{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/evading-forensic-classifiers-with-attribute-1","title":"Evading Forensic Classifiers with Attribute-Conditioned Adversarial Faces","arxiv_id":"2306.13091","date":"2023-06-22","proceeding":"CVPR 2023 1","authors":["Fahad Shamshad","Koushik Srivatsan","Karthik Nandakumar"],"abstract":"The ability of generative models to produce highly realistic synthetic face images has raised security and ethical concerns. As a first line of defense against such fake faces, deep learning based forensic classifiers have been developed. While these forensic models can detect whether a face image is synthetic or real with high accuracy, they are also vulnerable to adversarial attacks. Although such attacks can be highly successful in evading detection by forensic classifiers, they introduce visible noise patterns that are detectable through careful human scrutiny. Additionally, these attacks assume access to the target model(s) which may not always be true. Attempts have been made to directly perturb the latent space of GANs to produce adversarial fake faces that can circumvent forensic classifiers. In this work, we go one step further and show that it is possible to successfully generate adversarial fake faces with a specified set of attributes (e.g., hair color, eye size, race, gender, etc.). To achieve this goal, we leverage the state-of-the-art generative model StyleGAN with disentangled representations, which enables a range of modifications without leaving the manifold of natural images. We propose a framework to search for adversarial latent codes within the feature space of StyleGAN, where the search can be guided either by a text prompt or a reference image. We also propose a meta-learning based optimization strategy to achieve transferable performance on unknown target models. Extensive experiments demonstrate that the proposed approach can produce semantically manipulated adversarial fake faces, which are true to the specified attribute set and can successfully fool forensic face classifiers, while remaining undetectable by humans. Code: https://github.com/koushiksrivats/face_attribute_attack.","url_abs":"https://arxiv.org/abs/2306.13091v1","url_pdf":"https://arxiv.org/pdf/2306.13091v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"evading-forensic-classifiers-with-attribute-1","repo_url":"https://github.com/koushiksrivats/face_attribute_attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"attribute","task_name":"Attribute"},{"task_slug":"meta-learning","task_name":"Meta-Learning"}],"methods":[{"method_slug":"adaptive-instance-normalization","method_name":"Adaptive Instance Normalization"},{"method_slug":"convolution","method_name":"Convolution"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"feedforward-network","method_name":"Feedforward Network"},{"method_slug":"r1-regularization","method_name":"R1 Regularization"},{"method_slug":"stylegan","method_name":"StyleGAN"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2306.13091","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2306.13091"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/koushiksrivats/face_attribute_attack","reach":null}],"summary":{"ran":9,"ran_draft_wrong":1,"ran_fixture":2,"unverified":8},"by_repo_kind":{"official":{"samples":20,"ran":12,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":20,"samples":[{"code_sha256_prefix":"6a657c5a423ebb1b","entry":"Blur","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6a657c5a423ebb1b"}},{"code_sha256_prefix":"6ac39cc25c802292","entry":"ConstantInput","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6ac39cc25c802292"}},{"code_sha256_prefix":"e47588046427d5bf","entry":"EqualLinear","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e47588046427d5bf"}},{"code_sha256_prefix":"49d075452b1d32c2","entry":"FusedLeakyReLU","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"49d075452b1d32c2"}},{"code_sha256_prefix":"1ec76c108312391c","entry":"Generator","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1ec76c108312391c"}},{"code_sha256_prefix":"a14989f041846d5f","entry":"ImageTransform","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a14989f041846d5f"}},{"code_sha256_prefix":"6a89165f91afae45","entry":"NoiseInjection","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6a89165f91afae45"}},{"code_sha256_prefix":"3aff569b0f560591","entry":"Normalize","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3aff569b0f560591"}},{"code_sha256_prefix":"9b4774177e343e0b","entry":"PixelNorm","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9b4774177e343e0b"}},{"code_sha256_prefix":"9a98641c4a409588","entry":"Upsample","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9a98641c4a409588"}},{"code_sha256_prefix":"238fedc043c13f62","entry":"upfirdn2d","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"238fedc043c13f62"}},{"code_sha256_prefix":"fe99cfd294676edb","entry":"upfirdn2d_native","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fe99cfd294676edb"}},{"code_sha256_prefix":"673fcfe5abee6fa2","entry":"ModulatedConv2d","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"673fcfe5abee6fa2"}},{"code_sha256_prefix":"dabdb31d4bd12319","entry":"StyledConv","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"dabdb31d4bd12319"}},{"code_sha256_prefix":"995aad99045f4c4d","entry":"ToRGB","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"995aad99045f4c4d"}},{"code_sha256_prefix":"223870c61558817c","entry":"ensure_checkpoint_exists","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"223870c61558817c"}},{"code_sha256_prefix":"737ec98d1a59d066","entry":"fused_leaky_relu","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"737ec98d1a59d066"}},{"code_sha256_prefix":"dd91635c995516a5","entry":"get_classifier","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"dd91635c995516a5"}},{"code_sha256_prefix":"cc2b94960ff33e11","entry":"get_stylegan_generator","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cc2b94960ff33e11"}},{"code_sha256_prefix":"0910a44fbe46f84f","entry":"image_as_reference","repo":"koushiksrivats/face_attribute_attack","repo_kind":"official","path":"image_as_reference.py","file_url":"https://github.com/koushiksrivats/face_attribute_attack/blob/HEAD/image_as_reference.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0910a44fbe46f84f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}