Pith. sign in

REVIEW 4 major objections 5 minor 66 references

TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors

T0 review · 4 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read TIGA claims that a black-box AIGC detector can be evaded by injecting adversarial guidance directly into a frozen DDIM sampling trajectory, generating detector-evasive images from random noise alone, with the detector queried only through i

desk verdict Novel, well-engineered trajectory attack; the headline 100% ASR is measured only on detectors fine-tuned on the same generator, so the black-box general-claim is under-supported. read the letter →

arxiv 2607.25894 v1 pith:3QEOWSGQ submitted 2026-07-28 cs.CV

Xia Du , Zhuosen Bao , Zheng Lin , Jizhe Zhou , Jiawei Lian , Chi-man Pun , Jun Luo , Wei Ni
show 1 more author
Symeon Chatzinotas
This is my paper · ORCID
classification cs.CV
keywords adversarialattackAIGCdetectionblack-boxdiffusionmodelsDDIMtrajectorysurrogate-guidedsearchzero-orderoptimizationimageforensics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TIGA tries to establish that an attacker can make a frozen diffusion model generate images a black-box AI-content detector labels real, starting from random noise and a text/mask condition, with no source image and no retraining. The adversarial signal is steered into the intermediate latent states of a single DDIM denoising trajectory, so evasiveness is a property of the sampling process itself rather than a perturbation pasted onto a finished image. The method combines white-box surrogate detectors (which supply a transferable search direction) with black-box confidence queries (which refine that direction via symmetric finite-difference probing), then injects the accumulated momentum into the trajectory scaled by the diffusion noise schedule and filtered in the frequency domain. If true, this would make a practical black-box evasion scenario much easier: attackers need only queries to the detector, and the products remain natural-looking generated faces instead of noisy adversarial images.

What carries the argument

The load-bearing object is the DDIM denoising trajectory: the chain of latent states z_T to z_0 produced by a frozen diffusion model. Two points on that chain do the work: the predicted clean latent, where both surrogate and black-box detectors can be evaluated, and the propagated state z_{t-1}, where the adversarial update is actually injected. Around this chain the method builds three coupled pieces: a surrogate-guided prior (ensemble gradients back-propagated to the latent and normalized, refreshed periodically), a surrogate-guided directional search (anisotropic probing: directions are blends of the prior with orthogonal random components, scored by symmetric finite differences of the bl

What would settle it

Run TIGA against four detector architectures fine-tuned exclusively on images from a different diffusion model family, while generating the attacked faces with the original backbone; if attack success drops noticeably below 100% or the quality advantage over post-hoc baselines disappears, the same-backbone training set is what carries the result.

Watch

Extended reading notes

Core claim

The central claim is that detector evasion can be moved inside the generative process. TIGA runs entirely within the DDIM sampling loop: at each step it predicts the clean latent, computes a normalized gradient direction from a small ensemble of white-box surrogate detectors, draws probing directions from a distribution biased toward that surrogate prior, scores each probe with symmetric finite-difference queries to the black-box detector's confidence output, and accumulates the response-weighted directions into a momentum estimate. That estimate is injected into the propagated latent state z_{t-1} with a strength tied to the sampler's stochasticity level, then reshaped in the frequency doma

Load-bearing premise

The load-bearing premise is in the evaluation setup rather than the algorithm: the four black-box targets are fine-tuned on 12,000 images generated by the same diffusion backbone that TIGA attacks, so the surrogate gradients and black-box probe responses are aligned with the generator's own forensic fingerprint; against detectors trained on other generators, the reported 100% success may not transfer.

Editorial extensions

If this is right

  • A deployed detector that exposes only confidence scores becomes evadable without access to weights, gradients, source images, or diffusion-model retraining—a wider practical threat model for AIGC forensics.
  • Because the adversarial signal is generated rather than added, the standard epsilon-budget trade-off between attack strength and visible artifacts is replaced by schedule-based injection, which the paper shows is higher on success and lower on visible distortion than post-hoc baselines.
  • The evasiveness transfers to detectors never used during optimization, especially content-level forensic detectors, so the attack is not just overfitting to the surrogate or target pool.
  • Evasiveness survives Gaussian blur, JPEG compression, and resizing much better than post-hoc attacks, meaning the images keep fooling detectors after realistic platform-side transformations.
  • The three modules are complementary: removing the black-box search hurts success and quality most, removing the surrogate prior hurts cross-target reliability, removing momentum hurts success, and removing frequency reshaping hurts visual quality.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the strongest result is measured against targets fine-tuned on images from the same diffusion backbone that generates the attacked images, so the honest test of the method's claim is a version where detectors are trained on images from a different generator; the surrogate prior and query estimates would then face a genuine distribution shift.
  • Editorial inference: the surrogate-guided anisotropic search is a general recipe for black-box control of latent generative models—the same query-plus-prior estimator could steer diffusion models toward other queryable objectives such as avoiding safety filters or satisfying style constraints.
  • Editorial inference: the mechanism itself suggests a defense—if trajectory injections tend to imprint a schedule-aligned, low-frequency signature, detectors could be trained on TIGA-style trajectories or on the difference between injected and clean latents to shrink the loophole.
  • Editorial inference: the paper fixes the query interval at every step and a population of ten probes; an adaptive schedule that concentrated queries at high-noise steps, where injection is strongest, could cut the query budget while retaining most of the success rate.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes TIGA, a training-free, source-image-free framework for evading black-box AIGC detectors by steering a DDIM sampling trajectory. At each denoising step, TIGA aggregates gradients from white-box surrogate detectors into a prior direction (SGP), performs an anisotropic directional search with symmetric finite-difference queries to the black-box target (SGDS), and injects the resulting momentum into the latent trajectory with schedule-aware scaling and frequency-domain reshaping (SATI). The authors evaluate on four REDS detectors fine-tuned on their Collaborative Diffusion backbone, reporting 100% ASR and the lowest BRISQUE in every column of Table I, improved transfer to five unseen detectors (Table II), robustness to post-processing (Table III), and component ablations (Table IV).

Significance. If the claims hold, TIGA is a meaningful contribution: it is one of the first methods to combine surrogate-gradient priors with query-based directional search inside a single frozen diffusion sampling loop, avoiding both post-hoc pixel perturbations and detector-aware retraining. The query budget is reasonable (N=10 probes per step, symmetric differences, S=50 steps ≈ 1000 queries), and the framework is modular, with ablations that isolate the roles of the prior, the search, momentum, and frequency shaping. The conceptual idea of injecting adversarial guidance at the trajectory level is interesting and potentially useful for understanding robustness of generative-model forensics. However, the experimental evaluation as presented is not yet sufficient to substantiate the broad black-box claim, because the main targets are all fine-tuned on the same generator used to produce the test images, and the surrogate set is drawn from the same fine-tuned pool.

major comments (4)
  1. [Section IV-A and Table I] The headline 100% ASR is obtained only on the four REDS targets, each fine-tuned on 12,000 images 'synthesized by our diffusion backbone,' with test images from that same backbone. The surrogates for each target are the other three REDS models, also fine-tuned on the same backbone. This creates a same-generator, near-white-box condition: the prior is derived from detectors that share the exact generator distribution with the target, and the query-based search is never tested against a strong detector that is independent of the generator. The transfer results in Table II are not an adequate substitute: CNN and DIRE already classify more than 77% and 90% of clean images as real, and PGC, the only strong transfer detector, remains below 50% evasion. The central claim that TIGA evades black-box AIGC detectors under realistic mismatch therefore is not established. Please add experiments with
  2. [Table I and Section IV-B] The comparison to baselines is inequitable in an important way. Baselines are post-hoc pixel-space perturbations constrained to a maximum ℓ∞ budget of 16/255, whereas TIGA performs an unconstrained trajectory injection that, as the authors acknowledge in Section IV-B2, can produce 'slightly larger coarse, low-frequency changes (e.g., hair color or skin tone).' Thus the Pareto dominance in Table I may reflect unequal perturbation freedom rather than intrinsic superiority. BRISQUE is a no-reference quality metric and does not control content drift from the original generation. I ask for a fairer comparison: either impose a comparable trajectory-level budget on TIGA (e.g., bound the accumulated injection in latent or pixel space), or include reference-based quality metrics (LPIPS, FID, or pixel fidelity to the clean sample) and a side-by-side analysis of content drift, so that the claimed '
  3. [Tables I–IV and Fig. 4] All reported results come from a single fixed seed and a single run. The method is stochastic in several places (DDIM η=1, random anisotropic probing directions, random initial noise), and the paper does not provide error bars, confidence intervals, or multiple-seed statistics. The margins in Table I (e.g., 100.00% vs. 99.61% ASR, and BRISQUE differences of ~4 points) could be within run-to-run variance. Please report mean and standard deviation over at least 5 independent seeds for the main tables and the hyperparameter sweeps, and indicate whether the observed differences are statistically reliable.
  4. [Section IV-B3 and Table II] The transfer-evasion evidence is weaker than the text suggests. On CNN and DIRE, the clean evasion rates are already 77.86% and 90.57%, so TIGA's near-100% rates are close to a ceiling and do not demonstrate transfer of a newly induced signal. On PGC, the only transfer detector with a meaningful clean detection rate (4.29% clean evasion), TIGA reaches 22.17–49.06% depending on the surrogate set, which is substantial but far below the 100% reported on REDS, and still means the majority of TIGA images are detected. This is consistent with the same-generator concern: the transfer results show partial generalization, not the strong black-box evasion claimed in the abstract. Please contextualize these numbers as incomplete transfer, and, if possible, report transfer as a function of the target detector's clean accuracy.
minor comments (5)
  1. [Section I] Typo: 'mifigate' should be 'mitigate' in the introduction.
  2. [Section III-D / Algorithm 1] Eq. (10) defines a step-dependent decay β_i = β_momentum(1 − i/(S−1)), but Algorithm 1 and Section IV-A refer only to a constant 'momentum decay β_momentum = 0.8'. Please make the relationship between β_i and the constant explicit in the algorithm listing.
  3. [Fig. 3 caption] The ordering of labels in the caption ('PGD FGSM SimBA Square BruSLe Source Ours R2BA') does not match the typical left-to-right ordering of the figure panels; please align the caption with the image layout.
  4. [Table II] Minor formatting: 'R 2BA' appears with an irregular space in two columns; unify with the baseline name used in Table I.
  5. [General] No code or data availability statement is provided. Given the reliance on a specific Collaborative Diffusion backbone and a custom fine-tuning protocol, releasing code and detector checkpoints would materially aid reproducibility.

Circularity Check

0 steps flagged · score 1.0 of 10

No derivation-level circularity; the main caveat is that the REDS evaluation is same-generator, which is an evaluation-domain risk rather than a fitted-input prediction.

full rationale

TIGA's derivation chain is self-contained. Eq. (3) defines the attack objective as maximizing the black-box real-probability D_b(x0); Eq. (5) computes a surrogate-gradient prior; Eqs. (7)-(9) estimate the target's directional response via symmetric finite-difference queries; Eqs. (10)-(13) accumulate, scale, reshape, and inject the update. The target detector contributes nothing to the method except through the confidence queries that the attack is explicitly designed to use, so the 100% ASR reported in Table I is the optimized objective, not a fitted parameter renamed as a prediction. The transfer experiments in Table II are independently grounded because CNN, DIRE, Uni, Effort, and PGC are never used during optimization, and the improvement on the strongest unseen detector (PGC: 4.29% clean to 22.17-49.06%) is a genuine out-of-pool measurement. The main weakness is evaluation-domain rather than circular: Section IV-A fine-tunes all four REDS detectors on 12,000 images synthesized by the same Collaborative Diffusion backbone used to generate test images, so the headline results characterize a same-generator regime and may not transfer to off-the-shelf detectors trained on other generators. The paper itself acknowledges this scope in Section V, deferring 'broadening the surrogate/detector pools' to future work. No load-bearing self-citation or imported uniqueness theorem appears, and no step reduces, by construction, to its own inputs.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

TIGA introduces no new physical or conceptual entities; its free parameters are the seven hyperparameters tuned on the evaluation benchmark. The load-bearing assumptions are the standard DDIM sampler, the validity of preview-based queries, the manifold-preservation of schedule-aware injection, and the effectiveness of surrogate-guided anisotropic search. No novel particle, force, or conserved quantity is postulated. The main hidden cost is that all REDS detectors are trained by the authors on the same generator, which is an experimental-design assumption rather than a deductive axiom.

free parameters (7)
  • lambda_0 (guidance strength) = 0.35
    Scales the trajectory injection magnitude in Eq. (11); selected from the Fig. 4 sweep where ASR saturates before BRISQUE degrades sharply.
  • beta_guide (surrogate-prior fusion) = 0.5
    Controls how strongly the anisotropic probing distribution is biased toward the surrogate prior in Eq. (7); tuned on the same REDS benchmark.
  • N (probing directions) = 10
    Number of direction samples per guided step in Eq. (9); sweep shows diminishing returns after N=10.
  • rho (finite-difference radius) = 0.05
    Latent-space probing radius for symmetric finite differences in Eq. (8).
  • tau_q (query interval) = 1
    Queries black-box target at every denoising step; larger interval trades attack strength for fewer queries.
  • beta_momentum = 0.8
    Momentum decay in Eq. (10); stabilizes direction estimates across steps.
  • tau_g (prior refresh interval) = 5
    Recomputes the surrogate prior direction every 5 steps to save back-propagation cost.
assumptions (6)
  • standard math The DDIM update equations, Eqs. (1)-(2), are a valid description of the frozen sampler with the given cumulative noise coefficients alpha_t and stochasticity sigma_t.
    The paper uses the standard DDIM formulation without proving it; this is standard sampler mathematics.
  • domain assumption The black-box detector only exposes a scalar real-probability D_b(x), and queries to it are noise-free and unlimited in number.
    Threat model in Section III-A; real deployed APIs may have rate limits, noise, or non-smooth outputs.
  • domain assumption The decoded preview D(z_hat0) at each step approximates the final synthesized image well enough that detector responses on the preview are a useful guide for the final image.
    Invoked in Section III-B before Eq. (4); if the preview diverges from the final image, the per-step queries are misdirected.
  • domain assumption Injecting into z_{t-1} at magnitude sigma_t*lambda_0 and clipping to [-4,4] keeps the sample on the natural-image manifold and preserves semantics.
    Stated in Section III-D; the paper does not prove this, only argues it from the noise-schedule design.
  • ad hoc to paper Anisotropic search around the surrogate prior (Eqs. (6)-(7)) reduces estimation variance without losing the directions that are useful to the target.
    The central efficiency claim of SGDS is plausible and supported by ablations but is not derived; it is assumed by construction.
  • ad hoc to paper Frequency-domain low-pass reshaping in Eq. (12) suppresses forensic spectral traces without weakening the attack.
    The ablation w/o Freq. supports it empirically, but the mechanistic link between low-pass reshaping and detector evasion is not formally established.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors." pith.science (2026). https://pith.science/paper/3QEOWSGQ

@misc{pith2026260725894,
  author       = {Pith},
  title        = {Pith review of: TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3QEOWSGQ}},
  note         = {Machine review of arXiv:2607.25894}
}
read the original abstract

Recent diffusion models have achieved remarkable realism in facial image synthesis, posing growing challenges to artificial intelligence-generated content (AIGC) forensic detectors.Existing evasion methods typically perturb pre-generated images or require detector-aware training, which may introduce visible or statistical artifacts and limit applicability when the diffusion model must remain frozen and the target detector is accessible only through black-box queries. We propose Trajectory-Injected Generative Attack (TIGA), a source-image-free and training free framework that generates detector-evasive images within a single diffusion sampling trajectory. TIGA steers the latent Denoising Diffusion Implicit Model (DDIM) trajectory so that adversarial properties emerge during generation rather than being added afterward. TIGA first aggregates gradients from multiple white-box surrogate detectors to form a transferable, sign-aware prior, and then performs anisotropic directional search with symmetric finite-difference queries to estimate the black-box target response. The estimated directions are stabilized by decayed momentum and injected according to the DDIM noise schedule, with frequency-domain reshaping to suppress high frequency artifacts. Experiments on surrogate and unseen specialized forensic detectors show that TIGA achieves strong blackbox attack performance, transferability, and high robustness under common post-processing operations without source images or diffusion-model retraining, while preserving high perceptual quality.

Figures

Figures reproduced from arXiv: 2607.25894 by the authors.

Figure 1
Figure 1. Conceptual principle of TIGA. Standard DDIM sampling generates visually realistic AIGC images that can still be [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overall framework of TIGA. Given the shared initial noise [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Qualitative comparison of adversarial faces produced by each attack from the same DDIM-generated source image [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Sensitivity of (a) ASR and (b) BRISQUE to each hyperparameter ( [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Qualitative module ablation. Each row shows the same (mask, text) condition attacked with one component removed, [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

66 extracted references · 4 linked inside Pith

  1. [1]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Advances in neural information processing systems, vol. 33, pp. 6840– 6851, 2020

    2020

  2. [2]

    High- resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High- resolution image synthesis with latent diffusion models,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10 684–10 695

    2022

  3. [3]

    Collaborative diffusion for multi-modal face generation and editing,

    Z. Huang, K. C. Chan, Y . Jiang, and Z. Liu, “Collaborative diffusion for multi-modal face generation and editing,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 6080–6090

    2023

  4. [4]

    Defensive adversarial captcha: A semantics- driven framework for natural adversarial example generation,

    X. Du, X. Liu, J. Zhou, Z. Lin, C.-m. Pun, C. Wu, T. Li, Z. Chen, W. Ni, and J. Luo, “Defensive adversarial captcha: A semantics- driven framework for natural adversarial example generation,”IEEE Transactions on Dependable and Secure Computing, 2025

    2025

  5. [5]

    State-aware perturbation optimization for robust deep reinforcement learning,

    Z. Zhang, T. Duan, Z. Lin, D. Huang, Z. Fang, Z. Sun, L. Xiong, H. Liang, H. Cui, and Y . Cui, “State-aware perturbation optimization for robust deep reinforcement learning,”IEEE Trans. Mobile Comput., 2025

    2025

  6. [6]

    LLM-Driven Stationarity-Aware Expert Demonstrations for Multi-Agent Reinforcement Learning in Mobile Systems,

    T. Duan, Z. Zhang, Z. Lin, S. Guo, X. Guan, G. Wu, Z. Fang, H. Meng, X. Du, J.-Z. Zhouet al., “LLM-Driven Stationarity-Aware Expert Demonstrations for Multi-Agent Reinforcement Learning in Mobile Systems,”arXiv preprint arXiv:2511.19368, 2025

    arXiv 2025

  7. [7]

    A deep learning approach to universal image manipulation detection using a new convolutional layer,

    B. Bayar and M. C. Stamm, “A deep learning approach to universal image manipulation detection using a new convolutional layer,” in Proceedings of the 4th ACM workshop on information hiding and multimedia security, 2016, pp. 5–10

    2016

  8. [8]

    Automated Federated Pipeline for Parameter-Efficient Fine-Tuning of Large Lan- guage Models,

    Z. Fang, Z. Lin, Z. Chen, X. Chen, Y . Gao, and Y . Fang, “Automated Federated Pipeline for Parameter-Efficient Fine-Tuning of Large Lan- guage Models,”IEEE Trans. Mobile Comput., 2025

    2025

Show all 66 references
  1. [9]

    CNN- generated images are surprisingly easy to spot... for now,

    S.-Y . Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros, “CNN- generated images are surprisingly easy to spot... for now,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 8695–8704

    2020

  2. [10]

    SatSense: Multi-Satellite Collaborative Framework for Spectrum Sensing,

    H. Yuan, Z. Chen, Z. Lin, J. Peng, Z. Fang, Y . Zhong, Z. Song, and Y . Gao, “SatSense: Multi-Satellite Collaborative Framework for Spectrum Sensing,”IEEE Trans. Cogn. Commun. Netw., 2025

    2025

  3. [11]

    SUMS: Sniffing Unknown Multiband Signals under Low Sampling Rates,

    J. Peng, Z. Chen, Z. Lin, H. Yuan, Z. Fang, L. Bao, Z. Song, Y . Li, J. Ren, and Y . Gao, “SUMS: Sniffing Unknown Multiband Signals under Low Sampling Rates,”IEEE Trans. Mobile Comput., 2024

    2024

  4. [12]

    Efficient Parallel Split Learning over Resource-Constrained Wireless Edge Networks,

    Z. Lin, G. Zhu, Y . Deng, X. Chen, Y . Gao, K. Huang, and Y . Fang, “Efficient Parallel Split Learning over Resource-Constrained Wireless Edge Networks,”IEEE Trans. Mobile Comput., vol. 23, no. 10, pp. 9224–9239, 2024

    2024

  5. [13]

    Towards universal fake image detec- tors that generalize across generative models,

    U. Ojha, Y . Li, and Y . J. Lee, “Towards universal fake image detec- tors that generalize across generative models,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 24 480–24 489

    2023

  6. [14]

    Unionformer: Unified-learning transformer with multi-view representation for im- age manipulation detection and localization,

    S. Li, W. Ma, J. Guo, S. Xu, B. Li, and X. Zhang, “Unionformer: Unified-learning transformer with multi-view representation for im- age manipulation detection and localization,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2024, pp. 12 5...

    2024

  7. [15]

    Gapsl: A gradient-aligned parallel split learning on heterogeneous data,

    Z. Lin, O. Aouedi, W. Ni, S. Chatzinotas, and X. Chen, “Gapsl: A gradient-aligned parallel split learning on heterogeneous data,”arXiv preprint arXiv:2603.18540, 2026

    2026

  8. [16]

    Hfedmoe: Resource-aware heterogeneous federated learning with mixture-of-experts,

    Z. Fang, Z. Lin, S. Hu, Y . Ma, Y . Tao, Y . Deng, X. Chen, and Y . Fang, “Hfedmoe: Resource-aware heterogeneous federated learning with mixture-of-experts,”arXiv preprint arXiv:2601.00583, 2026

    2026

  9. [17]

    Thinking in frequency: Face forgery detection by mining frequency-aware clues,

    Y . Qian, G. Yin, L. Sheng, Z. Chen, and J. Shao, “Thinking in frequency: Face forgery detection by mining frequency-aware clues,” inEuropean conference on computer vision. Springer, 2020, pp. 86–103

    2020

  10. [18]

    Rethinking the up- sampling operations in CNN-based generative network for generalizable 13 deepfake detection,

    C. Tan, Y . Zhao, S. Wei, G. Gu, P. Liu, and Y . Wei, “Rethinking the up- sampling operations in CNN-based generative network for generalizable 13 deepfake detection,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2024, pp. 28 130–28 139

    2024

  11. [19]

    Dire for diffusion-generated image detection,

    Z. Wang, J. Bao, W. Zhou, W. Wang, H. Hu, H. Chen, and H. Li, “Dire for diffusion-generated image detection,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 22 445–22 455

    2023

  12. [20]

    LaRE 2: Latent reconstruction error based method for diffusion-generated image detection,

    Y . Luo, J. Du, K. Yan, and S. Ding, “LaRE 2: Latent reconstruction error based method for diffusion-generated image detection,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, 2024, pp. 17 006–17 015

    2024

  13. [21]

    Evading Deepfake-image detectors with White- and Black-Box Attacks,

    N. Carlini and H. Farid, “Evading Deepfake-image detectors with White- and Black-Box Attacks,”arXiv preprint arXiv:2004.00622, 2020

    2004 arXiv

  14. [22]

    Vulnerabilities in AI-generated image detection: The challenge of adversarial attacks,

    Y . Diao, N. Zhai, C. Miao, Z. Yu, X. Wei, X. Yang, and M. Wang, “Vulnerabilities in AI-generated image detection: The challenge of adversarial attacks,”IEEE Transactions on Multimedia, pp. 1–13, 2026

    2026

  15. [23]

    Take fake as real: Realistic-like robust black-box adversarial attack to evade AIGC detection,

    C. Xie, D. Ye, Y . Zhang, Y . Shang, L. Tang, Y . Lv, J. Deng, and J. Song, “Take fake as real: Realistic-like robust black-box adversarial attack to evade AIGC detection,”IEEE Transactions on Circuits and Systems for Video Technology, 2025

    2025

  16. [24]

    StealthDif- fusion: Towards evading diffusion forensic detection through diffusion model,

    Z. Zhou, K. Sun, Z. Chen, H. Kuang, X. Sun, and R. Ji, “StealthDif- fusion: Towards evading diffusion forensic detection through diffusion model,” inProceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 3627–3636

    2024

  17. [25]

    Adversarial diffusion model: Generating high quality and undetectable images from scratch,

    H. Wang, S. Li, Z. Qian, and X. Zhang, “Adversarial diffusion model: Generating high quality and undetectable images from scratch,”IEEE Transactions on Information Forensics and Security, vol. 21, pp. 1725– 1736, 2026

    2026

  18. [26]

    Progressive growing of GANs for improved quality, stability, and variation,

    T. Karras, T. Aila, S. Laine, and J. Lehtinen, “Progressive growing of GANs for improved quality, stability, and variation,”arXiv preprint arXiv:1710.10196, 2017

    2017 arXiv

  19. [27]

    A style-based generator architecture for generative adversarial networks,

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4401– 4410

    2019

  20. [28]

    Channel Power Gain Estimation for Terahertz Vehicle-to-Infrastructure Networks,

    Z. Lin, L. Wang, J. Ding, B. Tan, and S. Jin, “Channel Power Gain Estimation for Terahertz Vehicle-to-Infrastructure Networks,”IEEE Commun. Lett., vol. 27, no. 1, pp. 155–159, 2022

    2022

  21. [29]

    Pushing Large Language Models to the 6G Edge: Vision, Challenges, and Opportunities,

    Z. Lin, G. Qu, Q. Chen, X. Chen, Z. Chen, and K. Huang, “Pushing Large Language Models to the 6G Edge: Vision, Challenges, and Opportunities,”IEEE Communication Magazine, 2025

    2025

  22. [30]

    CAMD: Context- aware masked distillation for general self-supervised facial representa- tion pre-training,

    S. Wang, S. Chen, D.-H. Wang, Y . Hua, and Y . Yan, “CAMD: Context- aware masked distillation for general self-supervised facial representa- tion pre-training,”IEEE Transactions on Circuits and Systems for Video Technology, 2025

    2025

  23. [31]

    Mobile edge intelligence for large language models: A contemporary survey,

    G. Qu, Q. Chen, W. Wei, Z. Lin, X. Chen, and K. Huang, “Mobile edge intelligence for large language models: A contemporary survey,”IEEE Communications Surveys & Tutorials, 2025

    2025

  24. [32]

    HASFL: Heterogeneity- aware Split Federated Learning over Edge Computing Systems,

    Z. Lin, Z. Chen, X. Chen, W. Ni, and Y . Gao, “HASFL: Heterogeneity- aware Split Federated Learning over Edge Computing Systems,”IEEE Trans. Mobile Comput., 2026

    2026

  25. [33]

    Global texture enhancement for fake face detection in the wild,

    Z. Liu, X. Qi, and P. H. Torr, “Global texture enhancement for fake face detection in the wild,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 8060–8069

    2020

  26. [34]

    Image manipulation detection by multi-view multi-scale supervision,

    X. Chen, C. Dong, J. Ji, J. Cao, and X. Li, “Image manipulation detection by multi-view multi-scale supervision,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 14 185–14 193

    2021

  27. [35]

    Dual frequency branch frame- work with reconstructed sliding windows attention for AI-generated image detection,

    J. Yan, Z. Li, F. Wang, Z. He, and Z. Fu, “Dual frequency branch frame- work with reconstructed sliding windows attention for AI-generated image detection,”IEEE Transactions on Information Forensics and Security, vol. 21, pp. 2313–2325, 2026

    2026

  28. [36]

    Frequency-aware deepfake detection: Improving generalizability through frequency space learning,

    C. Tan, Y . Zhao, S. Wei, G. Gu, P. Liu, and Y . Wei, “Frequency-aware deepfake detection: Improving generalizability through frequency space learning,” 2024

    2024

  29. [37]

    A sanity check for AI-generated image detection,

    S. Yan, O. Li, J. Cai, Y . Hao, X. Jiang, Y . Hu, and W. Xie, “A sanity check for AI-generated image detection,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 70 702–70 720

    2025

  30. [38]

    Can we build a monolithic model for fake image detection? SICA: Semantic-induced constrained adaptation for unified- yet-discriminative artifact feature space reconstruction,

    B. Du, X. Ma, X. Zhu, Z. Yang, C. Niu, C. Qu, M. Fang, Z. Wang, J. Liu, J. Liuet al., “Can we build a monolithic model for fake image detection? SICA: Semantic-induced constrained adaptation for unified- yet-discriminative artifact feature space reconstruction,”arXiv preprint ...

    2026 arXiv

  31. [39]

    IMDL-BenCo: A comprehensive benchmark and codebase for image manipulation detection & localization,

    X. Ma, X. Zhu, L. Su, B. Du, Z. Jiang, B. Tong, Z. Lei, X. Yang, C.- M. Pun, J. Lvet al., “IMDL-BenCo: A comprehensive benchmark and codebase for image manipulation detection & localization,”Advances in Neural Information Processing Systems, vol. 37, pp. 134 591–134 613, 2024

    2024

  32. [40]

    ForensicHub: A unified benchmark & codebase for all-domain fake image detection and localization,

    B. Du, X. Zhu, X. Ma, C. Qu, K. Feng, Z. Yang, C.-M. Pun, J.-Z. Zhou et al., “ForensicHub: A unified benchmark & codebase for all-domain fake image detection and localization,”Advances in neural information processing systems, vol. 38, 2026

    2026

  33. [41]

    Is artificial intelligence generated image detection a solved problem?

    Z. Li, J. Yan, Z. He, K. Zeng, W. Jiang, L. Xiong, and Z. Fu, “Is artificial intelligence generated image detection a solved problem?”Advances in neural information processing systems, vol. 38, 2026

    2026

  34. [42]

    Genimage: A million-scale benchmark for detecting AI- generated image,

    M. Zhu, H. Chen, Q. Yan, X. Huang, G. Lin, W. Li, Z. Tu, H. Hu, J. Hu, and Y . Wang, “Genimage: A million-scale benchmark for detecting AI- generated image,”Advances in neural information processing systems, vol. 36, pp. 77 771–77 782, 2023

    2023

  35. [43]

    Revisiting image manipulation localization under realistic manipulation scenarios,

    X. Zhu, J.-Z. Zhou, K. Feng, C. Qu, X. Wang, Y . Wang, L. Zhou, and J. Liu, “Revisiting image manipulation localization under realistic manipulation scenarios,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2026, pp. 7198–7207

    2026

  36. [44]

    AEROBLADE: Training-free detection of latent diffusion images using autoencoder reconstruction error,

    J. Ricker, D. Lukovnikov, and A. Fischer, “AEROBLADE: Training-free detection of latent diffusion images using autoencoder reconstruction error,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 9130–9140

    2024

  37. [45]

    DRCT: Diffusion reconstruction contrastive training towards universal detection of diffusion generated images,

    B. Chen, J. Zeng, J. Yang, and R. Yang, “DRCT: Diffusion reconstruction contrastive training towards universal detection of diffusion generated images,” inForty-first International Conference on Machine Learning, 2024. [Online]. Available: https://openreview.net/ forum?id=oRLwyayrh1

    2024

  38. [46]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  39. [47]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

    2018

  40. [48]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in2017 IEEE Symposium on Security and Privacy (SP), 2017, pp. 39–57

    2017

  41. [49]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security, 2017, pp. 506–519

    2017

  42. [50]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inProceedings of the IEEE confer- ence on computer vision and pattern recognition, 2018, pp. 9185–9193

    2018

  43. [51]

    Simple black-box adversarial attacks,

    C. Guo, J. Gardner, Y . You, A. G. Wilson, and K. Weinberger, “Simple black-box adversarial attacks,” inInternational conference on machine learning. PMLR, 2019, pp. 2484–2493

    2019

  44. [52]

    Square at- tack: A query-efficient black-box adversarial attack via random search,

    M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square at- tack: A query-efficient black-box adversarial attack via random search,” inEuropean conference on computer vision. Springer, 2020, pp. 484– 501

    2020

  45. [53]

    BRUSLEATTACK: A query-efficient score-based black-box sparse adversarial attack,

    Q. V . V o, E. Abbasnejad, and D. Ranasinghe, “BRUSLEATTACK: A query-efficient score-based black-box sparse adversarial attack,” in International Conference on Learning Representations, vol. 2024, 2024, pp. 54 462–54 499

    2024

  46. [54]

    DP-RAE: A dual-phase merging reversible adversarial example for image privacy protection,

    J. Zhu, X. Du, J. Zhou, C.-M. Pun, Q. Xu, and X. Liu, “DP-RAE: A dual-phase merging reversible adversarial example for image privacy protection,” inProceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 671–680

    2024

  47. [55]

    Guided evolutionary strategies: Augmenting random search with surrogate gradients,

    N. Maheswaranathan, L. Metz, G. Tucker, D. Choi, and J. Sohl- Dickstein, “Guided evolutionary strategies: Augmenting random search with surrogate gradients,” inInternational Conference on Machine Learning. PMLR, 2019, pp. 4264–4273

    2019

  48. [56]

    Improving black- box adversarial attacks with a transfer-based prior,

    S. Cheng, Y . Dong, T. Pang, H. Su, and J. Zhu, “Improving black- box adversarial attacks with a transfer-based prior,”Advances in neural information processing systems, vol. 32, 2019

    2019

  49. [57]

    Adversarial Deepfakes: Evaluating vulnerability of Deepfake detectors to adversarial examples,

    S. Hussain, P. Neekhara, M. Jere, F. Koushanfar, and J. McAuley, “Adversarial Deepfakes: Evaluating vulnerability of Deepfake detectors to adversarial examples,” inProceedings of the IEEE/CVF winter conference on applications of computer vision, 2021, pp. 3348–3357

    2021

  50. [58]

    Evading Deep- fake detectors via adversarial statistical consistency,

    Y . Hou, Q. Guo, Y . Huang, X. Xie, L. Ma, and J. Zhao, “Evading Deep- fake detectors via adversarial statistical consistency,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 12 271–12 280

    2023

  51. [59]

    MaskGAN: Towards diverse and interactive facial image manipulation,

    C.-H. Lee, Z. Liu, L. Wu, and P. Luo, “MaskGAN: Towards diverse and interactive facial image manipulation,” inIEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2020

    2020

  52. [60]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778. 14

    2016

  53. [61]

    EfficientNet: Rethinking model scaling for con- volutional neural networks,

    M. Tan and Q. Le, “EfficientNet: Rethinking model scaling for con- volutional neural networks,” inInternational conference on machine learning. PMLR, 2019, pp. 6105–6114

    2019

  54. [62]

    Training data-efficient image transformers & distillation through attention,

    H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, and H. J ´egou, “Training data-efficient image transformers & distillation through attention,” inInternational conference on machine learning. PMLR, 2021, pp. 10 347–10 357

    2021

  55. [63]

    Swin Transformer: Hierarchical vision transformer using shifted win- dows,

    Z. Liu, Y . Lin, Y . Cao, H. Hu, Y . Wei, Z. Zhang, S. Lin, and B. Guo, “Swin Transformer: Hierarchical vision transformer using shifted win- dows,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 10 012–10 022

    2021

  56. [64]

    Orthogonal subspace decomposition for generalizable AI-generated image detection,

    Z. Yan, J. Wang, P. Jin, K.-Y . Zhang, C. Liu, S. Chen, T. Yao, S. Ding, B. Wu, and L. Yuan, “Orthogonal subspace decomposition for generalizable AI-generated image detection,” inProceedings of the 42nd International Conference on Machine Learning, ser. Proceedings of Machine ...

  57. [65]

    PGC: Peak-guided calibration for generalizable AI-generated image detection,

    X. Zhou, J. Fei, P. Yu, J. Xie, C. Cheng, and Z. Xia, “PGC: Peak-guided calibration for generalizable AI-generated image detection,” 2026

    2026

  58. [267]

    70 268–70 288

    PMLR, 13–19 Jul 2025, pp. 70 268–70 288. [Online]. Available: https://proceedings.mlr.press/v267/yan25b.html

    2025

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.