# Self-supervised learning - A way to minimize time and effort for precision
agriculture?

Michael L. Marszalek1 Corresponding author Bertrand Le Saux1 Pierre-Philippe
Mathieu 1 Artur Nowakowski2 Daniel Springer 3 1 European Space Agency (ESA)
$\Phi$-lab, Frascati, Italy -
(Michael.Marszalek, Bertrand.Le.Saux<EMAIL_ADDRESS>
2 World Food Programme (WFP), Rome, Italy -<EMAIL_ADDRESS>
3 Institute of Advanced Research in Artificial Intelligence (IARAI), Vienna,
Austria -<EMAIL_ADDRESS>

###### Abstract

Machine learning, satellites or local sensors are key factors for a
sustainable and resource-saving optimisation of agriculture and proved its
values for the management of agricultural land. Up to now, the main focus was
on the enlargement of data which were evaluated by means of supervised
learning methods. Nevertheless, the need for labels is also a limiting and
time-consuming factor, while in contrast, ongoing technological development is
already providing an ever-increasing amount of unlabeled data. Self-supervised
learning (SSL) could overcome this limitation and incorporate existing
unlabeled data. Therefore, a crop type data set was utilized to conduct
experiments with SSL and compare it to supervised methods. A unique feature of
our data set from 2016 to 2018 was a divergent climatological condition in
2018 that reduced yields and affected the spectral fingerprint of the plants.
Our experiments focused on predicting 2018 using SLL without or a few labels
to clarify whether new labels should be collected for an unknown year. Despite
these challenging conditions, the results showed that SSL contributed to
higher accuracies. We believe that the results will encourage further
improvements in the field of precision farming, why the SSL framework and data
will be published (Marszalek,, 2021).

###### keywords:

Crop types, Self-Supervised Learning, Transformer, Random Forest, SimSiam,
Remote Sensing

##  1 Introduction

Food sustainability is one of the grand challenges of the next decades, and a
rigorous monitoring of the global food system is needed to allocate our
resources (Fanzo et al.,, 2021). In particular, cropland use monitoring is
essential, to assess the supply chain, but also evaluate the impact on natural
ecosystems and keep track of the related hidden costs and subsidies (Rockström
et al.,, 2020). Earth Observation (EO) is a global recurring proxy for land
use monitoring, which is why it is widely used especially in areas where
accessibility and infrastructure are a problem.

Today’s opportunity is that there is much more image data available for
feature extraction, even if not labeled. In recent years, new methods such as
self-supervision have emerged that allow solid representations to be extracted
in an unsupervised manner and could provide a more reliable representation for
crop type mapping or other precision farming applications. Contrastive
learning is a powerful approach to self-supervision, which aims to learn a
representation where similar pairs of samples, such as time series of one crop
type, are close to each other in the embedding space and different time series
are far apart. In addition, only a few available labels do not impose a
restriction as with supervised learning. Self-Supervised Learning (SSL) was
successfully applied to detect changes (Leenstra et al.,, 2020), using
techniques such as pretext tasks or augmentations to learn an invariant
representation (Güldenring and Nalpantidis,, 2021). Baevski et al., (2022)
applied self-supervision for several tasks (NLP, speech, computer vision) with
the objective to apply one augmentation suitable for different domains. The
core idea was to mask a part of the input instead of using augmentations such
as rotation or color distortion which are only suitable for certain use cases.
The increasing number of self-supervised learning methods differ mainly in
terms of loss function, augmentation or architecture, with the choice of the
underlying encoder playing an important role. In this work, we used a
transformer (TF) as an encoder, which was verified in previous studies in a
supervised manner (Rußwurm et al.,, 2020). SimCLR was one of the first
architectures proposed where augmentation and the use of positive and negative
pairs is an important property. Another similar example is MOCO which uses a
memory bank in addition to negative and positive pairs. An overview as well as
comparison of these siamese networks was presented in (Chen and He,, 2021). We
build on the recent SimSiam method, which combines a dual-stream siamese
network with various data augmentations on positive pairs of input data (Chen
and He,, 2021). SimSiam also achieved promising results with a small batch
size and a small number of epochs.

Self-supervised learning has rarely been used in precision agriculture
although it could make an important contribution. For instance, for field-
level yield prediction, there are typically very few labels available, which
is a limitation for most supervised learning methods. In addition, adapting to
a new region or a year with different climatic conditions reduces the effort
required to record new labels. In fact, plant morphology varies in different
climates, and plant growth and spectral response may change from year to year,
due to climatic variations or agricultural practices. Models trained on
specific imagery and crop type may therefore not transfer optimally to new
regions or future years (Belgiu and Csillik,, 2018). From a machine learning
perspective, this is framed as domain adaptation. In this context, transfer
learning solved similar problems by means of learned knowledge. It used other
data sources such as ImageNet to pre-train a neural network and then transfer
it to a downstream task (Nowakowski et al.,, 2021; Lucas et al.,, 2021).
Castillo-Navarro et al., (2022) experimented with out-of distribution data and
confirmed the power of self-supervised learning with very few labels. Nyborg
et al., (2022) used Thermal Positional Encoding (TPE) for attention-based crop
classifiers to classify crop types in different regions in Europe and, most
importantly, to reduce the effects of climate on the spectral responses of
plants. Orynbaikyzy et al., (2022) identified appropriate Sentinel-1 and
Sentinel-2 features to fit a new target region. Reducing the features by
eliminating the weather-dependent bands likewise improved the results in our
experiments. Another initial application of SSL in the agricultural sector
outperformed deep learning approaches with a limited number of labels
(Güldenring and Nalpantidis,, 2021). Agastya et al., (2021) successfully
applied self-supervised learning for irrigation detection. These promising
approaches will save considerable time and reduce the need for labels.

In this study, SimSiam was applied with and without augmentation. In one
experiment, we omitted augmentation and aimed to bring in our existing labels
to learn an invariant representation per crop type. Data from previous years
already include several variations of time series for each crop type, covering
not only small climatological but also soil-related differences. This provided
an additional advantage because, unlike normal augmentation with 1D time
series, the risk of shifting to another crop type is reduced. Dwibedi et al.,
(2021) followed a similar hypothesis and added nearest neighbors from the data
set to find additional positive pairs, assuming that more similar variations
would be found this way.

The objectives of this research were as follows:

  1. 1.

A comparison of supervised learning with self-supervised learning.

  2. 2.

Experiments with/without augmentation to assess their impact on SSL
performance.

  3. 3.

Analysis to what extent SSL is suitable for the prediction of unknown or
deviating years. We assume that this also paves the way for the prediction of
crop types in new regions.

##  2 Materials and methods

###  2.1 Study site

The crop mapping task was evaluated on a data set which included the main crop
types (corn, winter wheat, winter barley, winter rapeseed, sugar beet, and
potato) in Upper Bavaria (Germany), collected for the years 2016, 2017 and
2018 (Figure 1). It is part of a larger collection, assembled and partly self-
created, which included crop types and yields for different regions
(Marszalek,, 2021). The climatological data in Table 1 provided better
insights into the various climatological conditions.

| 2016 | 2017 | 2018
---|---|---|---
Crop samples | 558 | 600 | 600
Mean temperature (${}^{\circ}\mathrm{C}$) | 12.3 | 13.0 | 13.7
Mean precipitation (mm) | 308.5 | 292.9 | 315.4
Table 1: Data overview with average temperature and accumulated precipitation
amount per year Figure 1: Experimental site in WGS84 (EPSG:4326). All crop
type samples were randomly selected in the region of Upper Bavaria. Two
weather stations (in orange) were used to generate the climatological
overview. Figure 2: Data on average temperature for each year and an overview
of monthly precipitation. Climatological data from March to July were used for
the visualisation.

The corresponding climatological overview was visualised in Figure 2. The
average temperature was compared for each year and showed that 2018 was 1.4
degrees different from 2016. 2016 and 2017 were more similar in terms of
temperature trend and precipitation. Figure 2 indicates that precipitation in
spring 2018 was below normal, which affected crop yields and plant growth. It
was visualised as a monthly mean value. Here, climatological data from several
fields near two weather stations (highlighted in orange in Fig. 2) were
averaged to provide an overview of the period March through July. While this
does not reflect the entire region of Upper Bavaria, it is intended to provide
an overview of the climatological conditions per year. The crop samples were
randomly selected from all over Upper Bavaria.

###  2.2 Sentinel-2

Sentinel-2 observations were used for the experiments with the self-supervised
framework. With a repeat cycle of 2-5 days and its multispectral data in e.g.
near infrared (NIR) and short-wave infrared (SWIR), these data allow various
applications in agriculture. One drawback is the impact of clouds because,
unlike SAR-based missions, clouds limit Sentinel-2’s data availability.
Nevertheless, the high temporal availability allowed the collection of
sufficient data over time in the test region. Initially, all 13 bands were
used in this study. A more detailed band description with properties can be
found in (GEE,, 2012) or (Marszalek et al.,, 2020). For this purpose, Level-1C
data were downloaded from Google Earth Engine (GEE) (Google,, 2020), but not
further processed to bottom-of-atmosphere (BOA) reflection information since
the focus was the comparison of supervised learning with self-supervised
learning. For each field a georeferenced polygon (StMELF,, 2020) was applied
for the collection of corresponding field images. The original time series
from February to the end of August were interpolated with a resolution of 2
weeks, resulting in 14 time steps for each field. Thus, a sample was
represented by 13 band time series with 14 time steps, with each band averaged
over the field polygon. For our experiments clouds were partially filtered
out, but only in a simplified form, which increased the noise in the time
series. GEE provides the ability to filter a scene based on metadata such as
”CLOUD_COVER”, but this did not remove the field-level clouds because we used
a cloud cover of 20% for each scene. For 2016, several time series were
downloaded incorrectly, which is reflected in the original data set in non-
changing values over time. These data were also removed in the pre-processing,
which is why slightly fewer samples are available for 2016.

###  2.3 Methods

Random Forest (RF) (Biau and Scornet,, 2015) and a transformer (TF) (Vaswani
et al.,, 2017) were used for the supervised crop type classification task in
this study. Overall Accuracy (OA) was used as a measure to evaluate the
experiments.

The semi-supervised crop type classification follows a two-fold training
regime. In the initial phase (pre-training) a SimSiam architecture with a
transformer as encoder (backbone) is trained to minimise a contrastive loss
between augmented sample pairs $x_{1}$ and $x_{2}$ of the same crop type and
to maximise the loss between pairs of different crop types. The latent
representation encoded by the transformer backbone is then used in a
supervised classification task (fine-tuning). Here, a linear layer was added
as a classification head on the pre-trained backbone. The SimSiam
implementation is based on the original work (Chen and He,, 2021). We
conducted experiments without and with a few labels of the target year. An
important aspect was to verify that the embeddings did not collapse during
pre-training. Chen and He, (2021) suggested that the $l_{2}$-normalized
outputs during training should be close to $1/\sqrt{dim}$, where $dim$ is the
output dimension.

##  3 Experiments

###  3.1 Supervised

The supervised training for RF and the TF was performed in four different
scenarios, distinguishable by the data used for training and testing. In the
first run the entire data (2016-2018) was used in the train (75%) and test
(25%) split (E1). The second training was performed with data from 2016 and
2017 only (E2), while data from 2018 was only used in the test set. The
training data of the third (E3) and fourth experiment (E4) is again based on
the years 2016 and 2017 but was enriched with 5% and 10% of samples from 2018
respectively. The first experiment was expected to outperform the other three
experiments because it was trained with data from three different years and
thus provided the most information about atmospheric and weather patterns.
Experiment E2 is the most realistic approach, to illustrate the performance of
the framework with respect to unseen data from an entire year.

TF was initialised with $4$ self-attention heads and $3$ layers. All
experiments were performed with a learning rate of $0.0016612$, $256$ as batch
size and $300$ epochs. As the experiment progressed, bands and time steps were
reduced to minimise noise.

###  3.2 Self/Semi-supervised

Augmentation is a key factor not only for SSL techniques to learn an invariant
representation but also to increase the training data set. In the present work
we used three augmentations, hereafter referred to as Aug1, Aug2, and Aug3,
with Aug1 in particular following a new approach.

Aug1 draws original (non-augmented) pairs of samples from the same crop type
and treats them as augmentations of each other. In this way an invariant
representation for each crop type is learned. If the pairs are from different
years, the model may generalise with respect to different weather patterns.

Aug2 randomly applied noise or drift to the original time series $x_{1}$ to
generate $x_{2}$. We used a Python framework for time series augmentation
(tsaug,, 2020) and parameterised the drift with $max\\_drift=0.1$ and
$n\\_drift\\_points=2$. The noise was initialised with $scale=0.02$.

Aug3 is a combination of Aug1 with cloud noise simulation. A constant factor
(e.g. 7000) was added to all band values for a randomly chosen time step to
simulate clouds and learn an invariant representation. Both $x_{1}$ and
$x_{2}$ were selected from the labeled data set per crop type before random
noise was added.

For each augmentation we repeated the same four experiments as discussed in
section 3.1. The impact of the different augmentations was analysed in terms
of embedded clusters after pre-training and fine-tuning. The pre-trainig is
based on $600$ epochs and a learning rate of $0.0016612$. SimSiam was
initialised with 64 features (d_model), $0.0005$ weight decay and $0.9$ as
momentum. The hidden dimension in the projection and prediction head were
initialised with $6$ and $14$ as the output dimension respectively. The
augmentation experiments were performed with 11 and 14 time steps to learn an
invariant representation.

####  3.2.1 Contrastive

While the contrastive pre-training aimed to provide a robust feature encoder
for the classification task, it is also possible to use this contrastive
framework directly as a classification tool. To illustrate the performance of
contrastive pre-training, we trained SimSiam according to E1 and E2 and used
2018 data for evaluation. For the classification ($\mathcal{P}$) of a single
sample from 2018 ($x_{1}$) we detected the minimum of the averaged contrastive
loss $\mathcal{C}$ between $x_{1}$ and all $N_{c}$ samples of each crop type
$c$ from 2016 and 2017 ($x_{2}$) according to

$\displaystyle\mathcal{P}=\textrm{min}(\mathcal{L}_{c})\ \ \ \ \textrm{with}\
\ \
\mathcal{L}_{c}=\frac{1}{N_{c}}\sum_{n}^{N_{c}}\mathcal{C}(x_{1},x_{2}^{n})\
.$ (1)

The incorrectly predicted crop types were recorded.

###  3.3 Results

####  3.3.1 Supervised

RF and TF were trained with all 13 bands and time steps as a first test. Table
2 summarises the four experiments repeated throughout the paper. RF improved
as the amount of data from the target year increased. In contrast, the
transformer had difficulties with this noisy data set which is why the overall
accuracy was reduced by about 40% for 2018 without labels.

Method | E1 (OA) | E2 (OA) | E3 (OA) | E4 (OA)
---|---|---|---|---
RF | 0.92 | 0.80 | 0.84 | 0.87
TF | 0.93 | 0.54 | 0.86 | 0.62
Table 2: Supervised benchmark with all bands and time steps: Overall accuracy
(OA) with all data (E1); OA with 0% labels for 2018 (E2); with 5% labels (E3)
and 10% for 2018 (E4).

As a next step, bands 1, 2, 3 and 10 were removed because in particular bands
1 and 10 are strongly influenced by aerosols and clouds. Table 3 provides an
overview about the results with B4, B5, B6, B7, B8, B8A, B9, B11 and B12.

Method | E1 (OA) | E2 (OA) | E3 (OA) | E4 (OA)
---|---|---|---|---
RF | 0.93 | 0.85 | 0.87 | 0.88
TF | 0.93 | 0.67 | 0.88 | 0.75
Table 3: Supervised benchmark - 14 time steps and 9 bands: Overall accuracy
(OA) with all data; OA with 0% labels for 2018; with 5% labels and 10% for
2018.

Removal of these bands stabilised the prediction of crop types in 2018 for E3
and E4. Tables 2 and 3 show that the results for E4 were worse compared to E3
for RF or TF. The last optimisation step visualised in Table 4 removed the
first observations in the time series. An investigation of the time series
showed that the signal of the first time steps in 2018 were contaminated by
clouds.

Method | E1 (OA) | E2 (OA) | E3 (OA) | E4 (OA)
---|---|---|---|---
RF | 0.93 | 0.85 | 0.88 | 0.88
TF | 0.93 | 0.86 | 0.85 | 0.91
Table 4: Supervised benchmark - 11 time steps and 9 bands: Overall accuracy
(OA) with all data; OA with 0% labels for 2018; with 5% labels and 10% for
2018.

Therefore, the time series were shortened by 3 time steps resulting in an
observation period from the end of March to the end of August. This
significantly affected the accuracy and improved the results for predictions
where either 10% or no samples of 2018 were included in the training. While RF
has dominated so far, transformer’s predictive capability was emerging here.

Figure 3: Examples of embeddings generated with principal component analysis
(PCA). The six different colors represent the crop types. A) gives an overview
of the raw data. B) shows the result after pre-training with SimSiam and Aug1.
Here it is already possible to differ between clusters. C) shows the last step
and the embeddings after fine-tuning with labels.

####  3.3.2 Self/Semi-Supervised

The following results are based on 14 and 11 time steps. As shown in Section
3.3.2, the 14 time steps contained cloud noise in the first few weeks, but
this is useful for learning a noise-invariant representation. Table 5 provides
an overview with Aug1 and Aug2 and 14 time steps. Table 6 focused on Aug1 and
Aug3 with 11 time steps and without cloud noise. Comparing the results in
Table 3 and Table 5 shows that Aug3 improved the accuracies. The combination
of crop invariance and noise in Aug3 also increased the prediction results for
E2 to 0.71 OA and E4 to 0.87 OA. For E4, the highest improvement of 16% was
achieved here. Aug1 has only one added value with 10% samples. The noise-
invariant representation also stabilises the results with 10% no longer
collapsing as in Table 3 or Table 2. Nevertheless, the robustness of RF proved
to be evident as well.

14 ts | E1 (OA) | E2 (OA) | E3 (OA) | E4 (OA)
---|---|---|---|---
Aug1 | 0.92 | 0.54 | 0.68 | 0.85
Aug3 | 0.93 | 0.71 | 0.87 | 0.87
Table 5: SSL with 14 time steps: Overall accuracy (OA) with all data (E1); OA
with 0% labels for 2018 (E2); with 5% labels (E3) and 10% for 2018 (E4).

In contrast, Table 6 addressed the results with 11 time steps for a growing
season from the end of March to the end of August. Thus, noise caused by
clouds was removed in the first 3 time steps in 2018 and changed the
presentation of the results. Both, Aug1 and Aug2 performed well in this
scenario. Especially the test with 5% labels reached an accuracy of 0.9 OA
compared to 0.85 OA supervised.

11 ts | E1 (OA) | E2 (OA) | E3 (OA) | E4 (OA)
---|---|---|---|---
Aug1 | 0.90 | 0.85 | 0.89 | 0.89
Aug2 | 0.93 | 0.81 | 0.90 | 0.84
Table 6: SSL with 11 time steps: Overall accuracy (OA) with all data; OA with
0% labels for 2018; with 5% labels and 10% for 2018.

One observation with Aug1 was the lower accuracy using all data compared with
supervised TF (0.9 vs 0.93 OA). Looking at the embeddings visualised with PCA,
it is evident that winter wheat and winter barley were difficult to separate.
While fine-tuning thereafter separated the two classes well, supervised
learning was able to distinguish these two classes more clearly. Figure 3
visualises examples with raw data, pre-training and fine-tuning. Figure 4
shows the collapse level of embeddings during the training. Our observations
confirmed that convergence near $1/\sqrt{dim}$ is important to assess whether
the embeddings collapse in the pre-training. Evaluation based on training loss
alone was not always sufficient. We sometimes observed a collapse of the
embeddings during pre-training, which prevented fine-tuning from improving
accuracy. Therefore, it was important to observe the collapse level from 300
epochs.

Figure 4: Standard deviation of the $l_{2}$-normalized output and training
loss.

Intermediate evaluation of the backbone
The direct evaluation of the SimSiam network without using a dedicated
classification layer, can be understood as an intermediate evaluation of the
quality of the latent representation. Table 7 shows the crop-wise prediction
accuracy of the SimSiam network when evaluated according to equation (1).

11 steps | $c_{1}$ | $c_{2}$ | $c_{3}$ | $c_{4}$ | $c_{5}$ | $c_{6}$
---|---|---|---|---|---|---
E1 | 0.94 | 0.84 | 0.97 | 0.97 | 0.96 | 1.00
E2 | 0.94 | 0.53 | 0.85 | 0.64 | 0.85 | 0.72
Table 7: Crop type resolved accuracy of contrastive classification based on 11
time steps for E1 and E2.

In both E1 and E2, we observed a decrease in accuracy for crop type 2 (winter
barley), which was more pronounced in E2. Since the evaluation for E1 is based
on data that included samples in training, a decline in a single crop type may
indicate a systematic problem either in the framework or in the data
themselves. It is hence of interest to resolve the actual predictions when the
network is confronted with samples of crop type 2 from the year 2018 (Table
8).

$\mathcal{P}(c_{2})$ | $c_{1}$ | $c_{2}$ | $c_{3}$ | $c_{3}$ | $c_{5}$ | $c_{6}$
---|---|---|---|---|---|---
E1 | 0 | 84 | 1 | 5 | 10 | 0
E2 | 1 | 53 | 2 | 3 | 41 | 0
Table 8: Predictions for all $100$ crop type 2 samples from 2018 (correct
predictions in bold numbers).

We have noticed a systematic tendency for crop type 2 to be incorrectly
identified as crop type 5 (winter wheat). This suggested that crop type 2 and
5 cannot be sufficiently separated by the contrastive framework.

##  4 Discussion & Conclusion

Methods in the field of supervised learning enabled several applications for
precision farming (Yang et al.,, 2019; Waldner and Diakogiannis,, 2019; Mazzia
et al.,, 2019). However, supervised learning is in general associated with a
large effort since labeled data are required. So far, few experiments were
performed with SSL for precision agriculture. In our work, we explored the
potential to use SSL for domain adaptation in crop classification.

Supervised learning achieved very good results through noise removal when
trained on bands B4, B5, B6, B7, B8, B8A, B9, B11 and B12. Excluding samples
from the target year, an overall accuracy of 0.86 was achieved. This resulted
in a decrease of about 8% compared to the test with all the data. We
hypothesise that the difference is mainly due to climatological variations
(Marszalek et al.,, 2022). The transformer had difficulties with noise caused
by clouds and improved significantly with the reduction of bands and noisy
time steps. RF showed robust performance in all tests regardless of noise.

Contrastive pre-training was used to learn robust representations for each
crop type. Augmentation is an important part of SSL and crucial for
performance. The introduction of 5% samples from the target year improved
accuracies and outperformed results using supervised learning. While previous
attempts were mainly based on typical augmentations such as rotation or jitter
(Güldenring and Nalpantidis,, 2021; Chen and He,, 2021), we took a different
approach with Aug1. Learning a crop-invariant representation separated most
crop types in the embedding space. Only winter wheat and winter barley were
not separable. By directly evaluating the backbone, we showed that these two
crop types could not be well distinguished by the contrastive embeddings.
Therefore, we hypothesise that this is the reason why pre-training combined
with fine-tuning led to slightly worse results than supervised training in
some cases. With 10% samples we recommend to proceed supervised because here
already OA values of around 0.9 were achieved. Aug3 has proven itself in the
test with the noise caused by clouds. Here, a significant increase in accuracy
was achieved. Successful denoising has also been confirmed in previous studies
(Dalsasso et al.,, 2021). The choice of augmentation provides several
opportunities to learn a better representation that could also be invariant to
regional differences. For example, Nyborg et al., (2021) introduced the
temporal shift of crop time series in different regions which inspired us to
use a drift (Aug2) as augmentation. However, this was only partially
successful in learning a shift-invariant representation. Further experiments
will be necessary to find a domain-invariant representation for crop types. We
also plan to further develop SimSiam based on the lessons learned to more
efficiently incorporate unlabeled data into training, which could be important
for domain adaption without labels. Dwibedi et al., (2021) and Zell et al.,
(2022) confirmed that incorporation of unlabeled data improved SSL.

The suitability of SSL was considered for crop classification in this study.
We showed that it is essential to introduce few labels for a new year.
Although the prediction of crop types in a deviating year was possible, we
would like to emphasise that the collection of few samples improved the
accuracy and reduced uncertainties. The study targeted crop classification,
but we also see potential for other applications in precision agriculture
(e.g. yield prediction). We showed that the pre-training improved the results
and that a costly collection of labels for a region with already existing data
from previous years is only partly necessary. Originally, we assumed that the
influence of climatological conditions would be much more significant.
Nevertheless, supervised learning and SSL provided good results. Although e.g.
a pronounced drought could strongly influence the spectral response of plants,
one can question the influence of climate for the classification of crops in
this study. The advantage of this test was that we used data from one region
and thus minimised the influence of soil and fertilisation. We assumed that
farming practices were similar over the years. However, for a change of the
target region, these two factors need to be taken into account as they are
likely to have an impact on the spectral response. While this study looked at
domain adaption, other studies have also identified the benefits for
agriculture (Güldenring and Nalpantidis,, 2021; Agastya et al.,, 2021). In
general, this study can be an argument for exploring other applications of SSL
where data availability is a limitation.

## ACKNOWLEDGEMENT

We would like to thank the LIGHTLY team for the support during this research
project and the Institute of Advanced Research in Artificial Intelligence
(IARAI) for providing the computational resources.

## References

  * Agastya et al., (2021) Agastya, C., Ghebremusse, S., Anderson, I., Reed, C., Vahabi, H., Todeschini, A., 2021. Self-supervised Contrastive Learning for Irrigation Detection in Satellite Imagery. ArXiv, abs/2108.05484.
  * Baevski et al., (2022) Baevski, A., Hsu, W.-N., Xu, Q., Babu, A., Gu, J., Auli, M., 2022. data2vec: A general framework for self-supervised learning in speech, vision and language.
  * Belgiu and Csillik, (2018) Belgiu, M., Csillik, O., 2018. Sentinel-2 cropland mapping using pixel-based and object-based time-weighted dynamic time warping analysis. Remote Sensing of Environment, 204, 509–523.
  * Biau and Scornet, (2015) Biau, G., Scornet, E., 2015. A random forest guided tour. TEST, 25, 197-227.
  * Castillo-Navarro et al., (2022) Castillo-Navarro, J., Le Saux, B., Boulch, A., Lefèvre, S., 2022. Energy-Based Models in Earth Observation: From Generation to Semisupervised Learning. IEEE Transactions on Geoscience and Remote Sensing, 60, 1-11.
  * Chen and He, (2021) Chen, X., He, K., 2021. Exploring simple siamese representation learning. _Proc. of the IEEE/CVF Conf. on Computer Vision and Pattern Recognition (CVPR)_ , 15750–15758.
  * Dalsasso et al., (2021) Dalsasso, E., Denis, L., Tupin, F., 2021. SAR2SAR: A Semi-Supervised Despeckling Algorithm for SAR Images. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 14, 4321–4329.
  * Dwibedi et al., (2021) Dwibedi, D., Aytar, Y., Tompson, J., Sermanet, P., Zisserman, A., 2021. With a little help from my friends: Nearest-neighbor contrastive learning of visual representations.
  * Fanzo et al., (2021) Fanzo, J., Haddad, L., Schneider, K. R. et al., 2021. Viewpoint: Rigorous monitoring is necessary to guide food system transformation in the countdown to the 2030 global goals. Food Policy, 104, 102163.
  * GEE, (2012) GEE, 2012. Spectral bands. https://developers.google.com/earth-engine/datasets/catalog/COPERNICUS_S2. (Accessed on: 21.07.2020).
  * Google, (2020) Google, 2020. GEE data catalog. https://earthengine.google.com/. (Accessed on: 21.07.2020).
  * Güldenring and Nalpantidis, (2021) Güldenring, R., Nalpantidis, L., 2021. Self-supervised contrastive learning on agricultural images. Computers and Electronics in Agriculture, 191, 106510.
  * Leenstra et al., (2020) Leenstra, M., Marcos, D., Bovolo, F., Tuia, D., 2020. Self-supervised pre-training enhances change detection in sentinel-2 imagery. _ICPR Workshops_.
  * Lucas et al., (2021) Lucas, B., Pelletier, C., Schmidt, D., Webb, G., Petitjean, F., 2021. A Bayesian-inspired, deep learning-based, semi-supervised domain adaptation technique for land cover mapping. Machine Learning, 1-33.
  * Marszalek, (2021) Marszalek, M., 2021. Crop type and yield data. https://github.com/ESA-PhiLab/WorldCrops. (Accessed on: 30.03.2022).
  * Marszalek et al., (2022) Marszalek, M., Körner, M., Schmidhalter, U., 2022. Prediction of multi-year winter wheat yields at the field level with satellite and climatological data. Computers and Electronics in Agriculture, 194, 106777.
  * Marszalek et al., (2020) Marszalek, M., Lösch, M., Körner, M., Schmidhalter, U., 2020. Early Crop-Type Mapping Under Climate Anomalies. Preprints.
  * Mazzia et al., (2019) Mazzia, V., Khaliq, A., Chiaberge, M., 2019. Improvement in Land Cover and Crop Classification based on Temporal Features Learning from Sentinel-2 Data Using Recurrent-Convolutional Neural Network (R-CNN). Applied Sciences, 10, 238.
  * Nowakowski et al., (2021) Nowakowski, A., Spiller, D., Cremer, N., Bonifacio, R., Marszalek, M., Garcia-Herranz, M., Mathieu, P. P., Kim, D.-H., 2021. Ai opportunities and challenges for crop type mapping using Sentinel-2 and drone data. _2021 IEEE International Geoscience and Remote Sensing Symposium IGARSS_ , 258–261.
  * Nyborg et al., (2022) Nyborg, J., Pelletier, C., Assent, I., 2022. Generalized classification of satellite image time series with thermal positional encoding.
  * Nyborg et al., (2021) Nyborg, J., Pelletier, C., Lefèvre, S., Assent, I., 2021. Timematch: Unsupervised cross-region adaptation by temporal shift estimation.
  * Orynbaikyzy et al., (2022) Orynbaikyzy, A., Gessner, U., Conrad, C., 2022. Spatial Transferability of Random Forest Models for Crop Type Classification Using Sentinel-1 and Sentinel-2. Remote Sensing, 14.
  * Rockström et al., (2020) Rockström, J., Edenhofer, O., Gaertner, J., DeClerck, F., 2020. Planet-proofing the global food system. Nature Food.
  * Rußwurm et al., (2020) Rußwurm, M., Pelletier, C., Zollner, M., Lefèvre, S., Körner, M., 2020\. BreizhCrops: A Time Series Dataset for Crop Type Mapping. International Archives of the Photogrammetry, Remote Sensing and Spatial Information Sciences ISPRS (2020).
  * StMELF, (2020) StMELF, 2020. Bavarian state ministry of food, agriculture and forestry. https://www.stmelf.bayern.de. [Online; accessed 21-July-2020].
  * tsaug, (2020) tsaug, 2020. Time series augmentation. https://github.com/arundo/tsaug. (Accessed on: 28.03.2022).
  * Vaswani et al., (2017) Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L. u., Polosukhin, I., 2017. Attention is all you need. I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, R. Garnett (eds), _Advances in Neural Information Processing Systems_ , 30, Curran Associates, Inc.
  * Waldner and Diakogiannis, (2019) Waldner, F., Diakogiannis, F., 2019. Deep learning on edge: Extracting field boundaries from satellite images with a convolutional neural network.
  * Yang et al., (2019) Yang, Q., Shi, L., Han, J., Zha, Y., Zhu, P., 2019. Deep convolutional neural networks for rice grain yield estimation at the ripening stage using UAV-based remotely sensed images. Field Crops Research, 235, 142-153.
  * Zell et al., (2022) Zell, A., Sumbul, G., Demir, B., 2022. Deep metric learning-based semi-supervised regression with alternate learning.


# FrePGAN: Robust Deepfake Detection Using Frequency-level Perturbations

Yonghyun Jeong1, Doyeon Kim1, Youngmin Ro1, Jongwon Choi2*

###### Abstract

Various deepfake detectors have been proposed, but challenges still exist to
detect images of unknown categories or GAN models outside of the training
settings. Such issues arise from the overfitting issue, which we discover from
our own analysis and the previous studies to originate from the frequency-
level artifacts in generated images. We find that ignoring the frequency-level
artifacts can improve the detector’s generalization across various GAN models,
but it can reduce the model’s performance for the trained GAN models. Thus, we
design a framework to generalize the deepfake detector for both the known and
unseen GAN models. Our framework generates the frequency-level perturbation
maps to make the generated images indistinguishable from the real images. By
updating the deepfake detector along with the training of the perturbation
generator, our model is trained to detect the frequency-level artifacts at the
initial iterations and consider the image-level irregularities at the last
iterations. For experiments, we design new test scenarios varying from the
training settings in GAN models, color manipulations, and object categories.
Numerous experiments validate the state-of-the-art performance of our deepfake
detector.

Figure 1: Various Patterns of Frequency Artifacts. The frequency-level
artifacts can be extracted by averaging the frequency-level spectrum of the
generated images. The appearance of artifacts is evident but uniquely vary by
the type of GAN model or object category. Thus, we can analyze that the
artifacts are easily detected by their evident appearances but can cause
overfitting to the training settings due to their uniqueness. Thus, the
artifacts should be ignored for generalized detection, but they are still
useful for detection of specific GAN models.

## Introduction

The recent rise of Generative Adversarial Networks (GAN) (Goodfellow et al.
2014; Karras et al. 2018; Karras, Laine, and Aila 2019; Karras et al. 2020)
has allowed the easy and extensive generation of highly realistic fake images,
as known as deepfakes. Unfortunately, the risk of malicious abuse of deepfakes
also rises with such an advancement (Nguyen et al. 2019), and the importance
of detecting deepfakes has become crucial. The target range of deepfakes has
broadened from swapping the face of the celebrity on the body of pornography
to spreading misinformation in social media as fake news, and even alluring
victims to transfer money for scams (Tolosana et al. 2020; Nguyen et al.
2019). To solve this issue, the tech giants and the academia have joined
together for ‘Deepfake Detection Challenge’ (Dolhansky et al. 2019, 2020) to
promote the current issues and encourage fellow researchers to tackle this
problem.

As confirmed by several previous studies (Chen et al. 2021), the CNN-based
generative models are known to have limitations in reconstructing the high-
frequency components. However, as shown in Fig. 1, although the frequency-
level artifacts are effective to detect the generated images for the specific
GAN models, it is easy for the detectors to be overfitted to the training
settings, due to the unique appearances of the frequency-level artifacts
varying by the CNN structures and training categories. Thus, it can be
analyzed that the frequency-level artifacts are effective to detect the
generated images from the known GAN models, but the key to the generalization
of deepfake detectors is to reduce the effect of frequency-level artifacts
during training.

††footnotetext: ∗Corresponding author

Based on intuition, we propose a novel framework composed of two modules: the
Frequency Perturbation GAN (FrePGAN) and the deepfake classifier. FrePGAN
contains the frequency-level perturbation generator and the perturbation
discriminator, which cooperate to adversarially generate perturbation maps
added onto both the real and fake images for reduced differences in the
frequency-level. Then, the perturbed images are fed into the deepfake
classifier to distinguish the fake images from the real ones in the pixel-
level. To train the deepfake detector to utilize both the frequency-level
artifacts and the general pixel-level irregularity, we update the frequency-
level perturbation generator and the deepfake classifiers alternatively. To
validate the performance of our model, we conduct numerous experiments using
multiple deepfake datasets. Including the benchmark evaluations, we have
designed three types of distinct test settings using unknown categories,
models, and manipulations unused during training. Our model achieves state-of-
the-art performance in both the known and unseen settings.

Our paper makes the following contributions:

  * •

We develop FrePGAN to generate the frequency-level perturbation maps to ignore
the domain-specific artifacts in fake images.

  * •

The perturbation maps obtained from FrePGAN are added to the given input
images, which can reduce the effect of domain-specific artifacts and improve
the generalization ability of the deepfake detector.

  * •

FrePGAN and the deepfake classifier are updated alternatively to train the
deepfake classifier to consider both the frequency-level artifact and the
general feature.

  * •

Our model achieves superior results compared to the state-of-the-art models
and robust detection performance of generated images in the known and unseen
domains.

## Related Work

The previous work can be categorized into the physiological feature-based,
image-based, and frequency-based detection.

### Physiological Feature-based Detection

With the rise of realistic human deepfakes, most studies focus on the temporal
properties, such as facial features (Agarwal et al. 2019; Matern, Riess, and
Stamminger 2019; Li and Lyu 2019; Montserrat et al. 2020), incoherent head
poses (Yang, Li, and Lyu 2019), and lack of eye-blinking (Li, Chang, and Lyu
2018). (Rossler et al. 2019; Dolhansky et al. 2019; Li et al. 2020) provide
large-scale datasets and evaluate various image forensics for face
manipulations. However, since most of these methods focus on the face only,
they can be ineffective in non-facial domains.

### Image-based Detection

To expand the detection range, some studies take images as input data. Tralic
et al. (Tralic, Petrovic, and Grgic 2012) analyze the inconsistencies in
blocking artifacts generated during JPEG compression (Tralic, Petrovic, and
Grgic 2012). Ferrara et al. (2012) explore the demosaicing artifacts generated
in manipulated images due to a color filter array (Ferrara et al. 2012) but
the artifacts can disappear during resizing. Thus, some focus on the
deviations in lighting conditions to detect manipulations (Carvalho, Farid,
and Kee 2015; Peng et al. 2016). Also, (Bayar and Stamm 2016) suggest learning
the prediction error filters for generalization but it struggles with post-
processing methods used to manipulated regions. Thus, Cozzolino et al.
(Cozzolino et al. 2018) propose an adaptable neural network to new target
domains using a few training samples (Cozzolino et al. 2018). Wang et al.
(Wang et al. 2020) use RGB images to distinguish cross-model manipulations,
such as blurring and JPEG (Wang et al. 2020). Also, (Guarnera, Giudice, and
Battiato 2020) explore the hidden traces by analyzing the last computational
layer to predict real and fake and the most probable technique used. Recently,
Zhao et al. (Zhao et al. 2021)suggests a multi-attention network to attend
different local parts for the artifacts and aggregate the high and low
features for classification (Zhao et al. 2021).

### Frequency-based Detection

Some analyze the spectral traces in the frequency domain, as (Kirchner 2008)
suggests using the frequency artifacts with the variance of prediction
residue. Also, (Huang et al. 2017) employ Fast Fourier Transform (Cooley,
Lewis, and Welch 1969) and singular value decomposition to identify copy-move
manipulations. (Marra et al. 2019) suggest a GAN-specific detection using the
artificial fingerprints in the frequency domain, and (Bappy et al. 2019)
propose a manipulation localization architecture using spatial maps and
frequency domain correlation. Also, (Frank et al. 2020) analyze the frequency
artifacts using Discrete Cosine Transform, while (Zhang, Karaman, and Chang
2019) exploit the artifacts induced by the up-sampler of GANs. Others (Durall,
Keuper, and Keuper 2020; Durall et al. 2019) exploit the spectral distortions
via azimuthal integration, while (Jeong et al. 2021) adopt the bilateral high-
pass filters for generalized detection. Recently, (He et al. 2021) propose to
re-synthesize testing images and extract visual cues for flexible detection.

Figure 2: Overall framework.  Consisted of FrePGAN for generating the
frequency-level perturbations and the deepfake classifier for distinguishing
the real and fake, the framework allows detecting fake images with the
balanced effect of domain-specific frequency-level artifacts and general
image-level irregularity in the generated images.

## Deepfake Detection Framework

We design a generalized deepfake detector containing the Frequency
Perturbation GAN (FrePGAN) and the deepfake classifier. FrePGAN generates the
frequency-level perturbation maps for the deepfake detector to ignore the
frequency-level artifacts. To reduce the effect of the frequency-level
artifacts, both real and fake images are added with the generated perturbation
maps of FrePGAN, respectively. The deepfake classifier is designed to
distinguish between the real and fake images. The visual illustration for the
overall architecture is shown in Fig. 2.

### Training of Deepfake Detection Framework

Though FrePGAN and the deepfake classifier can be trained in a sequence, we
purposefully train both networks in one iteration for comprehensive training
of various properties of the perturbation maps. Also, through the alternating
update, we can enhance the generalization of the deepfake classifier by
expanding the variety of its input data. At the initial updates, FrePGAN fails
to generate the proper perturbation map to ignore the effect of frequency-
level artifacts, so the deepfake classifier is trained to distinguish the fake
images from the real images by using the artifact that is easy to be detected.
On contrary, when FrePGAN is sufficiently trained to generate the perturbation
maps confusing the real and fake images, the deepfake classifier needs to
extract the new feature that works generally across the various types of GAN
models. As a result, the alternating updates can make the deepfake classifier
consider the frequency-level artifacts and the general features
simultaneously.

### Frequency Perturbation GAN

To train FrePGAN, we build a novel architecture composed of two major parts:
the perturbation map generator trained by the perturbation generation losses,
and the perturbation discriminator. The input of FrePGAN is an image
$x\in\mathbb{R}^{w\times h\times c}$ where $w$, $h$, and $c$ present its
width, height, and number of channels, respectively. Each and every input
image is labeled by $y$ either as real ($y=0$) or generated ($y=1$),
representing either actually captured in the real world or generated by GAN.
We define the real and generated images as $x_{r}\equiv x_{y=0}$ and
$x_{f}\equiv x_{y=1}$ respectively, and thus $x$ would be one of $x_{r}$ or
$x_{f}$. The perturbation map generator and the perturbation discriminator are
denoted as $G(\bullet)$ and $D(\bullet)$, respectively.

Figure 3: Comparison in power spectra of real and fake data We average the
power spectrum from (a) the entire training data and (b) the generated data,
respectively. For every GAN model of the graph, the fake images suffer from
the dramatic increment of the high-frequency components.

#### Perturbation Map Generator

As in Fig. 3, the real and fake images can be easily distinguished when
transformed into the frequency domain. Also, it can be observed that the
frequency-level artifacts mainly locate at the high-frequency components.
Thus, by adding the frequency-level perturbations, we can reduce the effect of
domain-specific artifacts.

To ignore the frequency-level artifacts, the perturbation should be generated
in the frequency domain as well. Thus, we utilize the frequency map
transformed from the original image as the input of the perturbation map
generator. The perturbation map generator contains three modules: frequency-
level transformer, frequency-level generator, and the inverse frequency-level
transformer.

First, the frequency-level transformer converts the input image into the
frequency map by employing Fast Fourier Transform (FFT) (Cooley, Lewis, and
Welch 1969), as denoted by $\widetilde{x}=\mathcal{F}(x)$ where
$\widetilde{x}\in\mathbb{R}^{w\times h\times 2c}$ is the frequency map
transformed from $x$ and $\mathcal{F}(\bullet)$ represents the operation of
FFT. The number of channels of $\widetilde{x}$ becomes doubled because each
image channel is separated into two channels for the real and imaginary parts
of the frequency-map.

Then, the frequency-level generator receives $\widetilde{x}$ to generate a
frequency map with the same size of $\widetilde{x}$. The scheme of the
generator is similar to those of image-to-image translation GANs (Isola et al.
2017; Zhu et al. 2017; Kim et al. 2017; Choi et al. 2018, 2020; Liu et al.
2019), which contain the encoder and decoder. Thus, when the frequency-level
generator is denoted by $H$, and $\mathbf{\widetilde{z}}=H(\widetilde{x})$
where $\mathbf{\widetilde{z}}\in\mathbb{R}^{w\times h\times 2c}$ is the output
from the frequency-level generator.

Lastly, the generated map $\mathbf{\widetilde{z}}$ is transformed into a
pixel-level perturbation map. The overall operation of the perturbation map
generator is derived with a given input of $x$ as:

$\displaystyle G(x)=\mathcal{F}^{-1}(H(\mathcal{F}(x))),$ (1)

where $\mathcal{F}^{-1}(\bullet)$ means the inverse FFT operation. We need to
remark that the final output from the perturbation map generator is shaped by
$G(x)\in\mathbb{R}^{w\times h\times c}$, which is shaped by the same size of
input $x\in\mathbb{R}^{w\times h\times c}$.

#### Perturbation Discriminator

To enhance the effect of the generated perturbation maps, we add the
perturbation discriminator to adversarially train the perturbation map
generator. The overall architecture follows the conventional GAN discriminator
(Radford, Metz, and Chintala 2015) that down-samples the input features by the
consecutive convolution layers and performs binary classification at the last
convolution layer. By the last fully connected layer, the perturbation
discriminator distinguishes the output of the perturbation map generator from
the original image. Thus, for an input of $x$, the target prediction of the
perturbation discriminator is a probability that can be represented by
$D(x_{r})=0$ and $D(G(x))=1$.

#### Training of FrePGAN

The two compositions of FrePGAN are adversarially trained to generate the
perturbation maps from the input images. Thus, when real images are given to
FrePGAN, the empty perturbation maps should be ideally acquired after the
generator, due to the absence of frequency-level artifacts. In contrast, when
the perturbation maps are added to the fake images, the distribution of the
added images should be difficult to distinguish from that of real images.

At every iteration, two training steps alternate, updating the perturbation
map generator and the perturbation discriminator, respectively. The
perturbation map generator is updated by minimizing the perturbation
generation loss ($\mathcal{L}_{G}$) while trying to maximize the discriminator
loss ($\mathcal{L}_{D}$) for the update of the perturbation discriminator.
Thus, the overall training of FrePGAN can be defined as:

$\displaystyle\widehat{G},\widehat{D}=\arg_{G,D}\min_{G}\max_{D}\mathcal{L}_{G}+\mathcal{L}_{D}.$
(2)

$\mathcal{L}_{G}$ has the generative adversarial loss ($\mathcal{L}_{adv}$)
and the compression loss ($\mathcal{L}_{com}$) to compress the magnitude of
perturbation maps. At every mini-batch update, $G$ is first updated to
minimize the following loss:

$\mathcal{L}_{G}=\lambda\mathcal{L}_{adv}+(1-\lambda)\mathcal{L}_{com},$ (3)

where $\lambda$ is a hyperparameter to tune the scales of $\mathcal{L}_{adv}$
and $\mathcal{L}_{com}$. In this work, we use $\lambda=0.5$.

We employ $\mathcal{L}_{adv}$ for the perturbation map generator to generate
the perturbation maps added to the images to be indistinguishable from the
real images by the perturbation discriminator. Since $x_{f}$ is also the
sample generated from other GAN models, $x_{f}$ is improper to be considered
as the real sample for the adversarial training of FrePGAN. Thus,

$\displaystyle\mathcal{L}_{adv}=\mathbb{E}_{x\sim\mathbf{X}}[\log\left(1-D\left(G\left(x\right)\right)\right)],$
(4)

where $\mathbf{X}$ represents the batch sets of images.

If only the generative adversarial loss is considered during training, FrePGAN
would not be able to preserve even the distribution of real images by adding a
large magnitude of perturbation maps. Since the purpose of employing FrePGAN
is to obtain a similar distribution of real images, we additionally include
the compression loss $\mathcal{L}_{com}$ in the perturbation generation loss.
Thus,

$\mathcal{L}_{com}=\mathbb{E}_{x\sim\mathbf{X}}\left[\left\|G(x)\right\|_{2}^{2}\right]$
(5)

According to the adversarial training, the perturbation discriminator is
trained to distinguish the images reconstructed by the perturbation map
generator ($G(x)$) from the real images ($x_{r}$). Thus, $\mathcal{L}_{D}$ can
be defined as:

$\displaystyle\mathcal{L}_{D}=\mathbb{E}_{x_{r}\sim\mathbf{X}_{r}}[\log\left(D\left(x_{r}\right)\right)]+\mathbb{E}_{x\sim\mathbf{X}}[\log\left(1-D\left(x+G\left(x\right)\right)\right)].$
(6)

As a result, by alternating the generative adversarial loss and the
discriminator loss, the perturbation map generator can generate high-quality
perturbation maps.

### Deepfake Classifier

The deepfake classifier is a network to distinguish whether the input image is
the generated fake one or not. Thus, the overall framework of the deepfake
classifier is a conventional classification network using ResNet-50 (Li and
Lyu 2019) to predict the binary label for deepfake detection (Frank et al.
2020; Wang et al. 2020). We denote the deepfake classifier as $C(\bullet)$.

#### Input of Deepfake Classifier

Since the deepfake classifier detects the presence of the informative features
upon the frequency-level artifacts in the input image, the images with the
generated perturbation maps should be inserted into the deepfake classifier
instead of the raw images. The input image of the deepfake classifier is
defined as:

$A_{G}(x)=x+G(x).$ (7)

Algorithm 1 Training the deepfake detection model

$G,D\leftarrow$ random initial parameters

$C\leftarrow$ pre-trained parameters

$epoch=0$

repeat

$(\mathbf{X},\mathbf{Y})\leftarrow$ batch sampled from dataset

//Forward Propagation

Estimate $\mathcal{L}_{adv}$, $\mathcal{L}_{com}$, $\mathcal{L}_{D}$,
$\mathcal{L}_{C}$ by Eq. 4, 5, 6, 8

//Update parameters according to gradients

Update $G$ by $\arg_{G}\min_{G}\mathcal{L}_{G}$

Update $D$ by $\arg_{D}\max_{D}\mathcal{L}_{D}$

Update $C$ by $\arg_{C}\min_{C}\mathcal{L}_{C}$

if No remaining data then

$epoch\leftarrow epoch+1$

end if

until $epoch=20$

Model | Original | Hue | Brightness | Saturation | Gamma | Contrast | Blur | Rotation
---|---|---|---|---|---|---|---|---
Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P.
Wang(2020) | 99.9 | 100. | 73.9 | 81.3 | 61.8 | 74.7 | 74.3 | 84.4 | 70.2 | 83.2 | 66.6 | 79.7 | 45.3 | 49.1 | 71.3 | 80.4
Frank (2020) | 99.6 | 99.4 | 85.5 | 97.2 | 84.2 | 97.2 | 91.2 | 98.0 | 85.4 | 97.4 | 84.3 | 96.7 | 53.8 | 90.3 | 99.6 | 99.4
Durall (2020) | 99.7 | 99.3 | 98.6 | 97.9 | 93.6 | 88.8 | 98.6 | 97.9 | 97.2 | 95.3 | 94.8 | 91.0 | 50.0 | 53.2 | 98.4 | 97.6
Jeong (2021) | 99.8 | 100. | 85.0 | 92.6 | 89.9 | 90.8 | 96.9 | 99.6 | 99.7 | 100. | 90.8 | 91.6 | 67.1 | 99.2 | 99.0 | 100.
Ours | 100. | 100. | 95.0 | 99.7 | 99.5 |  100. | 100. | 100. | 85.5 | 98.6 | 98.8 | 100. | 98.5 | 98.5 | 100. | 100.
Table 1: Comparison of cross-manipulation performance.

Training | Resolutions
---|---
Model | $1024\times 1024$ | $512\times 512$ | $256\times 256$ | $128\times 128$ | $64\times 64$
Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | AP. | Acc. | A.P.
Wang (2020) | 99.9 | 100. | 97.6 | 97.3 | 66.1 | 74.4 | 62.6 | 69.4 | 50.4 | 54.9
Frank (2020) | 99.6 | 99.4 | 92.2 | 90.2 | 90.5 | 86.0 | 91.3 | 86.9 | 89.7 | 85.1
Durall (2020) | 99.7 | 99.3 | 85.1 | 79.0 | 80.0 | 73.7 | 77.2 | 70.9 | 77.9 | 71.7
Jeong (2021) | 99.8 | 100. | 97.9 | 99.9 | 97.8 | 99.8 | 89.4 | 96.9 | 59.7 | 62.2
Ours | 100. | 100. | 100. | 100. | 100. | 100. | 98.0 | 99.9 | 95.9 | 99.4

Table 2: Testing results with variance in resolutions. Figure 4: Comparison of
performance in unknown categories.

#### Training of Deepfake Classifier

The training loss of the deepfake classifier is built by the cross-entropy
loss as:

$\displaystyle\mathcal{L}_{C}=\mathbb{E}_{(x,y)\sim(\mathbf{X},\mathbf{Y})}$
$\displaystyle\big{[}y\log{(C(A_{G}(x)))}$ (8)
$\displaystyle+(1-y)\log{(1-C(A_{G}(x)))}\big{]},$

where $\mathbf{Y}$ is the set of real and fake labels paired with the
respective samples of $\mathbf{X}$. Then, the deepfake classifier can be
trained as follows: $\widehat{C}=\arg_{C}\min_{C}\mathcal{L}_{C}$. The
training procedure of our overall framework is presented in Algorithm 1.

### Deepfake Image Prediction

After the training of our overall framework, we predict whether the new test
image is labeled as real or fake by utilizing the perturbation map generator
of FrePGAN ($\widehat{G}$) and the deepfake classifier ($\widehat{C}$). For
the new test image $x^{\prime}$, we acquire the perturbed images by estimating
$A_{\widehat{G}}(x^{\prime})=x^{\prime}+\widehat{G}(x^{\prime})$. Then,
$A_{\widehat{G}}(x^{\prime})$ is fed into the deepfake classifier, which
results in the final prediction as:
$\widehat{C}(A_{\widehat{G}}(x^{\prime}))$.

### Implementation Details

We employ the architecture of VGG model (Simonyan and Zisserman 2014) for the
perturbation map generator and the discriminator of DCGAN (Radford, Metz, and
Chintala 2015) for the perturbation discriminator. In addition, we utilize
ResNet (Li and Lyu 2019) pre-trained by ImageNet (Russakovsky et al. 2015) for
the deepfake classifier. We use Adam (Kingma and Ba 2014) to train the
perturbation map generator and the perturbation discriminator with the
learning rate of $10^{-4}$ and $10^{-1}$, respectively. Also, the deepfake
classifier is trained by Adam (Kingma and Ba 2014) with the learning rate of
$10^{-4}$. The batch size of the optimizer is always set to $16$, and the
input image size is resized to $256\times 256$ when the image sizes vary. The
number of epochs is set to $20$.

Model | Training settings | Test Models |  |
---|---|---|---|---
Input | # class | ProGAN | StyleGAN | StyleGAN2 | BigGAN | CycleGAN | StarGAN | GauGAN | Deepfake | Mean
Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P. | Acc. | A.P.
Wang (2020) | Image | 1 | 50.4 | 63.8 | 50.4 | 79.3 | 68.2 | 94.7 | 50.2 | 61.3 | 50.0 | 52.9 | 50.0 | 48.2 | 50.3 | 67.6 | 50.1 | 51.5 | 52.5 | 64.9
Frank (2020) | Freq | 1 | 78.9 | 77.9 | 69.4 | 64.8 | 67.4 | 64.0 | 62.3 | 58.6 | 67.4 | 65.4 | 60.5 | 59.5 | 67.5 | 69.1 | 52.4 | 47.3 | 65.7 | 63.3
Durall (2020) | Freq | 1 | 85.1 | 79.5 | 59.2 | 55.2 | 70.4 | 63.8 | 57.0 | 53.9 | 66.7 | 61.4 | 99.8 | 99.6 | 58.7 | 54.8 | 53.0 | 51.9 | 68.7 | 65.0
Jeong (2021) | Freq | 1 | 82.5 | 81.4 | 68.0 | 62.8 | 68.8 | 63.6 | 67.0 | 62.5 | 75.5 | 74.2 | 90.1 | 90.1 | 73.6 | 92.1 | 51.6 | 49.9 | 72.1 | 72.1
Our | Image | 1 | 95.5 | 99.4 | 80.6 | 90.6 | 77.4 | 93.0 | 63.5 | 60.5 | 59.4 | 59.9 | 99.6 | 100. | 53.0 | 49.1 | 70.4 | 81.5 | 74.9 | 79.3
Wang (2020) | Image | 2 | 64.6 | 92.7 | 52.8 | 82.8 | 75.7 | 96.6 | 51.6 | 70.5 | 58.6 | 81.5 | 51.2 | 74.3 | 53.6 | 86.6 | 50.6 | 51.5 | 57.3 | 79.6
Frank (2020) | Freq | 2 | 85.7 | 81.3 | 73.1 | 68.5 | 75.0 | 70.9 | 76.9 | 70.8 | 86.5 | 80.8 | 85.0 | 77.0 | 67.3 | 65.3 | 50.1 | 55.3 | 75.0 | 71.2
Durall (2020) | Freq | 2 | 79.0 | 73.9 | 63.6 | 58.8 | 67.3 | 62.1 | 69.5 | 62.9 | 65.4 | 60.8 | 99.4 | 99.4 | 67.0 | 63.0 | 50.5 | 50.2 | 70.2 | 66.4
Jeong (2021) | Freq | 2 | 87.4 | 87.4 | 71.6 | 74.1 | 77.0 | 81.1 | 82.6 | 80.6 | 86.0 | 86.6 | 93.8 | 80.8 | 75.3 | 88.2 | 53.7 | 54.0 | 78.4 | 79.1
Our | Image | 2 | 99.0 | 99.9 | 80.8 | 92.0 | 72.2 | 94.0 | 66.0 | 61.8 | 69.1 | 70.3 | 98.5 | 100. | 53.1 | 51.0 | 62.2 | 80.6 | 75.1 | 81.2
Wang(2020) | Image | 4 | 91.4 | 99.4 | 63.8 | 91.4 | 76.4 | 97.5 | 52.9 | 73.3 | 72.7 | 88.6 | 63.8 | 90.8 | 63.9 | 92.2 | 51.7 | 62.3 | 67.1 | 86.9
Frank (2020) | Freq | 4 | 90.3 | 85.2 | 74.5 | 72.0 | 73.1 | 71.4 | 88.7 | 86.0 | 75.5 | 71.2 | 99.5 | 99.5 | 69.2 | 77.4 | 60.7 | 49.1 | 78.9 | 76.5
Durall (2020) | Freq | 4 | 81.1 | 74.4 | 54.4 | 52.6 | 66.8 | 62.0 | 60.1 | 56.3 | 69.0 | 64.0 | 98.1 | 98.1 | 61.9 | 57.4 | 50.2 | 50.0 | 67.7 | 64.4
Jeong (2021) | Freq | 4 | 90.7 | 86.2 | 76.9 | 75.1 | 76.2 | 74.7 | 84.9 | 81.7 | 81.9 | 78.9 | 94.4 | 94.4 | 69.5 | 78.1 | 54.4 | 54.6 | 78.6 | 77.9
Our | Image | 4 | 99.0 | 99.9 | 80.7 | 89.6 | 84.1 | 98.6 | 69.2 | 71.1 | 71.1 | 74.4 | 99.9 | 100. | 60.3 | 71.7 | 70.9 | 91.9 | 79.4 | 87.2

Table 3: Comparison of cross-model performance. Ablation settings | Self | Category | Model | Manipulation | Mean
---|---|---|---|---|---
Generator | $L_{com}$ | $L_{adv}$ | Acc. | A.P. | mAcc. | mA.P. | mAcc. | mA.P. | mAcc. | mA.P. | Acc. | A.P.
Freq |  | ✓ | 99.0 | 100. | 90.9 | 98.2 | 69.4 | 76.1 | 90.9 | 98.4 | 87.6 | 93.2
Freq | ✓ |  | 100. | 100. | 91.0 | 98.5 | 67.3 | 74.4 | 91.3 | 99.1 | 87.4 | 93.0
Img | ✓ | ✓ | 99.8 | 100. | 92.9 | 99.2 | 68.7 | 77.4 | 92.4 | 99.6 | 88.5 | 94.1
Freq | ✓ | ✓ | 100. | 100. | 95.5 | 99.4 | 74.9 | 79.3 | 96.8 | 99.5 | 91.8 | 94.6
Table 4: Ablation Test with Various Settings.

## Experimental Results

We conduct experiments to confirm the performance of the deepfake detector in
the known domain and unseen domain.

### Dataset

We conduct experiments based on the same trainset and testset of the
experimental data of Wang et al. (Wang et al. 2020). The trainset contains 20
objects of Progan (Karras et al. 2018). The testset consists of FFHQ (Karras,
Laine, and Aila 2019) and LSUN (Yu et al. 2015) to train ProGAN (Karras et al.
2018), StyleGAN (Karras, Laine, and Aila 2019), and StyleGAN2 (Karras et al.
2020), and employs Imagenet (Russakovsky et al. 2015) to train BigGAN (Brock,
Donahue, and Simonyan 2019) and CycleGAN (Zhu et al. 2017). Also, we use
CelebA (Liu et al. 2015) for training StarGAN (Choi et al. 2018), and COCO
(Lin et al. 2014) for training GauGAN (Park et al. 2019). Lastly, we utilize
Deepfake dataset (Rossler et al. 2019), which is a combination of various
videos collected online with partially generated images reconstructed by face-
swapping models.

Also, to test the model’s performance in various manipulation techniques and
resizing, we employ the face data of ProGAN (Karras et al. 2018) dataset in
$1,024\times 1,024$ resolution. For the experiments with unknown categories
and unknown models, we utilize the horse data of ProGAN (Karras et al. 2018)
dataset in $256\times 256$ resolution.

### Deepfake Detection Performance

The deepfake detection performance is tested by the four types of experiments:
manipulated face images, resized face images, unseen categories, and unseen
models. We utilize two evaluation metrics of the average precision score
(A.P.) and accuracy (Acc.) as represented by (Wang et al. 2020; Durall,
Keuper, and Keuper 2020; Frank et al. 2020). To validate the effectiveness of
the proposed deepfake detector, we select the image-based (Wang et al. 2020)
and frequency-based state-of-the-art models (Frank et al. 2020; Durall,
Keuper, and Keuper 2020; Jeong et al. 2021) for comparison.

#### Deepfake Detection of Manipulated Face Images

We conduct various image manipulation experiments using the face data of
ProGAN (Karras et al. 2018) in $1,024\times 1,024$ resolution. To test the
performance with unknown manipulations, we add 7 various changes in images,
such as adjusting the hue, brightness, saturation, gamma, contrast,
blurriness, and image rotation. As shown in Table 1, ours is the most robust
model achieving superior performance in image manipulation experiments.

#### Deepfake Detection of Resized Face Images

To test the model with the previous detectors’ chronic issue of significant
performance decline with resizing, we conduct experiments with the face data
of ProGAN (Karras et al. 2018) dataset by gradually reducing the image sizes
with five different resolutions from $1,024\times 1,024$ to $64\times 64$.
Based on the experimental results of the resizing performance of the models as
shown in Table 2, we can confirm that our model outperforms all other models
when tested with the five cases of resized resolutions. Furthermore, even when
the image resolution is reduced, our model maintains 100% performance from
$1,024\times 1,024$ to $256\times 256$. When reduced to $128\times 128$ and
$64\times 64$, our model’s performance slightly declines but maintains at
least 97.8%, proving the best performance compared to the existing model.

#### Deepfake Detection of Unknown Categories

As shown in Figure 4, we conduct various experiments using the three
classifiers to analyze the performance of the models with 20 unknown
categories. We compare our model’s performance to the previous state-of-the-
art models (Wang et al. 2020; Durall, Keuper, and Keuper 2020; Frank et al.
2020). The experimental results verify that ours is the most robust model in
all categories, even when the number of training classes increases and the
type of inputs varies. The variety in the testing environment shows that each
component in our model plays an important role to detect not only the test
category but also all categories.

#### Deepfake Detection of Unknown GAN Models

To expand the testing scope, we compare the performance of our model with 8
different generative models, including ProGAN (Karras et al. 2018), StyleGAN
(Karras, Laine, and Aila 2019), StyleGAN2 (Karras et al. 2020), BigGAN (Brock,
Donahue, and Simonyan 2019), CycleGAN (Zhu et al. 2017), StarGAN (Choi et al.
2018), GauGAN (Park et al. 2019), and Deepfake (Rossler et al. 2019). As shown
in Table 3, we make changes to the training settings and conduct experiments
to detect the GAN models. First, we train the models with one type of category
and test with all GAN models. Then, to add variety, we increase the number of
training categories to two and four. Interestingly, even when trained with
only one type of category, our model achieves excellent performance similar to
the case when trained with four classes. The results show that ours achieves
the highest performance in both Acc. and A.P in ProGAN (Karras et al. 2018),
StyleGAN (Karras, Laine, and Aila 2019), GauGAN (Park et al. 2019), and
Deepfake (Rossler et al. 2019). Also, in StyleGAN2 (Karras et al. 2020),
BigGAN (Brock, Donahue, and Simonyan 2019), CycleGAN (Zhu et al. 2017), and
StarGAN (Choi et al. 2018), our model achieves the best performance in either
Acc. or A.P. Our performance rises with the number of training categories,
even when tested with the partially generated images in Deepfake dataset.

Figure 5: Addition of Perturbation Maps. (a) shows the averaged power spectrum
of real and fake images, respectively. (b) compares the averaged power
spectrum of real with that of fake. While the real and fake images can be
distinguished by the high-frequency components in the power spectrum, the
difference is nearly removed after the addition of the generated perturbation
maps. Figure 6: Effect of Perturbation Map. With the compression loss, the
magnitude of perturbation maps is negligent in the pixel-level domain as shown
in (b). However, the perturbation map increments the high-frequency components
as shown in (c).

### Ablation Study

To validate the effectiveness of the components in the proposed framework, we
also test several variants. We modify four settings of the proposed framework,
which include the composition of the perturbation generation loss and the data
input types of the generator of FrePGAN. The training dataset for the ablation
tests is the horse images generated by ProGAN (Karras et al. 2018). The
testing environments for cross-category and cross-model experiments are the
same as the previous section, and the manipulation experiment is conducted by
manipulating the horse test images with the same methods of cross-manipulation
experiments.

The results of the ablation tests are provided in Table 4. The best
performance of $(91.8,~{}94.6)$ can be obtained by utilizing the entire
framework with the frequency-level generator, the adversarial learning
mechanism, and the compression loss. Interestingly, the simultaneous usage of
the compression loss and the adversarial loss makes synergy to improve the
generalization of deepfake classifier. This result shows that the quality of
perturbation is important for the overall performance. Also, when we replace
our frequency-level generator with the pixel-level generator without the
frequency transformers, the performance drops by far due to the limited
quality of the generated perturbation maps.

### Visualization of Perturbation Maps

To visualize the effect of the perturbation maps, we conduct two experiments.
First, as shown in Fig. 5, we obtain the power spectra of real and fake
images. Then, due to the frequency-level artifacts, the high-frequency
components of real and fake become distinct to distinguish between them.
However, after adding the perturbation maps, the difference is reduced by far
in the power spectra, which validates that the proposed framework successfully
generates high-quality perturbation maps to make the real and fake similar.

Second, as shown in Fig. 6, from one real image, we obtain both the 1D and 2D
power spectrum. Interestingly, even after the addition of perturbation maps,
the pixel-level image and its 2D power spectrum are almost preserved. However,
when we estimate the 1D power spectrum, we can find that the high-frequency
components are magnified, which results in the 1D power spectrum similar to
that of fake images containing the frequency-level artifacts.

## Conclusion

It has become highly important to develop a robust, generalized deepfake
detector, which is not limited to the training settings. Numerous experiments
validate that our framework achieves a generalized detection robust in various
testing scenarios including the unknown categories, GAN models, manipulations,
and resizing. Trained with the perturbation generation loss and compression
loss, our newly proposed FrePGAN generates perturbations to reduce the effects
of domain-specific artifacts in generated images. Also, our framework shows
the effectiveness of the alternate updates of the deepfake classifier and the
perturbation generator, which is validated to be helpful for the improved
generalization of deepfake detectors.

## Acknowledgment

This work was supported by Samsung SDS and Institute of Information &
communications Technology Planning & Evaluation (IITP) grant funded by the
Korea government(MSIT) (2021-0-01341, Artificial Intelligence Graduate School
Program(Chung-Ang University); 2021-0-01778, Development of Human Image
Synthesis and Discrimination Technology Below the Perceptual Threshold;
2021-0-02067, Next Generation AI for Multi-purpose Video Search).

## References

  * Agarwal et al. (2019) Agarwal, S.; Farid, H.; Gu, Y.; He, M.; Nagano, K.; and Li, H. 2019.  Protecting World Leaders Against Deep Fakes.  In _CVPR Workshops_.
  * Bappy et al. (2019) Bappy, J. H.; Simons, C.; Nataraj, L.; Manjunath, B.; and Roy-Chowdhury, A. K. 2019\.  Hybrid lstm and encoder–decoder architecture for detection of image forgeries.  _IEEE TIP_.
  * Bayar and Stamm (2016) Bayar, B.; and Stamm, M. C. 2016.  A deep learning approach to universal image manipulation detection using a new convolutional layer.  In _ACM Workshop on Information Hiding and Multimedia Security_.
  * Brock, Donahue, and Simonyan (2019) Brock, A.; Donahue, J.; and Simonyan, K. 2019.  Large Scale GAN Training for High Fidelity Natural Image Synthesis.  In _ICLR_.
  * Carvalho, Farid, and Kee (2015) Carvalho, T.; Farid, H.; and Kee, E. R. 2015.  Exposing photo manipulation from user-guided 3d lighting analysis.  In _Media Watermarking, Security, and Forensics 2015_. International Society for Optics and Photonics.
  * Chen et al. (2021) Chen, Y.; Li, G.; Jin, C.; Liu, S.; and Li, T. 2021.  SSD-GAN: Measuring the Realness in the Spatial and Spectral Domains.  In _AAAI_.
  * Choi et al. (2018) Choi, Y.; Choi, M.; Kim, M.; Ha, J.-W.; Kim, S.; and Choo, J. 2018.  StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translation.  In _CVPR_.
  * Choi et al. (2020) Choi, Y.; Uh, Y.; Yoo, J.; and Ha, J.-W. 2020.  StarGAN v2: Diverse Image Synthesis for Multiple Domains.  In _CVPR_.
  * Cooley, Lewis, and Welch (1969) Cooley, J. W.; Lewis, P. A.; and Welch, P. D. 1969.  The fast fourier transform and its applications.  _IEEE Transactions on Education_.
  * Cozzolino et al. (2018) Cozzolino, D.; Thies, J.; Rössler, A.; Riess, C.; Nießner, M.; and Verdoliva, L. 2018.  ForensicTransfer: Weakly-supervised Domain Adaptation for Forgery Detection.  _arXiv_.
  * Dolhansky et al. (2020) Dolhansky, B.; Bitton, J.; Pflaum, B.; Lu, J.; Howes, R.; Wang, M.; and Ferrer, C. C. 2020.  The DeepFake Detection Challenge Dataset.  _arXiv preprint arXiv:2006.07397_.
  * Dolhansky et al. (2019) Dolhansky, B.; Howes, R.; Pflaum, B.; Baram, N.; and Ferrer, C. C. 2019.  The Deepfake Detection Challenge (DFDC) Preview Dataset.  _arXiv preprint arXiv:1910.08854_.
  * Durall, Keuper, and Keuper (2020) Durall, R.; Keuper, M.; and Keuper, J. 2020.  Watch your Up-Convolution: CNN Based Generative Deep Neural Networks are Failing to Reproduce Spectral Distributions.  In _CVPR_.
  * Durall et al. (2019) Durall, R.; Keuper, M.; Pfreundt, F.-J.; and Keuper, J. 2019.  Unmasking DeepFakes with simple Features.  _arXiv preprint arXiv:1911.00686_.
  * Ferrara et al. (2012) Ferrara, P.; Bianchi, T.; De Rosa, A.; and Piva, A. 2012.  Image forgery localization via fine-grained analysis of CFA artifacts.  _IEEE Transactions on Information Forensics and Security_ , 7(5): 1566–1577.
  * Frank et al. (2020) Frank, J.; Eisenhofer, T.; Schönherr, L.; Fischer, A.; Kolossa, D.; and Holz, T. 2020.  Leveraging Frequency Analysis for Deep Fake Image Recognition.
  * Goodfellow et al. (2014) Goodfellow, I.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y. 2014.  Generative adversarial nets.  In _NeurIPS_.
  * Guarnera, Giudice, and Battiato (2020) Guarnera, L.; Giudice, O.; and Battiato, S. 2020.  Deepfake detection by analyzing convolutional traces.  In _CVPR Workshops_.
  * He et al. (2021) He, Y.; Yu, N.; Keuper, M.; and Fritz, M. 2021.  Beyond the Spectrum: Detecting Deepfakes via Re-Synthesis.  _arXiv preprint arXiv:2105.14376_.
  * Huang et al. (2017) Huang, D.-Y.; Huang, C.-N.; Hu, W.-C.; and Chou, C.-H. 2017.  Robustness of copy-move forgery detection under high JPEG compression artifacts.  _Multimedia Tools and Applications_.
  * Isola et al. (2017) Isola, P.; Zhu, J.-Y.; Zhou, T.; and Efros, A. A. 2017.  Image-to-image translation with conditional adversarial networks.  In _CVPR_.
  * Jeong et al. (2021) Jeong, Y.; Kim, D.; Min, S.; Joe, S.; Gwon, Y.; and Choi, J. 2021.  BiHPF: Bilateral High-Pass Filters for Robust Deepfake Detection.  _arXiv preprint arXiv:2109.00911_.
  * Karras et al. (2018) Karras, T.; Aila, T.; Laine, S.; and Lehtinen, J. 2018.  Progressive Growing of GANs for Improved Quality, Stability, and Variation.  In _ICLR_.
  * Karras, Laine, and Aila (2019) Karras, T.; Laine, S.; and Aila, T. 2019.  A style-based generator architecture for generative adversarial networks.  In _CVPR_.
  * Karras et al. (2020) Karras, T.; Laine, S.; Aittala, M.; Hellsten, J.; Lehtinen, J.; and Aila, T. 2020\.  Analyzing and Improving the Image Quality of StyleGAN.  _CVPR_.
  * Kim et al. (2017) Kim, T.; Cha, M.; Kim, H.; Lee, J. K.; and Kim, J. 2017.  Learning to discover cross-domain relations with generative adversarial networks.  In _ICML_.
  * Kingma and Ba (2014) Kingma, D.; and Ba, J. 2014.  Adam: A Method for Stochastic Optimization.  _ICLR_.
  * Kirchner (2008) Kirchner, M. 2008.  Fast and reliable resampling detection by spectral analysis of fixed linear predictor residue.  In _ACM workshop on Multimedia and security_.
  * Li, Chang, and Lyu (2018) Li, Y.; Chang, M.; and Lyu, S. 2018.  In Ictu Oculi: Exposing AI Created Fake Videos by Detecting Eye Blinking.  In _WIFS_.
  * Li and Lyu (2019) Li, Y.; and Lyu, S. 2019.  Exposing DeepFake Videos By Detecting Face Warping Artifacts.  In _CVPR Workshops_.
  * Li et al. (2020) Li, Y.; Sun, P.; Qi, H.; and Lyu, S. 2020.  Celeb-DF: A Large-scale Challenging Dataset for DeepFake Forensics.  In _CVPR_.
  * Lin et al. (2014) Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Dollár, P.; and Zitnick, C. L. 2014.  Microsoft coco: Common objects in context.  In _ECCV_.
  * Liu et al. (2019) Liu, M.-Y.; Huang, X.; Mallya, A.; Karras, T.; Aila, T.; Lehtinen, J.; and Kautz, J. 2019.  Few-shot unsupervised image-to-image translation.  In _ICCV_.
  * Liu et al. (2015) Liu, Z.; Luo, P.; Wang, X.; and Tang, X. 2015.  Deep Learning Face Attributes in the Wild.  In _ICCV_.
  * Marra et al. (2019) Marra, F.; Gragnaniello, D.; Verdoliva, L.; and Poggi, G. 2019.  Do gans leave artificial fingerprints?  In _CMIPR_. IEEE.
  * Matern, Riess, and Stamminger (2019) Matern, F.; Riess, C.; and Stamminger, M. 2019.  Exploiting visual artifacts to expose deepfakes and face manipulations.  In _IWACV Workshops_. IEEE.
  * Montserrat et al. (2020) Montserrat, D. M.; Hao, H.; Yarlagadda, S.; Baireddy, S.; Shao, R.; Horváth, J.; Bartusiak, E.; Yang, J.; Güera, D.; Zhu, F.; et al. 2020\.  Deepfakes Detection with Automatic Face Weighting.  _arXiv preprint arXiv:2004.12027_.
  * Nguyen et al. (2019) Nguyen, T. T.; Nguyen, C. M.; Nguyen, D. T.; Nguyen, D. T.; and Nahavandi, S. 2019\.  Deep Learning for Deepfakes Creation and Detection.  _arXiv preprint arXiv:1909.11573_.
  * Park et al. (2019) Park, T.; Liu, M.-Y.; Wang, T.-C.; and Zhu, J.-Y. 2019.  Semantic image synthesis with spatially-adaptive normalization.  In _CVPR_.
  * Peng et al. (2016) Peng, B.; Wang, W.; Dong, J.; and Tan, T. 2016.  Optimized 3D lighting environment estimation for image forgery detection.  _IEEE Transactions on Information Forensics and Security_ , 479–494.
  * Radford, Metz, and Chintala (2015) Radford, A.; Metz, L.; and Chintala, S. 2015.  Unsupervised representation learning with deep convolutional generative adversarial networks.  _arXiv preprint arXiv:1511.06434_.
  * Rossler et al. (2019) Rossler, A.; Cozzolino, D.; Verdoliva, L.; Riess, C.; Thies, J.; and Nießner, M. 2019.  Faceforensics++: Learning to detect manipulated facial images.  In _ICCV_.
  * Russakovsky et al. (2015) Russakovsky, O.; Deng, J.; Su, H.; Krause, J.; Satheesh, S.; Ma, S.; Huang, Z.; Karpathy, A.; Khosla, A.; Bernstein, M.; Berg, A. C.; and Fei-Fei, L. 2015.  ImageNet Large Scale Visual Recognition Challenge.  _IJCV_.
  * Simonyan and Zisserman (2014) Simonyan, K.; and Zisserman, A. 2014.  Very deep convolutional networks for large-scale image recognition.  _arXiv preprint arXiv:1409.1556_.
  * Tolosana et al. (2020) Tolosana, R.; Vera-Rodriguez, R.; Fierrez, J.; Morales, A.; and Ortega-Garcia, J. 2020.  Deepfakes and beyond: A survey of face manipulation and fake detection.  _arXiv preprint arXiv:2001.00179_.
  * Tralic, Petrovic, and Grgic (2012) Tralic, D.; Petrovic, J.; and Grgic, S. 2012.  JPEG image tampering detection using blocking artifacts.  In _International Conference on Systems, Signals and Image Processing_ , 5–8. IEEE.
  * Wang et al. (2020) Wang, S.-Y.; Wang, O.; Zhang, R.; Owens, A.; and Efros, A. A. 2020.  CNN-generated images are surprisingly easy to spot…for now.  In _CVPR_.
  * Yang, Li, and Lyu (2019) Yang, X.; Li, Y.; and Lyu, S. 2019.  Exposing Deep Fakes Using Inconsistent Head Poses.  In _IEEE International Conference on Acoustics, Speech and Signal Processing_.
  * Yu et al. (2015) Yu, F.; Zhang, Y.; Song, S.; Seff, A.; and Xiao, J. 2015.  LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loop.  _arXiv preprint arXiv:1506.03365_.
  * Zhang, Karaman, and Chang (2019) Zhang, X.; Karaman, S.; and Chang, S. 2019.  Detecting and Simulating Artifacts in GAN Fake Images.  In _WFIS_.
  * Zhao et al. (2021) Zhao, H.; Zhou, W.; Chen, D.; Wei, T.; Zhang, W.; and Yu, N. 2021.  Multi-attentional deepfake detection.  In _CVPR_.
  * Zhu et al. (2017) Zhu, J.-Y.; Park, T.; Isola, P.; and Efros, A. A. 2017.  Unpaired Image-to-Image Translation using Cycle-Consistent Adversarial Networks.  In _ICCV_.