Fooling the Watchers: Breaking AIGC Detectors via Semantic Prompt Attacks

Peng Ying; Run Hao

REVIEW 5 major objections 6 minor 18 references

Fooling the Watchers: Breaking AIGC Detectors via Semantic Prompt Attacks

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A grammar-tree search over prompt fragments lets automated prompts evade open-source and commercial AIGC portrait detectors with no image editing.

desk verdict Plausible attack idea undone by missing baselines and an abstract that overstates its own Table 1. read the letter →

arxiv 2505.23192 v1 pith:QQ2BC7QA submitted 2025-05-29 cs.CV cs.AIcs.CR

Run Hao , Peng Ying This is my paper · ORCID

classification cs.CVcs.AIcs.CR

keywords semanticpromptattackAIGCdetectiongrammartreeMonteCarlosearchUCT-Randtext-to-imageadversarialportraitgeneration

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to establish that an attacker who can only write text prompts—no post-processing, no pixel noise—can still make AIGC detectors label AI-generated portraits as human-made. The method is an automated prompt generator built as a grammar tree of portrait and stylistic attributes, searched with a Monte Carlo tree search variant called UCT-Rand that uses the detector's own confidence score as reward. Tests across several text-to-image models against the open-source PatchCraft detector and a commercial detector report consistent evasion, with bypass rates rising over search rounds and first place in a real-world adversarial AIGC detection competition. The authors' point is that semantic-level prompt perturbations are a general fragility of current detectors, and they offer the generated prompts as a resource for training more robust detection.

What carries the argument

The carrying mechanism is a grammar tree whose nodes are prompt components: AND nodes concatenate all children, OR nodes select one candidate, and RAND nodes randomize how many times a child is used. Leaves are terminal fragments such as "with the rest of the page filled entirely with clear text" or "dazzle." The UCT-Rand variant replaces greedy selection with weighted random sampling of children, using the Upper Confidence Bound weight $Q(v,v') + \sqrt{2\ln N(v)/N(v,v')}$, where $Q(v,v')$ is the average of $2(1-\mathrm{score}_i)$ and $\mathrm{score}_i$ is the detector's probability that the generated image is AI-generated. This lets the search accumulate statistics about which semantic fragments push the detector below threshold.

What would settle it

Re-run the same UCT-Rand search while jittering the detector's score by ±0.05 between identical queries, or against a detector that outputs only a binary accept/reject label. If evasion rates stop improving over random grammar sampling, the scalar score was the load-bearing signal. Alternatively, retrain PatchCraft on high-resolution T2I images without GAN-era bias and check whether the text-injection and 'dazzle' prompts still bypass it.

Watch

Extended reading notes

Core claim

The paper's central claim is that prompt-level semantic perturbations alone are sufficient to make AIGC portrait detectors misclassify AI-generated images as human-made. The concrete discovery is that a grammar tree decomposing prompts into semantic components—portrait attributes, stylistic attributes, and extra constraints such as text injection—gives an automated search a structured space to explore, and that UCT-Rand search with the detector score as reward finds evasive prompts without manual tuning. Images generated this way bypass PatchCraft, which relies on rich-versus-poor texture-patch statistics, and a commercial detector, under rules that forbid any secondary editing of the generated image. In the reported real-world competition, the same tool placed first, and the authors claim the prompts it finds can seed adversarial datasets for detector hardening.

Load-bearing premise

The method assumes the detector's scalar confidence score is a stable, informative reward for the tree search, and that the hand-built grammar tree plus the manually found suffixes cover the semantic variations that change detector decisions.

Editorial extensions

If this is right

A practical attack needs only black-box query access to a detector and a T2I model API; no knowledge of detector internals is required.
Detectors whose decisions rest on texture-patch statistics or lighting cues will see evasion improve as the search runs longer, because the reward signal guides prompts toward blind spots.
The generated prompts double as adversarial training examples, giving detector developers a cheaper route to robustness evaluation than manual prompt crafting.
Detector evasion depends on the pairing of generator and detector: the same prompt-search method produced many bypassing images with flux-dev but very few with wanx2.0-t2i-turbo against PatchCraft, underscoring that artifact distributions differ across T2I models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the attack exploits semantic control over generation, a detector that verifies consistency between the prompt and the image content—rather than low-level fingerprints—would be a natural next line of defense; the paper does not test such a detector.
The grammar-tree-plus-scalar-reward recipe is media-agnostic: it could transfer to text-to-video or text-to-audio detectors whenever those systems expose a scalar confidence score, though this is an extrapolation beyond the paper's experiments.
A cheap partial defense suggested by the paper's own examples is to filter prompts containing texture-injection or lighting keywords before generation, but that would only push the search to discover new semantic fragments.
The reported advantage is expected to shrink against a detector adversarially retrained on prompts produced by this grammar tree, because the detector's scores would no longer vary smoothly with the search's preferred fragments.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a promising attack idea that the paper doesn't yet substantiate. The new part is treating semantic-prompt evasion as grammar-tree search with UCT-Rand, and the two manual prompt tricks in §3 — filling the rest of the page with clear text and injecting lighting words like "dazzle" — are concrete and mechanically sensible against PatchCraft. The first-place result in Tencent's Zhuque competition is the most serious evidence in the paper; if it holds up, the work matters for forensic deployments.

Credit: the attacks are aimed at a real weakness in PatchCraft's texture-fingerprint design, with worked examples. The UCT-Rand integration is a reasonable way to automate prompt search. The authors also report raw round counts instead of only cherry-picked images. Eq. (2)'s reward from detector confidence is simple and workable.

Soft spots, in order: the abstract says "consistently evade both open-source and commercial AIGC detectors," but Table 1 shows 5 evasions in 200 rounds for wanx+PatchCraft, and Table 2's 50–59% per hundred rounds for flux-dev is decent but not consistent. There is no random-prompt baseline, so we cannot attribute the successes to the search rather than to the two manually discovered suffixes. There are no quantitative results at all for the commercial Zhuque detector — the competition placement is the only evidence. No error bars, no repeated-generation variance, no ablation of UCT-Rand or the grammar tree, no code, no data, and no full grammar-tree definition. The text around Eq. (1) even carries over CDN-forwarding language from ReqsMiner, which is sloppy.

On circularity: the paper tunes against the same detectors it evaluates; that limits generalization but is standard practice for adaptive attacks, so I wouldn't call it a fatal flaw. The real problem is missing evidence, not method incoherence.

Bottom line: the reader's reject verdict is fair for the manuscript as submitted. The contribution could be real, and the competition result is externally plausible, but this is a teaser rather than a reproducible study. The right path is major revision: add a random-prompt baseline, report actual Zhuque success rates, release code and grammar tree, and rerun with repeated-seed stats. For someone working on AIGC detector robustness, the §3 prompts alone are worth reading. I'd send this back for revision rather than desk-reject outright, but I would not accept it anywhere near its current form.

Referee Report

5 major / 6 minor

Summary. The paper proposes an automated prompt-level attack against AIGC detectors. A hand-designed grammar tree over portrait and stylistic attributes is combined with a UCT-Rand Monte Carlo tree search variant to generate text prompts; the detector's AI-confidence score is used as the reward signal. The authors report experiments with the wanx2.0-t2i-turbo and flux-dev T2I models against the open-source PatchCraft detector, a first-place result in a Tencent competition against the commercial Zhuque detector, and claim that the method 'consistently evade[s] both open-source and commercial AIGC detectors.' The paper also suggests that the generated prompts could serve as adversarial training data.

Significance. If substantiated, the work would be a practically relevant and low-cost way to expose fragility in current AIGC detectors, and the threat model — black-box detector scores, no post-processing, direct T2I API generation — is realistic. The paper identifies two plausible detector weaknesses (texture injection and prompt-induced lighting changes) and builds a search algorithm around them. However, the current evidence is not sufficient to support the headline claims: the only controlled quantitative result is far below 'consistent evasion,' no quantitative commercial-detector results are reported, and the absence of baselines and ablations leaves the contribution of the proposed machinery unverified. The significance is therefore conditional on substantial additional evidence.

major comments (5)

[Abstract; Section 5.2, Table 1] The abstract claims that the method 'consistently evade[s] both open-source and commercial AIGC detectors,' but Table 1 reports only 5 bypasses in the first 200 rounds (2.5%) for wanx2.0-t2i-turbo against PatchCraft. Under the paper's own competition threshold of an AI-detection rate below 50%, this directly contradicts the word 'consistently.' The prose in Section 5.2 even acknowledges that most images from the more advanced model were classified as AI-generated. The claim of consistent evasion must either be withdrawn or supported by per-round score distributions and success rates across repeated runs.
[Section 5.1] The commercial-detector evidence consists solely of the statement that the approach 'ranked first in a real-world adversarial AIGC detection competition' and that the tool generated 'a sufficient number of images capable of bypassing the detectors.' No quantitative success rate, no number of queries, no score distribution, and no comparison to any baseline are given for the Zhuque detector. The abstract's claim about 'commercial AIGC detectors' is therefore unverifiable from the manuscript.
[Section 4.4, Eq. (2); Section 5] No random-prompt baseline and no ablation are reported, so the contribution of the UCT-Rand search and the grammar tree is not established. The two successful prompt elements in Section 3 ('with the rest of the page filled entirely with clear text' and 'dazzle') were manually discovered using knowledge of the detectors' mechanisms. Without a baseline that samples prompts randomly with the same query budget, the reported evasions could be due to these hand-chosen elements or to detector weaknesses, as the authors themselves speculate for flux-dev in Section 5.2.
[Tables 1 and 2; Section 4.2] The evaluation does not account for the stochasticity of T2I generation or detector-score noise. Each round appears to use a single generated image and a single detector score, with no repeated trials, confidence intervals, or variance measures. This is particularly important for Table 2, where flux-dev achieves 51/100 bypasses in the first round block; without repeated-generation statistics, the reported counts cannot be distinguished from chance, and the claim that success rises with the number of rounds is not supported by Table 1.
[Section 4.3 and 4.4, Eqs. (1)-(2)] The proposed method is not reproducible as specified. The full grammar tree is not given (Figure 5 is a schematic), the attribute sets and RAND selection ranges are not defined, and the sampling rule in Eq. (1) is ambiguous: 'weighted_{v' in Children(v)}' is not a complete mathematical expression. The reward in Eq. (2) is a linear transformation of the detector score, but its stability and informativeness as a search signal are not analyzed. These details are load-bearing because the paper's contribution is the automated search procedure.

minor comments (6)

[Eq. (1)] Please define the sampling operation explicitly; as printed, Eq. (1) mixes a maximization/selection statement with a weighted-sampling description, and no exploration constant is specified.
[Figure 2 caption vs. Section 5.2] Figure 2 says the image was generated by 'flux-schnell,' while Section 5.2 evaluates 'flux-dev'; please clarify which model is actually used.
[Tables 1 and 2] The two tables use different round-block sizes (50 vs. 100) and do not state the evasion threshold used for PatchCraft; specify whether the same <50% criterion as the competition is applied.
[Section 2.2] The sentence about CNNSpot cites Kang et al. 2023 for ProGAN; ProGAN is from Karras et al., and Kang et al. 2023 is a different text-to-image GAN scaling work. Please correct the reference.
[Section 5.2] The explanation for flux-dev's higher evasion rate is explicitly speculative ('we hypothesize') and is not backed by any analysis of PatchCraft's training data or image-resolution sensitivity; it should be labeled as a hypothesis or removed from the main claims.
[Introduction, Contributions] The paper states that this is 'the first study on prompt-level semantic attacks against AIGC detectors,' but it does not position itself against prior prompt-based manipulation of T2I outputs or related adversarial-prompt work; please soften or justify this novelty claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the reward definition and evaluation coincide only in the standard attack-evaluation sense, and the competition result is an external benchmark.

full rationale

The paper's derivation chain is short. Section 4 defines a grammar-tree prompt generator and a UCT-Rand search whose reward Q(v,v') in Eq. (2) is the average of 2*(1 - score_i), with score_i the target detector's AI-confidence. This is a definition of an optimization objective, not a prediction of an external quantity. Section 5 then reports evasion counts on PatchCraft and a first-place result in the Tencent Zhuque competition. The PatchCraft experiments use the same detector that supplies the search reward, so the reported success partly measures how well the search minimized its own objective; however, that is the standard relationship between an attack and its target, and the paper does not present the PatchCraft numbers as a generalization to unseen detectors. The Zhuque competition is an external, independently judged benchmark, with rules set by Tencent, not by the authors, so it is independent evidence. There are no load-bearing self-citations: the reference list contains no prior work by Hao or Ying, and UCT-Rand is cited to an external NDSS paper. No uniqueness theorem or ansatz is imported from the authors' own prior work. The main weaknesses of the paper—the 5/200 wanx+PatchCraft evasion count contradicting 'consistently evade', the absence of a random-prompt baseline, and the lack of variance statistics—are concerns about experimental support and generalization, not about circular reasoning. Hence the circularity score is 0.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

No numeric free parameters are reported; the UCT exploration constant follows the standard formula. The load-bearing choices are non-numeric: the grammar tree structure, the manually discovered attack suffixes, and the assumption that detector scores are reliable rewards. No new physical or conceptual entities are introduced.

assumptions (5)

domain assumption Semantic prompt phrases can reliably steer T2I models to produce images with targeted texture or lighting changes.
Invoked throughout Sections 3.2 and 3.3: the case studies assume that adding 'with clear text' or 'dazzle' alters generated images in a detector-relevant way.
domain assumption PatchCraft's rich/poor texture fingerprint can be dominated by injected text regions.
Stated in Section 3.2 as the basis for the text-injection attack: the detector is assumed to focus on the injected high-frequency text patches instead of the face region.
domain assumption The black-box detector's confidence score is a stable, informative reward for MCTS backpropagation.
Section 4.4, Eq. (2), defines Q using detector scores; if the scores are noisy or non-monotonic, the search cannot be shown to converge to evasive prompts.
ad hoc to paper The hand-built grammar tree's attribute set sufficiently covers semantic variations that affect AIGC detectors.
Section 4.3 describes the tree structure but provides no systematic justification or ablation showing that the chosen attributes cover detector failure modes.
ad hoc to paper PatchCraft's poor performance on flux-dev images is explained by its training data and resolution, not by other factors.
Section 5.2 proposes this hypothesis to interpret Table 2, but the paper does not test alternative explanations such as prompt distribution or generation pipeline differences.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Fooling the Watchers: Breaking AIGC Detectors via Semantic Prompt Attacks." pith.science (2026). https://pith.science/paper/QQ2BC7QA

@misc{pith2026250523192,
  author       = {Pith},
  title        = {Pith review of: Fooling the Watchers: Breaking AIGC Detectors via Semantic Prompt Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QQ2BC7QA}},
  note         = {Machine review of arXiv:2505.23192}
}

read the original abstract

The rise of text-to-image (T2I) models has enabled the synthesis of photorealistic human portraits, raising serious concerns about identity misuse and the robustness of AIGC detectors. In this work, we propose an automated adversarial prompt generation framework that leverages a grammar tree structure and a variant of the Monte Carlo tree search algorithm to systematically explore the semantic prompt space. Our method generates diverse, controllable prompts that consistently evade both open-source and commercial AIGC detectors. Extensive experiments across multiple T2I models validate its effectiveness, and the approach ranked first in a real-world adversarial AIGC detection competition. Beyond attack scenarios, our method can also be used to construct high-quality adversarial datasets, providing valuable resources for training and evaluating more robust AIGC detection and defense systems.

Figures

Figures reproduced from arXiv: 2505.23192 by the authors.

**Figure 1.** The adversary uses a lighting-based attack to generate images that can evade the detector. perturbs the semantics in the attribute space of images to deceive detection models. Prior work(Xie et al., 2024) uses real-world post-processing, i.e.,Gaussian blur, JPEG compression, Gaussian noise and light spot to generate adversarial examples. 3. Threat Model & Motivation 3.1. Threat Model We consider an adversary who a… view at source ↗

**Figure 3.** Generated using the wanx2.0-t2i-turbo model with the prompt: ’Jay Chou’s live concert, clear facial features, dazzle.’ The Zhuque AIGC Detector estimates a 24.3% probability that the image is AI-generated. impair detector performance, we aim to replicate similar effects at the T2I model generation stage using text prompts. To assess this, we evaluate the impact of prompt-induced lighting perturbations on the Zhuque … view at source ↗

**Figure 4.** A illustration for generating prompts designed to bypass the AIGC detector. 2024). UCT-Rand algorithm uses weighted random selection rather than the argmax function to choose the next child node which allows us to comprehensively explore different branches of the grammar tree. 4.2. Definition of Attribute and Semantic Embeddings Previous research (Meng et al., 2023) on attacking DeepFake detectors involved introdu… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

18 extracted references · 9 canonical work pages

[3]

Accessed: 2025-05-18

URL https://civitai.com/. Accessed: 2025-05-18. Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In2009 IEEE Conference on Computer Vi- sion and Pattern Recognition, pp. 248–255,

work page 2025
[5]

midjourney.com/home/

URL https://www. midjourney.com/home/. Accessed: 2025-05-18. Hong, Y . and Zhang, J. Wildfake: A large-scale challenging dataset for ai-generated images detection,

work page 2025
[9]

Karras, T., Laine, S., and Aila, T

URL https://arxiv.org/abs/ 2303.05511. Karras, T., Laine, S., and Aila, T. A style-based generator architecture for generative adversarial networks.Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4401–4410,

arXiv
[10]

AVA: Inconspicuous Attribute Variation-based Adversarial Attack bypassing DeepFake Detection

URL https:// arxiv.org/abs/2312.08675. Mirsky, Y . and Lee, W. Creation and detection of deepfakes: A survey.ACM Computing Surveys (CSUR), 54(1):1–41,

work page Pith review arXiv
[11]

Glide: Towards photoreal- istic image generation and editing with text-guided diffu- sion models.arXiv preprint arXiv:2112.10741,

Nichol, A., Dhariwal, P., Ramesh, A., Shyam, P., Sastry, G., Askell, A., Agarwal, S., et al. Glide: Towards photoreal- istic image generation and editing with text-guided diffu- sion models.arXiv preprint arXiv:2112.10741,

arXiv
[12]

Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M

doi: 10.1109/IWBF57495.2023.10156981. Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M. Hierarchical text-conditional image generation with clip latents.arXiv preprint arXiv:2204.06125,

arXiv 2023
[13]

Tencent zhuque lab

Accessed: 2025-05-19. Tencent zhuque lab. Zhuque ai assistant: Ai-generated content detection tool. https://matrix.tencent. com/ai-detect/ai_gen,

work page 2025
[14]

Tian, B., Juefei-Xu, F., Guo, Q., Xie, X., Li, X., and Liu, Y

Accessed: 2025- 05-26. Tian, B., Juefei-Xu, F., Guo, Q., Xie, X., Li, X., and Liu, Y . Ava: Adversarial vignetting attack against visual recogni- tion,

work page 2025

Show all 18 references

[15]

Wang, P., Bai, S., Tan, S., Wang, S., Fan, Z., Bai, J., Chen, K., Liu, X., Wang, J., Ge, W., et al

URL https://arxiv.org/ abs/2404.05311. Wang, P., Bai, S., Tan, S., Wang, S., Fan, Z., Bai, J., Chen, K., Liu, X., Wang, J., Ge, W., et al. Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution.arXiv preprint arXiv:2409.12191,

arXiv
[16]

Wang, S.-Y ., Wang, O., Zhang, R., Owens, A., and Efros, A. A. Cnn-generated images are surprisingly easy to spot... for now. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pp. 8695–8704, 2020a. Wang, S.-Y ., Wang, O., Zhang, R., Owens, ...

1912 arXiv
[17]

Xu, T., Zhang, P., Huang, Q., Zhang, H., Gan, Z., Huang, X., and He, X

URL https://arxiv.org/abs/2412.06727. Xu, T., Zhang, P., Huang, Q., Zhang, H., Gan, Z., Huang, X., and He, X. Attngan: Fine-grained text to image gener- ation with attentional generative adversarial networks. In Proceedings of the IEEE conference on computer vision and pattern...

arXiv
[18]

Zhu, M., Chen, H., Yan, Q., Huang, X., Lin, G., Li, W., Tu, Z., Hu, H., Hu, J., and Wang, Y

URL https://arxiv.org/abs/ 2311.12397. Zhu, M., Chen, H., Yan, Q., Huang, X., Lin, G., Li, W., Tu, Z., Hu, H., Hu, J., and Wang, Y . Genimage: A million- scale benchmark for detecting ai-generated image,

arXiv
[2009]

Douglas, J

doi: 10.1109/CVPR.2009.5206848. Douglas, J. and Yampolskiy, R. V . Deepfakes and face recognition: Challenges and opportunities. In2021 IEEE Conference on Multimedia Information Processing and Retrieval (MIPR), pp. 448–452,

2009
[2020]

Cazenavette, G., Sud, A., Leung, T., and Usman, B

URL https: //arxiv.org/abs/1912.00049. Cazenavette, G., Sud, A., Leung, T., and Usman, B. Fakein- version: Learning to detect images from unseen text-to- image models by inverting stable diffusion. InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recog...

1912 arXiv
[2021]

org/abs/2106.09685

URL https://arxiv. org/abs/2106.09685. Jiang, Z., Zhang, J., and Gong, N. Z. Evading watermark based detection of ai-generated content,

arXiv
[2023]

Kang, M., Zhu, J.-Y ., Zhang, R., Park, J., Shechtman, E., Paris, S., and Park, T

URL https://arxiv.org/abs/2305.03807. Kang, M., Zhu, J.-Y ., Zhang, R., Park, J., Shechtman, E., Paris, S., and Park, T. Scaling up gans for text-to-image synthesis,

arXiv
[2024]

URL https://arxiv.org/abs/2402.11843. Hu, E. J., Shen, Y ., Wallis, P., Allen-Zhu, Z., Li, Y ., Wang, S., Wang, L., and Chen, W. Lora: Low-rank adaptation of large language models,

arXiv
[2025]

Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M

Last updated: 2025-05-22. Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M. Square attack: a query-efficient black-box adver- sarial attack via random search,

2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [3]

Accessed: 2025-05-18

URL https://civitai.com/. Accessed: 2025-05-18. Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In2009 IEEE Conference on Computer Vi- sion and Pattern Recognition, pp. 248–255,

work page 2025

[2] [5]

midjourney.com/home/

URL https://www. midjourney.com/home/. Accessed: 2025-05-18. Hong, Y . and Zhang, J. Wildfake: A large-scale challenging dataset for ai-generated images detection,

work page 2025

[3] [9]

Karras, T., Laine, S., and Aila, T

URL https://arxiv.org/abs/ 2303.05511. Karras, T., Laine, S., and Aila, T. A style-based generator architecture for generative adversarial networks.Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4401–4410,

arXiv

[4] [10]

AVA: Inconspicuous Attribute Variation-based Adversarial Attack bypassing DeepFake Detection

URL https:// arxiv.org/abs/2312.08675. Mirsky, Y . and Lee, W. Creation and detection of deepfakes: A survey.ACM Computing Surveys (CSUR), 54(1):1–41,

work page Pith review arXiv

[5] [11]

Glide: Towards photoreal- istic image generation and editing with text-guided diffu- sion models.arXiv preprint arXiv:2112.10741,

Nichol, A., Dhariwal, P., Ramesh, A., Shyam, P., Sastry, G., Askell, A., Agarwal, S., et al. Glide: Towards photoreal- istic image generation and editing with text-guided diffu- sion models.arXiv preprint arXiv:2112.10741,

arXiv

[6] [12]

Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M

doi: 10.1109/IWBF57495.2023.10156981. Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M. Hierarchical text-conditional image generation with clip latents.arXiv preprint arXiv:2204.06125,

arXiv 2023

[7] [13]

Tencent zhuque lab

Accessed: 2025-05-19. Tencent zhuque lab. Zhuque ai assistant: Ai-generated content detection tool. https://matrix.tencent. com/ai-detect/ai_gen,

work page 2025

[8] [14]

Tian, B., Juefei-Xu, F., Guo, Q., Xie, X., Li, X., and Liu, Y

Accessed: 2025- 05-26. Tian, B., Juefei-Xu, F., Guo, Q., Xie, X., Li, X., and Liu, Y . Ava: Adversarial vignetting attack against visual recogni- tion,

work page 2025