ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors

Source: arXiv:2607.15246 · Published 2026-07-16 · By Christos Korgialas, Gabriel Lee Jun Rong, Dion Jia Xu Ho, Pai Chet Ng, Xiaoxiao Miao, Konstantinos N. Plataniotis

TL;DR

This paper addresses the transferability and reliability challenges of adversarial attacks against deepfake detectors, specifically in a strict no-query black-box setting. Deepfake detectors often rely on fragile, architecture-dependent forensic cues, making adversarial perturbations optimized on one detector poorly transferable to others, especially across CNN and transformer architectures. Existing attacks lack semantic awareness and multi-domain diversity, limiting their effectiveness under no-query constraints and on high-quality deepfake images. ARMOR++ introduces a novel multi-agent framework that leverages a vision-language model (Qwen2.5-VL) for spatial semantic priors and a large language model (Qwen3) for closed-loop orchestration including primitive selection, adaptive hyperparameter reparameterization, and entropy-regularized mixing of perturbations from a multi-domain primitive set. The five primitives span dense optimization (CW-style), saliency-based modification (JSMA), spatial transformations (STA), frequency-domain perturbations (SSA), and block-structured transformations (BSR), targeting heterogeneous model inductive biases. Rigorous evaluations on the AADD-2025 benchmark comprising low- and high-quality deepfakes show ARMOR++ substantially outperforms prior agentic (ARMOR) and non-agentic baselines in blind-target attack success rate (ASR) against both CNN and transformer detectors under strict no-query protocols. Statistical tests confirm the significance of ASR improvements across multiple datasets, architectures, and robust defensive configurations, exposing a substantial reliability gap in current deepfake detections and demonstrating the efficacy of agentic semantic reasoning and multi-domain perturbation orchestration.

Key findings

• ARMOR++ achieves a blind-target Attack Success Rate (ASR) increase of over 15 percentage points vs the prior agentic baseline ARMOR on AADD-2025 LQ and HQ subsets, under strict no-query constraints.
• Integration of SSA (frequency-domain) and BSR (block-structured) primitives improves transferability to transformer detectors (ViT-B/16, Swin-B), raising ASR by 8–12% compared to spatial-only primitives.
• Adding a third diverse surrogate model (EfficientNet-B4) alongside ResNet-50 and DenseNet-121 lifts transfer success by 4–6%, reducing surrogate overfitting.
• Entropy-regularized mixing of perturbations from five primitives yields a consistent +5% ASR gain over single-primitive or unregularized mixtures.
• ARMOR++ maintains SSIM above 0.9 and ℓ∞ perturbation within 8/255, preserving perceptual quality while reliably evading multiple detector architectures.
• Statistical significance of ASR improvements is confirmed with 95% Wilson confidence intervals and McNemar tests with Holm–Bonferroni corrections.
• Zero-shot transfer on an unseen dataset (DFDC-Preview) achieves ASR above 85%, demonstrating generalization across datasets and attack targets without target queries.
• Failure mode analysis reveals stagnation detection and adaptive constraint relaxation avoid early local minima, improving optimization convergence.

Threat model

The adversary is a strictly no-query black-box attacker with white-box access only to a surrogate ensemble of CNN detectors (ResNet-50, DenseNet-121, EfficientNet-B4). The target deepfake detector (ViT-B/16 or Swin-B transformer) is unknown in architecture and weights, never queried during optimization, candidate mixing, or hyperparameter tuning. The attack produces a single adversarial image that is evaluated once on the blind target for reporting only. The attacker cannot access gradients, logits, or probabilities from the target model and cannot adapt the perturbation based on target feedback. The perturbation budget is bounded in ℓ∞ norm and perceptually constrained by SSIM. The adversary aims to maximize transferability and evade detection by exploiting semantic vulnerabilities in spatial, frequency, and structural domains through multi-agent reasoning and multi-domain perturbations.

Methodology — deep read

The paper formalizes a strict no-query black-box threat model where the adversary has white-box access only to a surrogate ensemble of three detectors (ResNet-50, DenseNet-121, EfficientNet-B4) and no access to the blind target (ViT-B/16 or Swin-B). The target detector is queried exactly once after final perturbation selection, used only for evaluation, never feedback.

Input images are perturbed within an ℓ∞ budget of 8/255 under a perceptual similarity constraint (SSIM ≥ τ), with τ adaptively relaxed if stagnation occurs. The goal is to maximize surrogate ensemble confidence in the 'real' class to evade deepfake detection. The ensemble confidence is averaged across surrogates with uniform weights, and optimized via gradient descent using cross-entropy loss.

The ARMOR++ framework is a multi-agent system integrating a Vision-Language Model (Qwen2.5-VL) that generates a semantic spatial prior mask highlighting forensic vulnerability regions such as blending boundaries and compression artifacts. This mask reweights gradients for spatially focused perturbations. A Large Language Model (Qwen3) guides orchestration via five specialized Method Agents, each implementing a distinct adversarial primitive type that produces candidate perturbations independently.

The five primitives are:

1. CW-style: Dense gradient-based minimization with ℓ2 penalty
2. JSMA: Saliency-driven sparse pixel pair perturbations weighted by semantic mask
3. STA: Smooth spatial transformations optimized for flow regularity
4. SSA: Frequency-domain perturbations simulated via DCT with stochastic augmentation
5. BSR: Block-structured perturbations via local block swapping and rotation

Each primitive produces candidate perturbations under the current ℓ∞ and SSIM constraints. In parallel, Method Agents generate perturbations at every iteration. The Critique Agent scores candidates on ensemble confidence, cross-entropy loss, SSIM violation, and perturbation magnitude. The Strategist Agent detects optimization stagnation and adapts constraint envelopes accordingly. The Advisor Agent proposes adaptive hyperparameter updates per primitive to improve exploration.

The Mixer Agent then solves a convex optimization combining perturbations from all primitives weighted by an entropy-regularized score balancing surrogate confidence, SSIM penalty, ℓ2 perturbation energy, and perturbation diversity. This adaptive mixing allows balancing complementary strengths across domains and avoids stagnation.

Candidates and mixed perturbations are archived and scored across iterations. The master candidate with highest surrogate confidence meeting constraints is selected after a fixed maximum iteration budget (Kmax) for final evaluation.

Evaluation is conducted on the AADD-2025 benchmark with 713 low-quality and 693 high-quality fake images, plus zero-shot testing on a 200-image DFDC-Preview subset. Surrogates and targets are trained on disjoint splits. Baselines include MI-FGSM, DI-FGSM, TI-FGSM, SINI-FGSM, AutoAttack-PGD, and the prior ARMOR agentic attack.

Metrics include Attack Success Rate (ASR), SSIM, perturbation norms, and statistical significance via 95% Wilson intervals and McNemar tests with Holm-Bonferroni correction for multiple comparisons. Ablations isolate individual primitive contributions, semantic analysis, reparameterization, stagnation handling, and entropy-regularized mixing.

The entire system is reproducible in principle but code and pretrained models are not provided in the public repository. The paper details hyperparameters and experimental setups comprehensively.

One concrete example: given a fake input image, semantic regions indicating blending artifacts are extracted by Qwen2.5-VL. Five primitives simultaneously generate candidate perturbations targeting these vulnerable regions using ensemble surrogate gradients. The candidates are critiqued and mixed via entropy-regularized convex weighting guided by Qwen3. If optimization stagnates, hyperparameters and perturbation budgets are adapted dynamically. After Kmax iterations, the highest scoring candidate (on surrogates) is selected without querying the target, then evaluated once on the blind target to assess black-box transferability.

Technical innovations

• Integration of VLM-derived spatial semantic priors with LLM-guided multi-agent orchestration for closed-loop black-box no-query deepfake attack generation.
• Introducing a multi-domain set of five complementary adversarial primitives spanning dense, saliency-based, spatial, frequency-domain, and block-structured perturbations to target diverse detector inductive biases.
• Entropy-regularized convex mixing of multi-primitive perturbations enabling adaptive balance between surrogate confidence, perceptual fidelity, perturbation energy, and primitive diversity.
• Strict enforcement of a no-query black-box transfer protocol eliminating any black-box feedback in mixing or hyperparameter adaptation, stronger than prior agentic attacks.
• Adaptive stagnation detection and constraint relaxation closed-loop enabling dynamic reparameterization and perturbation budget adjustment for robust convergence.

Datasets

• AADD-2025 — 1,406 images (713 low-quality + 693 high-quality) — public benchmark for adversarial deepfake detection evaluation.
• DFDC-Preview (subset) — 200 images — zero-shot transfer evaluation dataset

Baselines vs proposed

• ARMOR (prior agentic baseline): ASR on AADD-LQ = 58.9% vs ARMOR++: 74.4%
• AutoAttack-PGD (non-agentic ensemble attack): ASR on AADD-HQ = 41.7% vs ARMOR++: 60.9%
• MI-FGSM: ASR = 38.5% vs ARMOR++: 74.4% under no-query constraints on ViT-B/16
• DI-FGSM: ASR = 42.2% vs ARMOR++: 74.4% on ViT-B/16 on LQ
• TI-FGSM: ASR = 45.1% vs ARMOR++: 74.4%
• SINI-FGSM: ASR = 49.6% vs ARMOR++: 74.4%
• Ablation - removing SSA primitive reduces ASR by ~7%, removing BSR reduces ASR by ~9%, confirming multi-domain primitive benefits

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.15246.

Fig 1: ARMOR++ pipeline. Semantic analysis initializes the attack state, five Method Agents generate candidates, and deterministic critique, strategy, and

Fig 2: Representative AADD-LQ comparison across eight methods. Each panel shows one adversarial example above its per-detector predictions, with green

Fig 3: Representative AADD-HQ comparison using the layout of Fig. 2. Each panel shows one adversarial example above its per-detector predictions, with

Limitations

• Code release and pretrained models are not provided, limiting reproducibility and external validation.
• Evaluation focuses on only two transformer target architectures (ViT-B/16, Swin-B); generalization to other architectures untested.
• The approach depends on availability of multiple surrogate models; effectiveness may degrade if surrogates poorly approximate the target.
• Semantic priors are derived only from one VLM (Qwen2.5-VL); domain-specific fine-tuning or other VLMs are not explored.
• No explicit robustness evaluation under adaptive adversarially trained or certified defenses beyond two tested defenses.
• Computational cost and inference latency details are limited; real-time or large-scale deployment feasibility unclear.

Open questions / follow-ons

• How well does the approach generalize to different or ensembles of transformer architectures beyond ViT-B/16 and Swin-B?
• Can incorporating multiple vision-language models or fine-tuning VLMs for forensic tasks further boost semantic guidance effectiveness?
• What is the tradeoff between computational cost and attack strength when scaling to larger ensemble surrogates or more primitives?
• How resilient is ARMOR++ to adaptive countermeasures such as adversarial training or certified defenses tailored to multi-domain perturbations?

Why it matters for bot defense

The ARMOR++ framework’s demonstration of strict no-query black-box transferable adversarial attacks guided by semantic reasoning and multi-domain perturbation orchestration provides key insights for bot-defense and CAPTCHA practitioners. The work highlights that deepfake detectors relying on heterogeneous forensic cues and multiple architectures (CNNs and transformers) remain vulnerable to carefully orchestrated adversarial examples without any target queries, exposing blind-spots in forgery detection systems.

For CAPTCHA and bot-defense engineers, the methodology underscores the importance of designing detectors that integrate robust cross-domain features and transformer-based inductive biases with resilience to perturbations crafted across spatial, frequency, and block-structured domains. The use of semantic prior knowledge to guide perturbation can inspire defenses that monitor or regularize latent forensic cues rather than relying solely on end-task accuracy. Additionally, the strict no-query attack model exemplifies a realistic threat scenario without reliance on costly query access, urging the adoption of proactive robustness evaluation protocols during detector development. Lastly, the agentic orchestration and closed-loop hyperparameter adaptation approach could inform automated adversarial robustness testing pipelines in production.

Cite

@article{arxiv2607_15246,
  title={ ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors },
  author={ Christos Korgialas and Gabriel Lee Jun Rong and Dion Jia Xu Ho and Pai Chet Ng and Xiaoxiao Miao and Konstantinos N. Plataniotis },
  journal={arXiv preprint arXiv:2607.15246},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.15246}
}

Read the full paper

• arXiv:2607.15246 (abstract)
• arXiv:2607.15246 (PDF)