Pith. sign in

REVIEW 3 major objections 7 minor 70 references

ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors

T0 review · 3 major / 7 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that orchestrating five perturbation primitives with vision-language and LLM guidance lets no-query transfer attacks fool blind transformer deepfake detectors at 44.3% on AADD-LQ/ViT-B/16.

desk verdict A careful, unusually honest attack paper whose headline gain over ARMOR is statistically real but not yet attributable: the comparison is not compute-matched and the key ablation row is internally inconsistent. read the letter →

arxiv 2607.15246 v1 pith:QM4S2C45 submitted 2026-07-16 cs.CV

Christos Korgialas , Gabriel Lee Jun Rong , Dion Jia Xu Ho , Pai Chet Ng , Xiaoxiao Miao , Konstantinos N. Plataniotis This is my paper
classification cs.CV
keywords deepfakedetectionadversarialtransferabilityblack-boxattackno-querythreatmodelvision-languageLLMagentmulti-domainperturbationAADD-2025
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ARMOR++ sets out to show that deepfake detectors can be reliably evaded under a strict no-query black-box threat model, where an attacker may optimize only on public surrogate CNNs and never queries the target detector. The framework uses a vision-language model to identify image regions likely to carry forensic traces and a large language model to choose among five complementary perturbation primitives—dense optimization, saliency, spatial warp, frequency-domain, and block-structured—and to reparameterize and mix them. On the AADD-2025 benchmark, it reports a blind-target attack success rate of 44.3% on ViT-B/16 for low-quality faces, a 4.7-point gain over the prior agentic ARMOR baseline and 24.7 points over AutoAttack-PGD, with the same ordering on Swin-B and on high-quality images. If the claim holds, current deepfake detectors leave an operationally significant residual failure rate, and standard non-adaptive defenses do not close it.

What carries the argument

The machinery is the ARMOR++ multi-agent closed loop: a Qwen2.5-VL Analysis Agent produces a soft spatial prior over forensic anomalies; a Qwen3 Conductor and Advisor set and adapt constraints and primitive hyperparameters; five parallel Method Agents generate candidates (CW-style, JSMA, STA, SSA, BSR); and deterministic Critique, Strategist, and Mixer components detect stagnation, relax constraints, and solve an entropy-regularized convex mixing problem. The mixer deliberately omits any target-probability term, preserving strict no-query transfer.

What would settle it

Train a ViT-B/16 target from random initialization on the AADD-2025 training split, keep the three ImageNet-pretrained CNN surrogates, and run ARMOR++ with the same budget. If blind-target ASR falls to near AutoAttack-PGD levels (roughly 0.20 or below), the central transfer claim is driven by shared pretraining rather than multi-domain orchestration; if ASR stays near 0.44, the orchestration claim survives.

Watch

Extended reading notes

Core claim

The paper's central discovery is that a multi-domain, semantically informed perturbation set, orchestrated by a closed-loop agentic controller, transfers across an architecture gap (CNN surrogates to ViT/Swin targets) far better than any single-domain static attack, even when the target is never queried. The paper identifies the mechanism as coverage of heterogeneous inductive biases: SSA targets spectral artifacts and BSR targets patch-based ViT structure, while CW, JSMA, and STA cover dense, sparse, and geometric vulnerabilities, with VLM-derived masks and LLM-driven hyperparameter adaptation keeping the search image-specific. The strict no-query protocol is preserved by excluding any targ

Load-bearing premise

The load-bearing premise is that all five detectors—three CNN surrogates and two transformer targets—are ImageNet-pretrained and fine-tuned on the same AADD-2025 training split; if a shared representation channel from that common initialization supplies most of the transfer, the reported residual failure rate may not generalize to independently initialized or differently trained detectors (the paper flags this in Section VII-E).

Editorial extensions

If this is right

  • At 44.3% ASR on AADD-LQ/ViT-B/16, a fake image survives detection in roughly 44% of cases under a feasible no-query threat model; the one-sided 95% lower bound on detector reliability is 0.525.
  • The ordering ARMOR++ > ARMOR > AutoAttack-PGD persists on Swin-B and in the high-quality regime, indicating the result is not specific to one architecture or artifact strength.
  • Two standard non-adaptive defenses (PGD adversarial training and randomized input transformation) leave residual ASRs of 19.8% and 27.6%, below the roughly 90% reliability typically required for automated decisions.
  • Adding SSA, BSR, and the third surrogate accounts for most of the 0.396-to-0.443 gain; removing adaptive mixing collapses ASR to 0.104, showing orchestration is load-bearing.
  • A zero-shot check on DFDC-Preview retains the large margin over non-agentic baselines, though the gain over ARMOR at N=200 is not statistically separable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: The paper's own limitation note implies a testable negative control—retrain ViT-B/16 and Swin-B targets from random initialization on the same training split while keeping ImageNet-pretrained surrogate CNNs. If blind-target ASR drops near the non-agentic baselines, much of the reported transfer flows through the shared initialization, not the multi-domain orchestration.
  • Inference: A natural next experiment is an adaptive defense that injects random resizing or noise during fine-tuning and then evaluates ARMOR++ under expectation-over-transformation; the current defenses are non-adaptive and would likely shrink the residual ASR.
  • Inference: The five-primitive space suggests a stronger static control—a tuned non-agentic ensemble with the same primitives and matched compute budget. The uniform-mixing ablation performs poorly, but a well-tuned static mixture could test whether the LLM controller adds value beyond primitive diversity.
  • Inference: Because SSA-dominated mixtures fail on 43% of unsuccessful HQ-like images, a detector that explicitly suppresses low-frequency spectral perturbations or enforces block-coherence might raise reliability more than current defenses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes ARMOR++, a multi-agent framework for no-query black-box transfer attacks on deepfake detectors. It combines a Qwen2.5-VL analysis agent that produces spatial semantic priors, a Qwen3 conductor/advisor for planning and adaptive reparameterization, and five parallel primitives (CW-style, JSMA, STA, SSA, BSR) spanning dense, saliency, geometric, frequency-domain, and block-structured perturbations. Evaluation on AADD-2025 LQ/HQ uses three CNN surrogates (ResNet-50, DenseNet-121, EfficientNet-B4) and two blind transformer targets (ViT-B/16, Swin-B), reporting ASR 0.443 on LQ/ViT, +4.7 points over ARMOR, and consistent ordering on HQ, DFDC-Preview, and under two non-adaptive defenses. The paper claims strict no-query protocol, matched perturbation envelope, and extensive statistical reporting with Wilson CIs, exact McNemar tests, and Holm correction.

Significance. If the results hold, the paper is a careful empirical demonstration that multi-domain, semantically guided orchestration can improve black-box transfer to transformer deepfake detectors and quantifies a residual reliability gap. The protocol is unusually careful: Wilson CIs, paired exact McNemar tests with Holm correction, matched epsilon/SSIM envelope, compute accounting, explicit limitation statements, and plans for artifact release. However, the central attribution to agentic orchestration is threatened by a compute mismatch between methods and an internal inconsistency in the ablation, so the headline claim needs a compute-matched control before it can be accepted.

major comments (3)
  1. [Sec. VI-C, Table VII; Sec. IV-C] Table VII reports ARMOR++ at ~13,400 surrogate forward passes per image versus ~9,500 for ARMOR and ~5,000 for AutoAttack-PGD. The 'matched perturbation envelope' described in Sec. I and IV-C controls the epsilon/SSIM schedule (Eq. 28), not the number of forward passes. Because ARMOR is evaluated in its native two-CNN configuration (Sec. V-C) while ARMOR++ uses three CNNs, the per-image pass counts are not directly comparable: the footnote defines one pass as one evaluation of the three-network ensemble, so ARMOR's ~9,500 passes are two-network evaluations. No compute-matched ARMOR or static five-primitive controller is reported, and Phase 4 mixer evaluations are excluded from the primitive-loop count. The headline +4.7-point gain (0.396→0.443) is therefore confounded by substantially more surrogate compute, so the central attribution to agentic orchestration rather than extra computatio
  2. [Sec. VI-E, Table X row (a)] Table X row (a), labeled 'Three primitives, 3 surrogates, full agents,' reports ASR 0.396, CI [.361,.432], SSIM .698±.173 — numerically identical to the ARMOR baseline row above it, even though ARMOR is defined as a two-CNN (ResNet-50 + DenseNet-121) configuration in Sec. V-C. A three-primitive, three-surrogate agentic configuration cannot have exactly the same per-image outcomes and SSIM as a three-primitive, two-surrogate baseline unless the row is a copy of the ARMOR row. The ablation's intended reference point for the 0.396→0.443 gain is therefore not credibly instantiated. Please correct row (a) or explain the discrepancy, and base the attribution on a properly instantiated control.
  3. [Sec. VII-E; Sec. V-B] All five backbones are initialized from ImageNet-pretrained weights and fine-tuned on the same AADD-2025 training split (Sec. V-B). This creates a potential implicit representation channel between the three CNN surrogates and the two transformer targets. The paper acknowledges this in Sec. VII-E and proposes a future negative control, but the current experiments do not bound the effect. Because the paper's general claim is that multi-domain orchestration transfers across architectures, the possibility that shared initialization supplies much of the transferability is a load-bearing external-validity concern. A negative control with an independently initialized or differently pretrained target is needed before the cross-architecture generalization claim can be accepted.
minor comments (7)
  1. [Sec. VI-C] The Table VII footnote states that Phase 4 mixer evaluations are not folded into the primitive-loop count, so the reported ~13,400 passes understate total surrogate compute. Please report the total including Phase 4 evaluations.
  2. [Sec. VI-A, Table IV] For the ARMOR comparison (74/40 discordant pairs), please clarify whether the p-value is the exact two-sided binomial test and whether the paired-difference CI [0.019,0.077] is the McNemar-based interval; this is a presentation issue.
  3. [Sec. VI-H] The statement '2+K_max = 7 generative calls' is consistent with Algorithm 1, but the Conductor call is a one-time initialization while the K_max calls are Advisor calls. Please make this distinction explicit in the text.
  4. [Sec. V-C] Query-based baselines are not allowed to query the blind target and are capped at 2,500 surrogate passes. This is a reasonable protocol but makes those baselines weak; consider adding a sentence noting that their intended operating regime is different.
  5. [Sec. VI-B, Tables V and VI] The dash for RL-PPO's p_cond is marked indeterminate because psurr≈0. This is fine, but a footnote explaining the dash would improve readability.
  6. [Sec. IV-C, Eq. (26)] The notation eLsurr is used but not formally defined before the equation; please define it inline (the text later says it is Lsurr/log K, but this appears after the equation).
  7. [Figs. 2 and 3] The qualitative claim that ARMOR++ is 'close to imperceptible' is supported by dataset-level mean SSIM but not by per-panel metrics. Adding per-panel SSIM or a small numeric inset would strengthen the figure.

Circularity Check

1 steps flagged · score 3.0 of 10

Ablation reference point relabels the ARMOR baseline; headline ASR itself is an independent external measurement.

  1. renaming known result [Section VI-E, Table X (rows 'ARMOR [30] (baseline)' and '(a)' ); Section VII-A]
    "ARMOR [30] (baseline) .396 [.361,.432] .280 .698±.173 ... (a) Three primitives, 3 surrogates, full agents .396 [.361,.432] .280 .698±.173 ... Row (a) reaches0.396, so the gain from0.396to0.443 is associated with adding SSA and BSR, the third surrogate, and the entropy regularizer."

    Row (a), the ablation configuration intended to isolate the three-primitive/full-agent reference point, is numerically identical to the ARMOR baseline in ASR, Wilson CI, wASR, and SSIM, even though the ARMOR baseline is described as a native two-CNN configuration. The paper uses this row as the reference for attributing the 0.396→0.443 gain to SSA, BSR, the third surrogate, and the entropy regularizer. The 'gain' is therefore the headline ARMOR→ARMOR++ comparison relabeled as a component-removal result; it does not independently establish which added component contributes the gain. This is a renaming of the known baseline result rather than a derived ablation attribution.

full rationale

The central empirical result is not circular: optimization, candidate selection, mixing, and reparameterization use only the three-CNN surrogate ensemble, and the blind ViT-B/16/Swin-B targets are queried once for reporting (Algorithm 1, Eqs. 24–33; Section III-A). ASR is measured on held-out AADD-2025 test subsets against an external benchmark, so no target information enters the construction. The ARMOR comparison, though to the authors' own prior work, is re-run under the same protocol; the numerical comparison is not imported from the citation. The compute difference (~13,400 vs ~9,500 surrogate passes/image) is a genuine confound in attributing the +4.7-point gain to orchestration rather than extra optimization, but this is a correctness risk, not a circularity. The one circularity-adjacent flaw is Table X: row (a) is numerically identical to the ARMOR baseline row, so the paper's component attribution for the 0.396→0.443 gain reduces to the headline baseline comparison. This affects the ablation's internal-validity claim, not the independent blind-target measurement. Score 3 reflects one localized relabeling issue while the central claim retains independent empirical content.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central claim rests on hand-chosen hyperparameters for the primitive family and mixing, on the threat model that a no-query transfer evaluation with shared ImageNet-pretrained backbones is a meaningful proxy, and on the stability of the VLM/LLM guidance. No new physical or mathematical entities are introduced; the 'agents' are software roles with directly observable behavior. The number of tunable constants is large, but they are disclosed and fixed across baselines.

free parameters (6)
  • Perturbation budget ε = 8/255 (max 16/255)
    Hand-set default; the strict no-query comparisons are matched to this envelope, but all results depend on it.
  • SSIM floor τ_min = 0.5
    Hand-set perceptual threshold used in Eq. (31)-(33) and escalation schedule Eq. (28).
  • Critique weights (μ_p, μ_l, μ_s) = (1.0, 0.5, 5.0)
    Chosen by hand for Eq. (26); the stagnation detection and candidate scoring depend on them.
  • Mixing and entropy coefficients (λ1, λ2, λ3, λ4^(0), ρ_mix) = (1.0, 10.0, 0.1, 0.20, 0.30)
    Hand-set for Eq. (31); the entropy anneal schedule controls exploration/exploitation.
  • Outer iterations K_max and stagnation window W = (5, 3)
    Procedure parameters; results change with K_max as shown by the archive selection.
  • Inner primitive budgets (U_CW=1000, U_JSMA=500, U_STA=200, U_SSA=300, U_BSR=300; Q_SSA=Q_BSR=20) = varies
    Default step counts; they determine the ~13,400 forward-pass per-image cost.
assumptions (4)
  • domain assumption Surrogate-to-target transfer on the same AADD-2025 test distribution is a valid proxy for blind-target vulnerability.
    The evaluation treats ViT-B/16/Swin-B as blind, but surrogates and targets are fine-tuned on the same training split and share ImageNet initialization (Section V-B, VII-E).
  • domain assumption The ImageNet-pretrained CNN surrogates and transformer targets share a representation channel adequate for transfer to be meaningful.
    Acknowledged in Section VII-E as a potential implicit representation channel; a negative control with independently initialized targets is suggested but not run.
  • domain assumption The VLM's semantic report and the LLM's hyperparameter shifts are stable enough under temperature 0.2/0 to give reproducible guidance.
    VLM uses temperature 0.2; greedy decoding produced degenerate JSON (Section V-E), so the guidance is stochastic; the paper uses 3 seeds/majority vote but does not quantify run-to-run VLM variability.
  • domain assumption SSIM and ℓ∞ budget define the feasible set and are the only perceptual constraints.
    Eq. (6); other perceptual dimensions (e.g., LPIPS, face identity preservation) are not considered.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors." pith.science (2026). https://pith.science/paper/QM4S2C45

@misc{pith2026260715246,
  author       = {Pith},
  title        = {Pith review of: ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QM4S2C45}},
  note         = {Machine review of arXiv:2607.15246}
}
read the original abstract

The reliability of deepfake detectors frequently degrades under black-box adversarial transfer, as these models often rely on fragile, architecture-dependent forensic cues. Existing transfer attacks often lack semantic awareness and struggle to maintain effectiveness under strict no-query constraints, particularly when perturbations are transferred from convolutional surrogates to transformer-based targets. To address these limitations, this paper introduces ARMOR++, a robust multi-agent framework designed for high-transferability deepfake evasion. The framework leverages the Qwen2.5-VL Vision-Language Model (VLM) to supply spatial semantic priors, while the Qwen3 Large Language Model (LLM) orchestrates primitive selection, adaptive hyperparameter reparameterization, and entropy-regularized perturbation mixing. By integrating five complementary primitives, spanning dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structured modifications, ARMOR++ effectively targets heterogeneous inductive biases. Rigorous evaluation on the AADD-2025 benchmark demonstrates that ARMOR++ significantly outperforms existing agentic and non-agentic baselines across both low- and high-quality image regimes. Statistical analysis confirms a substantial gain in blind-target Attack Success Rate (ASR) over the state-of-the-art agentic baseline, with further performance advantages evidenced against non-agentic benchmarks and under robust defensive configurations. These findings highlight a significant residual reliability gap in current deepfake detector deployments and demonstrate the efficacy of agentic orchestration in identifying latent vulnerabilities.

Figures

Figures reproduced from arXiv: 2607.15246 by the authors.

Figure 1
Figure 1. ARMOR++ pipeline. Semantic analysis initializes the attack state, five Method Agents generate candidates, and deterministic critique, strategy, and [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Representative AADD-LQ comparison across eight methods. Each panel shows one adversarial example above its per-detector predictions, with green [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Representative AADD-HQ comparison using the layout of Fig. 2. Each panel shows one adversarial example above its per-detector predictions, with [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

70 extracted references · 6 linked inside Pith

  1. [1]

    Deepfakes and beyond: A survey of face manipulation and fake detection,

    R. Tolosana, R. Vera-Rodriguez, J. Fierrez, A. Morales, and J. Ortega- Garcia, “Deepfakes and beyond: A survey of face manipulation and fake detection,”Information Fusion, vol. 64, pp. 131–148, 2020

    2020

  2. [2]

    The creation and detection of deepfakes: A survey,

    Y . Mirsky and W. Lee, “The creation and detection of deepfakes: A survey,”ACM Computing Surveys, vol. 54, no. 1, pp. 1–41, 2021

    2021

  3. [3]

    Deepfake generation and detection: A benchmark and survey,

    G. Pei, J. Zhang, M. Hu, Z. Zhang, C. Wang, Y . Wu, G. Zhai, J. Yang, C. Shen, and D. Tao, “Deepfake generation and detection: A benchmark and survey,”ACM Computing Surveys, 2026, to appear

    2026

  4. [4]

    Evolving from single-modal to multi-modal facial deepfake detection: A survey,

    T. Liu, Y . Qian, Y . Chen, J. Zhang, Y . Wang, and H. Yu, “Evolving from single-modal to multi-modal facial deepfake detection: A survey,”arXiv preprint arXiv:2406.06965, 2024

    arXiv 2024

  5. [5]

    Threats and vulnerabilities in artificial intelligence and agentic ai models,

    P. Radanliev, O. Santos, and C. Maple, “Threats and vulnerabilities in artificial intelligence and agentic ai models,”Frontiers in Artificial Intelligence, vol. 9, p. 1731566, 2026

    2026

  6. [6]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2016, pp. 770–778

    2016

  7. [7]

    Densely connected convolutional networks,

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2017, pp. 4700–4708

    2017

  8. [8]

    EfficientNet: Rethinking model scaling for convolutional neural networks,

    M. Tan and Q. V . Le, “EfficientNet: Rethinking model scaling for convolutional neural networks,” inProc. Int. Conf. Machine Learning (ICML). PMLR, 2019, pp. 6105–6114

    2019

Show all 70 references
  1. [9]

    An image is worth 16x16 words: Trans- formers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Trans- formers for image recognition at scale,” inProc. Int. Conf. Learning Represent...

    2021

  2. [10]

    Swin Transformer: Hierarchical vision transformer using shifted win- dows,

    Z. Liu, Y . Lin, Y . Cao, H. Hu, Y . Wei, Z. Zhang, S. Lin, and B. Guo, “Swin Transformer: Hierarchical vision transformer using shifted win- dows,” inProc. IEEE/CVF Int. Conf. Computer Vision (ICCV). IEEE, 2021, pp. 10 012–10 022

    2021

  3. [11]

    Can pretrained face verification models distinguish true identity from deepfakes?

    P. C. Ng and K. N. Plataniotis, “Can pretrained face verification models distinguish true identity from deepfakes?” inProc. British Machine Vision Conf. Workshops (BMVCW). BMV A, 2024

    2024

  4. [12]

    FaceForensics++: Learning to detect manipulated facial images,

    A. R ¨ossler, D. Cozzolino, L. Verdoliva, C. Riess, J. Thies, and M. Nießner, “FaceForensics++: Learning to detect manipulated facial images,” inProc. IEEE/CVF Int. Conf. Computer Vision (ICCV). IEEE, 2019, pp. 1–11

    2019

  5. [13]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” inProc. Int. Conf. Learning Representations (ICLR), 2014

    2014

  6. [14]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” inProc. Int. Conf. Learning Representations (ICLR), 2015

    2015

  7. [15]

    Threat of adversarial attacks on deep learning in computer vision: A survey,

    N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,”IEEE Access, vol. 6, pp. 14 410–14 430, 2018

    2018

  8. [16]

    Revisiting transferable adversarial images: Systemization, evaluation, and new insights,

    Z. Zhao, H. Zhang, R. Li, R. Sicre, A. Araujo, C. Sima, Y . Li, J. Kautz, P. Molchanov, and J. M. Alvarez, “Revisiting transferable adversarial images: Systemization, evaluation, and new insights,”IEEE Trans. Pattern Anal. Mach. Intell., 2024

    2024

  9. [17]

    Boosting ad- versarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting ad- versarial attacks with momentum,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2018, pp. 9185–9193

    2018

  10. [18]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. Yuille, “Improving transferability of adversarial examples with input diversity,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2019, pp. 2730–2739

    2019

  11. [19]

    Evading defenses to trans- ferable adversarial examples by translation-invariant attacks,

    Y . Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to trans- ferable adversarial examples by translation-invariant attacks,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2019, pp. 4312–4321

    2019

  12. [20]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” inProc. ACM Asia Conf. Computer and Communications Security (ASIACCS). ACM, 2017, pp. 506–519

    2017

  13. [21]

    Square At- tack: A query-efficient black-box adversarial attack via random search,

    M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square At- tack: A query-efficient black-box adversarial attack via random search,” inProc. European Conf. Computer Vision (ECCV). Springer, 2020, pp. 484–501

    2020

  14. [22]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” inProc. Int. Conf. Machine Learning (ICML). PMLR, 2020, pp. 2206–2216

    2020

  15. [23]

    Adversarial agents: Black-box evasion attacks with reinforcement learning,

    K. Domico, J.-C. Noirot Ferrand, R. Sheatsley, E. Pauley, J. Hanna, and P. McDaniel, “Adversarial agents: Black-box evasion attacks with reinforcement learning,”arXiv preprint arXiv:2503.01734, 2025

    2025 arXiv

  16. [24]

    CNN- generated images are surprisingly easy to spot... for now,

    S.-Y . Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros, “CNN- generated images are surprisingly easy to spot... for now,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2020, pp. 8695–8704

    2020

  17. [25]

    Thinking in frequency: Face forgery detection by mining frequency-aware clues,

    Y . Qian, G. Yin, L. Sheng, Z. Chen, and J. Jing, “Thinking in frequency: Face forgery detection by mining frequency-aware clues,” inProc. European Conf. Computer Vision (ECCV). Springer, 2020, pp. 86– 103

    2020

  18. [26]

    Intriguing properties of vision transformers,

    M. Naseer, K. Ranasinghe, S. Khan, M. Hayat, F. Shahbaz Khan, and M.-H. Yang, “Intriguing properties of vision transformers,” inProc. Advances in Neural Information Processing Systems (NeurIPS), 2021

    2021

  19. [27]

    Towards transferable adversarial attacks on vision transformers,

    Z. Wei, J. Chen, M. Goldblum, Z. Wu, T. Goldstein, and Y .-G. Jiang, “Towards transferable adversarial attacks on vision transformers,” in Proc. AAAI Conf. Artificial Intelligence (AAAI). AAAI Press, 2022, pp. 2668–2676

    2022

  20. [28]

    Frequency domain model augmentation for adversarial attack,

    Y . Long, Q. Zhang, B. Zeng, L. Gao, X. Liu, J. Zhang, and J. Song, “Frequency domain model augmentation for adversarial attack,” inProc. European Conf. Computer Vision (ECCV). Springer, 2022, pp. 549– 566

    2022

  21. [29]

    Boosting adversarial transferability by block shuffle and rotation,

    K. Wang, X. He, W. Wang, and X. Wang, “Boosting adversarial transferability by block shuffle and rotation,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2024

    2024

  22. [30]

    ARMOR: Agentic reasoning for methods orchestration and reparameterization for robust adversarial attacks,

    G. J. R. Lee, C. Korgialas, D. J. X. Ho, P. C. Ng, X. Miao, and K. N. Plataniotis, “ARMOR: Agentic reasoning for methods orchestration and reparameterization for robust adversarial attacks,” inProc. IEEE Int. Conf. Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2026, ...

    2026

  23. [31]

    Agentic AI: Autonomous intelligence for complex goals — a comprehensive survey,

    D. B. Acharya, K. Kuppan, and B. Divya, “Agentic AI: Autonomous intelligence for complex goals — a comprehensive survey,”IEEE Access, vol. 13, pp. 1–32, 2025

    2025

  24. [32]

    Multi-agent collaboration mechanisms: A survey of LLMs,

    K.-T. Tran, D. Dao, M.-D. Nguyen, Q.-V . Pham, B. O’Sullivan, and H. D. Nguyen, “Multi-agent collaboration mechanisms: A survey of LLMs,”arXiv preprint arXiv:2501.06322, 2025

    2025 arXiv

  25. [33]

    Agentic AI: A com- prehensive survey of architectures, applications, and future directions,

    M. Abou Akar, F. Daoud, and J. Charafeddine, “Agentic AI: A com- prehensive survey of architectures, applications, and future directions,” Artificial Intelligence Review, 2025

    2025

  26. [34]

    Qwen2.5-VL technical report,

    S. Bai, K. Chen, X. Liu, J. Wang, W. Ge, S. Song, K. Dang, P. Wang, S. Wang, J. Tanget al., “Qwen2.5-VL technical report,”arXiv preprint arXiv:2502.13923, 2025

    2025 arXiv

  27. [35]

    Qwen3 technical report,

    A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lvet al., “Qwen3 technical report,”arXiv preprint arXiv:2505.09388, 2025

    2025 arXiv

  28. [36]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” inProc. IEEE Symp. Security and Privacy (S&P). IEEE, 2017, pp. 39–57

    2017

  29. [37]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in Proc. IEEE European Symp. Security and Privacy (EuroS&P). IEEE, 2016, pp. 372–387

    2016

  30. [38]

    Spatially transformed adversarial examples,

    C. Xiao, B. Li, J.-Y . Zhu, W. He, M. Liu, and D. Song, “Spatially transformed adversarial examples,” inProc. Int. Conf. Learning Repre- sentations (ICLR), 2018

    2018

  31. [39]

    Adversarial attacks on deepfake detec- tors: A challenge in the era of AI-generated media (AADD-2025),

    S. Battiato, M. Casu, F. Guarnera, L. Guarnera, G. Puglisi, O. Pontorno, C. V . Ragaglia, and Z. Akhtar, “Adversarial attacks on deepfake detec- tors: A challenge in the era of AI-generated media (AADD-2025),” in Proc. ACM Int. Conf. Multimedia (ACM MM). ACM, 2025

    2025

  32. [40]

    The deepfake detection challenge (DFDC) preview dataset,

    B. Dolhansky, R. Howes, B. Pflaum, N. Baram, and C. C. Ferrer, “The deepfake detection challenge (DFDC) preview dataset,”arXiv preprint arXiv:1910.08854, 2019

    1910 arXiv

  33. [41]

    Multi- attentional deepfake detection,

    H. Zhao, W. Zhou, D. Chen, T. Wei, W. Zhang, and N. Yu, “Multi- attentional deepfake detection,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2021, pp. 2185–2194

    2021

  34. [42]

    Detecting deepfakes with self-blended images,

    K. Shiohara and T. Yamasaki, “Detecting deepfakes with self-blended images,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recog- nition (CVPR). IEEE, 2022, pp. 18 720–18 729

    2022

  35. [43]

    DeepfakeBench: A comprehensive benchmark of deepfake detection,

    Z. Yan, Y . Zhang, X. Yuan, S. Lyu, and B. Wu, “DeepfakeBench: A comprehensive benchmark of deepfake detection,” inProc. Advances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  36. [44]

    Zero-shot detection of AI-generated images,

    D. Cozzolino, G. Poggi, M. Nießner, and L. Verdoliva, “Zero-shot detection of AI-generated images,” inProc. European Conf. Computer Vision (ECCV). Springer, 2024. IEEE TRANSACTIONS ON RELIABILITY , VOL. XX, NO. XX, MONTH 2026 15

    2024

  37. [45]

    Evading deepfake-image detectors with white- and black-box attacks,

    N. Carlini and H. Farid, “Evading deepfake-image detectors with white- and black-box attacks,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition Workshops (CVPRW). IEEE, 2020, pp. 658–659

    2020

  38. [46]

    Adversarial perturbations fool deepfake detec- tors,

    A. Gandhi and S. Jain, “Adversarial perturbations fool deepfake detec- tors,” inProc. Int. Joint Conf. Neural Networks (IJCNN). IEEE, 2020, pp. 1–8

    2020

  39. [47]

    Adversarial attack on deepfake detection using RL-based texture patches,

    S. L. Fernandes and S. K. Jha, “Adversarial attack on deepfake detection using RL-based texture patches,” inProc. European Conf. Computer Vision Workshops (ECCVW). Springer, 2020

    2020

  40. [48]

    2D-Malafide: Adversarial attacks against face deepfake detection systems,

    C. Galdi, M. Panariello, M. Todisco, and N. Evans, “2D-Malafide: Adversarial attacks against face deepfake detection systems,” inProc. Int. Conf. of the Biometrics Special Interest Group (BIOSIG). IEEE, 2024

    2024

  41. [49]

    MIG-COW: Transferable adversarial attacks on deepfake detectors via gradient decomposition,

    W. Seo, J. Baek, Y . Jung, and S. Park, “MIG-COW: Transferable adversarial attacks on deepfake detectors via gradient decomposition,” inProc. ACM Int. Conf. Multimedia (ACM MM). ACM, 2025

    2025

  42. [50]

    MS-GAGA: Metric-selective guided adversarial generation attack,

    D. J. X. Ho, G. J. R. Lee, N. Shrivastava, H. Abichandani, P. C. Ng, and X. Miao, “MS-GAGA: Metric-selective guided adversarial generation attack,” inProc. British Machine Vision Conf. Workshops (BMVCW). BMV A, 2025

    2025

  43. [51]

    Delving into transferable adversarial examples and black-box attacks,

    Y . Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” inProc. Int. Conf. Learning Representations (ICLR), 2017

    2017

  44. [52]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” in Proc. Int. Conf. Learning Representations (ICLR), 2020

    2020

  45. [53]

    Simple black-box adversarial attacks,

    C. Guo, J. R. Gardner, Y . You, A. G. Wilson, and K. Q. Weinberger, “Simple black-box adversarial attacks,” inProc. Int. Conf. Machine Learning (ICML). PMLR, 2019, pp. 2484–2493

    2019

  46. [54]

    Efficient black-box adversarial attacks via bayesian optimization guided by a function prior,

    S. Cheng, Y . Miao, Y . Dong, X. Yang, X.-S. Gao, and J. Zhu, “Efficient black-box adversarial attacks via bayesian optimization guided by a function prior,” inProc. Int. Conf. Machine Learning (ICML). PMLR, 2024

    2024

  47. [55]

    Feature importance-aware transferable adversarial attacks,

    Z. Wang, H. Guo, Z. Zhang, W. Liu, Z. Qin, and K. Ren, “Feature importance-aware transferable adversarial attacks,” inProc. IEEE/CVF Int. Conf. Computer Vision (ICCV). IEEE, 2021, pp. 7639–7648

    2021

  48. [56]

    AnyAttack: Towards large-scale self-supervised adversarial attacks on vision-language models,

    J. Zhang, J. Ye, X. Ma, Y . Li, Y . Yang, Y . Chen, J. Sang, and D.- Y . Yeung, “AnyAttack: Towards large-scale self-supervised adversarial attacks on vision-language models,” inProc. IEEE/CVF Conf. Computer Vision and Pattern Recognition (CVPR). IEEE, 2025

    2025

  49. [57]

    Semantic-aligned adversarial evolution triangle for high- transferability vision-language attack,

    X. Jia, S. Gao, Q. Guo, S. Qin, K. Ma, Y . Huang, Y . Liu, I. W. Tsang, and X. Cao, “Semantic-aligned adversarial evolution triangle for high- transferability vision-language attack,”IEEE Trans. Pattern Anal. Mach. Intell., 2025

    2025

  50. [58]

    Adversarial attacks against closed-source MLLMs via feature optimal alignment,

    X. Jia, S. Gao, S. Qin, T. Pang, C. Du, Y . Huang, X. Li, Y . Li, B. Li, and Y . Liu, “Adversarial attacks against closed-source MLLMs via feature optimal alignment,” inProc. Advances in Neural Information Processing Systems (NeurIPS), 2025

    2025

  51. [59]

    AutoGen: Enabling next-gen LLM applications via multi- agent conversation,

    Q. Wu, G. Bansal, J. Zhang, Y . Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liu, A. H. Awadallah, R. W. White, D. Burger, and C. Wang, “AutoGen: Enabling next-gen LLM applications via multi- agent conversation,” inProc. Conf. on Language Modeling (COLM), 2024

    2024

  52. [60]

    Generative agents: Interactive simulacra of human behavior,

    J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, “Generative agents: Interactive simulacra of human behavior,” inProc. ACM Symp. User Interface Software and Technology (UIST). ACM, 2023, pp. 1–22

    2023

  53. [61]

    The rise and potential of large language model based agents: A survey,

    Z. Xi, W. Chen, X. Guo, W. He, Y . Ding, B. Hong, M. Zhang, J. Wang, S. Jin, E. Zhouet al., “The rise and potential of large language model based agents: A survey,”Science China Information Sciences, 2025

    2025

  54. [62]

    Large language models as optimizers,

    C. Yang, X. Wang, Y . Lu, H. Liu, Q. V . Le, D. Zhou, and X. Chen, “Large language models as optimizers,” inProc. Int. Conf. Learning Representations (ICLR), 2024

    2024

  55. [63]

    AgentHPO: Large language model agent for hyper-parameter optimization,

    S. Liu, C. Gao, and Y . Li, “AgentHPO: Large language model agent for hyper-parameter optimization,” inProc. Conf. on Parsimony and Learning (CPAL). PMLR, 2025

    2025

  56. [64]

    AutoDA: Automated decision-based iterative adversarial attacks,

    Q.-A. Fu, Y . Dong, H. Su, J. Zhu, and C. Zhang, “AutoDA: Automated decision-based iterative adversarial attacks,” inProc. USENIX Security Symp.USENIX Association, 2022

    2022

  57. [65]

    L-AutoDA: Large language models for automatically evolving decision-based adversarial attacks,

    P. Guo, F. Liu, X. Lin, Q. Zhao, and Q. Zhang, “L-AutoDA: Large language models for automatically evolving decision-based adversarial attacks,” inProc. Genetic and Evolutionary Computation Conf. Com- panion (GECCO). ACM, 2024

    2024

  58. [66]

    Red-teaming LLM multi-agent systems via communication attacks,

    P. He, Y . Lin, S. Dong, H. Xu, Y . Xing, and H. Liu, “Red-teaming LLM multi-agent systems via communication attacks,” inProc. Annual Meeting of the Association for Computational Linguistics (ACL), 2025

    2025

  59. [67]

    Image quality assessment: From error visibility to structural similarity,

    Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli, “Image quality assessment: From error visibility to structural similarity,”IEEE Trans. Image Processing, vol. 13, no. 4, pp. 600–612, 2004

    2004

  60. [68]

    Probable inference, the law of succession, and statistical inference,

    E. B. Wilson, “Probable inference, the law of succession, and statistical inference,”Journal of the American Statistical Association, vol. 22, no. 158, pp. 209–212, 1927

    1927

  61. [69]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inProc. Int. Conf. Learning Representations (ICLR), 2018

    2018

  62. [70]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” inProc. Int. Conf. Learning Represen- tations (ICLR), 2018

    2018

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.