Adversarial Deepfake Generation and an Investigation of Purification-Based Adversarial Detection

Authors: Junghyun Kim, Seunghyun Kim, Jiyoung Woo

Published: 2026-07-28 15:19:16+00:00

Comment: Accepted at CLEF 2026, ImageCLEF-Deepfake task. Published in CEUR-WS CLEF 2026 Working Notes

AI Summary

This paper details team 'Go To Germany's' participation in the ImageCLEF 2026 Deepfake Task, focusing on both adversarial deepfake generation and detection. Their generation pipeline achieved high evasion rates against detectors by incorporating a multi-model PGD attack. For detection, they developed an ensemble of specialized detectors but observed high false positives on real images. Additionally, they investigated purification-based adversarial detection, finding that EFFORT with median-3 purification broadly distinguishes adversarial from clean inputs, challenging the simple backbone-preservation hypothesis.

Abstract

This paper describes the participation of team Go To Germany in the ImageCLEF 2026 Deepfake Detection and Generation Task. For the image generation task, we employ FLUX.1-dev with PuLID for identity-preserving face synthesis, combined with a multi-model PGD adversarial attack targeting 12 detectors simultaneously (DiffJPEG-in-loop, MI/DI/EoT, adaptive weighting, two-stage warm-start). Our approach achieved 90% evasion against organizer detectors and 57.6% against participant detectors, with a final generation score of 0.4170. For the image detection task, we combine two complementary detectors - SigLIP+DINOv2 for AI-generated images and GenD-DINOv3 for face manipulations - in a max-probability ensemble, achieving 99.4% accuracy on baseline deepfakes but suffering from high false-positive rates on real images, resulting in a final detection score of 0.6986. Beyond the official submission, we conducted a self-initiated investigation of purification-based adversarial detection, comparing three families of detection signals across six detectors that share a CLIP ViT-L/14 backbone. We find that raw $|Δ\\text{logit}|$ under median-3 purification, applied through the EFFORT detector, separates adversarial inputs from clean inputs with AUROC 0.81-0.98 across four adversarial source types - a finding that refutes the simple backbone-preservation hypothesis and exposes a sharp JPEG-quality cliff at Q70 where the signal collapses.

Key findings

The generation approach achieved 90% evasion against organizer detectors and 57.6% against participant detectors. The detection ensemble achieved 99.4% accuracy on baseline deepfakes but had high false-positive rates on real images (43-57%). Purification-based adversarial detection using raw |Δlogit| under median-3 purification with the EFFORT detector effectively separated adversarial from clean inputs (AUROC 0.81-0.98), refuting the simple backbone-preservation hypothesis and revealing a sharp JPEG-quality cliff at Q70.

Approach

For generation, they used FLUX.1-dev with PuLID for identity-preserving face synthesis, combined with a multi-model PGD adversarial attack. For detection, they employed a max-probability ensemble of SigLIP+DINOv2 for AI-generated images and GenD-DINOv3 for face manipulations. Beyond the competition, they investigated purification-based adversarial detection by analyzing the raw logit shift under median-3 purification across various detectors with a shared CLIP ViT-L/14 backbone.

Datasets

FaceForensics++, BitMind (SDXL, FLUX), ImageCLEF 2026 Deepfake Detection task dataset, custom calibration set (FF++ original frames, generation-task reference videos, self-generated images, BitMind SDXL/FLUX).

Model(s)

FLUX.1-dev, PuLID, SigLIP+DINOv2, GenD-DINOv3, ForAda, GenD CLIP, EFFORT, CLIP ViT-L/14 (for backbone and various fine-tuning strategies: linear probe, LoRA, full fine-tune).

Author countries

South Korea

← Previous