Deepfake detectors have a soft spot: they often key on brittle, model-specific artifacts, so a doctored image that fools one detector may sail past another it was never tuned against. That is the black-box transfer problem, and it gets worse going from convolutional detectors to transformer-based ones, which trip on different cues. ARMOR++ is an attack framework built to exploit that gap, and it reads as a warning about how fragile these detectors still are.

It uses two language-and-vision models as a control layer: one supplies a sense of where in the image to focus, the other orchestrates a toolbox of five perturbation methods (dense optimization, saliency tweaks, spatial warps, frequency-domain changes, and block-level edits), tuning and mixing them on the fly. Because different detectors have different blind spots, hitting several at once transfers better. On the AADD-2025 benchmark they report higher blind-target success than prior attacks.

This summary is from the abstract, so the paper holds the exact success rates and the defensive settings they tested against.