ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors

View on arXiv ← Back to list

Authors: Christos Korgialas, Gabriel Lee Jun Rong, Dion Jia Xu Ho, Pai Chet Ng, Xiaoxiao Miao, Konstantinos N. Plataniotis

Published: 2026-07-16 17:45:13+00:00

AI Summary

This paper introduces ARMOR++, a robust multi-agent framework for high-transferability deepfake evasion under black-box adversarial transfer. It orchestrates a multi-domain primitive set by leveraging a Vision-Language Model (VLM) for semantic priors and a Large Language Model (LLM) for orchestrating primitive selection, hyperparameter reparameterization, and perturbation mixing. ARMOR++ significantly outperforms existing baselines on the AADD-2025 benchmark, highlighting a reliability gap in current deepfake detectors.

Abstract

The reliability of deepfake detectors frequently degrades under black-box adversarial transfer, as these models often rely on fragile, architecture-dependent forensic cues. Existing transfer attacks often lack semantic awareness and struggle to maintain effectiveness under strict no-query constraints, particularly when perturbations are transferred from convolutional surrogates to transformer-based targets. To address these limitations, this paper introduces ARMOR++, a robust multi-agent framework designed for high-transferability deepfake evasion. The framework leverages the Qwen2.5-VL Vision-Language Model (VLM) to supply spatial semantic priors, while the Qwen3 Large Language Model (LLM) orchestrates primitive selection, adaptive hyperparameter reparameterization, and entropy-regularized perturbation mixing. By integrating five complementary primitives, spanning dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structured modifications, ARMOR++ effectively targets heterogeneous inductive biases. Rigorous evaluation on the AADD-2025 benchmark demonstrates that ARMOR++ significantly outperforms existing agentic and non-agentic baselines across both low- and high-quality image regimes. Statistical analysis confirms a substantial gain in blind-target Attack Success Rate (ASR) over the state-of-the-art agentic baseline, with further performance advantages evidenced against non-agentic benchmarks and under robust defensive configurations. These findings highlight a significant residual reliability gap in current deepfake detector deployments and demonstrate the efficacy of agentic orchestration in identifying latent vulnerabilities.

Key findings

ARMOR++ significantly improves blind-target Attack Success Rate (ASR) on both low- and high-quality deepfake images, outperforming state-of-the-art agentic and non-agentic baselines. The multi-domain perturbation space, semantic guidance, and adaptive orchestration are crucial for achieving high transferability. The existence of a substantial residual reliability gap in current deepfake detectors is confirmed, even against non-adaptive defenses.

Approach

ARMOR++ uses a multi-agent framework where a VLM (Qwen2.5-VL) provides spatial semantic priors and an LLM (Qwen3) orchestrates the selection, reparameterization, and mixing of five complementary adversarial primitives (dense optimization, saliency-based, spatial transformations, frequency-domain perturbations, and block-structured modifications). This closed-loop system operates under a strict no-query protocol, relying only on surrogate model feedback for attack generation and adaptation to evade deepfake detectors.

Datasets

AADD-2025, DFDC-Preview

Model(s)

Qwen2.5-VL (Analysis Agent), Qwen3 (Conductor and Advisor agents), ResNet-50, DenseNet-121, EfficientNet-B4 (surrogates), ViT-B/16, Swin-B (blind targets)

Author countries

Greece, Singapore, USA, China, Canada

← Previous