The impressive visual quality and ubiquity of AI-generated images call for reliable and robust detection methods. Reconstruction-based detectors have emerged as a promising direction for transparent and training-free identification of synthetic images. However, due to their fundamentally different mode of operation (compared to standard, classifier-based methods), little is known about their adversarial robustness. In this work, we propose two novel attack methods targeted at detectors that leverage autoencoder reconstruction error. We find that by constructing imperceptible adversarial examples, the distance between original and reconstruction can be artificially increased, causing fake images to be wrongly classified as real. Our evaluation including images from three state-of-the-art generators and three detectors demonstrates that detection performance is significantly decreased, even if attacked images additionally undergo real-world degradations. Critically, our adversarial examples naturally transfer across detectors, as they all share the same principle, pointing towards an inherent vulnerability of reconstruction-based detectors.
Figures & tables
Figure 1: AUROC of the detectors under the proposed attack on the three selected datasets.
Figure 2: AUROC of the detectors under the proposed attack targeting the selected AEs.
Figure 3: AUROC of different attack variants and distortions in relation to the image quality.
Figure 4: The mean performance of all three detectors measured in AUROC under the proposed attack with various ϵ -budgets under JPEG and Blur.
Figure 5: AUROC of the detectors under the proposed attack on the three selected datasets using MSE distance.
Figure 6: AUROC of the detectors using the SD2 AE under the proposed attack on the Midjourney dataset.