ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors

Source: arXiv:2607.21897 · Published 2026-07-24 · By Jiale Zhao, Jiajun Wan, Lei Tang, Ye Qin, Kebing Jin, Jinghui Qin

TL;DR

This paper identifies a fundamental vulnerability in current deepfake detection methods: they rely primarily on digital synthesis artifacts and ignore authentic physical imaging signatures embedded by camera hardware sensors and Image Signal Processing (ISP) pipelines. The authors observe that real photographs carry unique hardware-intrinsic statistical signatures, notably signal-dependent shot noise and Gaussian read noise in the RAW domain, which generative models fail to replicate. Building on this insight, the paper proposes ISPCloak, an optimization-free adversarial attack that implants realistic sensor noise onto AI-generated images by projecting them into the RAW domain using an invertible ISP network, injecting Poisson-Gaussian noise, and reconstructing the perturbed image through a forward ISP pipeline.

ISPCloak suppresses generative artifacts first, then injects physically plausible RAW noise modulated by an adaptive masking strategy to preserve visual fidelity. Extensive experiments on multiple datasets (GenImage, WildFake, FaceForensics++) and with four heterogeneous forensic detectors show that ISPCloak achieves higher attack success rates (ASR) than gradient- or diffusion-based attacks while producing imperceptible perturbations and operating orders of magnitude faster. The physical grounding in sensor noise physics grants the attack strong cross-model transferability and realism, exposing a crucial blind spot in existing digital-only deepfake detection defenses.

Key findings

• ISPCloak achieves mean black-box attack success rate (ASR) of 86.59% on GenImage against AIDE detector, surpassing StealthDiffusion's 86.50% and outperforming PGD (80.67%) and DiffAttack (35.36%).
• On WildFake dataset, ISPCloak achieves 99.74% mean ASR on SAFE detector, significantly better than PGD's 73.36% and StealthDiffusion's 20.74%.
• On FaceForensics++, ISPCloak attains 95.60% ASR against SAFE, outperforming PGD's 90.80% and Diff-PGD's 84.80%.
• Physical noise injection in RAW domain with signal-dependent Poisson-Gaussian noise followed by invertible ISP reconstruction produces imperceptible perturbations with PSNR > 40 dB and SSIM > 0.99.
• ISPCloak requires no iterative optimization or gradient access, running in tens of milliseconds on NVIDIA RTX 4090, dramatically faster than gradient/diffusion-based baselines requiring multiple iterations.
• Adaptive masking allocates noise perturbations to texture-rich regions and suppresses in flat areas, improving visual fidelity and preserving semantic content.
• Transferability to diverse detectors including CNN-, Transformer-, and vision-language model-based forensic architectures is stronger for ISPCloak compared to gradient-based attacks, demonstrating less overfitting.
• Perturbations emulate real sensor noise physics (Poisson shot noise variance proportional to signal intensity) missing from AI-generated images, enabling fundamental camouflage undetectable by current feature-based forensic detectors.

Threat model

The adversary can manipulate AI-generated images to evade deepfake detectors but cannot alter actual camera hardware or RAW sensor acquisition processes. They have white-box access to the invertible ISP network and noise model to craft perturbations but face black-box detectors with unknown architectures. The attack assumes no physical presence on the device capturing real images, relying solely on post-processing to inject realistic sensor noise signatures into synthetic images.

Methodology — deep read

The authors begin with a threat model in which the adversary generates AI-synthesized images and aims to fool black-box deepfake detectors that rely primarily on digital synthesis artifacts. The attacker can manipulate images but cannot alter underlying hardware sensor characteristics authentically. The method assumes access to a pretrained invertible ISP network enabling mapping RGB images back to RAW sensor domain and forward.

Datasets used include GenImage (8,000 samples from diffusion and GAN models), WildFake (8,000 diverse real-world sourced images), and FaceForensics++ (images with localized facial manipulations). Detectors evaluated cover a range of forensic architectures: AIDE, SAFE, C2P-CLIP, and LGrad, representing spatial, frequency, gradient, and cross-modal forensic cues. Attack success rate (ASR) is the primary metric in transfer-based black-box settings.

ISPCloak pipeline steps:

1. Generative Artifact Suppression: A pretrained DnCNN denoising CNN extracts high-frequency synthetic artifacts from an AI-generated image. A gradient-based adaptive mask modulates suppression intensity to reduce visible distortion by focusing suppression on texture-rich regions.
2. Inverse ISP Mapping: The artifact-suppressed RGB image is projected into the RAW domain using the invertible ISP network, which converts 3-channel RGB into Bayer-mosaiced RAW data, approximating the original sensor measurement domain.
3. Physical Noise Injection: Within the RAW domain, signal-dependent Poisson shot noise (variance proportional to pixel intensity) and signal-independent Gaussian read noise are added. Noise levels are controlled by scaling coefficients (σ_p=0.09, σ_g=0.075) and the perturbation is clipped within physically realistic bounds (ϵ=0.006). An adaptive mask allocates noise preferentially to detailed regions to preserve visual quality.
4. Forward ISP Reconstruction: The noisy RAW data undergoes the learned forward ISP transform including demosaicing, white balance, tone mapping, etc., to produce the final adversarial RGB image. This injects complex spatial and spectral correlations into the image noise pattern matching authentic physical sensor noise.

This pipeline is completely feedforward, requiring no gradient calculations or iterative optimization, enabling ultra-fast adversarial example generation (tens of milliseconds on an RTX 4090 GPU).

Evaluation protocol involves black-box transfer attacks where ISPCloak perturbations generated with one surrogate ISP and noise model are tested against heterogeneous unseen detectors without fine-tuning. Comparisons include classical PGD, diffusion-based Diff-PGD, StealthDiffusion, and latent-space DiffAttack baselines, assessing ASR, PSNR/SSIM for visual quality, and inference speed. Ablations include varying masking parameters and noise scales.

For reproducibility, the authors commit to releasing code, original images, and adversarial examples publicly. The invertible ISP network architecture follows previous work [46], details of which are referenced but not fully disclosed in this summary. Noise parameters are fixed, and evaluation uses fixed random seeds to ensure consistency.

One example end-to-end: A generated image is first passed through DnCNN to extract synthetic artifact residuals. Using gradient magnitudes, an adaptive mask modulates subtraction of residuals to produce artifact-suppressed image. This is mapped back to RAW via InvISP. Poisson-Gaussian noise is sampled and added in RAW domain, clipped to ϵ bounds. The forward ISP function reconstructs the final RGB adversarial example, which visually resembles a camera-captured photo including realistic sensor noise, fooling the detector in a single forward pass.

Technical innovations

• Introduction of an optimization-free adversarial attack pipeline using invertible ISP networks to operate in RAW sensor domain rather than RGB or latent space.
• Injection of physically realistic, signal-dependent Poisson-Gaussian noise in the RAW domain to emulate authentic sensor noise physics missing from AI-generated images.
• Adaptive gradient-based masking to allocate perturbations preferentially in texture-rich regions, balancing imperceptibility and perturbation effectiveness.
• Demonstration that forensic detectors relying on digital artifact features fail against physically grounded RAW-domain perturbations, revealing a fundamental blind spot.

Datasets

• GenImage — 8,000 images from diffusion and GAN-based generative models — public
• WildFake — 8,000 diverse real-world images from various sources — public
• FaceForensics++ — images with localized facial manipulations — public

Baselines vs proposed

• On GenImage dataset/AIDE detector: PGD ASR = 80.67% vs ISPCloak ASR = 86.59%
• On GenImage/SAFE: StealthDiffusion ASR = 22.49% vs ISPCloak 81.54%
• On WildFake/SAFE: PGD ASR = 73.36% vs ISPCloak 99.74%
• On WildFake/AIDE: Diff-PGD ASR = 65.79% vs ISPCloak 97.05%
• On FaceForensics++/SAFE: PGD ASR = 90.80% vs ISPCloak 95.60%

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.21897.

Fig 1: Overview of our proposed physical noise injection framework. (a) Motivation: Real photographs inherently follow

Fig 2 (page 2).

Fig 3 (page 2).

Fig 4 (page 2).

Fig 5 (page 2).

Fig 6 (page 2).

Fig 7 (page 2).

Fig 8 (page 2).

Limitations

• Reliance on a pretrained invertible ISP network which may not fully generalize across all camera hardware pipelines or RAW formats.
• Experiments focus on image-level detection; localized or temporal forensic techniques on video deepfakes remain less explored.
• Physical noise model parameters are fixed; adapting to varying sensor types or real-world capture settings may require tuning.
• Does not evaluate robustness against adversarially trained detectors explicitly aware of physical sensor noise features.
• The adaptive masking parameters are empirically chosen; no extensive user studies to quantify perceptual thresholds.
• The invertible ISP mapping and noise injection may introduce subtle artifacts or color shifts undetected by standard perceptual metrics.

Open questions / follow-ons

• How effective is ISPCloak against forensic detectors trained explicitly to detect physical sensor noise inconsistencies or those augmented with physical realism?
• Can the approach adapt to video deepfakes where temporal consistency and sensor noise patterns may differ?
• What is the impact of varying ISP pipelines and real camera hardware diversity on attack generalization?
• Can defenses leverage physics-based forensic features to detect ISPCloak-style physically grounded attacks?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, ISPCloak highlights a crucial blind spot in deepfake detection: reliance solely on digital synthesis artifacts is insufficient against adversaries who embed authentic physical sensor noise fingerprints. Methods purely analyzing RGB or pixel-level statistics may be bypassed by attack strategies that reproduce camera intrinsic noise in the RAW domain. This calls for integrating physical-layer analysis within forensic detectors to verify hardware-consistent statistical signatures.

Practitioners designing bot or forgery detection systems should consider modeling the pipeline of physical image acquisition, including sensor noise characteristics and ISP processing, to detect or even exploit such physical camouflage attacks. ISPCloak’s demonstrated optimization-free, ultra-fast approach indicates that attackers can feasibly scale such physical realism-based evasion methods, increasing the urgency for defenses that jointly analyze digital and physical image features.

Cite

@article{arxiv2607_21897,
  title={ ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors },
  author={ Jiale Zhao and Jiajun Wan and Lei Tang and Ye Qin and Kebing Jin and Jinghui Qin },
  journal={arXiv preprint arXiv:2607.21897},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.21897}
}

Read the full paper

• arXiv:2607.21897 (abstract)
• arXiv:2607.21897 (PDF)