This is the web version of Eye on A.I., Fortune’s weekly newsletter covering artificial intelligence and business. To get it delivered weekly to your in-box, sign up here.
A few months ago, Chris Ume, a Belgian video effects artists, made a splash when he anonymously uploaded three videos of what seemed to be Tom Cruise goofing around to a TikTok account named “@deeptomcruise.”
The three videos went viral, ultimately garnering more than 20 million views, as people puzzled over whether they were real and tried to figure out who had produced them and how. The videos were in fact deepfakes—convincing fake videos created using an artificial intelligence technique called a generative adversarial network (or GAN.) But even digital video forensics experts were struck by their quality, calling them perhaps the best examples of the genre they’d seen to date. I was the first person to report Ume was creator of the Tom Cruise deepfakes and later, he told me a bit about his methods.
@deeptomcruise was just Ume’s personal side project. His day job was pretty cool too: working for Deep Voodoo, the visual effects studio put together by “South Park” creators Trey Parker and Matt Stone, along with British actor and screenwriter Peter Serafinowicz, to create deepfakes and other effects for their satirical comedy show “Sassy Justice.” But the Cruise videos brought Ume tons of offers for additional work. (One job he took: that Gilette Superbowl ad where a youthful Deion Sanders is seen, anachronistically, shaving with Gilette’s latest ProGlide razor before the 1989 NFL Draft; that’s Ume’s handiwork.)
This “breakdown” shows some of the methods Ume used to create the viral TikTok videos featuring a deepfake Tom Cruise.
Yesterday, Ume and I spoke again and he’s got some big news: he’s left Deep Voodoo to co-found a company called Metaphysic that will build software to streamline the process of creating deepfakes and other kinds of “synthetic media” for use in advertising, television, and film.
“We shook the world,” Ume says of his Tom Cruise deepfakes. “And a lot of production companies and Hollywood directors, they didn’t realize how good the technology is getting and they are now thinking of campaigns and movies and documentaries using this technology.”
Among those for whom the Cruise deepfakes served as a kind of “Sputnik” moment is Ume’s co-founder in Metaphysic, Tom Graham. Graham is an Australian lawyer, entrepreneur, and cryptocurrency investor. Among the companies Graham built is OmniSci, a data analytics company that was a pioneer in running large clusters of graphics processing units (GPUs), the powerful computer chips originally built for video games but which now underpin most neural network-based A.I. applications. He says Ume’s Tom Cruise videos convinced him deepfakes are on the cusp of transforming commercial video and film production. He reached out to Ume and Ume’s brother Kevin, who has served as Chris’s business manager, with the idea for Metaphysic.
Ume worked on this Gillette Super Bowl ad featuring Deion Sanders.
Ume uses open source software to produce the deepfake faces that are at the heart of his videos. But the trick lies in having the right data to feed that software, running the training process for the right length of time, and then a lot of very painstaking, manual post-production digital editing. Graham says Metaphysic will build systems to automate these steps.
Ume and Graham say that although they want to democratize the creation of high-quality deepfakes, they also want to ensure that the technology— which has been used to make nonconsensual pornography and which many fear will become a powerful weapon for political disinformation—is used ethically. Graham says that selling the software through a cloud-based platform will give Metaphysic some control: it will decide who it sells to and the software’s service and licensing terms can be used to help enforce ethical behavior. For instance, Ume says Metaphysic will never create deepfakes for, or sell its software to, those who want to use it for some political purpose.
Metaphysic plans to convene other deepfake creators, advertising agencies, film studios, and big social media companies, such as Facebook and YouTube, that are interested in keeping disinformation and libelous content off their platforms, to discuss industry-wide ethical standards on the use of deepfakes. For starters, Graham says, the people whose images are depicted in a deepfake should always have consented, or the deepfake should fall under free speech rules that exist in most countries around fair use for things such as commentary, parody or satire.
Ume says he makes deepfakes for creative purposes and never to deliberately fool people for malicious ends. Because of that, he says he favors some form of digital watermarking that would make deepfakes easy for experts to spot and track across the Internet.
Last week in Fortune, I wrote about a new A.I.-based technique for detecting deepfakes that Facebook researchers developed. It is better than most previous methods—with about 70% accuracy. I asked Tal Hassner, the lead Facebook researcher on the project, how it would do against @deeptomcruise and he admitted he couldn’t be sure. Videos of that quality are not well-represented in the benchmark dataset used to test the system. For his part, Ume is skeptical. “A lot of old footage, if you upload it to a deepfake detector, it will say it is 99% certain it is a deepfake just because the quality of the video,” he says. “These things don’t work.”
While most of the attention around deepfakes has focused on their potential to supercharge disinformation campaigns, deepfakes may wind up being most profoundly disruptive in Hollywood and on Madison Avenue. Synthetic media threatens to upend the relationship between talent and brands, and between stars and studios. The Screen Actors Guild ought to be plenty nervous. This is the biggest earthquake to hit Hollywood since “talkies” replaced silent films in the late 1920s. (My colleague Jonathan Vanian wrote about another use of GAN-based A.I. in Hollywood in the “Brain Food” section of last week’s newsletter: restoring old film footage.)
One of Ume’s latest deepfakes takes the actor Kit Harrington in the guise of his “Game of Thrones” character Jon Snow and places him in a decidedly more contemporary, domestic setting.
In fact, this revolution may be even more impactful. No longer will actors need to be on set for days or weeks. Just a day or two to shoot a person’s head from various angles and with different sorts of lighting might be sufficient; deepfake software will handle the rest. Hollywood makeup artists and stylists ought to be scared too–want to make a star appear younger or older, change their hair style, or add a beard or moustache? Other A.I. techniques based on GANs can easily add these effects after the initial filming. (Actors might still have to voice the script—although still other GAN-based algorithms can mimic voices extremely well too.) Actors will need to be careful about what their contracts say about how studios can use their image and voice once it’s been captured. Producing a sequel might require no new filming at all!
We may be witnessing the last few years in which the Academy Awards for Best Actor and Best Actress are still meaningful categories. How long will it be before a mysterious video surfaces of Tom Cruise, staring wild-eyed into the camera, saying, “Alright Mr. DeMille, I’m ready for my closeup”? If it happens, there’s a good chance that video will be authentic.
And with that, here’s the rest of this week’s news in A.I.
Jeremy Kahn
@jeremyakahn
jeremy.kahn@fortune.com
A.I. IN THE NEWS
Waymo gets a big boost to stay afloat. The self-driving car company announced it has raised a whopping $2.5 billion in additional funding from investors that included its former parent company Alphabet, private equity firm Silver Lake, tech investment house Tiger Global, Silicon Valley venture capitalists Andreesen Horowitz, car-dealership chain AutoNation Inc., and Fidelity, among others, according to The Wall Street Journal. The size of the fundraise, coming just a year after the company raised an initial $3.5 billion from investors outside of Alphabet, may indicate just how much cash the company is burning as it struggles to make good on its vision of creating roving fleets of self-driving taxis throughout the U.S. The company is operating a fully-autonomous ride-hailing service in parts of Phoenix, and recently began a trial in San Francisco. But the company is also turning to freight delivery to make revenues, announcing a new partnership with J.B. Hunt Transport Services for long-haul self-driving trucks.
Zillow is using deep learning to improve its automatic home valuations. The Internet-based real estate listing company has been using software to provide automatic house valuations for some time. But the system was based on using lots of different algorithms, each trained on a data for a particular local area. Now the company, according to an article in Wired, has started using a single neural network to make the estimates. The result has been that Zillow, which buys some houses itself, has been able to make more cash offers for properties. The company says its new deep learning system reduced price errors by 11.5% for off-market homes in 30 regions across the U.S. and allowed the company to update its valuations more frequently.
Mayflower autonomous ship runs into trouble. Ocean research non-profit ProMare and IBM have been working since 2016 to create a solar-powered trimaran that is capable of sailing autonomously across The Atlantic from Plymouth, England, to Massachusetts to commemorate the 400th Anniversary of the original Mayflower's 1620 arrival with the Pilgrims. The project faced numerous delays even before the pandemic hit, and missed its initial window to make it across the Atlantic in time for the anniversary celebrations, which in any case were curtailed due to COVID-19. It finally set sail on its Atlantic crossing last week, only to run into serious technical difficulties after just three days at sea, according to the BBC. Now it has been instructed to motor slowly back to Plymouth for repairs.
EU data privacy regulators call for an outright ban on the use of facial recognition and other biometric-based identification systems in all "publicly-accessible" places. A group representing all the national data protection authorities from the 27-member states of the bloc as well as the bloc's own data privacy watchdog jointly called for a complete ban on the use of facial recognition and other real-time biometric-based systems designed to identify individuals in "publicly-accessible" spaces, including shops or stadiums. The call goes much further than even the strict limits and need to clearly inform people they were being monitored that the EU proposed in the recently introduced Artificial Intelligence Act. Privacy campaigners had faulted that proposed law allowing too much leeway for possible use of facial recognition by law enforcement and others. My Fortune colleague David Meyer has the story here.
A.I. drug discovery Insilico raised more money from Warburg Pincus, announces partnership with Israeli pharma company Teva. Hong Kong-based Insilico, which is one of many companies around the world trying to use A.I. for drug discovery, announced it has raised another $255 million in venture capital funding from a group of investors lead by Warburg Pincus, the company said Tuesday. The company also announced a new collaboration with Israel-based company Teva to give the pharmaceutical giant access to Insilico's software that helps identify new targets for possible drugs. Using that software, Insilico itself discovered a new target for pulmonary fibrosis and then designed a completely new compound to hit that target, which it has brought through to the verge of human clinical trials.
EYE ON A.I. TALENT
EYE ON A.I. RESEARCH
Facebook has unveiled new training libraries to develop A.I. systems that are more robust to manipulated data. One problem with A.I. systems is that they can sometimes be fooled into classifying two pieces of data that are, to a human, fundamentally the same or very similar, in different ways. This opens up a way for people to game these systems, trying various subtle manipulations—brightening an image slight, capitalizing random characters in a piece of text or adding a few nonsense words, or slightly distorting an audio track—that don't detract much from a humans ability to understand that image, passage or soundtrack, but which might mean that a system designed to do something like block copyrighted material from being uploaded on to a social media platform without permission or stop a piece of content that has already been identified as hate speech from being reposted, will fail to spot that content. These manipulations can be applied manually by people, or, in some cases, they can use A.I. itself to try to find the most minimal manipulations that will still fool the A.I. watchdog.
Facebook has now open sourced a Python data library that it calls AugLy that will help anyone creating an A.I. system train it to be less susceptible to these kinds of attacks. The library include different kinds of "data augmentations" (manipulations of the data) for different "modalities" of data: text, images, and video, for example. And it even includes many multimodal examples, where text might be overlaid on an image. In a blog announcing AuGly, Facebook says "Data augmentations are vital to ensure robustness of AI models. If we can teach our models to be robust to perturbations of unimportant attributes of data, models will learn to focus on the important attributes of data for a particular use case." The company also said it used AuGly internally to train its SimSearchNet, its system for detecting identical or near-identical pieces of content in order to prevent disinformation, hate speech or copyright infringing material from being slightly tweaked and reposted. It says it also used AuGly to help evaluate how robust the competitors were in its Deepfake Detection Challenge contest.
FORTUNE ON A.I.
How top CFOs are incorporating tech into their roles—by Anne Sraders
Europe’s privacy regulators call for a ban on facial recognition in publicly accessible spaces—by David Meyer
Why investors are backing this former Facebook manager’s ‘explainable A.I.’ startup—by Jonathan Vanian
A.I. insurance firm Tractable marks ‘unicorn’ status as it expands from cars into property claims—by Jeremy Kahn
Facebook says it’s made a big leap forward in detecting deepfakes—by Jeremy Kahn
BRAIN FOOD
Companies using A.I. need to have an "adversarial" mindset. If there's a common thread running through this week's Eye on A.I., it's that people designing A.I. systems need to think hard about how someone might try abuse, misuse, trick, or manipulate that system. That's true when talking about deepfakes, and also in talking about how to use augmented datasets to make A.I. systems more resilient to slightly tweaked examples. Now here's a third case courtesy of Alex Polyakov, the founder and CEO of Israeli A.I. security startup Adversa.Al. Polyakov and his team were, with some very subtle manipulations of a photograph of Polyakov's face, able to trick the popular (but controversial) facial recognition app Pimeyes into thinking Alex was Elon Musk. What's more, unlike many previous adversarial attacks on A.I. systems, Polyakov was able to pull this off even though he never had access to the data used to train Pimeyes or to the algorithm underpinning the app.
How could he do it? Well, Polyakov tells me that it turns out that if almost all facial recognition algorithms share certain commonalities, and there are fair number of facial recognition A.l. models that freely available through open source software or open source research papers. So if you take these open source models and train an A.I. system to reliably fool them, the system will actually be able to trick almost every other facial recognition system, even those it was never specifically trained to fool. Adversa calls this attack "the Adversarial Octopus" (you can read more about it in this company blog post.)
The problem, Polyakov tells me, is that machine learning engineers, for the most part, don't spend enough time thinking about how a malicious actor could attack their software. It's a mindset problem, more than anything else, he says. "I would say most of the engineers working on A.I., they don't understand the new attack vectors," he says. He says that the security vulnerabilities that plague neural network-based systems are much more akin to things like optical illusions and other tricks on biases in human perception and cognition, than they are to traditional cybersecurity attacks where some bad code gets injected into a piece of software or a network. And like those kinds of illusions or cognitive biases, they are difficult to fix. "It is a complex problem and a new type of challenge we need to solve," he says.
