title: DeepFake Detection Based on the Discrepancy Between the Face and its Context
authors: Yuval Nirkin Lior Wolf Yosi Keller Tal Hassner
text: 
  
  
  
  
  
  We propose a method for detecting face swapping and other identity manipulations in single images. Face swapping methods, such as DeepFake, manipulate the face region, aiming to adjust the face to the appearance of its context, while leaving the context unchanged. We show that this modus operandi produces discrepancies between the two regions (e.g., Fig. <ref>). These discrepancies offer exploitable telltale signs of manipulation. Our approach involves two networks: (i) a face identification network that considers the face region bounded by a tight semantic segmentation, and (ii) a context recognition network that considers the face context (e.g., hair, ears, neck). We describe a method which uses the recognition signals from our two networks to detect such discrepancies, providing a complementary detection signal that improves conventional real vs. fake classifiers commonly used for detecting fake images. Our method achieves state of the art results on the FaceForensics++, Celeb-DF-v2, and DFDC benchmarks for face manipulation detection, and even generalizes to detect fakes produced by unseen methods.
  
  
  
  Image Forensics, Deep Learning, Deep Fake, Face Swapping, Fake image Detection.
  
  
  DeepFake Detection Based on Discrepancies Between Faces and their Context
      Yuval Nirkin, Lior Wolf, Yosi Keller, and Tal Hassner 
  Y. Nirkin and Y. Keller are with the Faculty of Engineering. Bar Ilan University. E-mail: yuval.nirkin@gmail.com
  Lior Wolf is with Facebook and Tel Aviv University.
  Tal Hassner is with Facebook AI.
  Work done in academia and outside FB.
  
      Received XXX 2019 / Accepted XXX 2020
  =======================================================================================================================================================================================================================================================================================================
  
  
  
  
  
  
  
  
  
  § INTRODUCTION
  
  
  
  
  Photography is widely perceived as offering authentic evidence of actual
  events, including, in particular, the presence and actions of human subjects
  in images and videos. Although this perception is slowly shifting,
  contemporary technology allows far easier and more accessible manipulation
  of images than many realize. This gap represents a societal threat
  whenever manipulated media is released over social networks and consumed by
  a public that is ill-equipped to question its authenticity.
  
  For instance, existing technology makes it easier for an actor to speak a
  given text, and then change her facial appearance and voice to imitate those
  of someone else. Alternatively, the face of a person captured in a
  crime-scene can be manipulated and replaced by another. Both of these examples are
  referred to as face swapping. A third scenario involves the 
  reenactment of a person's face to change expression or lip motion (aka 
  face reenactment).
  
  
  
  Contemporary approaches for detecting such manipulations relate to these
  three scenarios similarly: by training a classifier to distinguish between
  real and fake images or videos <cit.>
  . We note, however, that the third scenario differs from the first two, as
  it does not involve a change in identity. Our goal is to capture facial
  manipulation cues caused by face swapping, where the apparent identity is
  changed. Application-wise, swapping is of particular interest,
  as many of the existing face manipulation methods are designed for
  such identity modifying use cases. To this end we make two assumptions: (A1) Facial manipulation methods only manipulate the internal part of the face. (A2) The context of the face, which includes the head, neck, and hair regions outside the internal part of the face, provides a significant identity signal for the subject.
  
  We verify assumption A2 in Sec. <ref>. Our findings are consistent with previous reports, showing that context alone indeed provides strong identity cues <cit.>. 
  
  To support assumption A1, Fig. <ref> visualizes the affected regions of six different state of the art facial manipulation methods. Fig. <ref>(a,b) present two reenactment methods by Thies et al. <cit.>. Both methods manipulate the regions corresponding to a 3D morphable model (3DMM) <cit.>, covering a facial region that contains part of the forehead at the top and most of the jaw on the bottom. Fig. <ref>(c,d) shows two deepfakes variants samples from the FaceForensics++ <cit.> and DFD <cit.> datasets, both affecting a square region in the middle of the face. Fig. <ref>(e) is another 3DMM-based face swapping method, affecting similar regions as the reenactment methods, excluding the internal part of the mouth (sample obtained from previous work <cit.>). Fig. <ref>(f) is the output of FSGAN <cit.> which uses face segmentation to manipulate entire face regions. 
  
  We claim that it is no coincidence that all face manipulation methods we know of do not affect the entire head: While human faces have simple, easily modeled geometries, their context (neck, ears, hair, etc.) are highly irregular and therefore difficult to consistently reconstruct and manipulate, especially when considering the temporal constraints in video.
  
  We present a novel signal for identifying fake images based on comparing the inner face region – the one that is directly manipulated
  – with its outer context, which is left unaltered by all face manipulation methods we are aware of.
  We do this by representing these two regions, faces and their context, with two separate
  identity vectors. The two vectors are obtained by training two separate face
  recognition networks: one trained for identifying a person based on
  the face region and the other trained to identify the person based on face
  context. We compare these two vectors, seeking
  identity-to-identify discrepancies.
  
  Importantly, we do not assume prior knowledge of the identity of the
  person appearing in the image (source or target subject identities).
  Instead, given an image, we compare the representations for the one or two
  (unknown) identities, obtained from the face and its context using our two,
  specially trained networks.
  
  The cue we derive using these two networks differs from those obtained by
  methods that search for artifacts caused by particular face manipulation
  techniques. Compared to other methods, our cue has three distinct advantages:
  First, our cue is based on the inherent design of face swap
  schemes and so is expected to hold even if future approaches produce
  photo-realistic, artifact-free results. Second, this cue generalizes well to
  different manipulation methods, whereas artifact detecting methods rely on
  algorithm-specific flaws. Finally, since the proposed cue is largely unrelated
  to artifact detection methods, it is complementary, and can thus be readily
  combined with such approaches to improve accuracy.
  
  To summarize, we make the following contributions: (1) We propose a novel approach to identifying the results of face swapping methods. (2) Our method is based on a novel fake detection cue that compares two image-derived identity embeddings. (3) The proposed approach is shown to outperform existing state-of-the-art schemes when applied to FaceForensics++ <cit.>, Celeb-DF-v2 <cit.>, and DFDC <cit.>. (4) We show further results on two additional face swapping benchmarks, created using the FaceForensics++ data and additional swapping techniques, not included in FaceForensics++.
  
  
  
  § RELATED WORK
  
   
  
  Face swapping techniques. Semi- and fully-automatic
  face swapping methods were introduced nearly two decades ago <cit.>. These early methods were proposed as a means for preserving privacy <cit.>, recreation <cit.>, and entertainment (e.g., <cit.>); a far cry from some of their less appealing applications today in misinformation and fake news. Nearly all pre-deep learning approaches relied to some extent on 3D face
  representations, notably 3DMM <cit.>. Some of the more recent examples of such
  methods are the Face2Face approach for expression transfer <cit.>, face reenactement <cit.>,
  expression manipulation <cit.>, and face
  swapping methods <cit.>. 
  
  Public awareness of face manipulation methods began following the introduction of deep
  learning–based swapping and reenactment, particularly through the use of generative
  adversarial networks (GAN). A few notable examples of such techniques are
  GANimation <cit.>, GANnotation <cit.>, and others <cit.>. Unlike earlier,
  3D-based methods, GAN-based approaches are able to produce near
  photo-realistic results, not only in still photos, but also in videos. The
  quality of these results, along with the availability of public
  software, led to the use of what is now collectively known as DeepFakes, 
  for undesirable applications, including porn and fake news. More recently, FSGAN <cit.> showed convincing swapping results without requiring a dedicated training procedure for each source or target person, i.e., it is trained to replace any face with any other face.
  
  
  
   §.§ Detecting manipulated faces
   Over the years, many proposed methods for detecting generic, copy-move and splicing manipulations in images and videos <cit.>. Faces, however, received far less attention, likely because until recently, it was far harder to produce photo-realistic face manipulations. 
  
  The elevated threat posed by recent face manipulation methods is now being answered by increased efforts to develop automatic fake detection methods. Early methods for detecting manipulated visual media relied on handcrafted features <cit.>. A more modern, deep learning–based implementation of this approach was recently described by Cozzolino et al. <cit.>, followed by other deep learning–based methods, <cit.>, as well as approaches utilizing multiple cues <cit.>.
  
  Sabir et al. <cit.> recently proposed a recurrent
  neural network which uses temporal cues to detect Deepfake
  manipulations in videos. Stehouwer et al. <cit.>
  applied an attention mechanism to intermediate feature maps of different
  backbone classifiers, to improve manipulated region detection accuracy. Songsri et al. <cit.> showed that
  using additional facial landmarks improves both detection and
  localization of Deepfakes. Finally, Nguyen et al. <cit.> suggested a fake detection architecture based on the
  capsule networks. Their work achieves results equivalent to previous methods, while 
  utilizing significantly fewer parameters.
  
  
  
   §.§ Benchmarking face manipulation
   A number of recent efforts try to provide the research community with standard,
  high quality, fake detection benchmarks. These efforts include FaceForensics 
  <cit.>, DeepFake-TIMIT <cit.>, Celeb-DF <cit.>, VTD dataset <cit.>, FaceForensics++ challenge <cit.>, and the DFD dataset <cit.>. Several industry research labs have also
  recently contributed to these efforts, leading to the announcement of the
  DeepFake Detection Challenge (DFDC) <cit.>.
  
  These benchmarks represent multiple manipulation techniques – not just face
  swapping. By using a single (or few) synthesis methods, biases can be
  inadvertently introduced into these challenges: artifacts that are unique to
  a particular fake generation method, or to the use of particular training
  data. These sets, therefore, include media generated with a variety of
  synthesis methods. Our approach is designed to be invariant to such
  incidental biases: Rather than seeking particular artifacts, we consider a
  perceptual effect shared by swapping techniques in general and show that our method can detect fakes produced by
  previously unseen face manipulation techniques.
  
  
  
  
  § RECOGNITION OF FACES AND THEIR CONTEXT
  
  
  We describe the two complementary face recognition networks used to obtain
  identity cues for the face and its context. We further explain how we use these two networks in our proposed fake detection method.
  Deep neural networks are extensively used for face identification, and we focus on the contributions of two very specific facial regions, dictated by the desired application: the segmented face and its surrounding context.
  
  
  
   §.§ Detecting and segmenting faces
  
  We begin by applying the dual shot face detector (DSFD) <cit.>. We then increase detected bounding box sizes by 20%, relative to their height, to expose more of the context around the face, as DSFD is trained to return tight facial bounding boxes. Face crops are then resized to 299×299 pixels; the input
  resolution of the Xception architecture <cit.> which we use for
  our face/context cues (Sec. <ref>).
  
  To determine which parts of the crop are processed by the face network and which by the context network, we segment the crop into foreground (face) and background (context) using a face segmentation network. 
  The exact architecture and training details for the segmentation network are provided in Appendix <ref>.
  Given the cropped face I and its corresponding face segmentation mask S, we
  generate image I_f and its complementary image I_c, representing the face and its context, respectively.
  
  
  
  
  
  
   §.§ Recognition networks
  
  
  
  Recognition network architecture. Our networks are based on the Xception architecture <cit.> following its success in detecting other DeepFake cues <cit.>. We train the network using a vanilla cross entropy loss, although other loss functions could
  presumably also be used. Xception is based on the Inception architecture <cit.> but with Inception modules replaced with
  depth-wise separable convolutions. As far as we know, it was
  never used for face recognition.
  
  In our implementation, the Xception network consists of a strided
  convolution block, followed by twelve depth-wise separable
  convolutions blocks with residual connections, except for the last one. The
  network is terminated by two depth-wise separable convolutions, a
  pooling operation and a fully connected layer.
  
  We train two identification networks: E_f which maps an image of size
  299x299 containing pixels from the face region to a vector of
  pseudo-probabilities associated with the dataset faces, and, similarly,
  network E_c maps the remaining pixels from the detection
  bounding box (the context) to a vector of pseudo-probabilities of the same classes.
  
  We train both E_f and E_c on images from the standard, publicly available VGGFace2 dataset <cit.>. VGGFace2 contains 9,131 subjects from which we filtered images with a resolution lower than 128x128, resulting in 8,631 identities. The output of these two networks is, therefore, in ℝ^8,631.
  
  Validating recognition capabilities To validate and compare the recognition accuracy of these networks, we test their performance on both the VGGFace2 <cit.> test set and the test set of the Labeled Faces in the Wild (LFW) <cit.> benchmark (no additional training or fine tuning was applied to the networks before being tested on LFW images).
  
  Unsurprisingly, addressing the internal appearance of the face, network E_f outperforms E_c in term of accuracy, though both accuracies are high. These results
  are evident from Table <ref> for VGGFace2 and Fig. 
  <ref> for LFW. We note that the accuracy demonstrated by E_c – its ability to recognize faces despite only seeing the context –
  is unsurprising: similar results were reported by others,
  showing that faces can be recognized, even when only their context is
  visible <cit.>.
  
  Importantly, Fig. <ref>(b) shows that the representations
  typically used for face recognition – the activations of the penultimate
  layer of the face recognition network, do not match well for the same
  person, since the two networks were trained independently. When combining the
  responses from these two networks, we, therefore, use their final output: the
  per-subject pseudo-probabilities (Sec. <ref>).
  
  
  
  
  
  § FAKE DETECTION USING FACES VS. CONTEXT
  
  
  
  We illustrate our proposed fake detection approach in Fig. <ref>. Our method combines multiple Xception networks: The recognition
  networks, E_f and E_c, described in Sec. <ref>, a binary
  Xception net, E_s, trained to distinguish between real and manipulated
  images by face swapping methods, and another, optional, binary Xception net,
  E_r (not shown in Fig. <ref>), which we train to differentiate real images from those manipulated
  by face reenactment methods. We next describe these components in detail.
  
  
  
  
   §.§ Face discrepancy component
  
   We train the face discrepancy network to predict whether a face and its context share the same identity. It uses the output of the two recognition networks, E_f and E_c, described in Sec. <ref>. We pre-train these two networks and do not change their weights after they are combined, in order to ensure that the identity cues remain the dominant ones.
  In Sec. <ref> we show that training with the recognition network's weights unfrozen leads to a reduced accuracy when generalizing to unseen methods.
  
  We process the face and context images, I_f and I_c, with two separate identity classifiers, E_f and E_c, respectively, to compute a discrepancy feature vector v_d
  
      v_d=E_f(I_f)-E_c(I_c)=v_f-v_c.
  
  
  
  
   §.§ Manipulation specific networks
  
   Previous approaches trained classifiers to
  distinguish between real and fake faces, without considering the particular manipulation applied to the faces – swapping or reenactment. These two manipulations types differ significantly: Swapping manipulates the identity of the face, whereas reenactment manipulates facial pose and expression. While the latter is not the focus of our work, it is required by the FaceForensics++ benchmark used in our tests (Sec. <ref>). Our approach, therefore, includes also a component for
  detecting face reenactment.
  
  Specifically, we decouple swapping and reenactment by training a separate,
  dedicated classifier for each: Network E_s is trained to detect swapping
  artifacts and network E_r (not shown in Fig. <ref>) is trained to detect reenactment. We use
  Xception networks, similar to those described in Sec. <ref> for
  recognition, and train these networks to classify genuine vs. manipulated. Our training process first pre-trains both networks on examples of their particular manipulation vs. pristine images.
  Our reenactment network, E_r, is used in cases where the task is to detect both face swapping and face reenactment methods. Otherwise, we use a three network solution, where E_r is omitted.
  
  
  
   §.§ Combining all detection cues
  
  We chose the simplest method for combining the various signals: concatenating the three vectors v_d, v_s and v_r, where v_d∈ℝ^8,631 is defined in Eq. (<ref>), and v_s=E_s^p(I) and v_r=E_r^p(I), both in ℝ^2,048, denote the activations of the penultimate layers of the binary E_s and E_r, respectively. 
  
  The concatenated vector is passed to classifier D, which outputs a real vs. fake binary signal, trained using a logistic loss function. The classifier D consists of an initial linear layer, followed by batch normalization, ReLU, and a final linear layer.
  
  
  
   §.§ Training
  
  We first pre-train the four classifiers, E_s, E_r, E_f, and E_c, each on its own task. We train network E_s on the subset of videos in FaceForensics++ <cit.> consisting of pristine videos and videos manipulated by the face swapping methods: FaceSwap and Deepfakes. Network E_r is trained on the face reenactment methods: Face2Face and NeuralTextures. Note that we only use the compressed versions of these videos for training, with C23 (HQ) and C40 (LQ) compressions. We chose not to use the raw videos for training because there is little difference between them and the C23 compressed videos. The FaceForensics++ benchmark used to test our method does contain all three versions. 
  The training process applied to E_f and E_c is detailed in Sec. <ref>.
  
  Once the four networks are trained, we freeze the weights of E_f and E_c, and train the final classification network, D, using the three output vectors (v_s,v_r,v_d), while only fine-tuning E_r and E_s. The final training is done on the same split of the FaceForensics++ videos. For more technical details, please see Appendix <ref>.
  
  
  
   §.§ Inference on full images
  
  During inference, we often process images containing multiple faces. In such cases, we only classify detected faces having a height larger than 64 pixels, and discard the rest as background faces. The only exceptions are images where the largest face does not comply with this criterion, in which case we process the largest detected face.
  
  We further remove false detections by applying a threshold on the number of
  face pixels in the face segmentation mask, S, for each detection. We start
  with a threshold of 15% of the face pixels, relative to the number of pixels in
  the cropped region. If this step filters-out all our detections, we reduce
  the threshold by half. If none of the images pass the 7.5% threshold, we
  simply consider the one face patch with the maximal number of detected
  pixels.
  
  Finally, we apply the compound network, including E_m,E_f,E_c, and D, to the remaining face patches (one or more) and obtain one score per face
  patch as the output of D. We take the minimal output of these scores –
  the face patch predicted as most likely to be fake – in cases where
  only a single face is manipulated.
  
  
  
  § EXPERIMENTAL RESULTS
  
  
  We evaluated our proposed scheme using three recent, challenging benchmarks: FaceForensics++ <cit.>, DFDC <cit.>, and Celeb-DF-v2 <cit.>. In order to evaluate our method using additional face swapping techniques and test its generalization abilities, we further create our own test set, using two more swapping methods. For a runtime analysis of our method, please see Appendix <ref>.
  
  
  
   §.§ Face swapping detection experiments
  
  
  We use the following three datasets containing only face swapping examples:
  
  FF-DF FF-DF <cit.> is a subset of the FaceForensics++ benchmark <cit.>, which includes only faces swapped using the Deepfakes method <cit.>. These tests therefore include 1,000 videos from the pristine subset and 1,000 videos from the Deepfakes subset (the full FaceForensics++ is described in Sec. <ref>). 
  
  DFDC The recently announced, industry-backed, preview of the DFDC benchmark <cit.> offers a total of 5,244 videos of 66 actors: 4,464 training videos and 780 test videos, 1,131 of them are real videos and 4,113 are fakes generated by two different, unknown, face swapping methods.
  
  Celeb-DF-v2 Another recent dataset containing 590 real videos and 5,639 DeepFake videos of 59 celebrities <cit.>. This set is especially challenging as most state of the art methods tested on this set report near-chance accuracies.
  
  Training and evaluation In these tests, we do not use our reenactment network, E_r. We train on FaceForensics++, as described in Sec. <ref>. Results for all baseline  methods were previously reported <cit.>. These methods were trained mainly on FaceForensics++, sometimes with additional self collected data. None of these methods was trained on DFDC or Celeb-DF-v2 and so these experiments also compare the generalization of the different methods.
  
  All methods were compared using the area under the curve (AUC), at the frame level, on all frames in which faces were detected. This metric is very convenient for comparing methods that output per-frame classification as there is no need to set thresholds. 
  
  Face swap detection results
  We report our results in Table <ref>. Our method achieves the best AUC scores on all the benchmarks. On FaceForensics's DeepFakes subset <cit.> our method achieves similar results as the current state of the art, this is due to the accuracy being saturated. On the more challenging Celeb-DF-v2 benchmark, small improvements on the AUC scores are significant. Note also that the results reported for our method on Celeb-DF-v2 testify to its improved generalization abilities compared to the baseline methods.  
  
  
  
  
  
   §.§ Experiments on FaceForensics++
  
  
  The full FaceForensics++ dataset <cit.> contains 1,000 videos obtained from the web, from which 1,000 video pairs were randomly selected and used to generate additional 1,000 manipulated videos representing four face manipulation schemes. Two of these methods perform face swapping: a 3D-based face swapping method <cit.> using a traditional graphics pipeline and blending, and a GAN-based method <cit.>, trained using the images of pairs of subjects to compute a mapping between them. Two additional methods perform face reenactment: Face2Face <cit.>, a 3DMM-based method that manipulates facial expressions by changing the expression-coefficients estimated for the face, and NeuralTextures <cit.> which learns a face neural texture from a video and uses it to realistically render a 3D reconstructed face model. 
  
  
  Results on FaceForensics++ image benchmark Table <ref> shows that our total accuracy outperforms all previous methods by a large margin. Importantly, the accuracy in each of the different categories, on its own, is not a direct indication of detection performance, since there is a threshold-dependent trade-off between the accuracy on real and fake images. These results hint at the relative detection difficulty of each class and are provided for completeness. 
  
  
  
  
  
   §.§ Ablation study and generalization experiment
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  Face manipulation methods sometimes leave behind artifacts, possibly imperceptible, that can be leveraged for detection. Different manipulation methods, however, can produce different artifacts, as shown in Fig. <ref>. There is, therefore, no guarantee that a fake detection method would perform well when presented with fakes generated by unseen schemes which do not leave such known, recognizable artifacts. We next verify the accuracy of our proposed scheme in detecting fakes produced by methods that were not part of its training set.   
  
  We conduct these tests by extending the FaceForensics++ set, applying two additional face swapping methods to its videos: (1) Our implementation of FSGAN <cit.> and (2) the publicly available implementation of Nirkin et al. <cit.>, a 3D-based face swapping method that uses single image 3D face reconstruction and segmentation. Examples of the four face swapping methods, using the same source and target, can be seen in Fig. <ref>. Each method generates face swaps with distinct artifacts, with the exception of FSGAN, which produces images with fewer apparent artifacts.
  
  The extended version of the benchmark follows the pair selections prescribed by the original FaceForensics++ dataset. 
  Because Nirkin et al. <cit.> was designed for image-to-image face swapping, for each frame in the target video we select its closest frame in the source video, in terms of estimated head pose.
  
  In all our generalization experiments, we train the variants of our method and its XceptionNet baseline on the pristine and face swapping manipulations, using the official training and validation subsets of FaceForensics++. In these experiments, we do not use the reenactment detection network E_r.
  
  
  
    §.§.§ Generalization and ablation results
   
  We studied the effect of our face vs. context discrepancy approach by comparing it to a naive classifier. We further test an end-to-end version of our method, where all the classifiers are unfrozen in the training process. We report our generalization results in Table <ref> (ROC curves provided in Fig. <ref>). For results appearing at the top of Table <ref>, we fix the thresholds for XceptionNet and our method at zero. In the bottom of Table <ref> we optimize both thresholds on the test set. The threshold of the face identity difference in the first experiment is optimized using the VGGFace2 test set.
  
  Our results show that our method significantly outperforms the baseline on both unseen methods. The performance gap is greater on FSGAN generated faces, where artifacts are more rare. Artifacts produced by the 3DMM-based method are more similar to the ones we encounter in other methods, and so the gap is smaller. As evident from the ROC curves in Fig. <ref>, the end-to-end version of our method is less able to generalize. This result is due to the end-to-end training process sullying the face and context classifiers roles for extracting aligned identity representations. 
  
  Finally, note that the face discrepancy signal by itself is not competitive with networks trained to detect fakes. However, it is indicative of fake videos and its contribution to the overall method is seen by comparing our method with the baseline XceptionNet.
  
  
  
   §.§ Qualitative results
   Fig. <ref> presents qualitative examples of detected and missed fake faces from the DFDC collection. Fig. <ref>(a) shows example fakes detected by our method but undetected by the state of the art XceptionNet fake detector <cit.>. Fig. <ref>(b) offers example fakes which were detected by XceptionNet, but were missed by our method. Finally, Fig. <ref>(c) shows fakes missed by both approaches. 
  
  Clearly, our method excels in cases where swapping artifacts are hard to detect (Fig. <ref>(a)). Examining Fig. <ref>(b) shows that fake images detected by XceptionNet often exhibit visible artifacts, which that method was optimized to detect. Our method includes a face swapping component, E_s (Sec. <ref>), trained to detect similar method-specific artifacts, but does not provide the same detection accuracy as the baseline when such artifacts are present. Our overall approach still outperforms the baseline by a wide margin, as reported in Sec. <ref> and <ref>. Finally, the fakes missed by both methods are typically challenging images with low contrast or blurry features as in Fig. <ref>(c). 
  
  
  
  
  § CONCLUSION
  
  
  While the ability to manipulate faces in images and video has increased
  dramatically in the last few years, all recent methods follow similar
  patterns. In this work, we propose a novel detection cue which utilizes the
  commonalities of all recent face identity manipulation methods. It is
  complementary to conventional real/fake classifiers and can be used
  alongside them. Overcoming this approach would require a much broader
  integration of the new identity into the image, making our contribution hard
  to circumvent without additional technological breakthroughs. This is in
  contrast to artifact detection methods, which are susceptible to the
  constant progress in the visual quality of generated images. It is our hope
  that by further analyzing the design principles of face swapping techniques,
  additional methods of identifying fake images and videos would be
  discovered, leading to effective mitigation of the societal risks of such
  media.
  
  
  
  
  
  § SEGMENTATION NETWORK DETAILS
  
  
  For the face segmentation network, we are using the U-Net <cit.> architecture where the deconvolution layers used for the upsampling operations replaced with bilinear interpolation followed by a convolution. For this network, we crop and resize the images to a resolution of 256x256.
  
  The network is trained on a face segmentation dataset, similar to the one used by Nirkin el al. <cit.>, and produced by us using their publicly available code[Available: <https://github.com/YuvalNirkin/face_video_segment>]. Training used a batch size of 48 and 40,000 iterations per epoch. To increase the robustness of the segmentation network, the following image augmentations are applied: random image rotations between -30 to 30 degrees, random color jittering (brightness, contrast, saturation, and hue), horizontal flip with probability 0.5, and gaussian blur with a kernel size of 5 and sigma of 1.1, which is applied with probability 0.5.
  
  
  
  § TRAINING DETAILS
  
  
  Training used four NVIDIA Tesla P100 GPUs and an Intel Xeon CPU with 64 cores. We applied Adam optimization <cit.> (β_1=0.5,β_2=0.999). The learning rate was reduced by half every ten epochs, for a total of 90 epochs. The initial learning rate and the batch size differ between the training stages (see below).
  
  Identity networks The identity networks, E_f and E_c, are trained on images from the VGGFace2 dataset <cit.>, cropped by the provided bounding boxes after they have been squared using the length of the longer of the two axes and their size extended by 20%. The cropped images are then resized to a resolution of 299x299, which is the required input size for the Xception architecture <cit.>. As a form of augmentation, the images are horizontally flipped with a probability of 0.5. For the face network, E_f, we set the context pixels to a constant color, and for the context network, E_c, we set pixels corresponding to the face regions to a constant color. Both networks are trained with a batch size of 192 and an initial learning rate of 0.0002.
  
  Pretraining of the manipulation specific networks Networks E_s and E_r, are trained on the videos of FaceForensics++ <cit.>, each on its own specific subset as described in Sec. 4.4 in the main paper. The networks are trained for 40,000 iteration per epoch, with a batch size of 96, and an initial learning rate of 0.0002. For each iteration a random frame from a random video is selected, for which a face was detected. The face crops are transformed in the same way as for the identity networks.
  
  Training of the full pipeline In this final training, the networks E_s, E_r, and D are trained, while the weights of the identity networks, E_f and E_c, are frozen (except for the end-to-end ablation experiment, see Sec. 5.3 in the main paper). The discriminator D is trained from scratch, its weights are randomly initialized using a normal distribution. A batch size of 64 is used and there are 20,000 iterations per epoch. The  initial learning rate is set to 0.0001.
  
  
  
  § RUNTIME PERFORMANCE
  
  
  
  The system runtime performance was tested on a single NVIDIA Tesla V100 GPU with an Intel Xeon CPU with 8 cores. The entire pipeline was tested, including the segmentation and preprocessing but without the face detection step.
  For face detection we are using the dual shot face detector (DSFD) <cit.> which was not optimized for run-time performance and was originally used for images and not videos. This detection step can potentially be replaced with a face tracking algorithm (many of which can run in real-time even on CPU <cit.>). Our full pipeline inference rate without the reenactment classifier, E_r, is fast, at 90.6fps. Runtime is 81.5fps with E_r.
  
  
  
  
  
  IEEEtran
  
  
  