This work proposes two novel attack methods targeted at detectors that leverage autoencoder reconstruction error and finds that by constructing imperceptible adversarial examples, the distance between original and reconstruction can be artificially increased, causing fake images to be wrongly classified as real.
Abstract
The impressive visual quality and ubiquity of AI-generated images call for reliable and robust detection methods. Reconstruction-based detectors have emerged as a promising direction for transparent and training-free identification of synthetic images. However, due to their fundamentally different mode of operation (compared to standard, classifier-based methods), little is known about their adversarial robustness. In this work, we propose two novel attack methods targeted at detectors that leverage autoencoder reconstruction error. We find that by constructing imperceptible adversarial examples, the distance between original and reconstruction can be artificially increased, causing fake images to be wrongly classified as real. Our evaluation including images from three state-of-the-art generators and three detectors demonstrates that detection performance is significantly decreased, even if attacked images additionally undergo real-world degradations. Critically, our adversarial examples naturally transfer across detectors, as they all share the same principle, pointing towards an inherent vulnerability of reconstruction-based detectors.
A method to analyze ANNs designed for image classification from an adversarial robustness perspective and implemented an ablation and fine-tuning strategy that successfully boosted the robustness of the ANNs against a variant of the Auto-PGD attack under different threat models.
The rapid advancement of diffusion models has raised concerns about their misuse in generating deceptive visual content, motivating growing interest in AI-generated image detection. Many existing detection methods rely on image semantic features, but modern diffusion models are optimized to closely match the semantic structure of real images, reducing the effectiveness of semantic-based detection. An alternative line of work exploits differences revealed through diffusion reconstruction; however, most existing approaches treat reconstruction error as a static and passive metric, which can be sensitive to generators or post-processing, thereby limiting robustness. In this work, we propose Adversarial Diffusion Reconstruction Distance (ADRD), a detection framework that models diffusion reconstruction as a dynamic response process rather than a fixed descriptor. ADRD actively probes the reconstruction behavior by introducing perturbation in latent space and measuring how reconstruction deviations respond under identical perturbations. We empirically observe that real images typically exhibit larger and more variable reconstruction responses, while diffusion-generated images tend to show more stable reconstruction behavior, reflecting differences in their alignment with the diffusion model’s implicit data manifold. By characterizing reconstruction sensitivity instead of absolute reconstruction error, ADRD provides a complementary perspective to existing reconstruction-based detectors. Experimental evaluations on multiple benchmarks suggest that reconstruction response under controlled perturbations constitutes a meaningful signal for diffusion-generated image detection. The code is available at https://github.com/ezell-chou/adrd
Yi Zhou, Xiangwei Hu, Jun Tong et al.· PLoS ONE· 0 citations
Deep Neural Networks (DNNs) remain vulnerable to adversarial perturbations, raising significant concerns in image processing applications, particularly in high-stakes domains such as medical imaging and security-critical systems. Most existing defense strategies are limited by domain specificity, architectural dependence, or the need for extensive retraining, making them impractical for real-world deployment. In this work, we propose ADEx, the first framework to integrate low-rank image approximation with explainability-driven analysis for the detection of adversarial samples. ADEx works by extracting a low-rank representation of the input image using Singular Value Thresholding (SVT), and identifying important image regions by computing class-specific gradient maps from the final layers of the classifier. These maps are then compared using Rank-Biased Overlap (RBO) to quantify the degree of attention drift induced by adversarial perturbations. ADEx is designed for adversarial detection in image classification systems, where class-specific gradient-based explanations are well defined. The framework operates without retraining or architectural modification and can be applied to a wide range of differentiable classifiers, provided gradient access is available for explanation generation. Extensive experiments across multiple datasets, architectures, and attack types demonstrate consistent performance, robustness to hyperparameter choices, and low sensitivity to calibration size. The method provides an interpretable and lightweight solution suitable for practical deployment.
Syamantak Sarkar, Nirmal Joseph, Sudhish N. George et al.· IEEE Transactions on Image P...· 0 citations
Overall, GenPix provides a challenging and realistic benchmark for evaluating modern detectors, and the proposed AAE offers an efficient, interpretable baseline for future research on general-purpose fake-image detection.
Guessoum Dalila, B. Nadjia, Boumahdi Fatima et al.· Iraqi Journal for Computer S...· 0 citations
This study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems: transitioning from adversarial to benign regions is significantly easier than the reverse process, where adversarial examples can often be roughly recovered within only 1-2 steps.
