ARMOR++ is a novel adversarial attack framework that leverages multi-agent orchestration for cross-domain deepfake detection evasion. It uses Qwen2.5-VL to extract spatial semantic priors and Qwen3 LLM to intelligently coordinate five complementary attack primitives—dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block structure modifications—to achieve high-transfer black-box attacks on heterogeneous detectors.

Why does this research matter?

ARMOR++ significantly outperforms existing baselines on the AADD-2025 benchmark with remarkable improvements in blind target attack success rates. It exposes critical reliability gaps in current deepfake detection deployments, showing that detectors relying on fragile architecture-specific forensic cues are vulnerable to LLM-driven adversarial attacks. This warns industry to adopt comprehensive robustness evaluation beyond traditional tests.

What should researchers and practitioners watch next?

The work highlights semantic awareness as crucial for adversarial transfer and underscores the urgent need to develop novel detection architectures resistant to multi-domain, multi-primitive attacks. It encourages exploring deeper semantic features and pushes the field from passive defense toward proactive robustness design for a trustworthy AI content ecosystem.

ARMOR++：基於多智能體編排的跨域深度偽造檢測對抗攻擊框架

本文針對當前深度偽造檢測器在黑盒對抗遷移中可靠性下降的問題，提出了ARMOR++框架。現有方法缺乏語義感知且難以在嚴格無查詢約束下保持有效性，特別是在從卷積代理模型向Transformer目標模型遷移時。ARMOR++利用Qwen2.5-VL提供空間語義先驗，並由Qwen3大型語言模型協調原語選擇、自適應超參數重參數化及熵正則化擾動混合。該框架整合了五種互補的原語，涵蓋密集優化、顯著性方法、空間變換、頻域擾動和塊結構修改，以針對異構歸納偏置。在AADD-2025基準上的實驗表明，ARMOR++在低質量和高質量圖像regime下均顯著優於現有的智能體和非智能體基線，特別是在盲目標攻擊成功率上取得了顯著提升，揭示了當前檢測部署中的重大可靠性缺口。

Sources

arXiv