Exploring the Adversarial Robustness of CLIP for AI-generated Image Detection

TL;DR

This paper investigates the adversarial robustness of CLIP-based AI-generated image detectors, comparing them with CNN-based methods, and finds that while both are vulnerable to white-box attacks, their attack patterns differ significantly.

Contribution

It provides the first comprehensive analysis of CLIP-based detectors' robustness against adversarial attacks, highlighting differences from CNN-based detectors and offering insights for improving forensic detection methods.

Findings

CLIP-based detectors are vulnerable to white-box attacks.

Adversarial noise patterns differ in frequency domain between CLIP and CNN detectors.

Attacks do not transfer easily between CLIP and CNN-based methods.

Abstract

In recent years, many forensic detectors have been proposed to detect AI-generated images and prevent their use for malicious purposes. Convolutional neural networks (CNNs) have long been the dominant architecture in this field and have been the subject of intense study. However, recently proposed Transformer-based detectors have been shown to match or even outperform CNN-based detectors, especially in terms of generalization. In this paper, we study the adversarial robustness of AI-generated image detectors, focusing on Contrastive Language-Image Pretraining (CLIP)-based methods that rely on Visual Transformer (ViT) backbones and comparing their performance with CNN-based methods. We study the robustness to different adversarial attacks under a variety of conditions and analyze both numerical results and frequency-domain patterns. CLIP-based detectors are found to be vulnerable to white-box attacks just like CNN-based detectors. However, attacks do not easily transfer between CNN-based and CLIP-based methods. This is also confirmed by the different distribution of the adversarial noise patterns in the frequency domain. Overall, this analysis provides new insights into the properties of forensic detectors that can help to develop more effective strategies.