{"id":"3b0a4feb-0b7f-4c16-928e-6d1387e153af","arxiv_id":"2505.03435","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Combining adversarial training with diffusion reconstruction error (DIRE) substantially improves face-generator detector accuracy under PGD attacks, but only the training attack is tested.","lead":"This paper shows that adversarial training, combined with diffusion reconstruction error, helps AI-generated face detectors survive attacks that easily fool vanilla detectors. It is a useful robustness recipe, but the evaluation only tests the same attack used for training.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported robustness may rest on a non-adaptive attack: Algorithm 1 attacks f on raw pixels while f is trained on DIRE maps, so the claimed PGD accuracy may not reflect a true white-box adversary.","rationale":"The reader identified the same-attack-only evaluation as the weakest assumption, which is a real limitation. I agree, but I see a more fundamental problem: even for the PGD attack that was used, the manuscript's own algorithm and equations are internally inconsistent about what input the detector f consumes. Algorithm 1 attacks f on raw pixels during generation but trains f on concatenated DIRE residual maps, and the evaluation section does not clarify whether test-time adversarial images were generated against the raw classifier or the full DIRE pipeline. If the latter, the paper would need to show gradient flow through DDIM inversion/reconstruction; if the former, the defense is being evaluated against a non-adaptive adversary and the headline robustness numbers do not support the central claim. This is not a matter of consensus or stronger external attacks; it is a question of whether the reported experiment measures what it claims to measure. The consistency of the improvements across datasets and the non-trivial w/o AT robustness of DIRE are encouraging, but they do not resolve the ambiguity. Section 5 also reports that adversarial training can collapse to fixed predictions on non-face datasets, which is a separate limitation and reinforces that the robustness result is not universal. Because a single targeted experiment can settle whether the concern lands, I would not reject the work outright, but the submitted manuscript does not currently provide enough evidence to support conditional acceptance; it should be marked unverdictable until the full-pipeline attack is run or the exact attack protocol is disclosed.","tokens_in":12753,"tokens_out":6094,"duration_ms":68774,"concrete_test":"Run PGD against the final deployed model by backpropagating through the entire differentiable pipeline: for each test image x, maximize the loss of f(DIRE(x+δ)) (or f(Concat(DIRE(x), DIRE(x+δ))) as in training) under an L∞ constraint, using the paper's step size and, if released, its epsilon and iteration count; report adversarial accuracy on CelebA and SFHQ and compare with Table 1 DIRE w/AT rows. If accuracy falls well below the reported 99%, the robustness claim is an artifact of a non-adaptive attack. If accuracy remains high, the concern is resolved, though AutoAttack and transfer attacks should still be reported.","verdict_should_be":"UNVERDICTED","load_bearing_attack":"Section 3.2–3.3 and Algorithm 1 contain a domain mismatch that directly affects the central claim. Algorithm 1 lines 4–8 generate adversarial examples by PGD using ∇_{x'} L(f(x'), y), but lines 9–15 then define the detector input as x_combined = Concat(DIRE(x0), DIRE(x0')) and train f on that combined residual map. The detector f therefore consumes DIRE-space features, not raw RGB pixels, so the attack step as written is undefined because f cannot be evaluated at raw x'. Equation (5) has the same problem: it writes f(x) and f(x') on raw images even though the method trains on DIRE features. The test-time evaluation never states which model is attacked: a vanilla pixel-space ResNet/ViT, the DIRE feature extractor, or the full pipeline with gradients propagated through DDIM inversion and reconstruction. If the attacked images were generated against a raw-pixel classifier and then passed through DIRE for evaluation, the high 'Adversarial Images / w/ AT' accuracies in Table 1 (99.02% on CelebA, 99.98% on SFHQ) measure robustness against a mismatched, non-adaptive adversary. A true white-box adversary who optimizes through the DIRE preprocessing could defeat the defense despite these numbers. The paper's central claim that the method 'significantly improves the robustness' is therefore not established by the reported experiments.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a defense for AI-generated image detection by combining adversarial training with diffusion reconstruction error (DIRE). The method computes DIRE maps for clean and PGD-perturbed images, concatenates them, and trains a classifier (ResNet50 or ViT) on these maps. Experiments are conducted on face datasets (CelebA, LFW, Selfie, SFHQ, SDFace) in all-set and cross-domain settings, measuring accuracy under clean and attacked conditions and a 'robustness score' defined as the ratio of adversarial to clean accuracy. The paper reports large gains from adversarial training on some datasets but also conflicting results in cross-domain settings.","tokens_in":12992,"tokens_out":7047,"duration_ms":62836,"significance":"The topic is timely and important: adversarial robustness of AIGC detectors is under-studied, and DIRE is a plausible feature representation for such detection. The paper contributes visualizations of attack noise and DIRE differences, and it attempts a cross-domain robustness analysis. However, the significance of the claimed improvements is not currently established because the attack definition is inconsistent with the detector input space, the evaluation uses only the same PGD attack as training, and the proposed robustness score can be misleading. These issues are load-bearing for the central claim.","major_comments":[{"comment":"Algorithm 1 lines 4–8 generate PGD adversarial examples via ∇_{x'} L(f(x'), y) on raw images, while lines 9–15 define the detector input as x_combined = Concat(DIRE(x0), DIRE(x0')) and train f on that combined representation. Because f is never defined on raw pixels, the attack as written is undefined for the DIRE-based detector; the same inconsistency appears in Eq. (5), which writes f(x) and f(x') on raw inputs. If the attacks were instead generated against a separate pixel-space classifier and only evaluated after the DIRE transformation, the high accuracies in Table 1 (e.g., 99.02% for CelebA ResNet w/ AT) would reflect a non-adaptive adversary. The paper must specify the exact attacked model and, to support the abstract's white-box robustness claim, evaluate adaptive attacks that propagate gradients through the full inversion–reconstruction pipeline.","section":"§3.2–3.3, Algorithm 1"},{"comment":"Training and evaluation use the same PGD attack with the same parameters (Section 4.2, L∞, step size 10), so the robust accuracies in Tables 1–3 may be overfitted to the training attack. Section 4.4.2's conclusion that 'the performance remains comparable' under attack is therefore not evidence of general robustness. I request additional evaluation with unseen attacks (e.g., AutoAttack, FGSM, transfer attacks from other models, and varying epsilon budgets), with results reported per attack.","section":"§4.2, §4.4"},{"comment":"Section 4.5 states that 'models in the w/ AT setting always outperform those in the w/o AT setting,' but this is directly contradicted by the paper's own tables. In Table 2, DIRE on SDFace has adversarial accuracy 78.72% without adversarial training versus 41.06% with it, and in Table 3, DIRE on SFHQ has 95.45% versus 66.42%. Adversarial training can therefore reduce cross-domain robustness in the DIRE setting, which conflicts with the claimed universal benefit and needs a more careful analysis.","section":"§4.5, Table 2, Table 3"},{"comment":"The robustness score defined in Eq. (9) as Accadv/Accclean can exceed 1; for example, Table 2 reports Selfie DIRE with AT having clean accuracy 25.60% and adversarial accuracy 40.47%, yielding a score of 1.58. This metric rewards a detector whose accuracy improves under attack relative to its poor clean performance, which is misleading. Also, no error bars or multiple-seed results are reported anywhere, making it impossible to assess the statistical reliability of the claimed improvements.","section":"Eq. (9), Table 2"}],"minor_comments":[{"comment":"The attack description 'PGD under L∞ norm constraint with a step size of 10' is ambiguous; the perturbation bound epsilon and number of iterations are not reported, and a step size of 10 seems inconsistent with a bounded attack.","section":"§4.2"},{"comment":"The claim of being 'the first to focus on this critical issue in AIGC detection' is too strong given existing work on adversarial robustness of deepfake detectors; please qualify the claim with a comparison to related literature.","section":"§1"},{"comment":"The figures contain typographical artifacts (e.g., 'NoiseNoise' in Figure 1) and the visualizations would benefit from higher-resolution images and clear labels.","section":"Figures"},{"comment":"The text refers to an Appendix for dataset details and additional results, but the Appendix is not included in the manuscript; the submitted version should include it.","section":"Appendix"},{"comment":"The author list includes two email addresses from different institutions; please clarify the corresponding author and ensure the email display is correct.","section":"Author list"}],"recommendation":"major_revision","confidential_remarks":"The manuscript has a potential threat-model flaw that could invalidate the headline results. The authors should be asked to redo the evaluation with adaptive attacks and to reconcile the algorithmic description with the actual training procedure. Given the amount of new experiments required, I see this as a major revision rather than a straightforward acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the paper does something concrete: it combines DIRE (diffusion reconstruction error) features with adversarial training for AI-generated face detection and reports large accuracy gains under PGD relative to vanilla classifiers across several face datasets. Second—and this is the catch—the attack is set up against what looks like the wrong model. Algorithm 1 computes PGD steps using gradients of f at raw x', but the f they train is fed with concatenated DIRE maps, not raw pixels. A true white-box adversary would need gradients flowing through the DDIM inversion/reconstruction chain, and the paper never says that is what was done. If the adversarial images were generated against a raw-pixel ResNet or ViT and then passed through DIRE for evaluation, the high 'w/ AT' accuracies measure robustness against a mismatched, non-adaptive adversary. That makes the central robustness claim unsupported as stated.\n\nWhat is genuinely useful: the AT+DIRE combination is a reasonable engineering extension, and the cross-domain tables are more informative than the usual single-dataset numbers. The visualization of DIRE maps before and after attack is a nice piece of analysis. DIRE's standalone robustness in the 'w/o AT' rows is real evidence that diffusion reconstruction helps, independent of adversarial training. The all-set results are consistently strong for the DIRE+AT rows, which shows the method does not break on the training distribution.\n\nSoft spots beyond the attack mismatch: the robustness score Accadv/Accclean can exceed 1 (Table 2, Selfie DIRE w/AT score 1.58), which makes it meaningless as a robustness metric; there are no error bars, no code, and no stated epsilon or PGD iterations ('step size of 10' is not an epsilon); clean accuracy sometimes collapses under adversarial training (e.g., ResNet w/AT clean CelebA at 1.58% in Table 2) without analysis; and the 'first to focus on this issue' claim is not substantiated. They cite AutoAttack but never use it.\n\nThis paper deserves a serious referee, because the topic matters and the flaw is addressable: rerun attacks against the full DIRE pipeline, use an adaptive attack like AutoAttack, report epsilon and iterations, and fix the score. As it stands, the headline empirical claim is not established. I would send it out with a strong request for adaptive evaluation.","headline":"AT+DIRE for AIGC face detection is a sensible idea, but the attack in Algorithm 1 targets raw pixels while the detector is trained on DIRE maps, so the headline robustness numbers are not yet established.","tokens_in":13596,"tokens_out":4556,"would_cite":false,"duration_ms":45887,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that combining DIRE residual maps with adversarial training restores near-pre-attack accuracy for face-forgery detectors under white-box PGD attacks that drive vanilla detectors to 0%.","keywords":["AI-generated image detection","adversarial robustness","adversarial training","diffusion reconstruction error","DIRE","face deepfake detection","Projected Gradient Descent","cross-domain generalization"],"falsifier":"Run the trained detector on adversarial images crafted by an attack not seen in training, for example a stronger adaptive attack that differentiably passes through the inversion-reconstruction pipeline at the same epsilon; if accuracy falls well below the reported near-99% while clean accuracy stays high, the central robustness claim holds only for the training attack, not for adversarial robustness generally.","tokens_in":12478,"feed_emoji":"🛡️","tokens_out":9039,"duration_ms":80980,"temperature":0.7,"pith_summary":"AI-generated face detectors appear almost perfect on clean images, but the paper shows that small white-box PGD perturbations send standard ResNet and ViT detectors to 0% accuracy. The authors set out to prove that this collapse can be prevented by training on residual maps produced by diffusion reconstruction, alongside adversarial examples generated from those maps. Their central claim is that adversarial training and diffusion reconstruction error jointly give detectors near-pre-attack accuracy when the test distribution matches training, and that the reconstruction error specifically helps when generalizing to unseen face datasets. The reason to care is practical: imperceptible perturbations are a realistic threat to deployed deepfake detectors, and the paper identifies a residual feature that suppresses attack noise.","feed_headline":"PGD attacks zero out face detectors; combined defense keeps ~99%","feed_subtitle":"Adversarial training plus diffusion reconstruction error stops the same detectors from collapsing to 0 percent.","key_machinery":"The load-bearing object is the DIRE residual map, $\\mathrm{DIRE}(x_0) = |x_0 - R(I(x_0))|$, the absolute difference between an image and its reconstruction after deterministic DDIM inversion ($I$) and reconstruction ($R$). The map carries the argument because diffusion-generated images reconstruct more faithfully than real images, so residual magnitude separates the two classes even under perturbation. Adversarial training then works on these maps: the detector is trained on concatenated clean and PGD-attacked residual maps, forcing it to treat attack-induced variation as nuisance rather than signal. The inversion-reconstruction chain also acts as a built-in denoiser, which is why the paper attributes both intrinsic robustness and cross-domain stability to DIRE.","core_discovery":"On the paper's own terms, the discovery is that the failure of face forgery detectors under adversarial attack is not intrinsic: a detector trained in DIRE space on both clean and PGD-attacked samples recovers essentially all of its pre-attack accuracy. In the all-set setting, vanilla ResNet and ViT detectors drop from near 100% clean accuracy to near 0% under attack, while the adversarially trained DIRE detector holds roughly 99.9 to 100% accuracy on CelebA, LFW, Selfie, SFHQ, and SDFace. The paper further claims that adversarial training alone improves but does not fully restore cross-domain accuracy, while the diffusion reconstruction component stabilizes performance on unseen data distributions. The authors interpret DIRE's contribution as a denoising effect: DDIM inversion-reconstruction smooths adversarial perturbations, and the residual maps amplify real-versus-synthetic differences that are invisible in pixel space.","pith_inferences":["The paper's evidence is limited to the PGD attack it trained against; a natural extension is to test adaptive adversaries that back-propagate through the full DDIM inversion-reconstruction, since the reported denoising effect may not survive gradient-aware attacks.","Because the difference-DIRE visualizations show that real and fake images respond differently to attacks, one could turn the before/after residual difference into an explicit robustness feature or regularizer rather than relying only on implicit concatenated training.","The method's benefit appears tied to face-like statistics; applying the same pipeline to ImageNet-scale content may require conditioning the reconstruction or augmenting with domain-specific adversarial samples, otherwise the detector can collapse to constant outputs."],"forward_implications":["In-domain deployment: a face-forgery detector trained in DIRE space with adversarial training keeps roughly 99% accuracy under white-box PGD attacks of the same budget used in training, where the same detector without the defense falls to 0%.","DIRE alone is a partial defense: even without adversarial training it retains substantial accuracy on some datasets, so reconstruction-error features are a stronger starting point for robust detection than raw pixels.","Cross-domain robustness is not automatic from adversarial training; the diffusion reconstruction component is the part that prevents accuracy collapse on unseen face datasets.","The fixed-output collapse observed on non-face natural images means the defense is demonstrated for facial-image distributions, not for general image detection."],"supporting_citations":[{"why":"Defines DIRE, the reconstruction-error residual map that the proposed detector is trained on and that supplies the intrinsic denoising robustness.","marker":"[38]"},{"why":"Supplies the PGD attack formulation and the adversarial training procedure used to harden the detector.","marker":"[23]"},{"why":"Provides the deterministic DDIM inversion-reconstruction process used to compute residual maps and suppress adversarial noise.","marker":"[34]"},{"why":"Gives the diffusion forward/reverse process formalism that underlies inversion and reconstruction.","marker":"[16]"},{"why":"CelebA is a real-face dataset used both in all-set training and as a cross-domain evaluation target.","marker":"[21]"},{"why":"LFW is a real-face dataset providing a second evaluation domain for the robustness claims.","marker":"[17]"},{"why":"Selfie is the stylized real-face dataset that stresses cross-domain robustness.","marker":"[18]"},{"why":"SDFace supplies stable-diffusion-generated faces used as the synthetic class.","marker":"[37]"},{"why":"SFHQ supplies high-quality synthetic faces used as the second fake-image source.","marker":"[2]"}],"fun_headline_variants":["DIRE defense: adversarial training + diffusion keeps face detectors ~99% under PGD","Face forgery detectors survive PGD with diffusion-reconstruction training","Adversarial training plus diffusion reconstruction: face detectors hold ~99% under attack","DIRE-based method thwarts PGD attacks, preserving ~99% face detection accuracy","Robust face detection: DIRE and adversarial training resist PGD, retaining ~99% accuracy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that robustness to the exact PGD attack used in training, with the same L-infinity budget and step size, is a valid proxy for robustness to adversarial attacks in general; the paper does not test stronger, adaptive, or different attacks, so a real adversary using another method could break the defense.","fun_headline_variants_meta":{"raw":{"variants":["DIRE defense: adversarial training + diffusion keeps face detectors ~99% under PGD","Face forgery detectors survive PGD with diffusion-reconstruction training","Adversarial training plus diffusion reconstruction: face detectors hold ~99% under attack","DIRE-based method thwarts PGD attacks, preserving ~99% face detection accuracy","Robust face detection: DIRE and adversarial training resist PGD, retaining ~99% accuracy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000743,"raw_usage":{"total_tokens":3275,"prompt_tokens":867,"completion_tokens":2408,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":483,"completion_tokens_details":{"reasoning_tokens":2301}},"tokens_in":483,"tokens_out":2408,"duration_ms":15403,"temperature":1.0,"reasoning_tokens":2301,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:51:32.855951+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the trained detector on adversarial images crafted by an attack not seen in training, for example a stronger adaptive attack that differentiably passes through the inversion-reconstruction pipeline at the same epsilon; if accuracy falls well below the reported near-99% while clean accuracy stays high, the central robustness claim holds only for the training attack, not for adversarial robustness generally.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"CelebA is a real-face dataset used both in all-set training and as a cross-domain evaluation target."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"LFW is a real-face dataset providing a second evaluation domain for the robustness claims."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Selfie is the stylized real-face dataset that stresses cross-domain robustness."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"SDFace supplies stable-diffusion-generated faces used as the synthetic class."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"SFHQ supplies high-quality synthetic faces used as the second fake-image source."}],"review_version":1}