Adversarial Deepfake Generation and an Investigation of Purification-Based Adversarial Detection

2026-07-28

AI Summary

This work addresses the dual challenges of deepfake image generation and detection by proposing a two-stage hot-start, adaptive-weighted multi-detector adversarial attack strategy. High-fidelity identity-preserving face generation is achieved through integration of FLUX.1-dev and PuLID, while an ensemble of PGD attacks—incorporating DiffJPEG-in-loop and momentum/diversity/expectation-over-transformation (MI/DI/EoT) techniques—simultaneously evades 12 state-of-the-art detectors. On the detection front, the authors construct a maximum-probability ensemble model combining SigLIP+DINOv2 and GenD-DINOv3, and for the first time systematically validate the efficacy of logit-difference signals under median filtering in distinguishing diverse adversarial sources, revealing a detection failure at JPEG compression quality threshold Q70. Experiments show 90% and 57.6% evasion rates against organizer- and participant-submitted detectors (score: 0.4170), while the detector achieves 99.4% accuracy on baseline data and AUROC scores of 0.81–0.98 across four adversarial sources after purification (final score: 0.6986).

Abstract

This paper describes the participation of team "Go To Germany" in the ImageCLEF 2026 Deepfake Detection and Generation Task. For the image generation task, we employ FLUX.1-dev with PuLID for identity-preserving face synthesis, combined with a multi-model PGD adversarial attack targeting 12 detectors simultaneously (DiffJPEG-in-loop, MI/DI/EoT, adaptive weighting, two-stage warm-start). Our approach achieved 90% evasion against organizer detectors and 57.6% against participant detectors, with a final generation score of 0.4170. For the image detection task, we combine two complementary detectors - SigLIP+DINOv2 for AI-generated images and GenD-DINOv3 for face manipulations - in a max-probability ensemble, achieving 99.4% accuracy on baseline deepfakes but suffering from high false-positive rates on real images, resulting in a final detection score of 0.6986. Beyond the official submission, we conducted a self-initiated investigation of purification-based adversarial detection, comparing three families of detection signals across six detectors that share a CLIP ViT-L/14 backbone. We find that raw $|Δ\text{logit}|$ under median-3 purification, applied through the EFFORT detector, separates adversarial inputs from clean inputs with AUROC 0.81-0.98 across four adversarial source types - a finding that refutes the simple backbone-preservation hypothesis and exposes a sharp JPEG-quality cliff at Q70 where the signal collapses.

Problem

• adversarial deepfake
• deepfake detection
• adversarial generation
• purification-based detection
• face manipulation

Innovation

• adversarial deepfake
• purification-based detection
• identity-preserving synthesis
• multi-model PGD attack
• CLIP ViT backbone