Red Teaming AI Models

Persona Research Discussion

Michigan State University

Red Teaming for Computer Vision

• AI-generated images and deepfakes
• Diverse, plausible detector failures
• Useful evaluations for Persona

Red-Teaming Image Detectors

Generate new images that a detector calls real

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Project overview

Counterfactual Steering of T2I Models

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Conceptual figure from the starting deck

Steering Latent Trajectories

Reusable directions for a fixed generator–detector pair

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Fig. 2, p. 4

Steered and Unsteered Images

Similar content; different detector decisions

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Fig. 3, p. 6

Steering During Generation

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Fig. 4, p. 7

Steering T2I Models to Red-Team Detectors

Synthetic-image false-negative rates (%)

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Table 1, p. 6

Generator Fingerprints

Steering changes spectral signatures

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Fig. 6, p. 8

Recalibrating the Detector

Threshold recalibration; adaptive reattack remains open

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Table 3, p. 7

FoeGlass: Search with Feedback

Audio evidence; vision adaptation proposed

• Dehdashtian et al., “FoeGlass”, ICML 2026 · Fig. 2, p. 4

Finding Audio Detector Failures

Results vary by target detector

• Dehdashtian et al., “FoeGlass”, ICML 2026 · Table 1, p. 6 · VITS block

What Does Random Sampling Miss?

Benchmark, random and adaptive test inputs

• Dehdashtian et al., “FoeGlass”, ICML 2026 · Table 3, p. 8

Diversity of Discovered Failures

Illustration of sampled audio failure regions

• Dehdashtian et al., “FoeGlass”, ICML 2026 · Fig. 5, p. 14

Beyond Static Image Detection

Separate research target: capture and liveness

• Presentation-attack context images reused from your existing talks · 2023

Coverage Beyond Generators

Which generators, devices and encodings are missing?

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Project distribution-shift illustration

References

• Dehdashtian et al., PolyJuice Makes It Real: Black-Box, Universal Red Teaming for Synthetic Image Detectors, NeurIPS 2025.
  Paper · Project · Slides
• Dehdashtian et al., FoeGlass: Simple In-Context Learning Is Enough for Red Teaming Audio Deepfake Detectors, ICML 2026.
  OpenReview · Publication · Accessible copy
• Persona: selfie verification and liveness

Appendix: Resolution Transfer

Resolution transfer is not generator or detector transfer

• Dehdashtian et al., “PolyJuice Makes It Real”, NeurIPS 2025 · Table 4, p. 7