ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors

Authors: Jiale Zhao, Jiajun Wan, Lei Tang, Ye Qin, Kebing Jin, Jinghui Qin

Published: 2026-07-24 01:59:53+00:00

Comment: Accpted by ACM MM 2026

AI Summary

This paper introduces ISPCloak, an optimization-free adversarial attack framework that weaponizes the Image Signal Processing (ISP) pipeline to mislead deepfake detectors. It exploits the fundamental absence of hardware-intrinsic statistical signatures in AI-generated content by imprinting realistic camera noise through an invertible ISP network projection into the RAW domain. This physical simulation results in universally evasive adversarial examples that maintain imperceptible visual alterations while significantly disrupting deepfake detection mechanisms.

Abstract

The rapid advancement of generative models has spurred the critical need to evaluate the worst-case robustness of deepfake detectors. In this paper, we reveal a fundamental blind spot in current forensic paradigms: while existing detectors excel at capturing digital synthesis artifacts, their effectiveness drops drastically when AI-generated content is cloaked in authentic physical imaging characteristics. We posit that genuine photographs inherently possess hardware-intrinsic statistical signatures, which are imperceptible footprints imprinted by optical sensors and Image Signal Processing (ISP) pipelines, and are fundamentally absent in purely data-driven generative models. Driven by this insight, we propose ISPCloak, a novel optimization-free adversarial attack framework that explicitly weaponizes the ISP pipeline to mislead the judgment of deepfake detectors. Rather than relying on computationally expensive gradient perturbations, our method first employs an Invertible ISP network to project images into the RAW domain. Then, we seamlessly imprint the complex statistical priors of real cameras onto AI-generated images by injecting realistic Poisson-Gaussian sensor noise and conducting forward ISP reconstruction. Synergized with generative artifact suppression and adaptive masking, this streamlined physical simulation enables ultra-fast generation of adversarial examples. Extensive experiments show that embedding authentic physical perturbations fundamentally disrupts a broad range of current detection mechanisms, yielding universally evasive adversarial examples with imperceptible visual alterations.

Key findings

ISPCloak consistently achieves high attack success rates (ASR) across various deepfake detectors and generative models, outperforming optimization-based and diffusion-based attacks. It maintains high visual fidelity with superior PSNR, SSIM, L2 distance, and FID scores compared to baselines. The optimization-free nature leads to significantly faster generation speeds, making it practical for real-time deployment.

Approach

The method first uses a denoising network (DnCNN) to suppress digital generative artifacts. Then, an invertible ISP network projects the image into the RAW domain, where realistic Poisson-Gaussian sensor noise, characteristic of real cameras, is injected. Finally, a forward ISP reconstruction transforms this RAW-domain noise into complex visual alterations, creating an adversarial image that mimics authentic physical imaging characteristics.

Datasets

GenImage, WildFake, FaceForensics++

Model(s)

DnCNN (for generative artifact suppression), Invertible ISP network (for RAW domain projection and reconstruction), ResNet-50, Swin-Transformer, DeiT, EfficientNet (as surrogate models for baseline attacks)

Author countries

China

← Previous