ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors

• URL: http://arxiv.org/abs/2607.15246v1
• Date: Thu, 16 Jul 2026 17:45:13 GMT
• Title: ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors
• Abstract summary: This paper introduces ARMOR++, a robust multi-agent framework designed for high-transferability deepfake evasion.<n>By integrating five complementary primitives, ARMOR++ effectively targets heterogeneous inductive biases.<n> Rigorous evaluation on the AADD-2025 benchmark demonstrates that ARMOR++ significantly outperforms existing agentic and non-agentic baselines.
• Score: 28.44035744358622
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The reliability of deepfake detectors frequently degrades under black-box adversarial transfer, as these models often rely on fragile, architecture-dependent forensic cues. Existing transfer attacks often lack semantic awareness and struggle to maintain effectiveness under strict no-query constraints, particularly when perturbations are transferred from convolutional surrogates to transformer-based targets. To address these limitations, this paper introduces ARMOR++, a robust multi-agent framework designed for high-transferability deepfake evasion. The framework leverages the Qwen2.5-VL Vision-Language Model (VLM) to supply spatial semantic priors, while the Qwen3 Large Language Model (LLM) orchestrates primitive selection, adaptive hyperparameter reparameterization, and entropy-regularized perturbation mixing. By integrating five complementary primitives, spanning dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structured modifications, ARMOR++ effectively targets heterogeneous inductive biases. Rigorous evaluation on the AADD-2025 benchmark demonstrates that ARMOR++ significantly outperforms existing agentic and non-agentic baselines across both low- and high-quality image regimes. Statistical analysis confirms a substantial gain in blind-target Attack Success Rate (ASR) over the state-of-the-art agentic baseline, with further performance advantages evidenced against non-agentic benchmarks and under robust defensive configurations. These findings highlight a significant residual reliability gap in current deepfake detector deployments and demonstrate the efficacy of agentic orchestration in identifying latent vulnerabilities.

Related papers

• MS-MFAD : Multimodal large language models for Face Anti-spoofing Detection [25.077055201475442]
  We propose Multimodal Large Language Models (MFAD) for face anti-spoofing detection.<n>MFAD activates intrinsic reasoning capabilities of Multimodal Large Language Models via a fine-grained pixel-semantic anchoring mechanism.<n>By annotating only 1,000 precise masks per attack category, we generate reasoning evidence chains strictly corresponding to spoofed regions.
  arXiv  Detail & Related papers  (2026-08-18T03:38:59Z)
• TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors [76.4118981404995]
  Trajectory-Injected Generative Attack (TIGA) is a source-image-free and training free framework that generates detector-evasive images.<n>TIGA steers the latent Denoising Diffusion Implicit Model (DDIM) trajectory so that adversarial properties emerge during generation.<n>TIGA achieves strong blackbox attack performance, transferability, and high robustness under common post-processing operations.
  arXiv  Detail & Related papers  (2026-07-28T15:51:39Z)
• Perception, Verdict, and Evolution: Hindsight-Driven Self-Refining Forensics Agent for AI-Generated Image Detection [80.15317858033534]
  ForeAgent is an agentic forensics framework for AI-generated image detection with iterative self-evolution.<n>ForeAgent achieves state-of-the-art performance on the Chameleon benchmark, reaching 82.18% accuracy.<n>ForeAgent produces more consistent and causally grounded reasoning compared to GPT-5 and GPT-5-mini.
  arXiv  Detail & Related papers  (2026-06-25T02:59:33Z)
• Diagnosing and Mitigating Compounding Failures in Agentic Persuasion via Taxonomic Strategy Retrieval [2.5607169168631696]
  Taxonomic Strategy RAG (TS-RAG) is a systems intervention that routes strategies through a discrete categorical bottleneck to decouple argumentative structure from topical content.<n>TS-RAG significantly improves the transfer of abstract logic where standard semantic retrieval collapses.<n>It acts as a "capability bridge" in asymmetric deployments, empowering lightweight persuaders to consistently defeat superior opponents.
  arXiv  Detail & Related papers  (2026-06-23T12:16:27Z)
• TaFD: Threat-Aware Frequency Decoupling for Adversarial Robustness against Heterogeneous Attacks [6.525195905471157]
  Multi-threat robustness remains a fundamental challenge in deep learning.<n>Joint adversarial training (JAT) is widely adopted, but suffers from negative transfer under heterogeneous threats.<n>We propose Threat-aware Frequency Decoupling (TaFD), a two-stage defense framework that reformulates JAT as a frequency-domain divide-and-conquer paradigm.
  arXiv  Detail & Related papers  (2026-06-16T05:38:26Z)
• Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs [59.973833105841685]
  A key challenge for improving adversarial transferability is to effectively capture the intrinsic visual focus shared across different models.<n>We propose FRA-Attack, which addresses both challenges from a unified frequency-domain regularization perspective.<n>For feature alignment, a high-pass DCT objective on patch features suppresses redundant global structures and concentrates the loss on the high-frequency band that carries the MLLMs' intrinsic visual focus.<n>For gradient optimization, we introduce Frequency-domain Gradient Regularization (FGR), a textitmodel-agnostic low-pass regularizer that modulates the surrogate gradient using
  arXiv  Detail & Related papers  (2026-05-20T08:15:56Z)
• OmniVL-Guard: Towards Unified Vision-Language Forgery Detection and Grounding via Balanced RL [63.388513841293616]
  Existing forgery detection methods fail to handle the interleaved text, images, and videos prevalent in real-world misinformation.<n>To bridge this gap, this paper targets to develop a unified framework for omnibus vision-language forgery detection and grounding.<n>We propose textbf OmniVL-Guard, a balanced reinforcement learning framework for omnibus vision-language forgery detection and grounding.
  arXiv  Detail & Related papers  (2026-02-11T09:41:36Z)
• Transferable Dual-Domain Feature Importance Attack against AI-Generated Image Detector [32.543253278021446]
  Recent AI-generated image (AIGI) detectors achieve impressive accuracy under clean condition.<n>It is significant to develop advanced adversarial attacks for evaluating the security of such detectors.<n>This letter proposes a Dual-domain Feature Importance Attack scheme to invalidate AIGI detectors to some extent.
  arXiv  Detail & Related papers  (2025-11-19T16:03:15Z)
• Improving Black-Box Generative Attacks via Generator Semantic Consistency [51.470649503929344]
  generative attacks produce adversarial examples in a single forward pass at test time.<n>We enforce semantic consistency by aligning the early generator's intermediate features to an EMA teacher.<n>Our approach can be seamlessly integrated into existing generative attacks with consistent improvements in black-box transfer.
  arXiv  Detail & Related papers  (2025-06-23T02:35:09Z)
• TESSER: Transfer-Enhancing Adversarial Attacks from Vision Transformers via Spectral and Semantic Regularization [3.693610259830098]
  Adrial transferability remains a critical challenge in evaluating the robustness of deep neural networks.<n>We introduce textbfTESSER -- a novel adversarial attack framework that enhances transferability via two key strategies.<n>Experiments on ImageNet across 12 diverse architectures demonstrate that TESSER achieves +10.9% higher attack succes rate (ASR) on CNNs and +7.2% on ViTs.
  arXiv  Detail & Related papers  (2025-05-26T07:30:00Z)
• Source-Free Domain Adaptive Object Detection with Semantics Compensation [54.00183496587841]
  We introduce Weak-to-strong Semantics Compensation (WSCo) for strong data augmentation.<n>WSCo compensates for the class-relevant semantics that may be lost during strong augmentation on the fly.<n>WSCo can be implemented as a generic plug-in, easily integrable with any existing SFOD pipelines.
  arXiv  Detail & Related papers  (2024-10-07T23:32:06Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.