{"id":"caa0e448-8c9b-41cc-a5a7-61583da18ecf","arxiv_id":"2606.25376","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"AIR extends the attack space for face swapping by jointly applying reillumination and additive identity perturbations, achieving higher transferability and image quality than prior methods across GAN and diffusion-based models.","lead":"The paper introduces AIR, an attack that combines relighting and additive perturbations to fool subject-agnostic face-swapping models without using a surrogate model. This approach could strengthen privacy protections against deepfake threats by producing more effective and natural-looking adversarial examples.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Mathematical proof of attack-space extension implicitly assumes properties of identity extractors that may not generalize to diffusion-based FS models","rationale":"The reader's weakest assumption directly identifies the reillumination-plus-additive mechanism and the no-surrogate proof as the load-bearing elements. The concern is internal to the argument (whether the proof's assumptions match the tested diffusion models) rather than external consensus. Experiments on 1000 pairs are cited as support, but the theoretical justification for why the method works without surrogates is the part least secured by the given description.","tokens_in":1732,"tokens_out":359,"duration_ms":17165,"concrete_test":"Locate the mathematical proof (likely §3 or §4) and re-derive the attack-space extension inequality while replacing the identity extractor with a simplified diffusion U-Net forward pass; if the claimed extension bound no longer holds or requires additional Lipschitz constants not stated in the paper, the proof does not support transfer to diffusion models.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim requires that combining reillumination with additive perturbations extends the attack space in a model-agnostic way, enabling transferability without any surrogate FS model. The paper states a mathematical proof is provided for this extension. However, such a proof must rely on assumptions about the identity extraction module (e.g., continuity, Lipschitz bounds, or additive separability of illumination and identity features). Diffusion-based FS models often employ iterative denoising processes and cross-attention that violate simple additive or bounded-sensitivity assumptions used in standard adversarial analyses. If the proof only holds under a surrogate-like functional form for the extractor, the no-surrogate transferability claim rests on an unverified generalization step rather than the stated proof.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes AIR, a transferable adversarial attack on subject-agnostic face-swapping (FS) models that combines reillumination with additive perturbations to extend the attack space, supported by a mathematical proof of the extension; unlike prior methods, AIR requires no surrogate FS model. Experiments on 1000 image pairs across GAN- and diffusion-based state-of-the-art FS models report higher attack success rate and better image quality than existing attacks, with additional components for adaptive translation-invariance and illumination control.","tokens_in":1876,"tokens_out":479,"duration_ms":25853,"significance":"If the central claims hold, the work is significant because it demonstrates model-agnostic transferability via an extended attack space without surrogate training, together with a mathematical proof and large-scale experiments (1000 pairs) that include both GAN and diffusion FS models. These elements address a practical gap in protecting against unseen FS models and could inform future defenses.","major_comments":[{"comment":"Abstract and mathematical proof section: the claim that the proof establishes model-agnostic extension of the attack space (enabling transfer without surrogate) is load-bearing for the no-surrogate transferability result, yet the proof appears to rest on assumptions (additive separability of illumination and identity features, bounded sensitivity of the extractor) that diffusion-based FS models' iterative denoising and cross-attention mechanisms are likely to violate; explicit verification or counter-examples for diffusion extractors are needed.","section":"Abstract / Mathematical proof"},{"comment":"Experimental section (1000 image pairs): the reported superiority in attack success rate and image quality over baselines lacks stated metrics, error bars, exact protocol details, or ablation on the reillumination component alone, making it impossible to assess whether the gains are robust or protocol-dependent.","section":"Experiments"}],"minor_comments":[{"comment":"Abstract: the phrase 'surpasses all existing attacks' should be qualified with the specific baselines and metrics used.","section":"Abstract"},{"comment":"Notation: the definitions of the reillumination function and additive perturbation should be introduced with explicit symbols before the proof is referenced.","section":"Method"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback on the mathematical proof and experimental reporting. We address each major comment below and will revise the manuscript to incorporate additional verification and details.","responses":[{"response":"The proof establishes extension of the attack space under the stated assumptions of additive separability between illumination and identity features together with bounded sensitivity of the extractor. While experiments already show strong transfer to diffusion-based FS models, we agree that explicit checks on whether the assumptions hold for their iterative denoising and cross-attention components would strengthen the claim. In revision we will add a dedicated subsection providing empirical verification (or counter-examples) using the identity extractors from the diffusion FS models evaluated in the paper.","revision_made":"yes","referee_comment":"[Abstract / Mathematical proof] Abstract and mathematical proof section: the claim that the proof establishes model-agnostic extension of the attack space (enabling transfer without surrogate) is load-bearing for the no-surrogate transferability result, yet the proof appears to rest on assumptions (additive separability of illumination and identity features, bounded sensitivity of the extractor) that diffusion-based FS models' iterative denoising and cross-attention mechanisms are likely to violate; explicit verification or counter-examples for diffusion extractors are needed."},{"response":"We will expand the experimental section to explicitly define the attack success rate and image quality metrics, report standard error bars across repeated trials, detail the full protocol (pair selection, preprocessing, and hyper-parameters for the 1000 pairs), and include a new ablation isolating the reillumination component to quantify its contribution to the observed gains.","revision_made":"yes","referee_comment":"[Experiments] Experimental section (1000 image pairs): the reported superiority in attack success rate and image quality over baselines lacks stated metrics, error bars, exact protocol details, or ablation on the reillumination component alone, making it impossible to assess whether the gains are robust or protocol-dependent."}],"tokens_in":1383,"tokens_out":424,"duration_ms":18523,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The core contribution is a method called AIR that jointly applies relighting and additive perturbations to fool identity extractors in subject-agnostic face-swapping models. It avoids surrogate training, adds an adaptive translation-invariant step and illumination control for better visuals, and includes a mathematical argument that the combined perturbations enlarge the effective attack space. Experiments reportedly cover 1000 image pairs across multiple GAN and diffusion-based FS models and claim higher success rates with preserved image quality.\n\nWhat stands out is the explicit test on diffusion-based models and the no-surrogate transfer claim. Most prior attacks rely on surrogates or single perturbation types, so the joint approach and the proof attempt are distinct moves.\n\nThe soft spots are in the supporting details. The abstract mentions a proof but gives no indication of the assumptions (continuity, separability of illumination and identity features, or bounds on the extractor). The stress-test concern is reasonable here: diffusion models use iterative denoising and cross-attention that often break simple additive or Lipschitz assumptions common in adversarial proofs. If the proof only holds under a surrogate-like functional form, the model-agnostic transferability rests on an unverified step rather than the stated argument. Experiments are described at a high level with no metrics, baselines, error bars, or protocol, so it is impossible to judge whether gains are robust or from post-hoc choices.\n\nThis paper is for researchers working on adversarial defenses for deepfake identity extraction. It deserves a serious referee because the joint-perturbation idea and the diffusion-model tests are worth checking, even if the current evidence is preliminary.","headline":"AIR combines relighting and additive perturbations for no-surrogate transferable attacks on face-swapping models, with a claimed proof of extended space and tests on GAN plus diffusion models, but the writeup leaves the proof assumptions and experimental details thin.","tokens_in":2384,"tokens_out":411,"would_cite":false,"duration_ms":15185,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"The proposed AIR attack combines reillumination and additive perturbations to extend the space of effective adversarial examples against subject-agnostic face swapping models.","keywords":["face swapping","adversarial attack","transferable attack","reillumination","identity extraction","deepfake"],"falsifier":"Finding a new subject-agnostic FS model where the AIR attack has a lower success rate than current best attacks on the same test images.","tokens_in":2632,"feed_emoji":"","tokens_out":593,"duration_ms":22631,"temperature":0.7,"pith_summary":"The paper introduces AIR to protect against face swapping by generating adversarial examples that fool identity extraction in subject-agnostic models. It combines reillumination and additive perturbations to extend the attack space, allowing stronger yet natural-looking perturbations. This approach avoids the need for a surrogate model and includes an adaptive translation-invariant operation and illumination control. Experiments across 1000 image pairs on various GAN and diffusion-based models demonstrate higher attack success rates and better image quality than prior methods. A mathematical proof supports the attack space extension.","feed_headline":"Perturbation combo fools unseen face swap models","feed_subtitle":"By extending the attack space with reillumination and additive changes, AIR improves success rate and image quality without surrogate models","key_machinery":"The Additive Identity attack based on a Relighting function (AIR) that combines reillumination and additive perturbations to extend the attack space.","core_discovery":"AIR leverages reillumination and additive perturbations to mislead the identity extraction modules in subject-agnostic FS models. By using these two types of perturbations simultaneously, the attack space is extended such that stronger but more visually natural adversarial examples can be identified. An adaptive translation-invariant operation and an illumination control scheme are designed to enhance visual quality while preserving attack effectiveness. Unlike other methods, AIR does not require a surrogate FS model to achieve high transferability, and a mathematical proof is given for the extension of the attack space.","pith_inferences":["This combination of perturbations could apply to defending against other types of deepfake manipulations.","Further optimization of the illumination control might improve performance on specific lighting conditions.","Testing the attack on real-world deployed face swapping apps would show practical effectiveness."],"forward_implications":["AIR achieves higher attack success rates on unseen subject-agnostic FS models including GAN and diffusion-based ones.","AIR produces adversarial examples with better visual quality than existing attacks.","The method works without training on a surrogate FS model.","The attack space extension is supported by a mathematical proof."],"fun_headline_variants":["AIR extends attack space for face swap perturbations","Reillumination aids transferable attacks on face swapping","AIR misleads identity extraction in subject-agnostic FS","Additive and relighting perturbations fool unseen FS models","AIR provides surrogate-free transfer to face swap attacks"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"Reillumination combined with additive perturbations can reliably mislead identity extraction modules in unseen subject-agnostic face swapping models.","fun_headline_variants_meta":{"raw":{"variants":["AIR extends attack space for face swap perturbations","Reillumination aids transferable attacks on face swapping","AIR misleads identity extraction in subject-agnostic FS","Additive and relighting perturbations fool unseen FS models","AIR provides surrogate-free transfer to face swap attacks"]},"model":"grok-4.3","cost_usd":0.003167,"raw_usage":{"total_tokens":1717,"prompt_tokens":685,"num_sources_used":0,"completion_tokens":64,"cost_in_usd_ticks":31674500,"prompt_tokens_details":{"text_tokens":685,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":968,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":685,"tokens_out":64,"duration_ms":8335,"temperature":1.0,"reasoning_tokens":968,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-25T21:02:34.347994+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Finding a new subject-agnostic FS model where the AIR attack has a lower success rate than current best attacks on the same test images.","supporting_citations":[],"review_version":1}