Unit 9 exercises

(a) There are \(50{,}000/20{,}000 = 2.5\) synthetic calls a day, of which \(0.85 \times 2.5 \approx 2.1\) are flagged. The \(49{,}997.5\) genuine calls produce \(0.03 \times 49{,}997.5 \approx 1{,}500\) false alerts, so the detector raises about 1,502 alerts a day, about 2 of them real.

(b) Precision is \(2.125/1{,}502 \approx 0.0014\), about one real alert in 700.

(c) Screening every call is hopeless at this base rate. The detector becomes useful where the base rate is much higher, for example only on calls that request a high-risk action such as changing a payee, raising a limit or resetting authentication. There, a flag can trigger the out-of-band verification that the procedure of Lesson 9.3 requires anyway, so a false alert costs one call-back instead of an investigation, and the verification protects against the synthetic calls the detector misses.

(a) Positions \(2i\), \(2i+1\) and \(2i+2\) receive a contribution from input \(i\). Even interior positions are reached from two inputs (as the end of one window and the start of the next) and odd positions from one, so the output is 1, 1, 2, 1, 2, 1, 2, 1, 2, 1, 2, 1, 1.

(b) Apart from the ends, the output alternates between 2 and 1, so it is a constant 1.5 plus an alternating term of amplitude 0.5. An alternation with period 2 samples is exactly the frequency 0.5 cycles per sample, the Nyquist frequency. The input was constant, so this energy is created by the uneven overlap, which is what Odena et al. (2016) describe and what produces checkerboards in two dimensions, where the overlap counts of the two axes multiply.

(c) With the kernel \([1, 1, 1, 1]\) and stride 2, every interior output position is reached by exactly two windows, the overlap is even, and a constant input gives a constant interior output of 2. For a general kernel \([k_0, k_1, k_2, k_3]\), even interior positions receive \(k_0 + k_2\) and odd ones \(k_1 + k_3\), so the alternation disappears only if these two sums are equal. Odena et al. (2016) observe that networks with even overlap often learn kernels that cause similar artifacts. Lab 9's second "Try this" item uses a random 4-by-4 kernel, whose four interleaved sub-kernels have different sums, so expect the periodic pattern to remain.

(a) \(\alpha_t = 1 - \beta_t\) gives 0.9, 0.8 and 0.7, so \(\bar\alpha_1 = 0.9\), \(\bar\alpha_2 = 0.72\) and \(\bar\alpha_3 = 0.504\).

(b) From \(q(x_t \mid x_0)\), a Gaussian with mean \(\sqrt{\bar\alpha_t}\, x_0\) and covariance \((1 - \bar\alpha_t) I\),

(c) Substituting \(x_0 = 0.8\) and \(\epsilon = -1\),

After three steps the signal and the noise have nearly equal weight. Real models use many more steps with smaller \(\beta_t\), so that each reverse step only has to remove a little noise.

(a) \(\gamma T = 30\), and the denominator is \(\sqrt{22.5} \approx 4.74\), since \(120 \times 0.25 \times 0.75 = 22.5\). So \(z = 18/\sqrt{22.5} \approx 3.79\), below 4. The message is not flagged, although 40% of its tokens are green against 25% expected.

(b) \(\gamma T = 60\), and the denominator is \(\sqrt{45} \approx 6.71\), since \(240 \times 0.1875 = 45\). So \(z = 36/\sqrt{45} \approx 5.37\), and the message is flagged. The same green fraction gives stronger evidence in a longer text, because \(z\) grows with \(\sqrt{T}\) at a fixed fraction.

(c) With 76 green tokens, \(z = 16/\sqrt{45} \approx 2.39\), and the message is no longer flagged. Rewriting about 4% of the tokens was enough here because the original watermark was weak; a strongly watermarked long text needs far more edits, as Kirchenbauer et al. (2023) show. Watermark evidence is a statistic, and its strength depends on length, watermark strength and editing.

(a) With \(p_g = p_{\mathrm{data}}\), \(D^*(x) = 1/2\) for every \(x\). Then

which is the global minimum identified by Goodfellow et al. (2014).

(b) At that optimum, no function of the image can tell generated samples from training data better than chance, because the two distributions are identical. Real generators do not reach it, which is why detectors work at all, but the better a generator matches the data distribution, the less there is for any detector to find. Detection based on generator artifacts is a race against generator quality, and controls that do not depend on the content (Lesson 9.3) do not have this weakness.

(a) AUC depends only on the ranking of test scores. The detector relies mostly on the last ring of the spectrum, where nearest-neighbor fakes have a much lower mean log magnitude than real images because their spectrum is exactly zero at the frequencies with a horizontal or vertical component of 0.5 cycles per pixel. JPEG compression puts nonzero values at those frequencies and raises the mean log magnitude of the fakes' last ring close to that of real images. Their scores fall sharply, below the default threshold of 0.5 that the detector also applies to uncompressed data (few fakes flagged), while the scores of real images change little and stay lower still, so most fakes are still ranked above most real images (high AUC). A deployed detector operates at a threshold, so the shift matters.

(b) Replace the training set by one in which a random half of the real and fake images has been passed through jpeg(), recompute spectra(), and refit the pipeline. The detector then sees both conditions during training, so its threshold should transfer to compressed test images, possibly at some cost on uncompressed ones. Wang et al. (2020) found that blur and JPEG augmentation improved detection on most of their test generators but lowered it on two. Report the share of fakes flagged and the share of real images flagged at the threshold, on both uncompressed and compressed test images, not only the AUC.

A change of bank account redirects salary payments, so every such request is treated as unusual regardless of channel. The payroll officer does not act on the channel that delivered the request. They call the employee back on the number recorded in the HR system (not one supplied in the request) and also send a confirmation through an authenticated channel, such as a notification in the HR portal that requires the employee's login with multifactor authentication. The change takes effect only after a waiting period, and a notice of the change is sent to the employee's contact details recorded before the request. Requests that ask for secrecy or speed, or that arrive while the employee is said to be unreachable, are escalated to a second officer. Video or voice confirmation on a call that the requester initiated never counts.

To defeat this, an attacker needs more than a convincing voice or face. They must answer a call-back to the employee's recorded number, which requires taking over that phone line, and pass the portal's multifactor authentication, which requires compromising the account and its second factor, before that notice reaches the real employee. Each of these is a separate compromise that a deepfake does not provide.