Discovering Emerging Multimedia Technologies for National Security at ACM Multimedia 2024 (Part 2/4)

This is part 2 of the 4-part series about the experience attending the ACM MM 2024 conference, follow-up research explorations and technical takeaways.

You can read Part 1 here, Part 3 here, and Part 4 here. The following research papers were explored for various operational use cases in Home Team departments:

• Part 1: The ACM MM 2024 Conference experience
• Part 2: StealthDiffusion, an adversarial attack method applied on deepfake images to reduce their detectability by deepfake detectors. (You’re here!)
• Part 3: Wave-Mamba for Low-light image enhancement and deraining; RainMamba for Video Deraining.
• Part 4: Loformer for Image Deblurring.

StealthDiffusion Hiding in Plain Sight with Undetectable AI-Generated Images

AI-generated images are getting so convincing that not even deepfake detection algorithms can always tell them apart from the real thing. This gap between detection and deception is exactly what StealthDiffusion seeks to exploit — and it’s remarkably good at it.

Fig. 1. StealthDiffusion model workings: A small adversarial noise is introduced to the raw image using the Projected Gradient Descent (PGD) method, then proceed to the Adversarially Optimising on Latent Space step in Stable Diffusion, and the final output image is obtained by combining the outputs from the Control-VAE. These refined images are simultaneously difficult for algorithms to identify as fake and indistinguishable from genuine ones to the human eye. (source: StealthDiffusion)

Where previous evasion methods often introduced visible distortions or failed across different systems, StealthDiffusion: Towards Evading Diffusion Forensic Detection through Diffusion Model refines diffusion-generated images to be nearly indistinguishable from real ones, for both humans and algorithms. And it does so with surgical precision, thanks to two key innovations:

1. Latent Adversarial Optimisation (LAO) The LAO fine-tunes hidden representations in the diffusion pipeline, allowing for precise and detailed improvements without compromising image quality. Think of it like subtly rewriting the DNA of the image: keeping it looking the same, but with just enough change to sneak past detection models.
2. Control-VAE Module This Variational Autoencoder aligns the underlying patterns of generated images with those of real ones, reducing the statistical signals that detectors rely on without sacrificing visual quality or generation control.

The pipeline starts with a tiny injection of adversarial noise using Projected Gradient Descent (PGD). Then the system optimises within the latent space of Stable Diffusion, and finally harmonises the result using the Control-VAE. The output is a hyper-realistic image that resists both forensic tools and visual scrutiny.

Qualitative Model Performance of StealthDiffusion: A visual comparison between MimicBrush diffusion-inpainted images before and after StealthDiffusion

The following images show that the diffusion-inpainted images before and after Stealthdiffusion adversarial attack method has been applied to evade deepfake detection has imperceptible differences and the reconstructed images exhibit little to no visual distortions or artifacts.

Fig. 2.1. Example 1 of MimicBrush, diffusion-inpainted image (left), and the image after StealthDiffusion adversarial attack has been applied (right).

Fig. 2.2. Example 2 of MimicBrush, diffusion-inpainted image (left), and the image after StealthDiffusion adversarial attack has been applied (right).

Fig. 2.3. Example 3 of MimicBrush, diffusion-inpainted image (left), and the image after StealthDiffusion adversarial attack has been applied (right).

Quantitative Results: It’s Not Just Visual

To evaluate StealthDiffusion’s performance, we looked at both perceptual quality and detection evasion effectiveness. PSNR (Peak Signal-to-Noise Ratio) of 35.21 dB achieved indicates strong pixel-level similarity to the original image with minimal distortion. SSIM (Structural Similarity Index) of 0.9087 means the structural and perceptual quality is almost indistinguishable from real images. Low variance in both metrics demonstrates consistency across a wide range of image inputs — including those with complex inpainting artifacts like those generated using MimicBrush.

These numbers confirm that StealthDiffusion produces consistently high-quality results, making it a reliable method for generating clean, hard-to-detect deepfakes.

Testing Detection Robustness: Before vs After Attack

We wanted to know: Can StealthDiffusion actually trick a real deepfake detection model?

To find out, we used a Binary Neural Network (BNN) deepfake detector, chosen for its efficiency and generalisation ability, to test for detection robustness before and after the adversarial attack was applied on generated images. Two types of datasets were used: (1) Diffusion inpainted faces generated using MimicBrush (source images from CelebAMask-HQ dataset)* (2) Fully diffusion-synthesised face datasets: [DCFace](https://ieeexplore.ieee.org/document/10204758) and [DiffFace](https://arxiv.org/abs/2212.13344).*

Note: The recall was computed using scikit-learn’s recall_score function with the binary predictions obtained from the fixed 0.5 threshold. The approach treats the deepfake detection task as a standard binary classification problem with a conventional 0.5 decision boundary.

Table 1. Recall score before and after Stealthdiffusion adversarial attack method was applied on partial diffusion inpainted image dataset (generated using MimicBrush diffusion model) and entire face synthesis (fully diffusion-generated) datasets (DCFace and DiffFace) respectively.

Key Takeaways from the Results

For diffusion-inpainted images generated using MimicBrush, mixed performance was observed: For some facial regions (e.g., hair and facer), recall actually increased post-attack. This could mean that perturbations at region boundaries made fake areas more obvious.

Skin regions and irregular masks, however, showed decreased recall — suggesting that smoother areas or skin regions allow perturbations to blend in better, reducing detectability. Irregular masks, being broader or encompassing diverse regions, could dilute the detection model’s ability to focus on adversarial perturbations. For fully synthesised faces, a clear drop in recall was observed after the StealthDiffusion attack. A 1–2% drop may look insignificant numerically, but it is actually critical in high-recall regimes — especially in security-sensitive deployments. The diffusion models used to generate the images in the two datasets (DCFace and DiffFace) rely heavily on global consistency, which makes StealthDiffusion’s full-image adjustments particularly effective. These results suggest that StealthDiffusion is better tailored for fully synthesised faces, where it can uniformly adjust features across the entire image without introducing artifacts that might alert the detection model.

Further Insights and Future Work

The region-specific vulnerabilities of Stealthdiffusion were uncovered through this exploration.

The success (or failure) of adversarial attacks may depend heavily on where the changes are applied. Future studies could explore the impact of mask size, shape, and region on detectability and combine multiple regions in composite attacks to maximize stealth. Comparisons could also be made with other detectors. I used BNN in this study for its competitive performance and high efficiency, but how would Xception, EfficientNet, or Vision Transformers fare? Comparing across models could help reveal model-agnostic weaknesses.

And what do the findings mean for defensive research? Fine-grained detection is needed.

Countering adversarial attacks like StealthDiffusion will require stronger defenses:

• Adversarial training for deepfake detection models
• Defensive distillation or feature-level perturbation filters
• Ensemble models that cross-validate predictions using diverse architectures

StealthDiffusion’s ability to evade detection (even slightly) raises real concerns. In domains like national security, law enforcement, and content verification, small gaps in detection performance can lead to large consequences. For example, bad actors could misuse tools like StealthDiffusion to trick facial recognition systems by uploading doctored images designed to fool the technology. Hence, adversarial evaluation should be a mandatory step in deploying any deepfake detection pipeline.

In conclusion, StealthDiffusion pushes the boundaries of image generation while challenging the very idea of what can be detected. As generative AI tools become more powerful and stealthy, it’s not enough to build detectors that work today. We need systems designed with tomorrow’s threats in mind, and StealthDiffusion offers a glimpse into the next frontier of generative deception.

Thanks for reading! If you enjoyed this article, look out for Parts 3 and 4 where I’ll be sharing the work done, outcomes and insights gained from follow-up explorations of Wave-Mamba, RainMamba and Loformer.

Next up: [Part 3 — Wave-Mamba for Low-light image enhancement and deraining and RainMamba for Video Deraining]

Or go back to: [Part 1 — The ACM MM 2024 Conference experience]