Chimera: Creating Digitally Signed Fake Photos by Fooling Image Recapture and Deepfake Detectors

Deepfake detectors relying on heuristics and machine learning are locked in a perpetual struggle against evolving attacks. In contrast, cryptographic solutions provide strong safeguards against deepfakes by creating hardware-binding digital signatures when capturing (real) images. While effective, they falter when attackers misuse cameras to recapture images of digitally generated fake images from a display or other medium. This vulnerability reduces the security assurance back to the effectiveness of deepfake detectors. The main difference, however, is that a successful attack must now deceive two types of detectors simultaneously: deepfake detectors and detectors specialized for detecting image recaptures. This paper introduces Chimera, an end-to-end attack strategy that crafts cryptographically signed fake images capable of deceiving both deepfake and image recapture detectors. Chimera demonstrates that current adversarial and generative models fail to effectively deceive both detector types or lack generalization across different setups. Chimera addresses this gap by using a hardware-aware adversarial compensator to craft fake images that successfully bypass stateof-the-art detection mechanisms. The key innovation is a GAN-based image generator that accounts for and compensates the physical transformations introduced during the recapture process. Through rigorous testing using commercial off-the-shelf cameras and displays, Chimera proves effective in fooling both types of detectors with a high success rate while having high visual quality (compared to the original real image). Chimera demonstrates the vulnerability of deepfake detectors even when equipped with hardware-based digital signatures. Our successful end-to-end attack on state-of-theart detectors shows an urgent need for more robust detection and mitigation strategies. The source code is available at https://github.com/ssysarch/Chimera . *The first two authors contributed equally (the author order does not reflect their extent of contributions). Deepfake Detector Real Sign Real Fake Verify Deepfake Detector Verify Real Real Fake (a) While existing deepfake detection solutions are unable to defend against adaptive attacks, cryptographic signatures can protect the system by creating tamper-proof signatures. Sign Sign Deepfake Detector Verify Recapture Detector State-of-the-Art Our Model Real Fake + + (b) Cryptographic methods are vulnerable to screenshot deepfake attacks. Successful attacks, however, need to fool both deepfake AND recapture detectors. Our scheme, Chimera, is the first method to achieve such a capability.