mlsanityData to 14 Oct 2026

PolyJuice Makes It Real: Black-Box, Universal Red Teaming for Synthetic Image Detectors

arXiv 2509.15551 ↗First posted 19 Sep 2025cs.LGcited by 1

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

Synthetic image detectors (SIDs) are a key defense against the risks posed by the growing realism of images from text-to-image (T2I) models. Red teaming improves SID's effectiveness by identifying and exploiting their failure modes via misclassified synthetic images. However, existing red-teaming solutions (i) require white-box access to SIDs, which is infeasible for proprietary state-of-the-art detectors, and (ii) generate image-specific attacks through expensive online optimization. To address these limitations, we propose PolyJuice, the first black-box, image-agnostic red-teaming method for SIDs, based on an observed distribution shift in the T2I latent space between samples correctly and incorrectly classified by the SID. PolyJuice generates attacks by (i) identifying the direction of this shift through a lightweight offline process that only requires black-box access to the SID, and (ii) exploiting this direction by universally steering all generated images towards the SID's failure modes. PolyJuice-steered T2I models are significantly more effective at deceiving SIDs (up to 84%) compared to their unsteered counterparts. We also show that the steering directions can be estimated efficiently at lower resolutions and transferred to higher resolutions using simple interpolation, reducing computational overhead. Finally, tuning SID models on PolyJuice-augmented datasets notably enhances the performance of the detectors (up to 30%).

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 53 of its 72 references that are in the map. First posted on arXiv 19 Sep 2025.

Builds on

53 of 72 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Users24 May

Other references · 52

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  5. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  7. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  8. 2022Flow Matching for Generative Modelingcited by 5,702
  9. 2021Zero-Shot Text-to-Image Generationcited by 4,288
  10. 2024Scaling Rectified Flow Transformers for High-Resolution Image Synthesiscited by 4,181
  11. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  12. 2022Flow Straight and Fast: Learning to Generate and Transfer Data with Rectified Flowcited by 3,700
38 more
  1. 2019Optuna: A Next-generation Hyperparameter Optimization Frameworkcited by 2,501
  2. 2022Scaling Autoregressive Models for Content-Rich Text-to-Image Generationcited by 1,295
  3. 2022Red Teaming Language Models with Language Modelscited by 1,026
  4. 2022Exploring CLIP for Assessing the Look and Feel of Imagescited by 991
  5. 2019Improved Precision and Recall Metric for Assessing Generative Modelscited by 944
  6. 2019CNN-generated images are surprisingly easy to spot... for nowcited by 847
  7. 2020Leveraging Frequency Analysis for Deep Fake Image Recognitioncited by 504
  8. 2023Towards Universal Fake Image Detectors that Generalize Across Generative Modelscited by 490
  9. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  10. 2023Universal Guidance for Diffusion Modelscited by 437
  11. 2020Reliable Fidelity and Diversity Metrics for Generative Modelscited by 434
  12. 2022Detecting Deepfakes with Self-Blended Imagescited by 338
  13. 2022On the detection of synthetic images generated by diffusion modelscited by 283
  14. 2017Generating Natural Adversarial Examplescited by 183
  15. 2023Forgery-aware Adaptive Transformer for Generalizable Synthetic Image Detectioncited by 182
  16. 2023Fair Diffusion: Instructing Text-to-Image Generation Models on Fairnesscited by 151
  17. 2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
  18. 2017Controllable Invariance through Adversarial Feature Learningcited by 127
  19. 2021One Shot Face Swapping on Megapixelscited by 105
  20. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
  21. 2024Leveraging Representations from Intermediate Encoder-blocks for Synthetic Image Detectioncited by 89
  22. 2022Distilling Model Failures as Directions in Latent Spacecited by 82
  23. 2023Attack Prompt Generation for Red Teaming and Defending Large Language Modelscited by 76
  24. 2023Content-based Unrestricted Adversarial Attackcited by 73
  25. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  26. 2023ITI-GEN: Inclusive Text-to-Image Generationcited by 64
  27. 2021Improving the Efficiency and Robustness of Deepfakes Detection through Precise Geometric Featurescited by 57
  28. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
  29. 2025Deepfake-Eval-2024: A Multi-Modal In-the-Wild Benchmark of Deepfakes Circulated in 2024cited by 45
  30. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 43
  31. 2024Attention Calibration for Disentangled Text-to-Image Personalizationcited by 31
  32. 2024Contrasting Deepfakes Diffusion via Contrastive Learning and Global-Local Similaritiescited by 27
  33. 2024FairerCLIP: Debiasing CLIP's Zero-Shot Predictions using Functions in RKHSscited by 25
  34. 2023Steered Diffusion: A Generalized Framework for Plug-and-Play Conditional Image Synthesiscited by 18
  35. 2024Utility-Fairness Trade-Offs and How to Find Themcited by 15
  36. 2022Discrete Point-wise Attack Is Not Enough: Generalized Manifold Adversarial Attack for Face Recognitioncited by 14
  37. 2024Fairness and Bias Mitigation in Computer Vision: A Surveycited by 13
  38. 2021On Characterizing the Trade-off in Invariant Representation Learningcited by 12

50 most cited of 52 All 52 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Pulling The REINS: Training-Free Safety Alignment of Video Diffusion Models via Representation Steeringcited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2025DREAM: Scalable Red Teaming for Text-to-Image Generative Systems via Distribution Modeling
  2. 2026RISE: Red-teaming via Iterative Strategy Evolution for Modern Text-to-Image Models
  3. 2024DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimization
  4. 2024Synthetic Photography Detection: A Visual Guidance for Identifying Synthetic Images Created by AI
  5. 2026Visual Exclusivity Attacks: Automatic Multimodal Red Teaming via Agentic Planning
  6. 2026Automatic Red Teaming for Implicit Vulnerabilities of Text-to-Image Models
  7. 2025ARMs: Adaptive Red-Teaming Agent against Multimodal Models with Plug-and-Play Attacks
  8. 2026GPT-Red: Automated Red Teaming via Self-Play at Scale