Problem

The rapid advancement of diffusion models has led to highly realistic AI-generated content (AIGC), making it increasingly difficult for forensic detectors to distinguish between real and synthetic images. This poses significant risks, including misinformation and malicious forgery. While various AIGC detectors exist, they remain vulnerable to adversarial evasion methods. Existing evasion techniques typically fall into two categories: post-hoc perturbation of already generated images, which can introduce visible artifacts and limit robustness, or detector-aware training/finetuning of diffusion models, which requires significant resources and limits applicability in black-box scenarios. A critical challenge is the ability to generate detector-evasive images directly from random noise within a single diffusion sampling trajectory, without requiring source images or retraining the diffusion model, especially when the target detector is only accessible via black-box queries.

Method

Trajectory-Injected Generative Attack (TIGA) addresses these challenges with a training-free framework that steers the Denoising Diffusion Implicit Model (DDIM) latent trajectory. TIGA operates within the diffusion sampling process and comprises three main modules. First, the Surrogate-Guided Prior (SGP) module aggregates gradients from multiple white-box surrogate detectors to form a transferable, sign-aware prior direction in the latent space. This prior biases the subsequent search towards detector-evasive regions. Second, the Surrogate-Guided Directional Search (SGDS) module performs an anisotropic directional search, guided by the SGP, using symmetric finite-difference queries to estimate the black-box target detector's response. This approach estimates a stable trajectory guidance vector more efficiently than isotropic search. Third, the Schedule-Aware Trajectory Injection (SATI) module injects the accumulated momentum into the DDIM trajectory, scaling it according to the diffusion noise schedule and reshaping it in the frequency domain to suppress high-frequency artifacts and remove channel-wise bias, thereby preserving visual fidelity. This ensures that adversarial properties emerge naturally during generation rather than being added as external perturbations.

Results

Experiments demonstrated that TIGA achieved a perfect 100% Attack Success Rate (ASR) against all tested general-purpose black-box AIGC detectors (ResNet-50, EfficientNet-B0, DeiT-Base, Swin-Base), while simultaneously achieving the lowest BRISQUE (Blind/Referenceless Image Spatial Quality Evaluator) scores, indicating superior perceptual quality compared to six representative baselines (FGSM, PGD, SimBA, Square Attack, BruSLe, R2BA). TIGA also exhibited significantly better transferability to unseen specialized forensic detectors (CNN, DIRE, Uni, Effort, PGC), outperforming baselines which often overfit to low-level statistics of their original targets. Furthermore, TIGA proved robust under common post-processing operations such as Gaussian blur, JPEG compression, and resizing, whereas most baselines showed substantial degradation in evasiveness. An ablation study confirmed the complementary contributions of TIGA's three modules, with the Surrogate-Guided Directional Search being the most critical for attack strength without compromising quality, and the frequency-domain suppression contributing to fidelity.

Implications

TIGA represents a significant advancement in adversarial generation against black-box AIGC detectors. By directly injecting adversarial signals into the diffusion sampling trajectory, it bypasses the limitations of post-hoc perturbation and detector-aware retraining, offering a source-image-free, training-free solution. The framework's ability to achieve high attack success rates with minimal visual artifacts, strong transferability, and robustness to post-processing highlights a new threat to current AIGC forensic methods. This research encourages the development of more robust AIGC detection mechanisms that can account for trajectory-level manipulations. Future work includes expanding the range of surrogate and target detectors, as well as extending TIGA's applicability beyond face generation and single diffusion backbones to a wider array of generative models and content types.