ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors

2026-07-16 · Source: Computer Vision and Pattern Recognition · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

ARMOR++ is a robust multi-agent framework designed for high-transferability deepfake evasion, addressing the degradation of deepfake detectors under black-box adversarial transfer. This framework tackles limitations of existing transfer attacks, which often lack semantic awareness and struggle with effectiveness under no-query constraints, especially when perturbations transfer from convolutional surrogates to transformer-based targets. ARMOR++ leverages the Qwen2.5-VL Vision-Language Model (VLM) for spatial semantic priors and the Qwen3 Large Language Model (LLM) for orchestrating primitive selection, adaptive hyperparameter reparameterization, and entropy-regularized perturbation mixing. It integrates five complementary primitives: dense optimization, saliency-based methods, spatial transformations, frequency-domain perturbations, and block-structured modifications, targeting heterogeneous inductive biases. Evaluation on the AADD-2025 benchmark shows ARMOR++ significantly outperforms existing agentic and non-agentic baselines in both low- and high-quality image regimes, confirming a substantial gain in blind-target Attack Success Rate (ASR) and demonstrating its efficacy against robust defensive configurations.

Key takeaway

For AI Security Engineers developing deepfake detection systems, ARMOR++ highlights a critical reliability gap in current deployments. You should prioritize integrating more robust defenses that account for agentic, multi-domain adversarial attacks, as current models are vulnerable to sophisticated black-box transfer techniques. Consider evaluating your detectors against diverse perturbation strategies, including those leveraging vision-language models for semantic guidance, to proactively identify and mitigate latent vulnerabilities before deployment.

Key insights

Agentic orchestration of multi-domain primitives significantly enhances deepfake detector evasion under black-box transfer.

Principles

• Combining VLM and LLM improves semantic awareness in attacks.
• Diverse primitive sets target heterogeneous inductive biases.
• Agentic orchestration boosts attack transferability.

Method

ARMOR++ uses Qwen2.5-VL for semantic priors and Qwen3 LLM to orchestrate five primitives, including optimization, saliency, spatial, frequency, and block modifications, for perturbation mixing.

In practice

• Integrate VLMs for semantic guidance in adversarial attacks.
• Employ LLMs for adaptive hyperparameter tuning in attack generation.
• Combine diverse perturbation types to improve attack robustness.

Topics

• Deepfake Detection
• Adversarial Attacks
• Agentic AI
• Vision-Language Models
• Large Language Models
• Black-box Transfer Attacks

Best for: Computer Vision Engineer, Research Scientist, CTO, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• On Success and Simplicity: A Second Look at Transferable Vision-Language Attack Pipeline — Simpler, domain-knowledge-driven adversarial attack pipelines can achieve superior transferability and efficiency for Vision-Language Pre-training Models.
• Introducing Command A+: Making sovereign agentic capabilities available to all - Cohere — Cohere's Command A+ democratizes enterprise-grade agentic AI through an efficient, open-source MoE model.
• Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis — Orchestrated SLM ensembles, especially with evidence grounding, can outperform single LLMs for specialized tasks like malware analysis.
• Data Leakage Prevention in Agentic Applications via Preemptive Hardening — A pre-deployment pipeline hardens agentic applications against data leakage and tool misuse, achieving significant reductions without runtime policy enforcement.
• Article: Orchestrating Agentic and Multimodal AI Pipelines with Apache Camel — Orchestrate agentic and multimodal AI with integration frameworks for production reliability and clear separation of concerns.
• Scoped Verification for Reliable Long-Horizon Agentic Context Evolution under Distribution Shift — Graph-regularized context evolution with scoped validation sustains LLM agent reliability under distribution shifts.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Computer Vision and Pattern Recognition.