Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes

Xavier Pleimling; Sifat Muhammad Abdullah; Gunjan Balde; Peng Gao; Mainack Mondal; Murtuza Jadliwala; Bimal Viswanath

cs.CVFeb 25, 2026

Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes

Authors: Xavier Pleimling, Sifat Muhammad Abdullah, Gunjan Balde, Peng Gao, Mainack Mondal, Murtuza Jadliwala, Bimal Viswanath

Organizations: University of Texas at San Antonio San Antonio, TX, USA

Abstract

Advances in Generative AI (GenAI) have led to the development of various protection strategies to prevent the unauthorized use of images. These methods rely on adding imperceptible protective perturbations to images to thwart misuse such as style mimicry or deepfake manipulations. Although previous attacks on these protections required specialized, purpose-built methods, we demonstrate that this is no longer necessary. We show that off-the-shelf image-to-image GenAI models can be repurposed as generic ``denoisers" using a simple text prompt, effectively removing a wide range of protective perturbations. Across 8 case studies spanning 6 diverse protection schemes, our general-purpose attack not only circumvents these defenses but also outperforms existing specialized attacks while preserving the image's utility for the adversary. Our findings reveal a critical and widespread vulnerability in the current landscape of image protection, indicating that many schemes provide a false sense of security. We stress the urgent need to develop robust defenses and establish that any future protection mechanism must be benchmarked against attacks from off-the-shelf GenAI models. Code is available in this repository: https://github.com/mlsecviswanath/img2imgdenoiser

Figures & tables

Case study #	Our attack against protection schemes
	Protection type	Protection scheme (venue)
1	Preventing deepfake face manipulation	UnGANable (USENIX Sec’23) [ 61 ]
2	In-processing watermarking	PRC (ICLR’25) [ 34 ]
3	Post-processing watermarking	VINE (ICLR’25) [ 68 ]
4	Traceability when misused for model personalization	SIREN (IEEE S&P’25) [ 59 ]
	Our attack Vs. protection-specific attacks

TABLE I: Overview of our 8 case studies.

	$\epsilon=$ 0.06
Attacker	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓
No attack	0.00%	32.417	0.924	0.0006
Smoothing	63.25%	32.355	0.947	0.0006
DiffPure	48.29%	25.781	0.830	0.0028
SD1.5	63.25%	29.077	0.904	0.0013
SDXL	63.68%	30.726	0.925	0.0010

TABLE II: Denoising results for UnGANable. The best results for each metric are bolded . The highlighted row indicates the best model of our pipeline in terms of performance and utility.

Fig. 1 : Images in bottom row are generated with StyleGANv2 using their respective top row image as an input. SD3 better restores the original face features compared to the baselines.

Attacker	TPR@FPR ↓	PSNR ↑	SSIM ↑	KID ↓
No attack	1.000	-	-	0.0183
Smoothing (Avg.)	1.000	30.656	0.868	0.0294
DiffPure	0.280	21.694	0.305	0.0302
Regen-VAE B	0.312	28.859	0.770	0.0618
SD1.5	0.878	23.314	0.611	0.0248
SDXL	0.000	24.018	0.652	0.0142

TABLE III: Denoising results for PRC Watermark. FLUX demonstrates the best balance between performance and utility.

Fig. 2 : Qualitative image samples for PRC Watermark. Regen-VAE causes the image to appear blurrier in detail and DiffPure causes the image to appear more sharp and distorted. FLUX is able to preserve better quality during denoising.

Attacker	TPR@FPR ↓	PSNR ↑	SSIM ↑	LPIPS ↓	KID ↓
No Denoising	1.000	37.479	0.993	0.007	0.0000
DiffPure	0.991	22.087	0.336	0.575	0.0033
Regen-VAE B	0.976	29.424	0.832	0.275	0.0194
Sto. Regen.	0.981	22.325	0.636	0.270	0.0106
Det. Inver.	0.997	25.408	0.750	0.225	0.0072
FLUX	0.878	26.646	0.775	0.154	0.0006

TABLE IV: Denoising results for VINE. FLUX exhibits the best balance between performance and utility.

Fig. 3 : The bottom edge of three W-Bench samples with and without VINE. VINE’s watermarking creates visible perturbations on the edges of an image.

Attacker	TPR@Sign. ↓	PSNR ↑	SSIM ↑	KID ↓	LPIPS ↓
No attack	1.000	39.142	0.880	0.070	0.016
DiffPure	0.101	29.835	0.596	0.084	0.215
Regen-VAE C	0.591	31.886	0.890	0.071	0.085
SD1.5	0.147	22.348	0.803	0.100	0.122
SDXL	0.000	22.049	0.765	0.100	0.136
SD3	0.001	22.935	0.612	0.112	0.121

TABLE V: Denoising results for SIREN. FLUX exhibits the best balance between performance and utility.

	CLIP Accuracy		Generated Utility	Denoising Utility
Attacker	Top-1	Top-3	BRISQUE	PSNR	SSIM	BRISQUE
Mist	0.0%	1.3%	60.883	25.941	0.813	33.174
+ INSIGHT	0.7%	48.2%	29.229	17.945	0.393	28.231
+ FLUX	4.1%	74.6%	22.684	19.570	0.431	21.206

TABLE VI: Utility and performance results for INSIGHT and FLUX against Mist protection. We measure CLIP accuracy to Van Gogh’s style as performance. FLUX exhibits the best performance and BRISQUE utility.

Fig. 4 : Qualitative samples for INSIGHT. FLUX provides the best style fit for Van Gogh, greatly improving performance compared to INSIGHT.

Fig. 5 : Images in top row are source images. Images in bottom row are generated images from Textual Inversion. Note the high-quality sample produced when using GPT-4o.

	Performance		Denoising Utility
Protection	Inv. Dist. ↓	TPR@FPR = 0.01 ↓	CLIP FID ↓	BRISQUE ↓
UnMarker (HL)	0.0162	0.9011	6.774	62.969
UnMarker (L)	0.0166	0.9560	5.771	7.728
FLUX	0.0153	0.7912	11.549	13.958
GPT-4o	0.0149	0.6813	12.559	8.002

TABLE VII: Denoising results for TRW comparing our attack (FLUX and GPT-4o) with UnMarker on no cropping. GPT-4o exhibits best balance between performance & utility.

Fig. 6 : Qualitative examples comparing UnMarker with FLUX and GPT-4o on TRW. Note that GPT-4o provided a high quality sample that appears different from the watermarked sample but is still of the same concept.

Fig. 7 : Loss curve for UnGANable with and without the countermeasure. Without the countermeasure (left), loss values display an increasing trend with high magnitude. With the countermeasure (right), loss values plateau after only four training iterations, exhibiting values of low magnitude.

Domain	Category	Published Papers
Image	Watermarking / Copyright Protection	[ 28 ] (AAAI) [ 128 , 72 , 27 ] (ACM MM) [ 142 , 132 ] (CVPR) [ 19 ] (ECCV) [ 107 ] (ICASSP) [ 30 ] (ICCV) [ 34 , 68 ] (ICLR) [ 29 ] (ICML) [ 139 , 35 , 127 , 43 , 123 ] (NeurIPS) [ 71 ] (IEEE TETCI) [ 84 ] (IEEE TIFS) [ 138 , 76 ] (IEEE TMM) [ 69 ] (USENIX Security)
	Art Style Protection	[ 110 ] (ICCV) [ 129 ] (ICLR) [ 62 , 93 ] (ICML) [ 97 ] (USENIX Security)
	Facial Privacy	[ 104 , 112 , 96 , 119 , 42 ] (CVPR) [ 144 ] (ICASSP) [ 122 , 131 ] (ICCV) [ 2 ] (IEEE ICME) [ 111 ] (NeurIPS) [ 57 , 56 , 17 ] (PETS) [ 115 ] (IEEE TIFS) [ 99 ] (USENIX Security)
	Deepfake Manipulation	[ 44 ] (AAAI) [ 116 , 14 ] (CVPR) [ 26 ] (ICASSP) [ 114 ] (IJCAI-ECAI) [ 22 , 85 ] (IEEE TIFS) [ 61 ] (USENIX Security) [ 133 ] (WACV)
	Data Traceability	[ 54 ] (CVPR) [ 118 ] (ICLR) [ 59 ] (IEEE S&P)
Video	-	[ 67 ] (ICASSP) [ 89 ] (ICCV Workshop) [ 36 ] (IEEE Access) [ 4 ] (IEEE ICMLA) [ 105 ] (IEEE LSP) [ 58 ] (IEEE TDSC) [ 13 ] (IEEE TIFS) [ 66 ] (IEEE TIP) [ 100 ] (IEEE TPAMI) [ 102 ] (USENIX Security)

TABLE VIII : Published papers using perturbation-based techniques for proactive defense or protection. The publication venues are highlighted in parentheses after each group of citations.

Label	prompts	negative prompts
C1	Denoise the image	Add noise to the image
C2	Smoothen the image	Add noise to the image
C3	Denoise the image while preserving content of the image	Add noise to the image
C4	Remove adversarial perturbations	Add noise to the image
C5	Denoise the image	Add adversarial perturbation to the image
C6	Smoothen the image	Add adversarial perturbation to the image

TABLE IX: Labels for prompts and negative prompts combinations numbered C1-C8. These prompts are used as part of our denoising pipeline to attack perturbed images. Note that FLUX does not use negative prompts.

	$\epsilon=$ 0.05				$\epsilon=$ 0.06				$\epsilon=$ 0.07
Attacker	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓
No Denoising	0.00%	33.880	0.944	0.0004	0.00%	32.417	0.924	0.0006	0.00%	31.218	0.903	0.0008
Smoothing	57.44%	32.881	0.954	0.0006	63.25%	32.355	0.947	0.0006	56.52%	31.856	0.940	0.0007
DiffPure	45.13%	25.810	0.831	0.0028	48.29%	25.781	0.830	0.0028	46.01%	25.731	0.828	0.0028
SD1.5	64.62%	29.400	0.913	0.0014	63.25%	29.077	0.904	0.0013	54.71%	28.684	0.894	0.0014
SDXL	72.31%	31.097	0.932	0.0008	63.68%	30.726	0.925	0.0010	64.49%	30.388	0.918	0.0010

TABLE X: Full denoising results for UnGANable on the best prompt (C6) highlighting its performance on perturbation budgets

\epsilon=\{0.05,0.06,0.07\}

Fig. 8 : More image samples for UnGANable.

Fig. 9 : A GPT-4o image sample for UnGANable. While GPT-4o does not see much improvement in performance, certain face features are recovered during generation better than SD3.

Attacker	TPR@FPR ↓	PSNR ↑	SSIM ↑	KID ↓
No attack	1.000	-	-	0.0183
Smoothing (Avg.)	1.000	30.656	0.868	0.0294
DiffPure	0.280	21.694	0.305	0.0302
Regen-VAE B	0.312	28.859	0.770	0.0618
Regen-VAE C	0.360	29.741	0.786	0.0543
SD1.5	0.878	23.314	0.611	0.0248

TABLE XI: Full denoising results for PRC Watermark on the best prompt (C8). This table includes Regen-VAE C.

Fig. 10 : More image samples for PRC Watermark.

	Full Set		100 Remaining Images
Attacker	TPR@ FPR ↓	KID ↓	TPR@ FPR ↓	BRISQUE ↓
FLUX	0.258	0.0196	1.000	5.164
+ GPT-4o	0.060	0.0174	0.010	2.859

TABLE XII: Denoising results with GPT-4o improvement for PRC Watermark. The 100 remaining images were chosen as the most challenging to denoise.

Attacker	TPR@ FPR ↓	PSNR ↑	SSIM ↑	LPIPS ↓	KID ↓
No Denoising	1.000	37.479	0.993	0.007	0.0000
Smoothing (Avg.)	1.000	32.524	0.917	0.182	0.0015
DiffPure	0.991	22.087	0.336	0.575	0.0033
Regen-VAE B	0.976	29.424	0.832	0.275	0.0194
Regen-VAE C	0.982	29.949	0.840	0.240	0.0182
Sto. Regen.	0.981	22.325	0.636	0.270	0.0106

TABLE XIII: Full denoising results for VINE on the best prompt (C6). The performance of SD1.5, SDXL, SD3, Regen-VAE C, and Gaussian Smoothing are included.

Fig. 11 : Image samples for VINE. FLUX is able to improve performance without sacrificing significant utility.

Attacker	TPR@Sign. ↓	PSNR ↑	SSIM ↑	KID ↓	LPIPS ↓
No Denoising	1.000	39.142	0.880	0.070	0.016
DiffPure	0.101	29.835	0.596	0.084	0.215
Regen-VAE B	0.652	30.552	0.702	0.062	0.110
Regen-VAE C	0.591	31.886	0.890	0.071	0.085
SD1.5	0.147	22.348	0.803	0.100	0.122
SDXL	0.000	22.049	0.765	0.100	0.136

TABLE XIV: Full denoising results for SIREN on the best prompt (C6). The performance of Regen-VAE B is included.

	Proportion of image pairs where clean image has better utility
	Quality metrics ↑		Concept-appropriateness metrics ↑
	Noise	Artifacts	Detail	Concept fit	Prompt fit	Overall realism
Clean image vs. Mist + GPT-4o	0.08 ${}^{\textbf{***}}$	0.29	0.10 ${}^{\textbf{***}}$	0.00 ${}^{\textbf{***}}$	0.10 ${}^{\textbf{***}}$	0.18 ${}^{\textbf{**}}$
Clean image vs. Mist + FLUX	0.95 ${}^{\textbf{***}}$	0.33	0.20	0.42	0.36	0.30
Clean image vs. Mist + LightShed	0.94 ${}^{\textbf{***}}$	0.88 ${}^{\textbf{***}}$	0.85 ${}^{\textbf{***}}$	0.90 ${}^{\textbf{***}}$	0.90 ${}^{\textbf{***}}$	0.90 ${}^{\textbf{***}}$
Clean image vs. Mist + Noisy Upscaling	1.00 ${}^{\textbf{***}}$	0.92 ${}^{\textbf{***}}$	0.93 ${}^{\textbf{***}}$	0.60	0.58	0.85 ${}^{\textbf{***}}$

TABLE XV: Proportion of image pairs in Study 1 where the clean image has better utility than the corresponding counterpart generated image given a Mist-protected or denoised input.

{}^{\textbf{**}}

indicates that the corresponding proportion is statistically significant with

p<0.001

and

{}^{\textbf{***}}

indicates

p<0.0001

	Proportion of image pairs where GPT-4o image has better utility
	Quality metrics ↑		Concept-appropriateness metrics ↑
	Noise	Artifacts	Detail	Concept fit	Prompt fit	Overall realism
GPT-4o vs. LightShed	1.00 ${}^{\textbf{***}}$	0.94 ${}^{\textbf{***}}$	0.87 ${}^{\textbf{***}}$	1.00 ${}^{\textbf{***}}$	0.94 ${}^{\textbf{***}}$	0.94 ${}^{\textbf{***}}$
GPT-4o vs. Noisy Upscaling	1.00 ${}^{\textbf{***}}$	0.89 ${}^{\textbf{***}}$	1.00 ${}^{\textbf{***}}$	1.00 ${}^{\textbf{***}}$	1.00 ${}^{\textbf{***}}$	0.95 ${}^{\textbf{***}}$

TABLE XVI: Proportion of image pairs in Study 2 where the generated image when attacked with GPT-4o has better utility than the corresponding image attacked with Noisy Upscaling or LightShed.

{}^{\textbf{***}}

indicates that the corresponding proportion is statistically significant with

p<0.0001

Fig. 14 : An example of a training phase pair. The right image is an example of a control image as it is not concept-appropriate, showing a car instead of a cat.

Fig. 15 : An example image pair and 2 of the 6 questions presented to participants. The right image is the image generated with GPT-4o, which the participant is unaware of.

	Performance		Denoising Utility
Protection	Inv. Dist. ↓	TPR@MAE = 68.48 ↓	CLIP FID ↓	BRISQUE ↓
UnMarker (HL)	0.0162	0.9011	6.774	62.969
UnMarker (L)	0.0166	0.9560	5.771	7.728
FLUX	0.0153	0.7912	11.549	13.958
GPT-4o	0.0149	0.6813	12.559	8.002
UnMarker (CHL)	0.0140	0.1758	8.785	67.552

TABLE XVII: Full denoising results for UnMarker, FLUX, and GPT-4o on TRW. This table shows both the 0% and 10% crop settings.

Attacker	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓
UnGANable Cloak v1	100.0%	33.819	0.943	0.0004
+ SDXL C6 Denoising	82.4%	29.155	0.928	0.0013

TABLE XVIII: The performance and utility of Cloak v1 vs. Cloak v1 with an SDXL countermeasure. The countermeasure fails to add significant protection to images that were unsuccessfully cloaked and harms utility.

Attacker	TPR@ Sign. ↓	KID ↓	PSNR ↑	SSIM ↑	LPIPS ↓
SIREN Coating	0.991	0.078	36.040	0.816	0.030
+ FLUX	0.000	0.069	36.866	0.827	0.029

TABLE XIX: The performance and utility of SIREN vs. SIREN with a FLUX countermeasure. Adding the countermeasure reduces the protection to 0.

Fig. 17 : Loss curve for SIREN with and without the countermeasure. With the countermeasure, loss values increase and fluctuate (right). Without the countermeasure, the loss properly minimizes resulting in effective SIREN coating (left).

FLUX	TPR@FPR ↓	PSNR ↑	SSIM ↑	KID ↓
Strength 0.05	0.982	32.399	0.894	0.0198
Strength 0.15	0.258	28.042	0.775	0.0196
Strength 0.25	0.002	25.944	0.703	0.0214

TABLE XX: Strength ablation for PRC Watermark. Modifying the strength shows a tradeoff between performance and utility.

FLUX	TPR@Sign. ↓	KID ↓	PSNR ↑	SSIM ↑	LPIPS ↓
Strength 0.25	0.089	0.066	31.748	0.828	0.034
Strength 0.35	0.016	0.071	28.882	0.787	0.050
Strength 0.45	0.000	0.079	26.188	0.731	0.075

TABLE XXI: Strength ablation for SIREN. Modifying the strength shows a tradeoff between performance and utility.

Attacker	TPR@FPR ↓	PSNR ↑	SSIM ↑	KID ↓
SD1.5	0.862	23.334	0.612	0.0244
SDXL	0.004	24.172	0.657	0.0144
SD3	0.286	25.656	0.701	0.0187
FLUX	0.420	28.478	0.791	0.0199

TABLE XXII: No-prompt denoising results for PRC Watermark. The no-prompt result has a higher TPR@FPR than the with prompt result.

Attacker	TPR@FPR ↓	PSNR ↑	SSIM ↑	LPIPS ↓	KID ↓
SD1.5	0.987	22.863	0.650	0.203	0.0002
SDXL	0.774	23.269	0.682	0.204	0.0008
SD3	0.854	23.911	0.691	0.179	0.0003
FLUX	0.956	27.415	0.797	0.132	0.0001

TABLE XXIII: No-prompt denoising results for VINE-R. The no-prompt result has a higher TPR@FPR than the with prompt result.

Attacker	TPR@Sign. ↓	KID ↓	PSNR ↑	SSIM ↑	LPIPS ↓
SD1.5	0.120	0.091	22.401	0.812	0.121
SDXL	0.000	0.101	22.541	0.745	0.119
SD3	0.015	0.096	23.179	0.636	0.111
FLUX	0.472	0.079	29.243	0.827	0.054

TABLE XXIV: No-prompt denoising results for SIREN. The no-prompt result has a higher TPR@Significance than the with prompt result.

	$\epsilon=$ 0.06
Attacker	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓
SD3	77.78%	31.488	0.937	0.0007
FLUX	76.07%	31.552	0.941	0.0007
SDXL	63.68%	30.726	0.925	0.0010
Supervised SDXL	69.66%	25.302	0.873	0.0034

TABLE XXV: Supervised results for UnGANable. Supervised SDXL does not outperform SD3.

	$\epsilon=$ 0.05				$\epsilon=$ 0.06				$\epsilon=$ 0.07
SD3	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓
Prompt C1	68.21%	31.672	0.939	0.0007	67.09%	31.204	0.931	0.0008	61.96%	30.679	0.921	0.0009
Prompt C2	77.44%	31.923	0.943	0.0007	72.65%	31.495	0.937	0.0007	68.48%	31.044	0.929	0.0008
Prompt C3	73.33%	31.632	0.939	0.0007	65.81%	31.108	0.930	0.0010	63.04%	30.579	0.920	0.0013
Prompt C4	77.44%	31.820	0.942	0.0007	67.09%	31.351	0.935	0.0008	67.39%	30.870	0.926	0.0008
Prompt C5	70.26%	31.671	0.939	0.0007	63.68%	31.193	0.931	0.0008	61.96%	30.640	0.921	0.0009

TABLE XXVI: Prompt ablation for UnGANable. C2 and C6 are the best performing prompts.

	$\epsilon=$ 0.05				$\epsilon=$ 0.06				$\epsilon=$ 0.07
Attacker	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓	Matching Rate ↑	PSNR ↑	SSIM ↑	MSE ↓
SD1.5	68.21%	31.314	0.936	0.0008	66.24%	30.870	0.928	0.0009	64.13%	30.402	0.919	0.0009
SDXL	75.38%	32.513	0.948	0.0006	74.79%	32.064	0.941	0.0006	72.46%	31.580	0.935	0.0007
SD3	73.85%	31.909	0.943	0.0007	70.94%	31.432	0.935	0.0007	68.12%	30.940	0.927	0.0008
FLUX	76.92%	32.150	0.947	0.0006	76.07%	31.708	0.940	0.0007	72.10%	31.238	0.932	0.0008

TABLE XXVII: No-prompt denoising results for UnGANable. The no-prompt result for SD3 has a lower Matching Rate than the with prompt result.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 448 papers

WildFakeToolBench: Benchmarking AI-Generated Image Detectors with Web-Sourced Image Processing
Oct 22, 2026Mingjie Li, Yukun Jiang, Yicong Tan +1Adversarial Attacks on AI-Generated Image Detectors AI-Generated Image Detection
CISPA Helmholtz Center for Information Security
SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data
Aug 13, 2026Yicheng Bao, Xiahui Guo, Xuhong Wang +1Adversarial Training Adversarial Examples
1East China Normal University · 2Shanghai Artificial Intelligence Laboratory
GlobalForge: Towards Robust AI-Generated Image Detection
Jul 16, 2026Manni Cui, Ruiqi Liu, Dianyuan Zou +8Image Corruption Robustness Neural Network Robustness
1Huazhong University of Science and Technology · Institute of Automation, Chinese Academy of Sciences · 3Jilin University +1

Oct 22, 2026J/K move · Enter open · S save

WildFakeToolBench: Benchmarking AI-Generated Image Detectors with Web-Sourced Image Processing

Mingjie Li, Yukun Jiang, Yicong Tan, Yang Zhang

CISPA Helmholtz Center for Information Security

Adversarial Attacks on AI-Generated Image Detectors AI-Generated Image Detection Black-Box Adversarial Attacks

Open paper AskPDF arXiv

As AI generated images are getting popular these days, discussions on such generations are widely existed in current public forums, software repositories, and photography tutorials. Moreover, with the help of LLM-assisted code translation, malicious actors can adopt such information to evade detectors without specialized knowledge or local GPU execution of the resulting tools. To evaluate such risks, we introduce WildFakeToolBench, a benchmark suite of

156

executable image-processing tools derived from

220

public sources across

142

domains. Each tool retains its source evidence and passes syntax, execution, and output-distortion checks without using feedback from the evaluated detectors. On

105

generated images from five generators, we evaluate six state-of-the-art detectors with images processed by the tools in our collected bench to assess their effectiveness against such in-the-wild risks. The strongest individual tools achieve attack success rates of

25.25\%

100\%

across detectors, exceeding the strongest of six selected image-processing baselines for each detector. Evaluating subsets of an eight-tool pool yields worst-case coverage above

80\%

for every detector. Effectiveness is sparse and detector-specific: high coverage across candidates does not imply reliable one-shot evasion. These findings not only highlight the potential of such web-sourced risks, but also show the potential on establishing AI-image detector robustness evaluation framework based on those in-the-wild information.

Abstract

Adversarial Attacks

Explore similar work

WildFakeToolBench: Benchmarking AI-Generated Image Detectors with Web-Sourced Image Processing

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data

GlobalForge: Towards Robust AI-Generated Image Detection