Towards Robust Gan-Generated Image Detection: A Multi-View Completion Representation

1 Introduction

AI-powered image manipulation techniques, such as deepfakes, are constantly evolving thanks to the continuous advances in deep generative models, particularly generative adversarial networks (GANs) [Goodfellow et al., 2014a]. The quality and fidelity of the generated images have reached a photorealistic level that is indistinguishable from real images to human eyes. Alongside the technical advance, society is raising significant concerns regarding the abuse of these techniques to create and spread misleading information, which will cause a trust crisis where "seeing is no longer believing." To tackle the issues, the research community has been dedicated to developing powerful forensics tools against malicious image manipulations. One crucial and promising direction is detecting GAN-generated fake images, considering the ubiquitous adoptions of GANs in image manipulation tasks.

Most detection methods typically train CNN classifiers to learn specific features to distinguish GAN-generated images from real ones [Hu et al., 2021; Liu et al., 2020; Marra et al., 2019a; Dzanic et al., 2020; Frank et al., 2020; Durall et al., 2020], which work satisfactorily on clean test samples from the same GANs used in training. However, their performances will decrease dramatically when facing samples generated by unknown GANs or perturbed by noises, leading to limited practical reliability. One primary reason is that a deep CNN classifier may easily overfit unstable GAN-specific features of the training samples, particularly the low-level frequency-domain artifacts [Wang et al., 2020; He et al., 2021; Jeong et al., 2022a; Jeong et al., 2022b]. Previous studies have proved that conspicuous artifacts exist in the spectra of GAN-generated images [Wang et al., 2020; Frank et al., 2020]: Despite being easily identified by classifiers, these artifact patterns are inconsistent, varying significantly among different GAN models or perturbations. As a result, the classifier overfitting a specific frequency pattern will suffer from weak generalization ability and robustness in detecting other frequency patterns.

Based on the understanding of the overfitting issue, we are motivated to design an improved detection model with two requirements: (1) reduce the dependency on unstable lowlevel frequency features; and (2) learn a robust feature representation from other types of information, such as regional consistency, and color or textural details of images. Instead of directly learning detectable features from fake images, which potentially leads to the frequency overfitting problem, we propose a novel detection framework that incorporates a multi-view image completion learning and a cross-view classification learning processes, as sketched in Fig. 1. The framework can learn a strong and stable feature representation from diverse frequency-independent, view-specific information, resulting in outperforming generalization and robustness when facing unknown GANs or perturbations.

In the multi-view completion process, multiple view-toimage completion models are learned with real images only, and then used to characterize diverse distributional discrepancies between real and fake images. In contrast to overfitting specific GAN patterns, the compact distributions of the image-missing characteristics modeled from real images are more likely to distinguish unknown, out-of-distribution fake images from real ones [Ruff et al., 2020]. In addition, the view-to-image completions can align the frequency patterns of different types of fake samples with that of real images, which helps reduce the classifier's frequency bias. Then, in the cross-view classification, the real and fake samples synthesized from each incomplete view are fed into an independent classifier. The multi-scale feature concatenation and low-pass residual-guided attention modules are devised to strengthen the intra-view feature representation. The independent classifiers are finally combined using an adaptive loss fusion strategy to enhance the learning from cross-view information. Our contributions are highlighted as follows:

• We propose a novel GAN-generated image detection framework using multi-view completion classification learning to build a robust feature representation for detecting unknown GANs and perturbations.
• We devise several novel modules and learning strategies that effectively benefit the framework's ability to capture and incorporate diverse view-specific features.
• We perform extensive evaluations which validate the significantly improved generalization and robustness of our framework in a wide range of settings varying in image resolutions, GAN types, and perturbation methods.

2 Generated Image Detection: AReview

Image-domain detection. Image-domain detection extracts detectable traces from the pixel inputs. Earlier works tended to train a CNN to learn deep features in a data-driven manner [Marra et al., 2018; Tariq et al., 2018], while more recent works prefer to craft specific features for higher detection accuracy, such as the co-occurrence matrices [Nataraj et al., 2019; Barni et al., 2020], saturation [McCloskey and Albright, 2019], specular highlights [Hu et al., 2021] and texture cues [Liu et al., 2020]. [Marra et al., 2019a] and [Yu et al., 2019] pointed out that a GAN will leave a unique fingerprint containing the source model information in the generated images. Some other works improve on the network design, where novel learning strategies or modules, such as incremental learning [Marra et al., 2019b], self-attention mechanism [Jeon et al., 2020; Mi et al., 2020] and vision transformer [Wang et al., 2022], are adopted.

Frequency-domain detection. Frequency-domain detection relies on identifying the frequency discrepancy between GAN-generated images and real images [Dzanic et al., 2020; Frank et al., 2020; Durall et al., 2020]. Frequency discrepancy can be easily captured in various spectral representations by a classifier. For example, [Frank et al., 2020] found that even a shallow CNN can achieve a high detection accuracy using the 2D Discrete Cosine Transform (DCT) coefficients as input data. [Qian et al., 2020] proposed a dual-branch network that extracts the global and local DCT features. [Dzanic et al., 2020] and [Durall et al., 2020] proposed to transform the 2D Fast Fourier Transform (FFT) magnitude into 1D power profile as detectable features. [Liu et al., 2021] found that more distinguishable features can be extracted in the phase spectrum than in the amplitude spectrum. Unfortunately, some recent studies also pointed out that the frequency features are unstable and easy to be concealed [Dzanic et al., 2020; Durall et al., 2020; Liu et al., 2022; Huang et al., 2020; Jung and Keuper, 2021; Dong et al., 2022]. Thus, detectors heavily relying on frequency features are vulnerable and weakly generalized.

Generalized and robust detection. Generalized and robust detection of GAN-generated images is now in high demand. Most existing works involve a preprocessing operation to strengthen the representation of generalized and robust features. [Zhang et al., 2019] pointed out that a detector can generalize between two GANs with similar spectral artifacts in their generated images, which in turn confirms that a detector is likely to overfit specific frequency patterns. [Wang et al., 2020] explored the effects of different data augmentation strategies such as compression and blurring in improving a detector's generalization ability. [Jeong et al., 2022a] proposed to preprocess the fake images with a bilateral high-Pass filter, which amplifies the effect of the common frequencylevel artifacts shared by different GANs. [Jeong et al., 2022b] designed a frequency-level perturbation framework to erode the GAN-specific spectral artifacts in generated images before feeding them to a detector. [He et al., 2021] proposed to re-synthesize training images using a super-resolution model pre-trained with real images to help extract robust features and isolate fake images.

3 The Proposed Framework

We design the Multi-view Completion Classification Learning (MCCL) to build a novel multi-view, frequencyindependent feature representation for robust detection of GAN-generated images. As shown in Figure 2, the framework jointly trains a set of restorers and classifiers. The restorers are trained with real images only, and each learns to reconstruct the full image from one particular incomplete view. Then, both real and fake images are processed by each restorer through the same view-to-image pipeline. Since the recovery of missing information is governed by real images' characteristics only, the distributional difference between the reconstructed real and fake samples can be reflected in the restored information. Then, for each view, a classifier is trained based on the reconstructed samples to capture the view-specific distributional discrepancy. We combine the multi-scale features encoded by different decoding layers of each restorer with the restored image as the classifier's input. A low-pass residual-guided attention module is employed at the entry of the classifier to highlight the reconstruction difference between real and fake images. A self-adaptive loss fusion module is additionally designed to combine the decisions of multiple classifiers to facilitate inter-view learning.

3.1 Multi-View Image Completion Learning

Several independent encoder-decoder-based restorers R = {Rv }Nv=1 are trained with real images to recover the full image from different incomplete views. It is non-trivial to select the appropriate views for completion, which determines what types of frequency-irrelevant information we want to exploit. Since regional consistency, color, and texture have been

proven to be distinguishable features for GAN-generated images [Liu et al., 2020; Hu et al., 2021], we empirically consider three completion tasks: Masked Image Modeling, Grayto-RGB, and Edge-to-RGB, where the regional, color and textural details are previously missing and restored, respectively. The natural compact distributions of these types of information can be modeled during the completion. The significance of each view is also explored in the experiment.

Masked Image Modeling is an emerging approach for visual representation learning [He et al., 2022], which masks a portion of an image and predicts the masked area, and Dual-domain constraint. Given an image X and an incomplete view Xv , the completion is formulated as ˜Xv = Rv (Xv ). The training of Rv is supervised with a dualdomain constraint, which incorporates a pixel-level regression loss and a frequency loss:

where F(·) denotes the 2D FFT. The frequency loss computes the element-wise Euclidean distance between the Fourier spectra of original and restored images, which ensures Rv to capture the natural, correct frequency property of real images, so as to facilitate the frequency alignment between real and fake images. The optimization function can be therefore denoted as

where λ is the weight to balance different losses.

3.2 Intra-ViewClassification Learning

After training Rv with real images, both real and fake images are processed by Rv via the same image completion pipeline to enable the subsequent classification learning. To mine more robust and frequency-irrelevant features from each individual view's pathway, we propose the multi-scale feature concatenation and low-pass residual-guided attention modules, as shown in the orange box in Figure 2.

Multi-scale feature concatenation. Since Rv is an encoder-decoder consisting of multiple layers, during the completion, the missing information of the original image is progressively recovered by the stacked decoding layers of Rv . Thus, meaningful features for distinguishing real and fake images are embedded not only in the final output image, but also in the intermediate feature maps of the decoder. To this end, we build a feature pyramid to concatenate the intermediate features at different scales. For a decoder of Rv with a total of S layers, let fs be the feature map of the s-th layer, the s-th feature of the concatenation is computed as:

where Up(·) is an upsampling layer with a scaling factor of 2 to align the scales between two feature maps; Conv1(·) is a 1 × 1 convolutional layer to reduce channel dimensions; Conv3(·) is a 3×3 convolutional layer to suppress the aliasing effect of upsampling; Concat(·) indicates the concatenation of two tensors. Finally, the last layer of the feature pyramid zS is combined with the reconstructed image ˜X to get the enhanced feature F in the following way:

Low-pass residual-guided attention. The distinguishable features are contained in the restored regional, color, and textural information of the image. Thus, it is possible to leverage the reconstruction residual to provide spatial attention to improve intra-view learning. However, one challenge is that, since the original image X is involved in computing the residual, both stable and unstable features in the original image potentially remain in the residual. As discussed earlier, unstable features that are detrimental to generalization and robustness should be avoided. Prior studies have found that these unstable features are low-level artifacts that mainly cluster in high-frequency components [Frank et al., 2020; Durall et al., 2020]. Thus, we propose only using the lowfrequency residual to guide the classifier to focus on more stable features. Given an image X and its reconstructed version ˜X, the low-frequency residual is:

where H(·) is the first-order low-pass Butterworth filter and | · | is the absolute function. An attention mechanism is then devised to exploit the low-frequency residual. A functional network is used to process M to get the attention map, i.e., ˆM = G(M), where G(·) consists of a 7 × 7 convolutional layer, an average pooling layer and a sigmoid function. The attention map is applied to the enhanced feature F in Eq. 4 to obtain the residual-guided feature:

where ⊗ indicates the element-wise multiplication.

3.3 Inter-ViewClassification Learning

When the intra-view feature enhancement is ready, we can get a set of features { ˆ F v }Nv=1 corresponding to different views. For each view, an independent neural network classifier C v is trained on the feature ˆ F v . Since the features provide viewspecific information, the classifiers will learn diverse representations and contribute differently facing the same data instance. To ensure the complementarity and interactivity across different views during training, we propose a selfadaptive cross-view loss fusion strategy.

Self-adaptive loss fusion. The self-adaptive loss fusion strategy aims to combine the losses of different classifiers using adaptive weights, such that the importance of each viewspecific representation can be estimated and respected in the final decision. The weights are learned and autonomously adjusted during training. Formally, given a view-specific feature instance ˆ F v and the corresponding label y (y = 0 if the the sample is a real image, otherwise 1), let pv be the probability that the sample is fake predicted by C v . The training of C v is supervised by minimizing the cross-entropy loss:

The self-adaptive loss fusion strategy can be denoted as a minimization problem with respect to the weights β:

where τ > 1 is the power exponent parameter to avoid the trivial solution of β during the classification. In the inference stage, the decision is made on the average predicted probability of fake (pv ) over all classifiers, i.e., pfake = 1 3 ∑v pv , with a threshold of 0.5.

3.4 Optimization

The components of MCCL that require optimization include the parameters of {Rv }Nv=1 , {C v }Nv=1 and several building blocks for intra-view learning (for simplicity, the latter two are denoted in together as {C v }Nv=1 ), as well as the selfadaptive loss weights β. The optimization is performed in the following alternative way:

Update network parameters. The completion and classification networks with respect to different views are updated independently in parallel. For the view v, Rv and C v can be updated sequentially by optimizing the corresponding loss functions Eq. 2 and Eq. 7. During the optimization, the loss weights β are fixed.

Update loss weights β. Next, we fix the parameters of {Rv }Nv=1 and {C v }Nv=1 , and update β by solving Eq. 8. To satisfy the constraints, the Lagrangian function of Eq. 8 is

where ζ is the Lagrange multiplier. By derivation of Eq. 9 with respect to βv and ζ, the optimal solution of Eq. 8 is:

4 Experiments

4.1 Datasets

Real images. Our experiments are conducted on facial images, given that human faces are the main target of deepfakes. We choose the large-scale facial image dataset CelebA [Liu et al., 2015] and its high-quality version CelebA-HQ [Karras et al., 2018] to perform evaluations at different resolutions. The CelebA images have a resolution of 128 × 128 and the CelebA-HQ images have a resolution of 1024 × 1024.

GAN-generated images. A total of six popular GAN types are considered: ProGAN [Karras et al., 2018], CramerGAN [Bellemare et al., 2017], SNGAN [Miyato et al., 2018], MMDGAN [Li et al., 2017], StyleGAN [Karras et al., 2019] and StyleGAN2 [Karras et al., 2020]. In the low-resolution setting, we follow the setting in [Yu et al., 2019], using the pre-trained ProGAN, CramerGAN, SNGAN, and MMDGAN models 1 to generate fake faces. All the four GANs are pretrained with CelebA. In the high-resolution setting, we adopt the dataset released by [He et al., 2021] 2 , which includes images generated by ProGAN, StyleGAN, and StyleGAN2. Note that the ProGAN and StyleGAN are pre-trained with CelebA-HQ, while the StyleGAN2 with another facial image dataset FFHQ [Karras et al., 2019]. Since FFHQ has a larger diversity in terms of facial attributes compared with CelebAHQ, StyleGAN2 is included for cross-domain evaluation. Table 1 shows the details of the dataset setting.

Table 1: The details of the experimental dataset setting.

4.2 Implementation Details

The restorers and classifiers are implemented based on UNet [Ronneberger et al., 2015] and Xception [Chollet, 2017], respectively. The U-Net we use has five skip connection blocks (i.e., S = 5), and their output feature maps are employed to build the feature concatenation. We train the whole framework with a batch size of 80 using the Adam optimizer [Kingma and Ba, 2015]. The initial learning rate is 1e-3, and we reduce it to half after every ten epochs. τ in Eq. 8, and λ in Eq. 2 are empirically set to 4 and 10, respectively. We also use random Gaussian noise, color jitter, and blurring for data augmentation on the restorer side.

1 https://github.com/ningyu1991/GANFingerprints

2 https://github.com/SSAW14/BeyondtheSpectrum

4.3 Baseline DetectionModels

We compare MCCL with two normal detectors that exploit a CNN to extract and learn features directly: the image-domain detector using GAN fingerprints (GAN-FP) [Yu et al., 2019] and the frequency-domain detector based on 2D DCT coefficients (2d-DCT) [Frank et al., 2020]. We also compare three state-of-the-art generalized and robust detection methods: the data augmentation-based method (DA) [Wang et al., 2020], the frequency-level perturbation (FLP) [Jeong et al., 2022b], and the super-resolution re-synthesis (SRR) [He et al., 2021], each of which has specific strategies to improve robustness. The detection performance is evaluated by the classification accuracy (Acc.) and the average precision score (A.P.) commonly used in related studies [Wang et al., 2020; Jeong et al., 2022b].

4.4 Results of Generalization

Low-resolution setting. We train the detection model with the CelebA images and the corresponding 128×128 ProGAN images and test it with the ProGAN, CramerGAN, SNGAN, and MMDGAN images to evaluate the cross-GAN generalization ability. The results compared to five baselines are listed in Table 2. We conclude that: 1) The normal detectors, GAN-FP and 2d-DCT, are highly accurate for withindistribution detection but generalize poorly for cross-GAN detection, implying the risk of overfitting unstable features; 2) The other four detectors with specific strategies all get the cross-GAN detection performance improved. Our method MCCL achieves the best or second-best results spanning over all GANs, thanks to the novel multi-view representation enriching more robust, frequency-irrelevant features.

High-resolution setting. We follow the setting in [He et al., 2021]: we train a ProGAN detector and a StyleGAN detector independently using CelebA-HQ and the corresponding GAN images, and test both on ProGAN, StyleGAN, and StyleGAN2 test samples to evaluate the within-distribution, crossGAN and cross-domain performances, respectively. The results are summarized in Table 3. All detectors perform well in within-distribution detection. In the cross-GAN group, 2dDCT becomes more robust compared with its low-resolution performance. The reason may be that with the resolution increasing, stable low-frequency features are naturally enriched, which can be easier captured by the classifier trained directly on spectra. We can also see that FLP, SRR, and MCCL improve more significantly than DA in this group because they reduce classifiers' dependency on unstable frequency features in a learnable way. Regarding the cross-GAN & cross-domain group, which is the most challenging, our method remarkably outperforms all baseline methods in both sub-groups, indicating great applicability to difficult detection scenarios.

4.5 Results of Robustness

We evaluate the robustness against perturbations using the 128 × 128 ProGAN detectors. We train detectors with the CelebA and ProGAN images, and test them with perturbed ProGAN samples. Unlike prior work mainly concerning common image manipulations [Frank et al., 2020; Yu et al., 2019; Wang et al., 2020], we investigate a broader range of perturbations: (1) Common manipulations, including Blurring, Cropping, Compression, Noising and a mix of all. We follow the setting in [Frank et al., 2020] to created the perturbations; (2) Adversarial perturbations including FGSM [Goodfellow et al., 2014b] and PGD [Madry et al., 2018]. The adversarial examples are crafted based on a vanilla Xception detector with the noise amount ϵ = 8/255; and (3) Spectrum Difference Normalization (SDN) [Dong et al., 2022], an attack specific to GAN-generated images that calibrates the spectra of fake images according to real images.

An example of samples modified by different perturbations is shown in Figure 4. Table 4 shows the results. Since most perturbations significantly modify the original frequency distribution of fake samples, the performance of normal detectors degrades rapidly, while the other four are relatively more resistant given the suppression of frequency overfitting. Among the four robust methods, our method achieves the best results regarding all perturbations except for the A.P. scores for blurring and compression. It is worth noting that, when confronted with much more challenging perturbations such as the adversarial attacks FGSM and PGD and the specific attack SDN, our method obtains Acc. and A.P. scores that are notably higher than other baselines.

Summary. We here discuss the superiority of MCCL over the other three robust detection methods DA, FLP and SRR. DA and FLP augment the frequency distributions in the training set by image processing or adversarial perturbation to improve the generalization to unknown frequency patterns. However, only augmentation is insufficient as it cannot cover all GAN-specific frequency patterns. Unlike the frequencylevel augmentation, MCCL seeks to eliminate the frequency distributional gaps between real and fake images via image completion, which can enforce the subsequent classifiers to learn more stable, frequency-irrelevant features. SRR employs a super-resolution process to model real image distribution, which can be regarded as a single-view image completion task. MCCL outperforms SRR because of the multi-view representation and several novel learning strategies, which allow stable and robust feature representation from diverse types of information.

4.6 Analysis and Discussion

Ablation study. Two ablation studies are performed based on the 128 × 128 ProGAN detectors to show the significance of individual views and the effects of different modules . We report the average Acc. (mAcc.) and A.P. (mA.P.) scores for cross-model and cross-perturbation performance, as shown in Table 5. Regarding different view settings, the gray view leads to a relatively weaker robustness than the other two views, indicating that color information is less distinguishable than regional consistency and texture. The combination Within-distribution Cross-GAN Cross-perturbation Acc. A.P. mAcc. mA.P. mAcc. mA.P.

87.5

77.0

90.1

74.9

79.9

82.3

92.6

of all views (i.e., the final version in Table 5) outperforms all individual views, confirming the effectiveness of multi-view representation and the capability of MCCL to capture and fuse different types of view-specific features for robust detection. Additionally, we emphasize that MCCL is fully flexible and extensible in view configuration, which can incorporate more quantities and types of views to enable stronger feature representations. Regarding different module settings, with more modules activated, the learning capacity of the model improves, enabling more effective feature representation.

Frequency analysis. One advantage of multi-view completion representation is that it helps reduce the classifier's reliance on unstable frequency patterns by aligning the frequency distributions between real and fake images. It works because the unstable frequency artifacts of fake samples are prior removed in the incomplete views, and then the missing frequency pattern is reconstructed and calibrated according to real images by the restorer pre-trained with real images. We provide a spectral analysis to confirm the frequency alignment by estimating the spectral distributions using the azimuthal integration over each radial frequency of the centershifted FFT spectrum [Durall et al., 2020]. Figure 5 shows the distribution curves of real images and images generated by different GANs before and after completion. The original distributions differ significantly between real and fake images and between different GANs. As a result, a CNN detector may easily overfit one specific frequency pattern that may not generalize to another. After the view-to-image completions, the spectral distributional gaps have become much closer. The alignment is more thorough in the edge-to-RGB completion than in the other two because edge sketches remove far more information from the original image than masked and gray views. These frequency-aligned training samples will force the classifier to focus on more stable, general, and frequency-insensitive features. Figure 4 provides a visualization of the averaged FFT spectra of different fake samples before and after the edge-to-RGB completion. The differences between real images and all types of fake images become visibly smaller after completion.

5 Conclusion

To overcome the generalization and robustness issues in GAN-generated image detection, we propose a novel framework incorporating multi-view completion learning and cross-view classification learning for a robust feature representation. Numerous experiments with varying crossresolution, cross-GAN, and cross-perturbation settings validate the outperforming generalization and robustness of our proposed framework compared with the current state-of-theart detectors. We also confirm the effect of reducing frequency reliance in deepfake detection, offering a potential route for future designs of robust deepfake detection.

Acknowledgements

This work is supported by an ARC Discovery Project DP230100246 from the Australian Research Council Australia.