Research map / Adversarial robustness and security / Attacks on text and graphs
TraceEvader: Making DeepFakes More Untraceable via Evading the Forgery Model Attribution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TraceEvader, a training-free, non-box evasion attack that injects a universal imitated trace into high-frequency components and applies Gaussian mean-shift blur to low-frequency components to defeat DeepFake forgery model attribution.
Problem
DeepFake forgery model attribution (model-architecture and model-instance) relies on traces left during generation, and its robustness to evasion in black-box settings is unknown.
Approach
Exploit the distinct roles of high-frequency traces (architecture-consistent) and low-frequency traces (instance-specific): add a CNN-learned universal imitated trace to the high-frequency residual and apply adversarial mean-shift blur to the low-frequency part, without any gradient optimization on the victim attribution model.
Key results
- TraceEvader achieves an average attack success rate of 79.07% across model-architecture and model-instance attribution techniques.
- Against DNA-Det it reaches average ASR 97.95% and against Reverse 90.6%, outperforming baselines.
- Under intentional denoising, the average ASR remains around 75%, per the abstract.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply TraceEvader to fake images across GANs and diffusion models | TraceEvader · Model attribution across 8 forgery models | attack success rate: 79.07% | Helped |
| Apply TraceEvader to evade model-architecture attribution | TraceEvader · Model-architecture attribution | attack success rate: 83.6% | Helped |
| Apply TraceEvader to evade DNA-Det | TraceEvader · DNA-Det | attack success rate: 97.95% | Helped |
| Increase λ to 0.02 for SNGAN | TraceEvader · SNGAN, DCT | attack success rate: 80.5% | Helped |
| Apply TraceEvader to evade AttNet | TraceEvader · AttNet | attack success rate: 50.9% | Helped |
| Use denoising autoencoder reconstruction on TraceEvader samples | TraceEvader samples · AttNet and model-attribution methods | attack success rate: 73.4 -> 75; 65.4 -> 65.9; 100 -> 75; 50.1 -> 84 | Mixed |
| Add Gaussian noise to TraceEvader samples | TraceEvader · Common image transformations | attack success rate | Helped |
| Apply extremely heavy JPEG compression to TraceEvader samples | TraceEvader · Common image transformations | attack success rate | Hurt |
Surprising findings
- Removing high-frequency content alone does not fully defeat AttNet; its model-instance traces are concentrated in low-frequency semantic regions.
- Adding Gaussian noise to adversarial samples does not degrade attack success and can even increase it.
Limitations
- Weaker ASR against DCT on some generators, e.g., SNGAN, requiring a larger perturbation weight.
- Attack success drops against AttNet after retraining, to around 50.9% average.
- Denoising with a trained denoising autoencoder partly reduces effectiveness, though ASR stays high.
Experimental setup
Datasets: fake images from GANs and diffusion models real images
Benchmarks: DNA-Det Reverse DCT AttNet
Metrics: attack success rate (ASR) PSNR SSIM
Baselines: BIM MI-FGSM peak attack FakePolisher
Builds on: universal adversarial perturbations ambiguity attack Gaussian blurring mean shift BIM MI-FGSM
Closest papers by meaning
- Exposing the Deception: Uncovering More Forgery Clues for Deepfake Detection (AAAI 2024 · similarity 0.88)
- Exploring Unbiased Deepfake Detection via Token-Level Shuffling and Mixing (AAAI 2025 · similarity 0.87)
- DF40: Toward Next-Generation Deepfake Detection (NeurIPS 2024 · similarity 0.86)
- DiffusionFake: Enhancing Generalization in Deepfake Detection via Guided Stable Diffusion (NeurIPS 2024 · similarity 0.86)
- FreqBlender: Enhancing DeepFake Detection by Blending Frequency Knowledge (NeurIPS 2024 · similarity 0.86)
- Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.