ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors

• URL: http://arxiv.org/abs/2607.21897v1
• Date: Fri, 24 Jul 2026 01:59:53 GMT
• Title: ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors
• Abstract summary: We propose ISPCloak, a novel adversarial attack framework that explicitly weaponizes the ISP pipeline to mislead the judgment of deepfake detectors.<n>Our method first employs an Invertible ISP network to project images into the RAW domain.<n>Then, we seamlessly imprint the complex statistical priors of real cameras onto AI-generated images by injecting realistic Poisson-Gaussian sensor noise.
• Score: 14.415785941225735
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The rapid advancement of generative models has spurred the critical need to evaluate the worst-case robustness of deepfake detectors. In this paper, we reveal a fundamental blind spot in current forensic paradigms: while existing detectors excel at capturing digital synthesis artifacts, their effectiveness drops drastically when AI-generated content is cloaked in authentic physical imaging characteristics. We posit that genuine photographs inherently possess hardware-intrinsic statistical signatures, which are imperceptible footprints imprinted by optical sensors and Image Signal Processing (ISP) pipelines, and are fundamentally absent in purely data-driven generative models. Driven by this insight, we propose ISPCloak, a novel optimization-free adversarial attack framework that explicitly weaponizes the ISP pipeline to mislead the judgment of deepfake detectors. Rather than relying on computationally expensive gradient perturbations, our method first employs an Invertible ISP network to project images into the RAW domain. Then, we seamlessly imprint the complex statistical priors of real cameras onto AI-generated images by injecting realistic Poisson-Gaussian sensor noise and conducting forward ISP reconstruction. Synergized with generative artifact suppression and adaptive masking, this streamlined physical simulation enables ultra-fast generation of adversarial examples. Extensive experiments show that embedding authentic physical perturbations fundamentally disrupts a broad range of current detection mechanisms, yielding universally evasive adversarial examples with imperceptible visual alterations.

Related papers

• TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors [76.4118981404995]
  Trajectory-Injected Generative Attack (TIGA) is a source-image-free and training free framework that generates detector-evasive images.<n>TIGA steers the latent Denoising Diffusion Implicit Model (DDIM) trajectory so that adversarial properties emerge during generation.<n>TIGA achieves strong blackbox attack performance, transferability, and high robustness under common post-processing operations.
  arXiv  Detail & Related papers  (2026-07-28T15:51:39Z)
• Effective Synthetic Image Detection via Noise Residual Clustering [10.793335916255366]
  Synthetic images pose security threats such as misinformation and fraud.<n>Most existing detectors rely on supervised training with large labeled datasets.<n>We propose a training-free detection method using noise residual fingerprints.
  arXiv  Detail & Related papers  (2026-07-12T10:38:18Z)
• Physically-Induced Atmospheric Adversarial Perturbations: Enhancing Transferability and Robustness in Remote Sensing Image Classification [54.952203312050564]
  Adversarial attacks pose a severe threat to the reliability of deep learning models in remote sensing (RS) image classification.<n>We propose FogFool, a physically plausible adversarial framework that generates fog-based perturbations.<n>Experiments on two benchmark RS datasets demonstrate that FogFool achieves superior performance.
  arXiv  Detail & Related papers  (2026-04-16T05:47:57Z)
• Is Artificial Intelligence Generated Image Detection a Solved Problem? [16.9828631287303]
  AIGIBench is a benchmark designed to rigorously evaluate the robustness and generalization capabilities of state-of-the-art AIGI detectors.<n>It simulates real-world challenges through four core tasks: multi-source generalization, robustness to image degradation, sensitivity to data augmentation, and impact of test-time pre-processing.<n>It includes 23 diverse fake image subsets that span both advanced and widely adopted image generation techniques, along with real-world samples collected from social media and AI art platforms.
  arXiv  Detail & Related papers  (2025-05-18T10:00:39Z)
• Understanding and Improving Training-Free AI-Generated Image Detections with Vision Foundation Models [68.90917438865078]
  Deepfake techniques for facial synthesis and editing pose serious risks for generative models.<n>In this paper, we investigate how detection performance varies across model backbones, types, and datasets.<n>We introduce Contrastive Blur, which enhances performance on facial images, and MINDER, which addresses noise type bias, balancing performance across domains.
  arXiv  Detail & Related papers  (2024-11-28T13:04:45Z)
• Deepfake Sentry: Harnessing Ensemble Intelligence for Resilient Detection and Generalisation [0.8796261172196743]
  We propose a proactive and sustainable deepfake training augmentation solution. We employ a pool of autoencoders that mimic the effect of the artefacts introduced by the deepfake generator models. Experiments reveal that our proposed ensemble autoencoder-based data augmentation learning approach offers improvements in terms of generalisation.
  arXiv  Detail & Related papers  (2024-03-29T19:09:08Z)
• Safe and Robust Watermark Injection with a Single OoD Image [90.71804273115585]
  Training a high-performance deep neural network requires large amounts of data and computational resources. We propose a safe and robust backdoor-based watermark injection technique. We induce random perturbation of model parameters during watermark injection to defend against common watermark removal attacks.
  arXiv  Detail & Related papers  (2023-09-04T19:58:35Z)
• Learning Heavily-Degraded Prior for Underwater Object Detection [59.5084433933765]
  This paper seeks transferable prior knowledge from detector-friendly images. It is based on statistical observations that, the heavily degraded regions of detector-friendly (DFUI) and underwater images have evident feature distribution gaps. Our method with higher speeds and less parameters still performs better than transformer-based detectors.
  arXiv  Detail & Related papers  (2023-08-24T12:32:46Z)
• Learning Degradation-Independent Representations for Camera ISP Pipelines [14.195578257521934]
  We propose a novel approach to learn degradation-independent representations (DiR) through the refinement of a self-supervised learned baseline representation. The proposed DiR learning technique has remarkable domain generalization capability and it outperforms state-of-the-art methods across various downstream tasks.
  arXiv  Detail & Related papers  (2023-07-03T05:38:28Z)
• Adversarially-Aware Robust Object Detector [85.10894272034135]
  We propose a Robust Detector (RobustDet) based on adversarially-aware convolution to disentangle gradients for model learning on clean and adversarial images. Our model effectively disentangles gradients and significantly enhances the detection robustness with maintaining the detection ability on clean images.
  arXiv  Detail & Related papers  (2022-07-13T13:59:59Z)
• Adversarial Imaging Pipelines [28.178120782659878]
  We develop an attack that deceives a specific camera ISP while leaving others intact. We validate the proposed method using recent state-of-the-art automotive hardware ISPs.
  arXiv  Detail & Related papers  (2021-02-07T06:10:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.