Adversarial Attacks on AI-Generated Image Detectors

Latest papers

10 papers2 papers in the last four weeks, against 1 the four weeks before. 0.0% of all new papers.

Can Pixels Alone Reveal Image Origin? Minimax Limits and Learnable Interfaces for Passive Provenance
Sep 25, 2026Kai YaoAdversarial Attacks on AI-Generated Image Detectors Digital Image Forensics
School of Informatics University of Edinburgh
Fusion Under Component Failure: Negative Results and Failure Modes in Ensemble AI-Generated Image Detection
Sep 23, 2026Suraj Singh, Tushar Verma, Pragyan Singh +2Adversarial Attacks on AI-Generated Image Detectors AI-Generated Image Detection
Training-Free Reconstruction-Based AI-Generated Image Detectors Are Inherently Vulnerable to Adversarial Examples
Aug 17, 2026Roman Demchenko, Jonas Ricker, Asja FischerAdversarial Attacks on AI-Generated Image Detectors AI-Generated Image Detection
Ruhr University Bochum, Bochum, Germany
SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data
Aug 13, 2026Yicheng Bao, Xiahui Guo, Xuhong Wang +1Adversarial Training Adversarial Examples
1East China Normal University · 2Shanghai Artificial Intelligence Laboratory
TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors
Jul 28, 2026Xia Du, Zhuosen Bao, Zheng Lin +4Adversarial Attacks Transfer-Based Adversarial Attacks
School of Computer and Information Engineering, Xiamen University of Technology, Xiamen, 361000, China · Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg, L-1855 Luxembourg, Luxembourg · School of Computer Science, Engineering Research Center of Machine Learning and Industry Intelligence, Sichuan University, Chengdu, China, 610020, China +2
Ghosts Beneath Textures: Texture-Relation Cues for Cross-Paradigm AI-Generated Image Detection
Jul 4, 2026Haoyu Wang, Yiming Qin, Zhongjie Ba +4AI-Generated Image Detection Adversarial Attacks on AI-Generated Image Detectors
State Key Laboratory of Blockchain and Data Security, Zhejiang University · Alibaba Group
TextFake: Benchmarking AI-Generated Image Detection on Text-Rich Images
May 31, 2026Yuning Zhang, Changtao Miao, Mingyu Liao +5AI-Generated Image Detection Adversarial Attacks on AI-Generated Image Detectors
School of Cyber Science and Technology, University of Science and Technology of China · Anhui Province Key Laboratory of Digital Security · Individual Researcher
Fragile Reconstruction: Adversarial Vulnerability of Reconstruction-Based Detectors for Diffusion-Generated Images
Apr 14, 2026Haoyang Jiang, Mingyang Yi, Shaolei Zhang +4Adversarial Attacks on AI-Generated Image Detectors AI-Generated Image Detection
Renmin University of China, Beijing, China · Tencent Inc., Shenzhen, China
The Deployment Gap in AI Media Detection: Platform-Aware and Visually Constrained Adversarial Evaluation
Apr 7, 2026Aishwarya Budhkar, Trishita Dhara, Siddhesh ShethAdversarial Attacks on AI-Generated Image Detectors AI-Generated Image Detection
Ace Rent a Car
Adversarial Robustness of AI-Generated Image Detectors in the Real World
Oct 2, 2024Sina Mavali, Jonas Ricker, David Pape +2Adversarial Attacks Adversarial Robustness
CISPA Helmholtz Center for Information Security, Saarbrücken, Germany · Ruhr University Bochum, Bochum, Germany

Sep 25, 2026J/K move · Enter open · S save

Can Pixels Alone Reveal Image Origin? Minimax Limits and Learnable Interfaces for Passive Provenance

Kai Yao

School of Informatics University of Edinburgh

Adversarial Attacks on AI-Generated Image Detectors Digital Image Forensics AI-Generated Image Detection Adversarial Attacks Black-Box Adversarial Attacks

Open paper AskPDF arXiv

Passive image provenance asks whether pixels alone can reveal where an image came from: a human, an aggregate AI class, or a particular generator. This becomes a robustness problem once a source image can be edited before the verifier sees it. We study the problem as source--target verification under adversarial distribution shift. Our first result gives the exact best-case limit for any image-only verifier: the largest robust target-acceptance gap equals the minimum total-variation distance between the target distribution and the set of attacked source distributions. This quantity depends on the source, target, and edit class, not on the verifier architecture. Our second result explains why deployed public verifiers can fail before this statistical limit is reached. If the verifier can be emulated on the attack region to error

\varepsilon

, then a surrogate black-box attack reaches target acceptance within

2\varepsilon

plus optimization error of the white-box optimum; score-revealing logistic and softmax heads over public features are identifiable, and approximate score access gives stable recovery bounds. A finite-state experiment checks the minimax identity where both sides are computable. On same-prompt real/diffusion benchmarks, the evaluated public CLIP verifiers fail under targeted pixel attacks, while a ResNet-18 victim exhibits partial fake-to-real transfer. Binary feedback with abstention reduces measured attack success, but positive empirical gap upper bounds do not establish robustness. These results motivate separate evaluation of the source--target statistical ceiling and the information released by a deployed verifier.