What is ARMOR++ and how does it work?

ARMOR++ is a black-box adversarial attack framework targeting deepfake detectors. It leverages Qwen2.5-VL for spatial-semantic priors and Qwen3 for orchestrating five complementary attack primitives—dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structure modifications—to generate highly transferable adversarial examples.

What key vulnerability does this research reveal about deepfake detectors?

ARMOR++ significantly outperforms existing baselines on the AADD-2025 benchmark in blind-target attack success rate, revealing substantial reliability gaps in current detectors under heterogeneous inductive biases. Even against unknown detectors, it maintains strong transfer, showing existing defenses are insufficient against complex adversarial threats.

What are the implications for improving deepfake detection security?

The research urges industry to account for adversarial risks when deploying detectors and strengthen robustness training. Combining cross-modal semantic understanding with adversarial attack research points toward smarter, adaptive defense systems, while calling for fairer evaluation benchmarks to drive healthy competition between attackers and defenders.

ARMOR++：基於多智能體編排的多域原語遷移攻擊深度偽造偵測器

本文提出 ARMOR++，一種高遷移性黑盒對抗攻擊框架，專門針對深度偽造偵測器。針對現有攻擊缺乏語意感知且難以在嚴格無查詢約束下保持有效性的問題，該框架利用 Qwen2.5-VL 視覺語意模型提供空間語意先驗，並由 Qwen3 大型語言模型編排原語選擇、自適應超參數重參數化及熵正則化擾動混合。透過整合密集優化、顯著性方法、空間變換、頻域擾動和區塊結構修改五種互補原語，ARMOR++ 能有效攻擊具有異構歸納偏置的多樣化偵測器。在 AADD-2025 基準上的實驗表明，ARMOR++ 在高、低品質圖像區域均顯著優於現有智能體及非智能體基線方法，盲目標攻擊成功率大幅提升，揭示了當前偵測器部署的可靠性差距。

Sources

arXiv