Untraceable DeepFakes via Traceable Fingerprint Elimination
Authors: Jiewei Lai
Lan Zhang
Chen Tang
Pengcheng Sun
Xinming Wang
YUNHAO WANG
Venue: ICLR 2026 Poster (2026)
Keywords: DeepFakes Attribution;Adversarial Attack;Generative Model Fingerprint
Primary area: other topics in machine learning (i.e., none of the above)

Abstract: Recent advancements in DeepFakes attribution technologies have significantly enhanced forensic capabilities, enabling the extraction of traces left by generative models (GMs) in images, making DeepFakes traceable back to their source GMs. Meanwhile, several attacks have attempted to evade attribution models (AMs) for exploring their limitations, calling for more robust AMs.
However, existing attacks fail to eliminate GMs' traces, thus can be mitigated by defensive measures.
In this paper, we identify that untraceable DeepFakes can be achieved through a multiplicative attack, which can fundamentally eliminate GMs' traces.
Therefore, by leveraging the structural prior from content-coupled fingerprints, we design a multiplicative attack framework that instills an explicit inductive bias into the adversarial model, guiding it to eliminate fingerprints within DeepFakes, thereby evading AMs even enhanced with defensive measures. This framework trains the adversarial model solely using real data, applicable for various GMs and agnostic to AMs.
Experimental results demonstrate the outstanding attack capability and universal applicability of our method, achieving an average attack success rate (ASR) of 97.08\% against 6 advanced AMs across 12 GMs.
Even in the presence of defensive mechanisms, our method maintains an ASR exceeding 72.39\%.
Our work underscores the potential challenges posed by multiplicative attacks and highlights the need for more robust AMs.

Published as a conference paper at ICLR 2026
UNTRACEABLE DEEPFAKES VIA TRACEABLE FINGERPRINT ELIMINATION
Jiewei Lai', Lan Zhang Chen Tang', Pengcheng Sun', ,iinming Wang', Yunhao Wang University of Science and Technology of China, lnsttittee of Artificial Intelligence,
Hefei Comprehensive National Science Center, Lenovo Research jw_la ima il ustc edu on, zhang antttt edu. cn, (chentang1999, speical0806, xi xinmi siiniiggwwgge @maaaannngmmmmmmmmmmmaaaaaii @ma ustc. cestt..edu edu. en, wangyh436 Lenovoo com.
ABSTRACT
Recent advancements in DeepFakes attribution technologies have significantly en- hanced forensic capabilities, enabling the extraction of traces left by generative models (GMs) in images, making DeepFakes traceable back to their source GMs. Meanwhile, several attacks have attempted to evade attribution models (AMs) for exploring their limitations, calling for more robust AMs. However, existing at- tacks fail to eliminate GMs' traces, thus can mitigated by defensive measures. In this paper, we identify that untraceable DeepFakes can be achieved through a multiplicative attack, which can fundamentallyy eliminate GMs' traces. Therefore, design
by leveraging the structural prior from content-coupled fingerprints, a multiplicative attack framework that instills an explicit inductive bias into the adversarial model, guiding eliminate fingerprints within DeepFakes, thereby evading AMs even enhanced with defensive measures. This framework trains the adversarial model solely using real data, applicable for various GMs and agnostic to AMs. Experimental results demonstrate the outstanding attack capability and universal applicability of our method, achieving an average attack success rate (ASR) of 97.08% against 6 advanced AMS across 12 GMs. Even in the pres- ence of defensive mechanisms, our method maintains an ASR exceeding 72.39%. Our work underscores the potential challenges posed by multiplicative attacks and highlights the need for more robust AMs.
INTRODUCTION
With the rapid development of GMs, such as generative adversarial networks (GANs) (Karras et al. Miyato al., 2018 Binkowski et al. (0088) and diffusion models (DMs) (Rombach et al. creating realistic and diverse high-quality images is becoming easily accessible. However, this progress also enables misuse, leading to issues such as misinformation and intellectual property infringement. Therefore, dedicated research efforts are being paid to forensics, such as DeepFakes detection for authenticity identification (Wang et al. 2025).
2018
2022
DeepFakes attribution, a method that surpasses DeepFakes detection by identifying both the au- thenticity of an image and the specific model or type of models used to generate it, is promising approach for enhancing accountability among malicious content creators. This technology captures distinctive traces left by GMs within images, known as the model fingerprint, thereby attributing generative content its source model. Additionally, it supports intellectual property protection by identifying unauthorized use of copyrighted models or their generative content.
With significant advances in DeepFakes attribution, research into the vulnerability of AMs, known as attribution attacks, has emerged to explore their limitations, thereby fostering more robust attri- bution methods and effective countermeasures. Current attacks evade AMs by adding perturbations into images. called additive attacks, demonstrating considerable attack performance. However, our analysis and preliminary experiments reveal fundamental flaw: they are easy to defend against be- cause they fail to eliminate the fingerprints that are essential for attribution. This implies that while
"Corresponding author.

---

Published as a conference paper at ICLR 2026
existing methods can temporarily circumvent attribution, their inability to eliminate fingerprints ren- ders them inherently fragile and circumventable due to persistent forensic traces.
Therefore, this paper further explores attack methods against attribution methods, developing an attack strategy to achieve untraceable DeepFakes via fingerprint elimination that not only evades AMs but also circumvents defense mechanisms. To achieve this objective, three critical issues must be addressed: 1) The trade-off between fingerprint elimination and visual imperceptibility. While more extensive modifications generally enhance attack performance, they can also compromise im- age quality. Moreover, failing to eliminate the fingerprint undermines the effectiveness of the attack. 2) The broad spectrum of GMs and their diverse fingerprint characteristics present sigmificant com- plexity. It is impractical to design model-specific method, therefore, ensuring the universality of our approach enhances its applicability to DeepFakes generated by various GMs without requiring customization. 3) Additionally, the adversary often lacks knowledge of the attribution mechanisms in practical scenarios. Thus, designing model-agonist attack that is independent of specific AMs is essential for ensuring its effectiveness in evading various unknown AMs.
To address these challenges, we propose universal and black-box attack strategy targeting AMs and defensive mechanisms by fingerprint elimination. By leveraging the structural prior that model modulations, we identify the multiplicative attack that can elimi-
fingerprints are content-couple nate traceable fingerprints while preserving perceptual integrity through adversarial matrix. We rigorously prove the existence of multiplicative adversarial matrices and demonstrate that defend- ing against this attack is fundamentally constrained by statistical limits: 1) Without paired clean and adversarial images, inverting the multiplicative attack is non-identifiable: 2) Even with paired data, achieving low estimation error requires prohibitively large sample size, rendering practical defense unreliable. Subsequently, we design a universal and black-box multiplicative attack frame- work that leverages this structural prior to instill an inductive bias into the adversarial model, guiding it to learn to effectively eliminate fingerprints within DeepFakes while preserving the visual fidelity. This framework constructs the model using exclusively real data without requiring any DeepFakes or GMs. Specifically, this framework comprises three modules: 1) Data synthesis: employs sam- pling and transformation units to create synthetic data from real data, mimicking the characteristics of DeepFakes without access to GMs. 2) Model Construction: trains the model to eliminate arti- ficial fingerprints within synthetic images through explicit joint optimization of both visual fidelity and fingerprint elimination, thereby enabling genuine fingerprint elimination rather than mere ob- scuring. 3) Fingerprint Elimination: given DeepFakes generated by any GMs, the resulting model effectively serves the adversarial matrix eliminate fingerprints rather than merely obscuring. thus evading unknown AMs even with the presence of the defensive mechanisms.
Our main contributions are summarized as follows:
reveal that current attacks against AMs are constrained to additive perturbations through analysis and preliminary experiments. This additive nature inherently preserves model- specific fingerprints, rendering them highly susceptible to effective defensive mechanisms.
We theoretically identify that the multiplicative attack can provably eliminate GMs' finger- prints by leveraging their content-coupled modulations, and prove this attack is statistically non- non-invertible, rendering it intrinsically evasive against AMs, even under defenses.
We propose a universal and black-box multiplicative attack method which instills the in- ductive bias into the adversarial model, enabling it effectively eliminate traceable finger- prints while preserving visual fidelity without requiring any DeepFakes or access to AMs.
We experimentally validate our method's effectiveness against advanced AMs across 12 GMs with an ASR of 97.08% surpassing SOTA methods. Crucially, it achieves ASR of more than 72.39% against defensive measures. Quantitative analysis further confirms that method can effectively eliminate fingerprints and validate its multiplicative nature.
2 RELATED WORKS
2.1 DEEPFAKES ATTRIBUTION
DeepFakes attribution technologies focus on extracting a unique fingerprint left by GMs within FeepFakes to determine its source model. The pioneering work introduced model fingerprints and
2

---

Published as a conference paper at ICLR 2026
designed the AttNet framework to trace the source model. Building upon this foundation, sub-
sequent research studies actively inserted transferable fingerprints into GMs, thereby enabling the
decoupling of the fingerprint from the generated content (Yu et al. 2021 2022). To enhance the
capabilities of AMs in identifying unseen GMs, researchers explored DeepHakes attribution under
an open-set setting (Girish al. [02T Yang al.) (023). Instead of attributing images specific
models, these studies aimed at architecture-levd attribution, attributing images back to their source architectures (Frank et al., 2020 Yang et al. 2022; Bui et al. 2022, Asnani al.) 2023). DCT
revealed that architecture fingerprints cause severe artifacts in the frequency domain and performed attribution within this domain (Frank et al., 2020). DNA-Det identified the global consistency of
architectural fingerprints and developed patch-wise contrastive learning-based framework for attri- bution Yang et al., 2022). Meanwhile, some studies achieved this goal through a mixing represen- tation strategy and reverse engineering, respectively (Bui et al. [022] Asnani et al., 2023). Recently, the rise of DMs spurred research into attributing images generated by DMs. For example, the image and its description are simultancously utilized for DeepFakes detection and attribution (Sha et al, 2023). Besides, reconstruction errors were used to infer the source model, as well-reconstructedd images are likely generated from the inspected model (Wang et al. 2024 Laszkiewicz et al. 2024).
2.2 ANTI FORENSICS
DeepFakes forensies are critical for curbing misuse and establishing responsibility, driving many efforts devoted to exploring the vulnerabilities of existing forensic approaches, thus promoting more advanced technologies, including DeepFakes detection and attribution. Early anti-forensic work uti- lized adversarial examples like FGSM (Goodfellow et al. 2015), PGD (Madry et al., 2018) to add perturbations into DeepFakes for evading detectors (Neekhara et al. [021]] Liao et al. (022).. Dif- fAttack subsequently used DMs to generate highly transferable perturbations (Chen et al. (024a)) Similarly, imperceptible semantic level perturbations were designed through latent space optimiza- tion (Meng et al. 2024). Some studies (Wesselkamp et al. 2022; Liu et al., (203)) evaded detectors by reducing detectable artifacts rather than adding perturbations. For instance, FakePolisher learned real representation from real images to construct dictionary for reducing artifacts (Huang al., 2020). StealthDiffusion (Zhou et al. 2024) achieved this by optimizing both the latent space and the frequency domain, enabling images indistinguishable from real images. However, research the vulnerability of AMs remains limited. Specifically, the vulnerability faced with transformation- based methods like compression were explored (Yu et al., 2019; Yang et al., 2022). Transferable adversarial samples were also attempted to attack AMs (Wu et al. 2024). TraceEvader, a universal attack method by inserting perturbations into high frequency information and blurring low frequency information of images, thus confusing traceable fingerprints to evade AMs (Wu et al. 2024).
Liao
Although existing methods achieve high ASR, they fail eliminate the underlying model finger- prints within DeepFakes. In this paper, we propose a universal, black-box attack against AMs that fundamentally eliminates these fingerprints. Consequently, our method is significantly more chal- lenging to defend against, as demonstrated by both theoretical analysis and extensive experiments.
PRELIMINARY STATEMENT
3.1 THREAT MODEL
Defender's Goals and Capabilities: The goal of the defender is trace the source model of Deep- Fakes, determining which model instance or type of architecture the image is from. The defender 1) trains attribution models with available clean DeepFakes and 2) attempts to alleviate the vulnerabil- ity of AMs through defensive strategies such adversarial training. The defender may also collect or create some adversarial DeepFakes for enhancing attribution robustness.
Adversary's Goals and Capabilities: The goal of the attack is to generate DeepFakes and enhance untraceability to evade AMs even under defensive measures, thereby avoiding responsibility. The attacker 1) has full ownership of GMs and knowledge of training data, 2) has access to in- formation about any AMs, and 3) aims to develop a universal and black-box attack that eliminates model fingerprints, rendering untraceable DeepFakes without altering content perceptibly.
3

---

Published as a conference paper at ICLR 2026
ProGAN
GramerGAN
SNGAN
MMDGAN
InfoMax- GAN
StarGAN
StyleGANS
SD v1.5
SD v2-base
Original
TrankE vader
Oura
Figure 1: Spectral analysis (top to bottom): original, additive attack images, and images processed
with our method. See A.1.2 (Figures and A.4.2 2
(Figure 15 for more.
3.2 PROBLEM FORMULATION
Inspired by camera fingerprint studies QQian al. 2023), an image æ generated by model M can be modeled as: r = σ + x. fM + O, where x represents the visual content of the image, fM denotes the model-specific fingerprint left by model M,, and captures other noise components. For brevity, will use f'M to refer to the entire fingerprint term. Based on this formulation, we provide definitions for DeepFake attribution and attribution attack as follows:
Definition 1 (DeepFake Attribution). Let F RCRW P(M), where P(M) denotes the power set of all possible GMs, be an altribution model that identifies the source GMs M responsible for generating x. F aims extract fM from x through
F(z) fM s.t. f
where is a tolerance threshold for estimation errors.
Definition 2 (Attribution Attack), Let T RCHW - RCHW be an attack model that generates an adversarial image T (xx) to mislead FF while preserving visual fidelity, that is
[[F(T())) F(x)ll 2 and D(T(x),, x) S
where :(..)) is a metric bounding the visual distortion and A bounds the allowable perturbation.
This paper aims design an attack method that applicable images generated by any GMs (universal) and capable of misleading all AMs without prior knowledge (black-box).
3.3 EXISTING ATTACK ANALYSIS
In this section, we establish that existing attacks are fundamentally additive in nature and, crucially, fail to eliminate the underlying model fingerprint, rendering them inherently vulnerable to defense.
Definition 3 (Additive Attack). Let Tada RCHW - RCHW be an additive attack model that generates adversarial images through inserting the perturbation into images: Tada(I:)
p.
In this context, clean image generated is attacked as Tada(x) = xd FM +p θ. The success of additive attack methods lies in their ability to add carefully crafted perturbation p that obscures the fingerprint within DeepFakes, thereby misleading AMs. It is important to note that this merely confuses the fingerprint, increasing the difficulty of extracting the fingerprint, however, fingerprint itself remains intact within DeepFakes.
We identify that existing attack methods are additive (Detailed analysis details in the Appendix A.I.I). therefore, they are casily defended against as they fail to eliminate the fingerprint within DakpS, Our defensive experiments and frequency analysis (Details the Appendix A.1.2 both reveal the limitations of them: easily defended against and 2) fail to eliminate the fingerprint:
1) Defensive Evaluations: We employ adversarial training to enhance the DNA-Det (Yang et al,
2022) and evaluate the effectiveness of additive attacks against defensive mechanisms. Experimental results reveal that additive attacks can be easily and effectively countered by a defensive strategy. As summarized in Fig the performance of all tested attacks experiences significant decline
4

---

Published as a conference paper at ICLR 2026
following adversarial training. For instance, Tracervader's ASR drops from 98.28% to 25.10% against the defensive mechanism. By incorporating adversarial training, defenders can significantly enhance the robustness of AMs to handle additive attacks.
2) Frequency Analysis: Model fingerprints exhibit pronounced characteristics in the frequency do- main, manifesting distinct patterns (Frank et al. 2020). Our frequency analysis provides evidence of the persistence of these fingerprints within adversarial images. As illustrated in Figure | images attacked by TraceEvader (Wu al. 2024) still exhibit high similarity in the frequency domain with their original counterparts, demonstrating that additive attacks fail to eliminate the fingerprint.
Therefore, merely confusing the fingerprint is insufficient to truly evade AMs. Conversely, we argue that true con-traccability can only be achieved by eliminating the fingerprint within DeepFakes.
4 METHODOLOGY
In this section, we first prove the existence of multiplicative attacks that provably eliminate GMs' fingerprints and show that is statistically non-invertible, rendering defense fundamentally limited. We then present a universal black-box framework that uses only real data to synthesize fingerprint- mimicking data and train an adversarial model to eliminate fingerprints across diverse GMs.
4.1 MULTIPLICATIVE ATTACK
The principle of attribution methods is the extraction of the fingerprint fM from DeepFakes. There- fore, we argue that true untraceability requires eliminating these fingerprints at their source rather than merely obscuring them. To achieve this, we propose multiplicative attack:
Definition 4 (Multiplicative Attack), Let Tiual RCHW - RCHW be multiplicative attack model that generates adversarial images with an adversarial matrix W: (mma(())= = x O W.
Structural Prior from Content- Coupled Fingerprints: : This formulation leverages a critical property of generative fingerprints: GMs' fingerprints not independent noise but are intrinsically coupled with the image content. They arise from content-dependent operations such as up-sampling, which manifest structured modulations (e.g., grid-like patterns) (Odena al. 2016 Frank al. 2020
The Inductive Bias for Elimination: The multiplicative attack leverages this structural prior as an explicit inductive bias, directly disrupting this modulation mechanism through a multiplicative op- eration with an adversarial matrix. Specifically, in this context, clean image is attacked as: (x) zo W + fM @ W O. Here, f'M = fM @ W is the altered fingerprint, by optimiz- ing the adversarial matrix W, making f'M distinct from the original fM. the source GMs can not be traced because f'M * fM- By eliminating the original fingerprint, this attack removes all residual source-specific information, rendering attribution impossible even under advanced defenses.
Theoretical Existence of Adversarial Matrix: We prove that there always exists a multiplicative adversarial matrix W capable of constructing an adversarial image as x' = x O W to evade F while preserving visual fidelity. This is formally established in Theorem I and proved in Appendix A.2
4.2 DEFENSE DIFFICULTY ANALYSIS
We show that the multiplicative attack is statistically non-invertible, making inversion and approxi- mate inversion defenses infeasible, rendering it intrinsically evasive against both AMS and defenses:
1) Inversion Defense: Let x' P( O W)+ + where P denotes standard pre-processing and 7 rep- resents noise. Without paired supervision, inverting x from x' is non- ii---detttiiable. In practice, access to such paired samples is unrealistic. Even with N paired samples and per-pixel Gaussian model d = w, + пjz ~ N(0,o?), any unbiased estimator satisfies Var(W,) 2 /2/ E(²])) Consequently, achieving MSE < =² requires N 2 o²/ E[a]]). (=]3))) Details in Appendix A.2.2
2) Approximate Inversion: Using neural network to approximate W-1 also requires a large num- ber of image pairs, which is impractical. Moreover, using a network to invert images imprints its fingerprints onto the recovered content, further degrading defense efficacy. Our experiments show that even with simultancous access to both clean and adversarial images, defenders still cannot reli- ably attribute the source of DeepFakes. Details in Section 5.3 and Appendix A.4.2
5

---

Published as a conference paper at ICLR 2026
Data Synthesis
Model Construction
3. Fingerprint Elimination
X
xf
X
U
tntceable
Antefiicni fingerpeent
Eepatiol
Lepectrat
perccepcunt
GRt fingeerpeent
A Adversarial model +b
vatrocoalte
(3,)
Overview of multiplicative attack framework. (I): Data synthesis via sampling U. and transformation Ue units to generate fingerprint-minne mimicking data zs. (2): Adversarial model & trained with multi-domain loss. (3): & attacks DeepFakes into x', which evades AMs A while
Figure 2:
preserving realism. G denotes the source GMs; 9 is a post prost-prosssiin smoothing operator.
4.3
MULTIPLICATIVE ADVERSARIAL ATTACK FRAMEWORK
4.3.1
PARAMETERIZING THE MULTIPLICATIVE MATRIX
While Definition inates fingerprints, directly optimizing such matrix faces two fundamental challenges: 1) Com- putationally Infeasible: It is impractical to optimize and store the multiplicative matrix for every potential input. AMS are often inaccessible for optimization, and huge storage requirements render deployment physically impossible. 2) Limited Generalization: fixed W matrix optimized one image would lack generalization capability as fingerprint patterns vary across diverse GMs.
4 and Theorem 1 establish the existence of multiplicative matrix W that elim-
To overcome these limitations, propose parameterizing W input-dependent function W(x) and modeled via a neural network & that implements the multiplicative attack: +(x)) x @ W (x).
By modeling (x:) with compact neural network, we avoid the infeasible storage (only requir- ing fixed parameters) and computational cost per image implied by fixed-matrix approach. The input-dependent nature of ((x) inherently enables generalization across diverse inputs, resolving the fixed-matrix limitation. Critically, learning ((x) @ W(x) preserves the multiplicative attack structure while ensuring numerical stability, validated quantitatively in Section 5.4
4.3.2 FRAMEWORK DESIGN
Objective. The primary objective of this framework construct an adversarial model that serves as the adversarial matrix to eliminate fingerprints within DeepFakes, thus evading AMs, even under enhanced defenses. This model must satisfy: 1) wwwprrceppibiii---ffeeeeeeeeeeee
Trade-off: Main- taining visual fidelity while ensuring effective fingerprint elimination in both pixel and frequency domains.2) 2) Universality: Eliminating fingerprints across diverse GMs without model-specific cus- tomization. 3) Black-Box Effectively against various AMs without prior knowledge. Therefore, our framework explicitly designed to embed a targeted inductive bias into the adversarial model, guiding it learn how to effectively eliminate fingerprints by leveraging their content-coupled struc- tural prior. This design enables end-to-end construction without relying on any DeepFakes, GMs, or access specific AMs, ensuring universal applicability across diverse GMs.
Overview. As illustrated in Figure 2 our framework implements an end-to-end pipeline with tightly coupled modules that collectively achieve fingerprint elimination. Our framework proceeds in three sequential steps: First, the data synthesis module generates fingerprint-nimickinn images by apply- ing sampling and transformation operations real data, effectively simulating the artifacts left by diverse GMs without requiring access to any GM. Second, the model construction module trains an adversarial network on these synthetic pairs to eliminate artificial traces through joint optimiza- tion in perceptual, spatial, and frequency domains. Crucially, each loss term explicitly targets fingerprint-carrye characteristic: perceptual loss preserves semantics while enabling modification, spatial loss and spectral loss suppresses low-level pixel artifacts and high-frequency traces respec- tively, ensuring genuine fingerprint elimination rather than mere visual fidelity. Finally, the trained model functions parameterized multiplicative operator that intrinsically removes traceable fin- gerprints from any DeepFake, producing untraceable outputs while maintaining perceptual quality.

---

Published as a conference paper at ICLR 2026
Insight. The following motivation drives to mimic the fingerprints of GMs: 1) Sampling Oper- ations in GMs: GMs primarily rely on nown/up-samplie operations to generate images, such as nearest neighbor sampling, which introduces grid-like patterns in both the spatial and frequency do- mains (Odena et al., 2016 Frank et al.] 2020). These patterns are inherent artifacts of the sampling processes used by GMs. 2) Image Transformation Similarities: Certain transformation operations exhibit characteristics similar to those found in GMs. For example, blurring and adding noise using kernels closely resemble the convolution computations (Yang al., (022). These transformations share spatial properties with the operations within GMs. Therefore, the traces left by sampling and transformation operations exhibit properties that are analogous to the fingerprints of GMs.
Data Synthesis. To effectively mimic the fingerprints of GMs, we design sampling and transforma- tion units within the data synthesis module, as illustrated in Figure This module first applies the sampling unit Us to real images, followed by the transformation unit be to yield synthetic images:
1) The Sampling Unit (-(-) employs three sampling techniques: nearest-neighhor, bilinear, and bi- cubic interpolation. Given a real image 2r E RCHW, it is first down-sampled to Idown E IR "''''W" where C" C, H' H/2, and W = W/2. And then the image is up- up-sadeled back to its orig- inal dimensions, resulting in Tup E RCHW Specifically, the sampling unit stochastically applies down/up-sampling with probability P1: Fup = Us (Zr, 8down; Sup= P1), where Sdown; Sup selected randomly to introduce diverse spatial artifacts and enhance robustness.
2) The Transormationn Unit (-) incorporates series of image transformation techniques in- troduce diverse and realistic variations: (a) Gaussian noise sampled from (N0 where o² is randomly selected from [5.0, 20.0]: (b) Gaussian filtering with a kernel size randomly chosen (c) Randomly crops with an offset between 5-20% of the image lengths; (d) JPEG compression using quality factor randomly sampled from [10,75]: (c) Relighting (adjusts bright- ness, contrast, and saturation) with random factors from [0.5, 1.5]; (f) Combination processes in the following order: relight, cropping, blurring. compression and adding noise. one of the above operation / is randomly selected and applied with probability p2: Ie = Ue P2).
By utilizing sampling and transformation operations, we can effectively simulate the properties of GM-generated data without access to specific GMs, avoiding limitations to any particular GM.
Model Construction. The adversarial model & is trained end-to-end on real/synthetic image pairs (I,,,x,) xx)) to eliminate artificial fingerprints within synthetic images while preserving perceptual fi- delity. & comprises an encoder-decoder architecture. The encoder includes convolutional layers and 5 residual layers to extract feature maps. The decoder utilizes 2 up-sampling layers and a con- volutional layer to reconstruct images. More details in the Appendix [A.3 and Table 2 The model is optimized to target both visual fidelity and fingerprint elimination explicilly:
1) Fidelity Preserving: To ensure visual and semantic similarity hetween ((x,)) and xy, we employ perceptual loss function with pretrained 16-layer VGG network as the backbone to extract high- level features. The perceptual loss is defined as: Eperceptual = =Eier Wi Will (ā(z,) - f2. where
fi denotes the feature extracted from the selected layer F F= = network for image x, and w, [FT represents the weight.
( f' f'a... f's} of the perceptual
2) Fingerprint Elimination: Given that synthesis operations and GMs introduce content-coupled artifacts in both spatial and frequency domains, we design a spatial loss to remove low-level ar- tifacts within the pixel domain and multi-scale spectral loss for frequency domain optimiza- tion. Specifically, the spatial loss is formulated as Lapottial = [xx))) - æ For frequency domain artifacts elimination, we apply the Fourier Transform to obtain the frequency represen- tation of a scaled image Is with scale factor E S = (1. 0.5, 0.25). calculating the magni- tude of the frequency components, and applying logarithmic scaling stabilize numerical com- putations. And a small constant e is added to prevent taking the logarithm of zero values. The final spectral loss is formulated as Lepectral C(x, s4) log (og((ff((=*)) I + =), w, E {0.5, 0.3, 0.2) represents the weight. The total training loss function is formulated as: Liotal 31 Eperepptaa + 82Lapatial + ByLospecral-
Ee.es w:| [()(x,), 8) L(x,, st]l1,, where
By training the model with a Φ an inductive bias for fingerprint elimination, enabling it to remove artificial fingerprints while preserving visual fidelity, thereby realizing the core principle of multiplicative attack: eliminating the fingerprint left by GMs rather than merely obscuring.
optimization strategy, we instill in the attack model
7

---

Published as a conference paper at ICLR 2026
Table 1: Comparison of ASR (%) across various AMs. The best and second-best results are marked in bold and underlined. The symbol '.' within the table indicates not applicable or limited by
computational overhead. The performance AMs on clean samples presented in Table
DNA-Det
AttNet
DCT
Reverse
POSE
LTracer
Average
SSIM
LPIPS
PGD
99.98
66.16
59.77
6.75
58.17
0.912
0.401
BIM
0.75
47.25
43.78
3.40
23.79
0,910
0.401
MIFGSM
8.90
80.25
67.58
1.30
39.51
0.911
0.401
Diff'tttck
100.00
66.75
25.40
56.8
62.24
0.962
0.095
Transformation
43.70
99.96
61.21
54.89
47.01
98.79
67.60
0.941
0.151
FakePolisher
75.00
40.95
53.70
90.33
95.85
71.17
0.994
0.067
Regeneration
93.30
99.95
84.46
81.05
39.71
0.00
78.60
0,912
0.210
TradeEvader
98.28
65,45
92.40
88.80
86.81
90.89
87.11
0,995
0.038
Ours
98,56
100.00
100,00
89.54
95.52
98.89
97.08
0.963
0.093
Ours (w/o (4,)
98.10
100.00
100.00
84.75
93.76
95.32
0,970
0.076
Ours (w/o (de)
91.69
100.00
100.00
81.48
95.83
93,80
0.968
0.083
Ours (w/o GBMS)
86.15
100.00
100.00
67.83
95.14
89.82
0.965
0.102
Ours (w/o Espatial)
86.34
100.00
100.00
87.80
96.89
94.21
0.964
0.102
Ours (w/o Cepectral)
92.45
100.00
61.16
50.04
97.92
80.31
0.950
0.089
Fingerprint Elimination. After training, given a clean and traceable generative image the at- tack model & eliminates the fingerprints left by the corresponding source GMs, thereby achieving an untraceable adversarial image for evading DeepFakes attribution. Furthermore, to eliminate im- perfection or distortion artifacts and enhance the evasion capability, we implement hybrid image smoothing operation combining Gaussian Blur and Mean Shift filtering (GBMS) G(-). The adver- sarial image is generated as: x' = TTmaa (x = (z)).
Guided by the structural prior that model fingerprints content-coupled modulations, our frame- work realizes the multiplicative attack principle by parameterizing the adversarial matrix W as a neural function. This design instills inductive bias that enables effective fingerprint elimination without compromising perceptual fidelity, while overcoming the computational infeasibility and poor generalization inherent in directly optimizing the matrix W.
5 EXPERIMENTS
We conduct comprehensive experiments to evaluate our attack in evading diverse AMs and defensive mechanisms. Additionally, quantitative analysis in both spatial and frequency domains demonstrates that our method is multiplicative and effectively eliminates fingerprints in generated images.
5.1 EXPERIMENTS SETUP
Our experiments span 7 GANs, 5 DMs, and 4 datasets against 6 advanced AMs, and implement 8 attack methods, including 4 transferable attacks (PGD, BIM, MIFGSM, DiffAttack (Chen et al., 2024a)), 3 black-box methods (transformation, FakePolisher (Huang et al.) 2020), TraceEvader (Wul ct al. 2024)). ), and regeneration attack Zhao et al. (2024). Besides, we retrain DNA-Del for attribut- ing latest DMs (SD3 (Esser et 2024). FLUX (Labs al. 2025), PixArt (Chen al. 2024b) with DiTFake dataset (Li et al. 2025). named DNA-Der-DMs for verifying the effectiveness of our method in eliminating fingerprints of DMs. Details in the Appendix A.4. Table
5.2 EFFECTIVENESS AGAINST ATTRIBUTION METHODS
We evaluate the effectiveness of our proposed method in evading DeepFakes attribution technologies while preserving image quality and demonstrating its universality across diverse GANs and DMs.
1) Effectiveness: Our method achieves superior evasion performance against AMs in black-box settings. As shown in Table I it attains the highest ASR on four AMs and the second-highest on two others, significantly outperforming existing SOTA methods. Notably, method achieves average ASR of 97.0 97.88% substantially higher than TraceEvader's 87.11%. While the regeneration attack achieves considerable ASR in partial AMs, its performance remains suboptimal compared
8

---

Published as a conference paper at ICLR 2026
to our approach. Particularly, its ASR degrades to 39.71% and 0.0% against POSE and LTracer, respectively, highlighting the necessity of fingerprint elimination for attack.
2) Universality: Our method effectively eliminates fingerprints from both GAN- and DM-generated DeepFakes, demonstrating broad applicability across diverse GMs. Notably, it achieves 98.89% ASR against L.Tracer and near- 100% ASR DNA-Det-DMS, attacking DeepFakes into real or SD3- generated images, validating its efficacy in eliminating DM-specific fingerprints. More in AA.42
3) Imperceptibility: Both quantitative and visual evaluations confirm the imperceptibility of our at- tack. As shown in [ our method matches TraceEvader in image fidelity, achieving 0.963 SSIM and 0.093 LPIPS. Visual comparisons (original vs. adversarial) are provided in Appendix A.4.2 Figure 13 confirming high visual quality preservation. Additionally, confusion matrices in Ap- pendix A.4.2 Figure [1] quantitatively demonstrate that our attack reliably misleads AMs into clas- sifying adversarial DeepFakes as real images, empirically validating perceptual indistinguishability.
5.3 EFFECTIVENESS AGAINST DEFENSIVE MECHANISMS
To better assess our attack against the adaptive defense, we identify two distinct scenarios: 1) Black-Box Scenario: the defender is unaware of the existence of our attack and can not di- rectly utilize our attack model to generate ad- versarial images for improving the robustness of AMs. However, the defender can attempt to enhance AMs by creating adversarial im- ages through all other known attacks. 2) White- Box Scenario: the defender is fully aware of our method and can directly utilize adversarial images created by the proposed method to en- hance AMs.
408.00 00
5 5
Or on 01
bolllck-oo box
Figure 3: ASR of our method against enhanced AMs. (a) ASR of our attack against AMs en- hanced with the augmentation samples indicated on the x-axis. (b) ASR of different attack meth- ods under the white-box setting.
1) Against Adversarial Training: Experimental results show neither white-box nor black-box de- fenses can effectively resist our attacks through adversarial training. As shown in Fig our attack achieves over 72.39% ASR in black-box scenarios. Even when defenders directly use our adver- sarial images to enhance DNA-Det, no mitigation effect is observed, because the adversarial image contains information related to the source model, and the ASR even reaches 100%.
2) Against Approximate Inversion: We demonstrate that training deep neural networks to recover the original image from the adversarial image is infeasible. The inverted images maintain an ASR of 97. 76% and 99.97%, respectively, validating the defensive resistance of our method. This is con- sistent with the conclusion of our defense difficulty analysis. More details in the Appendix A.4.2
5.4 ABLATION STUDY AND QUANTITATIVE ANALYSIS
Ablation Study Analysis: Experimental re- sults validate the importance of compo- nents (Mo,th, GBMS) and function design (Cspatioal Expectral) in our framework. As shown in Table [ while removing individ- ual components does not degrade image qual- ity, it significantly reduces ASR. For in- stance, although removing GBMS still achieves SOTA, the average ASR drops from 97.08% to 89.82%. Notably, without Espectral, our method achieves only 50.04% ASR against Reverse AMs. These results conclusively demonstrate the necessity of all designed components and loss functions.
AJ8
Figure 4: Ablation study on the weighting pa- rameters B3 and Bg with 3, fixed at 0.5, showing their impact on ASR, SSIM, and LPIPS.
Furthermore, the parameter configuration (31, 32, (0)== is empirically verified as the optimal choice, achieving the best trade-off between attack effectiveness and perceptual quality. As shown in Figure 4 this setting yields the highest ASR of 97.1%, outperforming all alternative configurations. Crucially, this gain in ASR is achieved without compromising perceptual quality: SSIM and LPIPS remain stable at 0.963 0.964 and 0.092-0.097, respectively.

---

Published as a conference paper at ICLR 2026
It is worth noting that method fundamentally operates by eliminating fingerprints, which inher- ently requires more modifications than subtle perturbations. While our approach introduces slightly more distortion than Evader, it still achieves perceptual quality superior to many existing meth- ods, striking a favorable balance between attack strength and visual integrity. We will further inves- tigate more efficient fingeprritt-elmmnnation mechanisms with minimal distortion in future work.
Frequency Domain Analysis: Analysis results indicate that our attack can effectively eliminate the fingerprint left by GANs and DMs. As shown in Figure | images attacked by our method exhibit significant differences from the original ones in the frequency domain. This visual evidence indicates that our attack successfully eliminates the source model's 's fingerprint from DeepFakes.
Image Domain Analysis: Distance and corre- lation analysis both demonstrate that the pro- posed attack method exhibits multiplicative characteristics rather than additive:
TadeeEvader
Outs
12 Distance
1) L2 distance among Residual Components: The residual component A T(x) - r veri- fies attack nature: fixed/stable A indicates ad- ditive attacks, while variable A signifies mul- tiplicative behavior. As visualized in Figure 5 attack exhibits significantly higher variance than Tradervader's stable residuals, confirming
10-
-0.
-1.0
Figure 5: Distribution of 1.2 distances between A (left) and Pearson Correlation Coefficient (PCC) between A and original images (right). See 1.2 and Figure 9 for more.
its multiplicative characteristics as the L2 dis- tance mainly within [10,30].
2) Correlation between A and Original Images: The residual components caused by multiplicative attack A = x C W = x @ (W 1) exhibit higher correlation with original images than those caused by additive attack
p. As shown in Figure 5 the A caused by our method exhibits high correlation with original images, with the absolute value of PCC mainly within [0.5.1]. This strong correlation is a distinctive signature of multiplicative operations, contrasting sharply with TraceEvader's ' residuals (PCC mainly within [0,0.25]).
Computational Efficiency Analysis: Our method achieves high computational efficiency by elimi- nating fingerprints in single forward pass, enabling simultaneous evasion of all AMs in a black box setting. In contrast, transferable adversarial attacks typically require multiple iterative optimiza- tion steps and access to the target AMs. Compared to existing black-box approaches, our method achieves substantially higher inference efficiency: it takes only 60.6s to generate 20k adversarial images, significantly faster than the 732.7s required by TraceEvader. (More results in the Table
CONCLUSION AND LIMITATION
In this paper, analyze the principles underlying existing attack methods and reveal a critical struc- tural limitation: current attacks are additive, inherently preserving GMs' fingerprints, making them vulnerable defense. We argue that true untraceability in DeepFakes can be achieved via multi- plicative attacks, and provide theoretical evidence that such attacks are statistically non- non-invertible, posing fundamental challenge existing defensive strategies. Building on this insight, we design universal attack framework in which the adversarial model learns to eliminate GM fingerprints using only real data, requiring no knowledge of AMs and ensuring broad applicability across di- verse GMs. Experiments show our method achieves an ASR of 97.08% across 6 SOTA AMs and 12 GMs, surpassing existing SOTA approaches. It remains highly effective under defense, maintaining an ASR exceeding 72.39%. Our work highlights the emerging threat of multiplicative attacks and underscores the urgent need for more robust attribution mechanisms.
While method successfully eliminates model fingerprints, it requires more structural modifica- tions than additive attacks. Although visually imperceptible, we aim to optimize efficiency in future work and explore more advanced attack-defense co-evolution strategies.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This research was supported by China National Natural Science Foundation with No. 62441228, Science and Technology Tackling Program of Anhui Province, No.2024233090200116 We also thank Lenovo Research for their support during this research.
ETHICS STATEMENT
This work investigates the elimination of traceable fingerprints in DeepFake generation, a capability that inherently raises ethical concerns. On one hand, techniques for producing untraceable synthetic media could be misused to facilitate disinformation, impersonation, and privacy violations. On the other hand, we argue that rigorously probing the limits of existing attribution technologies is essential for developing more robust and trustworthy countermeasures.
To mitigate potential misuse, we emphasize the following: 1) Intended Purpose: Our method is de- veloped strictly for research, aiming expose vulnerabilities current DeepFake attribution frame- works. 2) Restricted Scope: All experiments use only publicly available datasets under controlled settings; no real-world personal or sensitive data are involved. 3) Dual-Use Awareness: While our work demonstrates the feasibility of fingerprint elimination, its primary contribution lies in alert- ing the community to critical weaknesses in existing attribution technologies. By revealing these limitations, hope to catalyze research into stronger watermarking, authentication, and regula- tory safeguards. 4) Responsible Disclosure: We provide sufficient implementation details to ensure academic reproducibility, but deliberately omit end-to-end tooling that could be readily weaponized.
We fully acknowledge the dual-use nature this research and urge the community to interpret our findings not blueprint for malicious DeepFake creation, but as a proactive step toward anticipating adversarial capabilities and building more resilient defense mechanisms.
REFERENCES
Vishal Asnani, Xi Yin, Tal Hassner, and Xiaoming Liu. Reverse engineering of generative models: Inferring model hyperparameters from generated images. IEFE Trans. Pattern Anal. Mach. Intell., 45(12):15477-15499 2023. doi: 10. T0.1009/TAAMM..233333010
URL holhttp:: //o... aacdoi..or. org/
10.1109/IPAME 2023333312211111111
Mikolaj Binkowski. Danica J. Sutherland. Michael Arbel, and Arthur Gretton. Demystifying MMD gans. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL net/ fow.mmid=rl
Tu Bui, Ning Yu, and John P. Collomosse. Repmix: Representation mixing for robust attribution of synthesized images. In Shai Avidan, Gabriel J. Brostow, Moustapha Cissé, Giovanni Maria Farinella, and Tal Hassner (eds.), Computer Vision - ECCV 2022 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XIV, volume 13674 of Lecture Notes URL
in Computer Science, pp. 146 163.1 Springer, 2022. doi: htttp:://dii.oo http:/di..oogggg/o 1007/07787888 0-33-199781
Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion mod- els for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, pp. 1-17, 2024a. doi: 10. L09/TPAAM.202244488880
Junsong Chen, Chongjian Ge, Enze Xie, Yue Wu, Lewei Yao, Xiaozhe Ren, Zhongdao Wang, Ping Luo, Huchuan Lu, and Zhenguo Li. Pixart-E: for 4k text-to-image generation. In Ales Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol (eds.), Computer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedingy, Part XXXII, volume 15090 of Lecture Notes in Computer Science, pp. 74-91. Springer. 2024b. doi:
training of diffusion transformer
URL htttp:://to...... http:///ooooogg///// 10. 1007/ 0010//9778--0111-1111-----
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, Dustin Podell, Tim Dockhorn, Zion En-
11

---

Published as a conference paper at ICLR 2026
glish, and Robin Rombach. Scaling rectified flow transformers for high-resolution image synthe- sis. In Forty-first International Conference on Machine Learning. ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net, 2024. URL htt.h:tt///// https////ppereeeeeeeeom net forum?id- FPnUhsQJ5R
Joel Frank, Thorsten Fisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pp. 3247-3258. PMLR, 2020. URL http::/prroceedingg www.nni..m.......m............e. mwr. seress/viig. hww.1///rrakkaa... html
Sharath Girish, Saksham Suri, Sai Saketh Rambhatla, and Abhinav Shrivastava. Towards dis- covery and attribution of open-world GAN generated images. In 2021 IEEE/CVF Interna- tional Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, URL https:
2021, pp. 14074-14083. IEEE, 2021. doi: 10. 10.1100000110001111100 (099/CCC44922.22211..11 //661...r//...11111CC188222222.2 2021. 001883
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. httttp://arxi...oo
1412 6572
Yihao Huang, Felix Juefei-Xu, Run Wang, Qing Guo, Lei Ma, Xiaofei Xie, Jianwen Li, Weikai Miao, Yang Liu, and Geguang Pu. Fakepolisher: Making deepfakes more detection-evasive by shallow reconstruction. In Chang Wen Chen, Rita Cucchiara, Xian-Sheng Hua, Guo-Jun Qi, Elisa Ricci. Zhengyou Zhang, and Roger Zimmermann (eds.). MM '20: The 28th ACM International Conference on Multimedia, Virtual Event / Seattle, WA, USA, October 12-16, 2020, pp. 1217 1226. ACM, 2020. doi: 10. 10.1115/3394171.. 341333333. 3394171 33113332
URL https: org/ 10. 1145/
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. In 6th International Conference on Learning Representa- tions, ICLR 2018, Vancouver, BC, Canada. April 30 May 3, 2018, Conference Track Proceed- ings. OpenReview.net, 2018. http::::: http:///pppreeeeeeeeeeeeeeeeeee. / net CorrmmiddHli992ceee
Black Forest Labs, Stephen Batifol, Andreas Blattmann, Frederic Boesel, Saksham Consul, Cyril Diagne, Tim Dockhorn, Jack English, Zion English, Patrick Esser, Sumith Kulal, Kyle Lacey, Yam Levi, Cheng Li, Dominik Lorenz, Jonas Müller, Dustin Podell, Robin Rombach, Harry Saini, Axel Sauer, and Luke Smith. FLUX.1 kontext: Flow matching for in-context image generation and editing in latent space. CoRR, hbbs/2506.157423 2025. doi: 1044550AARXXV22566.55724 2506.15743
41.50.48550ara.. URL https: //ooi. 1tt.
Mike Laszkiewicz, Jonas Ricker, Johannes Lederer, and Asja Fischer. Single-model attribution of generative models through final-layer inversion. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net, 2024. URL net htt///ooommmdddHceeee
petps::/oppereee
Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Fuli Feng. Improving syn- thetic image detection towards generalization: An image transformation perspective. In Yizhou Sun, Flavio Chierichetti, Hady W. Lauw, Claudia Perlich, Wee Hyong Tok, and Andrew Tomkins (eds.), Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining, V.I, KDD) 2025, Toronto, ON, Canada, August 3-7, 2025, pp. 2405 2414. ACM, 2025. doi: 10.1445/39062444709992 3709392
URL http::///oo..og011111143333/660
Quanyu Liao, Yuezun Li, Xin Wang, Bin Kong, Bin Zhu, Siwei Lyu, Youbing Yin, Qi Song, and Xi Wu. Imperceptible adversarial examples for fake image detection. In 202/ IEEE International Conference on Image Processing. ICIP 2021, Anchorage, AK, USA, September 19-22, 2021, pp. IEEE, 2021. doi: 10.11000CI14229222200..55 10. 10.1109/ve CTTT449922226 2021. 9506775
URL https: /oi. org/
12

---

Published as a conference paper at ICLR 2026
Chi Liu, Huajie Chen, Tianqing Zhu, Jun Zhang, and Wanlei Zhou. Making deepfakes more spurious: Evading deep face forgery detection via trace removal attack. JEEE Trans. De- pendable Secur. Comput., 2016):5182-511 /TSSC 2ww.DSc....2..... 2ttp:////DDD..2..22222111001
2023, doi: 10.1 10.1199TDSC.22233244444 URL
atttps://det http://oooorggg//////
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Truck Proceedings. OpenReview.net, 2018. URL http::tpp///em htttps://openreviiet net. Forum? dww.z/iif.....
Xiangtao Meng, Li Wang. Shanqing Guo, Lei Ju, and Qingchuan Zhao. AVA: inconspicuous at- tribute variation- based adversarial attack bypassing deepfake detection. In IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024, pp. 74-90. 90. IEEE, 2024. doi: 10.1 10.1109/5554223.2224444 2024.00555. URL 2024. 00155
Takeru Miyato, Toshiki Kataoka. Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. (RLhttps::// wpw.//veww.eeeeeeeeeeeeee..o //t www.:nnttttotttteemmm wtg.iidd--111gii11
Paarth Neekhara, Brian Dolhansky, Joanna Bitton, and Cristian Canton-Ferrer. Adversarial threats to deepfake detection: A practical perspective. In IEEE Conference on Computer Vision
and Pattern Recognition Workshops, CVPR Workshops 2021, virtual, June 19-25, 2021, pp. 923-932. Computer Vision Foundation / IEEE, 2021. doi: 1.91009PRW.55..00.... 202000200900000000 2011...222200011000 20110.0.0.........0. .00103. URL https://openaccent Twweetteeeaeeaeeeeeeeeeaaaereeee Saeraats_tt___eeeeee Bro__DeeFaakee Dewaaeeeeeeeeitrrrrreemoo P.terattiannA.PPaaiiciaaaa
theevf. com. http://tttetttccccecoooc httpeeettt////e/e///1// WMF /html/
Perspective_CvPe 2ww.__ppee..htmmmm
Augustus Odena, Vincent Dumoulin, and Chris Olah, Deconvolution and checkerboard artifacts. Distill, Oct 2016. doi: 10.23911/distill.00000 URL httt:://xx.d:/ org. 1t. /
distill. 00003
Feng Qian, Sifeng He, Honghao Huang, Huanyu Ma, Xiaobo Zhang, and Lei Yang. Web photo source identification based on neural enhanced camera fingerprint. In Ying Ding, Jie Tang, Juan F. Sequeda, Lora Aroyo, Carlos Castillo, and Geert-Jan Houben (eds.). Proceedings of the ACM Web Conference 2023, WWW 2023, Austin, TX, USA, 30 April 2023 4 May 2023, pp. 2054 2065. ACM, 2023. doi: 10.1 00.1145/344350735522222
URL
https: :tmpps://deeee /tw.///cii//// org 10.1g/10/111////1
3544507 3583225
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High- resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 10674-10685. IEEE, 2022. doi: 10. 2WWCVVRR2688.2222.000000 URL https: /ooi. org/10 1Tw.1:..11/////22222222
Zeyang Sha, Zheng Li, Ning Yu, and Yang Zhang. DE-FAKE: detection and attribution of fake images generated by text-to-image generation models. In Weizhi Meng, Christian Damsgaard Jensen, Cas Cremers, and Engin Kirda (eds.), Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen, Denmark, November 26- 30, 2023, pp. 3418-3432, ACM, 2023, doi: 10.1145/3576915.3611 111./.1111/3777661 3616588
URL http:httt/////// //oi..
Tianyi Wang, Xin Liao, Kam-Pui Chow, Xiaodong Lin, and Yinglong Wang. Deepfake detection: A comprehensive survey from the reliability perspective. ACM Comput. Surv., 58:3):58:15588333 2025. doi: 10.1 14553699770. URL. https:: wrw.10.gg10.. 11 1145/399770
Zhenting Wang, Vikash Sehwag, Chen Chen, Lingjuan Lyu, Dimitris N. Metaxas, and Shiqing Ma. How to trace latent generative model generated images without artificial watermark? In Forty International Conference on Machine Learning. ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.ne,, 2024. URL / net. wttp://oorrrmmmmt/2////// 6eJj
13

---

Published as a conference paper at ICLR 2026
Vera Wesselkamp, Konrad Rieck, Daniel Arp, and Erwin Quiring. Misleading deep-fake detection with GAN fingerprints. In 43rd IEEE Security and Privacy, SP Workshops 2022, San Francisco, CA, USA, May 22-26, 2022 pp. 59-65. IEEE, 2022. doi: 10.10099PWW4444.2222..98333 URL https: wttp//dd..oooo/ooooooooo org/ 10. 20110/////522500 2022. 9833860
Mengjie Wu, Jingui Ma, Run Wang, Sidan Zhang, Ziyou Liang, Boheng Li, Chenhao Lin, Lim- ing Fang, and Lina Wang. Traceevader: Making deepfakes more untraceable via evading the forgery model attribution. In Michael J. Wooldridge, Jennifer G. Dy, and Sriraam Natarajan (eds.), Thirty-Fighuth AAAI Conference on Artificial Intelligence, AAAI 2024, Thirty-Sixth Con- ference on Innovative Applications of Artificial Intelligence, IAAI 2024, Fourteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2014, February 20-27, 2024, Vancou- Ver, Canada, pp. 19995,119733, AAAI Press, 2024. doi: 1..1609AAAALV33818.......2 https:///oot .rg 1609 aaai v 29973
URL
Tianyun Yang, Ziyao Huang, Juan Cao, Lei Li, and Xirong Li. Deepfake network architecture at- tribution. In Thirty-Sixth AAAI Conference on Artificial Intelligence, AAAI 2022, Thirty-Fourth Conference on Innovative Applications of Artificial Intelligence, IAAI 2022, The Twelveth Sym- posium on Educational Advances in Artificial Intelligence, EAAI 2022 Virtual Event, February 22 URL
March 1, 2022, pp. 4662 4670. AAAI Press, 2022. doi:
https: //dii wr..orgglloo 10. 609 aaai. 023614.20399
Tianyun Yang, Danding Wang, Fan Tang, Xinying Zhao, Juan Cao, and Sheng Tang. Pro- gressive open space expansion for open-set model attribution. In IEEE/CVF Conference Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. 15865. IEEE, 2023. doi: 10.1 1A111099997222922023000000 / //doi.org/10.. 0w111100////22230 2023. 01 522]
_RLhetps:
Ning Yu, Larry Davis, and Mario Fritz. Attributing fake images to gans: Learning and analyzing GAN fingerprints. In 2019 IEEE/CVF International Conference on Computer Vision, ICCV 2019, Seoul, Korea (South), October 27 November 2. 2019. pp. 7555-7565, IEEE, 2019. doi: 10.1109/ 1109/ TCCV. 201 9.00765)
ICCV.2019.00755.
Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In 2021 IEEE/CVF Inter-
national Conference on Computer Vision. ICCV 2021. Montreal, QC. Canada, October 10-17, URL https:
2021, pp. 14428-14437 IEEE, 2021. doi: 119//CCV48922..2211102 aoooi.org/100 1110/110199000 920./4482222... 2021 01 418
Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry S. Davis, and Mario Fritz. Responsible disclo- sure of generative models using scalable fingerprinting. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022. OpenReview.net, 2022.
URL http::::://pppeeeiiieee net forum? i d= 25 6WHB
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks provably removable using generative AI. In Amir Globersons, Lester Mackey, Danielle Belgrave, Angela Fan, Ulrich Paquet, Jakub M. Tomezak, and Cheng Zhang (eds.), Ad- vances in Neural Information Processing Systems 38: Annual Conference on Neural Infor- mation Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 15, 2024, 2024, URL
http:/pppppp..illeee//e////////p /2ah///h/////////////// html
Ziyin Zhou, Ke Sun, Zhongxi Chen, Huafeng Kuang, Xiaoshuai Sun, and Rongrong Ji. Stealthdiffu- sion: Towards evading diffusion forensic detection through diffusion model. In Jianfei Cai, Mo- han S. Kankanhalli, Balakrishnan Prabhakaran, Susanne Boll, Ramanathan Subramanian, Liang Zheng, Vivek K. Singh, Pablo César, Lexing Xie, and Dong Xu (eds.), Proceedings of the 32nd ACM International Conference on Multimedia, MM 2024, Melbourne, VIC, Australia, 28 October 2024 1 November 2024, pp. 3627 3636. ACM, 2024. doi: 00.114//664447.36685555 URL 347.161535
14

---

Published as a conference paper at ICLR 2026
original
PGD
MIFGSM
transformation
FakePolisher
traceEvader
Ours
ProGAN
CramerGaN
SINGAN
MMD GAN
InfoMaa GON
Figure 6: Spectral analysis of high-frequency components (part 1).
A APPENDIX
In this appendix, we provide the following supplementary materials:
A.l presents detailed analysis of existing attack methods. Specifically, in A.I.1 we cat- egorize and summarize prior approaches; in A.1.2 we empirically validate their additive nature through multiple analyses, including L2 distance between residual components, cor- relation between residuals and original images, and frequency-domad characterization, demonstrating their fundamental limitation effectively eliminating model-specific fin- gerprints.
A.2
provides details of the theoretical analysis of the multiplicative attack. Specifically, in A.2. we provide a complete proof of Theorem I establishing the theoretical existence of the multiplicative adversarial matrix. A.222 we provide proof for the defense difficulty analysis.
A.3 details the architectural design of our attack model.
A.4 elaborates on experimental configurations and presents extended results and discus- sions. Concretely, J.4.J] specifies the AMs and baseline attacks used in our evaluation, along with implementation details of our framework, defense mechanisms, and inversion model architectures. In A.4.2] provide an in-depth analysis of method's effec- tiveness in evading both state-of-the-art AMs and defensive strategies, demonstrating its capability eliminate fingerprints from both GANs and DMs while preserving high visual fidelity.
Finally, we disclose the role of large language models (LLMs) in the preparation of this manuscript.
A.1 ANALYSIS EXISTING ATTACK
A.1.1 METHOD ANALYSIS
Existing attacks against AMs fundamentally rely on additive perturbations, which can summa- rized as follows:
15

---

Published as a conference paper at ICLR 2026
PGD
50
BIM
50
HIGGSM
Caralo mulion
TraceCvader
Figure Distribution of L2 distances between residual components.
PGD
BM
Dittktact
trenetormaten
Conder
-05
-05
-02
-65
-03
-15
-10
Figure 10: Pearson Correlation Coefficient (PCC) between residual components and the original image.
1) Transformation--oe based attack: Five types transformation operations: noise, blurring, cropping, JPEG compression, relighting and random combination of them employed perturb images (Yu ct al. 2019; Yang et al. 2022). Crucially, these transformations either directly add perturbations to the image (e.g., Gaussian noise å where x' =
or be reformulated additive operations in transformed domains. For instance, blurring operations apply additive noise in frequency domain, while JPEG compression introduces quantization errors that manifest as additive perturbations in pixel space.
2) Transferable adversarial example: The BIM and MI-FGSM are leveraged to gener- adversarial examples in a white-box setting against (Wu et al. 2024). Specifically, they solve optimization problems of the form x' arg max f(x + 6, y) subject to ||0|p S 6, where 8 the additive perturbation. These per- turbations are then transferred to other AMs in black-box box settings, maintaining their additive nature.
StardAN
StylGANN3+
SDVI-5
SDV2base
rogar transformation origiaa
3) Black-bor box and universal attack: (Wu et al. (224) adds universal perturbation learned from DeepPakes to the high-frequency compo- nents of images. This perturbation follows the a fixed
traccuEvvadrt
additive model Ax = 8, where noise pattern added to all images. Similarly, Gaussian blurring and mean shift applied to low-frequency components can be viewed as domain-specific additive perturbations.
All these methods operate within the additive perturbation paradigm, where adversarial ex-
amples are generated as x' x 6.
Figure 7: Spectral analysis of high-frequency components (part 2).
A.1.2 EXPERIMENTAL ANALYSIS
Through analysis of the L2 distance between residual components and the correlation between residuals and original images, we establish that all existing adversarial attacks fundamentally operate within the additive perturbation paradigm. More-
16

---

Published as a conference paper at ICLR 2026
through frequency domain analysis of fighffreuueny components before and after ad adversarial attacks, we demonstrate that existing attack methods fail to eliminate model fingerprints.
1) L2 distance among Residual Components: Additive attacks generate adversarial examples by directly superimposing perturbation p onto original images, resulting in x' = x t. Conse- quently, the residual component Ar x' should precisely equal the added perturbation p. defining characteristic of additive attacks is that the L2 distance between residual com- ponents across different samples remains rela- tively stable within constrained range.
ProGAN
StarSAN
StyleGAN3
As demonstrated in Figure 9 all existing attack methods exhibit this stability pattern. Specifi- cally, the L2 distances of residual components for PGD, BIM, MI-FGSM, and TraceEEvader consistently concentrate within the narrow in- terval [0, 10]. DiffAttack shows slightly higher values within [10, 20), while transformation- based attacks, which incorporate multiple operations, display broader distribution. Nevertheless, most of the residuals still fall within the [0, 20] range, maintaining the characteristic stability of additive perturbations.
DiffMback FROGAN
Faishrishee-ttrGe
Fake StaertteAee
Figure 8: Spectral analysis of high-frequency components (part 3).
This consistent concentration of L2 distances provides empirical evidence that these attacks adhere the additive perturbation model x' + p. where the residual Ar directly corresponds to the added perturbation
2) Correlation between A and Original Images: the additive attack framework, the residual component Az should exhibit minimal correlation with the original image x. To quantify this relationship, we employ the Pearson Correlation Coefficient (PCC), where values approaching indicate no linear correlation, while absolute values closer to 1 indicate stronger correlation.
Figure revells that residuals generated by existing attack methods consistently demonstrate low correlation with original images. Specifically, PGD and MI-FGSM produce residuals with PCC values approaching zero, while DiffAttack and TraceEvader yield slightly higher but still minimal correlations ( absolute value of PCC within [0.0.25]).
This consistently low correlation pattern across diverse attack methods provides compelling evi- dence that existing approaches operate within the additive perturbation paradigm.
3) Frequency Analysis: Model fingerprints exhibit pronounced characteristics the frequency do- main, manifesting distinct patterns (Frank et al. 2020). Our comprchensive evaluation spans GMs, including GAN variants and 2 DMs. As shown in Figures 6 and g the high- frequency spectra of adversarial examples generated by all existing methods, including additive attacks, reconstruction- based approaches (FakePolisher) and regeneration attack maintain remark- able similarity to those of original DeepFakes.
These empirical findings collectively demonstrate that existing adversarial attack methods fail to effectively eliminate model fingerprints, which critical for DeepFakes attribution. This finding provides critical insight into the limitations of current attribution attack methods against AMs and motivates our proposed multiplicative attack approach.
A.2 DETAILS OF THEORETICAL ANALYSIS OF MULTIPLICATIVE ATTACK
A.2.1 EXISTENCE OF ADVERSARIAL MATRIX W
We define the adversarial attack optimization problem as follows:
W arg max [x C W) - F(x)] s.t. ||Ar|2 <
W
where Ar = x O (W- - I) is the residual component between the adversarial image and the original
image, and is the 1.2 norm. Assuming F(x) is differentiable s, the first-order Taylor
17

---

Published as a conference paper at ICLR 2026
expansion around is:
F(roW)= = F(x) + J(z) Az.
where ((x) IR is the Jacobian matrix:
(Fi(z)
(())
The optimization problem can be rewritten as:
W arg max [](x)) Arll s.t. ||r|12 S A. W
We now prove the existence of an adversarial matrix W satisfying this goal.
Theorem (Existence of Multiplicative Adversarial Matrix). Let F()) be differentiable in neigh- borhood of x, and let the Jacobian matrix Ja) E R= be locally Lipschitz around a. If the input Rn satisfies the non-degeneracy condition: There exists at least one coordinate j E (1.2.....n)) such that 7; # 0 and dF,(2) * for some i, equivalently, the restricted spectral 8m;
norm Y = 1a (z) ull2 > 0, then there exists multiplicative perturbation matrix W such that for any E E (0, A}.
[|](z) Arll2 2 and |Aol12 S A,
where we set := (W-1) and S = ( perturbation subspace, and the restricted Jacobian Jz(x) has spectral norm 7 >> 0 as defined above. Moreover, choosing A small enough and constructing W by W, 1 Azz/ for Ij * 0 (and W; = 1 otherwise) keeps 2 W in the valid pixel range, and the first-order Taylor error bounded by O(
O whenever æz = =0 is the admissible
Proof. We proceed in five steps construct W and validate the inequality.
1. Structural Constraints on Ar: Define Ar = x @ (W - -1). For components where Tj = 0, we have Ary- 0. Thus, Ar is restricted to the subspace
{u E R Uy = 0 x 0}.
Admissible Perturbation Directions: By the non-degeneracy condition, the projection (s(x)
(retaining only columns of J(x) where Ij f 0) satisfies || 0. Hence, there exists non-zero direction v E S such that [x](x)
> 0.
3. Optimal Perturbation via SVD: Let (s(x) UEVT be the SVD of Js(x), where 0 ||Js(r)]l2
is the largest singular value and v1 E S is the corresponding right singular vector. Define:
Ar A U1
Then Ar|l2 A, and:
|J(x) Az| = A [Js(z) . 1n = A or.
Set 7 01 so [J(x)) Azll 7 -7.4 A.
Constructing W: From Az = x @ (W - 1), solve for W:
1 Az
Ij # 0,
W,
1
Jj = 0.
This ensures Ax x C (W - -7) and | < A.
Validating Arbitrary E 70,7 A]: For any E (0, A), let 8 = e/7 s A. Define:
Az' 8 V1.
Then Ar'|12 = 5 < A, and:
[|((x) Ar'l = 7 =e.
Construct W using the same formula as above.
If Jz(x) + (i.c., 7 > 0), there exists a perturbation Ar E S with ||x//2 S such that [](()) Ar| 2 for all (0, A).
18

---

Published as a conference paper at ICLR 2026
A.2.2 PROOFS FOR DEFENSE DIFFICULTY ANALYSIS
Proposition 1 (Non-identifiability without paired supervision). Assume P + +r, where is a deterministic pre-processing operator and 1n is measurement noise. In the idealized case P=1, n=0, the decompoxition of x' into (z, W) is not identifuble: there exist infinitely many (ū. W) such that I ② W = =x'.
Proof. Let 5:: + 0}. For any 8 E Ra with |0]|0= < and 6, = 0 for j & S, define = x ① +0) and W ( (1+6)-1- Then ă o W = x O (1 + o W о (1+ 8) W x'. Varying 6 yields infinitely many valid decompositions, hence non-identiifability. This non-identifiabilit persists under any deterministic P. because if O W 22 + 22, then P(11 W1) P(12 W2). The presence of noise 1 only exacerbates the ambiguity.
Lemma 1 (Pre-processing does not fix identifiability). If P is deterministic and injective the image range of interest, then non-identifabiiity of (z, W) from x' under p= 1, 1,7==00 implies non- identifiability under x' P(x @ W) well.
@ W2. then P(x1 @ W1) = P(x9 @ W2) by determinism. Injectivity is only needed if one tries recover @ W from x'; it does not help distinguish different (z, W) pairs producing the same product before P.
Proof. If œ1 3 W1
Proposition 2 (Cyl lower bound with paired supervision). Consider the per-pixel model =,=,,,, Tl.. where nj NN, o²) i. measurement noise (e.g.. from image acqui- sition or pre-processingg. Given N i..dd pairs (2(1k) (d(,)), any unbiased estimator W
Var(W,) 2
N (az
(K)
Consequently, achieve B(W, W3) < one needs N Z o² 222((E B((x
Sketch. The log-likelihood of {z] (k) N ]k=1 given W is Gaussian with mean z) W3 and variance o². The Fisher information is (W,, = # Em (2) The Cramér-Ras lower bound yields Var(W,) 2 I -W; taking expectation over the data distribution gives the stated bound.
Remark (Effect of standard pre-processing). If P is L-Lipschirz and F is locally Lipschitz. then for a feasible Ar = x O (W- 1) with |Aol|2 < A, [[P(( 3 W)) F(P(x))ll < L ||ll| +
( Thus P changes constants but not the identifiaiility conclusion of Proposition
A.3 THE DETAILS OF THE MODEL ARCHITECTURE
Table Proposed adversarial model architecture, H and W denote input image height and width; InstNorm = Instance Normalization; x5 repeated 5 times; Dual = two sequential convolutional
operations per block.
Component
Layer
Kernel
Stride
Padding
Output Shape
ActivationNorrmmliattion
Encoder
Convlayerr (Input)
Reflect
W
ReL.U InstNorm
Convlayer (Downsample)
3
Reflect
64 128 2
InstNorm
ConvLayer (Downsample)
x 3
2
Rellect
ReLU InstNorm
Residual Blocks RosidualLayer x5
3 3 (dual)
Reflect
128 $ W
Layer ReLU + InstNom:
Layer Lincar InstNorm;
Skip connection
Decoder
DecorvLayer (Upsample 1)
3 3
Reflect
64 x x
ReLU + InstNorm
DecorvLayer (Upsample 2)
3 3
Reflect
32 x H W
ReLU InstNorm
ConvLayer (Output)
9
Reflect
3
Linear
As systematically documented in Table 2 our adversarial model comprises an encoder-decoder ar- chitecture.
19

---

AtNNt Published as a conference paper at ICLR 2026
Table 3: Summary of Attribution Models, Generative Models, and those used in the experiments. SDv1-5 and SDv2-base respectively, indicate Stable Diffusion v1-5 and Stable Diffusion v2-base.
Besides, we retrain DNA-Det to attributing (SD3 (Esser et al. (204)) FLUX (Labs al. 2025).
PixArt (Chen et al. 2024b)) with DiTFake dataset (Li et al. 2025).
ProGAN SNGAM
MMDGAN
CramerGAN
InfoMaxGAN
StarGAN
StyleGANS
SDv1-5
SDv2hase
DNA-Det
DCT
Reverse POSE LTracer
The encoder processes the input image through a cascade of convolutional and residual layers to extract features. It comprises: 1) Three initial convolutional layers: The first layer employs 9x9 kernel with stride 1, transforming the 3-channel input into 32 feature maps. The subsequent two layers use 3x3 kernels with stride for spatial downsampling, progressively expanding the channel depth to 64 and then 128 while halving the spatial resolution at each step. All convolutional layers utilize reflection padding, instance normalization, and ReLU activation. 2) Five residual refinement blocks: Each block processes the 128-channel features through two sequential 3x3 convolutional layers with stride The first layer in each block applies ReLU activation, while the second operates linearly (without activation) to preserve gradient flow. Skip connections sum the block input with the processed features, mitigating degradation in deep networks and preserving details. Instance normalization is applied after each convolutional operation to ensure consistent feature distributions.
The decoder reconstructs the high-resolution output via two upsampling stages and an output syn- thesis layer: 1)Upsampling stages: Stage I: Upsamples the 128-channel encoder output to 64 chan- nels, followed by a 3x3 convolutional layer, instance normalization, and ReLU activation. Stage 2: Further upsamples to 32 channels through an identical operation sequence (interpolation, 3x3 convolution, normalization, ReLU).. 2) Output synthesis layer: A final 9x9 convolutional layer with stride and linear activation maps the 32-channel features the 3-channel output image.
A.4 THE DETAILS OF THE EXPERIMENTS
A.4.1 EXPERIMENTAL SETUP DETAILS
This section comprehensively details the experimental framework employed in our evaluation, in- cluding the victim models under attack, benchmark adversarial methodologies, and implementation details utilized for validation. We systematically describe the implementation specifics both ad- versarial training and approximate inversion techniques (Defense technology).
1) Victim Model (AMs): We conduct experiments against advanced attribution technologies, in- cluding DNA-Det (Yang al., 2022). AuNet (Yu et al. 2019), DCT (Frank al., 2020), Re- verse (Asnani et al. 2023), POSE (Yang et al.) 2023), and LTracer Wang et al. (2024). As sum- marized in Table 3 our experiments span 7 GANs, DMs and 4 datasets. All GANs employed in our evaluation were pre-trained on established facial datasets. Specifically, StyleGAN was trained on the high-fidelity FFHQ dataset, while alternative GAN architectures were trained the CelebA dataset. The two DMs were trained on the large-scale LAION dataset. We leveraged these pre- trained generative models to generate DeepFakes for comprehensive experimental evaluation. And for all AMs, we follow their original default Settings.
In addition, we implement DNA-Det for attributing 3 latest DMs (SD3 (Esser et al. 2024). FLUX (Labs et al. 2025), PixArt (Chen et al., (024b)) with DiTFake dataset (Li et al. 2025) by ourselves, which is used to verify the effectiveness of our method in eliminating fingerprints fusion models. We used DiTFake dataset to train it into a four-class classification model (real, SD3, FLUX, PixArt), 5000 images per class, 20,000 images in total) to train -NA-Det. We used 16,000 images for model training and 2000 for validation. 2000 for testing and attacking. We adopted the same default training settings as for the CelebA dataset. The attribution accuracy of the trained model is 96.65%.
dif-
20

---

Published as a conference paper at ICLR 2026
Table 4: Performance of attribution models on clean (non-adversarial) samples
DNA-Det
AttNet
DCT
Reverse
POSE
LTracer
Accuracy
100.0
99.43
99.07
99.66
85.43
98.89
2) Baseline (Attac For comparative analysis, we implement 8 attack methods, including 4 transferable attacks (PGD, BIM, MIFGSM, DiffAttack (Chen et al. (022aa)) and 3 black-box meth- ods, including transformation-baee based attack, FakePolisher (Huang et al. 2020) and TraceEvader (Wul jet al. (024)). Besides, we adopt 1 regeneration attack for comparison Zhao et al. (2024). For trans- ferable methods, adversarial images are created by attacking the Det- in a white-box setting and transferred against other AMs aligned with (Wu et al., 2024). Due to the high computational overhead of DiffAttack, we limited its application generating adversarial examples specifically DeepFakes. Similarly, FakePolisher's implementation is constrained to
against TroGAN-generatee facial imagery through its domain-speciffe dictionary construction; consequently, we evaluated this attack exclusively on facial DeepFakes while excluding LTrraerr due to dataset domain mismatch. For regeneration attacks, we employed Stable Diffusion-v2.1 1 as the reconstruction model.
3) Implementation Details: Our attack model is trained on the CelebA dataset to eliminate finger- prints in face images and on the ImageNet test set to remove fingerprints from DMs. We employ the Adam optimizer with an initial learning rate of le-4 and use cosine annealing strategy to adjust the learning rate. The weights in Liotal $1, 32, B3 are set as {0.55 0.43.
4) Adversarial Training Details: We implemented adversarial training to enhance the robustness of the DNA-Det detector against our proposed adversarial attack. Specifically, we preserved the origi- nal architecture and training configuration of DNA-Det while replacing 50% of the training samples with adversarial images generated by our method, maintaining the ground-truth labels throughout the training process. After completing the adversarial training phase, evaluated the attack success rate of our method against enhanced AMs.
5) Approximate Inversion Details:
To investigate the potential of approximate inversion as de- fense mechanism against our adversarial attacks, we implemented two inversion models based on established denoising architectures: DnCNN and an Autoencoder. Both models were trained to re- construct clean images from adversarial examples, with the adversarial inputs serving as the source domain and the corresponding clean images as ground-truth targets. The training objective employed the Mean Squared Error loss function. After model convergence, we evaluated the effectiveness of this defense strategy by processing the reconstructed images through the DNt-Det.
The architectural details of the two networks are as follows: 1) DnCNN: The DrCNN architecture employed in our experiments consists of 20-layer deep convolutional layers. The network begins with an initial convolutional layer that transforms the 3-channel input into 64 feature maps using 3x3 kernel with stride and padding 1, followed by a ReLU activation function. This is succeeded by 18 intermediate layers, each comprising a 3x3 convolutional operation maintaining 64 feature channels, batch normalization, and ReLU activation. The final layer projects the feature represen- tation back to the original 3-channel output space through another 3x3 convolution, with sigmoid activation ensuring the output values remain within the valid [0.1] range. 2) Autoencoder: The Autoencoder architecture implements symmetric encoder-decoder structure. The encoder path- way begins with a convolutional layer that processes the 3-channel input into 64 feature maps using 4x4 kernel with stride 2 and padding 1, followed by batch normalization and ReLU activation. Three additional convolutional layers progressively increase the channel depth to 128 and 256 while reducing spatial dimensions, culminating in a bottleneck layer that compresses the representation to 256 channels at 8x8 spatial resolution, forming the latent space representation. The decoder reverses this compression process through four transposed convolutional layers that progressively upsample the feature maps while reducing channel depth, each followed by batch normalization and ReLU ac- tivation (with the exception of the final layer which employs a sigmoid activation to constrain output values to the [0,1] range). All convolutional weights initialized using Kaiming normal initial- ization to ensure stable training dynamics, while batch normalization parameters follow standard initialization protocols. We summarize the architecture of both models in the table and
21

---

Published as a conference paper at ICLR 2026
Table 5: DrCNN Architecture
Component
Layer Type
Kernel Size
Stride
Padding
Output Shape
Activation/Normmlization
Input Layer
Conv2d
3 x
Reflect
64 x H W
ReLU
Intermediate
Conv2d x18
3 x 3
1
Reflect
64 x H X W
ReLU + BatchNorm
Ourput Layer
Conv2d
3 x
1
Reflect
3 H X
Sigmoid
Table 6: Autoencoder Architecture
Component
Layer Type
Kernel Size
Stride
Padding
Output Shape
Activation/Normaizattoon
Encoder
Conv2d (Downsample 1)
2
Reflect
61 #
ReLU + ButchNorm
Conv2d (Downsample
Reflect
128
ReLU BatchNorrm
Conv2d (Downsample Bottleneck
X
2
Reflect
256 x x d
ReLU BatchNorm
4 xx4
2
Reflect
256 x 18 m
ReLU BatchNorm
Decoder
Conv 2onn/pranppo (Upsample 1)
4
2
Reflect
256 x #
ReLU + BatchNorm
Conv Tranppranp (Upsample 2)
4x4
2
Reflect
128 x R
ReL.U+ + BatchNorm
Conv Transpose2d (Upsample 3)
4x4
2
Reflect
64 ef 1
Rel.U + BatchNorm
Output Layer
Reflect
3 11
Sigmoid
A.4.2 EXPERIMENTAL EVALUATION DETAILS
This section presents more empirical analysis and visual evidence further substantiate our method- ology's effectiveness.
1) Effectiveness Against Artributions: Figure II presents a comprehensive confusion matrix anal- ysis of AMs under our adversarial attack methodology. The visualization reveals that our attack successfully compromises the DeepFakes attribution capability of all evaluated AMs, significantly degrading their ability to determine the generative origin of DeepFakes. Among them, DCT mis- classifies 100% of adversarial images as CramerGAN --ggeerrtdd content, therefore, we exclude CramerGAN-generated DeepFakes attribution from our attack success rate calculations.
Notably, our attack induces AMs to misclassify a substantial proportion of adversarial images as real images, demonstrating the perceptual indistinguishabiiiyy of our adversarial images from gen- uine imagery. Most strikingly, when targeting AttNet, our method achieves a perfect 100% misat- tribution rate real images, demonstrating that the adversarial images generated by approach are perceptually indistinguishable from real images. This complete source obfuscation represents significant advancement prior art, as it effectively eliminates the distinguishing features that attribution models typically exploit for detection.
2) Effectiveness Against Desensive Mechanisms: Figure 12 presents confusion matrix anal- ysis of DNA-Det's robustness against our adversarial methodology under two prominent defense paradigms: adversarial training and approximate inversion. The visualization reveals that adver- sarially trained DNA-Det fails to correctly attribute adversarial images, cxhibiting degraded per- formance compared to the baseline model. Specifically, the adversarially trained DNA-Det mis- classifies 100% of adversarial images as authentic content, representing a complete collapse of source attribution capability. Similarly, approximate inversion defenses prove ineffective against
-0B
Pedla
3.00
CO00
COR
C014
0,00
00%
6229
230
6000
2.0
0280
1200
6.00
0.53
6000
0001
200
500
020
125
A20
0.00
1222
600
Peecated
Figure 11: Attribution Performance Analysis: Confusion matrices of the DeepFakes model under the proposed adversarial attack.
22

---

Published as a conference paper at ICLR 2026
Aderiiatal Traiing
Aparodrruraa InotsonED COSSOODDCCCN ChRN
Aporoisdd wwrseeiaasteeeecee
0.90
8:000
$389
CBX
C,00
0.003
0000
0.00
1200
2003
9:806
Pw
5.9
0189
028
2421
0:84
0150
009
NM0
FWS
2181
106
-0A
02
61X
MORHON
FOAMAN
1.00
8,077
0232
Prodiced
Prediced Label
Figure 12: Auributtion Performance Analysis: Confusion matrices of DNA-Det (enhanced) under the proposed adversarial attack.
Figure 13: Visualization of the original DeepFakes (top) and adversarial images (bottom) generated by the out attack.
our methodology. As evidenced by the confusion patterns across both inversion approaches, both DnCNN-based and AutoEncoder--asee reconstruction models fail recover traceable fingerprints for accurate attribution. These findings collectively demonstrate the resilience of our attack against state-of-the-arr defense mechanisms.
The above experimental results show that: 1) On the one hand, even though the adversarial training defense measures have seen the adversarial images attacked by our method during the training pro- cess, they cannot align the correct attribution, which indicates that the multiplicative attack proposed by us effectively eliminates the fingerprints inside DeepFakes, so that AMS cannot effectively per- form attribution to the source model in the image after the attack. 2) On the other hand, the defense method based on approximate inversion also unable effectively defend, which is consistent with the conclu- sion of our defense difficulty analysis above. Even if the defender can collect image pairs to train the inversion model, cannot defend against attack, because restoring images with the defense of neural networks will introduce new network fingerprints into new images. further reducing the possibility of attribution.
if it is enhanced by defense measures. Because there is information related
3) Effectiveness Preserving Image Fidelity: Figure 13 presents a visual comparison between original DeepFakes and their adversarial counterparts generated by our methodology. The side-by-side ex- amples demonstrate exceptional visual fidelity preservation, with structural similarity (SSIM) scores averaging 0.963 and Learned Perceptual Image Patch Similarity (LPIPS) of 0.093 across the eval- uation images. While minor color variations observable in some regions, the semantic content remains fully preserved, including facial identity, expression, and structural features. This high degree of perceptual consistency confirms that attack operates within imperceptibility thresh- olds while effectively compromising attribution model performance, representing a critical balance between attack efficacy and visual Fidelity.
23

---

Published as a conference paper at ICLR 2026
TLUX
Pkch 5D3
originl
320
OuTS
Figure 14:
Attribution Performance Analysis:
Confusion matrices of the DNA-Det-DMs classi- Figure 15:
Spectral analysis of high- fier on clean (left) and attacked (right) DeepFakes frequency components in DeepFakes gener- generated by FLUX, PixArt, and SD3.
ated by FLUX, PixArt, and SD3 before (top row) and after (bottom row) our attack.
4) Effectiveness Eliminating DMS' Fingerprints: evaluate the effectiveness of our attack method eliminating DMs' fingerprints across five state-of-the-an art diffusion models: Stable Diffusion v1.5, Stable Diffusion v2.1, FLUX, PixArt, and Stable Diffusion 3.
We assess the attack performance on a custom-trained attribution model (DNA-Der-DMs) that was trained identify DeepFakes generated by the three most recent diffusion models: FLUX, PixArt, and SD3. This model achieves an attribution accuracy of 96.65% on clean DeepFakes, demonstrat- ing its strong discriminative capability under benign conditions. In contrast, our adversarial attack achieves an ASR of nearly 100%, indicating near-total evasion of model attribution.
To visualize the impact of our attack, we present confusion matrices in Figure 14 comparing the DNAsDst-DMs's performance before and after the attack. The left subfigure shows that, on clean DeepFakes, the model accurately distinguishes among images generated by different DMs. How- ever, the right subfigure reveals dramatic degradation in attribution performance under attack: our adversarial DeepFakes successfully mislead the DNA-Det-DMs to predominantly misattribute all DMs-generated images either "real" or originating from SD3, effectively collapsing the model's s discriminative power and undermining its forensic utility.
frequency-domail analysis further validates that our method effectively eliminates the intrinsic fin- gerprints of DMs, even for the most recent architectures. As illustrated in Figure 7 DeepFakes generated by SDv1.5 and SDv2base after being attacked by our method exhibit significant spectral deviations from their clean counterparts. In Figure 15] we extend this analysis to the three latest DMs (FLUX, PixArt, and SD3), comparing the frequency-domain characteristics of their gener- ated images before and after attack. Consistent with the observations in Figure 7 the adversarial DeepFakes demonstrate substantial spectral difference compared to their original, clean versions.
Collectively, these results demonstrate that our attack successfully suppresses and, in many cases, effectively eliminates the model-specific fingerprints in DM-generated DeepFakes. This holds true even for the latest generation of DMs, demonstrating the broad applicability of our method, even against the latest DMs.
We do not include a dedicated evaluation of typical post-procsssing pipelines (c.g., JPEG re- compression, resizing, cropping) for the following reasons: 1) Our multiplicative attack is designed to eliminate generator-specific fingerprints within DeepFakes. Once the original fingerprint has been climinated, subsequent image-level transforms are informationn-rcuucng and cannot reconstruct the removed statistics; in practice, they further destroy any residual cues used by attribution models, thus making correct attribution even less likely. 2) TraceEvader (Wu et al. 2024) has already evaluated and reported that operations like JPEG re-compression resizing, and cropping do not degrade the attack performance; they introduce even greater perturbations to images, which can further increase the attack success rate.
24

---

Published as a conference paper at ICLR 2026
Table 7: Computational efficiency comparison of attack methods. Reported values end-to-end inference times (in seconds) for generating 20,000 adversarial images on a fixed hardware platform. Lower better. The best results marked in bold.
Mehtod
PGD
BIM
MIFGSM
FakePolisher
Regeneration
TraceBvader
Ours
Time Cost
102.62
79.54
127.62
2611.1
2180.49
732.70
60.64
A.5
USE OF LARGE LANGUAGE MODELS (LLMs)
We employed large language models (Qwen) as writing aids to improve the clarity and fluency cer- tain sections. These tools were used exclusively for language refinement and structural suggestions; they did not contribute to the design our attack framework, theoretical analysis, or experimental evaluation. All technical content, including algorithms, proof', and results, is the original work of authors. We assume full responsibility for the integrity of this manuscript.
25


Reviews:
[{"review_id": "VwtstJbhsL", "reviewer": "Reviewer_Sam5", "summary": "This paper presents a universal black-box attack method for untraceable deepfakes, that trains an adversarial model solely using real data and applicable for various generative models and agnostic to attributiom models. The experimental results show that the attack success rate of the proposed method is not only high across a wide range of attribution models, but also effective against defense mechanisms.", "questions": "See weaknesses.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1.[effectiveness] The proposed method achieves better attack performance than the previous methods, with some loss on SSIM and LPIPS.", "weaknesses": "1.[clarity] In Figure 1, only GAN models are analyzed for the spectral property. Do diffusion models show any similar property? This paper also includes diffusion models apart from GANs, so the diffusion model cannot be missed in this figure.\n\n2.[clarity] This method is effective. However, as a black-box method, its efficiency is also important for discussion. How does the proposed method compare with the previous methods in terms of compute?\n\n3.[ablation] The proposed method balances three parameters in L352 (please also add equation numbers -- this is a typesetting issue). They control perceptual, spatial, and spectral loss functions. In Table 1, I noted that the proposed method's SSIM and LPIPS results are far from the best. If we tune the parameters to improve the SSIM and LPIPS to match with TraceEvador, how does the proposed method perform? Namely, if the proposed method still outperforms TraceEvador at the same SSIM/LPIPS trade-off, the proposed method is strongly better. Otherwise we do not have enough evidence to claim this as a real improvement. At the mean time, the impact of the three parameters is not discussed in this paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kO2QxZd6w9", "reviewer": "Reviewer_8PRM", "summary": "This paper proposes a universal, black-box multiplicative attack to make DeepFakes untraceable by eliminating model fingerprints rather than merely confusing them with additive perturbations. The method trains an image-to-image network on real images augmented with sampling and transformation operations to mimic generative fingerprints; at test time it applies a pixelwise multiplicative mapping to DeepFakes to suppress attribution cues while preserving perceptual quality. Experiments across 12 GMs and 6 attribution models report high attack success and robustness against adversarial training and inversion defenses.", "questions": "See weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Clear articulation of why additive attacks preserve fingerprints; frequency-domain evidence and defensive degradation back this claim.\n2. Simple but clever training using sampling/transform ops to mimic GM artifacts without GM access, which is broad applicability.", "weaknesses": "Theory makes local (first-order) arguments and per-pixel noise assumptions. Some modern AMs often include non-linear, patchwise, or frequency pipelines and heavy pre-processing, have you tested its performance on such models?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9e2JbQu9zN", "reviewer": "Reviewer_kscU", "summary": "This paper attempts to develop a defense strategy against attribution attacks. First, it reviews the limitations of existing approaches, which mainly focus on adding perturbations to images without addressing the removal of model fingerprints, the key indicators used for model attribution. Then, the authors introduce a framework for generating multiplicative perturbations, which constitutes the main claimed contribution of this work. However, the paper’s novelty appears limited, and its motivation and overall logic are not clearly articulated. The anonymous code provided in abstract is dead. Further details are discussed below.", "questions": "NA", "limitations": "", "rating": 2, "confidence": 5, "soundness": 1, "presentation": 4, "contribution": 1, "strengths": "The overall writing quality is clear and well-organized, making the paper easy to follow. The visual demonstrations are also well-designed and effectively support the presented ideas, helping readers better understand the proposed method and its outcomes.", "weaknesses": "The primary claim of this paper is that existing approaches depend solely on additive perturbations applied to images, which are insufficient to remove the underlying model fingerprints responsible for attribution. To overcome this limitation, the authors propose an adversarial network incorporating multiple constraint loss terms that consider spatial, spectral, and perceptual aspects.\n\nHowever, my main concern is that these constraints appear to focus on controlling visual distortions rather than directly addressing the removal of model fingerprints. While the paper provides some theoretical justification, it is not strong enough to convincingly substantiate the central claim.\n\nIn addition, the experimental section does not include attribution accuracy results on clean images, making it difficult to assess the inherent challenge of the task or the true effectiveness of the proposed approach. This omission substantially undermines the paper’s contribution. Moreover, although the authors highlight the strength of their method in black-box defense settings, the corresponding results are missing from the table, which further adds to the confusion and raises doubts about the completeness of the evaluation.\n\nOverall, the motivation and contribution of this work remain unconvincing, and in its current form, the paper does not meet the standards expected for acceptance at ICLR.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Q77RnwcHmb", "reviewer": "Reviewer_Spzx", "summary": "This paper proposes a \"multiplicative attack\" framework aimed at generating untraceable deepfakes that evade forensic attribution models. The core idea is to apply pixel-wise multiplicative perturbations to the generated image to suppress identifiable model fingerprints while preserving visual fidelity. The authors present a theoretical justification suggesting that such perturbations make attribution statistically difficult, and propose an optimization-based implementation that enforces perceptual similarity through the combination of multiple loss terms. Extensive experiments are conducted across multiple models, showing that the proposed method significantly reduces attribution accuracy compared to existing attacks while maintaining high image quality, especially under adversarial training.", "questions": "- Why is $w_i \\in \\\\{0.5, 0.3, 0.2\\\\}$? Why are $\\beta_1, \\beta_2, \\beta_3$ set as $\\\\{0.5, 0.1, 0.4\\\\}$? What happens when these values are changed?\n- I also do not understand why the threat model restricts the attacker to having \"no access to or information about any AMs\". In realistic scenarios, attackers can easily access various AMs as their papers and codes are mostly opensourced. If access to some AMs could enable the attacker to design stronger attacks, then that would be definitely be better.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper studies an important and timely problem, i.e., untraceable deepfakes.\n- The experiments are comprehensive to a large extent and cover multiple generative and attribution models.\n- The paper is well written and easy to follow.\n- Code is provided, which should be encouraged. Although in the README the paper states the code is \"submitted to AAAI\".", "weaknesses": "My main concerns focus on the paper’s theoretical claims about the \"multiplicative attack\" and the supporting propositions. Currently, the theoretical claims made in this paper do not actually support the strong claims regarding multiplicative attacks being uniquely powerful.\n\n- The paper presents its attack as multiplicative, $x' = x \\odot W$, but then immediately defines the adversarial residual as $\\Delta x = x \\odot (W - 1)$ and constrains $|\\Delta x|_2 \\le \\Delta$. This is algebraically identical to writing $x' = x + p(x)$ with $p(x) = x \\odot (W-1)$. In other words, the \"multiplicative\" formulation is just an input-dependent additive perturbation in disguise. Because all of the theorems and propositions are stated and proved in terms of $\\Delta x$ (the residual) and its $\\ell_2$ geometry, the results apply equally well to additive attacks $x' = x + p$. Therefore, the paper gives no theoretical justification for the claim that multiplicative attacks are somehow fundamentally superior to additive attacks. In fact, since the theorems themselves are modeled under an $\\ell_2$ norm constraint, they appear to fit additive models better than the proposed multiplicative model. At best, the paper demonstrates properties of $x + p(x)$ models, not anything special about strict multiplicative structure.\n\n- Theorem 1 is essentially: assume $F$ is differentiable at $x$ and the Jacobian $J(x)$ has a non-zero direction, then there exists a small $\\Delta x$ (with $|\\Delta x|_2 \\le \\Delta$) that changes $F(x)$. I have two concerns regarding this theorem.\n  - The assumptions already imply the conclusion. Requiring a non-degenerate $J(x)$ is equivalent to assuming the model is sensitive to some input direction, so the \"existence\" of a perturbation that changes the output is tautological. This is hardly a new theoretical insight, but rather a trivial existence. \n  - The authors provide no bound on how large the change in the attribution decision will be, nor any probabilistic results about success across AMs. Changing $F(x)$ in the sense of its vector-valued output does not imply flipping the attribution label, nor does it imply removal of a fingerprint. Thus, it is not guaranteed that the attribution decision will be changed and thus the fingerprint removed.\n\n- Proposition 1 and 2 are also problematic and not specific to multiplicative models. The paper argues that multiplicative attacks are \"statistically non-invertible\" and supports this with a per-pixel linear-Gaussian model $x'_j = x_j W_j + \\eta_j$ and a Cramér–Rao lower bound $\\mathrm{Var}(\\hat W_j) \\ge \\sigma^2/(N \\mathbb{E}[x_j^2])$. This derivation is problematic for multiple reasons. \n  - The noise $\\eta$ seems to be artificially introduced. In the attack model the adversary deterministically crafts $x'$; there is no physical measurement noise generated by the attacker. The paper only introduces $\\eta$ later so that standard CRLB formulas can be applied. It is unclear why such noise is present and why it would follow the Gaussian distribution. More confusingly, why is $\\eta$ assumed to be zero in Proposition 1 but Gaussian in Proposition 2? The decision is confusing, and the specific form seems to be chosen solely to make the proof go through. \n  - CRLB results are standard and also apply equally to additive input-dependent perturbations. The same Fisher-information calculation would hold for $x' = x + p(x) + \\eta$ , meaning the bounds are not specific to multiplicative attacks. Thus, the CRLB-based proposition does not establish a unique advantage for multiplicative attacks and only restates that parameter estimation is harder in the presence of noise.\n\n- Finally, the theoretical analysis appears weakly connected to the practical method. The proposed implementation does not rely on an $\\ell_2$ constraint but instead uses perceptual loss. The idea of erasing fingerprints by using methods like sampling, transformations, and Gaussian blurring is already explored in prior works such as TraceEvader and StatAttack [1], and given the above concerns, the presented theory does not seem to explain the empirical success of the proposed attack. The rationale behind the design remains unclear. Although the paper claims to require no access to any AMs, the design in fact embeds many human priors about AMs into the attack process.\n\n- The authors wrote \"Moreover, using a network to invert images imprints its fingerprints onto the recovered content, further degrading defense efficacy\". If this is true, then a trivial attack would be to simply pass the generated image through any unrelated image-to-image model, which would already remove the fingerprint.\n\n- The citation format is incorrect. When citing a work rather than the authors, the paper should use the ``\\citep{}`` command (which produces \"(Ouyang et al., 2024)\") rather than ``\\cite{}`` command (which produces \"Ouyang et al. (2024)\").\n\nRef:\n\n[1]: Hou et al., Evading DeepFake Detectors via Adversarial Statistical Consistency. CVPR 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)