# Adversarial Threats to DeepFake Detection: A Practical Perspective

arXiv: https://arxiv.org/abs/2011.09957 · HTML: https://mlsanity.com/paper/2011.09957/

## Key facts

- Cited by 48 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Nov 2020.

## Built on by (most cited first, 30 of 48)

- [Deepfakes Generation and Detection: State-of-the-art, open challenges, countermeasures, and way forward](https://mlsanity.com/paper/2103.00484/) (2021)
- [KoDF: A Large-scale Korean DeepFake Detection Dataset](https://mlsanity.com/paper/2103.10094/) (2021)
- [Countering Malicious DeepFakes: Survey, Battleground, and Horizon](https://mlsanity.com/paper/2103.00218/) (2021)
- [Exploring Frequency Adversarial Attacks for Face Forgery Detection](https://mlsanity.com/paper/2203.15674/) (2022)
- [SepMark: Deep Separable Watermarking for Unified Source Tracing and Deepfake Detection](https://mlsanity.com/paper/2305.06321/) (2023)
- [Audio-Visual Person-of-Interest DeepFake Detection](https://mlsanity.com/paper/2204.03083/) (2022)
- [Evading DeepFake Detectors via Adversarial Statistical Consistency](https://mlsanity.com/paper/2304.11670/) (2023)
- [Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detection](https://mlsanity.com/paper/2402.11473/) (2024)
- [Learning to Immunize Images for Tamper Localization and Self-Recovery](https://mlsanity.com/paper/2210.15902/) (2022)
- [FaceSigns: Semi-Fragile Neural Watermarks for Media Authentication and Countering Deepfakes](https://mlsanity.com/paper/2204.01960/) (2022)
- [Digital and Physical Face Attacks: Reviewing and One Step Further](https://mlsanity.com/paper/2209.14692/) (2022)
- [Fairness Evaluation in Deepfake Detection Models using Metamorphic Testing](https://mlsanity.com/paper/2203.06825/) (2022)
- [Making DeepFakes more spurious: evading deep face forgery detection via trace removal attack](https://mlsanity.com/paper/2203.11433/) (2022)
- [PolyGlotFake: A Novel Multilingual and Multimodal DeepFake Dataset](https://mlsanity.com/paper/2405.08838/) (2024)
- [AVA: Inconspicuous Attribute Variation-based Adversarial Attack bypassing DeepFake Detection](https://mlsanity.com/paper/2312.08675/) (2023)
- [Vulnerabilities in AI-generated Image Detection: The Challenge of Adversarial Attacks](https://mlsanity.com/paper/2407.20836/) (2024)
- [From Image to Imuge: Immunized Image Generation](https://mlsanity.com/paper/2110.14196/) (2021)
- [D4: Detection of Adversarial Diffusion Deepfakes Using Disjoint Ensembles](https://mlsanity.com/paper/2202.05687/) (2022)
- [Misleading Deep-Fake Detection with GAN Fingerprints](https://mlsanity.com/paper/2205.12543/) (2022)
- [Exploring the Adversarial Robustness of CLIP for AI-generated Image Detection](https://mlsanity.com/paper/2407.19553/) (2024)
- [Generalizable Deepfake Detection with Phase-Based Motion Analysis](https://mlsanity.com/paper/2211.09363/) (2022)
- [The Deepfake Detection Dilemma: A Multistakeholder Exploration of Adversarial Dynamics in Synthetic Media](https://mlsanity.com/paper/2102.06109/) (2021)
- [An adversarial attack approach for eXplainable AI evaluation on deepfake detection models](https://mlsanity.com/paper/2312.06627/) (2023)
- [On the Vulnerability of DeepFake Detectors to Attacks Generated by Denoising Diffusion Models](https://mlsanity.com/paper/2307.05397/) (2023)
- [Manifestations of Xenophobia in AI Systems](https://mlsanity.com/paper/2212.07877/) (2022)
- [Passive Deepfake Detection Across Multi-modalities: A Comprehensive Survey](https://mlsanity.com/paper/2411.17911/) (2024)
- [RAID: A Dataset for Testing the Adversarial Robustness of AI-Generated Image Detectors](https://mlsanity.com/paper/2506.03988/) (2025)
- [Turn Fake into Real: Adversarial Head Turn Attacks Against Deepfake Detection](https://mlsanity.com/paper/2309.01104/) (2023)
- [Towards Unveiling Predictive Uncertainty Vulnerabilities in the Context of the Right to Be Forgotten](https://mlsanity.com/paper/2508.07458/) (2025)
- [MS-GAGA: Metric-Selective Guided Adversarial Generation Attack](https://mlsanity.com/paper/2510.12468/) (2025)

## Abstract (arXiv)

Facially manipulated images and videos or DeepFakes can be used maliciously to fuel misinformation or defame individuals. Therefore, detecting DeepFakes is crucial to increase the credibility of social media platforms and other media sharing web sites. State-of-the art DeepFake detection techniques rely on neural network based classification models which are known to be vulnerable to adversarial examples. In this work, we study the vulnerabilities of state-of-the-art DeepFake detection methods from a practical stand point. We perform adversarial attacks on DeepFake detectors in a black box setting where the adversary does not have complete knowledge of the classification models. We study the extent to which adversarial perturbations transfer across different models and propose techniques to improve the transferability of adversarial examples. We also create more accessible attacks using Universal Adversarial Perturbations which pose a very feasible attack scenario since they can be easily shared amongst attackers. We perform our evaluations on the winning entries of the DeepFake Detection Challenge (DFDC) and demonstrate that they can be easily bypassed in a practical attack scenario by designing transferable and accessible adversarial attacks.