{"id":"f830dbd1-8d94-4414-8661-5391c943de45","arxiv_id":"2607.25894","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"TIGA evades black-box AIGC detectors by injecting adversarial directions into the DDIM sampling trajectory, reaching 100% attack success on the paper's face-image benchmarks.","lead":"TIGA is a new attack method that makes fake images evade AI detectors by steering the diffusion process itself, rather than editing finished images. It works only from black-box real/fake scores, and could matter for anyone building or defending image-forensics systems.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Evaluation never attacks a strong detector independent of the generator; 100% ASR is measured only on detectors fine-tuned on the same backbone as the test images.","rationale":"The reader's weakest assumption—that the experimental targets and surrogates are not independent of the generator—is exactly the load-bearing concern. The paper's own Section IV-A states that all four REDS detectors are fine-tuned on 12,000 images synthesized by the same diffusion backbone used to generate the test images. In each of the four black-box settings, the target is one of these same-generator detectors and the surrogates are the other three. This does not invalidate the method's internal mechanism—the ablations in Table IV show that the black-box SGDS module contributes to ASR—but it means the headline 100% ASR is demonstrated only in a favorable surrogate-target regime. The transfer table provides some evidence of generality, especially for PGC (clean 4.29% to 22–49% evasion), but these are transfer rates, not direct black-box attack rates, and CNN/DIRE are weak on clean images. A direct attack on a strong, generator-independent detector is the missing experiment that would separate the value of the black-box queries from the same-generator prior. Without it, the central claim that TIGA is a generally effective black-box attack on AIGC detectors is not fully supported. The verdict should remain CONDITIONAL: the paper is technically coherent and promising, but the key evaluation-domain gap must be closed before accepting the headline claim at face value.","tokens_in":22011,"tokens_out":5974,"duration_ms":60473,"concrete_test":"Use PGC (clean evasion 4.29%, i.e., a strong detector on Collaborative Diffusion images) as the black-box target, with surrogates that are not fine-tuned on the Collaborative Diffusion backbone—e.g., CNN, DIRE, and Uni trained on SD-v1.4/ProGAN. Run TIGA's full pipeline with the same query budget (about 1,000 symmetric finite-difference queries) and report ASR on PGC. If ASR is comparably high (e.g., >90%), the central claim generalizes. If ASR remains near the 22–49% transfer rates of Table II, then the black-box queries are not closing the surrogate–target gap, and the claim is limited to same-generator detector pools.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that TIGA evades black-box AIGC detectors using only confidence queries plus a transferable surrogate prior. The headline Table I result is obtained exclusively on the REDS pool, where every target is fine-tuned on 12,000 images 'synthesized by our diffusion backbone' (Section IV-A) and the other three REDS models serve as surrogates. This creates a same-generator, same-task relationship: the surrogate prior is drawn from detectors trained on exactly the distribution the attack must evade. The transfer experiments in Table II use detectors trained on SD-v1.4/ProGAN, but CNN and DIRE already classify >77% and >90% of clean Collaborative Diffusion images as real, so they are weak on this generator; only PGC is strong (clean evasion 4.29%). Crucially, no experiment ever runs TIGA against a strong detector that is independent of the generator as the black-box target. Thus the contribution of the query-based black-box mechanism is never isolated in the regime where it matters most: when the surrogate prior is mismatched and the target is reliable. The measured 100% ASR may therefore depend on the favorable same-generator fine-tuning rather than on a generally effective black-box trajectory attack.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TIGA, a training-free, source-image-free framework for evading black-box AIGC detectors by steering a DDIM sampling trajectory. At each denoising step, TIGA aggregates gradients from white-box surrogate detectors into a prior direction (SGP), performs an anisotropic directional search with symmetric finite-difference queries to the black-box target (SGDS), and injects the resulting momentum into the latent trajectory with schedule-aware scaling and frequency-domain reshaping (SATI). The authors evaluate on four REDS detectors fine-tuned on their Collaborative Diffusion backbone, reporting 100% ASR and the lowest BRISQUE in every column of Table I, improved transfer to five unseen detectors (Table II), robustness to post-processing (Table III), and component ablations (Table IV).","tokens_in":22358,"tokens_out":4742,"duration_ms":48641,"significance":"If the claims hold, TIGA is a meaningful contribution: it is one of the first methods to combine surrogate-gradient priors with query-based directional search inside a single frozen diffusion sampling loop, avoiding both post-hoc pixel perturbations and detector-aware retraining. The query budget is reasonable (N=10 probes per step, symmetric differences, S=50 steps ≈ 1000 queries), and the framework is modular, with ablations that isolate the roles of the prior, the search, momentum, and frequency shaping. The conceptual idea of injecting adversarial guidance at the trajectory level is interesting and potentially useful for understanding robustness of generative-model forensics. However, the experimental evaluation as presented is not yet sufficient to substantiate the broad black-box claim, because the main targets are all fine-tuned on the same generator used to produce the test images, and the surrogate set is drawn from the same fine-tuned pool.","major_comments":[{"comment":"The headline 100% ASR is obtained only on the four REDS targets, each fine-tuned on 12,000 images 'synthesized by our diffusion backbone,' with test images from that same backbone. The surrogates for each target are the other three REDS models, also fine-tuned on the same backbone. This creates a same-generator, near-white-box condition: the prior is derived from detectors that share the exact generator distribution with the target, and the query-based search is never tested against a strong detector that is independent of the generator. The transfer results in Table II are not an adequate substitute: CNN and DIRE already classify more than 77% and 90% of clean images as real, and PGC, the only strong transfer detector, remains below 50% evasion. The central claim that TIGA evades black-box AIGC detectors under realistic mismatch therefore is not established. Please add experiments with","section":"Section IV-A and Table I"},{"comment":"The comparison to baselines is inequitable in an important way. Baselines are post-hoc pixel-space perturbations constrained to a maximum ℓ∞ budget of 16/255, whereas TIGA performs an unconstrained trajectory injection that, as the authors acknowledge in Section IV-B2, can produce 'slightly larger coarse, low-frequency changes (e.g., hair color or skin tone).' Thus the Pareto dominance in Table I may reflect unequal perturbation freedom rather than intrinsic superiority. BRISQUE is a no-reference quality metric and does not control content drift from the original generation. I ask for a fairer comparison: either impose a comparable trajectory-level budget on TIGA (e.g., bound the accumulated injection in latent or pixel space), or include reference-based quality metrics (LPIPS, FID, or pixel fidelity to the clean sample) and a side-by-side analysis of content drift, so that the claimed '","section":"Table I and Section IV-B"},{"comment":"All reported results come from a single fixed seed and a single run. The method is stochastic in several places (DDIM η=1, random anisotropic probing directions, random initial noise), and the paper does not provide error bars, confidence intervals, or multiple-seed statistics. The margins in Table I (e.g., 100.00% vs. 99.61% ASR, and BRISQUE differences of ~4 points) could be within run-to-run variance. Please report mean and standard deviation over at least 5 independent seeds for the main tables and the hyperparameter sweeps, and indicate whether the observed differences are statistically reliable.","section":"Tables I–IV and Fig. 4"},{"comment":"The transfer-evasion evidence is weaker than the text suggests. On CNN and DIRE, the clean evasion rates are already 77.86% and 90.57%, so TIGA's near-100% rates are close to a ceiling and do not demonstrate transfer of a newly induced signal. On PGC, the only transfer detector with a meaningful clean detection rate (4.29% clean evasion), TIGA reaches 22.17–49.06% depending on the surrogate set, which is substantial but far below the 100% reported on REDS, and still means the majority of TIGA images are detected. This is consistent with the same-generator concern: the transfer results show partial generalization, not the strong black-box evasion claimed in the abstract. Please contextualize these numbers as incomplete transfer, and, if possible, report transfer as a function of the target detector's clean accuracy.","section":"Section IV-B3 and Table II"}],"minor_comments":[{"comment":"Typo: 'mifigate' should be 'mitigate' in the introduction.","section":"Section I"},{"comment":"Eq. (10) defines a step-dependent decay β_i = β_momentum(1 − i/(S−1)), but Algorithm 1 and Section IV-A refer only to a constant 'momentum decay β_momentum = 0.8'. Please make the relationship between β_i and the constant explicit in the algorithm listing.","section":"Section III-D / Algorithm 1"},{"comment":"The ordering of labels in the caption ('PGD FGSM SimBA Square BruSLe Source Ours R2BA') does not match the typical left-to-right ordering of the figure panels; please align the caption with the image layout.","section":"Fig. 3 caption"},{"comment":"Minor formatting: 'R 2BA' appears with an irregular space in two columns; unify with the baseline name used in Table I.","section":"Table II"},{"comment":"No code or data availability statement is provided. Given the reliance on a specific Collaborative Diffusion backbone and a custom fine-tuning protocol, releasing code and detector checkpoints would materially aid reproducibility.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The core idea is promising and the manuscript is well structured, but the evaluation currently overclaims. The most serious issue is that the main black-box targets and the surrogates share the same generator and fine-tuning distribution, so the 100% ASR in Table I is not a convincing test of the proposed query-based mechanism under realistic surrogate-target mismatch. Adding an experiment with an off-the-shelf strong detector (e.g., PGC or DIRE trained on SD/ProGAN) as the black-box target, while keeping the surrogates from REDS, would directly address the central claim. Also, the lack of error bars is a significant omission for a stochastic generative attack. I recommend major revision; if the independent-target results are favorable and multi-seed statistics are provided, I would support acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"TIGA is a technically coherent and clearly presented attack. The new thing is the combination: source-image-free, training-free, trajectory-level black-box evasion via prior-guided zero-order search injected into a frozen DDIM sampler. That is a legitimate advance over post-hoc attacks and retraining-based methods, and the module ablation genuinely isolates each component — the zero-order search (SGDS) is load-bearing, the surrogate prior adds cross-target reliability, and the frequency shaping mainly buys quality. The method description is implementable, and the authors are honest that the prior only biases the search while the target queries determine the update.\n\nNow the soft spots, in proportion. The stress-test concern holds up on reading: every REDS target is fine-tuned on the same diffusion backbone that generates the test images, and the other three REDS models serve as surrogates. So the surrogate prior is drawn from detectors trained on exactly the distribution the attack must evade. That is a genuinely favorable setting for the method. The 100% ASR in Table I should be read as \"evades detectors that are in-domain on this generator,\" not as a general black-box result. The transfer experiments are weaker than they look: CNN and DIRE already classify 77% and 90% of clean images as real, so they are not strong detectors on this generator; PGC is the only reliable one, and TIGA does improve it from 4% to 22–49%, which is real but far from the headline. Also, the comparison to baselines is asymmetric — TIGA has no pixel budget while the baselines are capped at 16/255 — so the Pareto claim in Table I is not clean. No error bars, fixed seed, and hyperparameters chosen from sweeps on the same benchmark further limit how much I would lean on the exact numbers.\n\nNone of this kills the contribution. The evidence supports a narrower claim: query-based trajectory injection can evade detectors trained on the same generator, and it transfers reasonably to one strong unseen detector. That is still worth publishing if the authors add an independent target pool, match the attack budget, and report variance. The paper is certainly serious enough for a full peer review — not a desk reject — but I would send it back expecting major revision, not acceptance on the current evidence.","headline":"Novel, well-engineered trajectory attack; the headline 100% ASR is measured only on detectors fine-tuned on the same generator, so the black-box general-claim is under-supported.","tokens_in":22832,"tokens_out":1669,"would_cite":false,"duration_ms":17298,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TIGA claims that a black-box AIGC detector can be evaded by injecting adversarial guidance directly into a frozen DDIM sampling trajectory, generating detector-evasive images from random noise alone, with the detector queried only through i","keywords":["adversarial attack","AIGC detection","black-box attack","diffusion models","DDIM trajectory","surrogate-guided search","zero-order optimization","image forensics"],"falsifier":"Run TIGA against four detector architectures fine-tuned exclusively on images from a different diffusion model family, while generating the attacked faces with the original backbone; if attack success drops noticeably below 100% or the quality advantage over post-hoc baselines disappears, the same-backbone training set is what carries the result.","tokens_in":21884,"feed_emoji":"🎭","tokens_out":8359,"duration_ms":74350,"temperature":0.7,"pith_summary":"TIGA tries to establish that an attacker can make a frozen diffusion model generate images a black-box AI-content detector labels real, starting from random noise and a text/mask condition, with no source image and no retraining. The adversarial signal is steered into the intermediate latent states of a single DDIM denoising trajectory, so evasiveness is a property of the sampling process itself rather than a perturbation pasted onto a finished image. The method combines white-box surrogate detectors (which supply a transferable search direction) with black-box confidence queries (which refine that direction via symmetric finite-difference probing), then injects the accumulated momentum into the trajectory scaled by the diffusion noise schedule and filtered in the frequency domain. If true, this would make a practical black-box evasion scenario much easier: attackers need only queries to the detector, and the products remain natural-looking generated faces instead of noisy adversarial images.","feed_headline":"Steering a diffusion trajectory fools AI-image detectors 100 percent","feed_subtitle":"Crafted inside one denoising pass from random noise, the images survive blur, JPEG, and resizing.","key_machinery":"The load-bearing object is the DDIM denoising trajectory: the chain of latent states z_T to z_0 produced by a frozen diffusion model. Two points on that chain do the work: the predicted clean latent, where both surrogate and black-box detectors can be evaluated, and the propagated state z_{t-1}, where the adversarial update is actually injected. Around this chain the method builds three coupled pieces: a surrogate-guided prior (ensemble gradients back-propagated to the latent and normalized, refreshed periodically), a surrogate-guided directional search (anisotropic probing: directions are blends of the prior with orthogonal random components, scored by symmetric finite differences of the bl","core_discovery":"The central claim is that detector evasion can be moved inside the generative process. TIGA runs entirely within the DDIM sampling loop: at each step it predicts the clean latent, computes a normalized gradient direction from a small ensemble of white-box surrogate detectors, draws probing directions from a distribution biased toward that surrogate prior, scores each probe with symmetric finite-difference queries to the black-box detector's confidence output, and accumulates the response-weighted directions into a momentum estimate. That estimate is injected into the propagated latent state z_{t-1} with a strength tied to the sampler's stochasticity level, then reshaped in the frequency doma","pith_inferences":["Editorial inference: the strongest result is measured against targets fine-tuned on images from the same diffusion backbone that generates the attacked images, so the honest test of the method's claim is a version where detectors are trained on images from a different generator; the surrogate prior and query estimates would then face a genuine distribution shift.","Editorial inference: the surrogate-guided anisotropic search is a general recipe for black-box control of latent generative models—the same query-plus-prior estimator could steer diffusion models toward other queryable objectives such as avoiding safety filters or satisfying style constraints.","Editorial inference: the mechanism itself suggests a defense—if trajectory injections tend to imprint a schedule-aligned, low-frequency signature, detectors could be trained on TIGA-style trajectories or on the difference between injected and clean latents to shrink the loophole.","Editorial inference: the paper fixes the query interval at every step and a population of ten probes; an adaptive schedule that concentrated queries at high-noise steps, where injection is strongest, could cut the query budget while retaining most of the success rate."],"forward_implications":["A deployed detector that exposes only confidence scores becomes evadable without access to weights, gradients, source images, or diffusion-model retraining—a wider practical threat model for AIGC forensics.","Because the adversarial signal is generated rather than added, the standard epsilon-budget trade-off between attack strength and visible artifacts is replaced by schedule-based injection, which the paper shows is higher on success and lower on visible distortion than post-hoc baselines.","The evasiveness transfers to detectors never used during optimization, especially content-level forensic detectors, so the attack is not just overfitting to the surrogate or target pool.","Evasiveness survives Gaussian blur, JPEG compression, and resizing much better than post-hoc attacks, meaning the images keep fooling detectors after realistic platform-side transformations.","The three modules are complementary: removing the black-box search hurts success and quality most, removing the surrogate prior hurts cross-target reliability, removing momentum hurts success, and removing frequency reshaping hurts visual quality."],"fun_headline_variants":["Steered diffusion dodges AIGC detectors","Evade AI detectors mid-diffusion with injected attack","No source image needed: attack rides the denoising path","Training-free attack steers diffusion to dodge detectors","Inject attacks during DDIM sampling to fool AIGC detectors"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is in the evaluation setup rather than the algorithm: the four black-box targets are fine-tuned on 12,000 images generated by the same diffusion backbone that TIGA attacks, so the surrogate gradients and black-box probe responses are aligned with the generator's own forensic fingerprint; against detectors trained on other generators, the reported 100% success may not transfer.","fun_headline_variants_meta":{"raw":{"variants":["Steered diffusion dodges AIGC detectors","Evade AI detectors mid-diffusion with injected attack","No source image needed: attack rides the denoising path","Training-free attack steers diffusion to dodge detectors","Inject attacks during DDIM sampling to fool AIGC detectors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001625,"raw_usage":{"total_tokens":6304,"prompt_tokens":747,"completion_tokens":5557,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":491,"completion_tokens_details":{"reasoning_tokens":5477}},"tokens_in":491,"tokens_out":5557,"duration_ms":35482,"temperature":1.0,"reasoning_tokens":5477,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T01:10:18.421236+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run TIGA against four detector architectures fine-tuned exclusively on images from a different diffusion model family, while generating the attacked faces with the original backbone; if attack success drops noticeably below 100% or the quality advantage over post-hoc baselines disappears, the same-backbone training set is what carries the result.","supporting_citations":[],"review_version":1}