José Seco

Rosa Freitas
email: rosafreitas@ua.pt

José C Xavier

Paco Bustamante

João P Coelho

Francesca Coppola

Ryan A Saunders

Ângela Almeida

Sophie Fielding

Miguel A Pardal

Gabriele Stowasser

Giulia Pompeo

Geraint A Tarling

Andrew S Brierley

Eduarda Pereira

Oxidative stress, metabolic activity and mercury concentrations in Antarctic krill Euphausia superba and myctophid fish of the Southern Ocean

Keywords: Toxicity, Biochemical performance, Antioxidant capacity, Base line

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

The Southern Ocean ecosystem is distinctive for its low temperatures, large levels of seasonal sea ice [START_REF] Alberello | Brief communication: Pancake ice floe size distribution during the winter expansion of the Antarctic marginal ice zone[END_REF], high nutrients concentrations [START_REF] Brierley | Ecology of Southern Ocean pack ice[END_REF], and the productive upwelling regions [START_REF] Morrison | Upwelling in the Southern Ocean[END_REF]. Globally, it is also experiencing some of the highest levels of warming and ocean acidification [START_REF] Freer | Predicting ecological responses in a changing ocean: the effects of future climate uncertainty[END_REF][START_REF] Ipcc ; Shukla | Global Warming of .C. an IPCC Special Report on the Impacts of Global Warming of[END_REF][START_REF] Rintoul | Choosing the future of Antarctica[END_REF][START_REF] Turner | Antarctic climate change and the environment: an update[END_REF], which can affect individuals at a subcellular level and, in turn, alter patterns of distribution and food web structure [START_REF] Atkinson | Long-term decline in krill stock and increase in salps within the Southern Ocean[END_REF][START_REF] Xavier | Life Beyond the Ice, in: Exploring the Last Continent: an Introduction to Antarctica[END_REF]. Warming increases the release of freshwater into the Southern Ocean, particularly through accelerating the flow of glaciers, which liberates the contaminants that they store. These contaminants have the potential to cause stress to Southern Ocean fauna and it is important to describe and understand the impacts that they may have, particularly to key biomass dominant taxa.

Antarctic krill Euphausia superba is a key species in the Southern Ocean trophic web, being a major link between primary production and vertebrate predators [START_REF] Everson | Krill: Biology, Ecology and Fisheries[END_REF]. E. superba is also a very important commercial species, with 260000 tonnes harvested in 2016 [START_REF] Nicol | Products derived from krill[END_REF][START_REF] Tou | Krill for human consumption: nutritional value and potential health benefits[END_REF]; CCAMLR, 2017). This species is predominantly herbivorous, feeding mainly on phytoplankton and rarely on some copepod crustaceans [START_REF] Everson | Krill: Biology, Ecology and Fisheries[END_REF]. Whales, seals, penguins and flying seabirds are amongst those species that consume high quantities of E. superba [START_REF] Armstrong | Consumption of Antarctic krill by Minke whales[END_REF][START_REF] Croxall | Diet, provisioning and productivity responses of marine predators to differences in availability of Antarctic krill[END_REF][START_REF] Xavier | Feeding strategies and diets of breeding grey-headed and wandering albatrosses at South Georgia[END_REF]. However, given evidence of a 50-80 % decline in E. superba over long term [START_REF] Atkinson | Long-term decline in krill stock and increase in salps within the Southern Ocean[END_REF], predators may have to switch to alternative prey groups.

Myctophid fish, the most abundant group in the mesopelagic fish community worldwide [START_REF] Gjøsaeter | A review of the world resources of mesopelagic fish[END_REF], can be considered a major alternative energy source to predators in low E. superba abundance [START_REF] Murphy | Spatial and temporal operation of the Scotia Sea ecosystem: a review of large-scale links in a krill centred food web[END_REF][START_REF] Saunders | Seasonal variation in the predatory impact of myctophids on zooplankton in the Scotia Sea (Southern Ocean)[END_REF]. In the Southern Ocean, this group has an estimated biomass ranging between 70 and 200 million tones [START_REF] Collins | Patterns in the distribution of myctophid fish in the northern Scotia Sea ecosystem[END_REF][START_REF] Suzuki | Genetic Divergence and Identification of Two Controversial Lanternfishes Myctophidae: Diaphus) Based (Actinopterygii: on Mitochondrial Cytochrome b Sequences and PCR-RFLP Analysis[END_REF]. Myctophid fish are therefore an important independent trophic link between primary consumers and a wide range of higher predators, including king penguins [START_REF] Olsson | Diet of the king penguin Aptenodytes patagonicus during three summers at South Georgia[END_REF], albatrosses [START_REF] Xavier | Feeding strategies and diets of breeding grey-headed and wandering albatrosses at South Georgia[END_REF], Antarctic fur seals [START_REF] Davis | Spatial and temporal variability in the fish diet of Antarctic fur seal (Arctocephalus gazella) in the Atlantic sector of the Southern Ocean[END_REF], squid [START_REF] Kear | The Diet of Antarctic Squid -Comparison of Conventional and Serological Gut Contents Analyses[END_REF] and Patagonian toothfish [START_REF] Collins | Distribution and diet of juvenile Patagonian toothfish on the South Georgia and Shag Rocks shelves (Southern Ocean)[END_REF].

Myctophid fish prey mainly on zooplankton [START_REF] Saunders | Myctophid Fish (Family Myctophidae) Are Central Consumers in the Food Web of the Scotia Sea (Southern Ocean)[END_REF] and undertake diurnal vertical migration to feed and to avoid predators in surface waters during the day. Preyselection differs between myctophid species: Electrona antarctica consumes the amphipod Themisto gaudichaudii during summer time; Gymnoscopelus braueri preys on different species, including Themisto gaudichaudii, Metridia spp, E. superba, Pleuromamma robusta and ostracods; and G. nicholsi diet is dominated by Metridia spp. and E. superba during the summer [START_REF] Lourenço | Life cycle, distribution and trophodynamics of the lanternfish Krefftichthys anderssoni (Lonnberg, 1905) in the Scotia Sea[END_REF][START_REF] Saunders | Myctophid Fish (Family Myctophidae) Are Central Consumers in the Food Web of the Scotia Sea (Southern Ocean)[END_REF]2018). The vertical distribution of these myctophid species varies from 0 to 700 m, with E. antarctica being the species with the widest spread of depths through the water column [START_REF] Collins | Patterns in the distribution of myctophid fish in the northern Scotia Sea ecosystem[END_REF][START_REF] Saunders | Myctophid Fish (Family Myctophidae) Are Central Consumers in the Food Web of the Scotia Sea (Southern Ocean)[END_REF]2014).

When exposed to stressful conditions, including the presence of pollutants, organisms may resort to an overproduction of reactive oxygen species (ROS) in their cells, leading to a state known as oxidative stress [START_REF] Regoli | Oxidative pathways of chemical toxicity and oxidative stress biomarkers in marine organisms[END_REF]. To prevent the establishment of oxidative stress, cells possess an extensive antioxidant system, that includes enzymatic and non-enzymatic forms such as the enzymes superoxide dismutase, catalase, glutathione peroxidase, and reduced glutathione [START_REF] Regoli | Molecular and biochemical biomarkers in environmental monitoring: A comparison of biotransformation and antioxidant defense systems in multiple tissues[END_REF]. Depending on the stress level and organism's antioxidant capacity, cellular damage (namely through lipid peroxidation) and loss of redox balance (with increasing oxidation of reduced glutathione) may occur. To cope with oxidative stress, organisms may need to increase their metabolic capacity to ramp up their defence mechanisms, leading to increased electron transport system (ETS) activity and expenditure of energy reserves (e.g. glycogen) [START_REF] Cruz | Caffeine impacts in the clam Ruditapes philippinarum: Alterations on energy reserves, metabolic activity and oxidative stress biomarkers[END_REF][START_REF] Freitas | New insights on the impacts of e-waste towards marine bivalves: The case of the rare earth element Dysprosium[END_REF]. Several pollutants, including mercury (Hg), have already been shown to cause oxidative stress, as well as alterations on their metabolic capacity, in marine organisms [START_REF] Coppola | Influence of temperature rise on the recovery capacity of Mytilus galloprovincialis exposed to mercury pollution[END_REF][START_REF] Monteiro | Evidences of metabolic alterations and cellular damage in mussels after short pulses of Ti contamination[END_REF].

Despite the ecological importance of these two groups (E. superba and myctophid fish) in the pelagic realm, there is still a crucial knowledge gap regarding their ecophysiology [START_REF] Atkinson | Feeding and energy budgets of Antarctic krill Euphausia superba at the onset of winter-II. Juveniles and adults[END_REF][START_REF] Meyer | The overwintering of Antarctic krill, Euphausia superba, from an ecophysiological perspective[END_REF][START_REF] Quetin | Behavioral and Physiological Characteristics of the Antarctic Krill, Euphausia superba[END_REF], with only a few studies considering this aspect in E. superba, and virtually none in Southern Ocean myctophid, only two looking into ETS as a proxy for respiration rates [START_REF] Belcher | Respiration of mesopelagic fish: a comparison of respiratory electron transport system (ETS) measurements and allometrically calculated rates in the Southern Ocean and Benguela Current[END_REF]2019). The main goal of the present study is to describe the general oxidative stress and metabolic status of E. superba and of other three species of Antarctic myctophid fish (E. antarctica, G. braueri and G. nicholsi), to evaluate Hg concentration in these species and possible impacts on their biochemical performance, and to establish a base record for future studies. For this, antioxidant capacity, cellular damage, redox balance, metabolic capacity and energy reserves content were evaluated in all the mentioned species.

Samples were collected on board of the British research vessel RRS James Clark Ross during the austral summers of 2015/2016 (December 2015 and January 2016) in the Scotia Sea (cruise JR15004). Euphausia superba specimens were collected from the water column using an 8 m 2 mouth-opening Rectangular Midwater Trawl (RMT8; mesh size reducing from 4.5 mm to 2.5 mm in the cod end) [START_REF] Roe | A new multiple rectangular midwater trawl (RMT 1+8M) and some modifications to the institute of oceanographic sciences' RMT 1+8[END_REF]. The net was rigged with two nets that could be remotely opened and closed at different depths. Myctophid samples (Electrona antarctica, Gymnoscopelus braueri and G. nicholsi) were collected using a similar net design, with 25 m 2 mouth-opening (RMT25; mesh size reducing from 8 mm to 4.5 mm in the cod end) [START_REF] Roe | A new multiple rectangular midwater trawl (RMT 1+8M) and some modifications to the institute of oceanographic sciences' RMT 1+8[END_REF]. Samples were preserved in individual sample bags at -80 ºC.

Euphausia superba in the catches were identified and total length (TL) of each individual was measured, from the anterior edge of the eye to the tip of the telson and rounded down [START_REF] Morris | An assessment of the merits of length and weight measurements of Antarctic krill Euphausia superba[END_REF]. Sex and maturity stage were determined with reference to the presence of a petasma (males), thelycum (females) or absent (juveniles; individuals without visible external sexual characteristics) [START_REF] Ross | Reproduction in Euphausiacea[END_REF]. Myctophids were identified using published guides (Gon and Heemstra, 1990;[START_REF] Hulley | Myctophidae[END_REF] and measured for the nearest mm using standard length (SL). Sex and maturity was determined whenever possible: in some myctophid species (e.g. E. antarctica), there is sexual dimorphism associated with the location of photophores, but when this was not possible, the gonads were examined following dissection [START_REF] Yamamoto | Sex Differentiation[END_REF].

From each species (E. superba (n= 20); E. antarctica (n= 5); G. braueri (n= 5); G. nicholsi (n= 3)), samples were homogenized and used for biochemical markers measurements and for total mercury (Hg) determination. For E. superba, whole individuals were used for biochemical and Hg analysis, while for the myctophids species only muscle was analysed to avoid the inclusion of any bone.

Biochemical parameters were analysed in each species. For this, 20 individuals of E. superba (10 females, 10 males), and muscle tissue from 5 G. braueri (2 males, 3 unknow), 3 G. nicholsi (2 females, 1 male) and 5 E. antarctica (3 females, 2 males) (Table 1) were homogenized using a mortar and pestle with liquid nitrogen and sonicated for 15 s at 4 °C, after buffer addition (1:2) [START_REF] Carregosa | Physiological and biochemical responses of the Polychaete Diopatra neapolitana to organic matter enrichment[END_REF]. To determine the activity of superoxide dismutase (SOD), catalase (CAT), glutathione peroxidase (GPx), glutathione S-transferases (GSTs) enzymes and the content of glycogen (GLY) and protein (PROT), supernatants were extracted with a potassium phosphate buffer (50 mmol/L KH2PO4, 1 mmol/L ethylenediamine tetraacetic acid disodium salt hydrate (EDTA), 1 % (v/v) Triton X-100, 1 mmol/L dithiothreitol (DTT), pH 7.0). For lipid peroxidation (LPO) assessment, supernatants were obtained using 20 % (w/v) trichloroacetic (TCA). For electron transport system (ETS) activity evaluation the homogenizing buffer (0.1 mol/L Tris-HCl, 15 % (w/v) polyvinylpyrrolidone (PVP), 153 mmol/L Mg SO4, and 0.2 % (v/v) Triton-X 100, pH 8.5) was used. Samples were centrifuged for 20 min at 10 000 g (3 000 g for ETS) and 4º C [START_REF] Carregosa | Physiological and biochemical responses of the Polychaete Diopatra neapolitana to organic matter enrichment[END_REF], and supernatants were preserved at -80 ºC or analysed immediately.

The GLY content was determined according to the sulfuric acid method [START_REF] Dubois | Colorimetric Method for Determination of Sugars and Related Substances[END_REF], using glucose standards (between 0-10 mg/mL) to obtain a calibration curve.

Absorbance was measured at 492 nm after 30 min incubation at room temperature and results were expressed in mg per g of fresh weight (FW). The PROT content was determined according to [START_REF] Robinson | The biuret reaction in the determination of serum proteins I. A study of the conditions necessary for the production of a stable color which bears a quantitative relationship to the protein concentration[END_REF], following the Biuret method that uses bovine serum albumin (BSA) as standard (0 to 40 mg/mL) to obtain a calibration curve. After 10 min incubation at 30 °C, the absorbance was read at 540 nm. The results were expressed in mg per g of FW.

Metabolic capacity was assessed by measuring the ETS activity, following the method of [START_REF] King | Respiration and the activity of the respiratory electron transport system in marine zooplankton[END_REF] and modifications by De Coen and Janssen (1997). Absorbance was measured during 10 min at 490 nm in 25 s intervals and the extinction coefficient (ɛ) 15,900/M/cm was used to calculate the amount of formazan formed per unit time. Results were expressed in nmol min per g of FW.

Cellular damage was measured by the quantification of LPO levels following the method described in [START_REF] Ohkawa | Assay for lipid peroxides in animal tissues by thiobarbituric acid reaction[END_REF] with modifications referred by [START_REF] Carregosa | Physiological and biochemical responses of the Polychaete Diopatra neapolitana to organic matter enrichment[END_REF]. Absorbance was measured at 535 nm and LPO was determined using the extinction coefficient (ɛ) 156/mM/cm and results expressed in nmol of MDA equivalents formed per g of FW.

The activity of SOD was quantified based on the method of [START_REF] Beaucham | Superoxide Dismutase -Improved Assays and an Assay Applicable to Acrylamide Gels[END_REF]. SOD standards (0.25-60 U/mL) were used to generate a calibration curve. After 20 min incubation at room temperature, absorbance was measured at 560 nm. Results were expressed in U per g FW and by U per mg of PROT. The activity of CAT was quantified following Johansson and Borg (1988). Formaldehyde standards (0-150 μM) were used to produce a calibration curve. Absorbance was measured at 540 nm and results expressed in U per g FW and per mg of PROT. The activity of GPx was determined following the method of [START_REF] Paglia | Studies on the quantitative and qualitative characterization of erythrocyte glutathione peroxidase[END_REF]. Absorbance was measured at 340 nm during 5 min in 10 s intervals. Enzyme activity was calculated using the extinction coefficient (ɛ) 6.22/mM/cm and the results were expressed in U per g FW and per mg of PROT. The activity of GSTs was determined at room temperature using 1-chloro-2,4-dinitrobenzene (CDNB) as substrate according to the method described by [START_REF] Habig | Glutathione S-transferases the first enzymatic step in mercapturic acid formation[END_REF] with modifications described in [START_REF] Carregosa | Physiological and biochemical responses of the Polychaete Diopatra neapolitana to organic matter enrichment[END_REF]. The activity was determined spectrophotometrically at 340 nm using the extinction coefficient (ɛ) 9.6/mM/cm and absorbance was measured in intervals of 10 s during 5 min. The GSTs activity expressed in U per g FW and by U per mg of PROT.

Mercury concentrations were determined by thermal decomposition atomic absorption spectrometry with gold amalgamation, using a LECO AMA-254 (Advanced mercury analyser) following [START_REF] Coelho | Pattern and pathways for mercury lifespan bioaccumulation in Carcinus maenas[END_REF] methodology. Analytical quality control was performed using certified reference material (CRM; in this case TORT-2 and TORT-3 [lobster hepatopancreas, National Research Council, Canada] for E. superba; DORM-4 [Fish protein, National Research Council, Canada] for myctophids). The obtained values (mean ± standard deviation for the whole of the CRM analyses (n=13) provided recoveries ranging from 84 to 96 % (TORT-2: 88 ± 3 %; TORT-3: 89 ± 7 %; DORM-4: 91 ± 12%). The mass of CRM used for quality control analyses was adjusted to be within the range of total Hg present in the samples. Blanks were analysed at the beginning of each set of samples and the analyses were always performed at least in duplicate, until coefficient of variation were below 10%.

Data obtained from toxicology, biochemical analyses and biological factor (size, weight, sex and species) were submitted to permutational multivariate analysis of variance with the PERMANOVA+add-on in PRIMER v6 [START_REF] Anderson | PERMANOVA for PRIMER: Guide to Software and Statistical Methods[END_REF]. The pseudo-F values in the PERMANOVA main tests were evaluated in terms of significance. When the main test revealed statistical significant differences (p < 0.05), pairwise comparisons were performed.

The null hypothesis tested for each parameter was: for each biochemical parameters and Hg concentration, no significant differences existed among species.

Biochemical responses and Hg concentrations for the different species were used to calculate the Euclidean distance similarity matrix. This matrix was simplified through the calculation of the distance within the centroid matrix based on species, which was then submitted to ordination analysis, performed by Principal Coordinates (PCO). Pearson correlation vectors (r > 0.85) of physiological and biochemical descriptors and Hg concentrations were provided as supplementary variables being superimposed on the top of the PCO graph.

For all the studied species, both sexes were initially analysed separately and since no significant differences were observed in terms of biochemical performance the total number of organisms per species was pooled.

In terms of biochemical performance and Hg concentration in all the analysed organisms, the PCO analysis clearly highlights differences between species, with PCO1 explaining 64.8% of the total variation and distinguishing between E. superba (KRI) on the negative side from the myctophids species in the positive side. PCO2 explains 26.0% of the total variation, separating E. antarctica (ELN) and G. braueri (GYB) in the negative side from G. nicholsi (GYN) and E. superba (KRI) in the positive side (Figure 1).

In term of Hg levels, most probably due to lower trophic level and lifespan, E. superba had significantly lower Hg concentrations than all the myctophid fish species analysed (Table 2), with Hg concentrations in E. superba within the range of values observed in previous studies with the same species (0.008 to 0.077 g/g, Seco et al., 2019). The results obtained also showed that Hg concentrations did not significantly differ among myctophid species. To our knowledge, there is only two previous studies that reports Hg concentration in Southern Ocean myctophids, with reported concentrations within the same range as the ones obtained in the current study [START_REF] Cipro | Trace elements in invertebrates and fish from Kerguelen waters, southern Indian Ocean[END_REF][START_REF] Seco | Main drivers of mercury levels in Southern Ocean lantern fish Myctophidae[END_REF].

In terms of energy reserves, individuals of E. superba had a relatively low PROT content (Table 2) when compared with other crustaceans (Aristeus antennatus, Parapenaeus longirostris and Nephrops norvegicus) but the content of GLY was higher than in other crustacean species [START_REF] Rosa | Biochemical composition of deep-sea decapod crustaceans with two different benthic life strategies off the Portuguese south coast[END_REF]. These findings can be related to the fact that the current study was performed during the austral summer, when Southern Ocean inhabitants tend to build up energy reserves for winter time. For the 3 myctophid species, significant differences of the quantity of PROT (E. antarctica ≤ G. braueri ≤ G. nicholsi) were observed between E. antarctica and G. nicholsi, which may be related to the difference in size between both species' individuals (G. nicholsi individuals were 2 times the length of E.

Antarctica individuals; Table 1). This result is corroborated by the PCO analysis, where a close relationship between PROT content and size and weight were found (Figure 1). No significant differences on the PROT content were observed between G. braueri and the other 2 myctophid species. In terms of GLY content, no significant differences were observed among the 3 myctophid species, while E. superba had lower GLY values than G. nicholsi but there were no significant differences between E. superba and the other two myctophid species.

PROT and GLY contents were lower in E. superba compared to the three myctophid fish, which may indicate higher energetic requirements by the crustacean compared with the fish species. However, in the present study, E. superba was not the species with the highest metabolic activity and, therefore, lower GLY and PROT concentrations did not result from their expenditure in response to increased metabolism. In fact, in terms of metabolic capacity, no significant differences were observed between E. superba and both Gymnoscopelus species (Table 2). Also, the highest ETS activity observed in G. nicholsi was not accompanied by higher energy expenditure as this species presented the highest GLY and PROT contents.

Low energy reserves content in E. superba can be related with lower production and/or accumulation capacity in the crustacean compared with the fish species, however there is still a lack of knowledge regarding the energy cycle and reverses in this species. We can also hypothesize that differences in the energy reserves between E. superba and myctophid fish may be related with the dietary differences between the groups as E. superba feeds on phytoplankton [START_REF] Everson | Krill: Biology, Ecology and Fisheries[END_REF] whereas myctophid fish feed mainly in zooplankton (e.g.: E. superba, Metridia spp. and on Rhincalanus gigas [START_REF] Saunders | Seasonal variation in the predatory impact of myctophids on zooplankton in the Scotia Sea (Southern Ocean)[END_REF]).

As demonstrated previously, organisms tend to reduce their metabolism as a strategy to avoid accumulation of toxic substances, reducing for example their filtration rate and, consequently, ingestion of contaminants, as reported in estuarine bivalves [START_REF] Almeida | Presence of the pharmaceutical drug carbamazepine in coastal systems: Effects on bivalves[END_REF]2015;[START_REF] Pinto | Ecotoxicological effects of lanthanum in Mytilus galloprovincialis: Biochemical and histopathological impacts[END_REF]. Nevertheless, in the present study, the lowest ETS activity (E. antarctica) was not associated with the lowest Hg concentrations and, in the same way, the highest ETS activity observed in G. nicholsi did not correspond to higher Hg concentrations.

The ETS activity in myctophids showed to be positively correlated with size, as demonstrated in a previous study looking into ETS as a respiration rate, larger myctophids had higher ETS [START_REF] Belcher | Respiration of mesopelagic fish: a comparison of respiratory electron transport system (ETS) measurements and allometrically calculated rates in the Southern Ocean and Benguela Current[END_REF]. These preliminary data suggest that both groups of organisms may not decrease their metabolism as a strategy to avoid accumulation of pollutants or, most probably, Hg concentration in the environment was not the factor that conditioned species metabolism, since accumulated levels were very low.

Many Southern Ocean cold waters inhabitants have generally slow activity and low metabolic rates [START_REF] Abele | Formation of reactive species and induction of antioxidant defence systems in polar and temperate marine invertebrates and fish[END_REF]. In theory, this should result in lower rates of reactive oxygen species (ROS) formation in ectotherm species. It is well known that mitochondria respiration system is responsible for the generation of ROS which are responsible for cellular damage (including LPO). In the present study although lower metabolic rate (identified by lower ETS values) observed in E. antarctica was not accompanied by lower LPO values, higher LPO levels observed in G. nicholsi may result from higher ETS activity recorded in this species. In particular, LPO levels varied inter-specifically (G. nicholsi ≥ E.

antarctica > E. superba > G. braueri). Euphausia superba presented significantly higher LPO levels than G. braueri, but lower than G. nicholsi. In the fish group, E. antarctica and G. nicholsi had higher levels of LPO than G. braueri (Table 2). It is well described that LPO may occur as a consequence of pollutants exposure due to overproduction of ROS and inefficiency of antioxidant mechanisms (among others, [START_REF] Regoli | Oxidative pathways of chemical toxicity and oxidative stress biomarkers in marine organisms[END_REF]. In the present study, the highest LPO levels identified in G. nicholsi did not correspond to higher Hg tissue concentrations, which, once again, may corroborate the hypothesis that Hg concentrations observed in organisms were not high enough to induce cellular alterations. Also, a study on oxidative stress profiles on Dicentrarchus labrax, demonstrated that in some cases higher contamination levels do not result in LPO increase (Hg 0.04 g/g and 0.08 g/g) [START_REF] Mieiro | Brain as a critical target of mercury in environmentally exposed fish (Dicentrarchus labrax) -Bioaccumulation and oxidative stress profiles[END_REF].

Regarding the activity of antioxidant enzymes (Table 2, Figure 1), significantly lower values were observed in E. superba than in some of the myctophid group (E. antarctica and G. nicholsi for SOD and G. braueri for CAT), while no significant differences were found among the three myctophid species. GPx activity presented no changes among all the analysed species whereby it may not be influenced by environmental conditions, with similar response in all studied species. Detoxification enzymes, like GSTs, are related to elimination routes of contaminants (e.g., Hg) [START_REF] Elia | Antioxidant responses and bioaccumulation in Ictalurus melas under mercury exposure[END_REF]. In the present study GSTs levels showed no significant differences among species, with no relationship with the Hg concentrations in organism's tissues. The results obtained for GSTs activity were lower than the ones observed by other authors for E. superba [START_REF] Tremblay | Response of three krill species to hypoxia and warming: an experimental approach to oxygen minimum zones expansion in coastal ecosystems[END_REF]. Once again, these results may indicate that due to the low Hg concentration in seawater, and consequently low accumulation levels in the studied species, defence mechanisms were not responding to Hg tissues concentrations. From the literature published on this topic it is possible to conclude that antioxidant responses in E. superba vary between studies: SOD levels were lower in the present study, but CAT activity was higher in samples collected in 2011, also around South Georgia [START_REF] Tremblay | Response of three krill species to hypoxia and warming: an experimental approach to oxygen minimum zones expansion in coastal ecosystems[END_REF]. GPx was also lower than in individuals captured in the eastern Antarctic sector in 2006, when compared with the control individuals of the study performed by 2017. Thus, the obtained results demonstrated that the activity of antioxidant and biotransformation enzymes was similar among species, regardless the LPO levels and Hg concentration. Such response may indicate low stress levels in the organisms caused by low Hg concentrations accumulated by the organisms, with increased LPO levels resulting from increased metabolic capacity rather than contamination levels.

Overall, the present findings highlighted that G. nicholsi presented higher levels in almost all the analysed biochemical parameters. This performance may be due to a difference in size, compared with the other analysed species. To the best of our knowledge, this is the first study reporting biochemical parameters in Southern Ocean myctophid fish. The unique environmental features of the Southern Ocean, and its highly specialized inhabitants, are likely to make it very sensitive to environmental change. With ocean warming, increased levels of glacial melt and higher amounts of freshwater input, levels of contaminants (like Hg) may increase further into the future. Oxidative stress and metabolic capacity will be among the first biological responses of resident species to contaminants. So, it is important to describe levels of natural variation in these parameters for future comparisons.

The present study provides values for a number of metabolic parameters (PRO, GLY, ETS, LPO, CAT, ETS, GPx, SOD, GSTs) for E. superba and three biomass dominant myctophid species, all of which play key roles in Southern Ocean ecosystem function. At present, none of the studied biochemical parameters shows any positive or negative relationship with levels of Hg found within tissues. Nevertheless, these values provide an important baseline to establish whether any future increases in contamination levels are having a notifiable effect on species' metabolic capacity and biochemical performance.

ACKNOWLEDGEMENTS:

We thank the officers, crew and scientists aboard RSS James Clark Ross during cruises JR15004 for their in collecting samples. We Table 2. Biomarkers and mercury (Hg) concentration measured in each species. Biomarkers: PROT: protein content; LPO: lipid peroxidation levels; ETS: Electron transport system; GLY: Glycogen content; GPx: Glutathione peroxidase; GSTs: Glutathione S-transferases activity; SOD: superoxide dismutase activity; CAT: catalase activity. Units are presented per gram of fresh weight (FW) and per mg of protein (PROT) for comparison with resul from the literature.

  acknowledge the financial support of the Portuguese Foundation for the Science and Technology (FCT) through a PhD grant to José Seco (SRFH/PD/BD/113487), and the Portuguese Polar Program PROPOLAR. This study also benefited from the strategic program of MARE (Marine and Environmental Sciences Centre) financed by FCT (UIDB/04292/2020). Rosa Freitas was funded by national funds (OE), through FCT, in the scope of the framework contract foreseen in the numbers 4, 5 and 6 of the article 23, of the Decree-Law 57/2016, of August 29, changed by Law 57/2017, of July 19. JP Coelho was funded by the Integrated Program of SR&TD 'Smart Valorization of Endogenous Marine Biological Resources Under a Changing Climate' (Centro-01-0145-FEDER-000018), co-funded by Centro 2020 program, Portugal 2020 and the European Regional Development Fund.Thanks are due for the financial support to CESAM (UIDB/50017/2020+UIDP/50017/2020

Figure 1 .

 1 Figure 1. Ordination diagram based on biomarkers, biological characteristic and mercury (Hg) concentration. ELN -Electrona Antarctica, GYB -Gymnoscopelus braueri; GYN -Gymnoscopelus nicholsi; KRI -Euphausia superba; PROT -protein content; LPO -lipid peroxidation levels; ETS -Electron transport system activity; GLY -Glycogen content; GPx -Glutathione peroxidase; GSTs -Glutathione S-transferases activity; SOD -superoxide dismutase activity; CAT -catalase activity; Hg -Mercury concentration.

Table 1 .

 1 ). The Institut Universitaire de France (IUF) is acknowledged for its support to P. Bustamante as a Senior Member. RAS, SF, GS and GT were supported by the British Antarctic Surveys Ecosystem Programme, which is part of NERC and UKRI. Total number, mean length and weight values for each collected species and location (latitude and longitude) of sampling areas on the Scotia sea, surveyed during the austral summer of 2015/2016.

	Species	N	Total length (mm)	Weight (g)	Latitude	Longitude
	Euphausia superba	20	5.1 ( 0.3)	1.2 (0.3)	-60.3131	-46.8488
	Electrona antarctica	5	82 ( 14)	6.3(5.4)	-59.9861	-47.22192
	Gymnoscopelus braueri	5	104 ( 11)	9.1 (2.9)	-59.9861	-47.22192
	Gymnoscopelus nicholsi	3	148 ( 8)	14.7 (5.9)	-60.33097	-46.67431

25.54 (1.41) b 118.99 (38.51) c 42.45 (10.71) a, b

	76.86	0.34	3.73	0.01	20.11	0.09	5.07	0.11	0.13	1.79
	(7.99) c	(0.17)	(0.84) b	(0.005)	(10.20) a, b	(0.05)	(1.92) a	(0.04)	(0.04) a	(1.66)


Ritaban Roy

Indu Joshi
email: indu.joshi@cse.iitd.ac.in

Abhijit Das
email: abhijit.das@thapar.edu

Antitza Dantcheva
email: antitza.dantcheva@inria.fr

3D CNN Architectures and Attention Mechanisms for Deepfake Detection

Introduction

Manipulated images date back to the creation of the first photograph in the year 1825 [START_REF] Farid | Photo tampering throughout history[END_REF]. Related manipulation techniques have been widely driven by profit stemming from identity theft, age deception, illegal immigration, organized crime, and espionage, inflicting negative consequences on businesses, individuals, and political entities. While forgery was associated with a slow, painstaking process usually reserved for experts, we are entering new levels of manipulation of images and video, where deep learning and related manipulation are streamlined to reduce costs, time and skill needed to doctor images and videos. Automated generation and manipulation of audio, image and video bares highly exciting perspectives for science, art and video productions, e.g., video animation, special effects, reliving already passed actors.

While highly intriguing from computer vision perspective, deepfakes entail a number of challenges and threats, given that (a) such manipulations can fabricate animations of subjects involved in actions that have not taken place and (b) such manipulated data can be circumvented nowadays rapidly via social media. Particularly, we cannot trust anymore, what we see or hear on video, as deepfakes betray sight and sound, the two predominantly trusted human innate senses [START_REF] Silbey | The upside of deep fakes[END_REF]. Given that (i) our society relies heavily on the ability to produce and exchange legitimate and trustworthy documents, (ii) sound and images have recorded our history, as well as informed and shaped our perception of reality, e.g., axioms and truths such as "I'll believe it when I see it." "Out of sight, out of mind." "A picture is worth a thousand words.", as well as (iii) social media has catapulted online videos as a mainstream source of information; deepfakes pose a threat of distorting what is perceived as reality. To further fuel concern, deepfake techniques have become open to the public via phone applications such as FaceApp , ZAO and Wombo . Further, digital identity , associated to the entire collection of information generated by a person's online activity including usernames and passwords, photographs, online search activities, birth date, social security becomes highly vulnerable, with deepfakes entailing the premise to inflict severe damage. Additional social threats [START_REF] Chesney | Deep fakes: A looming challenge for privacy, democracy, and national security. 107 california law review[END_REF][START_REF] Eichensehr | Don't believe it if you see it: Deep fakes and distrust[END_REF] can affect domains such as journalism, education, individual rights, democratic systems and have intrigued already a set of journalists .

We differentiate two cases of concern: the first one has to do with deepfakes being perceived as real, and the second relates to real videos being misdetected for fake, the latter referred to as "liar's dividend". Given such considerations, e.g., video evidence becomes highly questionable.

Recent research on deepfake generation proposed approaches, where forged videos are created based on a short video of the source person [START_REF] Thies | Face2face: Real-time face capture and reenactment of rgb videos[END_REF][START_REF] Kim | Deep video portraits[END_REF], as well as from a single ID photo [START_REF] Averbuch-Elor | Bringing portraits to life[END_REF] of the source person. In addition, fully synthesized audio-video images are able to replicate synchronous speech and lip movement [START_REF] Suwajanakorn | Synthesizing obama: learning lip sync from audio[END_REF] of a target person. Hence deepfakes coerce the target person in a video to reenact the dynamics of the source person.

Two deepfake-schemes have evolved, corresponding to head puppetry (the dynamics of a head from a source person are synthesized in a target person), as well as face swapping (the whole face of a target person is swapped with that of a source person). Lip syncing (the lip region of the target person is reenacted by the lip region of a source person) falls in the first cateory. Currently such manipulations include subtle imperfections that can be detected by humans and, if trained well, by computer vision algorithms [START_REF] Li | In ictu oculi: Exposing AI generated fake face videos by detecting eye blinking[END_REF][START_REF] Korshunov | Vulnerability assessment and detection of deepfake videos[END_REF][START_REF] Agarwal | Protecting world leaders against deep fakes[END_REF]. Towards thwarting such attacks, early multimedia forensics based detection strategies have been proposed [START_REF] Agarwal | Protecting world leaders against deep fakes[END_REF][START_REF] Sabir | Recurrent convolutional strategies for face manipulation detection in videos[END_REF][START_REF] Amerini | Deepfake video detection through optical flow based cnn[END_REF][START_REF] Dang | On the detection of digital face manipulation[END_REF]. Such strategies, although essential, cannot provide a comprehensive solution against manipulated audio, images and video. Specifically, the detection of deepfakes is challenging for several reasons: (a) it evolves a "cat-and-mouse-game" between the adversary and the system designer, (b) deep models are highly domain-specific and likely yield big performance degradation in cross-domain deployments, especially with large train-test domain gap.

The manipulation scenario of interest in this work has to do with a face video or expressions of a target person being superimposed to a video of a source person, widely accepted and referred to as deepfake.

Contributions

Motivated by the above, this work makes following contributions.

(i) We compare state of the art video based techniques in detecting deepfakes. Our intuition is that current state of the art forgery detection techniques [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF][START_REF] Rössler | Faceforensics++: Learning to detect manipulated facial images[END_REF][START_REF] Cozzolino | Recasting residual-based local descriptors as convolutional neural networks: an application to image forgery detection[END_REF][START_REF] Bayar | A deep learning approach to universal image manipulation detection using a new convolutional layer[END_REF][START_REF] Rahmouni | Distinguishing computer graphics from natural images using convolution neural networks[END_REF][START_REF] Afchar | Mesonet: a compact facial video forgery detection network[END_REF] omit a pertinent clue, namely motion, by investigating only spatial information. It is known that generative models have exhibited difficulties in preserving appearance throughout generated videos, as well as motion consistency [START_REF] Tulyakov | MoCoGAN: Decomposing motion and content for video generation[END_REF][START_REF] Vondrick | Generating videos with scene dynamics[END_REF][START_REF] Saito | Temporal generative adversarial nets with singular value clipping[END_REF][START_REF] Wang | G3AN disentangling appearance and motion for video generation[END_REF]. Hence, we here show that using 3DCNNs indeed outperforms state of the art image-based techniques.

(ii) We show that such models trained on known manipulation techniques generalize poorly to tampering methods outside of the training set. Towards this, we provide an evaluation, where train and test sets do not intersect with respect to manipulation techniques.

(iii) We determine the efficacy of two attention mechanisms, namely SE-block and Non-local networks by comparing the number of parameters, inference time and classification performance for deepfake detection. We find that a non-local neural network indeed improves the classification accuracy of 3DCNNs without introducing significant computational overhead.

(iv) Lastly, we analyze the correlation matrix of learnt features, as well as activations of Seg-Grad-Cam [START_REF] Vinogradova | Towards interpretable semantic segmentation via gradient-weighted class activation mapping (student abstract)[END_REF] to give insight on how attention mechanisms work.

We note that this Chapter extends the work of Wang and Dantcheva [START_REF] Wang | A video is worth more than 1000 lies. comparing 3dcnn approaches for detecting deepfakes[END_REF] by contributions (iii) and (iv).

Related Work

A very recent survey has revisited image and video manipulation approaches and early detection efforts [START_REF] Tolosana | Deepfakes and beyond: A survey of face manipulation and fake detection[END_REF]. An additional comprehensive survey paper [START_REF] Xu | Adversarial attacks and defenses in images, graphs and text: A review[END_REF] reviews manipulations of images, graphs and text.

Generative adversarial networks (GANs) [START_REF] Goodfellow | Generative adversarial nets[END_REF] have enabled a set of face manipulations including identity [START_REF] Karras | A style-based generator architecture for generative adversarial networks[END_REF][START_REF] Majumdar | Evading face recognition via partial tampering of faces[END_REF], facial attributes [START_REF] Wang | From attributes to faces: a conditional generative adversarial network for face generation[END_REF], as well as facial expressions [START_REF] Liu | Conditional adversarial synthesis of 3D facial action units[END_REF][START_REF] Jiang | Deeperforensics-1.0: A large-scale dataset for real world face forgery detection[END_REF][START_REF] Wang | G3AN disentangling appearance and motion for video generation[END_REF][START_REF] Wang | ImaGINator conditional spatio-temporal gan for video generation[END_REF][START_REF] Wang | InMoDeGAN interpretable motion decomposition generative adversarial network for video generation[END_REF]].

Deepfake Detection

While a number of manipulation-detection-approaches are image-based [START_REF] Afchar | Mesonet: a compact facial video forgery detection network[END_REF][START_REF] Rössler | Faceforensics++: Learning to detect manipulated facial images[END_REF], others are targeted towards video [START_REF] Li | In ictu oculi: Exposing AI generated fake face videos by detecting eye blinking[END_REF][START_REF] Agarwal | Protecting world leaders against deep fakes[END_REF][START_REF] Sabir | Recurrent convolutional strategies for face manipulation detection in videos[END_REF] or jointly towards audio and video [START_REF] Korshunov | Speaker inconsistency detection in tampered video[END_REF]. We note that although some video-based approaches might perform better than image-based ones, such approaches are only applicable to particular kinds of attacks. For example, many of them [START_REF] Li | In ictu oculi: Exposing AI generated fake face videos by detecting eye blinking[END_REF][START_REF] Agarwal | Protecting world leaders against deep fakes[END_REF] may fail, if the quality of the eye area is not sufficiently good or the synchronization between video and audio is not sufficiently natural [START_REF] Korshunov | Vulnerability assessment and detection of deepfake videos[END_REF].

Image-based approaches are general-purpose detectors, for instance, the algorithm proposed by Fridrich and Kodovsky [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF] is applicable to both steganalysis and facial reenactment video detection. Rahmouni et al. [START_REF] Rahmouni | Distinguishing computer graphics from natural images using convolution neural networks[END_REF] presented an algorithm to detect computer-generated images, which was later extended to detecting computer-manipulated images. However, performance of such approaches on new tasks is limited compared to that of task-specific algorithms [START_REF] Rössler | Faceforensics++: Learning to detect manipulated facial images[END_REF].

Agarwal et al. exploited both, facial identity as well as behavioural biometrics information provided by the temporal component of videos to classify a video as real or fake [START_REF] Agarwal | Detecting deep-fake videos from appearance and behavior[END_REF]. Cozzolino et al. used temporal facial features to learn behaviour of a person and use this as an identifier to compare characteristics in the presented video and verify the claim of identity [START_REF] Cozzolino | ID-Reveal: Identity-aware deepfake video detection[END_REF]. Guarnera et al. argued that deepfake videos contain a forensic trait pertaining to the generative model used to create them. Specifically, they showed that convolutional traces are instrumental in detecting deepfakes [START_REF] Guarnera | Deepfake detection by analyzing convolutional traces[END_REF]. Khalid and Woo [START_REF] Khalid | Oc-fakedect: Classifying deepfakes using one-class variational autoencoder[END_REF] posed deepfake detection as an anomaly detection problem and used variational autoencoder for detecting deepfakes. Hernandez-Ortega [START_REF] Hernandez-Ortega | Deepfakeson-phys: Deepfakes detection based on heart rate estimation[END_REF] pro-posed a deepfake detection framework based on physiological measurement, namely heart rate using remote photoplethysmography (rPPG). Trinh et al. [START_REF] Trinh | Interpretable and trustworthy deepfake detection via dynamic prototypes[END_REF] utilized dynamic representations (i.e., prototypes) to explain deepfake temporal artifacts. Sun et al. [START_REF] Sun | Domain general face forgery detection by learning to weight[END_REF] attempted to generalize forgery face detection by proposing a framework based on meta-learning. Tolosana et al. [START_REF] Tolosana | Deepfakes and beyond: A survey of face manipulation and fake detection[END_REF] revisited first and second DeepFake generations w.r.t. facial regions and fake detection performance.

We show in this work that such algorithms are indeed challenged, if confronted with manipulation techniques outside of the training data.

Rössler et al. [START_REF] Rössler | Faceforensics++: Learning to detect manipulated facial images[END_REF] presented a comparison of existing handcrafted, as well as deep neural networks (DNNs), which analyzed the FaceForensics++ dataset and proceeded to detect adversarial examples in an image-based manner. This was done for (i) raw data, (ii) high quality videos compressed by a constant rate quantization parameter equal to 23 (denoted as HQ), as well as (iii) low quality videos compressed by a quantization rate of 40 (denoted as LQ). There were two training-settings used: (a) training on all manipulation methods concurrently, (b) individual training on each manipulation method separately. These two settings refer to the first two scenarios of interest in this work.

We summarize for training setting (a), which is the more challenging setting (as indicated by lower related detection rates).

1. Raw data: It is interesting to note that the correct detection rates for all seven compared algorithms ranged between 97.03% and 99.26%. The highest score was obtained by the XceptionNet [START_REF] Chollet | Xception: Deep learning with depthwise separable convolutions[END_REF]. 2. HQ: High quality compressed data was detected with rates, ranging between 70.97% and 95.73% (XceptionNet). 3. LQ: Intuitively low quality compressed data had the lowest detection rates with 55.98% to 81% (XceptionNet).

We here focus on the LQ-compression as the most challenging setting. We note that reported detection rates pertained to the analysis of a facial area with the dimension 1.3 times the cropped face. Analyzing the full frame obtained lower accuracy.

A challenge, not being addressed by Rössler et al. has to do with the generalization of such methods. When detection methods, as the presented ones are confronted with adversarial attacks, outside of the training set, such networks are challenged. This has to do with the third scenario of interst in this chapter.

Attention Mechanisms

Attention mechanisms are designed to identify and focus on salient information, which can facilitate improved decisions. Deepfake videos are acquired in uncontrolled conditions and can include a number of artificially created objects in the background (e.g., news-banners). We hypothesize that attention mechanisms are instrumental in facilitating improved classification accuracy of a deepfake detector by enabling the model to focus on discriminative information. Additionally, visualization of attention maps are beneficial in interpretation of the taken decision.

The understanding about attention can be derived from Naradaya-Watson's regression model [START_REF] Nadaraya | On estimating regression[END_REF][START_REF] Watson | Smooth regression analysis[END_REF]. Given the paired training data {( 1 , 1 ), ( 2 , 2 )...( , )}, for a given test example , a regression model predicts the target value ˆ as

ˆ = =1 ( , ) (1)
i.e. the target value is a weighted average of training instances. Here, the weight ( , ) signifies the relevance of training instance for making a prediction for . Attention mechanisms in deep models are analogous to Naradaya-Watson's regression model, as such models are similarly designed to learn a weighting function.

Attention models incorporate an encoder-decoder architecture, solving the pitfall of auto-encoder by allowing the decoder to access the entire encoded input sequence. Attention aims at automatically learning an attention weight, which captures the relevance between the encoder hidden state, i.e., candidate state and the decoder hidden state i.e., the query state. The seminal work on attention was proposed by Bahdanau et al. [START_REF] Bahdanau | Neural machine translation by jointly learning to align and translate[END_REF] for a sequence-to-sequence modeling task. Attention modelling has evolved to different type of attention based on the category of input and output, as well as application domain. While the input of an attention model constitute an image, sequence, graph or tabular data and, the output is represented by an image, sequence, embedding or a scalar. We note that attention can be categorised based on number of sequences, number of abstraction levels, number of positions, as well as number of representations [START_REF] Chaudhari | An attentive survey of attention models[END_REF]. We proceed to explain such types in details.

With respect to number of sequences, attention can be of three types, namely distinctive, co-attention and self attention. While in distinctive attention candidate and query states belong to two distinct input and output sequences, in self attention [START_REF] Parmar | Image transformer[END_REF][START_REF] Vaswani | Attention is all you need[END_REF] the candidate and query states belong to the same sequence. In contrast, co-attention accepts multiple input sequences as input at the same time and jointly produces an output sequence.

Considering number of abstraction, attention can be divided into two type of levels, namely single-level and multi-level. In single level attention weights are computed only for the original input sequence, whereas in multilevel there are lower and higher level of abstraction, works can be organized in top-down or bottom-up approaches.

While considering the number of positions, attention can be of two types, soft/global and hard/local. Hard attention requires the weights to be binary; for instance, a model that crops the image towards naturally discarding non-necessary details [START_REF] Guan | Diagnose like a radiologist: Attention guided convolutional neural network for thorax disease classification[END_REF]. A major limitation of hard attention is that it is implemented using stochastic non-differentiable algorithms [START_REF] Baradel | Glimpse clouds: Human activity recognition from unstructured feature points[END_REF][START_REF] Mnih | Recurrent models of visual attention[END_REF]. As a result, models employing it cannot be trained in an end-to-end manner. Daviating from this, models employing soft attention take an image or video as input and soft-weigh the region of interest [START_REF] Jaderberg | Spatial transformer networks[END_REF][START_REF] Wang | Residual attention network for image classification[END_REF]. Soft weighing is ensured by employing either sigmoid or softmax after the attention gates. This allows weights to be real valued and the objective function to be differentiable.

Based on number of representations we have multi-representational and multidimensional attention. While in the former different aspects of the input are considered, in the latter focus is placed on determining the relevance of each dimension of the input.

Finally, with respect to type of architecture, related attention models can be implemented as encoder-decoder, transformer and memory networks. An encoderdecoder based attention model takes any input representation and reduces it to a single fixed length, a transformer network aims to capture global dependencies between input and output, and in memory networks facts that are more relevant to the query are filtered out.

Application domains of attention include (i) natural language processing, (ii) computer vision, (iii) multi-modal tasks, (iv) graphical systems and (v) recommender systems. Visual attention brings to the fore a vector of importance weights; in order to predict or infer one element, e.g., a pixel in an image, we estimate using the attention vector how meaningful it is. In particular in this scenario, attention modules are designed to indicate decisive regions of an input, for the task in hand. The output of an attention module is a vector, representing relative importance. This vector is then used to re-weight network parameters, so that pertinent characteristics have higher weights. Consequently, an attention module boosts the model's performance in a targeted task. For this work we introduce a self attention, soft attention, single level, multidimensional attention for deepfake detection.

We proceed to describe two promising modules used extensively and successfully in image and video processing applications, and which we employ in this chapter, viz. non-local block, which is based on transformer network and squeeze and excitation that is based on an encoder-decoder network. Layer

Name Output Size Architecture Conv_1 16×112×112 7×7×7, 3, stride (1,2,2) Res_1 16×56×56 3×3×3 maxpool, stride 2 1 × 1 × 1, 64 3 × 3 × 3, 64 1 × 1 × 1, 256 ×3 Res_2 8×28×28 1 × 1 × 1, 128 3 × 3 × 3, 128 1 × 1 × 1, 512 ×4 Res_3 4×14×14 1 × 1 × 1, 256 3 × 3 × 43, 256 1 × 1 × 1, 1024 × 23 Res_4 2×7×7 1 × 1 × 1, 256 3 × 3 × 3, 256 1 × 1 × 1,

Non-local Block

The architecture of a non-local block [START_REF] Wang | Non-local neural networks[END_REF] is based on the observation that convolutional and recurrent operations process only a local neighbourhood. Consequently, these fail to capture long range dependencies. To overcome this limitation of CNNs, non-local block performs a non-local operation to compute feature responses (see Figure 1 and Table 1). A non-local operation is characterized by computing the response at a position as a weighted sum of features at all positions in the input feature maps.

Given that video processing requires access to information in distant pixels in space an time, computation of long-range dependencies is necessitated. Non-local operations enable a CNN to capture long-range dependencies and thus are highly beneficial in video processing. Formally, in the context of CNNs, a non-local operation is defined as

= 1 ( ) ∀ ( , ) ( ), (2)
where and denote the input and output feature, respectively. represents a pairwise function that computes a relationship (e.g., affinity) between pixels and . signifies a unary function, which computes a representation of input feature at pixel . ( ) is a normalization factor and is set as ( ) = ∀ ( , ).

In this chapter, the default choices of and are used. is a linear embedding and is defined as ( ) =

. Pairwise function is defined as

( , ) = ( ) ( ) , (3)
where ( ) = and ( ) = are the associated embeddings. This pairwise function is called embedded Gaussian and primarily computes dot-product similarity in the embedding space.

Squeeze and Excitation block

The Squeeze and Excitation (SE) block [START_REF] Hu | Squeeze-and-excitation networks[END_REF] boosts the representational power of a CNN by modelling inter-dependencies between channels of the features learnt by it (see Figure 2). As illustrated in Figure 3, the SE block comprises of two operators: squeeze and excitation. While the squeeze operation aggregates features across spatial dimensions and creates a global distribution of channel-level feature response, the excitation operation is a self-gating mechanism that generates a vector of per-channel re-calibration weights. We proceed to define both operations. Squeeze Operation Let us assume that the input feature ∈ × × is represented as =[ 1 , 2 , .... ], where ∈ × . The squeeze operation exploits global spatial information by squeezing through global average pooling and creating a channel descriptor, ∈ where ℎ element of is calculated as

= ( ) = 1 × =1 =1 ( , ). (4)
Excitation Operation exploits information acquired through squeeze operation to model dependency among channels through gating with sigmoid activation. Formally, squeeze operation is defined the following.

= ( , 1 , 2 ) = ( 2 ( 1 )), (5)
where 1 ∈ × , 2 ∈ × . In this context denotes the modulation weights per channel and denotes ReLU. The recalibrated feature is then computed as

˜ = ( , ) = ˜ = [ ˜ 1 , ˜ 2 , .... ˜ ]. (6)
We proceed to discuss the dataset.

Dataset

The FaceForensics++ dataset [START_REF] Rössler | Faceforensics++: Learning to detect manipulated facial images[END_REF] comprises of 1000 talking subjects, represented in 1000 real videos. Further, based on these 1000 real videos, 4×1000 adversarial examples have been generated by following four manipulation schemes.

1. Face-swap represents a graphic approach transferring a full face region from a source video to a target video. Using facial landmarks, a 3D template model employs blend-shapes to fit the transferred face. FaceSwap . 2. Deepfakes has become the synonym for all face manipulations of all kind, it origins to FakeApp and faceswap github . 3. Face2face [START_REF] Thies | Face2face: Real-time face capture and reenactment of rgb videos[END_REF] is a facial reenactment system that transfers the expressions of a source video to a target video, while maintaining the identity of the target person.

Based on an identity reconstruction, the whole video is being tracked to compute per frame the expression, rigid pose, and lighting parameters. 4. Neuraltextures [START_REF] Thies | Deferred neural rendering: Image synthesis using neural textures[END_REF] incorporates facial reenactment as an example for a Neural-Textures-based rendering approach. It uses the original video data to learn a neural texture of the target person, including a rendering network that has been trained with a photometric reconstruction loss in combination with an adversarial loss.

Only the facial expression corresponding to the mouth region is being modified, i.e., the eye region stays unchanged.

Algorithms

We select three state of the art 3D CNN methods, which have excelled in action recognition. We proceed to briefly describe them.

• I3D [START_REF] Carreira | Quo vadis, action recognition? a new model and the kinetics dataset[END_REF] incorporates sets of RGB frames as input. It replaces 2D convolutional layers of the original Inception model by 3D convolutions for spatio-temporal modeling and inflates pre-trained weights of the Inception model on ImageNet as its initial weight. Results showed that such inflation has the ability to improve 3D models. • 3D ResNet [START_REF] Hara | Can spatiotemporal 3D CNNs retrace the history of 2D CNNs and imagenet?[END_REF] and 3D ResNeXt are inspired by I3D, both extending initial 2D

ResNet and 2D ResNeXt to spatio-temporal dimension for action recognition. We note that deviating from the original ResNet-bottleneck block, the ResNeXt-block introduces group convolutions, which divide the feature maps into small groups.

We also conducted experiments with the 3D ResNet modified with squeezeexcitation blocks and non-local block, and the 3D ResNeXt modified with nonlocal block to investigate the effect of using self attention on these networks.

Given the binary classification problem in this work, we replace the prediction layer in all networks by a single neuron layer, which outputs one scalar value. All three networks have been pre-trained on the large-scale human action dataset Kinetics-400. We inherit the weights in the neural network models and further fine-tune the networks on the FaceForensics++ dataset in all our experiments. We detect and crop the face region based on facial landmarks, which we detect in each frame using the method from Bulat and Tzimiropoulos [START_REF] Bulat | How far are we from solving the 2D & 3D face alignment problem? (and a dataset of 230,000 3D facial landmarks)[END_REF]. Next, we enlarge the detected region by a factor of 1.3, in order to include pixels around the face region.

Experiments

We conduct experiments on the manipulation techniques listed above with the algorithms I3D, 3D ResNet and 3D ResNext aiming at training and detecting (a) all manipulation techniques, (b) each manipulation technique separately, as well as (c) cross-manipulation techniques. Towards this, we split train, test and validation sets according to the protocol provided in the FaceForensics++ dataset.

We use PyTorch to implement our models. The three entire networks are trained end-to-end on 4 NVIDIA V100 GPUs. We set the learning rates to 1 -3 . For training, I3D accepts videos of 64 frames with spatial dimension 224 × 224 as input. The size of input of 3D ResNet and 3D ResNeXt are 16 frames of spatial resolution 112 × 112. For testing, we split each video into short trunks, each of temporal size of 250 frames. The final score assigned to each test video is the average value of the scores of all trunks.

We also investigate the impact of two attention mechanisms on 3D ResNet, namely Squeeze-Excitation blocks and Non-local blocks. In the case of the 3D ResNet with the Squeeze-Excitation (SE) blocks, the network is trained from scratch as the SE blocks are incorporated in the bottleneck modules themselves. Despite this addition not performing at par with the original 3D ResNet pre-trained on Kinetics, training is more stable and obtains superior results compared to a 3D ResNet that is trained on the dataset from scratch. Based on the limitations and advantages we observe for the 3D ResNet, we also investigate the impact of using the non-local block in the 3D ResNeXt, which outperform the other 3D architectures in most cases after this modification. We report in all experiments the true classification rates (TCR).

All Manipulation Techniques

Firstly we evaluate the detection accuracy of the three video CNNs (with and without attention), and compare the results to image-forgery detection algorithms. For the latter we have in particular the state of the art XceptionNet [START_REF] Rössler | Faceforensics++: Learning to detect manipulated facial images[END_REF], learning-based methods used in the forensic community for generic manipulation detection [START_REF] Cozzolino | Recasting residual-based local descriptors as convolutional neural networks: an application to image forgery detection[END_REF][START_REF] Bayar | A deep learning approach to universal image manipulation detection using a new convolutional layer[END_REF], computer-generated vs. natural image detection [START_REF] Rahmouni | Distinguishing computer graphics from natural images using convolution neural networks[END_REF] and face tampering detection [START_REF] Afchar | Mesonet: a compact facial video forgery detection network[END_REF]. Given the unbalanced classification problem in this experiment (number of fake videos being nearly four times the number of real videos), we use weighted cross-entropy loss, in order to reduce the effects of unbalanced data. We observe that among the unmodified 3D CNNs, the detection accuracy of I3D is the highest and it is also the most computationally intense. The performance of 3D ResNet improves with the introduction of the non-local block. The lack of pre-training does hamper the performance of the 3D ResNet with the SE attention, however it performs significantly better than the vanilla 3D ResNet which was initialised with random weights. Interestingly, with the addition of the non-local block to the 3D-ResNeXt, its detection accuracy becomes the highest, surpassing I3D. Related results are depicted in Table 2. We present the receiver operating characteristic curves (ROC curves) in Figure 5 and the area under the curve (AUC) in Table 3.

Single Manipulation Techniques

We proceed to investigate the performances of all algorithms, when trained and tested on single manipulation techniques. We report the TCRs in Table 4. Interestingly, here the video based algorithms perform similarly as the best image-based algorithm. This can be due to the data-size pertaining to videos of a single manipulation technique being smaller. I3D performed best among unmodified video based methods. 3D ResNet with non-local block once again outperformed the pre-trained 3D ResNet and the 3D ResNet with SE attention outperformed the randomly initialised 3D ResNet that was trained from scratch. The performance of 3D ResNeXt also improved upon introduction of the non-local block, and in fact, it performed best among all video based methods.

Our experiments suggest that all detection approaches are consistently utmost challenged on the GAN-based neuraltextures-approach. We note that neuraltextures trains a unique model for each video, which results in a higher variation of possible artifacts. While deepfakes similarly trains one model per video, a fixed post-processing pipeline is used, which is similar to the computer-based manipulation methods and thus has consistent artifacts that can be instrumental for deepfake detection.

Cross-manipulation Techniques

In our third experiment, we train the 3D CNNs and the attention-endowed models with videos manipulated by 3 techniques, as well as the original (real) videos and proceed to test on the last remaining manipulation technique, as well as original videos. We show related results in Table 5. Naturally, this is the most challenging setting. At the same time, it is the most realistic one, because it is unlikely that knowledge on whether and how videos have been manipulated will be provided. Similar to the first experiment, we use weighted cross-entropy loss, in order to solve the unbalanced classification problem. For the detection algorithms, one of the more challenging settings in this experiment is when faceswap is the manipulation technique to be detected. We note that 3D ResNet with non-local block outperformed all other networks in this scenario.

While face2face and faceswap represent graphics-based approaches, deepfakes and neuraltextures are learning-based approaches. However, faceswap replaces the largest facial region in the target image and involves advanced blending and color correction algorithms to seamlessly superimpose source onto target. Hence the challenge might be due to the inherent dissimilarity of faceswap and learning-based approaches, as well as due to the seamless blending between source and target, different than face2face.

We note that humans easily detected manipulations affected by faceswap and deepfakes and were more challenged by face2face and ultimately neuraltextures [START_REF] Rössler | Faceforensics++: Learning to detect manipulated facial images[END_REF]. This is also reflected in the performance of 3D ResNet and 3D ResneXt with non-local block, which were most challenged by the videos manipulated by neuraltextures.

Effect of Attention in 3D ResNets

We here analyze the correlation matrices between two layers (at the same depth) for all the three variants of the 3D ResNet -the original 3D ResNet, the 3D ResNet with squeeze-excitation and the 3D ResNet with non-local block (refer Figure 6). The high correlation observed in distinct patches in Figure 6 Both attention mechanisms, squeeze-excitation and non local block increase the number of parameters in the 3D ResNet by around 10%, however when trained and tested on the whole dataset, we observe an improvement of 2% in the true classification rate in case of the model with non-local block (Table 2). We note that the 3D Resnet with SE attention could not be initialized with pre-trained Kinetics weights, so for a fair comparison, a 3D ResNet trained on the dataset from scratch was considered. Interestingly, without pre-trained weights, the vanilla 3D-ResNet is unable to converge its training in most cases and was underfitting. The training for the 3D ResNet with SE was more stable and yielded superior results over most experiments. It is also interesting to observe that face2face challenges 3D ResNet with non-local block more than the vanilla 3D ResNet. The exact reason behind this was not certain, however, as pointed out before, it was one of the more challenging scenarios for humans to detect as well [START_REF] Rössler | Faceforensics++: Learning to detect manipulated facial images[END_REF]. In summary, 3D ResNet with the nonlocal block outperforms predominantly all other 3D ResNet variants.

Visualization of Pertinent Features in Deepfake Detection

We proceed to visualize features each of the 3D ResNet models are focusing on for detecting of deepfakes by Grad-CAM [START_REF] Selvaraju | Grad-cam: Visual explanations from deep networks via gradient-based localization[END_REF]. We note that Grad-CAM finds the final convolutional layer in a network and examines the gradient information flowing into that layer. The output of Grad-CAM is represented by a heatmap visualization for a given class label, in our case deepfake detection. In particular, we visualize five frames from a deepfake-video in Figure 7, for each of the three variants of 3D ResNet. Interestingly, we observe that 3D ResNet with both attention mechanisms focuses stronger on the central part of a face, as compared to the original 3D ResNet. It is also worth noting that the heatmap for 3D ResNet with non-local block is located slightly higher than 3D Resnet with squeeze-excitation block, yielding the highest accuracy. The frames are taken from the same fake video with a time step of 24. Red represents higher probablity of the region being manipulated.

Conclusions

In this work we compared three state of the art video based CNN methods in detecting four deepfake-manipulation-techniques. The three tested methods included 3D ResNet, 3D ResNeXt and I3D, which we adapted from action recognition. In addition, we tested two attention mechanisms. Despite the pre-training of mentioned methods on the action recognition dataset Kinetics-400, the methods generalized very well to deepfake detection. Experimental results showed that 3D/video CNNs outperformed or performed at least similarly to image-based detection algorithms. In addition, we observed that the incorporation of attention mechanisms in 3D CNNs improved related detection accuracy and were beneficial in placing focus of the models on areas of maximum manipulation in the forged videos.

Further, we noted a significant decrease in detection rates in the scenario, when we detected a manipulation technique not represented in the training set. One reason relates to the fact that networks lack an adaptation-ability to transfer learned knowledge from one domain (trained manipulation methods) to another domain (tested manipulation method). It is known that current machine learning models exhibit unpredictable and overly confident behaviour outside of the training distribution.

Future work will involve the consideration of additional deepfake-techniques. Further, we plan to develop novel deepfake-detection approaches, which place emphasis on appearance, motion as well as pixel-level based generated noise, targeted to outsmart the improving generation and manipulation algorithms.

Fig. 1 :

 1 Fig. 1: Schematic diagrams of (a) non-local block, (b) non-local block in the backbone architecture.

Fig. 2 :Fig. 3 :

 23 Fig. 2: (a) Residual block, (b) residual block after adding SE block.

Fig. 4 :

 4 Fig. 4: Sample frames from the FaceForensics++ dataset From left to right: original source (large) and target (small) images, deepfakes, face2face, faceswap, neuraltextures.

Fig. 5 :

 5 Fig. 5: ROC curves pertaining to 3D ResNet and 3D ResNext endowed with attention mechanisms for testing and training of all four manipulation methods.

  (a) indicates that the original 3D ResNet without attention possibly overfits to the data. The addition of squeeze-excitation (Figure 6(b)) improves upon this and a further improvement is seen with the introduction of the non-local block in the 3D ResNet (Figure 6(c)).

Fig. 6 :

 6 Fig. 6: Correlation matrices for the 3D ResNets

Fig. 7 :

 7 Fig. 7: Grad-CAM visualizations for the 3D ResNet models for the same video.The frames are taken from the same fake video with a time step of 24. Red represents higher probablity of the region being manipulated.

Table 1 :

 1 Architecture of 3D ResNet-101 with non-local block.

	× 3
	1024

Table 2 :

 2 Detection of all four manipulation methods, LQ. TCR = True classification rate, DF = deepfakes, F2F = face2face, FS = face-swap, NT = neuraltextures.

	Algorithm	Train and Test TCR
	Steg. Features + SVM [19] FS, DF, F2F, NT 55.98
	Cozzolino et al. [14]	FS, DF, F2F, NT 58.69
	Bayar and Stamm [8]	FS, DF, F2F, NT 66.84
	Rahmouni et al. [39]	FS, DF, F2F, NT 61.18
	MesoNet [1]	FS, DF, F2F, NT 70.47
	XceptionNet [13]	FS, DF, F2F, NT 81.0
	I3D	FS, DF, F2F, NT 87.43
	3D ResNet	FS, DF, F2F, NT 83.86
	3D ResNet (w/o pre-training) FS, DF, F2F, NT 54.96
	3D ResNet (with SE)	FS, DF, F2F, NT 80.0
	3D ResNet (with non-local) FS, DF, F2F, NT 85.85
	3D ResNeXt	FS, DF, F2F, NT 85.14
	3D ResNeXt (with non-local) FS, DF, F2F, NT 88.28

Table 3 :

 3 AUC values of 3D ResNet and 3D ResNeXt endowed with attention.

	Algorithm	AUC
	3D ResNet	0.82
	3D ResNet (w/o pre-training) 0.51
	3D ResNet (with SE)	0.72
	3D ResNet (with non-local) 0.86
	3D ResNeXt (with non-local) 0.91

Table 4 :

 4 Detection of each manipulation method individually, LQ. TCR = True classification rate, DF = deepfakes, F2F = face2face, FS = face-swap, NT = neuraltextures.

	Algorithm	DF F2F FS	NT
	Steg. Features + SVM [19] 73.64 73.72 68.93 63.33
	Cozzolino et al. [14]	85.45 67.88 73.79 78.00
	Bayar and Stamm [8]	84.55 73.72 82.52 70.67
	Rahmouni et al. [39]	85.45 64.23 56.31 60.07
	MesoNet [1]	87.27 56.20 61.17 40.67
	XceptionNet [13]	96.36 86.86 90.29 80.67
	I3D	95.13 90.27 92.25 80.5
	3D ResNet	91.81 89.6 88.75 73.5
	3D ResNet (w/o pre-training) 58.80 73.60 59.20 56.50
	3D ResNet (with SE)	81.70 77.00 75.90 66.25
	3D ResNet (with non-local) 94.67 89.20 92.13 76.00
	3D ResNeXt	93.36 86.06 92.50 80.50
	3D ResNeXt (with non-local) 95.50 90.4 95.08 80.71

Table 5 :

 5 Detection of cross-manipulation methods, LQ. TCR = True classification rate, DF = deepfakes, F2F = face2face, FS = face-swap, NT = neuraltextures, NL = non-local, scratch = w/o pre-training.

	Train	Test 3D ResNet I3D 3D ResNeXt	3D	3D	3D	3D
						ResNet	ResNet	ResNet	ResNeXt
						(scratch)	(with SE)	(with NL)	(with NL)
	FS, DF, F2F NT	64.29	68.57	66.79	54.28	55.35	62.9	63.2
	FS, DF, NT F2F	74.29	70.71	68.93	51.0	53.5	68.2	69.1
	FS, F2F, NT DF	75.36	75.00	72.50	50.7	52.5	76.78	77.8
	F2F, NT, DF FS	59.64	57.14	55.71	50.3	53.5	68.2	65.71

Table 6 :

 6 Number of parameters in 3D ResNet without and with attention.

	Algorithm	No. of parameters
	3D ResNet	85,249,216
	3D ResNet with SE	94,303,808
	3D ResNet with non-local	93,647,040

Ritaban Roy, Indu Joshi, Abhijit Das and Antitza Dantcheva