Geo-DefakeHop: High-Performance Geographic Fake Image Detection

Artificial intelligence (AI) and deep learning (DL) techniques have made significant advances in recent years by leveraging more powerful computing resources and larger collected and labeled datasets. Geospatial science [14] and remote sensing [27] benefit from this development, involving increased application of AI to process data arising from cartography and geographic information science (GIS) more effectively. Despite countless advantages brought by AI, misinformation over the Internet, ranging from fake news [30] to fake images and videos [8, 15, 24, 31, 38, 40], poses a serious threat to our society.

Satellite images are utilized in various applications such as weather prediction [37], agriculture crops prediction [22], flood and fire control [23]. If one cannot determine whether a satellite image is real or fake, it would be risky to use it for decision making. Fake satellite images may have impacts on national security. For example, adversaries can create fake satellite images to hide military infrastructure and/or create fake ones to deceive others. Though government analysts could verify the authenticity of geospatial imagery leveraging other satellites or data sources, this would be prohibitively time intensive. It would be extremely difficult for the public to verify the authenticity of satellite images.

It becomes easier to generate realistically looking images due to the rapid growth of generative adversarial networks (GANs). There are two ways to generate fake satellite images. One is to leverage the base map of an input satellite image to be produced by one GAN first. Then, a fake satellite image can be generated by another GAN with the base map [7, 13, 39]. CycleGAN belongs to this family. Another way is to generate fake satellite images directly without a base map [2, 16-18, 29]. StyleGAN [17, 18] and Lightweight GAN [25] belong to this family. Since generated satellite images are difficult to discern by human eyes, there is an urgent need to develop an automatic detection system that can find fake satellite images accurately and efficiently.

Little research has been done on fake satellite images detection due to the lack of a proper fake satellite image dataset. The first fake satellite image dataset was recently released by Zhao et al. [36]. To determine whether a satellite image is real and fake, this work extracted handcrafted features (such as spatial, histogram, and frequency features) and adopted the support vector machine (SVM) classifier. It achieves an F1-score of 87% in detection performance. We are not aware of any existing DL solution to this dataset. Yet, there are DL-based fake image detection methods for other images. They will be reviewed in Section 2.

Previous fake image detection work mainly focuses on a binarized decision on whether an image is fake or authentic. However, a large satellite image could be partially modified. It is crucial to generate a binary-decision map at the pixel level to identify the regions that have been altered. To meet this requirement, we crop a satellite image into multiple blocks and analyze discriminant features in different frequency components. Consequently, we can obtain the image-level prediction result and the pixel-level prediction result simultaneously. The latter can generate a heat map for partially altered satellite images. This is the first unique feature of this current work. Furthermore, different legitimate distortions could occur naturally or be added to fool fake image detection algorithms. Thus, we consider various perturbations in our experiment to ensure the robustness of our model for satellite images. This is the second unique feature of our work.

A robust fake satellite image detection method, called Geo-DefakeHop, is proposed here. It is based on one observation and one assumption. The observation is that the human visual system (HVS) [11] has its limitation. That is, it behaves like a low-pass filter and, as a result, it has a poor discriminant power for high-frequency responses. The assumption is that GANs can generate realistic images by reproducing low-frequency responses of synthesized images well [9, 32]. Apparently, it is more challenging to synthesize both low and high-frequency components well due to limited model complexity. If this assumption holds, we can focus on differences between higher frequency components in differentiating true and fake images.

This high-level idea can be implemented by a set of filters operating at all pixel locations in parallel, known as a filter bank in signal processing. Each filter offers responses of a particular frequency channel in the spatial domain and these responses can be used to check the discriminant power of a channel from the training data. To make the detection model more robust, we adopt multiple filter banks, find discriminant channels from each, and ensemble their responses to get the final binary decision. Since multiple filter banks are used simultaneously, it is named parallel subspace learning (PSL). The proposed Geo-DefakeHop offers a lightweight, high-performance and robust solution to fake satellite images detection. Its model size ranges from 0.8K to 62K parameters. It achieves an F1-score higher than 95% under various common image manipulations such as resizing, compression and noise corruption.

The rest of this paper is organized as follows. Related work is reviewed in Section 2. The Geo-DefakeHop method is presented in Section 3. Experiments are shown in Section 4. Finally, concluding remarks are given in Section 5.

GANs provide powerful machine learning models for image-to-image translation. It consists of two neural networks in the training process: a generator and a discriminator. The generator attempts to generate fake images to fool the discriminator while the discriminator tries to distinguish generated fake images from real ones. They are jointly trained via end-to-end optimization with an adversarial loss. In the inference stage, only the generator is needed. Many GANs have been proposed. One example is Cycle-consistent GAN (CycleGAN) [39]. It has been applied to fake satellite image generation [36]. In this work, we use StyleGAN2 [18] which is the most popular GAN on the internet and Lightweight GAN [25] which is the newest GAN that could be trained efficiently in one day to generate more fake satellite images (see Section 4.1).

Most fake image detection methods adopt convolution neural networks (CNNs). For example, Wang et al. [32] used the real and fake images generated by ProGAN Karras et al. [16] as the input of ResNet-50 pretrained by the ImageNet. Zhang et al. [35] generated fake images with their designed GAN, called AutoGAN, and claimed that CNN trained by their simulated images could learn artifacts of fake images. Nataraj et al. [28] borrowed the idea from image steganalysis and used the co-occurrence matrix as input to a customized CNN so that it can learn the differences between real and fake images. By following this idea, Barni et al. [1] added the cross-band co-occurrence matrix to the input so as to increase the stability of the model. Guarnera et al. [10] utilized the EM algorithm and the KNN classifier to learn the convolution traces of artifacts generated by GANs. Little research has been done to date on fake satellite images detection due to the lack of available datasets. Zhao et al. [36] proposed the first fake satellite image dataset with simulated satellite images from three cities (i.e., Tacoma, Seattle and Beijing). Furthermore, it used 26 hand-crafted features to train an SVM classifier for fake satellite image detection. The features can be categorized into three types which are spatial, histogram and frequency. Features of different classes are concatenated for performance evaluation. In Section 4, we will benchmark our proposed Geo-DefakeHop method with the method in [36] and CNN models with images and spectrum as the input.

The PixelHop concept was introduced by Chen and Kuo [6]. Each PixelHop has local patches of the same size as its input. Suppose that local patches are of dimension L = s₁ × s₂ × c, where s₁ × s₂ is the spatial dimension and c is the spectral dimension. A PixelHop defines a mapping from pixel values in a patch to a set of spectral coefficients, which is called the Saab transform [21]. The Saab transform is a variant of the principal component analysis (PCA). For standard PCA, we subtract the ensemble mean and then conduct eigen-analysis on the covariance matrix of input vectors. The ensemble mean is difficult to estimate if the sample size is small. The Saab transform decomposes the n-dimensional signal space into a one-dimensional DC (direct current) subspace and an (n − 1)-dimensional AC (alternating current) subspace. Signals in the AC subspace have an ensemble mean close to zero. Then, we can apply PCA to the AC signal and decompose it into (n − 1) channels. Saab coefficients are unsupervised data-driven features since Saab filters are derived from the local correlation structure of pixels.

The Saab transform can be implemented conveniently with filter banks. It has been successfully applied to many application domains. Examples include [4, 20, 26, 33, 34]. Among them, DefakeHop [4] is closest to this work. There are substantial differences between DefakeHop and Geo-DefakeHop. DefakeHop was initially proposed to detect deepfake face videos. DefakeHop extracted features from human eyes, nose and mouth regions. The purposes of DefakeHop and Geo-DefakeHop are different. The former focuses on a binarized decision on whether a face image is fake or authentic. A large satellite image could be partially modified. The latter needs to generate a binary-decision map at the pixel level to identify which regions are altered. The DefakeHop focuses on the low-frequency signal because the high-frequency parts are destroyed by the resizing, smoothing, and sharpening operation in the face swap process. In the experiments of this work, we also show that if the image is perturbed by resizing, compression, and noise corruption, more low-frequency components are needed to keep good performance. Therefore, we claim that DefakeHop performs well with the low-frequency signal only. In Geo-DefakeHop, we jointly consider low- and high-frequency channels and select the most discriminant channels to reduce the model size.

Furthermore, DefakeHop was designed using successive subspace learning (SSL) while Geo-DefakeHop is developed with parallel subspace learning (PSL). SSL and PSL are quite different.

In DefakeHop, SSL cascades several PixelHops and derives a deep and global feature with a large receptive field. In Geo-DefakeHop, PSL does not need global but local features since we need to make a decision at each pixel location. Therefore, instead of cascading several PixelHops as done in SSL, PSL extracts features parallelly with different filter shapes to get a rich feature set.

We tailor DefakeHop to the context of satellite images and show that Geo-DefakeHop outperforms DefakeHop by a significant margin due to a better design in Section 4.

Our idea is motivated by the observation that GANs fail to generate high-frequency components such as edges and complex textures well. It is pointed out by Frank et al. [9] that GANs have inconsistencies between the spectrum of real and fake images in high-frequency bands. Another evidence is that images generated by simple GANs are blurred and unclear. Blurry artifacts are reduced and more details are added by advanced GANs to yield higher quality fake images. Although these high quality simulated images look real to human eyes because of the limitation of the HVS, it does not mean that the high-frequency fidelity loss is not detectable by machines. Another shortcoming of generated images is periodic patterns introduced by convolution and deconvolution operations in GAN models as reported in Guarnera et al. [10]. GANs often use a certain size of convolution and deconvolution filters (e.g., 3 × 3 or 5 × 5). They leave traces on simulated images in form of periodic patterns in some particular frequency bands. Sometimes, when GAN models do not perform well, they can be observed by human eyes.

Being motivated by the above two observations, we proposed a new method for fake satellite image detection as shown in Figure 1. It consists of four modules:

1. Preprocessing: Input image tiles are cropped into non-overlapping blocks of a fix size.

2. Joint spatial/spectral feature extraction via PixelHop: The PixelHop has a local patch as its input and applies a set of Saab filters to pixels of the patch to yield a set of joint spatial/spectral responses as features for each block.

3. Channel-wise classification, discriminant channels selection and block-level decision ensemble: We apply an XGBoost classifier to spatial responses of each channel to yield a soft decision, and select discriminant channels accordingly. Then, the soft decisions from discriminant channels of a single PixelHop or multiple PixelHops are ensembled to yield the block-level soft decision.

4. Image-level decision ensemble: Block-level soft decisions are ensembled to yield the image-level decision.

They are elaborated below.

A color satellite image tile of spatial size 256 × 256 covers an area of one kilometer square as shown in the left of Figure 1. It is cropped into 256 non-overlapping blocks of dimension 16 × 16 × 3, where the last number 3 denotes the R, G, B three color channels. Each block has homogeneous content such as trees, buildings, land and ocean.

As described in Section 2.3, a PixelHop has a local patch of dimension L = s₁ × s₂ × c as its input, where s₁ and s₂ are spatial dimensions and c is the spectral dimension. For square patches, we have s₁ = s₂ = s. We set s to 2, 3, 4 in the experiments. Since the input has R, G, B three channels, c = 3.

The PixelHop applies L Saab filters to pixels in the local patch, including one DC filter and (L − 1) AC filters, to generate L responses per patch. The AC filters are obtained via eigen-analysis of AC components. The mapping from L pixel values to L filter responses defines the Saab transform. Since the AC filters are derived from the statistics of the input, the Saab transform is a data-driven transform.

We adopt overlapping patches with stride equal to one. Then, for a block of spatial size 16 × 16, we obtain W × H patches, where W = 17 − s₁ and H =17 − s₂. As a result, the block output is a set of joint spatial/spectral responses of dimension W × H × L. To give an example, if the local patch size is 3 × 3 × 3 = 27, the block output is a 3D tensor of dimension 14 × 14 × 27. They are used as features to be fed to the classifier in the next stage.

For each channel in a block, we have one response from each local patch so that there are W × H responses in total. These responses form a feature vector, and samples from blocks of training real/fake images are used to train a classifier, leading to channel-wise classification. The classifier can be any one used in machine learning such as Random Forest, SVM, and XGBoost. In our experiments, the XGBoost classifier [5] is chosen for its high performance. XGBoost is a gradient-boosting decision tree algorithm that can learn a nonlinear data distribution efficiently.

To evaluate the discriminant power of a channel, we divide the training data into two disjoint groups: (1) data used to train the classifier, and (2) data used to validate the channel performance. The latter provides a soft decision score predicted by the channel-wise classifier. The channel-wise performance evaluation reflects the generation power of a GAN in various frequency bands. Some channels are more discriminant than others because of the poor generation power of the GAN in that frequency band. This finding matches to other general deepfake detector method where fake images contain discrepancy from real images in frequency domain [9]. Selection of discriminant channels is based on the performance of the validation data.

We use an example to explain discriminant channel selection. It is a PixelHop of dimension 3 × 3 × 3, which has 27 channels in total. The x-axis of Figure 2 is the channel index and the y-axis is the energy percentage curve or the performance curve measured by the F1 score. A larger channel index means a higher frequency component. In these plots, blue lines indicate that energy percentage of each channel while red, magenta and green lines represent the F1 scores of the train, validation and test data. We consider the following four settings.

1. RawImages

A higher frequency channel usually has a higher performance score as shown in Figure 2(a). Low-frequency channels are not as discriminant as high-frequency channels. It validates our assumption that the GANs fail to generate high-frequency components with high fidelity.

Figure 2(a) shows that, when we classify a high-frequency channel (a channel with a large index), its F1 score is higher than a low-frequency channel (a channel with a small index). It indicates that the distributions of real and fake images are more distinguishable in the high-frequency channel. In other words, the fake image is not as close to the authentic image in the high-frequency channels. It contains artifacts that can be spotted more easily.

2. ImageResizing

The input image is resized from 256 × 256 to 64 × 64. As compared with the setting of raw images, the discriminant power of high-frequency channels degrades a little bit as shown in Figure 2(b). This is attributed to the fact that the down-sampling operation uses a low pass filter to alleviate aliasing. Despite the performance drop of each channel, the overall detection performance can be preserved by selecting more channels.

3. AdditiveGaussianNoise

Noisy satellite images are obtained by adding white Gaussian noise with σ = 0.1, where the dynamic range of the input pixel is [0, 1]. Thus, the relative noise level is high. We see from Figure 2(c) that low-frequency channels perform better than high-frequency channels. This is because we need to take the signal-to-noise ratio (SNR) into account. Low-frequency channels have higher SNR values than high-frequency ones. As a result, low-frequency channels have higher discriminant power.

4. JPEGCompression

The experimental results with JPEG compression of quality factor 75 are shown in Figure 2(d). We see from the figure that the performance of different channels fluctuates. Generally, the performance of low-frequency channels is better than that of high-frequency channels since the responses of high-frequency channels degrade due to higher quantization errors in JPEG compression. However, We still can get discriminant channels based on the performance of the validation data.

Generally, if only one PixelHop is used, we select several most discriminant channels for ensembles. If multiple PixelHops are used simultaneously, we select most discriminant channels from all PixelHops for ensembles.

The number of channels are also fine-tuned by the validation dataset to find the optimal number of channels. All selections are based on the F1 score performance of the validation dataset.

In the last stage, we ensemble predicted scores of all blocks in one image tile. Let N_ch denote the total number of selected channels. Since each channel has one predicted score from the previous step, each block has a feature vector of dimension N_ch. For each image, we concatenate the feature vectors of all blocks to form one feature vector of the image. Since there are 256 blocks in one tile, the dimension of the image-level feature vector is 256 × N_ch. An XGBoost classifier is trained to determine the final prediction of each tile. N_ch is a hyperparameter that is decided by the performance of the validation dataset.

An attacker may stitch real and fake image blocks to form an image tile so as to confuse the ensemble classifier. This can be handled by a visualization tool that shows pixel-wise prediction scores. That is, we use a heat map to display XGBoost prediction scores for each pixel, which is the center of of a block. Since we would like to have the pixel-wise prediction, these blocks are overlapping ones with stride equal to one. Furthermore, we can plot the heat map for each channel using the prediction score of each channel. Several examples are given in Table 1. The table has four columns. The first column shows real satellite images. The second column shows edited images, parts of which are replaced by the fake images. The third column gives the ground truth labels, where the dark blue and the yellow indicate the real and fake regions, respectively. Finally, the fourth column shows the prediction results. Cold and warm colors mean a higher probability of being real and fake, respectively. Our model can highlight the position of the fake area even for a small fake region as shown in the last row of Table 1.

To gain more insights, we show channel-wise Saab features and channel-wise heat map for DC, AC1, AC11 and AC26 frequencies of a PixelHop of dimension 3 × 3 × 3 in Table 2, where DC and AC1 are low-frequency channels, AC11 is a mid-frequency channel and AC26 is a high-frequency channel. By comparing the four heat maps, we see that A26 has the strongest discriminant power, AC11 the second while DC and AC1 have the least discriminant capability.

The UW Fake Satellite Image dataset released by the University of Washington [36] is the first publicly available dataset targeting at authentic and fake satellite image detection. Its authentic satellite images are collected from Google Earth’s satellite images while its fake satellite images are generated by CycleGAN. The base map used to generate fake satellite images are from CartoDB [3]. There are 4032 authentic color satellite images of size 256 × 256 and their fake counterparts in the dataset. The images are captured at a zoom level of 16, which is equivalent to the scale of 1:8000. It covers the three cities of Tacoma, Seattle and Beijing.

To demonstrate the generalizability of our detection method, we use StyleGAN2 [19] which is the most popular GAN on the internet and Lightweight GAN [25] which is the newest GAN that could be trained efficiently in one day to generate more fake satellite images. To reduce the training complexity, we crop images into non-overlapping sub-images of size 128χ 128. For each city, we train two GAN models. Thus, three are six GAN models in total: StyleGAN2-Beijing, StyleGAN2-Seattle, StyleGAN2-Tacoma, Lightweight GAN-Beijing, Lightweight GAN-Seattle and Lightweight GAN-Tacoma. The number of fake satellite images generated by each GAN model is the same as that of authentic images. The numbers of real and fake satellite images are summarized in Table 3. Each GAN model is trained on Nvidia V100 GPU for 150,000 steps with random translation and cutout as the augmentation. Each StyleGAN2 model takes 48 hours to train while each Lightweight GAN demands 24 training hours. We call them USC Fake Satellite Image datasets. The two datasets as well as trained GAN models are released in the GitHub.¹

The FID score [12] is a commonly used metric to evaluate the fidelity and variability of generated GAN images. Lower FID scores indicate better generated GAN images of higher fidelity and variability. We report the FID scores of UW/CycleGAN, USC/StyleGAN2 and USC/Lightweight GAN in Table 4. It is apparent that StyleGAN2 and Lightweight GAN have lower FID scores than CycleGAN. It implied that StyleGAN2 and Lightweight GAN are more difficult to detect than CycleGAN. This is consistent with experimental results given in Section 4.6. Note that CycleGAN does not have the FID for Tacoma, since the dataset only contains fake images from Beijing and Seattle.

We compare the performance of Geo-Defakehop with two previous methods in this section.

• Method by Zhaoetal. [36]

  The method extracted hand-crafted features (e.g., spatial, histogram and frequency features) from satellite images and trained an SVM classifier with these hand-crafted features to classify real and fake images.

• DefakeHop Chenetal. [4]

  The method was first proposed to detect Deepfake face videos. We tailored it to the fake satellite image detection problem by removing frame and region ensemble modules.

It is worthwhile to point out that DefakeHop is built upon successive subspace learning (SSL) while Geo-DefakeHop is based on parallel subspace learning (PSL). SSL and PSL are two different designs.

For Geo-DefakeHop, we consider four PixelHop designs:

• PixelHop A: Selected discriminant channels from 12 filters of dimension 2 × 2 × 3,

• PixelHop B: Selected discriminant channels from 27 filters of dimension 3 × 3 × 3,

• PixelHop C: Selected discriminant channels from 48 filters of dimension 4 × 4 × 3,

• PixelHop A&B&C: Selected discriminant channels from PixelHops A, B and C.

Adding more PixelHops could improve the performance since we increase the diversity of the features. However, it is a trade-off between the model size, computational complexity, and performance. In our experiment, we conducted experiments with different numbers of PixelHops. We observed that adding more PixelHops could slightly improve the performance but the model size increases. Three PixelHops offer a good tradeoff.

We compare the detection performance under six settings:

• Raw images obtained from the UW dataset;

• Image tiles being resized from 256 × 256 to 128 × 128 and to 64 × 64;

• Image tiles corrupted additive white Gaussian noise with standard deviation σ = 0.02, 0.06, 0.1;

• Image tiles coded by the JPEG compression standard.

• Split the dataset with 80-10-10, 40-10-50 and 10-10-80 setting.

• Image tiles generated by CycleGAN, StyleGAN2 and Lightweight GAN

We follow the same experimental setting as given in [36] and split the dataset as 80-10-10. The model is obtained by the training set, fine-tuned on validation set and evaluated on the test set. Training and test images go through the same image manipulation conditions. As to the performance metrics, we use the F1 score, precision and recall.

We compare the performance of three detection methods under various conditions in this subsection.

Raw Images. We conduct both training and testing on raw images from the UW dataset [36] and show the performance of the three methods in Table 5. As shown in the table, we see that PixelHop B and PixelHop A&B&C of Geo-DefakeHop achieve perfect detection performance with 100% F1 score, 100% precision and 100% recall while PixelHop A and PixelHop B achieve nearly perfect performance. Both Geo-DefakeHop and DefakeHop outperform Zhao et al.’s [36] method in all performance metrics by significant margins. There is also a clear performance gap between Geo-DefakeHop and DefakeHop.

Image Resizing. The results are shown in Table 6. For image resized to 128 × 128, both PixelHop A and PixelHop A&B&C achieve perfect performance with 100% F1 score while PixelHop B and PixelHop C achieve nearly perfect performance. For image resized to 64 × 64, we see the power of ensembles. That is, the F1 score, precision and recall of PixelHop A&B&C are all above 99%, which is slightly better than an individual PixelHop. Again, all four Geo-DefakeHop settings outperform Zhao et al. ‘s [36] method by significant margins. DefakeHop is slightly better than Zhao et al.’s [36] method but significantly worse than Geo-DefakeHop.

Additive White Gaussian Noise. We test the detection performance with three noise levels σ = 0.02, 0.06, 0.1 and show the results in Table 7. We see from the table that, if authentic or fake satellite images are corrupted by white Gaussian noise with σ = 0.02, 0.06 and 0.1, the F1 scores of GeoDefakeHop decreases from 100% to 99.01%, 96.59% and 96.10%, respectively. In contrast, the F1 scores of DefakeHop are slightly above 90% and those of Zhao et al.’s [36] method are around 80% or lower. Also, the ensemble gain of multiple PixelHops is more obvious as the noise level becomes higher.

DefakeHop is affected much less than Geo-DefakeHop. It is because De-fakeHop focus on the low-frequency components only.

JPEG Compression. Typically, QF is chosen from the range of [70, 100]. In this experiment, we encode satellite images by JPEG with QF=95, 85 and 75 and investigate the robustness of benchmarking methods against these QF values. The results are shown in Table 8. The F1 scores of Geo-DefakeHop are 98.28%, 97.91% and 97.92% for QF = 95, 85 and 75, respectively. It is interesting to note that hand-crafted feature performs better with a lower quality factor. The possible reason might be JPEG compression suppresses some noise information which derive a set of better hand-crafted features.

By comparing the three distortion types, the additive white Gaussian noise has the most negative impact on the detection performance, JPEG compression the second, and image resizing has the least impact. This is consistent with our intuition. Image resizing does not change the underlying information of images much, JPEG changes the information slightly because of the fidelity loss of high-frequencies and the additive white Gaussian noise perturbs the information of all frequencies.

We consider the weak supervision setting by reducing the number of training samples and increasing the number of test samples. That is, we split the CycleGAN dataset based on two settings: 40-10-50 and 10-10-80, where the first, second and third numbers indicate the percentages of training, validation and test data samples. Furthermore, we include two general fake image detectors based on the convolution neural networks in performance benchmarking. Motivated by [32] and [35], we use ResNet-18 pre-trained by the ImageNet as the network structure. The optimizer is SGD optimizer and the initial learning rate is 0.001 with momentum 0.9. The batch size is 32. We update the model for 50 epochs and get the model with the best validation score. We train two models: one with the original image as input and the other with the 2D FFT spectrum as the input. They are denoted by ResNet18 and ResNet18-FFT in Table 9. [32], ResNet18, ResNet18-FFT and Geo-DefakeHop all have excellent detection performance under the weak supervision setting against CycleGAN.

Table 10 compares the detection performance of the same four detection methods against CycleGAN, StyleGAN2 and Lightweight GAN models under the weak supervision setting of 10-10-80. As mentioned earlier, fake images generated by StyleGAN2 and Lightweight GAN have lower FID scores, indicating that their generated images are more difficult to detect. We see significant performance degradation of the method of [36]. ResNet18 still maintain high performance. The F1-scores of ResNet18-FFT drop around 3% to 96% from CycleGAN to StyleGAN2 and Lightweight GAN. Geo-DefakeHop can preserve high detection performance with over 99% F1-scores against all three GAN models. We also re-train the deep learning baseline model proposed by Wang et al. [32]. It achieves high performance on CycleGAN. However, the performance of StyleGAN2 and LightweightGAN drops a lot because the training dataset is small and overfitting problem.

For a PixelHop of filter size s1 × s2 × c, it has at most P_max = s1 × s2 × c filters. For example, the size of PixelHop A is 2 × 2 × 3 and P_A,max = 12. Similarly, we have P_B,max = 27 and P_C,max = 48. However, we choose only a subset of discriminant filters. They are denoted by P_A, P_B and P_c, respectively. An XGBoost classifier consists of a sequence of binary decision trees, which are specified by two hyper-parameters: the max depth and the number of trees. Each XGBoost tree consists of both leaf nodes and non-leaf nodes. Non-leaf nodes have two parameters (i.e., the dimension and the value) to split the dataset where leaf nodes have one parameter (i.e., the predicted value). We have two types of XGBoost classifiers: (1) the channel-wise classifier and (2) the ensemble classifier. For the former, the max depth and the number of the trees are set to 1 and 100 respectively. Since each tree has one non-leaf node and two leaf nodes, its model size is 4 × 100 = 400 parameters. For the latter, the max depth and the number of trees are set to 1 and 100 × P, where P = P_A + P_B + P_c is the total number of selected discriminant channels of all three PixelHops, respectively. The model size of the ensemble classifier is 4 × 100 × P = 400P parameters. As an example, we provide the model size computation detail in Table 11 for four Geo-DefakeHop designs with the raw satellite images as the input. As shown in the table, PixelHops A, B, C and A&B&C have 812, 827, 848 and 2,487 parameters, respectively. Since the selected discriminant channel numbers of PixelHops A, B, C and A&B&C vary with raw, resized, noisy and compressed input satellite images, their model sizes are different. The model sizes are summarized in Table 12.

A method called Geo-DefakeHop was proposed to distinguish between authentic and counterfeit satellite images. Its effectiveness in terms of the F1 scores, precision and recall was demonstrated by extensive experiments. Furthermore, its model size was thoroughly analyzed. It can be easily implemented in software on mobile or edge devices due to its small model size. As to future extensions, two topics are described below. First, the UW Fake Satellite Image dataset only contains the three cities of Tacoma, Seattle and Beijing. A large-scale fake satellite image dataset with more cities can be constructed to make the dataset more challenging. More manipulations such as blurring and contrast adjustment can be added to test the limitation of the detection system. Second, several frequency-aware GANs such as StyleGAN3 [17] were recently proposed to enhance the high frequency components in synthesized images. StyleGAN3 utilized Fourier features as input to define a spatially infinite map. To solve the aliasing problem which is highly detrimental to GAN, StyleGAN3 used a smaller cutoff frequency to suppress high frequency components. Although StyleGAN3 can control high frequency components in generated images with improved capability, some high frequency information is still removed in the generating process. It is interesting to see whether Geo-DefakeHop can exploit such small differences for effective fake satellite images detection.

This work was supported by the Army Research Laboratory (ARL) under agreement W911NF2020157. Computation for the work was supported by the University of Southern California s Center for High Performance Computing (hpc.usc.edu).