MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition

1 Introduction

• Deepfake detectors’ vulnerability to subtle manipulations that change a “face” prediction to “real” exposes an unresolved security challenge.Source: §1 · p. 1
• CNN- and ViT-based detectors remain vulnerable to adversarial attacks, and perturbations often transfer poorly between these architectures.CNNs capture local texture and artifact patterns, while ViTs use self-attention to model global context.Source: §1 · p. 1
• MIG-COW is proposed as an ensemble attack framework for generating generalizable, visually imperceptible adversarial examples across deepfake detectors.It is designed to exploit shared and model-specific vulnerabilities across CNN and ViT detectors.Source: §1 · p. 1
• MIG-COW achieves the highest overall score, balancing attack success and visual imperceptibility across two white-box and two black-box models.The framework exploits shared and model-specific vulnerabilities across CNN- and ViT-based detectors.Source: §1 · pp. 1–2
• Low-performing source models can degrade attack effectiveness despite architectural diversity, making functional equivalence important for adversarial transfer.Source: §1 · p. 2

2 Related work

• CNN detectors focus on local textures and manipulation artifacts, whereas ViT detectors capture global dependencies using self-attention.The section names Xception and EfficientNet-B7 as CNN examples, and ICT and UIA-ViT as ViT examples.Source: §2 · p. 2
• CNN and ViT structural differences are associated with varying adversarial vulnerabilities and limited generalizability to unseen manipulations or domain shifts.Source: §2 · p. 2
• FGSM and PGD are baseline white-box attacks, while MI-FGSM uses momentum-based updates to stabilize gradients and improve success against unseen models.Source: §2 · p. 2
• MIG and MuMoDIG use integrated-gradient approaches to improve architecture-invariant perturbations, with MuMoDIG refining the integration path and using log-based loss.Source: §2 · p. 2
• Few studies have explicitly tested general-purpose gradient-based attacks on deepfake detectors, which rely on subtle cues such as fine-grained textures and identity consistency.The section identifies a need for tailored attacks that address heterogeneous systems without sacrificing effectiveness on individual models.Source: §2 · p. 2

3.1 Overview

• MIG-COW combines momentum-integrated gradients and orthogonal gradient aggregation to preserve consensus directions alongside complementary architecture-specific information.The framework is designed to generalize adversarial examples across CNN and ViT detectors.Source: §3.1 · p. 2

3.2.1 Integrated Gradient (IG).

• Integrated Gradients attribute input features along a path from a black baseline to the input, providing attributions described as stable across CNNs and ViTs.The method uses momentum-integrated gradients to stabilize optimization and help escape undesirable local optima.Source: §3.2.1 · p. 2
• The source-model loss uses cross-entropy on raw logits for the target class rather than raw probabilities, which the authors say enhances gradient scaling.The stated formulation avoids extra softmax normalization.Source: §3.2.1 · p. 3
• The gradient Gram matrix captures correlations among model gradients, and its least-aligned eigenvector weights the model IGs to form an aggregate direction.This approach addresses the risk that direct averaging overemphasizes shared information and obscures model-specific cues.Source: §3.2.1 · p. 3
• Removing the aggregate gradient's consensus-direction component yields an orthogonal direction intended to retain non-redundant, model-specific information.The final attack direction weights the consensus and orthogonal vectors, with 0 < β < 1.Source: §3.2.1 · pp. 3–4

3.2.3 Perform adversarial update with momentum.

• The attack updates the adversarial example iteratively with momentum, using μ as the momentum decay factor and ε as the perturbation budget.Algorithm 1 lists the clean image, target label, iteration count, momentum factor, weight factor, baseline image, and perturbation budget as inputs.Source: §3.2.3 · p. 4

4.1 Datasets and Evaluation

• The AADD-2025 dataset contains 693 HQ and 710 LQ fake images, with LQ images degraded through resizing and variable-quality compression.The images were generated using a range of named image-generation models.Source: §4.1 · p. 4
• All 1,403 fake images were verified as fake by both organizer-provided white-box detectors before attacks were evaluated.White- and black-box ASR count images fooled among the total, while SSIM measures similarity to the original images.Source: §4.1 · p. 4
• The AADD-2025 score combines visual similarity with attack effectiveness, averaging classifier outcomes over test images.The equation defines the classifier set, test-image count, original and adversarial images, real-class label, and indicator for a real-class prediction.Source: §4.1 · p. 4

4.2 Experiment Settings

• ResNet50 and DenseNet121 were the organizer-provided white-box sources, with pretrained ViT-P added as a supplementary source despite its dataset domain mismatch.ViT-P correctly classified about 70% of the 1,403 clean fake images as fake.Source: §4.2 · p. 4
• The two official black-box targets use ViT-B/16 and DenseNet121-DCT architectures.Table 1 reports average ASR, SSIM, and overall score; its score uses the four official models and excludes ViT-P.Source: §4.2 · p. 5, Table 1 · p. 5
• PGD, MI-FGSM, and base MIG were compared with MIG-COW, using averaged ensembles for the baselines.All experiments used perturbation budget 𝜖=0.02, 25 iterations, and momentum factor 𝜇=1.Source: §4.2 · p. 5

4.3.1 Attack on White-box Detectors.

• With CNN-only white-box sources, MIG-COW reaches 99.96% average white-box ASR, compared with 93.48% for MIG, 91.00% for MI-FGSM, and 58.31% for PGD.The white-box setting assumes full access to detector architecture and parameters.Source: §4.3.1 · p. 5
• With ViT-P included, MIG-COW reaches 93.87% ASR on ViT-P and 99.93% on both CNNs, while MIG reaches 90.96% on ViT-P.PGD and MI-FGSM reach 25.74% and 51.53% ASR on ViT-P, respectively.Source: §4.3.1 · p. 5

4.3.2 Attack on Black-box Detectors.

• The black-box evaluation follows the challenge threat model: no model details or gradients, one query per input, and only a binary prediction.The attack transfers adversarial examples crafted using white-box models to the official targets.Source: §4.3.2 · p. 5
• MIG-COW achieves the highest average black-box ASR and better white-box ASR and SSIM, yielding the best overall score among methods.Adding ViT-P generally degrades black-box ASR for IG-based methods; MI-FGSM has the highest black-box ASR in that setting but performs poorly white-box.Source: §4.3.2 · p. 5
• The hyperparameter-tuning figure plots ASR and SSIM across perturbation budget, attack steps, and consensus weight.ASR is shown with solid red lines and SSIM with dashed blue lines.Source: Figure 3 · p. 6
• ViT-P inclusion reduces black-box ASR for MIG and MIG-COW, indicating that source-model functional similarity matters more for transfer than architectural alignment alone.ViT-P shares the ViT-B/16 structure with a black-box target, but has lower baseline accuracy.Source: §4.3.2 · p. 6

4.4.1 Ablation Study.

• Removing CE loss reduces attack success on CNNs, while removing COW moderately lowers ViT-P performance; using both yields the highest overall score, 3,772.The ablations indicate that CE loss stabilizes CNN gradient signals and COW captures model-specific features for ViT detectors.Source: §4.4.1 · p. 6
• The orthogonal component of COW captures model-specific decision boundaries not represented by the consensus gradient, supporting deception across architectures.CE loss and COW play complementary roles in balancing generalization and specificity.Source: §4.4.1 · p. 6

4.4.2 Hyperparameters.

• Increasing perturbation budget generally raises ASR but lowers SSIM, whereas increasing attack steps improves both metrics with diminishing returns beyond 25 steps.The sensitivity analysis varies 𝜖 from 0.01 to 0.03 and T from 10 to 30.Source: §4.4.2 · p. 6
• A consensus weight of 0.7 to 0.8 maximizes ASR while preserving high perceptual similarity, with orthogonal weight set to 1−𝛽.This setting balances shared and model-specific gradient directions.Source: §4.4.2 · p. 6

• MIG-COW achieves high attack success in white-box settings while preserving visual similarity with benign input.Source: §5 · p. 6
• Momentum-based optimization and consensus-orthogonal gradient decomposition capture shared and model-specific vulnerabilities across CNN and ViT ensembles.Source: §5 · p. 6
• Reduced effectiveness against the official black-box ViT highlights the transfer gap between surrogate models and unseen deployment-time detectors.The conclusion identifies differences in architecture, training objectives, and data distributions as part of that gap.Source: §5 · p. 6
• Adding a low-performing model can degrade attack performance in both white-box and black-box settings, despite increasing architectural diversity.Source: §5 · p. 6
• The findings underscore careful surrogate-model selection and motivate future research into adaptive, robust attack strategies.Source: §5 · p. 6