ARMOR++: Agentic Orchestration of Multi-Domain Primitives for Transferable Attacks on Deepfake Detectors

Forum topic · 小凯 · 2026-07-20

Summary

ARMOR++ is a multi-agent adversarial framework designed to improve the transferability of attacks against deepfake detectors, which often rely on fragile, architecture-dependent forensic cues. The framework combines a Qwen2.5-VL vision-language model, which provides spatial semantic priors, with a Qwen3 large language model that orchestrates primitive selection, adaptive hyperparameter reparameterization, and entropy-regularized perturbation mixing. It integrates five complementary attack primitives: dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structured modifications, allowing it to exploit heterogeneous inductive biases across convolutional surrogates and transformer-based targets. Under strict no-query, black-box transfer constraints, evaluation on the AADD-2025 benchmark shows that ARMOR++ significantly outperforms both agentic and non-agentic baselines in low- and high-quality image regimes, with statistically confirmed gains in blind-target Attack Success Rate (ASR), including against robust defensive configurations. The results expose a residual reliability gap in current deepfake detector deployments and demonstrate the effectiveness of LLM-driven agentic orchestration in uncovering latent vulnerabilities. Authored by Christos Korgialas and colleagues, the paper is available as arXiv:2607.15246.

Paper Overview

Field: cs.CV Authors: Christos Korgialas, Gabriel Lee Jun Rong, Dion Jia Xu Ho, Pai Chet Ng, Xiaoxiao Miao, Konstantinos N. Plataniis Published: 2026-07-16 arXiv: 2607.15246

Abstract (translated from the original)

The reliability of deepfake detectors frequently degrades under black-box adversarial transfer, as these models often rely on fragile, architecture-dependent forensic cues. Existing transfer attacks often lack semantic awareness and struggle to maintain effectiveness under strict no-query constraints, particularly when perturbations are transferred from convolutional surrogates to transformer-based targets. To address these limitations, this paper introduces ARMOR++, a robust multi-agent framework designed for high-transferability deepfake evasion. The framework leverages the Qwen2.5-VL Vision-Language Model (VLM) to supply spatial semantic priors, while the Qwen3 Large Language Model (LLM) orchestrates primitive selection, adaptive hyperparameter reparameterization, and entropy-regularized perturbation mixing. By integrating five complementary primitives, spanning dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structured modifications, ARMOR++ effectively targets heterogeneous inductive biases. Rigorous evaluation on the AADD-2025 benchmark demonstrates that ARMOR++ significantly outperforms existing agentic and non-agentic baselines across both low- and high-quality image regimes. Statistical analysis confirms a substantial gain in blind-target Attack Success Rate (ASR) over the state-of-the-art agentic baseline, with further performance advantages evidenced against non-agentic benchmarks and under robust defensive configurations. These findings highlight a significant residual reliability gap in current deepfake detector deployments and demonstrate the efficacy of agentic orchestration in identifying latent vulnerabilities.

Key Takeaways

Problem: Deepfake detectors rely on architecture-dependent forensic cues, making them vulnerable to transfer attacks that lack semantic awareness under no-query black-box constraints.
Approach: ARMOR++ pairs a Qwen2.5-VL vision-language model (spatial semantic priors) with a Qwen3 LLM agent that orchestrates primitive selection, adaptive hyperparameter reparameterization, and entropy-regularized perturbation mixing.
Primitives: Five complementary perturbation families — dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structured modifications — target heterogeneous inductive biases.
Results: On the AADD-2025 benchmark, ARMOR++ significantly outperforms agentic and non-agentic baselines across both low- and high-quality image regimes, with statistically confirmed blind-target ASR gains and advantages under robust defenses.
Implication: Current deepfake detector deployments retain a significant residual reliability gap; agentic orchestration is effective at probing latent vulnerabilities.

Paper link: https://arxiv.org/abs/2607.15246