As AI-generated synthetic images become increasingly realistic, Vision Transformers (ViTs) have emerged as a cornerstone of modern deepfake detection. However, the prevailing reliance on frozen, pre-trained backbones introduces a subtle yet critical vulnerability. In this work, we present the Surrogate Iterative Adversarial Attack (SIAA), a gray-box attack that exploits knowledge of the detector's ViT backbone alone and operates entirely within the target detector's feature space to craft highly effective adversarial examples. Through our experiments, involving multiple ViT-based detectors and diverse gray-box scenarios, including few-shot learning, complete training misalignment and attack transferability tests, we demonstrate that this vulnerability consistently yields high attack success rates, often approaching white-box performance. By doing so, we reveal that backbone knowledge alone is sufficient to undermine detector reliability, highlighting the urgent need for more resilient defenses in adversarial multimedia forensics.

翻译：随着人工智能生成的合成图像日益逼真，视觉变换器已成为现代深度伪造检测的基石。然而，普遍依赖冻结预训练骨干网络的做法引入了一种细微但关键的脆弱性。本研究提出代理迭代对抗攻击——一种利用对检测器视觉变换器骨干知识、完全在目标检测器特征空间内运作的灰盒攻击方法，旨在生成高效对抗样本。通过涉及多种基于视觉变换器的检测器及多样化灰盒场景（包括小样本学习、完全训练错配及攻击迁移性测试）的实验，我们证明这种脆弱性始终能产生较高的攻击成功率，常接近白盒攻击水平。由此揭示：仅凭骨干网络知识就足以破坏检测器可靠性，凸显了在对抗性多媒体取证领域亟需更具韧性的防御策略。