MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition

Wonjune Seo; Joonhyuk Baek; Yeseong Jung; Saerom Park

cs.CROct 22, 2026

MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition

Authors: Wonjune Seo, Joonhyuk Baek, Yeseong Jung, Saerom Park

Organizations: Ulsan National Institute of Science and Technology, Ulsan, Republic of Korea

Abstract

Despite recent advances, deepfake detectors remain vulnerable to adversarial examples, particularly in diverse, real-world settings. We propose MIG-COW, a novel adversarial attack framework that generates highly generalizable and visually imperceptible adversarial examples. By combining momentum-integrated gradients with a consensus-orthogonal decomposition, MIG-COW captures both shared and model-specific vulnerabilities across heterogeneous CNN and ViT detectors. On the AADD-2025 Challenge benchmarks, MIG-COW achieves a 99.96% white-box attack success rate (ASR) with high perceptual similarity (SSIM), significantly outperforming existing baselines. However, its limited 7.16% ASR against official black-box targets - despite achieving the best overall score - highlights the ongoing challenge of transferability. We also demonstrate that incorporating low-performing but diverse models in the ensemble can degrade attack effectiveness, underscoring the need for careful surrogate model selection in real-world adversarial settings.

Figures & tables

Figure 1. Overview of the proposed MIG-COW framework. The attack integrates momentum-based integrated gradients and consensus-orthogonal weighting to generate transferable adversarial examples across diverse deepfake detectors.

Figure 2. Comparison of IG visualizations across different model: ResNet50, DenseNet121, ViT-P, MIG, and our proposed method.

Setting	Method	White-box ASR (%)				Black-box ASR (%)			SSIM ↑	Score
Setting	Method	ResNet50	DenseNet121	ViT-P	Avg	ViT-B/16	DenseNet121-DCT	Avg	SSIM ↑	Score
w/o ViT-P	PGD	56.45	60.37	-	58.31	0.50	7.98	4.02	0.9304	1655
	MI-FGSM	88.03	93.94	-	91.00	3.42	9.10	6.26	0.9096	2485
	MIG	96.94	90.02	-	93.48	3.64	9.90	6.77	0.9169	2577
	MIG-COW	100	99.93	-	99.96	3.50	10.83	7.16	0.9143	2747
w/ ViT-P	PGD	57.02	63.64	25.74	48.80	0.64	9.10	4.87	0.9280	1716

Table 1. Comparison of attack methods on white-box and black-box detectors, including average ASR, SSIM, and overall score, where the best results are highlighted in bold, and the second-best results are underlined. The Score is computed based on the four models excluding ViT-P (i.e., ResNet50, DenseNet121, ViT-B/16, and DenseNet121-DCT).

Panel of Figure 3 — Figure 3. Hyperparameter tuning results across perturbation budget $\epsilon$ , steps $T$ , and consensus weight $\mathbf{g}_{\text{con}}$ for ASR(%) and SSIM, which are plotted as solid red and dashed blue lines, respectively, in each graph.

Setting		Detector			SSIM	Score
COW	CE loss	ResNet50	DenseNet121	ViT-P	SSIM	Score
✓		92.37	93.08	94.51	0.9172	3,602
	✓	100	99.93	89.02	0.9168	3,716
✓	✓	99.93	99.93	93.87	0.9161	3,772

Table 2. White-box ablation study. Each detector score indicates performance under different CE loss and COW configurations. The Score is calculated based on the three models presented in the table.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 447 papers

What Makes Adversarial Examples Transfer Across Deepfake Detectors?
Sep 9, 2026Rafael M. Mamede, Pedro C. Neto, Ana F. SequeiraAdversarial Robustness Deepfake Detection
INESC TEC, Porto, Portugal · Faculty of Engineering, University of Porto (FEUP), Porto, Portugal · Unilabs, Porto, Portugal
Detection-Guided Adaptive Purification with Diffusion Models for Robust Audio Deepfake Detection
Oct 7, 2026Muhammed Salih Kayhan, Qiben YanAudio Deepfake Detection Robustness Audio Deepfake Detection
Michigan State University, East Lansing, MI, USA
$μ$ Flow: Leveraging Average Images for Improving Generalisation of Deepfake Faces Detectors
Jun 29, 2026Orazio Pontorno, Mattia Litrico, Luca Guarnera +2Deepfake Detection One-Class Classification
University of Catania, Catania, Italy · University of Nottingham, Nottingham, UK

Sep 9, 2026J/K move · Enter open · S save

What Makes Adversarial Examples Transfer Across Deepfake Detectors?

Rafael M. Mamede, Pedro C. Neto, Ana F. Sequeira

INESC TEC, Porto, Portugal · Faculty of Engineering, University of Porto (FEUP), Porto, Portugal · Unilabs, Porto, Portugal

Adversarial Robustness Deepfake Detection Transfer-Based Adversarial Attacks Black-Box Adversarial Attacks Adversarial Transferability

Open paper AskPDF arXiv

Deepfake detectors remain vulnerable to transfer-based black-box attacks, in which adversarial examples are generated on a source surrogate model and transferred to a target model, unknown to the attacker. Yet how source--target compatibility shapes attack success remains poorly understood. Prior studies evaluate limited detector pools and rarely disentangle architectural from training factors. We conduct a controlled evaluation of adversarial transferability across 60 detectors spanning six backbones, two pretraining regimes, and five training-data configurations, using two attack procedures: AutoAttack (AA) and the Carlini--Wagner attack with Expectation over Transformation (CW--EOT). Matched comparisons reveal significantly higher transfer when source and target share an exact backbone, architecture family, pretraining regime, or training data. This compatibility structure is attack-dependent: exact backbone compatibility has the largest effect under AA, whereas shared pretraining and training data have the largest effects under CW--EOT. When transfer is averaged across non-target sources, mean attack success rate (ASR) is

7.21\%

under AA and

19.52\%

under CW--EOT. By contrast, a multi-source oracle combining both attacks attains a

64.48\%

mean ASR after excluding exact backbone and training-data matches, showing that source averaging can substantially understate target vulnerability. We release 240,000 adversarially perturbed images, complete pairwise transfer results, detector configurations, and evaluation code. These findings establish source--target compatibility and source-model selection as central dimensions of credible transfer-based black-box robustness evaluation.

Abstract

Adversarial Attacks

Explore similar work

What Makes Adversarial Examples Transfer Across Deepfake Detectors?

Detection-Guided Adaptive Purification with Diffusion Models for Robust Audio Deepfake Detection

μμμFlow: Leveraging Average Images for Improving Generalisation of Deepfake Faces Detectors

$μ$ Flow: Leveraging Average Images for Improving Generalisation of Deepfake Faces Detectors