ARMOR++: Agentic Reasoning for Method Orchestration and Reparameterization in Transferable Black-Box Attacks on Deepfake Detectors

Research Question and Approach

Deepfake detectors often rely on fragile, architecture-specific forensic cues, making them vulnerable to adversarial transfer attacks. Existing transfer attacks frequently struggle with semantic awareness and often fail when moving from convolutional surrogates to transformer-based targets. This paper introduces ARMOR++, a multi-agent framework designed to improve the transferability of black-box attacks. The authors formulate attack generation as a closed-loop process where a Vision-Language Model (Qwen2.5-VL) provides spatial semantic priors, and a Large Language Model (Qwen3) orchestrates the selection and reparameterization of five distinct attack primitives: dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structured modifications.

Methodology

ARMOR++ operates under a strict no-query threat model, meaning the attacker has no access to the target detector's feedback during the optimization process. The framework uses a multi-agent architecture where specialized agents handle different tasks: an Analysis Agent generates semantic priors, a Conductor Agent sets global constraints, Method Agents execute the five primitives, and a Mixer Agent performs entropy-regularized perturbation synthesis. By integrating frequency-domain (SSA) and block-structured (BSR) primitives alongside traditional spatial and optimization-based methods, the framework targets a wider range of inductive biases, specifically addressing the differences between CNNs and Vision Transformers (ViTs).

Rigorous evaluation on the AADD-2025 benchmark shows that ARMOR++ significantly outperforms both agentic and non-agentic baselines across various image quality regimes. Statistical analysis, including McNemar tests with Holm–Bonferroni correction, confirms that the framework achieves a substantial gain in blind-target Attack Success Rate (ASR). The results demonstrate that agentic orchestration is highly effective at identifying latent vulnerabilities in deepfake detectors, particularly when the attack is semantically guided and utilizes a diverse set of perturbation domains.