MIG-COW fools deepfake detectors in white-box tests
Original title: MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition
On AADD-2025, the method reports 99.96% white-box success but only 7.16% against official black-box targets.
A cs.CR paper introduces MIG-COW, an attack that builds visually similar adversarial examples against deepfake detectors by combining momentum-integrated gradients with consensus-orthogonal decomposition. The authors say it targets shared and model-specific weaknesses across CNN and ViT detectors. On AADD-2025 Challenge benchmarks they report a 99.96% white-box attack success rate and high SSIM, beating baselines they tested. Transfer to official black-box targets was only 7.16% ASR, which they call the best overall score but still weak. They also report that adding diverse, low-performing models to the ensemble can make the attack worse.
Unconfirmed: Black-box results are limited to the paper’s official AADD-2025 targets; real-world transfer beyond that benchmark is not shown.
- The method aims to stay visually imperceptible while generalizing across detector types.
- Black-box transfer remains the stated open problem despite the top overall score.
- Surrogate choice matters: weak but diverse ensemble members can reduce effectiveness.
From the original article
1 min read at arxiv.orgDespite recent advances, deepfake detectors remain vulnerable to adversarial examples, particularly in diverse, real-world settings. We propose MIG-COW, a novel adversarial attack framework that generates highly generalizable and visually imperceptible adversarial examples.
By Wonjune Seo · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.