LOKI: Dual Domain Perturbation Network for Deepfake Detector Evasion

Abstract

Deepfake forensic detectors have achieved remarkable performance on pristine synthetic images by exploiting spatial artifacts and frequency-domain inconsistencies. Yet, their reliability degrades substantially under realistic post-processing operations, such as compression, resizing and blurring, which are ubiquitous in social media pipelines. At the same time, adversarial examples optimized against a specific detector often exhibit poor cross-model transferability and frequently fail once subjected to image degradations. The Adversarial Attacks on Deepfake Detectors (AADD) Challenge at ACM Multimedia 2026 highlights these limitations by evaluating attack robustness against heterogeneous forensic detectors under real-world transformations. To tackle this problem, we introduce LOKI, a Dual-Domain Perturbation Network that jointly manipulates spatial and spectral forensic cues through complementary U-Net and DCT-based branches. To improve both transferability and distortion robustness, LOKI is optimized against a heterogeneous ensemble of four detectors using a Curriculum Expectation over Transformation (EOT) strategy that progressively increases post-processing severity during training. Our approach achieved the 2nd place in the AADD Grand Challenge, demonstrating competitive cross-model transferability and attack effectiveness that remains substantial under severe image degradations.