Lightweight Preprocessing Defenses for Robust Deepfake Detection Against Adversarial Perturbations

초록

Deepfake detection models achieve high performance on benchmark datasets yet underperform against adversarial perturbations. This paper investigates lightweight, model-agnostic input preprocessing as a defense mechanism against such perturbations. We evaluate 17 preprocessing configurations - ranging from simple compression to multi-step transformations - against Statistical Consistency Attack (StatAttack) on two well-known models: CNN (XceptionNet) and Vision Transformer (ViT-small). Our experiments on the FaceForensics++ and Celeb-DF v2 datasets demonstrate that specific pipelines - particularly those combining smoothing with structural restoration (e.g., Gaussian blur + sharpening, JPEG compression + rescaling) - can significantly recover detection performance under attack without model retraining. For instance, blur + sharpening recovered XceptionNet's F1 score from 0.8687 to 0.9856 under StatAttack on Celeb-DF v2. These findings suggest that inference-time preprocessing offers a scalable, cost-effective defense layer for deepfake detection systems.

키워드