenge to this binary classification framework. In this paper, we redefine the deepfake detection problem as a fine-grained classification problem according to their similarity.

Fine-grained classification [50, 49, 13, 37, 12, 52, 47, 17, 10] is a challenging research task in computer vision, which captures the local discriminative features to distinguish different fine-grained categories. Studies in this field mainly focus on locating the discriminative regions and learning a diverse collection of complementary parts in weakly-supervised manners. Previous works [50, 49] build part models to localize objects and treat the objects and semantic parts equally. Recently, several works [52, 47, 10] have been proposed under a multiple attentional framework, the core ideal of these method is that learning discriminative regions in multiple scales or image parts simultaneously and encouraging the fusion of these features from different regions. In addition, [17] designs attention cropping and attention dropping to obtain more balanced attention maps. In this paper, we model deepfake detection as a special fine-grained classification problem for the first time. It shares the same spirit in learning subtle and discriminative features, but only involves two categories, \ie, real and fake.

In this section, we initially state the motivation of the designing and give a brief overview of our framework. As aforementioned, the discrepancy between real and fake faces is usually subtle and occurs in local regions, which is not easy to be captured by single-attentional structural networks. Thus we argue that decomposing the attention into multiple regions can be more efficient for collecting local feature for deepfake detection task. Meanwhile, the global average pooling which is commonly adopted by current deepfake detection approaches is replaced with local attention pooling in our framework. This is mainly because the textural patterns vary drastically among different regions, the extracted features from different regions may be averaged by the global pooling operation, resulting in a loss of distinguishability. On the other hand, we observe that the slight artifacts caused by forgery methods tend to be preserved in textural information of shallow features. Here, the textural information represents the high frequency component of the shallow features, just like the residual information of RGB images. Therefore, more shallow feature should be focused on and enhanced, which has not been considered by current state-of-the-art detection approaches.

Motivated by these observation, we propose a multi-attentional framework to solve the deepfake detection as a fine-grained classification problem. In our framework, three key components are integrated into the backbone network: 1) We employ an attention module to generate multiple attention maps. 2) We use densely connected convolutional layers [18] as a texture enhancement block, which can extract and enhance the textural information from shallow feature maps. 3) We replace the global average pooling with Bilinear Attention Pooling(BAP). And we use BAP to collect the textural feature matrix from the shallow layer and retain the semantic feature from the deep layer. The framework of our method is depicted in Figure 2.

Unlike single-attentional structure based network which can take the video-level labels as explicit guidance for training, the multi-attentional based network can only be trained in a unsupervised or weakly-supervised manner due to the lack of region-level labels. It could lead to a degradation of network that multiple attention maps focus on same region while ignoring other regions which may also provide discriminative information. To address the problem, we specifically design a Region Independence Loss, which aims to ensure each attention map focusing on one specific region without overlapping and the focused region is consistent across different samples. Further, we employ the Attention Guided Data Augementation(AGDA) mechanism to decrease the salience of the most discriminative feature and force other attention maps to mine more useful information.

Denote the input face image of network as $I$ and the backbone network of our framework as $f$, the feature maps extracted from the intermediate stage of $t$-th layer is denoted as $f_{t}(I)$ with size of $C_{t}\times H_{t}\times W_{t}$. Here, $C_{t}$ is the number of channels, $H_{t},W_{t}$ are the height and the width of feature maps, respectively.

Here $T$ contains most textural information of $f_{SL_{t}}(I)$. We then use a densely connected convolution block with 3 layers to enhance $T$, the output is noted as $F\in R^{C_{F}\times H_{s}\times W_{s}}$, which is defined as “textual feature map”.

To the end of this step, the partial textural feature maps $F_{k}$ should be fed into classifier after global pooling. However, considering the differences among the different region range, if using the traditional global average pooling, the pooled feature vector will be influenced by the intensity of attention map, which violates the purpose of focusing on textural information. To address the problem, we design a normalized average pooling:

$$v_{k}=\frac{\sum_{m=0}^{H_{s}-1}\sum_{n=0}^{W_{s}-1}F_{k,m,n}}{||\sum_{m=0}^{H_{s}-1}\sum_{n=0}^{W_{s}-1}F_{k,m,n}||_{2}}$$

(2)

The normalized attention features $v_{k}\in R^{1\times N}$ are then stacked together to obtain the textural feature matrix $\mathbf{P}\in R^{M\times C_{F}}$, which will be fed into the classifier.

As to deep features, we first splice each attention map to get a single channel attention map $A_{sum}$. Then we use BAP for $A_{sum}$ and the feature map from the last layer of network to get the global deep feature $\mathbf{G}$, which will also be fed into the classifier.

As aforementioned, training a multiple attention network may easily fall into a network degraded case due to the lack of fine-grained level labels. In details, different attention maps tend to focus on the same region as shown in Figure 4 which is not conducive to the network to capture rich information for a given input. In addition, for different input images, we hope that the each attention map locates in fixed semantic region, for example, attention map $A_{1}$ focuses on eyes in different image, $A_{2}$ focuses on mouth. Therefore, the randomness of captured information by each attention map will be reduced.
如前所述，由于缺乏细粒度的级别标签，训练多注意力网络很容易陷入网络降级的情况。具体来说，不同的注意力图往往集中在同一个区域，如图 4 所示，这不利于网络捕获给定输入的丰富信息。此外，对于不同的输入图像，我们希望每个注意力图都位于固定的语义区域，例如，注意力图 $A_{1}$ 关注不同图像中的眼睛， $A_{2}$ 关注嘴巴。因此，每个注意力图捕获的信息的随机性会降低。

To achieve these goals, we propose a Region Independence Loss which helps to reduce the overlap among attention maps and keep the consistency for different inputs. We apply BAP on the pooled feature map $D$ otained in Section 3.2 to get a “semantic feature vector” : $V\in R^{M\times N}$, and the Regional Independence Loss is defined as below by modifying the center loss in [15]:
为了实现这些目标，我们提出了一个区域独立性损失，它有助于减少注意力图之间的重叠并保持不同输入的一致性。我们在第 3.2 节中提出的池化特征图 $D$ 上应用 BAP 以获得“语义特征向量” ： $V\in R^{M\times N}$ ，通过修改 [15] 中的中心损失，区域独立性损失定义如下：

	$\displaystyle\mathcal{L}_{RIL}=\sum_{i=1}^{B}\sum_{j=1}^{M}\max(\left\|V_{j}^{i}-c_{j}^{t}\right\|_{2}^{2}-m_{in}(y_{i}),0)+$		(3)
	$\displaystyle\sum_{i,j\in(M,M),i\neq j}\max\left(m_{out}-\left\|c_{i}^{t}-c_{j}^{t}\right\|_{2}^{2},0\right)$

where $B$ is the batch size, M is number of attentions, $m_{in}$ represents the margin between feature and the corresponding feature center and is set as different values when $y_{i}$ is $0$ and $1$. $m_{out}$ is the margin between each feature center. $c\in R^{M\times N}$ are feature centers of $V$, it is defined as below and updated in each iteration:

$$c^{t}=c^{t-1}-\alpha\left(c^{t-1}-\frac{1}{B}\sum_{i=1}^{B}V^{i}\right)$$

(4)

Here $\alpha$ is the updating rate of feature centers, we decay $\alpha$ after each training epoch. The first part of $L_{RIL}$ is an intra-class loss that pulls $V$ close to feature center $c$, the second part is an inter-class loss that repels feature centers scattered. we optimize $c$ by calculating the gradient for $V$ in each batch. Considering that the patterns of texture in fake faces should be more diverse than real ones for fakes are generated by multiple methods, thus we restrict part features of fake faces in the neighborhood from the feature center of real ones but with larger margin. In this way, we give a larger margin in the intra-class for searching useful information in fake faces.

For the objective function of our framework, we combine this Regional Independence Loss with the traditional cross entropy loss:

$$\mathcal{L}=\lambda_{1}*\mathcal{L}_{CE}+\lambda_{2}*\mathcal{L}_{RIL}$$

(5)

$\mathcal{L}_{CE}$ is a cross entropy loss, $\lambda_{1}$ and $\lambda_{2}$ are the balancing weights for these two terms. By default, we set $\lambda_{1}=\lambda_{2}=1$ in our experiments.

Under the restraining of Regional Independence Loss, we reduce the overlap of different attention regions. However, although different attention regions can be well separated, the attention maps may still respond to the same discriminative features. For example, in Figure 5, the attention regions are not overlapped but they all strongly respond to the landmarks of input faces. To force the different attention maps to focus on different information, we propose the Attention Guided Data Augmentation (AGDA) mechanism.

For each training sample, one of the attention maps $A_{k}$ is randomly selected to guide the data augmentation process, and it is normalized as Augmentation Map $A^{*}_{k}\in R^{H\times W}$. Then we use Gaussian blur to generate a degraded image. Finally, we use $A^{*}_{k}$ as the weight of original image and degraded image:

$$I^{\prime}=I\times(1-A^{*}_{k})+I_{d}\times A^{*}_{k}$$

(6)

Attention guided data augmentation helps to train the models in two aspects. Firstly, it can add blurry to some regions which ensure the model to learn more robust features from other regions. Alternatively, AGDA can erase the most saliently discriminative region by chance, which forces different attention maps focusing their response on different targets. Moreover, the AGDA mechanism can prevent a single attention region from expanding too much and encourage the attention blocks to explore various attention region dividing forms.

For all real/fake video frames, we use a state-of-the-art face extractor RetinaFace[8] to detect faces and save the aligned facial images as inputs with a size of $380\times 380$. We set hyper-parameters $\alpha=0.05$ in Equation 4, and decayed by 0.9 after each epoch. The inter-class margin $m_{out}$ in Equation 3 is set to 0.2. The intra-class margin $m_{in}$ are set as 0.05 and 0.1 respectively for real and fake images. We choose quantity of attention maps $M$, $SL_{a}$ and $SL_{t}$ by experiments. In AGDA we set the resize factor 0.3 and Gaussian blur $\sigma=7$. Our models are trained with Adam optimizer[20] with learning rate 0.001 and weight decay 1e-6. We train our models on 4 RTX 2080Ti GPUs with batch size 48.

In this paper, we adopt EfficientNet-b4[39] as the backbone network of our multi-attentional framework. EfficientNet-b4 is able to achieve comparable performance to XceptionNet [3] with only half FLOPs. There are 7 main layers in total of EfficientNet, which are denoted from L1-L7, respectively.

As mentioned above, we observe that subtle artifacts tend to be preserved by textural features from shallow layers of the network, thus we choose L2 and L3 as the candidates of $SL_{t}$. Conversely, we want the attention maps to attend to different regions of the input, which needs the guidance of high-level semantic information to some extent. Therefore, we use deeper stage L4 and L5 as the candidates of $SL_{a}$. By default setting $M=1$, we train models with four combinations on FF++(HQ). From the results in Table 1, we find that the model reaches best performance when using L2 for $SL_{t}$ and L5 for $SL_{a}$.

In this section, we compare our framework with current state-of-the-art deepfake detection methods. We evaluate the performance on FF++ [34] and DFDC [9], respectively. And we further evaluate the cross-dataset performance on Celeb-DF [25] in Section 4. We adopt ACC (accuracy) and AUC (area under Receiver Operating Characteristic Curve) as the evaluation metrics for extensive experiments.