# Response to R3

We thank **Reviewer BZLH** for the thoughtful review and insightful recommendations. Below we provide a response to key questions/comments that may alleviate experimental concerns:

## Additional experimental evaluation of D3

> My rating is actually neutral, between Borderline accept and Borderline reject. The major issue is: experiments part is relative weak. Experiments are conducted with only one data set, StyleGAN trained on FFHQ. How will the proposed method perform for other data sets (e.g., other than faces), other GAN or generative models, combination of multiple data sets and GAN models, and transferability (e.g., train on one data set / generative model, and test on others) ? The current experimental setting is not very convincing.

To address the concern about experiments, we conducted D3 using two additional datasets (StyleGAN and BigGAN), which cover domains other than faces, as well as other GAN models. The tables below presents adversarial accuracies (percentages, upto 100) of our best-performing ensemble, D3-S(4) as trained, tested, and attacked using the stronger white-box attacks on these additional datasets:

## StarGAN
| Attack (L2; APGD-50)| Epsilon | AT (1) | ADP (4) | GAL (4) | DVERGE (4) | D3-S (4) |
|-|-|-|-|-|-|-|
|CE| 0.5 | 45.3 | 87.5| 13.5| 25.3 | **100**|
|CE| 1 | 9.5| 0 | 0.9 | 11.6 | **100**|
|CE| 5 | 0| 0 | 0 | **2.7**| 0.1|
|CE| 10| 0| 0 | 0 | **2.7**| 0.1|
|CW| 0.5 | 20.9 | 90.8| 16.2| 19.3 | **100**|
|CW| 1 | 3.3| 0.1 | 0.3 | 5.8| **100**|
|CW| 5 | 0| 0 | 0 | **2.7**| 0.1|
|CW| 10| 0| 0 | 0 | **2.7**| 0.1|

| Attack (Linf; APGD-50)| Epsilon | AT (1) | ADP (4) | GAL (4) | DVERGE (4) | D3-S (4) |
|-|-|-|-|-|-|-|
|CE| 0.004 | 14.6 | 8.6 | 1.6 | 18.5 | **100**|
|CE| 0.016 | 0| 0 | 0 | 3| **99.6** |
|CE| 0.032 | 0| 0 | 0 | 0| **0.1**|
|CE| 0.064 | 0| 0 | 0 | 0| **0.1**|
|CW| 0.004 | 11.5 | 17.4| 2.3 | 19.3 | **100**|
|CW| 0.016 | 0| 0 | 0 | 2.7| **99.8** |
|CW| 0.032 | 0| 0 | 0 | 0| **0.1**|
|CW| 0.064 | 0| 0 | 0 | 0| **0.1**|

## BigGAN
| Attack (L2; APGD-50)| Epsilon | AT (1) | ADP (4) | GAL (4) | DVERGE (4) | D3-S (4) |
|-|-|-|-|-|-|-|
|CE|0.5| 23.6|9.2 | 59.4| 13.6 | **91** |
|CE|1|16.6|9.1 | 27.1| 2.8| **91** |
|CE|5|14.4 | 9.1 | 9.4 | 0| **70.5** |
|CE|10| 14.4 | 9.1 | 9.4 | 0| **26.2** |
|CW|0.5 | 25.1 | 9.3 | 61.6| 14.5 | **91** |
|CW|1| 15.4 | 9.1 | 27.4| 3.1| **91** |
|CW|5|14.4 | 9.1 | 9.4 | 0| **71** |
|CW|10| 14.4 | 9.1 | 9.4 | 0| **26.2** |

| Attack (Linf; APGD-50) | Epsilon | AT (1) | ADP (4) | GAL (4) | DVERGE (4) | D3-S (4) |
|-|-|-|-|-|-|-|
|CE|0.004|16.2|9.1| 41.5| 5.5| **91** |
|CE|0.016|14.4|9.1| 9.4 | 0| **90** |
|CE|0.032|14.4|9.1| 9.4 | 0| **78.3** |
|CE|0.064|14.4|9.1| 9.4 | 0| **26.6** |
|CW|0.004|15.9|9.1| 2.3 | 5.4| **91** |
|CW|0.016|14.4|9.1| 43.8| 0| **90.5** |
|CW|0.032|14.4|9.1| 9.4 | 0| **79.6** |
|CW|0.064|14.4|9.1| 9.4| 0| **26.7** |

We find that D3-S(4) continues to outperform, or perform on the level of the baselines.

We additionally present below results on transferability (train on one dataset/generative model, and test on others) between our three datasets:

Transferability performance of AT (1) models:
| | StyleGAN (train) | BigGAN (train) | StarGAN (train) |
|--------------------|------------------|----------------|-----------------|
| **StyleGAN (test)** | 100 | 38.4 | 33 |
| **BigGAN (test)** | 27 | 90 | 60 |
| **StarGAN (test)** | 7.5 | 79 | 100 |

Transferability performance of D3-S(4) models:
| | StyleGAN (train) | BigGAN (train) | StarGAN (train) |
|--------------------|------------------|----------------|-----------------|
| **StyleGAN (test)** | 99 | 43 | 46 |
| **BigGAN (test)** | 22 | 85 | 54 |
| **StarGAN (test)** | 11 | 75 | 100 |

We observe that D3-S(4) does not suffer from decreased cross-GAN transferability/generalization performance in comparison to the baseline full-spectrum AT (1) detector. We also emphasize that cross-GAN generalization performance is a different problem; nonetheless, the above table suggests that any generalization improvements as per the literature that could be applied to the full-spectrum classifier (e.g., incorporating multiple GANs into the training set) would carry over to D3-S(4).

## Discussion of limitations and societal impacts
We will add further discussion of these areas to the draft. Regarding limitations: we will further emphasize that applying D3 to CIFAR10, ImageNet, and other image forgery techniques would require additional investigation into useful and redundant feature spaces. Regarding societal impacts: we hope to highlight that the realism of modern deepfakes raises several threats, e.g, impersonation, disinformation, etc --- detecting deepfakes in a robust manner thus becomes a pressing problem. However, it is possible more capable adversaries could incorporate D3 in their pipeline to generate "better" deepfakes that are more realisic/can evade detectors. Adversarial deepfakes also have benign use cases, e.g., anonymization of an end-user on a online network; D3 would prevent this anonymization.