{'fraction_non_alphanumeric': 0.02933405595826841, 'fraction_numerical': 0.010432897500169366, 'mean_word_length': 4.798114689709348, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Learning to Detect Fake Face Images in the Wild

Although Generative Adversarial Network (GAN) can be used to generate the realistic image, improper use of these technologies brings hidden concerns. For example, GAN can be used to generate a tampered video for specific people and inappropriate events, creating images that are detrimental to a particular person, and may even affect that personal safety. In this paper, we will develop a deep forgery discriminator (DeepFD) to efficiently and effectively detect the computer-generated images. Directly learning a binary classifier is relatively tricky since it is hard to find the common discriminative features for judging the fake images generated from different GANs. To address this shortcoming, we adopt contrastive loss in seeking the typical features of the synthesized images generated by different GANs and follow by concatenating a classifier to detect such computer-generated images. Experimental results demonstrate that the proposed DeepFD successfully detected 94.7% fake images generated by several state-of-the-art GANs.


I. INTRODUCTION
With the rapid growth of deep learning techniques for image generation, the security issues because of malicious uses of such image generation/synthesis became more important. For example, progressive growing of GANs (PGGAN) proposed by nVidia [4] have demonstrated that the realistic and highresolution face images can be easily synthesized. It can be used to create a fake personal account on Facebook to cheat something or someone [1]. It will cause very serious problems on the society, political, and commercial activities. Therefore, an effective and efficient images forgery detection technique is desired.
To address the issue of image forgery detection, there are two different categories in the traditional approach: 1) extrinsic feature and 2) intrinsic feature. First forgery detection will embed external unique signals into the original images (e.g. digital watermarking). Then, the received image can be verified whether it is a forgery or not by comparing the extracted watermark and the original watermark. The second strategy will tend to discover the intrinsic and invariant features from the original images. The forgery image should be able to detected by checking the statistical property of the extracted intrinsic feature from the received image because any tampered operation will make the intrinsic feature changed. The first strategy needs the original externally signal to check whether it is a forgery or not. In general, it is relatively hard to have originally external signal (i.e. watermark) for any received image. In contrast, the second strategy only seeks the intrinsic feature of the received image, finding the unusual statistical property of it, to detect whether it is a forgery or not [3].
There are several approaches to find the intrinsic features of images to determine the tampered images [2][3] The forgery detection technique in [2] finds sensor pattern noise as the intrinsic feature. Double compression cues are used in [13] as the intrinsic feature for JPEG formatted image. However, traditional forgery detection techniques are hard to detect the generated images by GANs since their image content are made by deep neural network directly. Therefore, it does not exist any unusually statistical property in the intrinsic features of the received images, leading to traditional forgery detection approach fails to detect the generated images. To solve this shortcoming, we propose a deep neural network called deep forgery discriminator (DeepFD) based strategy to effectively and efficiently detect the generated / fake images synthesized by GANs or other advanced networks.
There is an easy to train a deep neural network classifier to distinguish fake images and real images by collecting a large training set containing fake and real images. However, the trained classifier might be ineffectively to detect the fake images synthesized by a new GAN or other advanced generators because it did not learn the discriminative features from newly generated images. In general, it is hard to collect training images generated by all possible GANs or image synthesizers. Moreover, there are many new GANs proposed every year. Such strategy needs to re-train the classifier to keep its performance when there is a new GAN proposed. To ensure the performance of the proposed DeepFD, we tend to learn the jointly discriminative features from collected training images across different GANs by introducing the contrastive loss into the network learning framework [12]. Contrastive loss learns such joint features from heterogeneous training images by introducing the pairwise information so that the DeepFD should be able to effectively distinguish any fake image generated by any GAN. Besides, the proposed DeepFD can further localize unrealistic details of the fake image based on a fully convolutional architecture. Our contributions are summarized below:


We propose a novel deep neural network based discriminator based on contrastive loss, upon which we can distinguish the fake images generated by any GANs. To the best of our knowledge, the proposed method is the first research effectively addressing generated image detection.  The proposed DeepFD can be used to localize unrealistic details of the fake image and we can follow such regions to further improve the performance of the proposed DeepFD. The rest of this paper is organized as follows. Sec. II presents the proposed DeepFD for forgery image detection. In Sec. III, experimental results are demonstrated. Finally, conclusions are drawn in Sec. IV. Figure 1 shows the flowchart of the proposed DeepFD. In the proposed method, we have two learning phases. First, we collect a lot of fake images synthesized by several GANs called example-generative model and real images to learn the jointly discriminative features D1 based on the proposed contrastive loss. Afterward, a discriminator (classifier) D2 will be concatenated to the D1 to further distinguish fake images. In the test phase, it is easy to distinguish the test image whether it is fake or real by D1 and D2 directly. The details of network architectures in D1 and D2 are respectively described in Table I. Note, the classifier D2 is directly concatenated to the 4 th layer of the jointly discriminative feature learning network D1.

II. THE PROPOSED DEEP FORGERY DISCRIMINATOR
Let the training set collected from M GANs be where each GAN will generate training images. Let the real training set be = [ =1 , =2 , … , = ] containing training images. Total number of training images containing real and fake images will be = + = + ∑ =1 . The label Y = [y 1 , y 2 , … , y ] indicates the image is fake (y=0) or real (y=1). To integrate the pairwise information into learning architecture, there are C( , 2) pairs in the pairwise information P = [ =0, =0 , =0, =1 , … , =0, = , … , = , = ]. In general, it is unnecessary to generate all possible pairs to learn the jointly discriminative features of the fake images. In our experiments, it is enough that we adopt 1 million pairs to learn the joint feature.

A. Jointly Discriminative Feature Learning
Let the feature representation R = D 1 ( ). With a paired input images, the purpose of jointly discriminative feature learning is to minimize the similarity function defined as follows: where we use the exact same network D 1 to extract the features of the paired input images. Directly minimizing E ( 1 , 2 ) may lead the feature representation D 1 ( ) to a constant mapping [12]. This situation will make the feature representation ineffective and useless. In contrast, we introduce the contrastive loss: ( , ( , 1 , 2 )) where E = ‖D 1 ( 1 ) − D 1 ( 2 )‖ and m is the predefined marginal value. In this manner, it is possible to learn the common characteristic of the fake images generated by different GANs. With the contrastive loss, the feature representation D 1 ( ) will tend to become similar to D 1 � � if = 1 (i.e., fake-fake or real-real pair). By iteratively train the network D1 based on the contrastive loss, the jointly discriminative feature should be able to be well learned.

B. Classifier Training
Once the jointly discriminative feature representation has learned, there are several ways to classify the received images such as SVM, random forest classifier, or Bayer classifier. In this work, we directly concatenate a convolutional layer and a fully connected layer to the network D1 (See details in Table I).
In this way, the proposed DeepFD will be an end-to-end architecture.
The loss function of the classifier can be defined as a crossentropy loss:  Fig. 1 The flowchart of the proposed deep forgery discriminator (DeepFD). Example-generative model (one or more than one models) will continuously synthesize training samples for the proposed DeepFD training.
The classifier can be easily trained by back-propagation [10]. Note, the parameters in all layers in D1 will be updated as well because the jointly discriminative feature learned by D1 might be further improved. In this way, we believe that the fake image can be effectively detected.

A. Experimental Settings
To generate the training samples, the CelebA dataset will be used in this experiments. The images in CelebA cover large pose variations and background clutter including 10,177 number of identities and 202,599 aligned face images.
In experiments, we collected five state-of-the-art GANs to generate the fake images pool: 1) DCGAN (Deep convolutional GAN) [6] 2) WGAP (Wasserstein GAN) [7] 3) WGAN-GP (WGAN with Gradient Penalty) [8] 4) LSGAN (Least Squares GAN) [9] 5) PGGAN [4] Each GAN will be used to generate 200,000 fake images sized of 64 × 64 into the fake image pool. PGGAN will produce a high-resolution result sized of 64 × 64 . We downsample the fake images generated by PGGAN into resolution 64 × 64 to have a fair comparison. Since the resolution of fake image of PGGAN is downscaled into 64 × 64, the recognition task is relatively difficult because some unrealistic details of the fake images are eliminated. Then, we randomly pick 202,599 fake images from the fake image pool. Finally, we have 400,198 training images and 5,000 test images containing real and fake images.
In the parameters setting of D1 and D2, the learning rate is 1e-3 and the maximum epoch is 15. The marginal value m in contrastive loss is 0.5. Adam optimizer [11] is used for training D1 and D2. In first two epochs, we only adopt pairwise information to learn D1. Afterward, the collected fake and real images will be used to learn D2. The batch size is 32.
A traditional image forgery detection is used for comparison [3]. We also design a baseline approach based on the proposed DeepFD without contrastive loss to emphasize our contribution. On the other hand, we also remove the proposed classifier and replace it with other advanced classifiers such as RFC (Random forest classifier), SVM (Support vector machine), and LC (Linear classifier) to demonstrate the effectiveness of the proposed DeepFD.  Fig. 2 The curve of the contrastive loss for learning D1 using pairwise information. To obtain the jointly discriminative feature for our task, we adopt pairwise information to guide D1 learning in two epochs. Figure 2 shows that the proposed contrastive loss is stable and will be converged. Although the contrastive loss is no longer used after 25,000 iterations (2 epochs), the contrastive loss did not increase. It has also verified a fact that the jointly discriminative feature learning is associated with classifier learning. Figure 3 presents the test accuracy comparison between the proposed DeepFD with and without contrastive loss learning. It is clear that the proposed DeepFD is easily converged and reach higher performance.

B. Performance Comparison
To demonstrate the effectiveness of the proposed DeepFD, we separate the fake images generated by one of the collected GAN methods from the training pool. A generalized DeepFD should be able to detect the fake images even they are not used in the training. Table II indicates the performance comparison between the proposed DeepFD and other baseline methods in terms of accuracy, precision, and recall. The proposed DeepFD significantly outperforms other techniques. It is also verified that the proposed DeepFD is more generalized and effective than others. On the other hand, we observed that the performance gain of the proposed method for the training dataset excluding LSGAN is significantly better because that the LSGAN shows fewer unrealistic details in the generated images. Therefore, the purely supervised approach (i.e., the proposed method without contrastive loss) cannot well capture the common features for the fake image. The proposed DeepFD is easier to extract the jointly discriminative feature for all kinds of the fake images, leading to higher performance.

C. Visualization of the Unrealistic Details in the Fake Images
Since the proposed DeepFD is designed to be a fully convolutional network, the feature maps can be visualized to localize the unrealistic details in the fake images. Inspired by fully convolutional network [14], there are two channels in the last convolutional layer in the proposed classifier D2, leading to the learning goal of this layer will tend to learn a high activated feature representation, which can be considered as the unrealistic details localization. Six visualization results of the fake images generated by PGGAN are shown in Fig. 4. It well knows that the performance on image synthesis task of PGGAN is the state-of-the-art. However, some artifacts in the generated images still can be found. In the proposed DeepFD, most of such artifacts can be successfully localized, bring an extra benefit that the detecting performance can be further improved by investigating these visualized results.
IV. CONCLUSIONS In this study, we have proposed a novel deep forgery discriminator (DeepFD) based on embedding the contrastive loss, to successfully detect the fake / generated images generated by state-of-the-art GANs. To the best of our knowledge, the proposed approach is the first work to solve the problems of detecting the fake images. The main contribution is that the contrastive loss can be used to well capture the joint discriminative features of the fake images generated by different GANs. Besides, the proposed classifier refinement process leads to further boost the classification performance and can be used to visualize the unrealistic details in the fake images. Our experimental results demonstrate that the proposed method outperforms other baseline approaches in terms of precision and recall rate.