MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition
MIG-COW addresses a critical vulnerability in deepfake detection: the difficulty of crafting adversarial examples that simultaneously fool both CNN and ViT architectures. The method combines momentum-integrated gradients with a consensus-orthogonal decomposition to separate shared vulnerabilities from model-specific decision cues. While it achieves near-perfect white-box success, the work is most valuable for highlighting how fragile cross-architecture transferability remains in practice.
The paper proposes a technically competent ensemble attack that improves white-box success to 99.96% ASR, yet its black-box transferability remains practically ineffective at only 7.16% ASR against official challenge targets. While the consensus-orthogonal decomposition is a principled contribution, the overall gains over the base MIG framework in black-box settings are marginal, and the abstract framing of "highly generalizable" adversarial examples is not convincingly supported by the evidence.
The consensus-orthogonal weighting module is the clearest contribution: the ablation study shows that the logit-based cross-entropy loss and the orthogonal component play complementary roles, with COW specifically improving ViT attack success via the combined direction $\mathbf{g}_{\text{cb}}=\beta\mathbf{g}_{\text{con}}+(1-\beta)\mathbf{g}_{\text{orth}}$. The paper also offers a valuable empirical finding that architectural diversity alone does not guarantee better transferability when surrogate models are functionally mismatched.
The primary flaw is the yawning gap between white-box and black-box performance. A 7.16% black-box ASR, even if the best submitted score, does not merit the description "highly generalizable" in the abstract and contributions. Including the weak ViT-P surrogate degrades both white-box and black-box results, but the paper offers only post-hoc speculation about functional equivalence without controlled experiments to isolate this factor.
The evaluation is further constrained to a single competition dataset with a fixed split, and the effective hyperparameters such as $\beta \in [0.7,0.8]$ appear tuned to this specific benchmark, risking overfitting.
White-box evidence is solid: MIG-COW dominates PGD, MI-FGSM, and MIG across ResNet50 and DenseNet121 with large margins. However, the evidence for transferability is weak; the black-box ASR improvements over MIG amount to roughly 0.4–1.3 percentage points, which is within natural variance on 1,403 images. The paper is commendably transparent about these numbers, yet the abstract claims "significantly outperforming existing baselines," which overstates the practical black-box advance. The citation of Bhojanapalli et al. as evidence that perturbations "transfer poorly" between CNNs and ViTs is somewhat overstated; that work primarily discusses qualitative differences in adversarial perturbations rather than empirical transfer rates.
Reproducibility is mixed. The attack algorithm is fully specified in pseudocode and hyperparameters ($\epsilon=0.02$, $T=25$, $\mu=1$) are reported, yet no code repository is mentioned. The AADD-2025 dataset is competition-specific, and the official black-box model weights are unavailable to the public, making the full black-box evaluation irreproducible outside the challenge. The supplementary ViT-P surrogate is cited opaquely with no accessible URL or model card, which would obstruct independent reproduction of the ensemble experiments.
Despite recent advances, deepfake detectors remain vulnerable to adversarial examples, particularly in diverse, real-world settings. We propose MIG-COW, a novel adversarial attack framework that generates highly generalizable and visually imperceptible adversarial examples. By combining momentum-integrated gradients with a consensus-orthogonal decomposition, MIG-COW captures both shared and model-specific vulnerabilities across heterogeneous CNN and ViT detectors. On the AADD-2025 Challenge benchmarks, MIG-COW achieves a 99.96% white-box attack success rate (ASR) with high perceptual similarity (SSIM), significantly outperforming existing baselines. However, its limited 7.16% ASR against official black-box targets - despite achieving the best overall score - highlights the ongoing challenge of transferability. We also demonstrate that incorporating low-performing but diverse models in the ensemble can degrade attack effectiveness, underscoring the need for careful surrogate model selection in real-world adversarial settings.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.