Research map / Adversarial robustness and security / Backdoor and poisoning
Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a passcode-controlled, representation-suppressing, adaptive, invisible trigger generator to inject backdoors into Deepfake detectors via dirty-label or clean-label data poisoning.
Problem
Deepfake detectors trained on third-party datasets can be backdoored by malicious data providers who poison training data with triggers that bypass detection at inference time.
Approach
An encoder-decoder (steganography-style) trigger generator maps a passcode string and a benign face into an invisible, sample-adaptive trigger; a decoder enforces passcode recoverability, and in the clean-label setting an adversarial loss against a pretrained detector suppresses forgery representations so the trigger, not the content, is associated with the target label.
Key results
- Dirty-label passcode attack reaches near 100% ASR with the correct passcode on eight detectors while incorrect passcodes yield under 3% ASR, with benign accuracy matching original accuracy.
- Clean-label attack averages 97.26% ASR across four detectors versus 92.05% for the best prior invisible-trigger method PFF.
- Backdoor survives FT, FP, NAD and ABL defenses with clean-label ASR of 84-98% and dirty-label ASR of 99-100%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add representation-suppression learning using a ResNet detector during clean-label trigger generation (ablation) | Ours, clean-label · FF++ | ASR: 86.97 -> 96.62 | Helped |
| use ResNet rather than EfficientNet as the detector during clean-label trigger generation (ablation) | Ours, clean-label · FF++ | ASR: 91.91 -> 96.62 | Helped |
| use representation-suppression triggers for clean-label poisoning (ablation) | Ours, clean-label · FF++ | ASR: 86.97 -> 96.62 | Helped |
| use ResNet as the trigger-generation detector instead of no detector (ablation) | Ours, clean-label · FF++ | ASR: 86.92 -> 97.72 | Helped |
| use ResNet as the trigger-generation detector instead of no detector (ablation) | Ours, clean-label · FF++ | ASR: 83.64 -> 96.62 | Helped |
| use ResNet as the trigger-generation detector instead of no detector (ablation) | Ours, clean-label · FF++ | ASR: 84.14 -> 96.01 | Helped |
| use the correct passcode rather than an incorrect or similar passcode | Ours, dirty-label · FF++ | ASR: 99.19 vs. 0.00 | Helped |
| use the correct passcode rather than an incorrect or similar passcode | Ours, clean-label · FF++ | ASR: 90.91 vs. 0.56 | Helped |
Surprising findings
- Image compression has minimal effect on the trigger's attack success rate, while Gaussian blur largely negates it.
Limitations
- Trigger is fragile to heavy Gaussian blur (ASR drops almost entirely at radius 11).
- Visual quality metrics (SSIM, PSNR, FID) are only reference measures and may not reflect true perceptual quality.
- Evaluated on FF++, Celeb-DF and DFDC face datasets only, with a fixed 512x512 resolution.
Experimental setup
Datasets: FaceForensics++ Celeb-DF DFDC
Benchmarks: FaceForensics++ Celeb-DF DFDC
Metrics: ASR BA OA SSIM PSNR FID
Baselines: BadNet Blended ISSBA SIG LC PFF FT FP NAD ABL
Builds on: PFF ISSBA
Closest papers by meaning
- Exposing the Deception: Uncovering More Forgery Clues for Deepfake Detection (AAAI 2024 · similarity 0.88)
- DF40: Toward Next-Generation Deepfake Detection (NeurIPS 2024 · similarity 0.87)
- Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detection (ICLR 2024 · similarity 0.87)
- DiffusionFake: Enhancing Generalization in Deepfake Detection via Guided Stable Diffusion (NeurIPS 2024 · similarity 0.87)
- From Specificity to Generality: Revisiting Generalizable Artifacts in Detecting Face Deepfakes (NeurIPS 2025 · similarity 0.87)
- Rethinking Vision-Language Model in Face Forensics: Multi-Modal Interpretable Forged Face Detector (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.