secReferences

# Quality-Agnostic Deepfake Detection with Intra-model Collaborative Learning

Binh M. Le
Dept. of Computer Science & Engineering
Sungkyunkwan University
Suwon, South Korea
<EMAIL_ADDRESS>Simon S. Woo
Dept. of Computer Science & Engineering
Sungkyunkwan University
Suwon, South Korea
<EMAIL_ADDRESS>Corresponding author.

###### Abstract

Deepfake has recently raised a plethora of societal concerns over its possible
security threats and dissemination of fake information. Much research on
deepfake detection has been undertaken. However, detecting low quality as well
as simultaneously detecting different qualities of deepfakes still remains a
grave challenge. Most SOTA approaches are limited by using a single specific
model for detecting certain deepfake video quality type. When constructing
multiple models with prior information about video quality, this kind of
strategy incurs significant computational cost, as well as model and training
data overhead. Further, it cannot be scalable and practical to deploy in real-
world settings. In this work, we propose a universal intra-model collaborative
learning framework to enable the effective and simultaneous detection of
different quality of deepfakes. That is, our approach is the quality-agnostic
deepfake detection method, dubbed QAD. In particular, by observing the upper
bound of general error expectation, we maximize the dependency between
intermediate representations of images from different quality levels via
Hilbert-Schmidt Independence Criterion. In addition, an Adversarial Weight
Perturbation module is carefully devised to enable the model to be more robust
against image corruption while boosting the overall model’s performance.
Extensive experiments over seven popular deepfake datasets demonstrate the
superiority of our QAD model over prior SOTA benchmarks.

##  1 Introduction

Deep learning approaches for facial manipulation, such as deepfakes, have
recently received considerable attention [62, 35, 69, 29, 23, 26], because
they can be abused for the malicious purposes such as fake news, pornography,
etc. Due to the advancements made in Generative Adversarial Networks and other
deep learning-based computer vision algorithms, deepfakes have also become
more realistic and natural, making it harder not only for humans, but also for
classifiers to tell them apart. Moreover, it has been simpler than ever before
to create convincing deepfakes using simple programs and apps without
requiring advanced machine learning knowledge. Such easy-to-create and
realistic fake images and videos can be maliciously exploited, raising
significant security, privacy, and societal concerns such as fake news
propagation [46], and stealing personal information via phishing and scams
[12].

Figure 1: A summary of our goal. Our approach stands out from previous works
that detect deepfakes using separate models for different qualities (e.g.
Baseline 2 [32]) or a single model without considering the interaction between
qualities (e.g. Baseline 1 [50]). Instead, our method employs all quality
levels and improves the performance of the model on each quality level,
leading to overall enhanced performance.

To mitigate such problems caused by deepfakes, there has been a tremendous
research effort put into constructing reliable detectors [36, 29, 10, 45, 69,
51]. Although they have achieved outstanding performance with high-quality
deepfakes, most of them have failed to detect low-quality deepfakes
effectively [10, 50]. While video compression steps do not significantly
impact on visualization, it drastically drop deepfake detectors’ performance
on low-quality deepfakes (c40). A handful of research has been focused on
detecting low-quality deepfakes such as ADD [32] and BZNet [33]. However,
their methods can only detect low-quality compressed deepfakes. And, those
prior approaches expose a critical problem, when deployed in practice since
the prior video quality information of the input is unknown. Moreover,
developing different models for each input quality induces significant
computational overhead. Other works, such as LipForensics [19], also attempt
to make their detectors robust against various corruptions and compression.
Nevertheless, it is unable to detect image-based deepfakes with random lossy
compression like JPEG.

In this research, we propose the novel deepfake detection method, QAD, which
can simultaneously detect both high and low-quality (quality-agnostic)
deepfakes in a single model, as illustrated in Fig. 1. Especially, we propose
a universal intra-model collaborative learning framework to provide the
effective detection of different quality deepfakes. We modulate the
conventional model-based collaborative learning [55] to an instance-based
intra-model collaborative learning framework in our training. During the
training phase, our single model simultaneously learns the representations of
one image, but with different qualities. By utilizing the collaborative
learning framework, our QAD can align the distributions of high and low-
quality image representations to be geometrically similar. Hence, it can avoid
the overfitting caused by compressed images and the overconfidence caused by
raw images, while boosting its overall performance.

In particular, we perform a rigorous theoretical analysis, and show that the
low-quality deepfake classification error can be bounded by two terms:
classification loss and the distance between the representations of high and
low-quality images. Instead of using a direct pairwise regularization to
minimize the gaps between the high and low-quality image representations, we
propose to apply Hilbert-Schmidt Independence Criterion (HSIC) to maximize the
dependence between a mini-batch of high and low-quality images, thus
maximizing the mutual information between them, and supporting the high-level
representations and effective output predictions. Meanwhile, to enhance the
model’s robustness under heavy input compression, we propose Adversarial
Weight Perturbation (AWP) [64, 4], which can further flatten the weight loss
landscape of the model, bridging the gap in multiple quality learning for
deepfake detection.

Finally, we conduct extensive experiments to show the effectiveness of our QAD
with seven different popular benchmark datasets. We first show that our method
can outperform previous baselines when training with data from various video
and image compression qualities. Furthermore, we show that our QAD exceeds the
performance of the SOTA quality-aware models such as BZNet [33] by a
significant margin, while requiring remarkably fewer computational parameters
and no prior knowledge of the inputs. Our contributions are summarized as
follows:

1) We theoretically analyze and prove that the classification error of low-
quality deepfakes can be bounded by its classification loss and the
representation distance with its corresponding high-quality images.

2) We propose a unified quality-agnostic deepfake detection framework (QAD),
utilizing instance-based intra-model collaborative learning. We use the
Hilbert-Schmidt Independence Criterion (HSIC) to maximize the geometrical
similarity between intermediate representations of high and low-quality
deepfakes, and Adversarial Weight Perturbation (AWP) to make our model robust
under varying input compression.

3) We demonstrate that our approach outperforms well-known baselines,
including the total of eight quality-agnostic and quality-aware SOTA methods
with seven popular benchmark datasets.

##  2 Related works

###  2.1 Deepfake detection

Recently, deepfakes have been of the utmost crucial because they can cause
serious security and privacy threats. Threrefore, a large number of detection
methods have been proposed to effectively identify such deepfakes [50, 35, 34,
25, 48, 62, 36, 29, 10, 69]. However, the majority of the aforementioned works
focus on mining visual artifacts of deepfakes, such as the blending boundaries
of generated faces [35], the irregularity of pupil shapes [17], the
spatiotemporal inconsistency [7, 51], or exploring deep learning-based
attention methods [69] to identify such artifacts. Meanwhile, several
approaches also showed that exposing deepfakes in the frequency domain is
effective. Such methods include analyzing the discrepancies of frequency
spectrum [10, 31, 29], employing the checkerboard artifacts caused by the
transposed convolutional operator [68, 13], or mining the statistical
frequency features with dual deep learning models [45]. Nevertheless, such
models’ performance substantially decreases when encountering low-quality
compressed images. To remedy the above shortcoming, recent studies proposed
methods to detect the deepfake in highly compressed low-quality versions such
as [32], which utilized a knowledge distillation. Also, [33] presented a
supper-resolution-based network for enhancing the performance of low-quality
deepfake detection. However, all of the aforementioned approaches are limited
in developing a single model for each quality of deepfakes, which is
impractical to deploy in real-world scenarios due to the requirement of prior
knowledge of the input quality.

###  2.2 Collaborative learning

Collaborative learning proposed by [55] is designed to achieve a global
minimum of a deep neural network, while maintaining the same computational
complexity at inference time as at training time. Collaborative learning
inherits the advantages of auxiliary training [56], multi-task learning [66],
and knowledge distillation [21]. Its applications cover supporting weakly-
supervised learning [27], or integrating with online knowledge distillation
[65, 18]. And, its training graph is divided into two or more sub-networks to
ensure global minimum achievement [55]. Besides, [11] proposed an intra-model
collaborative learning framework that shares a similar characteristic with
self-knowledge distillation. However, all of the approaches are model-based
collaborative learning, in which a single input generates multiple outputs (or
views) through multiple classifier heads of one target network in both
training and inference phase.

In this work, we distinguish ourselves by deploying the collaborative learning
framework for simultaneously training deepfakes of various qualities with an
undeviated single model, namely instance-based collaborative learning.
Different from conventional mini-batch stochastic optimization, which
independently samples random images from different qualities and optimizes the
detector, our collaborative learning approach allows us to utilize the common
features in the same image but from different qualities simultaneously. Thus,
our deepfake detector circumvent the overfitting caused by compressed images
or the overconfidence from raw images, enhancing its overall performance.

###  2.3 Hilbert-Schmidt Independence Criterion

The Hilbert-Schmidt Independence Criterion (HSIC) [16] measures the
statistical dependency between probability distributions. In fact, HSIC
differs from the covariance, where $Cov(X,Y)=0$ does not imply that two random
variables $X$ and $Y$ are independent [49], while HSIC shows its tractable
computation and equivalency in terms of the independence property [16].
Moreover, HISC is easy to be estimated statistically and algorithmically. In
practice, applications based on HSIC are found in a variety of practical
domains, including maximizing the dependencies for self-supervised learning
[37] and classification learning [38, 15], or defense against model inversion
attacks [43]. In this paper, we utilize the HSIC to maximize the dependency
between distributions of deepfake images of different qualities at
intermediate layers. Therefore, we aim to constrain low-level representations
of images not to be exactly the same, but to share a geometrical similarity of
learning features that can support high-level output predictions.

##  3 Methods

In this section, we first theoretically examine the upper bound for our
optimization problem by considering a DNN classifier of $K$ classes, and two
modalities of input quality: raw (high-quality) and compressed (low-quality).
Then, we discuss how to more efficiently collaborate on the representations of
deepfake images of differing quality.

Figure 2: Overview of our QAD framework. A mini-batch of images from different
quality modalities (e.g., two in this diagram) is forwarded through a single
universal model. Although it is one model, we pictorially split it into two
branches for the reader’s understanding. After training, we obtain one
universal model that regulates different qualities. Top-right: The HSIC
geometrically maximizes the dependency between images from various quality
modalities at different resolutions, supporting high-level output predictions.
Bottom-right: Through searching for the worst-case parameters’ corruption and
compensating for input corruption (compression), the AWP flattens the model’s
weight loss landscape, making the model robust under varying input
compression.

###  3.1 Preliminary & our inspiration

Given a sample $x_{r}$ from a space $\mathcal{X}$ and its compressed version
at quantile $c$, $x_{c}$ can be expressed as $x_{c}=x_{r}-\delta_{c}$, and we
define the corresponding label $y\in\\{0,1\\}$ (real and fake). Next, a family
$\mathcal{F}$ of learning functions $f:\mathcal{X}\rightarrow\mathbb{R}^{2}$
returns a $2$-tuple $f(x)=[f(x,j)]_{j=1}^{2}$, whose $f(x,j)$ is proportional
to the probability to assign $x$ to the $j$-th class, and $f$ is defined by
learning parameters $\theta$. Given a training data
$\mathcal{D}=\\{(x_{i},y_{i})\\}_{i=1}^{n}\subset\mathcal{X}\times\mathcal{Y}$,
our goal is to minimize the expectation of a loss function
$\mathcal{L}:\mathbb{R}^{2}\times\mathcal{Y}\rightarrow\mathbb{R}$. Here, we
consider $\mathcal{L}(f(x),y)=1-\sigma_{T}(f(x,y))$, where $\sigma_{T}$ is the
softmax function with temperature $T>0$:

$\sigma_{T}({f(x),y})=\frac{\text{exp}(f(x,y)/T)}{\sum_{k=1}^{2}\text{exp}(f(x,k)/T)}.$
(1)

Theorem 1.  (Proof can be done similarly as [41] and [22] in Supp. Material)
For any $f\in\mathcal{F}$, and with probability $1-\delta$ over the draw of
$\mathcal{D}$,

$\displaystyle\mathbb{E}[\mathbb{I}\\{\hat{y}(x_{c})\neq y\\}]$
$\displaystyle\leq 2\mathbb{E}_{\mathcal{D}}\mathcal{L}(f(x_{c}),y)$
$\displaystyle+\frac{8}{T}\mathbb{E}_{\mathcal{D}}\mathcal{L}_{i\textendash
col}(f(x_{r}),f(x_{c}))+4\mathfrak{R}_{\mathcal{D}}(\Phi_{\mathcal{W}})$
$\displaystyle+\frac{16}{n}+\mathcal{O}\left(\sqrt{\frac{\text{log}(2/\delta)}{2n}}\right),$
(2)

where $\mathfrak{R}_{\mathcal{D}}$ is the Rademacher complexity,
$\Phi_{\mathcal{W}}=\\{\mathcal{L}(f(x_{r}),y),f\ \in\mathcal{F}\\}$, and

$\mathcal{L}_{i\textendash col}(f(x_{r}),f(x_{c}))=\parallel
f(x_{r})-f(x_{c})\parallel.$ (3)

Insight of Theorem 1. On the right-hand side of Eq. 2, our classifier $f$
depends on two terms, where the first term is the classification loss
$\mathcal{L}(f(x_{c}),y)$ applied to the prediction of the compressed image
$x_{c}$. And, the second term is the instance-based collaborative loss
$\mathcal{L}_{i\textendash col}(f(x_{r}),f(x_{c}))$ that measures the pairwise
difference between predictions of the raw image and its compressed version.
Therefore, minimizing the expectation over training data $\mathcal{D}$ of
$2\mathcal{L}(f(x_{c}),y)+8\mathcal{L}_{i\textendash
col}(f(x_{r}),f(x_{c}))/T$, can decrease the true error. Note that Eq. 2 is
also general so that it can be applicable for raw images. Hence, in practice,
the first term can be generalized to both raw and compressed images.

In order to minimize the expectation of errors in both raw and compressed
deepfake image predictions, our theoretical analysis shows that we can
minimize both classification loss and collaborative loss at the output.
However, as observed by [11] and in our experiments (see Tab. 4), this
instance-based collaborative learning loss fails to achieve the best
performance. Additionally, training solely with highly-compressed images makes
the detector prone to overfitting, yielding a considerable gap between
training and test performance [32]. As a result, the major research challenge
is how we can further lower the sensitivity of $f_{\theta}$ to $x$ at various
compression settings and push their representations close to each other.

Classification loss. We can construct a robust model under input corruption by
flattening the weight loss landscape. In particular, we apply the Adversarial
Weight Perturbation [64] to search for the worst-case perturbations
$\phi^{\ast}$ of the model weights at every training step. Thereafter,
optimizing the perturbed model via $\mathcal{L}(f_{\theta+\phi^{\ast}},y)$ can
enable it to be more robust under varying input image corruptions/distortions,
which represent the varying qualitiies of deepfake inputs (See Fig. 2—Bottom-
right panel). Furthermore, the classification loss in Eq. 2 is upper bounded
by this new loss function due to the worst-case perturbations.

Collaborative loss. With respect to the collaborative learning loss, Eq. 3
shares similar characteristics with recent knowledge distillation research
[21, 60]. However, our goal is to develop and train a single universal model,
not having a teacher-student relationship. Nevertheless, we argue that the gap
between raw and compressed image representations can be minimized more
efficiently by regularizing their discrepancy at the low-level
representations. Moreover, enforcing the similarity of the pairwise
representations at the intermediate layers with an input difference of
$|\delta_{c}|$ can collapse layers’ weights to zero or can lead a deep model
to remember training data instead of learning discriminative features.
Therefore, we relax this constraint by maximizing the kernel dependency in a
mini-batch of data between the raw and compressed image representations by the
Hilbert-Schmidt Independence Criterion (HSIC). Using HSIC, we can instead
enforce the geometrical structures of mini-batch of raw data and the
compressed data to be similar, so that we can still effectively detect
different-quality deepfakes in a single model. From a mutual information
perspective, maximizing the kernel dependency can enforce the mutual
information of the learned representations of different compression ratios,
thus regularizing the detector to be more generalized (See Fig. 2—Top-right
panel).

###  3.2 Details of our methods

####  3.2.1 Weight loss landscape flattening

Recent studies [24, 63] suggest that searching for a flatter minima can
improve the generalization ability of the model. To achieve this, we propose
using Adversarial Weight Perturbation [64] to identify flat local minima of
the empirical risk. The worst-case perturbations $\phi^{\ast}$ of the model
weights which increases the loss dramatically is formulated as:

$\phi^{\ast}=\operatorname*{arg\,max}_{\phi\in\mathcal{B}_{p}(\theta,\gamma)}\mathcal{L}(f_{\theta+\phi}(x),y),$
(4)

where
$\mathcal{B}_{p}(\theta,\gamma)=\\{\upsilon\in\Theta:\parallel\theta-\upsilon\parallel_{p}\leq\gamma\\}$
is the feasible region of any perturbation $\phi$. The AWP adds the worst-case
perturbation to the model weight, so that
$\mathcal{L}(f_{\theta+\phi^{\ast}}(x),y)$ becomes the supremum value in
$\mathcal{B}_{p}(\theta,\gamma)$. Therefore, optimizing
$\mathcal{L}(f_{\theta+\phi^{\ast}}(x),y)$ pushes $\theta$ adjust its values
such that the loss landscape is more flatten with the same capability
$\mathcal{B}_{p}(\theta,\gamma)$. As a result, $f$ become more stable under
input image’s changes.

Similar to adversarial example perturbation [39], $\phi^{\ast}$ is generated
by projected gradient method as follows:

$\phi^{\ast}\leftarrow\Pi_{\theta}^{\gamma}\left(\phi+\eta\frac{\nabla\mathcal{L}(f_{\theta+\phi}(x),y)}{\parallel\nabla\mathcal{L}(f_{\theta+\phi}(x),y)\parallel}\parallel\theta\parallel\right),$
(5)

where $\Pi_{\theta}^{\gamma}$ is an operator that projects its input into the
feasible region ${B}_{p}(\theta,\gamma)$, and $\eta\in\mathbb{R}$ is the step
size. In fact, we empirically find that using a one-step projection for
$\phi^{\ast}$ is sufficient for the model’s robustness under the image
corruptions formed by compression. By adding $\phi^{\ast}$ in Eq. 5 to
$\theta$, it is straightforward to bound $\mathcal{L}(f(x_{c}),y)$ in Eq. 2.

####  3.2.2 Intra-model collaborative learning

Hilbert-Schmidt Independence Criterion (HSIC). Let $\mathcal{T}$ and
$\mathcal{G}$ be two separable Reproducing Kernel Hilbert Spaces (RKHS) on
metric spaces $\mathcal{U}$ and $\mathcal{V}$, respectively. HSIC measures the
dependency between two random variables $U$ and $V$ from a joint distribution
on $\mathcal{U}$ and $\mathcal{V}$, by evaluating the cross-covariance of the
nonlinear transformations of the two random variables:

$HSIC(U,V)=\parallel\mathbb{E}[\zeta(U)\psi(V)^{T}]-\mathbb{E}\zeta(U)\mathbb{E}\psi(V)^{T}\parallel_{HS}^{2},$
(6)

where $\parallel\cdot\parallel_{HS}$ is the Hilbert-Schmidt norm, which
becomes the Frobenius norm in finite dimensions. And,
$\zeta:\mathcal{U\rightarrow\mathcal{T}}$ and
$\psi:\mathcal{V}\rightarrow\mathcal{G}$ are nonlinear mapping functions. With
appropriate transformation $\zeta$ and $\psi$, HSIC is a dependence test,
which can identify the nonlinear dependencies between $U$ and $V$ as follows:
$HSIC(U,V)=0\Leftrightarrow U\perp V$.

Also, inner products in $\mathcal{T}$ and $\mathcal{G}$ are formed by positive
definite kernel functions:
$k(u,u^{\prime})=\langle\zeta(u),\zeta(u^{\prime})\rangle_{\mathcal{T}}$ and
$l(v,v^{\prime})=\langle\psi(v),\psi(v^{\prime})\rangle_{\mathcal{G}}$. And,
let $(U^{\prime},V^{\prime})$ and $(U^{\prime\prime},V^{\prime\prime})$ be
independent copies of $(U,V)$, then Eq. 6 can be expressed as follows:

$\begin{split}&HSIC(U,V)=\mathbb{E}[k(U,U^{\prime})l(V,V^{\prime})]\\\
&-2\mathbb{E}[k(U,U^{\prime})]\mathbb{E}[l(V,V^{\prime\prime})]+\mathbb{E}[k(U,U^{\prime})]\mathbb{E}[l(V,V^{\prime})].\end{split}$
(7)

Estimation of HSIC. The empirical estimation of HSIC with an bias of
$\mathcal{O}(\frac{1}{n})$ using $n$ samples i.i.d drawn
$\\{(u_{i},v_{i})\\}_{i=1}^{n}$ from the joint distribution $(U,V)$ is
provided as follows [16]:

$\widehat{HSIC}(U,V)=\frac{1}{(n-1)^{2}}\text{{tr}}(KHLH),$ (8)

where $K_{i,j}=k(u_{i},u_{j})$, and $L_{i,j}=l(v_{i},v_{j})$ are kernel
matrices for the kernels $k$, and $l$, respectively, and
$H_{i,j}=\delta_{i,j}-\frac{1}{n}$ is a centering matrix. Regarding the kernel
functions, Theorem 4 in [16] suggested that an universal kernel, such as
Laplace and Gaussian RBF kernel, can guarantee the HSIC to detect any
dependency between $U$ and $V$.

HSIC for maximizing the geometrical similarity. Let $\tau$ and $\rho$ be two
different qualities of deepfakes, (e.g., raw vs. compressed). Consider the
$l$-th layer of the learning network $f$, we denote the learning features of a
mini-batch of $B$ images from $\tau$ and $\rho$ are
$Z_{l}^{\tau}=\\{u_{i}\\}_{B}$, and $Z_{l}^{\rho}=\\{v_{i}\\}_{B}$,
respectively, where $u_{i},v_{i}\in\mathbb{R}^{H\times W\times C}$ and $H,W$
and $C$ are the height, width, and channel number. Our regularization aims to
maximize the dependency between $Z_{l}^{\tau}$ and $Z_{l}^{\rho}$ via a mini-
batch of representations. In other words, we try to minimize the following
loss:

$\mathcal{L}_{col}(\tau,\rho)=-\sum_{l\in
L}\widehat{HSIC}(Z^{\tau}_{l},Z_{l}^{\rho}),$ (9)

where $L$ is a predetermined collection of layers to apply the collaborative
loss. And, the computational complexity for calculating Eq. 9 is
$\mathcal{O}(B^{2}L)$, which can be reduced to $\mathcal{O}(BL)$ when applying
random Fourier features [47].

Model | Test Set AUC (%)
---|---
| NT | DF | F2F | FS | FSH | CDFv2 | FFIW10K  | Avg
Video Compression (raw + c23 + c40 of test set)
MesoNet [1]◆ | 70.24 | 93.72 | 94.15 | 85.17 | 96.00 | 80.52 | 94.56  | 87.77
Rössler _et al._ [50] ◆ | 89.64 | 99.05 | 97.89 | 98.83 | 98.50 | 97.49 |  99.17 | 97.22
$F^{3}\text{Net}$ [45] ◆ | 86.79 | 98.73 | 96.32 | 97.82 | 97.45 | 95.06 | 97.94  | 95.73
MAT [69]◆ | 86.79 | 98.73 | 96.32 | 97.82 | 97.45 | 95.06 | 97.94  | 95.73
Fang & Lin [11] | 89.30 | 98.98 | 97.33 | 98.43 | 98.66 | 96.58 | 98.94  | 96.89
SBIs [53]† | 78.33 | 95.19 | 79.74 | 80.37 | 80.48 | - | \-  | 82.82
BZNet [33]† | 80.12 | 98.81 | 94.10 | 97.71 | - | - | \-  | 91.01
ADD [32]† | 86.26 | 96.23 | 90.62 | 95.57 | 95.94 | - | \-  | 92.92
QAD-R (ours)  | 91.25 | 99.54 | 98.34 | 99.01 | 99.12 | 98.36 | 99.10  | 97.82
QAD-E (ours)  | 94.92 | 99.53 | 98.94 | 99.27 | 99.12 | 98.38 | 99.16  | 98.47

Table 1: Classification performance in the quality-agnostic setting with video
compression of test set. The methods are trained using one of three
approaches: simultaneously with three modalities (raw + c23 + c40),
individually with each of the three modalities, or with a mid-level of
compression (c23) to prevent performance degradation resulting from lossy
compression. In the inference phase, video compression is applied to the
input. The best results are highlighted in bold. $\dagger$ and $\lozenge$
indicate results were obtained from methods’ pre-trained weights and published
code, respectively.

Model | Test Set AUC (%)
---|---
| NT | DF | F2F | FS | FSH | CDFv2 | FFIW10K  | Avg
Random Image Compression (JPEG on raw of test set)
MesoNet [1]◆ | 70.23 | 92.02 | 88.32 | 82.60 | 91.84 | 81.12 | 91.87  | 85.43
Rössler _et al._ [50]◆ | 69.89 | 98.62 | 94.97 | 96.66 | 96.76 | 96.98 | 98.81  | 93.24
$F^{3}\text{Net}$ [45]◆ | 70.95 | 97.89 | 92.83 | 96.34 | 94.72 | 95.44 | 97.19  | 92.19
MAT [69] ◆ | 69.53 | 98.96 | 95.53 | 97.99 | 96.97 | 98.21 | 98.91  | 93.73
Fang & Lin [11] | 75.49 | 98.32 | 94.63 | 97.64 | 97.28 | 96.67 | 98.39  | 94.06
SBIs [53]† | 77.75 | 97.83 | 82.05 | 86.10 | 85.42 | - | \-  | 85.83
BZNet [33]† |  79.00 | 98.77 | 95.23 | 97.92 | - | - | \-  | 92.73
ADD [32]† | 75.84 | 96.83 | 92.23 | 95.24 | 96.00 | - | \-  | 91.23
QAD-R (ours)  | 75.18 | 98.86 | 93.72 | 98.52 | 98.18 | 98.51 | 98.96 | 94.56
QAD-E (ours)  | 76.27 | 99.20 | 94.44 | 98.69 | 98.60 | 98.52 | 98.86  |  94.94

Table 2: Classification performance in the quality-agnostic setting with image
compression of test set. The training approach resembles that of Table 1’s
setting, however, in the inference phase, random image compression is applied
to the input.  Algorithm 1 QAD: Quality-Agnostic Deepfake detection.

1:DNN $f$ parameterized by $\theta$, training dataset $\mathcal{D}$ with M
quality modalities $\scalebox{1.44}{$\tau$}=\\{r,c_{1},...c_{M-1}\\}$.
Learning rate $\alpha_{l}$ and mini-batch size of ${B}$. Model weight
perturbation size $\gamma$, step size $\eta$, and the number of steps $K$.
Layers of $f$ to apply $HSIC$ $L$.

2:while not converged do

3: for $\text{mini-batch
}(X=[X_{\tau}]_{\tau\in\scalebox{1.44}{$\tau$}},\textrm{ }Y)\in\mathcal{D}$ do

4: # One-step AWP

5: $\mathcal{L}_{1}=\mathcal{L}(f_{\theta+\phi}(X),Y)/MB$

6:
$\phi\leftarrow\Pi_{\theta}^{\gamma}\left(\phi+\eta\frac{\nabla\mathcal{L}_{1}}{\parallel\nabla\mathcal{L}_{1}\parallel}\parallel\theta\parallel\right)$

7: $\theta\leftarrow\theta+\phi$

8: $\mathcal{L}_{1}\leftarrow\mathcal{L}(f_{\theta}(X),Y)/MB$

9: # intermediate reps.

10: $[Z_{l}^{\tau}]_{l\in L}^{\tau\in\scalebox{1.44}{$\tau$}}:=f_{\theta}(X)$

11: # HSIC: dependence maximization

12:
$\mathcal{L}_{2}\leftarrow\sum^{\tau\neq\rho}_{\tau,\rho\in\scalebox{1.44}{$\tau$}}\mathcal{L}_{col}(\tau,\rho)$

13: # Overall loss Eq. (10)

14: $\mathcal{L}_{QAD}\leftarrow\mathcal{L}_{1}+\alpha\times\mathcal{L}_{2}$

15: $\theta\leftarrow\theta-\alpha_{l}\cdot\nabla_{\theta}\mathcal{L}_{QAD}$

16: $\theta\leftarrow\theta-\phi$

17: end for

18:end while

###  3.3 End-to-end training loss

Given a training mini-batch $B$ that include all $M$ quality modalities
$\scalebox{1.44}{$\tau$}=\\{r,c_{1},...c_{M-1}\\}$, the overall collaborative
learning loss in our QAD framework is formulated as:

$\begin{split}\mathcal{L}_{QAD}=&\frac{1}{MB}\sum_{\tau\in\scalebox{1.44}{$\tau$},i\in
B}\mathcal{L_{\phi^{\ast}}}(x_{\tau,i},y_{i})+\alpha\sum^{\tau\neq\rho}_{\tau,\rho\in\scalebox{1.44}{$\tau$}}\mathcal{L}_{col}(\tau,\rho),\end{split}$
(10)

where $\alpha$ is a hyper-parameter to balance contribution of each loss. It
is worth noting that our QAD training loss is parameter-free, and is not
affected by the order of the modalities. Further, unlike other model-based
collaborative learning [55], our QAD does not derive any sub-models. In other
words, it can be integrated with any backbone, i.e., RESNET50, and introduces
no extra computation at the inference time. Note that Theorem 1 still holds
when replacing the classification loss $\mathcal{L}(f(x),y)$ with any cross-
entropy based loss, since $\mathcal{L}(f(x),y)$ is bounded by the cross-
entropy loss. Finally, we present our end-to-end algorithm for optimizing Eq.
10 in Algorithm 1, and its pictorial illustration in Fig. 2.

##  4 Experimental Results

Method |  w/ prior infor. |  #params | Test Set AUC (%)
---|---|---|---
|  |  | NT | DF | F2F | FS | FSH | CDFv2 | FFIW10K  | Avg
BZNet [33]† [$\times 3$]  |  Y | 22M $\times$ 3  | 91.01 | 99.30 | 96.90 | 98.82 | - | - | \-  | 96.51
ADD [32]† [$\times 3$]  |  Y | 23.5M $\times$ 3  | 89.08 | 99.25 | 96.53 | 98.21 | 98.25 | - | \-  | 96.26
RESNET50 [$\times 3$]  |  Y | 23.5M $\times$ 3  | 88.96 | 99.26 | 97.04 | 98.63 | 98.71 | 97.09 | 98.58  | 96.90
QAD-R (ours)  |  N | 23.5M $\times$ 1  | 88.85 | 99.42 | 97.77 | 98.83 | 98.93 | 97.56 | 98.93  | 97.18
EFFICIENTNET-B1[$\times 3$]  |  Y | 6.5M $\times$ 3  | 87.63 | 99.05 | 96.72 | 98.16 | 97.95 | 96.70 | 98.54  | 96.39
QAD-E (ours)  |  N | 6.5M $\times$ 1 | 92.25 | 99.46 | 98.30 | 99.08 | 98.90 | 97.50 | 99.01 | 97.79

Table 3: Classification performance in the quality-aware setting with video
compression of test set. Except for our model, each model is trained with
three modalities: raw, c23, and c40, respectively (denoted $[\times 3]$). In
the inference phase, while our QAD uses one single pre-trained model, other
methods use their corresponding pre-trained model (e.g., pre-trained RESNET-50
on raw) to detect a given testing input (e.g., raw). Reported performances are
averaged score of the three modalities.

###  4.1 Dataset and pre-processing

For evaluating our proposed method, we experiment with seven different popular
deepfake benchmark datasets: NeuralTextures (NT) [58], Deepfakes (DF) [5],
Face2Face (F2F) [59], FaceSwap (FS) [6], FaceShifter (FSH) [34], CelebDFV2
(CDFv2) [67], and Face Forensics in the Wild (FFIW10K) [70]. Besides the raw
version, these videos are also compressed into two types: medium (c23) and
high (c40), utilizing the H.264 codec and constant rate quantization
parameters of 23 and 40, respectively. These effectively result in different
quality of deepfakes, and details of these datasets are provided in our Supp.
Material.

###  4.2 Experimental Settings

The models are trained with the Adam optimizer [30] with a learning rate of
2e-3, scheduled by one-cycle strategy [54] in 32 epochs. We use a mini-batch
size of 64. In every training epoch, the model is evaluated ten times, and we
save the best one based on the validation accuracy. Regarding the backbone
network, we use the RESNET-50 [20] (QAD-R) and EFFICIENTNET-B1 [57] (QAD-E)
with their default input size of $224\times 224$ and $240\times 240$,
respectively. The backbone models utilize pre-trained weights from IMAGENET
dataset [8]. Our hyper-parameters settings
$\\{\sigma=6,\alpha=0.004,\gamma=0.002\\}$ are obtained by fine-tuning on
RESNET50 with NeuralTextures dataset and are kept the same throughout all
datasets, whereas that of EFFICIENTNET-B1 are
$\\{\sigma=6,\alpha=0.002,\gamma=0.006\\}$.

###  4.3 Results

This section reports the results of our QAD and other baselines under two
scenarios: 1) quality-agnostic setting, which represents no model has prior
knowledge of the input images’ quality, and 2) quality-aware setting, which
baselines are required to know inputs’ quality information.

####  4.3.1 Quality-agnostic models

We use the popular deepfake detection benchmark methods on our datasets: 1)
MesoNet with Inception layer by [1], 2) Xception model proposed by [50], 3)
$F^{3}\text{Net}$ [45], 4) MAT [69] \- a multi-attention deepfake detector, 5)
a deviation of the method proposed by [11] to the instance-based collaborative
learning, SBIs [53] \- a self-blended method using real image only during
training, 7) ADD [32] \- a knowledge distillation-based approach for detecting
low-quality deepfakes, and 8) BZNet [33] \- a super-resolution approach for
improving detection of low-quality deepfakes. Each method has a different
training approach to defend against performance degradation caused by lossy
compression. The first five methods are trained with a mixture of the three
data quality types (raw+c23+c40). SBIs is trained with the mid-level of video
compression (c23), which is commonly adopted in many works. Meanwhile, ADD and
BZNet models are trained on raw, c23, and c40, respectively; however, in the
inference phase, they are blindly tested over the entire dataset without the
prior knowledge of quality types, and we report their average performance. In
the test set, we include both video compression and random JPEG image
compression [3].

The results for the video compression are presented in Table 1, where our QAD
outperforms other SOTA baselines across multiple benchmark datasets. Notably,
we achieve a significant improvement in AUC score of up to 5.28% for heavily
compressed datasets, such as NeuralTextures (89.64% vs 94.92%). We also
surpassed previous works on various deepfake datasets by $0.44\%$ to $1.05\%$
points, with the exception of Deepfakes and FFIW10K datasets, which are easy
to detect even when compressed. Compared to the collaborative learning
baseline by [11], which is a comparative benchmark, our QAD still gains a
decent improvement on average, up to $0.93\%$ and $1.54\%$ points with QAD-R
and QAD-E, respectively. Finally, our QAD-E models achieved the highest score
on average, reaching $98.47\%$.

Regarding the random image compression experiment, the results are provided in
Table 2. Although BZNet is marginally outperform our model on face-reenactment
deepfakes (NT and F2F), our method still achieves the best performance with
the highest scores on five over seven datasets. On average, our enhancements
show decent improvements, with margins of 0.5% and 0.88% of QAD-R and QAD-E,
respectively, compared to the second-best competitor (Fang & Lin).

Figure 3: Model’s performance versus $\alpha$ and $\gamma$ on the
NeuralTextures.

Model / loss | RESNET-50
---|---
ACC (%) | AUC (%)
Baseline | 78.8 | 88.2
Coll. loss | Soft-label  | 77.0 | 84.0
| Pairwise loss  | 79.7 | 89.1
| Center loss  | 79.8 | 88.9
|  HSIC  | 80.3 | 90.1
Adv. loss | AWP-KL  | 80.9 | 89.4
|  AWP-XE  | 81.7 | 90.7
QAD (ours) | 82.2 | 91.3

Table 4:  Performance (ACC & AUC) of RESNET50 integrated with different
losses.

####  4.3.2 Quality-aware models

In this experiment, we compare our models with quality-aware benchmark
baselines. In particular, beside RESNET-50 and EFFICIENTNET-B1, for each of
the raw, c23, and c40 datasets, we implement ADD [32] and BZNet [33] models.
Since ADD and BZNet are the best performing methods, in which they utilized
knowledge distillation and super-resolution approaches, respectively, for
detecting deepfakes in different qualities. Hence, we only include them in
this experiment. In the inference phase, the performance of these models is
validated with the prior knowledge of the input image’s quality, i.e., c40
images are evaluated by the same quality c40 pre-trained models. Meanwhile,
our universal QAD is blindly evaluated without such prior knowledge. We
integrate our QAD on RESNET50 and EFFICIENTNET-B1 and present their
performance in Table 3. As we can obbserve, our QAD-E model performs slightly
better or on par with RESNET-50, BZNet, and ADD models, despite having only
one-third of the number of parameters and no prior knowledge of input image
quality. Moreover, when integrating with EFFICIENTNET-B1, QAD-E achieves a new
SOTA performance with an improvement of up to $0.89\%$ points (97.79% vs.
96.90%), with a modest number of parameters (6.5M).

###  4.4 Ablation studies

####  4.4.1 $\alpha$ and $\gamma$ of our loss

We investigate the sensitivities of our QAD with respect to $\alpha$ and
$\gamma$, and summarize the results of our analysis in Fig. 3. In this study,
we experiment with RESNET50 on the NeuralTextures dataset, which is the
hardest dataset to detect when compressed. And, we vary the values of the
hyperparameters $\alpha\in\\{0.002,0.004,0.008\\}$ and
$\gamma\in\\{0.001,0.002,0.003,0.004\\}$, where the value at
$(\alpha,\gamma)=(0.0,0.0)$ indicate the baseline. The results suggest that
when $\alpha$ is greater than $0.002$, the performance of our model is high
and stable, surpassing current SOTA with any $\alpha$ greater than $0.002$.
Additionally, increasing $\gamma$ generally improves performance. Note that,
as we did not tune the hyper-parameters to optimize the test accuracy, Section
4.3’s hyper-parameters are not the best, despite outperforming all current
methods on the datasets.

QAD  | NT | DF | F2F | FS | FSH | CDFv2 | FFIW10K  | Avg
---|---|---|---|---|---|---|---|---
RESNET18 |
✗  | 88.73 | 98.93 | 98.05 | 98.06 | 98.67 | 97.09 | 98.72  | 96.89
✓  | 91.38 | 99.32 | 98.32 | 99.19 | 98.94 | 97.97 | 99.10 | 97.75
RESNET34 |
✗  | 88.26 | 99.01 | 97.98 | 98.67 | 98.88 | 96.61 | 98.97  |  96.91
✓  | 92.87 | 99.30 | 98.37 | 99.10 | 99.21 | 98.48 | 99.14 | 98.07
EFFICIENTNET-B0 |
✗  | 86.12 | 99.29 | 97.93 | 98.21 | 98.42 | 97.81 | 98.80  | 96.65
✓  | 91.99 | 99.33 | 98.66 | 99.15 | 99.00 | 98.38 | 99.12 | 97.95

Table 5: Performance (AUC) of RESNET18, RESNET34, and EFFICIENTNET-B0 baseline
and their integration with our QAD training framework.

####  4.4.2 Selection of losses

We study different alternatives for the collaborative learning loss and the
adversarial weight perturbation approach. In particular, for the collaborative
learning loss, we apply the loss function that was introduced by [55], in
which they aggregate the logits of different views, combining them with their
true labels to generate the soft labels. Besides, we replace our HSIC
regularization with intermediate pairwise loss (Eq. 3) and center loss.
Regarding the adversarial weight perturbation, we further apply the KL
divergence between the representations of raw and compressed images to perturb
the model’s weights.

We report the results in Table 4, where we observe that the soft label loss
fails to improve the baselines due to a lack of low-level representation
agreement between different image qualities. While both pairwise and center
loss slightly improve the baselines and are unstable with different model
architecture, our HSIC consistently achieves the best performance by relaxing
the instance-base constraint. Meanwhile, we can observe the model’s
performance drops in terms of both ACC and AUC, when replacing our AWP with
cross-entropy loss with KL divergence. Generally, this experiment shows that
using pairwise differences of various quality image representations at the
output, such as soft label, pairwise constraint, or AWP-KL, for optimizing the
model can hinder its convergence to the optimal parameters.

####  4.4.3 Experiment with different backbones

Table 5 shows the comparability of our QAD with three different backbone
networks: RESNET18, RESNET34, and EFFICIENTNET-B0. The hyperparameter settings
are kept the same for RESNET50 and EFFICIENTNET-B1. As shown in Table 5, our
QAD consistently improves the baselines, from 0.86% to 1.3% points on average
of seven deepfake datasets.

Figure 4: Performance (AUC) of our proposed method at different input
resolutions with NeuralTextures dataset. Figure 5:  t-SNE visualisation of
baseline and our QAD.

####  4.4.4 Performance at different input scales

Unlike other classification tasks, a notable factor that substantially affects
the deepfake detection performance, which is omitted by most previous works
[50, 45, 69], is the input size of faces. We resize the input images from $56$
to $336$ and demonstrate how it impacts our QAD in comparison with RESNET50
baseline. The experiment is performed with the NeuralTextures dataset, and its
results are reported in Fig. 4. We note that our proposed QAD and the
baselines consistently improve their performance, when increasing the input
size. Beside, our method also keep its staging improvement across the input
resolutions compared to RESNET50 baseline.

####  4.4.5 Feature distribution visualization

To verify the consistency of invariant representation upon the input quality,
we draw the feature distribution of EFFICIENTNET-B1 and our QAD-
EFFICIENTNET-B1 pre-trained on NeuralTextures (with raw, c23, and c40
datasets) with t-SNE [61]. The results are shown in Fig. 5. As observed, our
QAD model’s representations are less dispersed both in terms of intra-class
and inter-quality. This experiment demonstrates that traditional cross-entropy
loss trained with multiple input quality are confused due to the low-level
constraints, while our QAD enables the model to achieve more generalization
regardless of input quality.

##  5 Conclusion

Most deep learning-based deepfake detectors use a single model for each video
quality, leaving an unsolved practical issue of their generalizability for
detecting different quality of deepfakes. In this work, we propose a universal
deepfake detection framework (QAD). Using intra-model collaborative learning,
we minimize the geometrical differences of images in various qualities at
different intermediate layers by the HSIC module. Moreover, our adversarial
weight perturbation (AWP) module is directly applied to the model’s parameters
to provide its robustness against input image compression. Extensive
experiments show that our QAD achieves competitive detection accuracy and
marks the new SOTA results on various deepfake datasets without prior
knowledge of input image quality.

Acknowledgements. This work was partly supported by Institute for Information
& communication Technology Planning & evaluation (IITP) grants funded by the
Korean government MSIT: (No. 2022-0-01199, Graduate School of Convergence
Security at Sungkyunkwan University), (No. 2022-0-01045, Self-directed Multi-
Modal Intelligence for solving unknown, open domain problems), (No.
2022-0-00688, AI Platform to Fully Adapt and Reflect Privacy-Policy Changes),
(No. 2021-0-02068, Artificial Intelligence Innovation Hub), (No. 2019-0-00421,
AI Graduate School Support Program at Sungkyunkwan University), and (No.
RS-2023-00230337, Advanced and Proactive AI Platform Research and Development
Against Malicious deepfakes).

## References

  * [1] Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen.  Mesonet: a compact facial video forgery detection network.  In 2018 IEEE international workshop on information forensics and security (WIFS), pages 1–7. IEEE, 2018.
  * [2] Peter L Bartlett and Shahar Mendelson.  Rademacher and gaussian complexities: Risk bounds and structural results.  Journal of Machine Learning Research, 3(Nov):463–482, 2002.
  * [3] Alexander Buslaev, Vladimir I Iglovikov, Eugene Khvedchenya, Alex Parinov, Mikhail Druzhinin, and Alexandr A Kalinin.  Albumentations: fast and flexible image augmentations.  Information, 11(2):125, 2020.
  * [4] Dan Andrei Calian, Florian Stimberg, Olivia Wiles, Sylvestre-Alvise Rebuffi, András György, Timothy A Mann, and Sven Gowal.  Defending against image corruptions through adversarial augmentations.  In International Conference on Learning Representations, 2021.
  * [5] DeepFakes Community.  Deepfakes.  https://github.com/deepfakes/faceswap, 2017.  Accessed: 2021-01-01.
  * [6] FaceSwap Community.  Faceswap.  https://github.com/MarekKowalski/FaceSwap, 2016.  Accessed: 2021-01-01.
  * [7] Oscar de Lima, Sean Franklin, Shreshtha Basu, Blake Karwoski, and Annet George.  Deepfake detection using spatiotemporal convolutional networks.  arXiv preprint arXiv:2006.14749, 2020.
  * [8] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248–255, 2009.
  * [9] Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer.  The deepfake detection challenge (dfdc) dataset.  arXiv preprint arXiv:2006.07397, 2020.
  * [10] Tarik Dzanic, Karan Shah, and Freddie D Witherden.  Fourier spectrum discrepancies in deep network generated images.  In Proceedings of the 34th International Conference on Neural Information Processing Systems, pages 3022–3032, 2020.
  * [11] Shijie Fang and Tong Lin.  Intra-model collaborative learning of neural networks.  In 2021 International Joint Conference on Neural Networks (IJCNN), pages 1–7. IEEE, 2021.
  * [12] FBI.  Deepfakes and stolen pii utilized to apply for remote work positions.  https://www.ic3.gov/Media/Y2022/PSA220628, June 2022.  Accessed: 2022-07-01.
  * [13] Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz.  Leveraging frequency analysis for deep fake image recognition.  In International Conference on Machine Learning, pages 3247–3258. PMLR, 2020.
  * [14] Bolin Gao and Lacra Pavel.  On the properties of the softmax function with application in game theory and reinforcement learning.  arXiv preprint arXiv:1704.00805, 2017.
  * [15] Daniel Greenfeld and Uri Shalit.  Robust learning with the hilbert-schmidt independence criterion.  In International Conference on Machine Learning, pages 3759–3768. PMLR, 2020.
  * [16] Arthur Gretton, Olivier Bousquet, Alex Smola, and Bernhard Schölkopf.  Measuring statistical dependence with hilbert-schmidt norms.  In International conference on algorithmic learning theory, pages 63–77. Springer, 2005.
  * [17] Hui Guo, Shu Hu, Xin Wang, Ming-Ching Chang, and Siwei Lyu.  Eyes tell all: Irregular pupil shapes reveal gan-generated faces.  In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2904–2908. IEEE, 2022.
  * [18] Qiushan Guo, Xinjiang Wang, Yichao Wu, Zhipeng Yu, Ding Liang, Xiaolin Hu, and Ping Luo.  Online knowledge distillation via collaborative learning.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11020–11029, 2020.
  * [19] Alexandros Haliassos, Konstantinos Vougioukas, Stavros Petridis, and Maja Pantic.  Lips don’t lie: A generalisable and robust approach to face forgery detection.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 5039–5049, 2021.
  * [20] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
  * [21] Geoffrey Hinton, Oriol Vinyals, and Jeff Dean.  Distilling the knowledge in a neural network.  stat, 1050:9, 2015.
  * [22] Daniel Hsu, Ziwei Ji, Matus Telgarsky, and Lan Wang.  Generalization bounds via distillation.  arXiv preprint arXiv:2104.05641, 2021.
  * [23] Juan Hu, Xin Liao, Jinwen Liang, Wenbo Zhou, and Zheng Qin.  Finfer: Frame inference-based deepfake detection for high-visual-quality videos.  In Proceedings of the Thirty-Sixth AAAI Conference on Artificial Intelligence, pages 951–959, 2022.
  * [24] Takashi Ishida, Ikko Yamane, Tomoya Sakai, Gang Niu, and Masashi Sugiyama.  Do we need zero training loss after achieving zero training error?  arXiv preprint arXiv:2002.08709, 2020.
  * [25] Hyeonseong Jeon, Young Oh Bang, Junyaup Kim, and Simon Woo.  T-gd: Transferable gan-generated images detection framework.  In International Conference on Machine Learning, pages 4746–4761. PMLR, 2020.
  * [26] Yonghyun Jeong, Doyeon Kim, Youngmin Ro, and Jongwon Choi.  Frepgan: Robust deepfake detection using frequency-level perturbations.  In Proceedings of the Thirty-Sixth AAAI Conference on Artificial Intelligence, pages 1060–1068, 2022.
  * [27] Yuan Ji, Xu Jia, Huchuan Lu, and Xiang Ruan.  Weakly-supervised temporal action localization via cross-stream collaborative learning.  In Proceedings of the 29th ACM International Conference on Multimedia, MM ’21, page 853–861, New York, NY, USA, 2021. Association for Computing Machinery.
  * [28] Liming Jiang, Ren Li, Wayne Wu, Chen Qian, and Chen Change Loy.  Deeperforensics-1.0: A large-scale dataset for real-world face forgery detection.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2889–2898, 2020.
  * [29] Mahyar Khayatkhoei and Ahmed Elgammal.  Spatial frequency bias in convolutional generative adversarial networks.  In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 7152–7159, 2022.
  * [30] Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  arXiv preprint arXiv:1412.6980, 2014.
  * [31] Binh M Le and SS Woo.  Exploring the asynchronous of the frequency spectra of gan-generated facial images.  In CEUR Workshop Proceedings, volume 3084. CEUR-WS, 2021.
  * [32] Binh M Le and Simon S Woo.  Add: Frequency attention and multi-view based knowledge distillation to detect low-quality compressed deepfake images.  In Proceedings of the Thirty-Sixth AAAI Conference on Artificial Intelligence, pages 122–130, 2022.
  * [33] Sangyup Lee, Jaeju An, and Simon S Woo.  Bznet: Unsupervised multi-scale branch zooming network for detecting low-quality deepfake videos.  In Proceedings of the ACM Web Conference 2022, pages 3500–3510, 2022.
  * [34] Lingzhi Li, Jianmin Bao, Hao Yang, Dong Chen, and Fang Wen.  Faceshifter: Towards high fidelity and occlusion aware face swapping.  arXiv preprint arXiv:1912.13457, 2019.
  * [35] Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo.  Face x-ray for more general face forgery detection.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5001–5010, 2020.
  * [36] Yuezun Li and Siwei Lyu.  Exposing deepfake videos by detecting face warping artifacts.  In CVPR Workshops, 2019.
  * [37] Yazhe Li, Roman Pogodin, Danica J Sutherland, and Arthur Gretton.  Self-supervised learning with kernel dependence maximization.  Advances in Neural Information Processing Systems, 34:15543–15556, 2021.
  * [38] Wan-Duo Kurt Ma, JP Lewis, and W Bastiaan Kleijn.  The hsic bottleneck: Deep learning without back-propagation.  In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 5085–5092, 2020.
  * [39] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  International Conference on Learning Representations (ICLR), 2018\.
  * [40] Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar.  Foundations of machine learning.[sl], 2012.
  * [41] Awais Muhammad, Fengwei Zhou, Chuanlong Xie, Jiawei Li, Sung-Ho Bae, and Zhenguo Li.  Mixacm: Mixup-based robustness transfer via distillation of activated channel maps.  Advances in Neural Information Processing Systems, 34:4555–4569, 2021.
  * [42] Yuval Nirkin, Yosi Keller, and Tal Hassner.  Fsgan: Subject agnostic face swapping and reenactment.  In Proceedings of the IEEE/CVF international conference on computer vision, pages 7184–7193, 2019.
  * [43] Xiong Peng, Feng Liu, Jingfen Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han.  Bilateral dependency optimization: Defending against model-inversion attacks.  In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, 2022.
  * [44] Ivan Perov, Daiheng Gao, Nikolay Chervoniy, Kunlin Liu, Sugasa Marangonda, Chris Umé, Mr Dpfks, Carl Shift Facenheim, RP Luis, Jian Jiang, et al.  Deepfacelab: A simple, flexible and extensible face swapping framework.  2020\.
  * [45] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao.  Thinking in frequency: Face forgery detection by mining frequency-aware clues.  In European Conference on Computer Vision, pages 86–103. Springer, 2020.
  * [46] Thorsten Quandt, Lena Frischlich, Svenja Boberg, and Tim Schatto-Eckrodt.  Fake news.  The international encyclopedia of Journalism Studies, pages 1–6, 2019.
  * [47] Ali Rahimi and Benjamin Recht.  Random features for large-scale kernel machines.  Advances in neural information processing systems, 20, 2007.
  * [48] Nicolas Rahmouni, Vincent Nozick, Junichi Yamagishi, and Isao Echizen.  Distinguishing computer graphics from natural images using convolution neural networks.  In 2017 IEEE Workshop on Information Forensics and Security (WIFS), pages 1–6. IEEE, 2017.
  * [49] Alfréd Rényi.  On measures of dependence.  Acta mathematica hungarica, 10(3-4):441–451, 1959.
  * [50] Andreas Ros̈sler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner.  Faceforensics++: Learning to detect manipulated facial images.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1–11, 2019.
  * [51] Andrey Sebyakin, Vladimir Soloviev, and Anatoly Zolotaryuk.  Spatio-temporal deepfake detection with deep neural networks.  In International Conference on Information, pages 78–94. Springer, 2021.
  * [52] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra.  Grad-cam: Visual explanations from deep networks via gradient-based localization.  In Proceedings of the IEEE international conference on computer vision, pages 618–626, 2017.
  * [53] Kaede Shiohara and Toshihiko Yamasaki.  Detecting deepfakes with self-blended images.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18720–18729, 2022.
  * [54] Leslie N Smith and Nicholay Topin.  Super-convergence: Very fast training of neural networks using large learning rates.  In Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications, volume 11006, page 1100612. International Society for Optics and Photonics, 2019.
  * [55] Guocong Song and Wei Chai.  Collaborative learning for deep neural networks.  Advances in neural information processing systems, 31, 2018.
  * [56] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich.  Going deeper with convolutions.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1–9, 2015.
  * [57] Mingxing Tan and Quoc Le.  Efficientnet: Rethinking model scaling for convolutional neural networks.  In International conference on machine learning, pages 6105–6114. PMLR, 2019.
  * [58] Justus Thies, Michael Zollhöfer, and Matthias Nießner.  Deferred neural rendering: Image synthesis using neural textures.  ACM Transactions on Graphics (TOG), 38(4):1–12, 2019.
  * [59] Justus Thies, Michael Zollhofer, Marc Stamminger, Christian Theobalt, and Matthias Nießner.  Face2face: Real-time face capture and reenactment of rgb videos.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2387–2395, 2016.
  * [60] Yonglong Tian, Dilip Krishnan, and Phillip Isola.  Contrastive representation distillation.  In International Conference on Learning Representations, 2019.
  * [61] Laurens Van der Maaten and Geoffrey Hinton.  Visualizing data using t-sne.  Journal of machine learning research, 9(11), 2008.
  * [62] Run Wang, Lei Ma, Felix Juefei-Xu, Xiaofei Xie, Jian Wang, and Yang Liu.  Fakespotter: A simple baseline for spotting ai-synthesized fake faces.  arXiv preprint arXiv:1909.06122, 2, 2019.
  * [63] Colin Wei, Sham Kakade, and Tengyu Ma.  The implicit and explicit regularization effects of dropout.  In International conference on machine learning, pages 10181–10192. PMLR, 2020.
  * [64] Dongxian Wu, Shu-Tao Xia, and Yisen Wang.  Adversarial weight perturbation helps robust generalization.  Advances in Neural Information Processing Systems, 33:2958–2969, 2020.
  * [65] Guile Wu and Shaogang Gong.  Peer collaborative learning for online knowledge distillation.  In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 10302–10310, 2021.
  * [66] Yongxin Yang and Timothy Hospedales.  Deep multi-task representation learning: A tensor factorisation approach.  In 5th International Conference on Learning Representations, 2017\.
  * [67] Li Yuezun, Yang Xin, Sun Pu, Qi Honggang, and Lyu Siwei.  Celeb-df: A large-scale challenging dataset for deepfake forensics.  In IEEE Conference on Computer Vision and Patten Recognition (CVPR), 2020.
  * [68] Xu Zhang, Svebor Karaman, and Shih-Fu Chang.  Detecting and simulating artifacts in gan fake images.  In 2019 IEEE International Workshop on Information Forensics and Security (WIFS), pages 1–6. IEEE, 2019.
  * [69] Hanqing Zhao, Wenbo Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, and Nenghai Yu.  Multi-attentional deepfake detection.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2185–2194, 2021.
  * [70] Tianfei Zhou, Wenguan Wang, Zhiyuan Liang, and Jianbing Shen.  Face forensics in the wild.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5778–5788, June 2021.
  * [71] Bojia Zi, Minghao Chang, Jingjing Chen, Xingjun Ma, and Yu-Gang Jiang.  Wilddeepfake: A challenging real-world dataset for deepfake detection.  In Proceedings of the 28th ACM international conference on multimedia, pages 2382–2390, 2020.

*

In this supplementary material, we first provide a brief description of the
datasets used in our experiment Section (Section A). Next, the proof of
Theorem 1 is provided in Section B. In Section C, we conduct ablation studies
about the detectors’ robustness towards unseen corruptions. Besides, we
discuss the limitations of our proposed method in Section D. Finally, in
Section E, we graphically illustrate the benefits of applying our QAD for
deepfake detection problems.

##  Appendix A Datasets

We describe here seven popular benchmark deepfake datasets used to verify our
proposed QAD:

  * •

NeuralTextures. Facial reenactment is a video re-rendering approach that uses
the Neural Textures [58] technique. This method employs neural textures, which
are learned feature maps placed on top of 3D model proxies, as well as a
deferred neural renderer. The NeuralTextures dataset used in our study provide
facial alterations to the mouth region, while the rest of the face remains
unchanged.

  * •

Deepfakes. Each autoencoder in the DeepFakes dataset is trained on the source
face and the target face separately before encoding the data. An artificial
face is created by using the decoder trained on the target face to decode the
embedding representation of the source face. Note that though DeepFakes
originally referred to a particular face swapping technique, the term has now
come to apply to AI-generated facial modification approaches in general.

  * •

Face2Face. Face2Face [59] is a method of real-time facial recreation in which
the identity of the target individual is maintained while their expression
mimics that of the source. More specifically, a series of manually chosen key-
frames is used in conjunction with a flexible model-based bundling strategy to
recover the identification associated with the target face. Target backdrop
and illumination are preserved while expression coefficients from the source
face are transmitted.

  * •

FaceSwap. FaceSwap [6] is an easy-to-use program based on the visual
architectures of the faces being swapped. To create a 3D representation of a
person’s face, 68 individual landmarks on the face are taken into account.
Finally, it does color correction after projecting the facial areas back to
the target face by reducing the pair-wise landmark errors.

  * •

FaceShifter. FaceShifter [34] is a two-step face-swapping system. The first
step employs a generator with Adaptive Attentional Denormalization layers and
an encoder-based multi-level feature extractor for a target face. In
particular, the Adaptive Attentional Denormalization creates a synthetic face
by fusing a person’s identity with their physical characteristics. To improve
face occlusions, they then created a unique Heuristic Error Acknowledging
Refinement Network in the second phase.

  * •

CelebDFv2. CelebDFv2 [67] is a large, difficult dataset for deepfake
forensics. It contains 590 original YouTube videos with subjects of various
ages, ethnic backgrounds, and genders, as well as 5,639 DeepFake videos. The
synthesized videos are generated by the Deepfake synthesis algorithm, followed
by several refining steps targeting specific visual artifacts such as low
resolution, color mismatch, and temporal flickering.

  * •

Face Forensics In the Wild (FFIW10K). FFIW10K consists of 10,000 forgeries
videos of high quality, with an average of three human faces every frame. Each
video is created using one of three face-swapping techniques: DeepFaceLab
[44], FS-GAN [42], and FaceSwap [6], in order to increase the variety of
manipulated videos.

For FaceForensics++ datasets, we follow the same preprocessing step as in ADD
[32] for each modality. And, with a 3-tuple quality modality (raw, c23, and
c40) in our experiment, we have 276,480, 53,760, and 53,750 for training,
validation, and testing, respectively. Similarly, for both CelebDF-v2 and
FFIW10K datasets, we used 360,000, 49,200, and 49,200 images for training,
validating, and testing, respectively. To ensure the fair comparison, faces
cropped from videos are resized to $128\times 128$, then prepossessed to the
desired input size of each benchmark detector, e.g., $299\times 299$ for
XceptionNet.

##  Appendix B Proof of Theorem 1

Let the optimization function be $\mathcal{L}(f(x),y)=1-\sigma_{T}(f(x,y))$,
where $\sigma_{T}$ is the softmax function with temperature $T>0$:

$\sigma_{T}({f(x),y})=\frac{\text{exp}(f(x,y)/T)}{\sum_{k=1}^{2}\text{exp}(f(x,k)/T)}.$
(11)

We introduce a function class
$\Phi_{\mathcal{W}}\subseteq[0,1]^{\mathcal{X}\times\mathcal{Y}}$ from the
distribution of raw images:
$\Phi_{\mathcal{W}}=\\{(x_{r},y)\mapsto\mathcal{L}(f(x_{r}),y):f\
\in\mathcal{F}\\}$.

Let $\nu\in\\{1,2,...,\log_{2}(n)\\}$ and $\tau_{\nu}=2^{2-\nu}$, and we
define function classes as follows:

$\begin{split}\Phi_{\nu}=\\{(x_{c},y)\mapsto&\mathcal{L}(f(x_{c}),y):\\\
&\mathbb{E}_{\mathcal{D}}\left[|\sigma_{T}(f(x_{r}))-\sigma_{T}(f(x_{c}))|\right]\leq\tau_{\nu}\\}.\end{split}$
(12)

For any $\mathcal{L}\in\Phi_{\nu}$, and $\delta\in(0,1)$, with probability at
least $1-\delta$, the classical generalisation bound with the Rademacher
complexity [2, 40] is defined as follows:

$\begin{split}\mathbb{E}[\mathcal{L}(f(x_{c}),y)]\leq\mathbb{E}_{\mathcal{D}}[\mathcal{L}(f(x_{c}),y)]&+2\mathfrak{R}_{\mathcal{D}}(\Phi_{\nu})\\\
&+\mathcal{O}\left(\sqrt{\frac{\log(2/\delta)}{2n}}\right),\end{split}$ (13)

where

$\mathfrak{R}_{\mathcal{D}}(\Phi_{\nu})=\frac{1}{n}\mathbb{E}_{\pi}\left[\sup_{\mathcal{L}\in\Phi_{\nu}}\sum_{i=1}^{n}\pi_{i}\mathcal{L}(f(x_{c}),y)\right],$
(14)

and $\pi_{1},...,\pi_{n}$ are i.i.d. Rademacher random variables with
$P(\pi_{i}=1)=P(\pi_{i}=-1)=\frac{1}{2}$. The Rademacher complexity
$\mathfrak{R}_{\mathcal{D}}$ measures the rate that the empirical risk
converges to the population risk.

Moreover, we also have:

$\begin{split}\mathfrak{R}_{\mathcal{D}}(\Phi_{\nu})&=\frac{1}{n}\mathbb{E}_{\pi}\left[\sup_{\mathcal{L}\in\Phi_{\nu}}\sum_{i=1}^{n}\pi_{i}\mathcal{L}(f(x_{c}),y)\right]\\\
&=\frac{1}{n}\mathbb{E}_{\pi}\biggl{[}\sup_{\mathcal{L}\in\Phi_{\nu}}\sum_{i=1}^{n}\pi_{i}(\mathcal{L}(f(x_{c}),y)-\mathcal{L}(f(x_{r}),y)\\\
&\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;+\mathcal{L}(f(x_{r}),y))\biggr{]}\\\
&\leq\frac{1}{n}\mathbb{E}_{\pi}\left[\sup_{\mathcal{L}\in\Phi_{\nu}}\sum_{i=1}^{n}|\pi_{i}||\mathcal{L}(f(x_{c}),y)-\mathcal{L}(f(x_{r}),y)|\right]\\\
&+\frac{1}{n}\mathbb{E}_{\pi}\left[\sup_{\mathcal{L}\in\Phi_{\mathcal{W}}}\sum_{i=1}^{n}\pi_{i}\mathcal{L}(f(x_{r}),y)\right]\\\
&\leq\tau_{\nu}+\mathfrak{R}_{\mathcal{D}}(\Phi_{\mathcal{W}})\end{split}$
(15)

Replacing Eq. 15 into Eq. 13, we have:

$\begin{split}\mathbb{E}[\mathcal{L}(f(x_{c}),y)]\leq&\mathbb{E}_{\mathcal{D}}[\mathcal{L}(f(x_{c}),y)]+2\tau_{\nu}\\\
&+2\mathfrak{R}_{\mathcal{D}}(\Phi_{\mathcal{W}})+\mathcal{O}\left(\sqrt{\frac{\log(2/\delta)}{2n}}\right).\end{split}$
(16)

In addition, for every $\mathcal{L}(f(x_{c}),y))$, there always exists
$\tau_{\nu}$, such that:

$\tau_{\nu}\geq\mathbb{E}_{\mathcal{D}}\left[\parallel\sigma_{T}(f(x_{r}))-\sigma_{T}(f(x_{c}))\parallel\right]\geq\frac{1}{2}\tau_{\nu}-2^{1-\log_{2}(n)}.$
(17)

Then

$\begin{split}\tau_{\nu}&\leq\frac{4}{n}+2\mathbb{E}_{\mathcal{D}}\left[\parallel\sigma_{T}(f(x_{r}))-\sigma_{T}(f(x_{c}))\parallel\right]\\\
\end{split}$ (18)

Now, Eq. 16 can be rewritten as:

$\begin{split}\mathbb{E}[\mathcal{L}(f(x_{c}),y)]\leq&\mathbb{E}_{\mathcal{D}}[\mathcal{L}(f(x_{c}),y)]+\frac{8}{n}\\\
&4\mathbb{E}_{\mathcal{D}}\left[|\sigma_{T}(f(x_{r}))-\sigma_{T}(f(x_{c}))|\right]\\\
&+2\mathfrak{R}_{\mathcal{D}}(\Phi_{\mathcal{W}})+\mathcal{O}\left(\sqrt{\frac{\log(2/\delta)}{2n}}\right).\end{split}$
(19)

Next, we rewrite the loss function for a compressed image, $x_{c}$, as
follows:

$\displaystyle\mathcal{L}(f(x_{c}),y)=\frac{\sum_{i\neq
y}\exp(f(x_{c},i)/T)}{\sum_{i=1}^{2}\exp(f(x_{c},i)/T)}$
$\displaystyle=\frac{1}{1+\frac{\exp(f(x_{c},y)/T)}{\sum_{i\neq
y}\exp(f(x_{c},i)/T)}}$
$\displaystyle=\frac{1}{1+\exp(f(x_{c},y)/T-\ln\bigl{(}\sum_{i\neq
y}\exp(f(x_{c},i)/T)))}$
$\displaystyle=s\Bigl{(}-f(x_{c},y)/T+\ln\bigl{(}\sum_{i\neq
y}\exp\left(f(x_{c},i)/T\right)\bigr{)}\Bigr{)},$ (20)

where $s(\cdot)$ is the sigmoid function. However, note that the second term
in the sigmoid function of Eq. 20 belongs to the family of Log-Sum-Exp (LSE)
function, and $s(\cdot)$ is a monotonically increasing function. Then, we
have:

$\mathcal{L}(f(x_{c}),y)\geq
s\Bigl{(}-f(x_{c},y)/T+f(x_{c},\tilde{y})/T\Bigr{)},$ (21)

where $\tilde{y}=\operatorname*{arg\,max}_{i\neq y}f(x_{c},i)$. Since we
always have $s(t)\geq\frac{1}{2}\mathbb{I}(t\geq 0),\forall t\in\mathbb{R}$,
then

$\begin{split}s\Bigl{(}-f(x_{c},y)/T+&f(x_{c},\tilde{y})/T\Bigr{)}\geq\\\
&\frac{1}{2}\mathbb{I}\Bigl{(}-f(x_{c},y)/T+f(x_{c},\tilde{y})/T\geq
0\Bigr{)},\end{split}$ (22)

or

$\begin{split}2\mathcal{L}(f(x_{c}),y)&\geq\mathbb{I}\Bigl{(}f(x_{c},y)/T\leq
f(x_{c},\tilde{y})/T\Bigr{)}\\\ &=\mathbb{I}\Bigl{(}\hat{y}(x_{c})\neq
y\Bigr{)}.\end{split}$ (23)

Combining Eq. 19 and Eq. 23,

$\displaystyle\mathbb{E}\left[\mathbb{I}\\{\hat{y}(x_{c})\neq y\
\\}\right]\leq 2\mathbb{E}[\mathcal{L}(f(x_{c}),y)]$ $\displaystyle\leq
2\mathbb{E}_{\mathcal{D}}[\mathcal{L}(f(x_{c}),y)]+\frac{16}{n}$
$\displaystyle
8\mathbb{E}_{\mathcal{D}}\left[\parallel\sigma_{T}(f(x_{r}))-\sigma_{T}(f(x_{c}))\parallel\right]$
$\displaystyle+4\mathfrak{R}_{\mathcal{D}}(\Phi_{\mathcal{W}})+\mathcal{O}\left(\sqrt{\frac{\log(2/\delta)}{2n}}\right).$
(24)

As softmax is a $L-Lipschitz$ function [14] with $L=1/T$, we obtain:

$\displaystyle\mathbb{E}\left[\mathbb{I}\\{\hat{y}(x_{c})\neq y\ \\}\right]$
$\displaystyle\leq
2\mathbb{E}_{\mathcal{D}}[\mathcal{L}(f(x_{c}),y)]+\frac{16}{n}$
$\displaystyle\frac{8}{T}\mathbb{E}_{\mathcal{D}}\left[\parallel
f(x_{r})-f(x_{c})\parallel\right]$
$\displaystyle+4\mathfrak{R}_{\mathcal{D}}(\Phi_{\mathcal{W}})+\mathcal{O}\left(\sqrt{\frac{\log(2/\delta)}{2n}}\right).$
(25)

##  Appendix C Additional Experiments

Figure 6: Classification performance (AUC) of deepfake detectors under various
corruptions with different severity levels.

Robustness against unseen corruptions. Although our QAD does not intend to
defend against all image corruption types, we investigate the robustness of
our model and other detectors under unseen perturbations. All defenders in our
experiment are trained on FaceForensics++ [50] including five typical
deepfakes: NeuralTextures, DeepFakes, Face2Face, FaceSwap, and FaceShifter,
with their quality modalities: raw, c23, and c40. In the inference phase, we
apply five operations with five severity levels, as given in [28]: saturation,
contrast, block-wise distortion, white Gaussian noise, and blurring. The
results are indicated in Fig. 6. Although none of the perturbations are
included in the training phase, generally, our proposed QAD-E achieves the
best robustness compared to previous SoTA approaches. One may notice that MAT
[69] is a competitive defender; it obtains more robustness in the worst case
by using a large input size of an image, i.e., $380\times 380$, which can
alleviate the perturbations’ effects. Finally, we believe that our method can
be generalized to different corruptions when including them in the training
phase, making detectors more robust. However, this is out of our study’s
scope, which mainly targets deepfake compression.

##  Appendix D Limitations

We can point out two limitations of QAD. First, our proposed method relies on
the existence of a $M$-tuple of quality modalities in the training dataset.
While this requirement in the research environment is usually satisfied, a few
deepfake datasets contain only videos in different qualities and conditions,
such as DFDC [9]. Therefore, possible future research could focus on utilizing
unpaired images of various qualities to robust the deepfake detector.

Secondly, as we target detecting deepfake in multi-quality and we did not
mining fine-grained deepfake artifacts as in [69], our QAD can be less
generalized when validating across datasets. As shown in Table 6, we trained
all detectors on five FaceForensics++ [50] datasets with their three versions:
raw, c23, and c40. In the inference phase, we test the pre-trained models on
DFDC [9] and WildDeepfake [71] datasets. While our QAD, especially when
integrating with EFFICIENTNET-B1, outperforms previous works on the
WildDeepfake, it still needs to improve on the DFDC dataset. Our future work
will focus on designing a good metric learning framework that can be
generalized towards both input quality and cross-domain deepfakes.

Method | Training set | Test set
---|---|---
FF++ | DFDC | WildDeepfake
ACC | AUC | ACC | AUC | ACC | AUC
MesoNet [1] | 61.6 | 65.6 | 60.3 | 71.4 | 54.4 | 55.8
Rössler _et al._ [50] | 79.4 | 86.4 | 57.6 | 66.0 | 61.1 | 66.4
$F^{3}\text{Net}$ [45] | 75.4 | 84.2 | 54.1 | 66.4 | 58.9 | 64.5
MAT [69] | 77.3 | 86.8 | 65.1 | 71.9 | 63.6 | 71.0
Fang & Lin [11] | 80.7 | 89.0 | 63.2 | 70.2 | 63.1 | 67.7
SBIs [53] | 68.9 | 86.0 | 60.5 | 70.9 | 59.2 | 65.5
QAD-R | 85.3 | 93.4 | 61.4 | 67.0 | 62.5 | 68.9
QAD-E | 87.8 | 95.6 | 56.5 | 65.3 | 65.5 | 74.7

Table 6: Cross-validation performance of models that trained on FF++ and
validated on DFDC and WildDeepfake datasets.

##  Appendix E Grad-CAM Results

Gradient-weighted Class Activation Mapping (Grad-CAM) [52] applies gradients
from a high-probability prediction class to a lower level convolutions layer,
resulting in a coarse localization map that highlights critical locations in
the image. Positive layer outputs and higher gradient values generate more
activation areas, which are illustrated in red in Fig. 7 and Fig. 8. On the
other hand, negative pixels or low gradients produce fewer activation regions,
which are represented in blue. In this experiment, we visualize RESNET50
baseline and our QAD-R on the five FaceForensics++ datasets: NeuralTextures,
Deepfakes, Face2Face, FaceSwap, FaceShifter, and explain the benefits of our
training frameworks as follows:

  * •

Consistently activating important regions across quality modalities. Since
RESNET-50 is trained without any regularization, it considers images of
different quality as different images. Therefore, the activation regions can
vary across quality modalities, which is indicated by the red arrows in Fig.
7, resulting in a large proportion of wrong predictions in low-quality images.
In contrast, our QAD utilizes the HSIC to maximize the dependence between
quality modalities, it regulates activation regions to be similar, ensuring
its generalizability for detecting different quality deepfakes, as show in
Fig. 7.

  * •

Expanding attention regions in low-quality images. Under heavy compression,
subtle differences and artifacts for distinguishing deepfakes can be
diminished. As we can observe in Fig. 8, RESNET50 activates different regions,
resulting in inconsistent prediction among quality modalities. Meanwhile, our
QAD by utilizing the AWP assists in enlarging activation regions on the low-
quality images, which are indicated by the green circles in Fig. 8. Therefore,
it accumulates information from several regions inside the low-quality image
to make an overall prediction, making the detector more accurate.

Figure 7: Grad-CAM activation maps of deepfake images from NeuralTextures,
DeepFakes, Face2Face, FaceSwap and FaceShifter dataset. The red arrows
indicate the inconsistent activation regions created by the RESNET50 baseline.
The green arrows indicate the re-corrected activation regions created by our
QAD framework.  Figure 8: Grad-CAM activation maps of deepfake images from
NeuralTextures, DeepFakes, Face2Face, FaceSwap and FaceShifter dataset. In
contrast with inconsistent or wrong activation regions from the baseline, our
QAD can enlarge the activation regions in the low-quality images and reconcile
them with other quality modalities.