Abstract:The security of AI-generated content (AIGC) detection based on GANs and diffusion models is closely related to the credibility of multimedia content. Malicious adversarial attacks can evade these developing AIGC detection. However, most existing adversarial attacks focus only on GAN-generated facial images detection, struggle to be effective on multi-class natural images and diffusion-based detectors, and exhibit poor invisibility. To fill this gap, we first conduct an in-depth analysis of the vulnerability of AIGC detectors and discover the feature that detectors vary in vulnerability to different post-processing. Then, considering the uncertainty of detectors in real-world scenarios, and based on the discovery, we propose a Realistic-like Robust Black-box Adversarial attack (R$^2$BA) with post-processing fusion optimization. Unlike typical perturbations, R$^2$BA uses real-world post-processing, i.e., Gaussian blur, JPEG compression, Gaussian noise and light spot to generate adversarial examples. Specifically, we use a stochastic particle swarm algorithm with inertia decay to optimize post-processing fusion intensity and explore the detector's decision boundary. Guided by the detector's fake probability, R$^2$BA enhances/weakens the detector-vulnerable/detector-robust post-processing intensity to strike a balance between adversariality and invisibility. Extensive experiments on popular/commercial AIGC detectors and datasets demonstrate that R$^2$BA exhibits impressive anti-detection performance, excellent invisibility, and strong robustness in GAN-based and diffusion-based cases. Compared to state-of-the-art white-box and black-box attacks, R$^2$BA shows significant improvements of 15% and 21% in anti-detection performance under the original and robust scenario respectively, offering valuable insights for the security of AIGC detection in real-world applications.

Gray-Box Shilling Attack: An Adversarial Learning Approach

Towards Efficient Data Free Blackbox Adversarial Attack

Shilling Black-Box Recommender Systems by Learning to Generate Fake User Profiles

Attacking Recommender Systems with Augmented User Profiles

Attacking Recommender Systems With Plausible Profile

Anti-FakeU: Defending Shilling Attacks on Graph Neural Network Based Recommender Model

Shilling Black-box Review-based Recommender Systems through Fake Review Generation

Generative Adversarial Networks: A Survey on Attack and Defense Perspective

Multi-agent Attacks for Black-box Social Recommendations

Review-Incorporated Model-Agnostic Profile Injection Attacks on Recommender Systems

Collaborative Generative Adversarial Network for Recommendation Systems

Knowledge-enhanced Black-box Attacks for Recommendations

Revisiting Adversarially Learned Injection Attacks Against Recommender Systems

Poisoning GNN-based Recommender Systems with Generative Surrogate-based Attacks

Recommender Systems Based on Generative Adversarial Networks: A Problem-Driven Perspective

A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks

Single-User Injection for Invisible Shilling Attack against Recommender Systems

Wasserstein GAN-based architecture to generate collaborative filtering synthetic datasets

Generating Adversarial Examples with Adversarial Networks

Adversarial Attacks for Black-Box Recommender Systems Via Copying Transferable Cross-Domain User Profiles

Take Fake as Real: Realistic-like Robust Black-box Adversarial Attack to Evade AIGC Detection