{"paper":{"title":"Backbone is All You Need: Assessing Vulnerabilities of Frozen Foundation Models in Synthetic Image Forensics","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Knowledge of only the Vision Transformer backbone in frozen deepfake detectors enables gray-box adversarial attacks that reach near white-box success rates.","cross_cats":["cs.MM"],"primary_cat":"cs.CV","authors_text":"Andrea Montibeller, Chiara Musso, Giulia Boato, Joy Battocchio","submitted_at":"2026-05-13T11:35:56Z","abstract_excerpt":"As AI-generated synthetic images become increasingly realistic, Vision Transformers (ViTs) have emerged as a cornerstone of modern deepfake detection. However, the prevailing reliance on frozen, pre-trained backbones introduces a subtle yet critical vulnerability. In this work, we present the Surrogate Iterative Adversarial Attack (SIAA), a gray-box attack that exploits knowledge of the detector's ViT backbone alone and operates entirely within the target detector's feature space to craft highly effective adversarial examples. Through our experiments, involving multiple ViT-based detectors and"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"backbone knowledge alone is sufficient to undermine detector reliability, highlighting the urgent need for more resilient defenses in adversarial multimedia forensics.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That an attacker with only backbone knowledge can reliably access and manipulate the target detector's internal feature space to generate effective adversarial examples.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Knowledge of the ViT backbone alone enables highly effective gray-box adversarial attacks on synthetic image detectors, often nearing white-box performance.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Knowledge of only the Vision Transformer backbone in frozen deepfake detectors enables gray-box adversarial attacks that reach near white-box success rates.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"a8459fc3c857990a19bf08d1709a524d91147681a5ce83fa63ae926b9e20cb81"},"source":{"id":"2605.13381","kind":"arxiv","version":1},"verdict":{"id":"1031e522-6686-4422-b22e-ea3bc63e3f6a","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-14T19:08:12.870169Z","strongest_claim":"backbone knowledge alone is sufficient to undermine detector reliability, highlighting the urgent need for more resilient defenses in adversarial multimedia forensics.","one_line_summary":"Knowledge of the ViT backbone alone enables highly effective gray-box adversarial attacks on synthetic image detectors, often nearing white-box performance.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That an attacker with only backbone knowledge can reliably access and manipulate the target detector's internal feature space to generate effective adversarial examples.","pith_extraction_headline":"Knowledge of only the Vision Transformer backbone in frozen deepfake detectors enables gray-box adversarial attacks that reach near white-box success rates."},"references":{"count":31,"sample":[{"doi":"","year":2023,"title":"Adobe. 2023. Adobe Firefly: Generative AI for Content Creation. https://www. adobe.com/sensei/generative-ai/firefly.html. Accessed: 2026-02-09","work_id":"fcde58b3-a116-4165-9046-d60aad5a5927","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Irene Amerini, Mauro Barni, Sebastiano Battiato, et al. 2025. Deepfake media forensics: Status and future challenges.Journal of Imaging11, 3 (2025), 73","work_id":"3a6d192f-87bd-4073-b43d-88390eaa7449","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Erik Arakelyan, Karen Hambardzumyan, Davit Papikyan, et al. 2025. With Great Backbones Comes Great Adversarial Transferability. arXiv:2501.12275","work_id":"0eda3e66-13c7-42a8-ae46-7cd88ed6f3ed","ref_index":3,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Sebastiano Battiato, Mirko Casu, Francesco Guarnera, et al. 2025. Adversarial Attacks on Deepfake Detectors: A Challenge in the Era of AI-Generated Me- dia (AADD-2025). InProceedings of the 33rd ACM I","work_id":"3f457d95-fe0b-44db-b8d1-99cad2dfc435","ref_index":4,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Joy Battocchio, Stefano Dell’Anna, Andrea Montibeller, and Giulia Boato. 2025. Advance Fake Video Detection via Vision Transformers. InProceedings of the 2025 ACM Workshop on Information Hiding and Mu","work_id":"b6c0f140-7afe-41d7-b8a4-48bfcdf71a5e","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":31,"snapshot_sha256":"fb2f481fb197d5545c700ce90e9883e441e0f6707b9f2f8cc1dfcb3801e3fa62","internal_anchors":2},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"}