Abstract: Generative adversarial network GANgenerated faces forensics models are used to distinguish real faces and GANgenerated faces. But due to the fact that forensics models are susceptible to adversarial attacks, the antiforensics techniques for GANgenerated faces have emerged. However, existing antiforensic methods rely on whitebox surrogate models, which have limited transferability. Therefore, a blackbox method based on invertible neural network (INN) is proposed for GANgenerated faces antiforensics in this paper. This method embeds the features of real faces into GANgenerated faces through the INN, which enables the generated antiforensics faces to disturb forensics models. Meanwhile, the proposed method introduces a feature loss during training to maximize the cosine similarity between the features of the antiforensics faces and the real faces, further improving the attack performance of antiforensics faces. Experimental results demonstrate that, under the scenarios where no whitebox models are involved, the proposed method has good attack performance against eight GANgenerated faces forensics models with better performance than seven comparative methods, and can generate highquality antiforensics faces.

Key words: adversarial attack, invertible neural network, GANgenerated faces, antiforensics, blackbox

摘要： 生成对抗网络(generative adversarial network, GAN)生成的人脸取证模型用于区分真实人脸和GAN生成人脸.但由于其易受对抗攻击影响，GAN生成人脸反取证技术应运而生.然而，现有反取证方法依赖白盒代理模型，迁移性不足.因此，提出了一种基于可逆神经网络(invertible neural network, INN)的黑盒GAN生成人脸反取证方法.该方法通过INN将真实人脸特征嵌入GAN生成人脸中，使生成的反取证人脸能够误导取证模型.同时，在训练中引入特征损失，通过最大化反取证人脸特征与真实人脸特征间的余弦相似度，进一步提升反取证性能.实验结果表明，在不依赖任何白盒模型的场景下，该方法对8种取证模型都有良好的攻击性能，优于对比的7种方法，且可以生成高视觉质量的反取证人脸.

关键词: 对抗攻击, 可逆神经网络, GAN生成人脸, 反取证, 黑盒