Search papers, labs, and topics across Lattice.
This paper details the "Go To Germany" team's approach to the ImageCLEF 2026 Deepfake Detection and Generation Task, utilizing FLUX.1-dev with PuLID for identity-preserving face synthesis and a multi-model PGD adversarial attack that achieved 90% evasion against organizer detectors. For detection, a max-probability ensemble of SigLIP+DINOv2 and GenD-DINOv3 achieved 99.4% accuracy on baseline deepfakes but struggled with high false-positive rates on real images. Additionally, an investigation into purification-based adversarial detection revealed that raw $|\Delta \text{logit}|$ under median-3 purification effectively distinguishes adversarial inputs from clean ones, challenging existing hypotheses about backbone preservation.
Achieving 90% evasion against leading deepfake detectors reveals significant vulnerabilities in current detection methodologies.
This paper describes the participation of team"Go To Germany"in the ImageCLEF 2026 Deepfake Detection and Generation Task. For the image generation task, we employ FLUX.1-dev with PuLID for identity-preserving face synthesis, combined with a multi-model PGD adversarial attack targeting 12 detectors simultaneously (DiffJPEG-in-loop, MI/DI/EoT, adaptive weighting, two-stage warm-start). Our approach achieved 90% evasion against organizer detectors and 57.6% against participant detectors, with a final generation score of 0.4170. For the image detection task, we combine two complementary detectors - SigLIP+DINOv2 for AI-generated images and GenD-DINOv3 for face manipulations - in a max-probability ensemble, achieving 99.4% accuracy on baseline deepfakes but suffering from high false-positive rates on real images, resulting in a final detection score of 0.6986. Beyond the official submission, we conducted a self-initiated investigation of purification-based adversarial detection, comparing three families of detection signals across six detectors that share a CLIP ViT-L/14 backbone. We find that raw $|\Delta \text{logit}|$ under median-3 purification, applied through the EFFORT detector, separates adversarial inputs from clean inputs with AUROC 0.81-0.98 across four adversarial source types - a finding that refutes the simple backbone-preservation hypothesis and exposes a sharp JPEG-quality cliff at Q70 where the signal collapses.
