arXiv：cs.AI· Rafael M. Mamede, Pedro C. Neto, Ana F. Sequeira·· 13 小时前
什么决定了对抗样本在 Deepfake 检测器之间的迁移性？
What Makes Adversarial Examples Transfer Across Deepfake Detectors?
AI 导读
研究对 60 个 Deepfake 检测器（涵盖六种骨干网络、两种预训练方式和五种训练数据配置）进行了对抗迁移性的受控评估，发现源与目标模型在骨干网络、架构族、预训练方式或训练数据上匹配时迁移成功率显著更高，且这一兼容性结构依赖于攻击方式。
正文
Abstract:Deepfake detectors remain vulnerable to transfer-based black-box attacks, in which adversarial examples are generated on a source surrogate model and transferred to a target model, unknown to the attacker. Yet how source--target compatibility shapes attack success remains poorly understood. Prior studies evaluate limited detector pools and rarely disentangle architectural from training factors. We conduct a controlled evaluation of adversarial transferability across 60 detectors spanning six backbones, two pretraining regimes, and five training-data configurations, using two attack procedures: AutoAttack (AA) and the Carlini--Wagner attack with Expectation over Transformation (CW--EOT). Matched comparisons reveal significantly higher transfer when source and target share an exact backbone, architecture family, pretraining regime, or training data. This compatibility structure is attack-dependent: exact backbone compatibility has the largest effect under AA, whereas shared pretraining and training data have the largest effects under CW--EOT. When transfer is averaged across non-target sources, mean attack success rate (ASR) is $7.21\%$ under AA and $19.52\%$ under CW--EOT. By contrast, a multi-source oracle combining both attacks attains a \(64.48\%\) mean ASR after excluding exact backbone and training-data matches, showing that source averaging can substantially understate target vulnerability. We release 240,000 adversarially perturbed images, complete pairwise transfer results, detector configurations, and evaluation code. These findings establish source--target compatibility and source-model selection as central dimensions of credible transfer-based black-box robustness evaluation.
| Subjects: | Computer Vision and Pattern Recognition (cs.CV); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | arXiv:2609.10002 [cs.CV] |
| (or arXiv:2609.10002v2 [cs.CV] for this version) | |
| https://doi.org/10.48550/arXiv.2609.10002 arXiv-issued DOI via DataCite |
Submission history
From: Rafael M. Mamede [view email]
[v1]
Wed, 9 Sep 2026 10:28:36 UTC (2,430 KB)
[v2]
Fri, 9 Oct 2026 05:06:59 UTC (2,430 KB)
来源：arXiv：cs.AI · arxiv.org