TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors

2026-07-28

AI Summary

This work addresses the challenge that existing AIGC detectors struggle to identify highly photorealistic synthetic images, while conventional evasion methods often introduce visual artifacts and fail when diffusion models are frozen or detectors are only accessible as black boxes. To overcome these limitations, the authors propose TIGA, a framework that directly generates detection-evading images within a single DDIM sampling step, without requiring source images or retraining of models. TIGA embeds adversarial perturbations via trajectory guidance, leveraging a sign-aware prior and anisotropic directional search to enhance transferability. Robustness and visual fidelity are further improved through multi-surrogate gradient aggregation, symmetric finite-difference estimation, decaying momentum, and frequency-domain reshaping. Experiments demonstrate that TIGA achieves strong attack performance, high transferability across diverse unknown black-box detectors, resilience against post-processing, and consistently high perceptual quality.

Abstract

Recent diffusion models have achieved remarkable realism in facial image synthesis, posing growing challenges to artificial intelligence-generated content (AIGC) forensic detectors.Existing evasion methods typically perturb pre-generated images or require detector-aware training, which may introduce visible or statistical artifacts and limit applicability when the diffusion model must remain frozen and the target detector is accessible only through black-box queries. We propose Trajectory-Injected Generative Attack (TIGA), a source-image-free and training free framework that generates detector-evasive images within a single diffusion sampling trajectory. TIGA steers the latent Denoising Diffusion Implicit Model (DDIM) trajectory so that adversarial properties emerge during generation rather than being added afterward. TIGA first aggregates gradients from multiple white-box surrogate detectors to form a transferable, sign-aware prior, and then performs anisotropic directional search with symmetric finite-difference queries to estimate the black-box target response. The estimated directions are stabilized by decayed momentum and injected according to the DDIM noise schedule, with frequency-domain reshaping to suppress high frequency artifacts. Experiments on surrogate and unseen specialized forensic detectors show that TIGA achieves strong blackbox attack performance, transferability, and high robustness under common post-processing operations without source images or diffusion-model retraining, while preserving high perceptual quality.

Problem

• black-box attack
• AIGC detection
• diffusion models
• adversarial generation
• forensic evasion

Innovation

• trajectory-injected attack
• black-box AIGC detection
• diffusion model evasion
• source-image-free adversarial generation
• frequency-domain perturbation