PolyJuice Makes It Real: Black-Box, Universal Red-Teaming for Synthetic Image Detectors
Sepehr Dehdashtian*, Mashrur M. Morshed*, Jacob H. Seidman, Gaurav Bharaj, Vishnu N. Boddeti
NeurIPS 2025
Why Is Red Teaming Important?
Red-Teaming Setting
Intuition Behind PolyJuice
PolyJuice Overview
\( \underset{\mathbf{U}}{\argmax}\ \ \text{Tr}\Big\{\mathbf{U}^\top \mathbf{Z} \mathbf{H} \mathbf{K}_{\mathbf{YY}} \mathbf{H} \mathbf{Z}^\top \mathbf{U}\Big\} \\
\text{s.t.} \quad \mathbf{U}^\top \mathbf{U} = \mathbf{I} \)
\( h_{\mathbf{\delta_t}}(\mathbf{z}'_t) = \mathbf{z}'_t + \lambda_t \mathbf{\delta_t},\quad t=1, \ldots, T-1\)
Steering Visualization
How Successful is PolyJuice in Attacking Synthetic Image Detectors?
How Effective is PolyJuice When Applied on a T2I Model-Specific Detector?
How Effective is PolyJuice in Reducing False Negative Rate of Existing SIDs?
How Transferable are the Directions from Lower to Higher Resolutions?
\( \delta_{\text{low}} \in \mathbb{R}^{C \times H_{\text{low}} \times W_{\text{low}} } \longrightarrow \delta_{\text{high}} \in \mathbb{R}^{C \times H_{\text{high}} \times W_{\text{high}}} \)
How Does PolyJuice Affect the Spectral Fingerprint of the T2I Models?
Does PolyJuice Conserve Image Quality?
Summary
- PolyJuice:
- is a novel black-box and distribution-based red-teaming method against SIDs,
- is a brew once, break many approach,
- improves the rate of deceiving SID by up to 84%,
- steers samples into failure regions underexplored by standard T2I generation,
- improves robustness of SIDs by up to 30% when attacks are used to fine-tune them.