# Effect of the $\sigma$-cut potential on the properties of neutron stars with
or without a hyperonic core

N. K. Patra1 B. K. Sharma2<EMAIL_ADDRESS>A. Reghunath2,3 A. K. H.
Das2 T. K. Jha1 1Department of Physics, BITS-Pilani, K. K. Birla Goa Campus,
Goa 403726, India.  2Department of Sciences, Amrita School of Physical
Sciences, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India  3 Institut
fuer Physik, Experimentelle Elementarteilchenphysik II (EE2), Humboldt-
Universitaet zu Berlin, 12489 Berlin, Germany

###### Abstract

Motivated by the recent observation of high-mass pulsars ($M\simeq
2M_{\odot}$), we employ the $\sigma$-cut potential on the equation of state
(EOS) of high-density matter and the properties of neutron stars within the
relativistic mean-field (RMF) model using TM1∗ parameter set. The $\sigma$-cut
potential is known to reduce the contributions of the $\sigma$ field,
resulting in a stiffer EOS at high densities and hence leading to larger
neutron star masses without affecting the properties of nuclear matter at
normal saturation density. We also analyzed the effect of the same on pure
neutron matter and also on the neutron star matter with and without hyperonic
core and compared it with the available theoretical, experimental, and
observational data. The corresponding tidal deformability ($\Lambda_{1.4}$) is
also calculated. With the choice of meson-hyperon coupling fixed to
hypernuclear potentials, we obtain $\approx 10~{}\%$ increase in mass by
employing the $\sigma$-cut potential for $f_{s}=0.6$. Our results are in good
agreement with various experimental constraints and observational data,
particularly with the GW170817 data.

##  I Introduction

Neutron stars (NSs) are one of the densest objects that exist in the universe
Baym and Pethick (1975, 1979); Heiselberg and Pandharipande (2000). All four
fundamental forces play an important role in determining the global properties
of these stars. The study of their global properties provides a crucial link
between nuclear, particle, and astrophysics Malik  _et al._ (2018); Patra  _et
al._ (2020, 2022). The neutron star matter is likely to be composed of ions
and electrons in the outer crust region, i.e., near the surface, and neutron-
rich nuclei and some free neutrons appear in the inner crust region. In the
core densities, it may have free neutrons along with fewer protons and
electrons. As we go deeper to the core of the star, i.e., with an increase of
density towards the center of the star, exotic components of NS matter, viz.,
hyperons, heavier non-strange baryons, boson condensates, and even deconfined
quarks may appearGlendenning (1996). The global properties of the neutron star
are the imprints of a particular equation of state (EOS). Energetically, the
hyperons start appearing via weak interaction around 2-3 times nuclear
saturation density $\rho_{0}$. The presence of hyperons makes EOS softer and
consequently predicts a mass lower than when they are not included and has an
effect on the radius too. In addition, Softer EOS at higher density may also
be achieved by considering cross couplings among the $\sigma$, $\omega$, and
$\rho$ mesons within the Relativistic Mean Field approach Del Estal  _et al._
(2001a); Malik  _et al._ (2017).

A comprehensive idea regarding the $\sigma$-cut scheme was convened by
studying its effects on neutron star properties such as maximum mass,
compactness, and tidal deformability. Recently, two different groups of
Neutron Star Interior Composition Explorer (NICER) X-ray telescopes provided
simultaneously neutron star’s mass and radius for PSR J0030+0451 with
$R(1.44^{+0.15}_{-0.14})=13.02^{+1.24}_{-1.06}$km Miller  _et al._ (2019) and
$R(1.34^{+0.15}_{-0.16})=12.71^{+1.14}_{-1.19}$km Riley  _et al._ (2019) and
for J0740+6620 with $R(2.08\pm 0.07)=13.7^{+2.6}_{-1.5}$km Miller  _et al._
(2021) and $R(2.072^{+0.067}_{-0.066})=12.39^{+1.30}_{-0.98}$km Riley  _et
al._ (2021). Due to the model dependence of the experimental analyses,
differences between these estimates came out. By combining the NICER results
with the limits on the NS maximum mass as well as the tidal deformability from
GW170817 Abbott  _et al._ (2020) leads to constraints on the
$\beta$-equilibrated EOS for densities in the range
$1.5\rho_{0}\lesssim\rho_{B}\lesssim 3\rho_{0}$ Miller  _et al._ (2021);
Raaijmakers  _et al._ (2021), which can limit NS mass and radii Miller  _et
al._ (2021); Riley  _et al._ (2019); Miller  _et al._ (2019); Riley  _et al._
(2021); Pang  _et al._ (2021); Raaijmakers  _et al._ (2021).

Observation of neutron star’s mass around 2$M_{\odot}$ Demorest  _et al._
(2010); Antoniadis  _et al._ (2013) and the corresponding radius estimates
around 11.9 $\pm$ 1.4 km Abbott  _et al._ (2018, 2019) respectively disfavors
the possibility of softer EOS. On the contrary, results obtained from
transport models predict a soft EOS Fuchs  _et al._ (2001); Xiao  _et al._
(2009) at high densities. Such apparent contradictions in the EOS from
experimental and observational data motivate one to probe the different
aspects of an EOS and emphasize the importance to constrain them Chatterjee
and Vidaña (2016).

A $\sigma$-cut scheme Maslov  _et al._ (2015) was developed to make EOS
stiffer at high densities without compromising the properties of nuclear
matter around saturation density $\rho_{0}$. In the $\sigma$-cut scheme, a
$\sigma$-potential term is included in the Lagrangian of the RMF model to
reduce the contribution of the scalar field at high density thereby making EOS
stiffer resulting in larger masses for neutron stars. In one of recent works
Dutra  _et al._ (2016), a plethora of RMF models were analyzed to test the
range of resulting neutron star masses, where 14 of them could result in
masses within the range (1.93 - 2.05)$M_{\odot}$, of which only two of the
models could satisfy the mass constraint when hyperons were included. To
increase the masses further, in accordance with recent observations, one of
the ways out is to include the $\sigma$-cut scheme and analyze the effect on
the EOS as well as the star masses. Recently, the $\sigma$-cut scheme is
implemented to study the properties of finite nuclei and hyperon-rich matter
using TM1 parameter set Zhang  _et al._ (2018) and also to kaon condensate in
neutron stars Ma  _et al._ (2022) using FSUGold parameter set.

In the present work, we implement the $\sigma$-cut scheme using TM1∗ Del Estal
_et al._ (2001b) interaction. The improved TM1∗ parameter has extra cross
couplings compared to TM1. These extra couplings have no effect on the
properties of finite nuclei and nuclear matter around saturation density but
these cross couplings seem to be instrumental in making EOS softer at high
densities. We choose TM1∗ for the present analysis and use the same strength
of $\sigma$-cut potential as given in ref. Zhang  _et al._ (2018).

The paper is organized as follows: In Sec. II, we briefly describe the RMF
model with $\sigma$-cut potential and stellar equations for a neutron star. In
Sec. III, we present and discuss the role of $\sigma$-cut potential on the
properties of nuclear matter and neutron stars with hyperons. The summary and
conclusions of the present work are given in Sec. IV.

##  II Formalism

We apply the well-known RMF model to describe the EOS at higher densities
relevant to the neutron stars. The details of the model and derivation of EOS
with nucleon and with nucleon and hyperon both can be found in the ref. Sharma
_et al._ (2007). We include the $\sigma$-cut potential $U_{cut}(\sigma)$ in
RMF Lagrangian as in the refs.Maslov  _et al._ (2015); Zhang  _et al._ (2018).
The Lagrangian density with $U_{cut}(\sigma)$ is given by,

$\displaystyle{\cal L}$ $\displaystyle=$
$\displaystyle\sum_{B}\overline{\Psi}_{B}\left(i\gamma^{\mu}D_{\mu}-M_{B}+g_{\sigma
B}{\sigma}\right){\Psi}_{B}+\frac{1}{2}{\partial_{\mu}}{\sigma}{\partial^{\mu}}{\sigma}$
(1) $\displaystyle-
m_{\sigma}^{2}{\sigma^{2}}\left(\frac{1}{2}+\frac{\kappa_{3}}{3!}\frac{g_{\sigma
B}\sigma}{M_{N}}+\frac{\kappa_{4}}{4!}\frac{g^{2}_{\sigma
B}\sigma^{2}}{M_{N}^{2}}\right)-\frac{1}{4}{\Omega_{\mu\nu}}{\Omega^{\mu\nu}}$
$\displaystyle+\frac{1}{2}\left(1+{\eta_{1}}\frac{g_{\sigma
B}\sigma}{M_{N}}+\frac{\eta_{2}}{2}\frac{g^{2}_{\sigma
B}\sigma^{2}}{M_{N}^{2}}\right)m_{\omega}^{2}{\omega_{\mu}}{\omega^{\mu}}-\frac{1}{4}{R^{a}_{\mu\nu}}{R^{a\mu\nu}}$
$\displaystyle+\frac{1}{2}\left(1+\eta_{\rho}\frac{g_{\sigma
B}\sigma}{M_{N}}\right)m_{\rho}^{2}{\rho^{a}_{\mu}}{\rho^{a\mu}}+\frac{1}{4!}{\zeta_{0}}g^{2}_{\omega
B}\left({\omega_{\mu}}{\omega^{\mu}}\right)^{2}$ $\displaystyle-
U_{cut}(\sigma)$

The $U_{cut}(\sigma)$ has logarithmic form as Maslov  _et al._ (2015) which
only influence the $\sigma$-field at high density and is given by,

$\displaystyle U_{cut}(\sigma)=\alpha\ln[1+\exp\\{\beta(g_{\sigma
N}\sigma/M_{N}-f_{s})\\}]$ (2)

where $\alpha$ = $m_{\pi}^{4}$ and $\beta$ = 120 Maslov  _et al._ (2015). The
factor $f_{s}$ is a free parameter and we take $f_{s}$ = 0.6 Zhang  _et al._
(2018) for our calculation. The field equations for $\sigma$, $\omega$, and
$\rho$-mesons obtained from eq.(1) are given by,

$\displaystyle m_{\sigma}^{2}\left({\sigma}_{0}+\frac{g_{\sigma
N}{\kappa_{3}}}{2M_{N}}\sigma_{0}^{2}+\frac{g_{\sigma
N}^{2}{\kappa_{4}}}{6M_{N}^{2}}\sigma_{0}^{3}\right)+U_{cut}^{{}^{\prime}}(\sigma)$
$\displaystyle-\frac{1}{2}m_{\omega}^{2}\left(\eta_{1}\frac{g_{\sigma
N}}{M_{N}}+\eta_{2}\frac{g_{\sigma
N}^{2}}{M_{N}^{2}}\sigma_{0}\right)\omega_{0}^{2}$
$\displaystyle-\frac{1}{2}m_{\rho}^{2}\eta_{\rho}\frac{g_{\sigma
N}}{M_{N}}\rho_{0}^{2}=\sum_{B}g_{\sigma B}M_{B}^{*2}\rho_{SB}$ (3)

$\displaystyle m_{\omega}^{2}\left(1+\frac{\eta_{1}g_{\sigma
N}}{M_{N}}\sigma_{0}+\frac{\eta_{2}g_{\sigma
N}^{2}}{2M_{N}^{2}}\sigma_{0}^{2}\right)\omega_{0}$
$\displaystyle+\frac{1}{6}\zeta_{0}g_{\omega
N}^{2}\omega_{0}^{3}=\sum_{B}g_{\omega B}\rho_{B}$ (4)

$\displaystyle m_{\rho}^{2}\left(1+\frac{g_{\sigma
N}{\eta_{\rho}}}{M_{N}}\sigma_{0}\right)\rho_{03}=\sum_{B}g_{\rho
B}I_{3B}\rho_{B}$ (5)

where $I_{3B}$ is the third component of nucleon isospin operator and the
derivative of $U_{cut}(\sigma)$ is given by,

$\displaystyle U_{cut}^{{}^{\prime}}(\sigma)=\frac{\alpha\beta g_{\sigma
N}}{M_{N}}\frac{1}{[1+\exp\\{-\beta(g_{\sigma N}\sigma/M_{N}-f_{s})\\}]}$ (6)

The EOS for hyperon-rich matter satisfies the conservation of the total baryon
number and charge neutrality condition which is given by,

$\displaystyle\sum_{B}Q_{B}\rho_{B}+\sum_{L}Q_{L}\rho_{L}=0$ (7)

where $\rho_{B}$ and $\rho_{L}$ are the baryon and the lepton $(e,\mu)$ number
densities with $Q_{B}$ and $Q_{L}$ as their respective electric charge.

The energy density $\cal E$ and pressure $P$ for charge-neutral
$\beta$-equilibrated neutron star matter with a lowest-lying octet of baryons
is given by,

$\displaystyle{\cal E}$ $\displaystyle=$
$\displaystyle\sum_{B}\frac{2}{(2\pi)^{3}}\int_{0}^{k_{B}}d^{3}k{E_{B}^{*}(k)}+\frac{1}{8}\zeta_{0}g_{\omega
N}^{2}\omega_{0}^{4}+U_{cut}(\sigma)$ (8) $\displaystyle+$
$\displaystyle\frac{1}{2}\left(1+\frac{\eta_{1}g_{\sigma
N}}{M_{N}}\sigma_{0}+\frac{\eta_{2}g_{\sigma
N}^{2}}{2M_{N}^{2}}\sigma_{0}^{2}\right)m_{\omega}^{2}{\omega_{0}^{2}}$
$\displaystyle+$ $\displaystyle
m_{\sigma}^{2}{\sigma_{0}}^{2}\left(\frac{1}{2}+\frac{\kappa_{3}g_{\sigma
N}\sigma_{0}}{3!M_{N}}+\frac{\kappa_{4}g_{\sigma
N}^{2}\sigma_{0}^{2}}{4!M_{N}^{2}}\right)$ $\displaystyle+$
$\displaystyle\frac{1}{2}\left(1+\eta_{\rho}\frac{g_{\sigma
N}\sigma_{0}}{M_{N}}\right)m_{\rho}^{2}{\rho_{0}}^{2}+\sum_{L}{\cal E}_{L}$

$\displaystyle P$ $\displaystyle=$
$\displaystyle\sum_{B}\frac{2}{3(2\pi)^{3}}\int_{0}^{k_{B}}d^{3}k\frac{k^{2}}{E_{B}^{*}(k)}+\frac{1}{4!}\zeta_{0}g_{\omega
N}^{2}\omega_{0}^{4}-U_{cut}(\sigma)$ (9) $\displaystyle+$
$\displaystyle\frac{1}{2}\left(1+\frac{\eta_{1}g_{\sigma
N}}{M_{N}}\sigma_{0}+\frac{\eta_{2}g_{\sigma
N}^{2}}{2M_{N}^{2}}\sigma_{0}^{2}\right)m_{\omega}^{2}{\omega_{0}^{2}}$
$\displaystyle-$ $\displaystyle
m_{\sigma}^{2}{\sigma_{0}}^{2}\left(\frac{1}{2}+\frac{\kappa_{3}g_{\sigma
N}\sigma_{0}}{3!M_{N}}+\frac{\kappa_{4}g_{\sigma
N}^{2}\sigma_{0}^{2}}{4!M_{N}^{2}}\right)$ $\displaystyle+$
$\displaystyle\frac{1}{2}\left(1+\eta_{\rho}\frac{g_{\sigma
N}\sigma_{0}}{M_{N}}\right)m_{\rho}^{2}{\rho_{0}}^{2}+\sum_{L}P_{L}$

Here the subscript ’B’, ’N’, and ’L’ represents the low-lying octet of
baryons, nucleons, and leptons respectively. The ${\cal E}_{L}$ and $P_{L}$
are the energy density and pressure of the leptons.

The mass-radius relation for a neutron star is obtained by Tolman,
Oppenheimer, and Volkoff (TOV) equation Oppenheimer and Volkoff (1939); Tolman
(1939) which is given by,

$\frac{dP}{dr}=-\frac{G}{r}\frac{\left[\varepsilon+P\right]\left[M+4\pi
r^{3}P\right]}{(r-2GM)},$ (10) $\frac{dM}{dr}=4\pi r^{2}\varepsilon,$ (11)

Here we adopt the natural units, i.e., c = 1, and the terms G, $P(r)$ and
$M(r)$ are the universal gravitational constant, the pressure of neutron star,
and the enclosed gravitational mass inside a sphere of radius $(r)$
respectively. The Eqs. (10) and (11) are solved to obtain the structural
properties of a static neutron star with neutral hyperonic matter Lattimer and
Prakash (2004); Krastev and Sammarruca (2006).

##  III Results and Discussion

We choose TM1∗ parameter set Del Estal  _et al._ (2001b) for our present
analysis. As already mentioned, the motivation to choose TM1∗ is to examine
how the $\sigma$-cut potential influence the EOS with cross-couplings of
$\sigma$-field and consequently the structural properties of a neutron star.
In $\sigma$-cut scheme with TM1∗ we took $\alpha$ = $m_{\pi}^{4}$ and $\beta$
= 120 as given in Maslov  _et al._ (2015) except the value of factor $f_{s}$.
In ref. Maslov  _et al._ (2015) the value of $f_{s}$ was taken as 0.36, 0.44
and 0.52 unlike Zhang  _et al._ (2018). In one of the earlier works, for
finite nuclei results including $\sigma$-cut potential are found to be
identical with the original TM1 parameter set for the value of $f_{s}$ larger
than 0.55 Zhang  _et al._ (2018). In the finite nuclear domain, there is
almost no difference between TM1 and TM1∗ Del Estal  _et al._ (2001b) and we
choose $f_{s}$ = 0.6 for our present analysis.

Figure 1: Pressure as a function of number density $\rho$ for (a) symmetric
nuclear matter and (b) pure neutron matter with original TM1∗ and the TM1∗
with $\sigma$-cut potential ($f_{s}$ = 0.6) along with other microscopic EOSs.
The orange polygon and green polygon in Fig.1(a) describe the transverse flow
data Ritman  _et al._ (1995) and KaoS experimental data Miskowiec  _et al._
(1994) respectively.

In the present analysis, we used several microscopic Brueckner–Hartree–Fock
(BHF) EOS based on different nucleon-nucleon potential namely Bonn B (BOB)
Machleidt  _et al._ (1987); Machleidt (1989), the Nijmegen 93 (N93) Nagels
_et al._ (1978); Stoks  _et al._ (1994), Argonne $V_{18}$ (V18) Wiringa  _et
al._ (1995) as well as phenomenological Urbana model (UIX), Dirac-BHF method
(DBHF) Gross-Boelting  _et al._ (1999), APR EOS Akmal  _et al._ (1998) and
well-known phenomenological EOS SFHO Steiner  _et al._ (2013) for symmetric
nuclear matter, pure neutron matter, and symmetry energy for comparison along
with available experimental data.

In Fig.1, we plot and compare all the microscopic EOSs along with the original
TM1∗ and TM1∗ with $\sigma$-cut potential ($f_{s}$ = 0.6) for symmetric
nuclear matter and pure neutron matter. In Fig.1(a), the orange and green
shaded regions represent the flow data by the FOPI collaboration Ritman  _et
al._ (1995) and data from KaoS collaboration Miskowiec  _et al._ (1994) for
symmetric nuclear matter, respectively. From Fig.1(a), we see that most of the
microscopic EOSs are compatible with the experimental data Ritman  _et al._
(1995); Miskowiec  _et al._ (1994) except for BOB, V18, and DBHF EOS, which
are stiff at high densities. It is to be noted that the original TM1∗ results
are consistent with experimental data at all the values of number density
$\rho$. On the other hand, the TM1∗ EOS with $\sigma$-cut potential gives the
stiffest EOS for symmetric nuclear matter compared to other EOSs. The EOS with
$\sigma$-cut potential becomes stiffer at $\rho$ = $0.28$ $fm^{-3}$ compared
to original TM1∗ EOS for symmetric nuclear matter. For completeness, we plot
all considered EOSs for pure neutron matter in fig.1(b). We find that the
original TM1∗ and EOS with $\sigma$-cut potential is stiffer compared to other
microscopic EOSs for pure neutron matter. The TM1∗ EOS with $\sigma$-cut
potential becomes stiffer at $\rho$ = $0.32$ $fm^{-3}$ compare to original
TM1∗ EOS for pure neutron matter. One can conclude from fig.1 that the effect
of $\sigma$-cut potential is more in symmetric nuclear matter compared to pure
neutron matter. The reason for this discrepancy is that the $\sigma$-cut
potential reduces the magnitude of $\sigma$-field contribution in symmetric
nuclear matter and $\omega$-field remains unaffected by $\sigma$-cut potential
resulting in stiffer EOS stiffer at high densities. On the other hand, the
contribution of $\sigma$-field is smaller in pure neutron matter is smaller
compared to symmetric nuclear matter. As $\sigma$-cut potential is isospin
independent and equally effect $\sigma$-field in symmetric nuclear and pure
neutron matter. The contribution of $\sigma$-field is smaller in pure neutron
matter compared to the symmetric nuclear matter at certain densities without
$\sigma$-cut potential. So, the effect of $\sigma$-cut potential is less
prominent in neutron matter as compared to the symmetric nuclear matter.

Figure 2: Symmetry energy $E_{sym}$ as a function of number density $\rho$ for
all microscopic EOS as well as with original TM1∗ and the TM1∗ with
$\sigma$-cut potential along with experimental data. The inset plot shows
$E_{sym}$ for the original TM1∗ and the TM1∗ with $\sigma$-cut potential at
high densities.

The symmetry energy $E_{sym}$ and its density dependence play an important
role in finite nuclei and neutron star properties. A lot of experimental
efforts have been put into constraining high-density behavior of $E_{sym}$
using various probes in heavy ion collisions (HICs) at relativistic energies.
In Fig.2, we display some constraints obtained for the density dependence of
$E_{sym}$ from FOPY-LAND (green band) Russotto  _et al._ (2011), ASY-EOS
(indigo band) Russotto  _et al._ (2016), IAS-EOS (orange band) Tsang  _et al._
(2009), and HIC (Sn + Sn) (brown band) Danielewicz and Lee (2014)
respectively. We also plot all the microscopic EOSs along with the original
TM1∗ and the TM1∗ $\sigma$-cut potential. We observe that all the experimental
data increase monotonically with the density. We also found that all
microscopic EOSs are compatible with the experimental data. Although $E_{sym}$
obtained from original TM1∗ and the TM1∗ with $\sigma$-cut potential follow
the trend similar to other microscopic EOSs but both predict high value of
$E_{sym}$, around 5 MeV more compare to other EOSs after $\rho$ = $0.1$
$fm^{-3}$. There is no difference in the value of $E_{sym}$ between original
TM1∗ and the TM1∗ with $\sigma$-cut potential up to $0.3$ $fm^{-3}$. We also
found that $E_{sym}$ is softer at higher densities i.e. higher than $0.4$
$fm^{-3}$ in TM1∗ with $\sigma$-cut potential compared to original TM1∗. Such
behavior of $E_{sym}$ occurs because TM1∗ with $\sigma$-cut potential ($f_{s}$
= 0.6) have a larger effective mass and in RMF models symmetry energy
inversely depend on effective massZhang  _et al._ (2018).

In the present analysis, we consider the pure nucleonic as well as hyperon-
rich neutron star matter. Meson-Hyperon couplings are fixed by reproducing the
hyperon potentials at normal density as indicated by hypernuclei experiments.
We fix the scalar $x_{\sigma H}=g_{\sigma H}/g_{\sigma N}$ and vector
$x_{\omega H}=g_{\omega H}/g_{\sigma N}$ coupling constants by fixing the
hyperon potential depths $(B/A)_{H}|_{\rho_{0}}$ as in ref. Sen  _et al._
(2019) and is given by

$(B/A)_{H}|_{\rho_{0}}=x_{\omega H}U_{V}|_{\rho_{0}}+x_{\sigma
H}U_{S}|_{\rho_{0}}$ (12)

where $U_{S}=g_{\sigma N}\sigma_{0}$ and $U_{V}=g_{\omega N}\omega_{0}$
respectively. We reproduce the hyperon potential depths $(B/A)_{H}$ at
saturation density ${\rho_{0}}$ equal to -28MeV, +30MeV and -18MeV for
$\Lambda$, $\Sigma$ and $\Xi$ respectively. We take $x_{\rho H}=x_{\omega H}$
in the present analysis. As suggested Glendenning and Moszkowski (1991), the
value of $x_{\sigma H}$ should be smaller than 0.72. In the present work, we
take two values of $x_{\sigma H}$ = 0.6 and 0.7 and keep it the same for all
hyperons. The corresponding vector coupling is taken by fixing $x_{\sigma H}$
and the aforementioned hyperon potentials at normal nuclear matter density.

Figure 3: Pressure as a function of baryon number density $\rho_{B}$ for with
or without $\sigma$-cut potential in neutron star matter for (a) only
nucleonic neutron star matter along with other microscopic EOSs. and (b)
neutron star matter including hyperons with original TM1∗ and the TM1∗ with
$\sigma$-cut potential ($f_{s}$ = 0.6) for scalar coupling constants
$x_{\sigma H}$ = 0.6 and 0.7. The combined data from multi-messenger neutron
star observations and HIC (Astro+HIC) shown as an orange polygon is also
shown. The shading corresponds to 95$\%$ and 68$\%$ credible intervals
(lightest to darkest).

In Fig.3(a), we display the pressure as a function of baryon number density
$\rho_{B}$ of neutron star matter. As we are considering only nucleonic
matter, the baryon number density $\rho_{B}$ is equal to $\rho$ like fig.1 and
fig.2 in fig.3(a). The combined data from multi-messenger neutron star
observations and HIC (Astro+HIC) Huth  _et al._ (2022) shown as an orange
polygon in both fig.3(a) and 3(b). The light and dark shade of the orange
polygon corresponds to the 95$\%$ and 68$\%$ credible intervals, respectively.
From Fig.3(a), one can conclude that the original TM1∗ and the TM1∗ with
$\sigma$-cut potential ($f_{s}$ = 0.6) along with other microscopic EOSs are
consistent with observational and experimental constraints for pure nucleonic
neutron star matter. In Fig.3(b), we plot the pressure as a function of baryon
number density $\rho_{B}$ of neutron star matter with nucleonic and nucleonic
plus hyperon rich matter for $x_{\sigma H}$ = 0.6 and 0.7. We found that all
the EOSs are similar up to $\rho_{B}=0.3fm^{-3}$ and the effect of
$\sigma$-cut potential and different $x_{\sigma H}$ starts appearing
thereafter. Our results for all EOSs in fig.3(b) are consistent with the dark
shade area of combined data of observational and experimental constraints.

Figure 4: The particle fractions $Y_{i}$ as function of baryon number density
$\rho_{B}$ in neutron star TM1∗ with $\sigma$-cut potential ($f_{s}$ = 0.6)
for (a) $x_{\sigma H}=0.6$ (b) $x_{\sigma H}=0.7$.

To analyse the effect of $\sigma$-cut potential on particle fractions
$Y_{i}=\rho_{i}/\rho_{B}$, we plot the particle fraction of TM1∗ with
$\sigma$-cut potential ($f_{s}$ = 0.6) for $x_{\sigma H}=0.6,0.7$ in fig.4(a)
and (b) respectively. From fig.4(a) and 4(b), we find that $\sigma$-cut
potential has no effect on the neutron, proton, and lepton fractions (electron
and muon) in the entire density range. In the hyperonic sector, it is
interesting to see that the $\sigma$-cut potential has a slight effect on the
appearance of $\Lambda^{0}$ and $\Xi^{-}$. $\Lambda^{0}$ starts to nucleate at
around $0.34fm^{-3}$ for both the values of $x_{\sigma H}$. $\Xi^{-}$ appears
at $0.47fm^{-3}$ for $x_{\sigma H}=0.6$ and at $0.50fm^{-3}$ for $x_{\sigma
H}=0.7$ respectively. On the other hand, the main effect of $\sigma$-cut
potential happens on $\Xi^{0}$ fractions where $\Xi^{0}$ appears at
$1.52fm^{-3}$ for $x_{\sigma H}=0.6$ as compared to $1.39fm^{-3}$ for
$x_{\sigma H}=0.7$.

Figure 5: The mass radius relation of neutron star with original TM1∗ and TM1∗
with $\sigma$-cut potential for nucleonic and nucleonic plus hyperon rich
matter with $x_{\sigma H}$ = 0.6 and 0.7 along with other available
observational data.

In Fig.5, we display the mass-radius (MR) relation for nucleonic and nucleonic
plus hyperon-rich neutron star with original TM1∗ and TM1∗ with $\sigma$-cut
potential ($f_{s}$ = 0.6) along with observational data. The astrophysical
observable constraints from GW190814 Abbott  _et al._ (2020), PSR J0740+6620
Riley  _et al._ (2021); Miller  _et al._ (2021), PSR J0348+0432 Antoniadis
_et al._ (2013), GW170817 Fattoyev  _et al._ (2018) and NICER experiment for
PSR J0030+0451 Riley  _et al._ (2019); Miller  _et al._ (2019) are represented
by shaded regions. As anticipated, the obtained mass for pure nucleonic matter
($n,p,e,\mu$) is larger compared to the mass obtained with hyperons for both
the values of $x_{\sigma H}$. In hyperon-rich matter, mass is higher for
$x_{\sigma H}$ = 0.7 compared to $x_{\sigma H}$ = 0.6 irrespective of whether
we implemented the $\sigma$-cut potential or not. The effect of $\sigma$-cut
potential is almost similar in all the considered TM1∗ EOSs. The TM1∗ with
$\sigma$-cut potential gives the slightly higher mass of neutron star for
nucleonic matter compared to the original TM1∗.

Figure 6: The tidal deformability of neutron star as function of maximum mass
with original TM1∗ and TM1∗ with $\sigma$-cut potential for nucleonic and
nucleonic plus hyperon rich matter with $x_{\sigma H}$ = 0.6 and 0.7 along
with observational constraints from GW170817.

In Fig.6, we display the calculated tidal deformability of neutron star with
original TM1∗ and TM1∗ with $\sigma$-cut potential ($f_{s}$ = 0.6) for
nucleonic and nucleonic plus hyperon rich matter with $x_{\sigma H}$ = 0.6 and
0.7. The observational constraints from GW170817 is shown as a shaded region.
Our results seem to be consistent with the observational constraints from
GW170817. TM1∗ with $\sigma$-cut potential ($f_{s}$ = 0.6) for pure nucleonic
matter has highest value of the tidal deformability. Similarly, in hyperon-
rich matter the value of tidal deformability is higher for $x_{\sigma H}$ =
0.7 compared to $x_{\sigma H}$ = 0.6. For comparison, all the calculated
values of neutron star properties such as tidal deformability
($\Lambda_{1.4}$), radii (R1.4 and R2.07) (in km) and maximum mass (Mmax(in
M${}_{\odot})$) with different TM1∗ models are listed in Table 1. It is
concluded that with $\sigma$-cut potential ($f_{s}$ = 0.6) for pure nucleonic
matter is well constrained and its maximum mass satisfy the current available
maximum mass $2.08\pm 0.07M_{\odot}$ Miller  _et al._ (2021). Similar high
mass neutron stars were obtained from three of other RMF models Dutra  _et
al._ (2016) investigated with nucleon only matter.

Table 1: The values of neutron star properties, namely the tidal deformability ($\Lambda_{1.4}$), radii (R1.4 and R2.07) (in km) and maximum mass (Mmax(in M${}_{\odot})$) are listed . TM1∗ models | Mmax | R1.4 | R2.07 | $\Lambda_{1.4}$
---|---|---|---|---
npe$\mu$ | 2.02 | 15.24 | 12.18 | 845.30
npe$\mu$, fs=0.6 | 2.08 | 15.23 | 12.98 | 860.81
npe$\mu$+H, xσH=0.6 | 1.59 | 15.13 | 13.67 | 841.74
npe$\mu$+H, xσH=0.6, fs=0.6 | 1.74 | 15.23 | 13.64 | 851.92
npe$\mu$+H, xσH=0.7 | 1.69 | 15.12 | 13.20 | 831.66
npe$\mu$+H, xσH=0.7, fs=0.6 | 1.86 | 15.23 | 13.47 | 860.81

##  IV Conclusions and Summary

The $\sigma$-cut scheme developed Maslov  _et al._ (2015) and recently
implemented to study neutron star properties of EOS with hyperons using TM1
parameter set Zhang  _et al._ (2018) and kaon condensate using FSUGold
parameter set Ma  _et al._ (2022). In the present analysis, we adopted and
implemented the $\sigma$-cut scheme for the RMF model TM1∗ parameter, which
gives the same results as TM1 for finite nuclei and nuclear matter properties
Del Estal  _et al._ (2001b). We analyzed the effect of $\sigma$-cut potential
on symmetric nuclear matter, pure neutron matter, symmetry energy, and neutron
star structure and composition with nucleonic and nucleonic plus hyperon-rich
matter and compared with the existing experimental and observational data. We
found that $\sigma$-cut potential with TM1∗ parameter predicts a stiffer EOS
compared to other microscopic EOSs for symmetric nuclear matter. A similar
trend is also found in the case of pure neutron matter and symmetry energy
results. We found that there is almost no effect till the two times nuclear
saturation density $\rho_{0}$ and $\sigma$-cut potential make symmetry energy
softer at high density. We proceed to construct EOS with the original TM1∗ and
TM1∗ with $\sigma$-cut potential ($f_{s}$ = 0.6) for pure nucleonic and
nucleonic and hyperon rich matter. The sensitivity of meson-hyperon coupling
on the EOS is analyzed. For hyperon-rich matter, we choose scalar coupling
constants $x_{\sigma H}$ = 0.6 and 0.7, respectively, and fixed the respective
hyperon potential depths in the matter as pronounced from the hyper-nuclear
experiments. For $x_{\sigma H}$ = 0.6, we obtained smaller mass and tidal
deformability as compared to $x_{\sigma H}$ = 0.7 of neutron star. The
dominant global properties of the neutron star, such as the mass, radius, and
tidal deformability within the model, are in good agreement with experimental
and observational constraints.

##  V Acknowledgements

N.K.P. would like to acknowledge the Department of Science and Technology,
Ministry of Science and Technology, India, for the support of DST/INSPIRE
Fellowship/2019/IF190058.

## References

  * Baym and Pethick (1975) G. Baym and C. Pethick, Ann. Rev. Nucl. Part. Sci. 25, 27 (1975).
  * Baym and Pethick (1979) G. Baym and C. Pethick, Ann. Rev. Astron. Astrophys. 17, 415 (1979).
  * Heiselberg and Pandharipande (2000) H. Heiselberg and V. Pandharipande, Ann. Rev. Nucl. Part. Sci. 50, 481 (2000), arXiv:astro-ph/0003276 .
  * Malik  _et al._ (2018) T. Malik, N. Alam, M. Fortin, C. Providência, B. K. Agrawal, T. K. Jha, B. Kumar, and S. K. Patra, Phys. Rev. C 98, 035804 (2018).
  * Patra  _et al._ (2020) N. K. Patra, T. Malik, D. Sen, T. K. Jha, and H. Mishra, Astrophys. J. 900, 49 (2020).
  * Patra  _et al._ (2022) N. K. Patra, S. M. A. Imam, B. K. Agrawal, A. Mukherjee, and T. Malik, (2022), arXiv:2203.08521 [nucl-th] .
  * Glendenning (1996) N. K. Glendenning,  _Compact Stars, 2nd ed._ , November (Springer-Verlag, New York, 1996).
  * Del Estal  _et al._ (2001a) M. Del Estal, M. Centelles, X. Vinas, and S. K. Patra, Phys. Rev. C 63, 044321 (2001a), arXiv:nucl-th/0101065 .
  * Malik  _et al._ (2017) T. Malik, K. Banerjee, T. K. Jha, and B. K. Agrawal, Phys. Rev. C 96, 035803 (2017).
  * Miller  _et al._ (2019) M. C. Miller _et al._ , Astrophys. J. Lett. 887, L24 (2019), arXiv:1912.05705 [astro-ph.HE] .
  * Riley  _et al._ (2019) T. E. Riley _et al._ , Astrophys. J. Lett. 887, L21 (2019), arXiv:1912.05702 [astro-ph.HE] .
  * Miller  _et al._ (2021) M. C. Miller _et al._ , Astrophys. J. Lett. 918, L28 (2021), arXiv:2105.06979 [astro-ph.HE] .
  * Riley  _et al._ (2021) T. E. Riley _et al._ , Astrophys. J. Lett. 918, L27 (2021), arXiv:2105.06980 [astro-ph.HE] .
  * Abbott  _et al._ (2020) R. Abbott _et al._ (LIGO Scientific, Virgo), Astrophys. J. Lett. 896, L44 (2020), arXiv:2006.12611 [astro-ph.HE] .
  * Raaijmakers  _et al._ (2021) G. Raaijmakers, S. K. Greif, K. Hebeler, T. Hinderer, S. Nissanke, A. Schwenk, T. E. Riley, A. L. Watts, J. M. Lattimer, and W. C. G. Ho, Astrophys. J. Lett. 918, L29 (2021), arXiv:2105.06981 [astro-ph.HE] .
  * Pang  _et al._ (2021) P. T. H. Pang, I. Tews, M. W. Coughlin, M. Bulla, C. Van Den Broeck, and T. Dietrich, Astrophys. J. 922, 14 (2021), arXiv:2105.08688 [astro-ph.HE] .
  * Demorest  _et al._ (2010) P. Demorest, T. Pennucci, S. Ransom, M. Roberts, and J. Hessels, Nature 467, 1081 (2010), arXiv:1010.5788 [astro-ph.HE] .
  * Antoniadis  _et al._ (2013) J. Antoniadis _et al._ , Science 340, 6131 (2013), arXiv:1304.6875 [astro-ph.HE] .
  * Abbott  _et al._ (2018) B. P. Abbott _et al._ (LIGO Scientific, Virgo), Phys. Rev. Lett. 121, 161101 (2018), arXiv:1805.11581 [gr-qc] .
  * Abbott  _et al._ (2019) B. P. Abbott _et al._ (LIGO Scientific, Virgo), Phys. Rev. X 9, 011001 (2019), arXiv:1805.11579 [gr-qc] .
  * Fuchs  _et al._ (2001) C. Fuchs, A. Faessler, E. Zabrodin, and Y.-M. Zheng, Phys. Rev. Lett. 86, 1974 (2001), arXiv:nucl-th/0011102 .
  * Xiao  _et al._ (2009) Z. Xiao, B.-A. Li, L.-W. Chen, G.-C. Yong, and M. Zhang, Phys. Rev. Lett. 102, 062502 (2009), arXiv:0808.0186 [nucl-th] .
  * Chatterjee and Vidaña (2016) D. Chatterjee and I. Vidaña, Eur. Phys. J. A 52, 29 (2016), arXiv:1510.06306 [nucl-th] .
  * Maslov  _et al._ (2015) K. A. Maslov, E. E. Kolomeitsev, and D. N. Voskresensky, Phys. Rev. C 92, 052801 (2015), arXiv:1508.03771 [astro-ph.HE] .
  * Dutra  _et al._ (2016) M. Dutra, O. Lourenço, and D. P. Menezes, Phys. Rev. C 93, 025806 (2016), arXiv:1510.02060 [astro-ph.HE] .
  * Zhang  _et al._ (2018) Y. Zhang, J. Hu, and P. Liu, Phys. Rev. C 97, 015805 (2018), arXiv:1801.01984 [nucl-th] .
  * Ma  _et al._ (2022) F. Ma, W. Guo, and C. Wu, Phys. Rev. C 105, 015807 (2022), arXiv:2202.03001 [nucl-th] .
  * Del Estal  _et al._ (2001b) M. Del Estal, M. Centelles, X. Vinas, and S. K. Patra, Phys. Rev. C 63, 024314 (2001b).
  * Sharma  _et al._ (2007) B. K. Sharma, P. K. Panda, and S. K. Patra, Phys. Rev. C 75, 035808 (2007), arXiv:nucl-th/0611039 .
  * Oppenheimer and Volkoff (1939) J. R. Oppenheimer and G. M. Volkoff, Phys. Rev. 55, 374 (1939).
  * Tolman (1939) R. C. Tolman, Phys. Rev. 55, 364 (1939).
  * Lattimer and Prakash (2004) J. M. Lattimer and M. Prakash, Science 304, 536 (2004), arXiv:astro-ph/0405262 .
  * Krastev and Sammarruca (2006) P. G. Krastev and F. Sammarruca, Phys. Rev. C 74, 025808 (2006), arXiv:nucl-th/0601065 .
  * Ritman  _et al._ (1995) J. L. Ritman _et al._ (FOPI), Z. Phys. A 352, 355 (1995), arXiv:nucl-ex/9506002 .
  * Miskowiec  _et al._ (1994) D. Miskowiec _et al._ , Phys. Rev. Lett. 72, 3650 (1994).
  * Machleidt  _et al._ (1987) R. Machleidt, K. Holinde, and C. Elster, Phys. Rept. 149, 1 (1987).
  * Machleidt (1989) R. Machleidt, Adv. Nucl. Phys. 19, 189 (1989).
  * Nagels  _et al._ (1978) M. M. Nagels, T. A. Rijken, and J. J. de Swart, Phys. Rev. D 17, 768 (1978).
  * Stoks  _et al._ (1994) V. G. J. Stoks, R. A. M. Klomp, C. P. F. Terheggen, and J. J. de Swart, Phys. Rev. C 49, 2950 (1994), arXiv:nucl-th/9406039 .
  * Wiringa  _et al._ (1995) R. B. Wiringa, V. G. J. Stoks, and R. Schiavilla, Phys. Rev. C 51, 38 (1995), arXiv:nucl-th/9408016 .
  * Gross-Boelting  _et al._ (1999) T. Gross-Boelting, C. Fuchs, and A. Faessler, Nucl. Phys. A 648, 105 (1999), arXiv:nucl-th/9810071 .
  * Akmal  _et al._ (1998) A. Akmal, V. R. Pandharipande, and D. G. Ravenhall, Phys. Rev. C 58, 1804 (1998), arXiv:nucl-th/9804027 .
  * Steiner  _et al._ (2013) A. W. Steiner, M. Hempel, and T. Fischer, Astrophys. J. 774, 17 (2013), arXiv:1207.2184 [astro-ph.SR] .
  * Russotto  _et al._ (2011) P. Russotto _et al._ , Phys. Lett. B 697, 471 (2011), arXiv:1101.2361 [nucl-ex] .
  * Russotto  _et al._ (2016) P. Russotto _et al._ , Phys. Rev. C 94, 034608 (2016), arXiv:1608.04332 [nucl-ex] .
  * Tsang  _et al._ (2009) M. B. Tsang, Y. Zhang, P. Danielewicz, M. Famiano, Z. Li, W. G. Lynch, and A. W. Steiner, Phys. Rev. Lett. 102, 122701 (2009), arXiv:0811.3107 [nucl-ex] .
  * Danielewicz and Lee (2014) P. Danielewicz and J. Lee, Nucl. Phys. A 922, 1 (2014), arXiv:1307.4130 [nucl-th] .
  * Sen  _et al._ (2019) D. Sen, K. Banerjee, and T. K. Jha, Int. J. Mod. Phys. E 27, 1850097 (2019), arXiv:1812.03529 [nucl-th] .
  * Glendenning and Moszkowski (1991) N. K. Glendenning and S. A. Moszkowski, Phys. Rev. Lett. 67, 2414 (1991).
  * Huth  _et al._ (2022) S. Huth _et al._ , Nature 606, 276 (2022), arXiv:2107.06229 [nucl-th] .
  * Fattoyev  _et al._ (2018) F. J. Fattoyev, J. Piekarewicz, and C. J. Horowitz, Phys. Rev. Lett. 120, 172702 (2018), arXiv:1711.06615 [nucl-th] .


# Mitigating Adversarial Attacks in Deepfake Detection: An Exploration of
Perturbation and AI Techniques

Saminder Dhesi, Laura Fontes, Pedro Machado, Isibor Kennedy Ihianle, David Ada
Adama  0000-0003-0171-7436 0000-0003-1760-3871 0000-0001-7445-8573
0000-0002-2650-857X Department of Computer Science,
Nottingham Trent University
Nottingham, UK
<EMAIL_ADDRESS>
<EMAIL_ADDRESS>
###### Abstract

Deep learning constitutes a pivotal component within the realm of machine
learning, offering remarkable capabilities in tasks ranging from image
recognition to natural language processing. However, this very strength also
renders deep learning models susceptible to adversarial examples, a phenomenon
pervasive across a diverse array of applications. These adversarial examples
are characterized by subtle perturbations artfully injected into clean images
or videos, thereby causing deep learning algorithms to misclassify or produce
erroneous outputs. This susceptibility extends beyond the confines of digital
domains, as adversarial examples can also be strategically designed to target
human cognition, leading to the creation of deceptive media, such as
deepfakes. Deepfakes, in particular, have emerged as a potent tool to
manipulate public opinion and tarnish the reputations of public figures,
underscoring the urgent need to address the security and ethical implications
associated with adversarial examples. This article delves into the
multifaceted world of adversarial examples, elucidating the underlying
principles behind their capacity to deceive deep learning algorithms. We
explore the various manifestations of this phenomenon, from their insidious
role in compromising model reliability to their impact in shaping the
contemporary landscape of disinformation and misinformation. To illustrate
progress in combating adversarial examples, we showcase the development of a
tailored Convolutional Neural Network (CNN) designed explicitly to detect
deepfakes, a pivotal step towards enhancing model robustness in the face of
adversarial threats. Impressively, this custom CNN has achieved a precision
rate of 76.2% on the DFDC dataset.

###### Index Terms:

Deepfakes, Adversarial Attacks, CNN, GAN

##  I Introduction

Nowadays, the falsification of images and videos on digital platforms is not a
new problem, but the prior techniques for detecting these were mainly focused
on face-swapping visualisation and its impact on the reputation of
celebrities. Deepfakes, a type of synthetic media generated through Deep
Learning (DL) and Machine Learning (ML) methods, were first introduced in
1997. To detect these falsified media, classification techniques are required
that focus on facial recognition through different features such as the eyes,
lips, or cheeks. The most commonly used approach is binary image
classification with supervised learning, which distinguishes between real and
fake. However, recent advancements have led to the development of more
effective deepfake detection systems using Generative Adversarial Networks
(GANs) or Autoencoders. But these require large datasets, and the limited
availability of image and video data can be a challenge to the training models
which results in poor performance, reduced predictiveness and responsiveness.

To overcome the challenges posed by deepfakes, a pairwise learning approach
can be employed to evaluate the similarity scores between inputs. Deepfakes
involve the forging of faces, and the detection and recognition of real and
fake faces is a major challenge due to factors such as lighting and facial
expressions. Deep learning methods are prioritised for extracting
discriminative features to improve robustness.

Adversarial examples in deepfake detection present a challenge to model
accuracy, as these perturbed inputs can exploit vulnerabilities and manipulate
the model output. To counteract these attacks, techniques such as cropping and
compression can be used, as well as evaluation of the robustness of sub-
sampled networks. The deepfake detection model architecture can be designed to
withstand either white-box or black-box attacks, using face recognition and
Convolutional Neural Network (CNN) for image classification and considering
different perturbations in detection methods.

Differential privacy is used to defend against adversarial attacks on ML
models by balancing accuracy and information impact within the dataset. To
address potential malicious use of ML systems, four main categories of
mitigating strategies have been proposed: rate limiting, regression testing,
anomaly detection, and human intervention. The countermeasures involve
reducing the impact of perturbations through data encryption, data sanitation,
and robust statistics, in order to minimise errors during training and
testing.

In this article, we examine the significance of deepfake detection by
examining the presence of real images and the robustness of the data. The
article will delve into the optimisation of Deep Learning models, such as CNNs
and GANs, for deepfake detection. The models will operate on a frame-by-frame
basis to analyse the temporal dependencies in videos, with Neural Networks
being utilised to accurately classify fake videos. The main focus of this
study is to address the challenges posed by deepfake generation and the use of
publicly available, standardized datasets, such as the 140k real vs. fake and
deepfake detection challenge available on Kaggle111Available online,
https://www.kaggle.com/, last accessed 09/02/2023. The structure of the
article is as follows: related work is analysed in Section II, the methodology
is presented in Section III, the results analysis in Section IV and the
conclusions and future work in Section V.

##  II Related work

Adversarial attacks are a growing concern in the field of artificial
intelligence and machine learning. These attacks involve manipulating input
data in a way that causes a model to make incorrect predictions, often with
the intent of compromising security or privacy. Some of the key challenges
posed by adversarial attacks include the need to carefully design models that
are robust against such manipulation, to develop methods for detecting and
defending against attacks in real-world scenarios, and to improve
understanding of the underlying reasons for why models can be vulnerable to
these types of attacks [1]. In response to these challenges, researchers and
practitioners are exploring a variety of countermeasures to improve the
robustness of machine learning models. These countermeasures range from
modifying model architecture and training procedures, to developing new
techniques for detecting and defending against adversarial attacks, to using
domain knowledge or other forms of auxiliary information to improve the
robustness of predictions. Additionally, researchers are also exploring the
use of formal methods and reasoning techniques to prove that models are robust
against a wide range of potential attacks, and to identify potential
weaknesses and vulnerabilities in advance. By addressing these challenges and
developing effective countermeasures, researchers and practitioners aim to
ensure that AI and machine learning systems can be deployed securely and with
confidence, and that the benefits of these technologies can be fully realised
[1].

The first reported introduction of adversarial attacks in neural networks was
by Szegedy et al. [2]. However, the lack of understanding of these attacks and
the newness of the subject area makes it difficult to criticise the potential
limitations of the methods suggested for defence. A taxonomy of adversarial
attacks has been developed through specific criteria and threat models, as
proposed by McDaniel et al. [3]. The defence against adversarial attacks can
be classified into supervised and unsupervised techniques. Supervised
strategies aim to improve the generalisation of the learning models and to
tailor specific perturbation patterns. Unsupervised strategies aim to smooth
the decision boundaries through regularisation of loss functions and the
removal of nuisance variables. The robustness of the decision boundary is
crucial in the defence against adversarial attacks and requires more
attention. The historical timeline of adversarial machine learning and the
current limitations in secure machine learning algorithms for detecting
malware have been discussed by Biggio and Roli [4].

The use of adversarial training was first introduced in Deep Neural Networkss
(DNNs) to make the functions resistant to adversarial perturbations and
maintain the accuracy of clean inputs. According to Goodfellow et al. [5],
this was achieved by relying on the linearisation of lost data points.
However, robust models against adversaries can still be vulnerable to more
iterative attacks. The ImageNet recently observed the capacity for adversarial
training using step methods. Training against multi-step methods is expected
to have better resistance against adversaries, as indicated by Madry et al.
[6]. Although the adversarial inputs may look similar to the original inputs,
the linearity of DNNs makes it possible for malicious perturbations to impact
decision-making. It is vital to note that perturbations can only address
certain types of attacks, as pointed out by Carrara et al. [7].

Adversarial attacks refer to inputs that aim to exploit flaws in a detection
system and manipulate the behaviour of trained models. Adversarial mitigation
aims to counter these attacks by making the models more robust to malicious
inputs, both during the training and decision-making phases. Attackers can use
two different techniques: data poisoning, which involves altering a few
training inputs to mislead the model’s output, and model poisoning, in which
the attacker tries to direct the model to produce a false label for perturbed
instances [8]. The issue of poison target attacks, used against DNNs, is
widespread and exploits the influences of the functions. Koh and Liang [9]
developed training with small perturbations to specific training points,
making predictions for the target set test points. DNNs are altered by adding
perturbations to input vectors, limited to modifying only one pixel in an
image. For image recognition, the accuracy is maximised. The DNN adds noise
and changes one pixel to alter the Confidence Value (CV), which is represented
by the probability distribution used by the Differential Evolution (DE)
algorithm to filter pixels and determine the correct image class. The fast-
gradient sign algorithm is primarily used to calculate the effectiveness of
perturbations for the hypothesis [10]. The linearity and high dimensionality
of inputs lead to sensitivity to perturbations. This requires consideration
for image classification, as it only works for small size (e.g. $32\times 32$)
images by modifying a specific colour to lower the network’s confidence in
iterations and resulting in new categories with the highest classification
confidence being successfully chosen [10].

Adversarial attacks pose a threat to the accuracy and reliability of machine
learning models. These attacks use bi-level optimisation control, making them
difficult to detect. Mitigation strategies to defend against these attacks
include shielding adversarial inputs through normalising raw inputs, rate
limiting, regression testing, anomaly detection, and human intervention. Rate
limiting involves limiting the number of users who can contribute to the model
and using mechanisms to prevent false positives and negatives [11]. Regression
testing involves comparing a newly trained model to baseline standards and
estimating changes in outputs of previous models. Anomaly detection locates
suspicious patterns through metadata, IP-based analysis, heuristic analysis,
analysis of temporal dynamics, and graph-based Sybil attack detection
methods[11]. Machine learning models can be attacked in various forms such as
spam emails, phishing attacks, and malware. The main types of adversarial
attacks are white box and black box attacks [8]. In a white box attack, the
attacker has complete access to the target model’s network and can exploit its
vulnerabilities. In a black box attack, the attacker does not have complete
access but can still affect the model’s performance.Another type of
adversarial attack is the grey box attack which combines elements of both
white box and black box attacks [8, 12]. Adversarial perturbation takes
advantage of the geometric correlation between decision boundaries in
classifiers. To counter adversarial attacks, methods have been proposed such
as modifying the training process, changing the network function, and using
external models for classification. A taxonomy has been created to categorise
these defence methods based on whether they modify the original network or add
to its architecture. The effectiveness of these defences against different
attack methods is yet to be fully determined, and certification is required to
ensure their reliability [13].

GANs are a type of generative model that can produce new content based on a
dataset. The unsupervised learning method can analyse, capture, and copy
variations in the data [14]. The model can add noise to improve its confidence
in predictions, but this can also result in misclassifications. The generator
and discriminator in a GAN can be used to generate fake samples of data and
detect deepfakes. Face swapping was initially used for entertainment purposes
on social media, but advancements in deep learning have made it more realistic
and difficult for forensics models to detect the fakes [15]. Deepfakes use
superimposition of faces to create synthetic media and have gained popularity
due to the improved realism produced by the application of auto-encoders and
GANs in facial recognition and media tracking. Deepfakes were first introduced
in 2017 for creating synthetic media using face swaps from adult entertainment
but have since had negative consequences for political campaigns due to
falsification [16, 17]. While deepfakes have positive applications, such as
being used in movies to reshoot scenes, the negative consequences and
potential harm outweigh the positive implications [18].

Traditional methods for detecting deepfakes in images were introduced using
CNN models and face-cropping techniques. Dolhansky et al. [19] used the CNN
model with six convolution layers and TamperNet to detect low image
manipulation [20]. Later, XceptionNet was introduced and trained on full-sized
images using separable convolution layers, which improved the precision of
TamperNet from 79.0% to 83.3% and the recall from 3.3% to 26.4% [21].
Deepfakes detection currently involves face-tracking and a CNN classifier to
determine if an image is real or fake. However, the current methods are
vulnerable to adversarial attacks, which can mislead the classification, and a
robust deepfake detector is still needed. The state-of-the-art method, iCaps-
Dfake, uses different nature feature extraction to reduce the need for pre-
processing, but it fails to consider the potential for human-created fake
images [22]. The high potential risk of misinformation and disinformation
posed by deepfakes is a growing threat to cybersecurity, especially in areas
such as non-consensual pornography, political disinformation, and financial
fraud. However, full implementation of deepfake detection methods would
require large sample datasets, which can be difficult to access.

##  III Methodology

The application was implemented in Python 3+, using Open Computer Vision
(OpenCV) for face recognition, NumPy/SciPy for computational linear algebra,
and PyTorch/TensorFlow for ML and DL techniques. Jupyter Notebook was used as
a web-based interactive computational environment for larger datasets for data
analysis, data visualisations, and exploratory computing. OpenCV was
incorporated for pre-processing the dataset to handle this data type. The
project mainly used TensorFlow for high-level model development with more
mature libraries and built-in artificial intelligence. The framework is
prevalent under Central Processing Unit (CPU), but for faster training
potential, Graphic Processing Unit (GPU) such as Compute Unified Device
Architecture (CUDA) can be used. Nevertheless, the machine used for the
project was an Intel(R) Core™ i7 CPU @ 1.80GHz with 64GB of Random Access
Memory (RAM) and was not equipped with an NVIDIA GPU.

The project primarily used two datasets: the Deepfake Detection Challenge
(DFDC) 222Available online, https://www.kaggle.com/c/deepfake-detection-
challenge, last accessed: 15/02/2023 and COVID333Available online,
https://www.kaggle.com/datasets/pranavraikokte/COVID19-image-dataset, last
accessed: 19/02/2023. These datasets were chosen due to their ability to be
used on wide range of models and techniques. The criteria for selecting these
datasets included two classes, a large number of images or videos, and little
to no noise in the real class. Noise in the dataset would include low
resolution, poor quality images with low pixel count and irrelevant images. A
large number of visual representations in each class is crucial to detecting
deepfakes by adopting training within Python. The CNN requires a large number
of images to differentiate between the classes. To create the fake visuals,
the project uses competing neural networks between the generator network and
the discriminator network. The noise in the dataset needs to be minimal for
the optimum processing of data, as generating poor results would not apply to
the class.

Furthermore, the Real vs. Fake dataset is a large collection of non-celebrity
face images, with 140,000 faces equally split between real and fake, collected
by NVIDIA. These images were generated using StyleGAN and have been
standardised by resizing to 256 pixels in JPG format. The dataset is split
into train, test, and validation sets, with a 60:20:20 ratio, and each set has
a corresponding CSV file. The dataset contains a variety of genders, ages,
races, and facial features. Although unsupervised clustering was suggested for
the dataset by the DFDC Kaggle forum, it was considered out of the scope of
this project. The test folder contains unclassified images that participants
can use to test the accuracy of the models they create. The DFDC dataset [23]
was released by Facebook and consists of 50 files of training data, with a
total size of 470 GB, and a metadata JSON file with labels. The dataset is
split into train and test sets in an 80:20 ratio. The test set contains a
smaller sample of MP4s, which is used for validation. The videos were recorded
under various conditions, with different lighting and backgrounds and a
variety of people. We also tested the models against the COVID dataset which
is composed of 137 cleaned images of COVID-19 based images and more 317 in
total containing Viral Pneumonia and Normal Chest X-Rays structured into the
test and train directories.

The following step was to train and test the deepfake detection framework
using CNN (see Figure 1) and GAN. Before training the model, the Real vs. Fake
dataset was pre-processed, and the images resized to $256\times 256$ JPG
format. The dataset was split into 60% for training, 20% for validation, and
20% for testing, which allows the model to learn patterns to classify faces in
the training set and validate the learning on the validation set before
testing on the test set. This approach is important for preventing
overfitting, which occurs when the model performs well on the training data
but is unable to generalise to new data. While other datasets only have a
train and test set, the Real vs. Fake dataset has a validation set to help the
model generalise better. To ensure the model is effective, it was important to
use a large sample size in each class while avoiding excessive data that could
be time-consuming to process under CPU. The model’s ability to distinguish
between the labelled sets will be tested using the test set. It was crucial to
accurately classify the detection to avoid potential errors caused by
overfitting or underfitting.

Figure 1: Customised 7-layer CNN architecture. The network is composed of 3
convolutional layers, 3 fully connected layer and the classification layer.

To customise the CNN and GAN models, the pre-trained models were split into
specific algorithms with distinct uses. CNN, for example, was used for two-
dimensional image classification and can learn position and scale variants in
the data structure using spatial relationships. ResNet50 was used to boost
neural network performance by adding more layers to the network and finding
the predicted and residual of each result. GAN was used to distribute any data
for generating instances, which is specifically useful for deepfake detection.
To evaluate the performance of the models, appropriate parameters such as
epochs, batch size, and activation filters were standardised to enable
comparisons and detect issues.

During the testing phase, it is possible that the custom model may produce
higher error rates due to false negatives that occur in the computational
environment compared to real-world scenarios. This is a consequence of not
having optimal labels with or without parallax errors that affect the position
of the image or video. To ensure accurate results, it was important to clean
the dataset of all noise and reduce the margin for error. The DFDC video
dataset presents a different challenge as it is in MP4 format and requires
analysis frame-by-frame for detection. The CNN classifies each frame as real
or fake, and the goal is to minimise the adversary perturbation from the delta
that was used to create the adversarial input, which is discussed further
below. To classify an image in PyTorch, the first step is to normalise it by
subtracting the mean and dividing the result by the standard deviation. This
transformation is applied using PyTorch layers, and the resulting image is
resized to $224\times 224$ pixels, which is the standard input size. A pre-
trained ResNet50 model can then be used to classify the image, producing a
probability vector by applying a SoftMax operator. The classifier can be fine-
tuned to adjust the probabilities based on the specific task at hand. This is
done using the hypothesis function:

$h_{\theta}:\chi\to\mathbb{R}^{k}$ (1)

where $h_{\theta}$ is the mapping between input space and output space, which
is a k-dimensional vector. Here, k is the number of classes predicted;
$\theta$ represents all parameters within the model (such as convolution
filters or fully convolved layers), which are typically optimised while
training the neural network. The precision of the model object is linked to
$h_{\theta}$. The loss function is given by:

$l:\mathbb{R}^{k}.\mathbb{Z}{+}\to\mathbb{R}{+}$ (2)

Here, $l$ maps the model’s prediction and labels of non-negative numbers. The
model output for the logics can be positive and negative for the second
argument in the index for distinguishing the true class. For $x\in X$ the
input and $y\in\mathbb{Z}$ the true class, the loss function computes the
difference between the model’s prediction and the true label. The most
prevalent form of loss in deep learning is the cross-entropy loss (SoftMax),
defined as:

$l(h_{\theta}(x),y)=log\left(\sum_{j=1}^{k}exp(h_{\theta}(x_{j}))\right)-h_{\theta}(x)y$
(3)

Here, $h_{\theta}(x_{j})$ denotes the $j^{th}$ term for the vector
$h_{\theta}(x)$. The adversarial example is used to manipulate the loaded
image, which enables the classifier to lower the probability of recognising
the deepfake image. The approach is used to train for optimisation on the
parameters to minimise the average loss in the training set:

$min=\frac{1}{m}\sum_{m}^{i=1}l(h_{\theta}(x_{i}),y_{i})$ (4)

Here, the parameter $\theta$ is optimised to minimise the average loss over
part of the training set. Another form involves adjusting the image to
optimise the network parameters that will adjust the image for maximising the
loss. This is done to solve the optimisation problem with the equation below:

$max=l(h_{\theta}(\hat{x}),y)$ (5)

Here, $\hat{x}$ denotes the adversarial example for maximising the loss. The
gradient step is used for adjusting the optimiser to perturbations for
maximising the loss for the training set. This allows computing the
probability and then adding the delta as random noise for the adversarial
attack, which creates an image that looks identical, but the probability of
classifying it is significantly reduced. Finally, targeted attacks can also be
used to maximise the loss of a specific target class in the probability
vector, by minimising the loss of that target class through linear
optimisation. Adversarial robustness is a significant challenge when it comes
to attacking deep learning classifiers, as these attacks aim to modify
existing images in the training set. It is important to consider the potential
adversarial risks that may arise, such as retaining specific regions of
perturbations to encode the images.

##  IV Results analysis

Organising the dataset into the correct format is critical for the success of
the project. One of the main challenges we encountered was resizing the images
or video frames to dimensions suitable for specific models. Another issue was
the limited availability of real images of target faces, which made it
difficult to create a balanced dataset for binary classification. In
comparison, there were more deepfake faces available in the real-life dataset.
We started with binary classification, a supervised machine learning technique
that involves making observations and classifications. We used a simple CNN to
train the custom model on a variety of different faces in the Real vs. Fake
dataset, and then moved on to the DFDC dataset. Since we were learning a new
language, training the model on a CPU was time-consuming. To generate
predictions, we trained a single model with balanced classes, and the dataset
was categorised into distinct classes for labelling and targeting purposes. We
also found that we needed to convert the DFDC dataset into images to apply any
algorithm once frame-by-frame detection had occurred.

In deep learning, the mapping process is used to detect deepfakes by
categorising them as either real or fake. CNNs are particularly effective in
image recognition and are commonly used to train the dataset. The process
involves training the weights with input images and validating the performance
of the network. The input images are processed through a series of layers,
including convolution layers, pooling layers, and fully connected layers,
which are then activated by a sigmoid function. This efficient image
recognition and classification is what makes CNNs an ideal technique for
detecting deepfakes. This process can be visualised through the mathematical
equation:

$n(out)=\left[\frac{n(in)+2p-k}{s}\right]+1$ (6)

where $n(in)$ is the number of input features, $n(out)$ is the number of
output features, $k$ is the convolution kernel size, $p$ is the convolution
padding size, and $s$ is the convolution stride size.

The model summary provides insight into the architecture of the model, which
includes 6 layers consisting of 4 convolution layers and 2 fully connected
layers. To identify the 80,000 images belonging to 2 classes - real (1) or
fake (0) - binary encoding is applied. The generator is then initialised to
flow the data to the fit generator for training the model and validating its
accuracy. As shown in Figure 2, the blue line represents the validation loss,
while the orange line represents the validation accuracy. The trained CNN
model demonstrated a precision value of 0.748, which indicates that around
three quarters of the images were classified correctly. It’s expected that
larger models, such as ResNet50, may produce better precision, as their
features are more selective. The number of epochs refers to the full pass of
the training set through an algorithm, and hyperparameters can be specified to
determine the number of epochs. The model’s internal parameters are updated
with each epoch, which results in the gradient learning algorithm. The epoch
number and factor rate will become zero over time as the algorithm learns.
Achievable reasonable test correctness is required to apply this complexity to
real-world applications. To achieve a less biased estimate and enhance the
model, k-fold cross-validation can be used.

When evaluating classification performance, accuracy is a common metric used
to measure how well the model has correctly classified the samples. It can be
calculated using the equation:

$Acc=\frac{TP+TN}{TP+FP+TN+FN}$ (7)

where $TP$ is the number of true positives, $TN$ is the number of true
negatives, $FP$ is the number of false positives, and $FN$ is the number of
false negatives. The accuracy score gives the proportion of correctly
classified samples out of the total number of samples.

Accuracy is a common metric used to assess the performance of a classification
model. It is calculated as the ratio of correctly classified samples to the
total number of samples. However, accuracy alone does not take into account
the loss function used by the model. To address this issue, the cross-entropy
function is often used instead of accuracy. A high accuracy value is
desirable, but the focus should also be on maximising the cross-entropy
function to achieve the best results. Figure 2 shows the results of using the
cross-entropy function to measure the performance of a model. The R2 value of
0.9987 indicates high accuracy of the predictions, but increasing the number
of epochs may further improve the results. When training the model, it was
found that the precision increased as the number of epochs increased. This
suggests that the model is learning the specific patterns that are important
for detecting deepfakes. In comparison to a custom model, the pretrained
convolutional base used in this study achieved higher accuracy with consistent
performance across different epochs. The pretrained model is tuned for quicker
training time and is able to classify real and deepfake images with high
accuracy. The study’s accuracy of 87.3% for detecting deepfakes is higher than
that reported in the literature for the DFDC dataset (79%), which could be
attributed to the larger Real vs. Fake dataset used in this study. Overall,
the results suggest that using a pretrained model can lead to better
performance for deepfake detection.

Figure 2: The epochs and Accuracy on Real vs. Fake dataset with CNN model

The classification model’s matrix parameters are set to predict the majority
class frequency for null error rate conditions. This means that the model’s
error rate is preferred to be higher than the null Real error rate. The
receiver operating characteristics (ROC) curve is used to evaluate the
classifier’s performance, and a desirable threshold is chosen, as seen in
Figure 2.

The linear regression model with the same model and parameters can also be
used for classification, but if the classification exceeds 1, logistic
regression is necessary to predict real and fake labels. The error function of
the linear regression model includes weighting parameters that are used in the
gradient descent optimisation algorithm to minimise the misclassification
error. Figure 3 shows the logarithmic loss metric, which evaluates the
probability of correctly classifying the data. This metric can be used to
compare models based on the following equation, primarily for binary
classification:

$-\frac{1}{N}\sum_{i=1}^{N}y_{i}.log(p(y_{i})+(1+y_{i}).log(1-p(y_{i}))$ (8)

In this equation, the first term is zero for the binary cross-entropy model
when the actual class is 1 (real) and the other actual class is 0 (fake).
Additionally, the binary cross-entropy model is less exponential than typical
regression curves and tends to be more symmetric. This could be due to the
possibility of overfitting when there is no validation set, as shown in Figure
3.

Figure 3: Logarithmic loss using logistic regression for DFDC dataset for
inception at 0.6

Equation 8 shows the binary cross-entropy model used primarily for binary
classification. When the actual class is 1 (real), and the other actual class
is 0 (fake), the first term of the equation becomes 0. Unlike typical
regression curves, this model is seen to be less exponential and tends to hold
more symmetry. However, this could be due to the potential of overfitting, as
shown in Figure 3, which may result from the absence of a validation set. Most
models would have concluded that the entire video is real, regardless of
whether a single frame is fake. However, state-of-the-art detection confirms
that each frame needs to be investigated. The frame-by-frame detection can
later be used in a white-box setting to propagate the loss in the entire model
when adding perturbations, obtaining a gradient for adversarial frames. This
is because current deepfake detection DNNs are assumed to be non-adaptive in
attacks that aim to withstand human eyes, generating realistic fake videos.

The customised GAN used to implement the losses of both the discriminator and
generator models, and their training process does not exhibit a clear pattern.
Recent advancements in deep learning have leveraged data augmentation
techniques, such as cropping, flipping, and zooming, to improve model
performance in a given domain, typically applied to image data. In GANs, the
generator and discriminator compete against each other, with each trying to
achieve a higher loss than the other, creating an environment for learning
from the training data based on the received loss. In Figure 4, the
convergence of the Real vs. Fake plot indicates that the model has reached a
maximum level of performance, and any additional enhancements are unlikely. It
is worth noting that the D loss is less interactive than the G loss, which is
not counterbalanced as in a traditional model. This implies that the generator
will be improved in the next iteration, and synthetic observations of good
quality can be generated. A generator with 100% accuracy would generate
synthetic samples that the discriminator could classify as real, whereas a
discriminator with 50% accuracy would be unable to distinguish fake
observations from real ones.

Figure 4: GAN graph for D and G losses in Real vs. Fake dataset strength of
real estimates for the epoch trained. The Y axis is the real indices that has
been standardised and the x-axis represents the epoch

To illustrate how these models can be applied to real-world scenarios, let’s
consider the example of a COVID dataset. As shown in Figure 5, this dataset
was used to train a binary classification model with a limited amount of data.
Since there were only 100 images in each class, the model had to be carefully
adapted to these weights in order to learn to accurately classify COVID
positive and negative cases. It’s worth noting that in real-life scenarios,
obtaining a large, diverse dataset can be challenging, and may require a
significant amount of effort to collect and label the data. Nonetheless, even
with limited data, it’s possible to train a model that can provide valuable
insights and predictions. As the field of deep learning continues to evolve,
new techniques and approaches are being developed to address these challenges
and improve the performance of models with limited data.

Figure 5: The epochs and validation for COVID dataset against validation loss
(blue) and validation accuracy (orange) with CNN model.

White box perturbations refer to a type of attack where an adversary has
access to a machine learning model’s architecture and parameters. By
exploiting this information, the adversary can create an output gradient that
generates an adversarial example using the model’s gradient and loss. This is
done by adding perturbations to the input, which can cause the model to
incorrectly classify the input, moving it closer to the decision boundary
between the true class (real) and the other class (fake). The goal of white
box perturbations is to decrease the predictability of the input and generate
an attack that is imperceptible to the human eye.

In the image domain, the Lp norms are used to measure the amount of
perturbation by quantifying the maximum distortion added to individual pixels
in the image. The primary objective of adversarial perturbations is to
generate an attack that is imperceptible to the human eye. For example, if a
model’s initial prediction for the true class probability of a given image is
10.9, indicating that it is a real image, an adversarial attack can reduce the
true class probability to $2.26e^{-18}$ by subjecting the image to a delta
(perturbation), leading to misclassification.

Table I shows the Probability of true class in Real vs. Fake dataset as the
iterations of each degradation that the attack applies to the image,
ultimately resulting in misclassification. In summary, white box perturbations
allow adversaries to create adversarial examples by exploiting a model’s
parameters and architecture. These attacks are difficult to detect because
they generate imperceptible changes to the input, making them a serious threat
to the security of machine learning models.

TABLE I: Probability of true class in Real vs. Fake dataset before adding delta for perturbation. Delta | True Class probability
---|---
0 | 10.90469
5 | 35.33980
10 | 40.24509
15 | 37.24498
20 | 37.62185
25 | 40.85791

It is important to note that the adversarial attack significantly degrades the
accuracy of the model, reducing the probability of correctly detecting an
actual attack. While the cost of an error on the adversarial input may not be
high in real-life applications, a decrease in accuracy can have severe
consequences. In particular, classification errors can lead to the abstention
of detecting inputs, and the significant amount of noise applied in these
datasets can result in further classification refusals. It’s crucial to
consider the domain of the system being used, as the difference in error rates
between random inputs and adversarial inputs can vary depending on the
application.

To ensure the validity of the testing results, it was crucial to avoid using
the adversarial attacks on the training set, which is a common pitfall in
evaluating the robustness of models. This was especially important when
applying the attacks to a defence mechanism, as the overfitting can be against
a particular attack that was included in the training set. Some attacks may be
effective on both training and testing sets, which could potentially
overestimate the model’s robustness. Therefore, the strongest attack against a
custom model requires a specifically tuned approach tailored to the model’s
architecture. To evaluate the potential of invalidating the model’s
robustness, it was necessary to consider errors that may deviate from
classifying the correct class. To ensure the testing is effective, it was
essential to define a precise threat model that assumes the attacker’s
knowledge, goals, and capabilities. Finally, to perform an adaptive upper
bound of robustness, the loss function should be changed to cause
misclassification, while the defence mechanism is evaluated.

##  V Conclusions and Future Work

This article proposes a state-of-the-art DeepFake detector network that
utilises machine learning techniques to mitigate adversarial attacks on
autonomous systems that are vulnerable to deepfakes. To evaluate the efficacy
of the proposed approach, a transferable white-box attack via perturbations
was developed to pose a practical threat to the deepfake detection system. The
attack was applied to a variety of DFDC and COVID datasets, to demonstrate the
effectiveness of the proposed algorithms on DL techniques such as CNN and GAN.
The proposed approach showed promising results for detecting deepfakes,
achieving a precision value of accuracy of 76.2% on the DFDC dataset. However,
this result can be improved by increasing the volume of media in the datasets.
The detection models were able to distinguish between real and fake media and
can be applied in real-life scenarios such as the COVID dataset. To evaluate
the system’s robustness against adversarial attacks, white-box attacks via
perturbation were applied to distort the images. The Real vs. Fake dataset’s
classification probability was reduced from 10.9 to $2.26e^{-18}$ with the
addition of perturbation, and the COVID dataset’s probability was reduced from
11.1 to $1.46e^{-16}$. The proposed method offers an effective approach to
detecting deepfakes by incorporating adversarial examples through white-box
attacks that use perturbations to decrease classification probability.

The proposed work on mitigating adversarial attacks and detecting deepfakes
has significant ethical impacts. Deepfakes, which are manipulated media that
appear real, can be exploited to deceive, manipulate public opinion, spread
misinformation, and facilitate cybercrime. The proposed DeepFake detector
network aims to address these ethical concerns by safeguarding truth and trust
in digital media, mitigating social and political manipulation, and protecting
privacy and consent. This work has implications for individuals,
organizations, and society as a whole.The proposed work on mitigating
adversarial attacks and detecting deepfakes has significant ethical impacts.
Deepfakes, which are manipulated media that appear real, can be exploited to
deceive, manipulate public opinion, spread misinformation, and facilitate
cybercrime. The proposed DeepFake detector network aims to address these
ethical concerns by safeguarding truth and trust in digital media, mitigating
social and political manipulation, and protecting privacy and consent. This
work has implications for individuals, organizations, and society as a whole.
From a business perspective, the impact of Artificial Intelligence (AI) in
relation to deepfake detection and AI-based technologies is notable. By
incorporating AI-powered deepfake detection systems, businesses can enhance
trust and reliability in their digital media content. This helps demonstrate
their commitment to authentic communication, transparent marketing practices,
and reliable representation of products or services. Additionally,
implementing robust deepfake detection mechanisms safeguards brand reputation
by proactively identifying and addressing potential threats that manipulate
brand images or spread false information. Furthermore, integrating deepfake
detection systems into cybersecurity strategies strengthens defences against
malicious activities such as impersonation, unauthorised access, and fraud,
ensuring the integrity and authenticity of digital interactions. From a
business perspective, the impact of AI in relation to deepfake detection and
AI-based technologies is notable. By incorporating AI-powered deepfake
detection systems, businesses can enhance trust and reliability in their
digital media content. This helps demonstrate their commitment to authentic
communication, transparent marketing practices, and reliable representation of
products or services. Additionally, implementing robust deepfake detection
mechanisms safeguards brand reputation by proactively identifying and
addressing potential threats that manipulate brand images or spread false
information. Furthermore, integrating deepfake detection systems into
cybersecurity strategies strengthens defences against malicious activities
such as impersonation, unauthorized access, and fraud, ensuring the integrity
and authenticity of digital interactions.

In terms of future work, this study can serve as a starting point for
generating perturbations by minimising the likelihood of correct class
classification. Another objective could be to work on detecting deepfakes in
audio for video media. Additionally, further advancements in the field of
deepfakes would require obtaining larger datasets and training models using
OpenCV architecture in Python. To handle increased input size, it would be
necessary to standardise parameters such as image or video size. This can help
improve the model’s performance. In addition, a promising direction of
research would be to work on a physical ”adversarial patch” which could
enhance facial recognition by allowing the classifier to add any image or
video to the chosen target class, misclassifying the arbitrary modification of
each pixel, ultimately defending against adversarial attacks. Lastly, the
methodology developed in this study could be extended beyond the forensic
domain of deepfake detection, to enable 3D object localisation for use in
robotic applications such as self-driving vehicles.

## References

  * [1] I. Ilahi, M. Usama, J. Qadir, M. U. Janjua, A. Al-Fuqaha, D. T. Hoang, and D. Niyato, “Challenges and countermeasures for adversarial attacks on deep reinforcement learning,” _IEEE Transactions on Artificial Intelligence_ , vol. 3, no. 2, pp. 90–109, 2021.
  * [2] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” _arXiv preprint arXiv:1312.6199_ , 2013.
  * [3] P. McDaniel, N. Papernot, and Z. B. Celik, “Machine learning in adversarial settings,” _IEEE Security & Privacy_, vol. 14, no. 3, pp. 68–72, 2016\.
  * [4] A. Demontis, M. Melis, M. Pintor, J. Matthew, B. Biggio, O. Alina, N.-R. Cristina, F. Roli _et al._ , “Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,” in _28th USENIX security symposium_. USENIX Association, 2019, pp. 321–338.
  * [5] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” _arXiv preprint arXiv:1412.6572_ , 2014.
  * [6] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” _arXiv preprint arXiv:1706.06083_ , 2017.
  * [7] F. Carrara, F. Falchi, R. Caldelli, G. Amato, and R. Becarelli, “Adversarial image detection in deep neural networks,” _Multimedia Tools and Applications_ , vol. 78, pp. 2815–2835, 2019.
  * [8] _Deep Neural Network based Malicious Network Activity Detection Under Adversarial Machine Learning Attacks_ , ser. LNCS, vol. 5805. Springer, 2020.
  * [9] P. W. Koh and P. Liang, “Understanding black-box predictions via influence functions,” in _International conference on machine learning_. PMLR, 2017, pp. 1885–1894.
  * [10] J. Su, D. V. Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” _IEEE Transactions on Evolutionary Computation_ , vol. 23, no. 5, pp. 828–841, 2019.
  * [11] L. Muñoz-González, B. Pfitzner, M. Russo, J. Carnerero-Cano, and E. C. Lupu, “Poisoning attacks with generative adversarial nets,” _arXiv preprint arXiv:1906.07773_ , 2019.
  * [12] Y. Wang, Y.-a. Tan, W. Zhang, Y. Zhao, and X. Kuang, “An adversarial attack on dnn-based black-box object detectors,” _Journal of Network and Computer Applications_ , vol. 161, p. 102634, 2020.
  * [13] N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” _Ieee Access_ , vol. 6, pp. 14 410–14 430, 2018.
  * [14] H. Yang, D. Huang, Y. Wang, and A. K. Jain, “Learning face age progression: A pyramid architecture of gans,” in _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 2018, pp. 31–39.
  * [15] I. Korshunova, W. Shi, J. Dambre, and L. Theis, “Fast face-swap using convolutional neural networks,” in _Proceedings of the IEEE international conference on computer vision_ , 2017, pp. 3677–3685.
  * [16] V. Badrinarayanan, A. Kendall, and R. Cipolla, “Segnet: A deep convolutional encoder-decoder architecture for image segmentation,” _IEEE transactions on pattern analysis and machine intelligence_ , vol. 39, no. 12, pp. 2481–2495, 2017.
  * [17] E. Zamyatin and A. Filchenkov, “Learning to generate chairs with generative adversarial nets,” _Procedia Computer Science_ , vol. 136, pp. 200–209, 2018\.
  * [18] K. Demetrious, “Book review: Gareth thompson, post-truth public relations: Communication in an era of digital disinformation jim macnamara, beyond post-communication: Challenging disinformation, deception and manipulation,” 2021\.
  * [19] B. Dolhansky, R. Howes, B. Pflaum, N. Baram, and C. C. Ferrer, “The deepfake detection challenge (dfdc) preview dataset,” _arXiv preprint arXiv:1910.08854_ , 2019.
  * [20] R. Skibba, “Accuracy eludes competitors in facebook deepfake detection challenge,” 2020.
  * [21] G. Wang, G. Yuan, T. Li, and M. Lv, “An multi-scale learning network with depthwise separable convolutions,” _IPSJ Transactions on Computer Vision and Applications_ , vol. 10, no. 1, pp. 1–8, 2018.
  * [22] S. S. Khalil, S. M. Youssef, and S. N. Saleh, “icaps-dfake: An integrated capsule-based model for deepfake image and video detection,” _Future Internet_ , vol. 13, no. 4, p. 93, 2021.
  * [23] B. Dolhansky, J. Bitton, B. Pflaum, J. Lu, R. Howes, M. Wang, and C. C. Ferrer, “The deepfake detection challenge (dfdc) dataset,” 2020. [Online]. Available: https://arxiv.org/abs/2006.07397