MS-GAGA: Metric-Selective Guided Adversarial Generation Attack
Dion J. X. Ho, Gabriel Lee Jun Rong, Niharika Shrivastava, Harshavardhan Abichandani, Pai Chet Ng, Xiaoxiao Miao
TL;DR
MS-GAGA presents a two-stage adversarial framework to stress-test deepfake detectors under black-box access. It fuses a dual-stream generation phase (MNTD-PGD with momentum, Nesterov updates, translation invariance, input diversity, plus SSIM regularization, and SG-PGD guided by saliency maps) with a metric-aware selection that balances transferability and perceptual fidelity, achieving up to 27% higher misclassification on unseen detectors. While demonstrating practical transfer across CNN-based architectures, the method exhibits perceptual trade-offs (lower SSIM) and is evaluated on static CNN-based detectors; future work targets transformer-based and frequency-domain detectors and broader modalities. Overall, MS-GAGA provides a rigorous red-teaming tool that reveals vulnerabilities in current deepfake defenses and offers a path toward more robust, transferable defensive strategies across diverse detectors.
Abstract
We present MS-GAGA (Metric-Selective Guided Adversarial Generation Attack), a two-stage framework for crafting transferable and visually imperceptible adversarial examples against deepfake detectors in black-box settings. In Stage 1, a dual-stream attack module generates adversarial candidates: MNTD-PGD applies enhanced gradient calculations optimized for small perturbation budgets, while SG-PGD focuses perturbations on visually salient regions. This complementary design expands the adversarial search space and improves transferability across unseen models. In Stage 2, a metric-aware selection module evaluates candidates based on both their success against black-box models and their structural similarity (SSIM) to the original image. By jointly optimizing transferability and imperceptibility, MS-GAGA achieves up to 27% higher misclassification rates on unseen detectors compared to state-of-the-art attacks.