Réunion

Neural Waste Processing: Detecting Generated Images with Pre-Trained Neural Networks

Orateur invité : Christian Riess (Friedrich-Alexander-Universität)

In the recent past, the detection of generated images became one of the hottest topics in image forensics: given an input image, a machine learning system has to decide whether the image was captured with an actual camera or generated with a neural network. It quickly turned out that it is relatively easy to train a detector for one specific set of real and generated images, but that it is relatively difficult to train a detector on one set of images and apply it on another. This so-called generalization problem is arguably the largest obstacle in the deployment of forensic detectors as a service.

In this talk, we will look at one particular design paradigm for forensic detectors that generalizes comparably well: to craft a forensic detector around a neural network that has been trained for another task. As such, the detection of generated images becomes more of an indirect task that recycles some otherwise irrelevant artifacts of the pretrained network. Various facets of this idea can be appreciated in different scientific works, and we will add some own investigations towards a better understanding of the underlying design pattern.

Building a digital common to benchmark AI-generated image detectors

Christian Launay (Pôle d'Expertise de la Régulation Numérique (PEReN))

TBD

Steganalyzers for deep fake detection

Minh Thong Doi (CERI SN, CRIStAL)

TBD

DeTOX : Combatting deepfakes of (French) celebrities

Alexandre Libourel (EURECOM)

Politicians and government leaders are prime targets for deepfake attacks, where a single manipulated video can severely damage reputations or even pose national security risks. Attackers exploit vast amounts of publicly available audio and video data to generate highly realistic deepfakes. Current deepfake generation models successfully replicate the physical biometrics of an individual—such as facial structure and voice—but fail to reproduce their behavioral biometrics, including characteristic facial expressions and movement patterns. This gap can be exploited to improve the performance of Person of Interest (PoI) deepfake detection. By learning a POI’s unique facial dynamics and gestures, these detectors can identify inconsistencies where deepfakes fail to capture genuine behavioral traits. Unlike previous approaches relying on Facial Action Units—an incomplete representation of expressivity—our method models POI-specific behaviors using a state-of-the-art face-reenactment encoder coupled with a transformer to extract behavioral patterns. Furthermore, our method doesn’t require any deepfake samples during training. This independence from specific deepfake generation techniques makes our approach robust and adaptable, particularly for protecting high-profile individuals most vulnerable to deepfake threats. This work is a part of the DeTOX project, a French defense program from the ’Astrid: guerre Cognitive’ consortium. The present project aims at detecting deepfakes of French VIPs by leveraging generation weaknesses in video, audio, and audio-video synchronization.

Manipulation localization via JPEG compatibility attack

Etienne Levecque (LIST3N, Université de Technologie de Troyes)

JPEG compression and decompression act as many-to-one functions: each block is derived from a function that applies to at least one original antecedent. However, when local modifications are made to a JPEG image, such as inpainting using a generator, this property can be disrupted. In this case, the manipulated block may lack any identifiable antecedent, rendering it incompatible. If we know the exact JPEG pipeline of the image, we can attempt to recover one antecedent for each block. If this fails for certain blocks, it proves that these blocks have been altered, allowing us to pinpoint the manipulation down to the block level. Contrarily, if all blocks have at least one antecedent, we can consider the image to be authentic. This approach is powerful, explainable, and its false positive rate depends on the number of iterations and converge to zero.

From detection to characterization: what can we tell about an image modification?

Oratrice invitée : Ewa Kijak (Université de Rennes 1, IRISA)

TBD

Latent representation manipulation for face editing

Lilian Bour (GREYC)

TBD

MOSAIC : Machine-generated text detection in an unsupervised setting

Matthieu Dubois (Sorbonne Université, CNRS, ISIR)

TBD

Curriculum Learning for Fake Speech detection (CLeFS)

Aghilas Sini (LIUM)

Ce travail s’inscrit dans la problématique de l’incapacité des systèmes de détection de deepfake speech à anticiper de nouvelles attaques, en raison de l’essor et de l’évolution rapide des technologies de synthèse vocale. Nous proposons d’exploiter le Curriculum Learning comme mécanisme d’apprentissage afin de concevoir un système évolutif et plus robuste face aux attaques émergentes.

Nos expérimentations ont été menées sous les contraintes du challenge international ASVSpoof5, à savoir l’interdiction d’utiliser des modèles pré-entraînés et la limitation aux données fournies par les organisateurs pour l’entraînement. Pour répondre à ces exigences, nous avons adopté AASIST, un classificateur neuronal profond bi-classes spécialisé dans la détection de spoofing.

Dans un premier temps, nous avons étendu le classificateur bi-classes en un modèle multi-classes, afin d’anticiper l’émergence de nouvelles attaques. Concrètement, nous proposons d’entraîner un classificateur multiclasse en considérant l’ensemble des attaques et le bona fide présents dans le jeu de données, puis d’interpréter le modèle appris en bi-classes lors de l’inférence.

Dans notre approche, nous avons implémenté différentes stratégies propres au paradigme du Curriculum Learning, en explorant trois hyperparamètres clés : optimizer, sampler et accumulation. Les résultats obtenus montrent des performances comparables à celles des approches sans le mécanisme Curriculum Learning. Les expériences menées ont permis d’aborder des discussions sur l’intérêt de la réinitialisation de l’optimizer, de la réorganisation des données d’apprentissage (sampler) et de la sauvegarde des données durant l'apprentissage (accumulation).

Cette étude ouvre de nouvelles perspectives, notamment en intégrant une prise en compte plus fine des spécificités du locuteur et en adaptant l’apprentissage en fonction des typologies d’attaques.