Compression-Resistant Adversarial Perturbation for Real-World Proactive Defense against Deepfakes

The Deepfakes can generate highly realistic fake images and videos, which may be used to spread false information, manipulate public opinion, and pose serious threats to individual privacy and social stability. In recent years, researchers have proposed proactive defense methods to disrupt the output of Deepfakes by adding adversarial perturbations to the original data. However, the added perturbations are often not robust to common image compression operations, which severely limits the practical application of these proactive defense methods in the real world. In this paper, we propose a new method for adaptively adding adversarial perturbations in the discrete cosine transform (DCT) domain, which can resist various compression operations in real-world scenarios. Specifically, DCT coefficients that remain stable during the compression process and have a significant impact on the output of Deepfakes are selected to add perturbations. In addition, a new perceptual loss is introduced to enhance the visual quality of adversarial examples while preserving their robustness against lossy image compression. Extensive experimental results have shown that our method has strong robustness and effective defense capabilities against various compression operations, including Joint Photographic Experts Group (JPEG) compression and other compression operations provided by those online social networks (OSNs) in the real world. Furthermore, it can significantly improve the visual quality of adversarial images compared to previously proposed DCT-based perturbation methods.