Abstract
Generative models are revolutionizing industries by synthesizing high-quality images, yet they pose societal risks as they are exploited at scale for generating disinformation, propaganda, scams, and phishing attacks. Recent work has developed detectors with remarkable accuracy in identifying images generated by current models, but the robustness of the detectors remains to be explored. This paper investigates the robustness of these detectors against adversarial perturbations designed to elude detection. We observe that an end-to-end adversarial attack on the entire detection pipeline is ineffective due to the long stochastic process of diffusion models. Instead, we create intermediate guidance for the attack at the model internals. Empirical results on both black box and white box attacks demonstrate the importance of our proposed intermediate supervision when constructing the attack. Our results show that our approach can fool the detector, reducing the detection accuracy by up to 69 points in the black-box setting and 91 to 100 points in the white-box setting. In addition, our attack transfers well to generated images from unknown models, including StyleGAN. Our work suggests that existing AI-generated image detectors are easily deceived by adversarial perturbations, highlighting the need for more robust detectors.