PaperlayerView exact revision on arXiv

Source-linked AI summary

What Makes Adversarial Examples Transfer Across Deepfake Detectors?

Rafael M. Mamede, Pedro C. Neto, Ana F. Sequeira

arXiv:2609.10002v1cs.CVcs.AIcs.CRcs.LG

TL;DR

Deepfake-detector transfer attacks are difficult to assess because the role of source–target compatibility is poorly understood. The paper evaluates transfer across 60 systematically varied detectors and finds that compatibility strongly structures attack success, while source averaging can understate vulnerability.

  • Problem

    The paper addresses limited evidence about how source–target compatibility shapes adversarial transfer across deepfake detectors.

  • Method

    The study uses matched, stratified comparisons across 60 detectors varying backbone, architecture family, pretraining, and training data under two attacks.

  • Results

    Transfer is higher for shared compatibility factors, with exact backbone most influential under AA and pretraining or training data most influential under CW–EOT.

  • Takeaways & Limitations

    Source-model selection and compatibility-aware oracles are central to credible black-box robustness evaluation because low single-source or averaged ASR can conceal vulnerabilities.

  • Takeaways & Limitations

    Conclusions are limited to the evaluated architectures, data, manipulation families, and attacks, with one training run per detector preventing quantification of seed variability.

Abstract

from arXiv · show

Deepfake detectors remain vulnerable to transfer-based black-box attacks, in which adversarial examples are generated on a source surrogate model and transferred to a target model, unknown to the attacker. Yet how source--target compatibility shapes attack success remains poorly understood. Prior studies evaluate limited detector pools and rarely disentangle architectural from training factors. We conduct a controlled evaluation of adversarial transferability across 60 detectors spanning six backbones, two pretraining regimes, and five training-data configurations, using two attack procedures: AutoAttack (AA) and the Carlini--Wagner attack with Expectation over Transformation (CW--EOT). Matched comparisons reveal significantly higher transfer when source and target share an exact backbone, architecture family, pretraining regime, or training data. This compatibility structure is attack-dependent: exact backbone compatibility has the largest effect under AA, whereas shared pretraining and training data have the largest effects under CW--EOT. When transfer is averaged across non-target sources, mean attack success rate (ASR) is $7.21\%$ under AA and $19.52\%$ under CW--EOT. By contrast, a multi-source oracle combining both attacks attains a \(64.48\%\) mean ASR after excluding exact backbone and training-data matches, showing that source averaging can substantially understate target vulnerability. We release 240,000 adversarially perturbed images, complete pairwise transfer results, detector configurations, and evaluation code. These findings establish source--target compatibility and source-model selection as central dimensions of credible transfer-based black-box robustness evaluation.

1. Introduction

Deepfake detectors are vulnerable to adversarial transfer, but it remains unclear whether transferred perturbations exploit detector-specific weaknesses or broader vulnerabilities. This study evaluates how architecture and training compatibility shape transfer across a controlled detector bank.

  • Threat model: Adversarial examples are small, often imperceptible image perturbations that can change a model’s decision and transfer from a surrogate to an unknown target.The evaluation uses ℓ∞-bounded perturbations with ϵ = 8/255 generated on source detectors and tested on targets.
  • Motivation: Deepfake detectors often struggle with unseen generators, raising the question of whether their adversarial weaknesses generalize across training conditions.The study directly examines whether transfer reflects model-specific weaknesses or broader vulnerabilities.
  • Study design: 60 detectors span six backbones, two pretraining regimes, and five training-data subsets for controlled black-box transfer evaluation.The factorial design produces 3,540 ordered black-box source–target pairs per attack.
  • Study design: Transferability is systematically associated with shared exact backbone, architecture family, pretraining regime, and training data.These comparisons test whether transfer reflects architecture, training similarities, or broader detector vulnerabilities.
  • Resources: The released benchmark includes 240,000 adversarially perturbed images, pairwise transfer results, detector configurations, and evaluation code.These resources support reproducible compatibility-aware black-box robustness evaluation.

2. Related Work

Prior work established adversarial vulnerability and transfer in deepfake detection, but typically used limited detector pools or broad mismatch categories. This paper instead treats transfer variation itself as the object of study through controlled factor-based comparisons.

  • Deepfake generation and detection: Deepfake benchmarks expanded from limited manipulation mechanisms toward more realistic and diverse datasets.FaceForensics++, Celeb-DF, and DFDC broadened manipulation coverage, realism, or scale.
  • Deepfake generation and detection: Deepfake detectors commonly use CNNs or transformer-based visual encoders, while cross-dataset and cross-manipulation shifts can substantially degrade performance.This motivates examining whether detector and training factors also influence adversarial transfer.
  • Adversarial vulnerabilities: Existing adversarial-transfer studies demonstrated practical threats but generally evaluated limited complete pipelines or broad model and dataset mismatch categories.Prior work included evaluations with five detectors, three attacks, and two datasets, or four detection pipelines.
  • Research gap and novelty: This work constructs a systematically varied detector bank to characterize how backbone, architecture family, pretraining, and training data are associated with transfer.The approach moves beyond asking whether transfer occurs toward identifying conditions under which it becomes stronger or weaker.

3. Methodology

The methodology systematically varies detector architecture, pretraining, and training data, then evaluates directional black-box transfer under two attacks and controlled oracle settings. It measures transfer after accounting for source–target similarities and uses stratified contrasts with jackknife uncertainty estimates for compatibility comparisons.

  • Detector bank: 60 detectors combine six backbones, two pretraining strategies, and five training subsets in a factorial model bank.The six backbones include three CNNs and three Transformers; the resulting bank contains 6 × 2 × 5 = 60 detectors.
  • Adversarial generation: 240,000 perturbed images are generated from 2,000 manipulated test images using two evasion attacks for every source detector.The perturbation set is formed as 2,000 × 60 × 2 = 240,000 images.
  • Pairwise evaluation: Transfer is evaluated directionally across 3,600 ordered source–target pairs per attack, including 60 white-box and 3,540 black-box evaluations.A pair is distinct for each ordered source and target, so reversing the models produces another evaluation.
  • Attack objective: The attacks optimize a threshold-aware evasion objective under an L∞ perturbation budget of ϵ = 8/255, using AutoAttack and CW–EOT.The attacker seeks to make manipulated images appear authentic while leaving detector parameters and training data unchanged.
  • Evaluation metric: ASR is computed on manipulated images initially classified correctly by each target, isolating attack-induced misclassification from pre-existing detection errors.The target-specific conditioning set contains images with nonnegative target margin before perturbation.
  • Oracle protocols: Self-excluding and strict oracles estimate vulnerability with, respectively, unrestricted non-target surrogates and surrogates excluding exact-backbone or complete-training-data matches.The strict oracle still permits partial training-data overlap, representing settings where public data can be reproduced but the target’s full dataset cannot.
  • Statistical analysis: Equally weighted stratified contrasts compare compatible and incompatible pairs while fixing other relevant characteristics, and leave-one-node-out jackknife estimates uncertainty.The analysis reports approximate 95% Wald confidence intervals and two-sided p-values, with multiple hypothesis tests addressed in the main analysis.

4. Experimental Results

Across 60 detectors, black-box transfer depended on source–target compatibility and differed by attack. CW–EOT generally transferred more broadly than AA, while strict multi-source evaluation revealed substantially higher vulnerability than average single-source transfer.

  • AA white-box optimization reached a mean ASR of 99.78%, while CW–EOT reached 99.96% across source detectors.
  • Compatibility patterns: Under AA, exact-backbone matches produced the clearest transfer pattern, with mean ASR of 21%–32% versus at most 15% across most cross-backbone cells.
  • Compatibility patterns: Under CW–EOT, matched pretraining achieved 33% and 27% mean ASR versus 6% and 12% across corresponding mismatched regimes, while training-set overlap also elevated transfer.
  • Interpretation: The heatmaps are descriptive, so Table 1 uses stratified contrasts to hold remaining measured detector characteristics fixed.
  • Matched contrasts: All four matched compatibility contrasts were positive and significant; AA was led by exact backbone at 22.34 percentage points, whereas CW–EOT was led by pretraining at 21.25 and training data at 19.03.
  • Portfolio vulnerability: Mean transfer across non-target sources was 7.21% for AA and 19.52% for CW–EOT, compared with 64.48% for a strict oracle combining both attacks.

5. Discussion

The discussion interprets transferability as a structured relationship between source and target detectors rather than an isolated property of an attack or target. It also cautions that portfolio results are upper bounds and that conclusions are limited by the evaluated detector pool and single training runs.

  • Transferability depends strongly on source–target relationships, with AA emphasizing shared backbone and CW–EOT emphasizing shared pretraining and training data.
  • Interpretation: Shared backbone may align local decision geometry, whereas shared data provenance may yield overlapping representations or non-robust cues.
  • Pretraining: Shared pretraining remains relevant because task-specific fine-tuning may not erase inherited input sensitivities.
  • Threat assessment: Low single-source transfer can reflect incompatible source–target pairing rather than target robustness, while strict-oracle results show secrecy alone is insufficient against attackers probing the target.
  • Limitations: The conclusions are limited to the evaluated architectures, pretraining regimes, manipulation families, datasets, and attacks, with one training run per detector configuration.

6. Conclusion

Across 60 detectors and 3,540 ordered source–target pairs per attack, transfer depends on the source–attack–target configuration. Compatibility-aware, diverse-source evaluation is therefore necessary because heterogeneous-source averages can conceal vulnerabilities.

  • Transfer increased with shared backbone, pretraining, and training data, but the dominant compatibility factor differed by attack.Exact backbone compatibility dominated under AA, whereas shared pretraining and training data dominated under CW–EOT.
  • Source surrogate selection is a central component of the black-box threat model.The relevant transfer structure is tied to compatibility among source, attack, and target rather than to targets alone.
  • A low ASR from one source or an average across heterogeneous source–target pairings can conceal vulnerabilities exposed by other surrogates.The paper therefore uses oracle evaluations as a complementary, more stringent assessment of target vulnerability.
  • The strict oracle shows that vulnerabilities extend beyond closely matched detector pipelines.Thus, hiding model and training-data details does not establish black-box robustness.
  • The released 240,000 adversarial images, pairwise transfer results, detector configurations, and evaluation code support compatibility-aware robustness evaluation.These resources also support evaluation that accounts for surrogate diversity.

Supplementary Material

The supplementary analysis estimates compatibility, directional, and between-attack differences using matched comparisons, detector-level jackknife inference, Wald intervals, and Holm-adjusted hypothesis tests.

  • Compatibility contrasts: Matched strata compare compatible and incompatible source–target pairs while fixing the remaining detector and training characteristics.This design reduces confounding from properties other than the characteristic under study.
  • Compatibility contrasts: Only strata containing at least one compatible and one incompatible pair are retained for compatibility estimation.The estimator averages within-stratum differences across eligible strata.
  • Directional contrasts: Directional contrasts test whether transfer differs when detector groups swap source and target roles.Positive values indicate greater transfer in the first direction, while negative values indicate greater reverse-direction transfer.
  • Between-attack contrasts: Between-attack contrasts compare AA and CW–EOT compatibility differences and overall ASR over paired common strata or source–target pairs.Positive values indicate stronger compatibility association or higher mean black-box ASR under CW–EOT, depending on the contrast.
  • Statistical inference: Holm-adjusted significance is assessed at pHolm < 0.05, while reported confidence intervals remain unadjusted.The detector, rather than the individual source–target pair, is the jackknife deletion unit.

A.1. Notation and Analysis Units

The analysis treats transfer as directional ASR between distinct source and target detectors, yielding 3,540 ordered black-box pairs per attack from a 60-detector bank.

  • For attack a, ASR_s→t denotes the attack success rate when source detector s transfers adversarial examples to target detector t.Because transfer is directional, s→t and t→s are distinct observations.
  • The detector bank contains 60 detectors, and each attack has 60 × 59 = 3,540 eligible ordered black-box pairs.All ordered transfers exclude white-box pairs where source and target are identical.
  • Clean performance is reported for all 60 detectors on three Deepfake test sets.These include complete FaceForensics++ and Celeb-DF evaluations plus a matched in-domain FaceForensics++ subset.

C. Additional Statistical Results

Additional statistical results find no consistent transfer asymmetry after Holm adjustment, distinguishing compatibility effects from a universal ordering of detector groups as sources.

  • None of the six prespecified directional contrasts provides evidence of consistent transfer asymmetry after Holm adjustment.This result holds across the reported directional comparisons.
  • Under AA, Transformer-to-CNN transfer was estimated at 2.30 percentage points lower than the reverse direction, but the contrast was not significant after Holm adjustment.The 95% CI was [−4.48, −0.11], with pHolm = 0.2769.
  • Under CW–EOT, no directional contrast was significant after Holm adjustment.The largest estimate favored face-recognition-pretrained sources transferring to ImageNet-pretrained targets by 5.96 percentage points, but its confidence interval included zero.
  • Shared backbone, pretraining, or training data can increase transfer without making one detector group consistently stronger as a source.The principal structure is source–target compatibility rather than a universal ordering between detector groups.

D. Sensitivity Analysis

Sensitivity analyses show that the main attack-specific compatibility pattern is stable when detectors associated with individual backbones or training datasets are omitted, although some smaller effects vary more.

  • The signs and qualitative ordering of compatibility effects remain stable across backbone and training-dataset omissions.No individual omission reverses the central attack-specific pattern.
  • Exact-backbone compatibility remains dominant under AA, while shared pretraining and training data remain strongest under CW–EOT.
  • Negative exact-backbone and positive pretraining and training-data interactions persist across every group-omission replicate.
  • The smaller AA training-data and architecture-family effects vary more relatively, and the architecture-family interaction remains the least precisely estimated.The architecture-family interaction does not differ significantly from zero in the main analysis.

E. Detailed Transfer Results

Complete pairwise transfer matrices reveal substantial source–target variation hidden by aggregate estimates. AA transfer is sparse and concentrated among compatible configurations, whereas CW–EOT transfer is broader and stronger.

  • Complete model-level matrices reveal substantial source–target variation concealed by aggregate transfer estimates.
  • AA transfer is comparatively sparse and concentrated among particular compatible detector configurations.
  • CW–EOT generally produces broader and stronger transfer than AA.

F. Experimental and Reproducibility Details

The study documents detector training, evaluation, statistical reporting, and released configurations through standardized procedures and complete pairwise transfer visualizations. These details support reproducible comparisons across detector and attack settings.

  • Pretraining: Face-recognition pretraining used all four BUPT-BalancedFace partitions, 224 × 224 inputs, 512-dimensional normalized embeddings, and ElasticArcFace+ identity classification.
  • Pretraining: All backbones were trained for 30 epochs with batch size 256 using optimizer and learning-rate settings specialized by backbone family.
  • Detector training: Detector configurations FS, FR, EFS, and FE used their corresponding DF40 subsets, while ALL used their union under a common real-image partition and validation mixture.
  • Detector training: Training used standardized augmentation including flipping, blur, color perturbation, and JPEG compression, with inputs generally sized to 224×224.
  • Hyperparameter selection: Architecture-specific Bayesian hyperparameter searches were conducted for face-recognition pretrained detectors, then settings were fixed across all five training-data conditions.
  • Optimization: Final models were fine-tuned end-to-end with two-class cross-entropy for 51 epochs using fixed seed 42, retaining the checkpoint with highest validation AUC.
  • Evaluation: Thresholds maximizing validation balanced accuracy were selected from 1,001 uniformly spaced values over [0, 1] and fixed for clean and adversarial evaluation.
  • Reported analyses: Table 2 organizes clean AUC across 60 detectors by pretraining regime, backbone, and DF40 training subset, reporting FF++ALL/FF++ID/CDFALL percentages.
Loading 2609.10002v1…