What Makes Adversarial Examples Transfer Across Deepfake Detectors?
A controlled study of 60 deepfake detectors shows adversarial example transfer depends heavily on source-target compatibility, with source averaging understating vulnerability.
The study evaluates adversarial example transferability across 60 deepfake detectors spanning six backbones, two pretraining regimes, and five training-data configurations, using AutoAttack (AA) and Carlini-Wagner with Expectation over Transformation (CW-EOT). Transfer rises sharply when source and target share an exact backbone, architecture family, pretraining regime, or training data, with the dominant factor depending on the attack. Mean attack success rate is 7.21% under AA and 19.52% under CW-EOT for single sources, while a multi-source oracle reaches 64.48% after excluding exact matches, showing source averaging can substantially understate target vulnerability. The authors release 240,000 adversarially perturbed images, pairwise transfer results, detector configurations, and evaluation code.
- Exact backbone, pretraining, or training-data overlap drives transfer-based black-box attack success
- Dominant compatibility factor differs: backbone under AutoAttack, pretraining and data under CW-EOT
- Multi-source oracle attains 64.48% mean ASR versus 7.21% (AA) and 19.52% (CW-EOT) single-source
- Releases 240,000 adversarially perturbed images, detector configs, and evaluation code
- Tags
- adversarial-examplesautoattackblack-box-attacksdeepfake-detectionrobustness-evaluationtransferability
- Products
- AutoAttackCarlini-Wagner
From the original article
1 min read at arxiv.orgDeepfake detectors remain vulnerable to transfer-based black-box attacks, in which adversarial examples are generated on a source surrogate model and transferred to a target model, unknown to the attacker. Yet how source--target compatibility shapes attack success remains poorly understood. Prior studies evaluate limited detector pools and rarely disentangle architectural from training factors.
By Rafael M. Mamede · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.