💻 computer science

ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors

This paper introduces ARMOR++, a robust multi-agent framework that leverages Qwen2.5-VL and Qwen3 to orchestrate a diverse set of adversarial primitives, achieving significantly higher transferability and attack success rates against deepfake detectors compared to existing state-of-the-art methods under strict black-box constraints.

Original authors: Christos Korgialas, Gabriel Lee Jun Rong, Dion Jia Xu Ho, Pai Chet Ng, Xiaoxiao Miao, Konstantinos N. Plataniotis

Published 2026-07-17

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Christos Korgialas, Gabriel Lee Jun Rong, Dion Jia Xu Ho, Pai Chet Ng, Xiaoxiao Miao, Konstantinos N. Plataniotis

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling art gallery where anyone can paint a picture. For a long time, if you wanted to know if a painting was real or a forgery, you just looked at it with your eyes. But recently, a new kind of magic brush appeared—artificial intelligence—that can paint faces so perfectly that even experts struggle to tell the difference. This has created a high-stakes game of cat and mouse. On one side, we have "detectives" (AI models) trained to spot the tiny, invisible flaws left behind by these magic brushes. On the other side, we have "hackers" trying to trick the detectives by adding just enough noise to a fake face to make it look real to the detective, without actually changing how the face looks to a human. This isn't just about art; it's about trust. If we can't tell what's real, we can't trust our news, our security cameras, or even our own eyes. The big question is: how do we know if our digital detectives are actually reliable, or if they are just easily fooled by a clever trick?

Enter ARMOR++, a new, super-smart "hacker" team designed to test these detectives. Think of deepfake detectors like security guards at a club. Some guards only look at the shape of a person's face (like a Convolutional Neural Network), while others look at the whole picture and how the pieces fit together (like a Vision Transformer). The problem is that a trick that works on one type of guard often fails on the other. Previous attempts to trick these guards were like throwing a single type of rock at a wall; sometimes it worked, but often the wall was too strong or made of a different material.

ARMOR++ is different because it doesn't just throw one rock; it sends in a whole team of specialists who talk to each other. The team is led by two very smart "agents" (computer programs based on large language models). The first agent, the Analyst, looks at the fake face and uses its "eyes" to find the weird spots—like a blurry edge or a strange texture—and says, "Hey, attack here!" The second agent, the Conductor, acts like a coach. It doesn't just pick one attack; it manages a squad of five different "attackers," each with a unique superpower:

The Blender: Adds a smooth, dense layer of noise everywhere.
The Pincher: Tweaks just a few specific pixels to confuse the guard.
The Shifter: Gently warps the face, like stretching a rubber sheet.
The Frequency Wizard: Changes the "colors" of the image in a way humans can't see but computers can (like turning a radio dial).
The Block Shuffler: Cuts the image into puzzle pieces and swaps them around.

What makes ARMOR++ special is that it plays a game of "guess and check" without ever asking the target guard for help. It practices on a set of practice guards (surrogate models) that it knows inside out. It tries out different combinations of its five attackers, listens to its smart agents, and adjusts its strategy in real-time. If an attack isn't working, the team doesn't give up; they change the rules, try a different mix of attacks, and keep going until they find the perfect combination that fools the target guard.

The paper finds that this team-based approach is incredibly effective. When tested on a massive collection of fake faces (the AADD-2025 benchmark), ARMOR++ managed to fool the most advanced "blind" guards (the ones it had never seen before) about 44.3% of the time on low-quality images and 32.1% of the time on high-quality images. To put that in perspective, the previous best team (called ARMOR) only fooled them about 39.6% and 28.3% of the time, and standard "single-attack" methods barely broke 20%.

The researchers also checked if these tricks still worked if the guards had some basic training to resist attacks (like "adversarial training"). Even then, ARMOR++ was the most successful, still fooling the guards about 19.8% of the time, while other methods dropped to near zero. This suggests that even our best current security systems have a significant "blind spot" when it comes to these smart, multi-pronged tricks. The authors conclude that while our detectors are getting better at spotting fakes, they are still not reliable enough to be trusted completely, especially when facing an attacker that can think, adapt, and use many different types of tricks at once. It's a wake-up call: in the race between fake creators and real detectors, the detectors still have a lot of work to do.

Technical Summary: ARMOR++

Problem Statement
The reliability of deepfake detectors is frequently compromised under black-box adversarial transfer, particularly when perturbations optimized on convolutional neural network (CNN) surrogates are applied to transformer-based targets (e.g., ViT, Swin). Existing transfer attacks often lack semantic awareness and struggle to maintain effectiveness under strict no-query constraints. Furthermore, current methods frequently rely on fragile, architecture-dependent forensic cues (such as blending boundaries or high-frequency texture inconsistencies) and fail to address the unique difficulty of deepfake detection, where classifiers exploit weak, localized traces rather than stable object-level categories. Prior agentic approaches, such as ARMOR, are limited by a spatial-only perturbation space, insufficient surrogate diversity, and reliance on black-box probability terms that weaken the no-query protocol.

Methodology: ARMOR++
The paper proposes ARMOR++, a robust multi-agent framework designed for high-transferability deepfake evasion under a strict no-query protocol. The framework integrates a Vision-Language Model (VLM) and a Large Language Model (LLM) to orchestrate method selection and reparameterization without querying the blind target.

Architecture & Agents: The system employs a closed-loop multi-agent architecture:
- Analysis Agent (Qwen2.5-VL): Generates a semantic report identifying facial topologies, texture irregularities, and compression artifacts to create a soft spatial prior ( $M_R$ ).
- Conductor Agent (Qwen3): Initializes global constraints (perturbation budget $\epsilon$ , quality threshold $\tau$ ) and hyperparameters based on the semantic report.
- Method Agents: Execute five complementary primitives in parallel:
  1. CW-style: Dense $\ell_2$ -penalized optimization.
  2. JSMA: Sparse saliency manipulation.
  3. STA: Geometric deformation via smooth spatial warping.
  4. SSA (Spectrum Simulation Attack): Frequency-domain perturbations via DCT augmentation.
  5. BSR (Block-Structured Augmentation): Block-wise shuffling and rotation to disrupt global coherence.
- Advisor Agent: Adapts hyperparameter bounds for each primitive based on historical performance.
- Strategist Agent: Detects optimization stagnation and triggers adaptive relaxation of constraints (increasing $\epsilon$ , decreasing $\tau$ ).
- Mixer Agent: Synthesizes a master candidate by optimizing convex mixing weights ( $w$ ) using an entropy-regularized score that balances surrogate confidence, SSIM violation, perturbation energy, and primitive diversity.
Strict No-Query Protocol: All optimization, reparameterization, and mixing rely exclusively on feedback from a surrogate ensemble ( $F_{surr}$ ). The blind target is queried exactly once, only after the final adversarial example is selected, solely for reporting purposes. This eliminates the use of black-box probability terms ( $p_{bb}$ ) in the mixing score, a limitation of prior work.

Key Contributions

Transferable Agentic Framework: A multimodal, multi-agent architecture for no-query evasion that relies solely on surrogate feedback and LLM-guided reasoning.
Semantically Guided Closed-Loop Orchestration: Integration of VLM-derived spatial priors with LLM-driven stagnation detection, bounded constraint escalation, and adaptive reparameterization.
Multi-Domain Perturbation Space: The inclusion of frequency-domain (SSA) and block-structured (BSR) primitives alongside optimization, saliency, and spatial-transformation attacks to target the spectral and patch-based inductive biases of high-quality (HQ) deepfakes and transformer detectors.
Reliability-Oriented Evaluation: Comprehensive benchmarking on the AADD-2025 dataset (Low-Quality and High-Quality regimes) with rigorous statistical analysis (95% Wilson confidence intervals, McNemar tests) and failure-mode analysis.

Experimental Results
The framework was evaluated on the AADD-2025 benchmark using three CNN surrogates (ResNet-50, DenseNet-121, EfficientNet-B4) and two blind transformer targets (ViT-B/16, Swin-B).

Attack Success Rate (ASR): On the Low-Quality (LQ) regime with ViT-B/16, ARMOR++ achieved an ASR of 44.3%, significantly outperforming the previous agentic baseline ARMOR (39.6%) and the strongest non-agentic baseline AutoAttack-PGD (19.6%).
High-Quality (HQ) Regime: ARMOR++ maintained superior performance in the harder HQ regime (ASR 32.1% on ViT-B/16), preserving its ranking over baselines despite the reduced absolute success rates.
Perceptual Quality: ARMOR++ achieved the highest weighted ASR (wASR), indicating a superior balance between attack success and perceptual fidelity (SSIM $\approx$ 0.69 on LQ, 0.73 on HQ) compared to ensemble methods like AutoAttack-PGD, which suffered significant quality degradation.
Defense Robustness: Under non-adaptive defenses (PGD adversarial training and randomized input resizing), ARMOR++ retained the highest residual ASR (e.g., 19.8% under adversarial training on LQ), demonstrating that standard defenses do not fully mitigate the threat.
Ablation Studies: Removing the semantic analysis agent reduced ASR to 21.8%, while removing the multi-domain primitives (SSA/BSR) or the entropy regularizer resulted in significant performance drops, confirming the necessity of the proposed components.

Significance and Claims
The paper claims that ARMOR++ demonstrates a significant residual reliability gap in current deepfake detector deployments. The results indicate that high clean-data accuracy and standard non-adaptive defenses are insufficient to certify detector dependability under cross-architecture adversarial transfer. By effectively exploiting latent vulnerabilities through agentic orchestration and multi-domain perturbations, the study highlights that forensic classifiers remain vulnerable to systematic, semantically informed attacks. The authors conclude that the proposed framework serves as a rigorous stress test, revealing that current deepfake detection systems are not yet robust enough for security-critical, real-world deployment against sophisticated black-box threats.

More like this