Wrapper-Based Adversarial Input Screening for Deep Image Classifiers Using Feature Squeezing and Logit-Space Inconsistency

Training-Free Reconstruction-Based AI-Generated Image Detectors Are Inherently Vulnerable to Adversarial Examples

The impressive visual quality and ubiquity of AI-generated images call for reliable and robust detection methods. Reconstruction-based detectors have emerged as a promising direction for transparent and training-free identification of synthetic images. However, due to their fundamentally different mode of operation (compared to standard, classifier-based methods), little is known about their adversarial robustness. In this work, we propose two novel attack methods targeted at detectors that leverage autoencoder reconstruction error. We find that by constructing imperceptible adversarial examples, the distance between original and reconstruction can be artificially increased, causing fake images to be wrongly classified as real. Our evaluation including images from three state-of-the-art generators and three detectors demonstrates that detection performance is significantly decreased, even if attacked images additionally undergo real-world degradations. Critically, our adversarial examples naturally transfer across detectors, as they all share the same principle, pointing towards an inherent vulnerability of reconstruction-based detectors.

A Comprehensive Review on Adversarial Attacks and Detection Techniques in Deep Learning Models for Image Analysis

The research methodology involved a systematic literature review using the Scopus database, adhering to Preferred Reporting Items for Systematic Reviews and Meta-Analyses guidelines, and focusing on recent advancements in attack and defence techniques.

Dual-Domain Adversarial Purification for Robust Remote Sensing Scene Classification

Deep learning has boosted remote sensing (RS) scene classification, but adversarial examples can still cause high-confidence misclassification with imperceptible perturbations. Adversarial purification (AP) offers a practical test-time defense without retraining the classifier. However, most existing methods are confined to pixel-space restoration, which may leave residual adversarial effects that persist and amplify through feature extraction, ultimately biasing the prediction. To address these issues, a dual-domain AP (DDAP) framework is proposed to mitigate adversarial effects at both the pixel and feature levels in a unified pipeline. In the pixel domain, a pixel-domain frequency-aware diffusion purification (PFDP) module performs diffusion-based restoration through a frequency-aware dual-stream U-Net (FD-UNet). By integrating adaptive spectral filtering with multidomain consistency constraints, PFDP reduces adversarial-perturbation-dominated high-frequency responses while preserving structural details and semantic information in RS imagery. In the feature domain, an adversarial vulnerable channel dropout (AVCD) strategy models unshifted shallow-feature statistics with a Gaussian mixture model (GMM) and adaptively assigns channelwise dropout probabilities based on a samplewise shift score and channel vulnerability, thereby suppressing residual adversarial influence before downstream classification. Extensive experiments on UC Merced (UCM) and aerial image dataset (AID) across multiple backbones and attack types demonstrate that DDAP consistently improves robustness while maintaining a favorable clean–robust balance compared with representative baselines.

Two-Stage Detect-Then-Classify Pipeline with DSAR-CNN for Robust Fragment Classification Under Padding and Bit-Flip Attacks

File fragment classification is fundamental to digital forensics and network security, enabling the recovery and identification of files when metadata is corrupted or absent. While state-of-the-art deep learning models on the FFT-75 benchmark achieve 65–79% accuracy on clean fragments, they exhibit vulnerability to byte-level adversarial perturbations, and evaluation across 39 byte-level attack variants shows that the baseline accuracy drops from 71.1% on clean fragments to an average of 15.8% under adversarial perturbations. This paper presents a novel two-stage detection-based defense framework tailored for file fragment classification that mitigates the accuracy-robustness trade-off commonly associated with adversarial training. The framework integrates three components: (1) an attention-based adversarial detector achieving 95.46% specificity and 91.34% recall (91.44% overall accuracy); (2) an existing baseline file fragment classifier preserving 71.1% accuracy on clean fragments; and (3) a novel Dual-Scale Attention-based Robust CNN (DSAR-CNN) specifically designed for adversarial fragment classification, achieving 68.4% accuracy on adversarially perturbed samples (evaluated on the test set of 4.6M fragments) through multi-scale depth wise separable convolution, CBAM-style dual attention, learnable position embeddings, and split global pooling. Developed and evaluated across 75 file types and 39 attack variants from the FFT-75 benchmark, the complete pipeline achieves 70.91% accuracy on clean data (0.19 percentage point penalty) and 63.84% on adversarial data, yielding 70.20% accuracy in realistic mixed-threat scenarios (90% clean, 10% adversarial) - outperforming both the undefended baseline and the standard adversarial training benchmark. The framework provides an approach for improving the robustness of forensic classification systems against byte-level adversarial attacks such as padding and bit-flipping.

Adversarial Attacks on Deep OCR Systems

Deep-OCR (DeepSeek-OCR) advances document recognition by treating the visual modality as an optical compression medium, enabling long-context OCR at low token cost. However, its increased complexity may introduce new security vulnerabilities. In this paper, we present, to the best of our knowledge, the first pure black-box adversarial attack against a generative OCR vision-language model, where only the decoded string can be queried and no gradients, logits, or model internals are available. We recast the attack as a zeroth-order optimization problem driven by a bounded scalar loss defined directly on the string output via sequence similarity, and estimate the gradient with a random-direction finite-difference scheme whose query cost is independent of the image dimension. An Adam update with ell_infinity projection yields imperceptible perturbations for both untargeted and targeted objectives. Pilot experiments on Deep-OCR validate the string-only attack and evaluation pipeline and expose severe qualitative decoder failures, including repetition, truncation, and prompt leakage. They also show that controlled targeted rewriting remains substantially harder than untargeted degradation; we avoid claiming targeted success until the pre-registered evaluation is complete.

Balancing clean accuracy and gradient robustness via mask-guided mixup and adaptive label refinement