Research map / Adversarial robustness and security / Backdoor and poisoning
Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Poisoned Forgery Face, a clean-label backdoor attack on face forgery detectors that uses a translation-sensitive trigger generator (convolving kernel loss) and landmark-based relative embedding to make real-labeled poisoned samples cause fake faces to be classified as real.
Problem
Backdoor attacks on face forgery detectors are underexplored; existing triggers conflict with blending-based synthetic fake generation (backdoor label conflict) and are visually perceptible, so they fail or are detectable.
Approach
A fully convolutional trigger generator is trained with a loss -log||K(v)⊗G(z)||_1 so the trigger changes under translation, which separates real-face triggers from transformed triggers on blended fakes; triggers are embedded only inside landmark-based blending masks with a pixel-relative ratio a·x/255 (a≤0.05).
Key results
- On FF++ with SBI, the method reaches 84.52 BD-AUC versus 68.13 for the best baseline (Blended), a +16.39 gain; on Face X-ray it reaches 79.82 BD-AUC.
- Against the Xception deepfake detector, BD-AUC is 99.65 on FF++ and 99.13 on Celeb-DF-2, with clean AUC preserved (85.18 vs 85.10 without attack).
- Stealthiness: PSNR 35.19 and L-infinity 10.84 versus Blended 31.66 and 12.41; human IM-Ratio 37.38% is the lowest among attacks tested.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply Poisoned Forgery Face instead of the strongest listed baseline | Xception · FF++ → FF++ | BD-AUC | No clear effect |
| apply Poisoned Forgery Face instead of the strongest listed baseline | SBI · FF++ → FF++ | BD-AUC: +16.39% | Helped |
| apply Poisoned Forgery Face instead of the strongest listed baseline | Face X-ray · FF++ → FF++ | BD-AUC: +7.72% | Helped |
| apply Poisoned Forgery Face instead of the strongest listed baseline | SBI · FF++ → CDF | BD-AUC | Helped |
| apply Poisoned Forgery Face instead of the strongest listed baseline | SBI · FF++ → DFD | BD-AUC | Helped |
| increase kernel size from 5 × 5 to 3 × 3 (ablation) | SBI trigger generator · FF++ → FF++ | BD-AUC: 84.52 -> 77.48 | Hurt |
| increase kernel size from 5 × 5 to 7 × 7 (ablation) | SBI trigger generator · FF++ → FF++ | BD-AUC: 84.52 -> 83.82 | Hurt |
| increase kernel size from 5 × 5 to 9 × 9 (ablation) | SBI trigger generator · FF++ → FF++ | BD-AUC: 84.52 -> 81.96 | Hurt |
| increase kernel size from 5 × 5 to 11 × 11 (ablation) | SBI trigger generator · FF++ → FF++ | BD-AUC: 84.52 -> 78.10 | Hurt |
| increase kernel size from 5 × 5 to 13 × 13 (ablation) | SBI trigger generator · FF++ → FF++ | BD-AUC: 84.52 -> 77.69 | Hurt |
| reduce relative embedding ratio from a=0.05 to a=0.03 (ablation) | SBI trigger embedding · FF++ → FF++ | BD-AUC: 84.52 -> 67.02 | Hurt |
| increase relative embedding ratio from a=0.05 to a=0.07 (ablation) | SBI trigger embedding · FF++ → FF++ | BD-AUC: 84.52 -> 86.81 | Helped |
Surprising findings
- Deepfake artifact detection (Xception) is more susceptible to backdoors than blending-based detectors, where most baselines are far below 100% BD-AUC.
- Blending-artifact detectors resist existing clean-label attacks, with BD-AUC often near 50% (e.g., BadNets 48.47 on SBI).
Limitations
- Method is not optimal for specific detectors; relies on common transformations rather than per-method optimization.
- Attack performance depends on the kernel size used for trigger generation; larger kernels degrade BD-AUC.
- Face X-ray attack on FF++ AUC drops relative to the clean model (77.70 vs 78.90).
Experimental setup
Datasets: FaceForensics++ (c23/HQ)
Benchmarks: FaceForensics++ Celeb-DF-2 DeepFakeDetection
Metrics: AUC BD-AUC PSNR L-infinity IM-Ratio average prediction score
Baselines: BadNets Blended ISSBA SIG Label Consistent FTrojan FT FP NAD ABL
Builds on: SBI Face X-ray Label Consistent BadNets
Closest papers by meaning
- Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted (CVPR 2025 · similarity 0.87)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.86)
- Rethinking Vision-Language Model in Face Forensics: Multi-Modal Interpretable Forged Face Detector (CVPR 2025 · similarity 0.86)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.86)
- DevFD : Developmental Face Forgery Detection by Learning Shared and Orthogonal LoRA Subspaces (NeurIPS 2025 · similarity 0.86)
- Identity-Aware Vision-Language Model for Explainable Face Forgery Detection (AAAI 2026 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.