ISPCloak fools deepfake detectors by mimicking real camera sensors

A new paper from Jiale Zhao and colleagues reveals a fundamental blind spot in deepfake detection: while forensic models excel at catching digital synthesis artifacts, they fail against content that carries authentic physical imaging signatures. The authors introduce ISPCloak, a framework that weaponizes the camera ISP pipeline to generate optimization-free adversarial examples. Instead of relying on computationally expensive gradient-based perturbations, ISPCloak first uses an invertible ISP network to project AI-generated images into the RAW domain. There, it imprints realistic statistical priors from real cameras—specifically Poisson-Gaussian sensor noise—and then reconstructs the image through a forward ISP pipeline. This process, augmented with generative artifact suppression and adaptive masking, produces adversarial examples that look indistinguishable from real photos to human eyes but completely bypass current deepfake detectors.

Extensive experiments demonstrate that embedding these authentic physical perturbations fundamentally disrupts a broad spectrum of detection mechanisms, achieving universally evasive adversarial examples. The method is ultra-fast because it requires no per-image optimization—just a single forward pass through the invertible ISP + forward ISP pipeline. The work has been accepted at ACM Multimedia 2026 and highlights a critical vulnerability: as generative models improve, detectors must evolve to account for hardware-intrinsic statistical signatures, not just digital artifacts. This could have profound implications for digital forensics, media authentication, and AI safety.