Adversarial Deepfake Generation and an Investigation of Purification-Based Adversarial Detection

• URL: http://arxiv.org/abs/2607.25842v1
• Date: Tue, 28 Jul 2026 15:19:16 GMT
• Title: Adversarial Deepfake Generation and an Investigation of Purification-Based Adversarial Detection
• Abstract summary: This paper describes the participation of team "Go To Germany" in the ImageCLEF 2026 Deepfake Detection and Generation Task.<n>For the image generation task, we employ FLUX.1-dev with PuLID for identity-preserving face synthesis.<n>For the image detection task, we combine two complementary detectors - SigLIP+DINOv2 for AI-generated images and GenD-DINOv3 for face manipulations.
• Score: 9.42962723864652
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: This paper describes the participation of team "Go To Germany" in the ImageCLEF 2026 Deepfake Detection and Generation Task. For the image generation task, we employ FLUX.1-dev with PuLID for identity-preserving face synthesis, combined with a multi-model PGD adversarial attack targeting 12 detectors simultaneously (DiffJPEG-in-loop, MI/DI/EoT, adaptive weighting, two-stage warm-start). Our approach achieved 90% evasion against organizer detectors and 57.6% against participant detectors, with a final generation score of 0.4170. For the image detection task, we combine two complementary detectors - SigLIP+DINOv2 for AI-generated images and GenD-DINOv3 for face manipulations - in a max-probability ensemble, achieving 99.4% accuracy on baseline deepfakes but suffering from high false-positive rates on real images, resulting in a final detection score of 0.6986. Beyond the official submission, we conducted a self-initiated investigation of purification-based adversarial detection, comparing three families of detection signals across six detectors that share a CLIP ViT-L/14 backbone. We find that raw $|Δ\text{logit}|$ under median-3 purification, applied through the EFFORT detector, separates adversarial inputs from clean inputs with AUROC 0.81-0.98 across four adversarial source types - a finding that refutes the simple backbone-preservation hypothesis and exposes a sharp JPEG-quality cliff at Q70 where the signal collapses.

Related papers

• RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation [0.0]
  Existing detectors depend on trusted references, specific attack artifacts, or global thresholds sensitive to corpus topology.<n>We present RAGSieve, a self-referenced detection framework that constructs its reference from the inspected system.<n>Joint deployment reduces attack success from 67.4% to 14.0% while retaining 41.3% F1 on unpoisoned retrieval.
  arXiv  Detail & Related papers  (2026-08-13T09:29:48Z)
• Multi-Backbone Self-Supervised Ensembles for Audio Deepfake Detection and a Cross-Track Analysis of Generation-Detection Asymmetry [9.42962723864652]
  This paper describes the participation of team "Go-To-Germany" in the ImageCLEF 2026 Audio Deepfake Detection and Generation task.<n>We present a cross-track analysis revealing a pronounced asymmetry: our detection system identifies 100% of participant-generated deepfakes.<n>We report an 11.25% false-positive gap on held-out organizer real recordings as the principal open challenge for deployment.
  arXiv  Detail & Related papers  (2026-08-03T07:04:51Z)
• Physiological Signals as a Forensic Modality for Talking-Face Deepfake Detection [0.0]
  Talking-face (TF) deep-swap generation synthesizes photore- alistic facial video from a static source image and an au-fake signal, producing forgeries that current image-based detectors consistently fail to identify.<n>We propose a detection framework that extracts per-video r wave forms via RhythmFormer and trains a suite of lightweight classifiers to distinguish real signals.
  arXiv  Detail & Related papers  (2026-07-23T19:47:15Z)
• Ghosts Beneath Textures: Texture-Relation Cues for Cross-Paradigm AI-Generated Image Detection [33.4849821487505]
  ConImageGen is a benchmark for cross-paradigm AI-generated image detection.<n>By suppressing semantic interference, we visualize, for the first time, semantics-irrelevant texture patterns across generation paradigms.<n>We propose DTS-Det, a framework that captures and leverages such relations for generalized AI-generated image detection.
  arXiv  Detail & Related papers  (2026-07-04T13:08:01Z)
• Perception, Verdict, and Evolution: Hindsight-Driven Self-Refining Forensics Agent for AI-Generated Image Detection [80.15317858033534]
  ForeAgent is an agentic forensics framework for AI-generated image detection with iterative self-evolution.<n>ForeAgent achieves state-of-the-art performance on the Chameleon benchmark, reaching 82.18% accuracy.<n>ForeAgent produces more consistent and causally grounded reasoning compared to GPT-5 and GPT-5-mini.
  arXiv  Detail & Related papers  (2026-06-25T02:59:33Z)
• How Fragile Are Training-Free AI-Generated Image Detectors? A Controlled Audit of Score Direction, Preprocessing, and Compression [6.3999417080764225]
  We audit two representative training-free scores -- an autoencoder-reconstruction score (AEROBLADE-style) and a noise-perturbation feature-similarity score (RIGID-style)<n>The audit yields three cautionary findings.
  arXiv  Detail & Related papers  (2026-06-18T17:05:51Z)
• When Detectors Forget Forensics: Blocking Semantic Shortcuts for Generalizable AI-Generated Image Detection [48.75021863792367]
  Vision Foundation Models (VFMs, emphe.g., CLIP) often struggle to generalize to images created using unseen generation pipelines.<n>We propose textbfGeometric Semantic Decoupling (GSD), a parameter-free module that explicitly removes semantic components from learned representations.<n>GSD estimates semantic directions from batch-wise statistics and projects them out via a geometric constraint, forcing the artifact detector to rely on semantic-invariant forensic evidence.
  arXiv  Detail & Related papers  (2026-03-10T06:16:35Z)
• How well are open sourced AI-generated image detection models out-of-the-box: A comprehensive benchmark study [5.740397289924559]
  No universal winner exists, with detector rankings exhibiting substantial instability.<n>Our findings challenge the one-size-fits-all'' detector paradigm.
  arXiv  Detail & Related papers  (2026-02-08T04:36:13Z)
• ForensicsSAM: Toward Robust and Unified Image Forgery Detection and Localization Resisting to Adversarial Attack [56.0056378072843]
  We show that highly transferable adversarial images can be crafted solely via the upstream model.<n>We propose ForensicsSAM, a unified IFDL framework with built-in adversarial robustness.
  arXiv  Detail & Related papers  (2025-08-10T16:03:44Z)
• AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuning [93.77763753231338]
  Adversarial Contrastive Prompt Tuning (ACPT) is proposed to fine-tune the CLIP image encoder to extract similar embeddings for any two intermediate adversarial queries. We show that ACPT can detect 7 state-of-the-art query-based attacks with $>99%$ detection rate within 5 shots. We also show that ACPT is robust to 3 types of adaptive attacks.
  arXiv  Detail & Related papers  (2024-08-04T09:53:50Z)
• A Universal Anti-Spoofing Approach for Contactless Fingerprint Biometric Systems [0.0]
  We propose a universal presentation attack detection method for contactless fingerprints. We generated synthetic contactless fingerprints using StyleGAN from live finger photos and integrating them to train a semi-supervised ResNet-18 model. A novel joint loss function, combining the Arcface and Center loss, is introduced with a regularization to balance between the two loss functions.
  arXiv  Detail & Related papers  (2023-10-23T15:46:47Z)
• The Report on China-Spain Joint Clinical Testing for Rapid COVID-19 Risk Screening by Eye-region Manifestations [59.48245489413308]
  We developed and tested a COVID-19 rapid prescreening model using the eye-region images captured in China and Spain with cellphone cameras. The performance was measured using area under receiver-operating-characteristic curve (AUC), sensitivity, specificity, accuracy, and F1.
  arXiv  Detail & Related papers  (2021-09-18T02:28:01Z)
• G-DetKD: Towards General Distillation Framework for Object Detectors via Contrastive and Semantic-guided Feature Imitation [49.421099172544196]
  We propose a novel semantic-guided feature imitation technique, which automatically performs soft matching between feature pairs across all pyramid levels. We also introduce contrastive distillation to effectively capture the information encoded in the relationship between different feature regions. Our method consistently outperforms the existing detection KD techniques, and works when (1) components in the framework are used separately and in conjunction.
  arXiv  Detail & Related papers  (2021-08-17T07:44:27Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.