What Makes Adversarial Examples Transfer Across Deepfake Detectors?

Authors: Rafael M. Mamede, Pedro C. Neto, Ana F. Sequeira

Published: 2026-09-09 10:28:36+00:00

AI Summary

This research investigates the factors influencing adversarial transferability across 60 deepfake detectors, spanning various backbones, pretraining regimes, and training data configurations. The study finds that source-target compatibility, particularly shared exact backbone, architecture family, pretraining, and training data, significantly impacts transfer success, with the most influential factor being attack-dependent. It also reveals that single-source or averaged transfer evaluations can severely underestimate target vulnerability.

Abstract

Deepfake detectors remain vulnerable to transfer-based black-box attacks, in which adversarial examples are generated on a source surrogate model and transferred to a target model, unknown to the attacker. Yet how source--target compatibility shapes attack success remains poorly understood. Prior studies evaluate limited detector pools and rarely disentangle architectural from training factors. We conduct a controlled evaluation of adversarial transferability across 60 detectors spanning six backbones, two pretraining regimes, and five training-data configurations, using two attack procedures: AutoAttack (AA) and the Carlini--Wagner attack with Expectation over Transformation (CW--EOT). Matched comparisons reveal significantly higher transfer when source and target share an exact backbone, architecture family, pretraining regime, or training data. This compatibility structure is attack-dependent: exact backbone compatibility has the largest effect under AA, whereas shared pretraining and training data have the largest effects under CW--EOT. When transfer is averaged across non-target sources, mean attack success rate (ASR) is $7.21\\%$ under AA and $19.52\\%$ under CW--EOT. By contrast, a multi-source oracle combining both attacks attains a \\(64.48\\%\\) mean ASR after excluding exact backbone and training-data matches, showing that source averaging can substantially understate target vulnerability. We release 240,000 adversarially perturbed images, complete pairwise transfer results, detector configurations, and evaluation code. These findings establish source--target compatibility and source-model selection as central dimensions of credible transfer-based black-box robustness evaluation.