Robustness in AI-Generated Detection: Enhancing Resistance to Adversarial Attacks

TL;DR

This paper addresses the fragility of AI-generated face detectors to imperceptible adversarial perturbations and proposes a robust framework that combines PGD-based adversarial perturbations, adversarial training, and diffusion reconstruction (DIRE). By evaluating in-domain and cross-domain settings, the authors demonstrate that standard detectors fail under attack, while AT and DIRE significantly improve detection robustness and cross-domain generalization. The results highlight a practical path toward reliable AIGC detection in real-world deployments and offer insights into diffusion-based defenses for synthetic media. The work also includes a plan to release code to facilitate replication and further research.

Abstract

The rapid advancement of generative image technology has introduced significant security concerns, particularly in the domain of face generation detection. This paper investigates the vulnerabilities of current AI-generated face detection systems. Our study reveals that while existing detection methods often achieve high accuracy under standard conditions, they exhibit limited robustness against adversarial attacks. To address these challenges, we propose an approach that integrates adversarial training to mitigate the impact of adversarial examples. Furthermore, we utilize diffusion inversion and reconstruction to further enhance detection robustness. Experimental results demonstrate that minor adversarial perturbations can easily bypass existing detection systems, but our method significantly improves the robustness of these systems. Additionally, we provide an in-depth analysis of adversarial and benign examples, offering insights into the intrinsic characteristics of AI-generated content. All associated code will be made publicly available in a dedicated repository to facilitate further research and verification.

Figures (6)

• Figure 1: Although SOTA detectors achieve near-perfect accuracy in discriminating fake images, even minimal and imperceptible perturbations can cause misclassifications, leading to synthetic images being identified as real, and vice versa. In contrast, our proposed method maintains robust classification accuracy even under adversarial attacks.
• Figure 2: Pipeline of our robustness-centric method, which integrates adversarial training with diffusion inversion reconstruction to improve detection robustness. Given a set of real and fake images, we first apply adversarial perturbations and then use the resulting adversarial samples along with the original samples for residual reconstruction. Finally, we train the detector using the reconstruction residual maps for more robust performance.
• Figure 3: Visualization of attack noise, adversarial samples, and DIRE residual maps of fake images. "Difference DIRE” represents the disparity between DIRE maps of the original samples and those of the adversarially attacked samples. For enhanced clarity, the attack noise was amplified by a factor of 20, and the Difference DIRE maps by a factor of 10.
• Figure 4: Visualization of attack noise, adversarial samples, and DIRE maps of real images.
• Figure 5: Visualization of attack noise, adversarial samples, and DIRE maps of non-face real images.