Reproduce “Evading Deepfake-Image Detectors with White- and Black-Box Attacks” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Nicholas Carlini, Hany Farid
Carlini and Farid show that deepfake-image detectors can be defeated by carefully chosen, often imperceptible image changes. White-box perturbations, universal patches, latent-space modifications, and black-box transfer attacks reduce tested detectors from high AUC values near 0.96–0.99 to as low as 0.0005, 0.085, 0.17, and 0.22 respectively, demonstrating that clean-data accuracy is not a sufficient measure of detector reliability.
Key insights
- Deepfake detectors can be more sensitive to adversarial changes than ordinary image classifiers: an L2 perturbation of only 0.02 reduced one detector to approximately chance performance.
- Attacks do not need to be image-specific. A small universal patch and a generator-side latent modification fooled many different images while preserving their visual appearance and photorealism.
- Model secrecy is not a complete defense: adversarial examples transferred across independently trained detectors, reducing the target model’s AUC from 0.96 to 0.22.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.