Adversarial Deepfake Generation and an Investigation of Purification-Based Adversarial Detection

This paper details the participation of team "Go To Germany" in the ImageCLEF 2026 Deepfake Detection and Generation Task. The authors present a dual-track approach: a sophisticated image generation pipeline using FLUX.1-dev and PuLID, and a robust detection ensemble. Beyond the competition, the researchers conducted an investigation into the vulnerability of vision foundation models to adversarial attacks and the efficacy of purification-based detection methods.

The generation pipeline employs a multi-model Projected Gradient Descent (PGD) attack that simultaneously targets 12 different detectors. To ensure the generated deepfakes remain effective across various detection architectures, the authors integrated several techniques into their attack loop, including differentiable JPEG simulation (Diff JPEG-in-loop), Input Diversity (DI), and Expectation over Transformation (EoT). This multi-stage approach achieved high evasion rates, exceeding 95% on 15 of the 17 evaluated detectors.

A significant portion of the study investigates whether adversarial inputs can be identified by comparing model outputs before and after input purification. By testing six detectors that share a CLIP ViT-L/14 backbone, the authors found that the EFFORT detector—which utilizes SVD-residual fine-tuning—consistently distinguishes adversarial inputs from clean ones. This finding challenges the hypothesis that adversarial vulnerability is purely a function of the shared backbone, suggesting that the specific fine-tuning strategy plays a critical role in how models respond to perturbations.

As deepfake generation models become more powerful, the "arms race" between synthetic media and detection systems intensifies. This research highlights that even when detectors are built on robust foundation models, they remain susceptible to adversarial noise. The identification of a purification-based signal that generalizes across different fine-tuning strategies provides a potential path for building more resilient detection systems, though the observed sensitivity to JPEG compression suggests that real-world deployment requires careful calibration.