{"id":"38604a9d-caf5-493a-b44e-4a7f45416104","arxiv_id":"2412.01622","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A dual-branch EfficientNetV2 network with guided noise extraction, dynamic-convolution feature aggregation, and an atrous residual pyramid achieves top average F1 on five forgery localization benchmarks.","lead":"An image forgery localization system that combines a guided-filter and Sobel noise branch with a dynamic-convolution aggregation module and an atrous residual pyramid reports higher F1 scores than several published methods on five benchmarks. A smart generalist might read it to see whether modular tweaks to a two-branch forensics network actually improve small-region and post-processed image localization.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The SOTA claim rests on uncontrolled cross-paper F1 comparisons; the NIST16 F1 gain (+19.3) is not corroborated by AUC (+1.4) or IoU (+0.7), so the headline margins are not yet established.","rationale":"Good-faith reading: this is a conventional empirical IFL paper with a coherent pipeline (EfficientNetV2 dual-branch, FAM, ARPM, SCCM), and Table 8 gives internal ablation support that each module helps on CASIA. The central claim, however, is comparative: SOTA on four datasets and on small forged regions. That claim depends on the comparability of the baselines. The paper states in Section 4.1.1 that only the proposed model is trained on the PSCC-style training set, then in Section 5.1 that baseline numbers are taken from original papers or released code. Since the original methods were trained on different data and with different protocols, the reported F1 margins cannot be attributed to the architecture. The threshold concern is intertwined: the largest claimed gain (+19.3 F1 on NIST16) is accompanied by much smaller AUC and IoU gains, which is the expected signature of threshold or calibration effects under class imbalance. The reader's identified assumption about the guided-filter residual in Eqs. (3)-(4) is less load-bearing: it is heuristic, but Table 8 shows only a moderate contribution from guided noise, and a network can learn to down-weight irrelevant residual content, so a failure of the residual-isolates-forgery assumption would weaken but not necessarily destroy the claim. The concrete check is a controlled retraining and evaluation; until that is done, CONDITIONAL remains the right level of confidence, so the reader's verdict is unchanged.","tokens_in":19945,"tokens_out":8205,"duration_ms":78681,"concrete_test":"Run a controlled comparison: using official code/weights, retrain (or fine-tune) HiFi-Net, PSCC-Net, and MVSS-Net on the exact Section 4.1.1 training set with the paper's 256x256 resolution, Adam, lr=2e-4, and 25-epoch schedule, then evaluate all methods on the five test sets with the same script and report PR-AUC and F1 at both 0.5 and the per-method optimal threshold. If the NIST16/IMD20 F1 margins over HiFi-Net are not reproduced under this protocol, the central SOTA claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is empirical: Section 5.1/Table 3 reports that Ours beats HiFi-Net in F1 by 8.1, 2.7, 19.3, and 5.7 points on Coverage, CASIA, NIST16, and IMD20, and Section 5.2/Table 6 claims superior small-region localization. The load-bearing condition is that the baseline numbers are directly comparable. That condition is not met: Section 4.1.1 trains only the proposed model on the PSCC-style training set, while Section 5.1 says baseline results are 'taken from the original paper or run the publicly available source code.' The original methods were trained on different data, at different resolutions, and with different augmentation and fine-tuning protocols; the paper does not retrain baselines on the shared training set or otherwise control for this. The risk is concrete: the 19.3-point NIST16 F1 gap is much larger than the 1.4-point AUC and 0.7-point IoU gaps over the best baselines (Tables 3-4). F1 at a fixed 0.5 threshold is sensitive to calibration; a large F1 gain with nearly unchanged AUC/IoU is exactly the signature of threshold or probability-scale artifacts rather than a genuine localization-quality gain. Table 6's small-region AUC gains are larger, but they also rely on unreleased baseline checkpoints and a dataset-filtering procedure (images with forged area below 1%, 5%, 10%) that is not specified in enough detail to replicate. Until the evaluation is controlled, the headline 'best on four datasets' and the specific percentage improvements are unsupported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an end-to-end image forgery localization network with two branches: an RGB branch and a guided-noise branch. The guided noise is defined as the absolute residual after guided filtering plus Sobel edge maps, based on the decomposition I = Ic + If. Features from four EfficientNetV2 layers are aggregated by a dynamic-convolution-based Feature Aggregation Module (FAM), then processed by an Atrous Residual Pyramid Module (ARPM) with dilation rates 6, 12, and 18. Localization is performed by PSCC-Net's spatial-channel correlation module in a progressive manner, and the total loss is the sum of four BCE losses. Experiments are reported on five public datasets with AUC, F1, and IoU, including small-region and robustness studies, plus an ablation study on CASIA. The central claim is that the proposed model outperforms several state-of-the-art IFL methods, especially on small forged regions and under post-processing.","tokens_in":20261,"tokens_out":5393,"duration_ms":56468,"significance":"If the reported results hold, the paper offers a modular architecture that is simple to describe and appears competitive on multiple public benchmarks. The manuscript's strengths are the systematic ablation on CASIA, which shows that each proposed component contributes to the final score, and the use of three complementary metrics. However, the empirical headline depends on uncontrolled comparisons with published baseline numbers, and the NIST16 F1 improvement is not mirrored by AUC or IoU. No code, model weights, or training data are released. The architectural novelty is incremental, but the empirical claim, if verified under a controlled protocol, would still be a useful contribution to the forgery localization literature.","major_comments":[{"comment":"The claim of state-of-the-art performance is not supported by a controlled comparison. The proposed model is trained from scratch on the 376k-image PSCC-style set at 256×256 resolution, whereas Section 5.1 states that 'all model results are taken from the original paper or run the publicly available source code.' The baselines were therefore trained on different data, at different resolutions, with different augmentation and fine-tuning protocols; none is retrained on the shared training set. As a result, the reported F1 improvements of 8.1, 2.7, 19.3, and 5.7 points on Coverage, CASIA, NIST16, and IMD20 (Table 3) conflate architectural differences with training-protocol differences. This is load-bearing for the main claim and should be addressed by retraining baselines under a shared protocol or by a tightly specified reproduction procedure.","section":"§5.1 and §4.1.1"},{"comment":"The NIST16 result is internally inconsistent across metrics: the F1 gain over HiFi-Net is +19.3 points, while the corresponding AUC gain over PSCC-Net is +1.4 and the IoU gain over HiFi-Net is +0.7. F1 at a fixed threshold is sensitive to calibration, so this pattern is compatible with a threshold artifact rather than a genuine localization-quality gain. The explanation offered in Section 5.1 (small forged regions make F1 emphasize precision and recall) does not address why the global metrics move so little. Please report the threshold used for F1, provide PR curves, or include a threshold-independent metric to substantiate the NIST16 claim.","section":"§5.1, Tables 3-4"},{"comment":"The small-forged-region experiment is not reproducible as specified. It is unclear whether the 1157, 3428, and 4667 selected images were chosen per dataset or globally, how the forged-area percentage was computed (relative to image area, bounding-box area, or ground-truth ROI), and whether images with extremely small masks were excluded. Because the comparison uses only methods with publicly available code, the exact baseline configurations and checkpoint versions also need to be pinned down. The small-region claim, which is one of the paper's central contributions, cannot be verified without this information.","section":"§5.2, Table 6"},{"comment":"The robustness comparison is reported as single numbers without variance or significance tests, and the undistorted baseline shows the proposed method at 93.8 AUC versus 98.2 for PSCC-Net and 98.4 for HiFi-Net. The table's parenthetical deltas (e.g., '0.3↓', '6.0↓') are not defined in the text. The robustness claim would be strengthened by reporting multiple runs or seeds with error bars, and by clarifying whether the same operating point is used for all methods, especially given the apparent calibration difference on the undistorted Columbia set.","section":"§5.3, Table 7"}],"minor_comments":[{"comment":"The decomposition I = Ic + If and the claim that guided filtering removes only If while preserving Ic are asserted without discussing other high-frequency content such as texture, sensor noise, or compression artifacts; a sentence situating this as a heuristic and referring to the ablation evidence (Table 8) would help the reader calibrate the assumption.","section":"§3.2.2, Eqs. (2)-(4)"},{"comment":"There are multiple typos and inconsistencies, including 'Spectifically', 'Expensive experiments', 'modifing', 'guiede niose', 'artous convolution', 'resourece', and 'Soble(·)' in Eq. (4) and Figure 2.","section":"Throughout"},{"comment":"Both equations have unbalanced parentheses: Eq. (7) is missing a closing parenthesis at the end, and Eq. (15) lacks a closing parenthesis after ReLU(C3×3(F)).","section":"Eqs. (7) and (15)"},{"comment":"The F1 score is used throughout, but the threshold used to binarize the predicted probability mask is not reported; please state it explicitly.","section":"§4.3"},{"comment":"The parenthetical deltas in the 'Ours' column (e.g., '0.3↓', '6.0↓') are not explained in the table caption or the text.","section":"Table 7"},{"comment":"The data availability statement says 'Data will be made available on request'; given the empirical nature of the claims, releasing code, model weights, and the exact evaluation scripts is important for verification.","section":"§9, Data availability"}],"recommendation":"major_revision","confidential_remarks":"The paper is within the scope of a security/forensics venue, and the central issue is experimental control rather than methodology. The architecture is plausible and the ablation is a positive sign, but the headline SOTA claim currently rests on cross-paper comparisons with different training protocols, and the NIST16 F1/AUC/IoU discrepancy needs a concrete explanation. I would like to see either a controlled retraining of baselines or a clear statement of why that is infeasible, together with full specification of the small-region evaluation. I would not invite a revision based solely on typos."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a competent, conventional empirical IFL paper with an honest ablation and a plausible but not yet defensible SOTA claim. The architecture — guided-filter plus Sobel noise extraction, two EfficientNetV2 branches, dynamic-convolution FAM, atrous residual pyramid, SCCM localization — is a legitimate combination not present in the cited prior work, and the CASIA ablation supports each module. The paper earns a look from anyone working on forgery localization.\n\nWhat it does well: the experiments cover five public datasets and three metrics; the robustness tables on Columbia under resize/blur/noise/JPEG show consistent gains beyond the two best baselines except at JPEG q=100; the ablation isolates the contributions of the noise extractor, FAM, ARPM, and EfficientNetV2 backbone, and it compares against BayarConv and SRM in the noise branch. That is real evidence by the usual standards of this subfield.\n\nThe soft spots are evaluation control and reproducibility. First, Table 3 mixes baseline numbers taken from original papers with runs of public code; those baselines were trained on different data, at different resolutions, with different augmentation and fine-tuning. The 19.3-point NIST16 F1 gain sits next to a 1.4-point AUC gain and a 0.7-point IoU gain — exactly the pattern you expect from a threshold calibration artifact rather than a real localization-quality jump. The paper acknowledges this discrepancy and gives an imbalance argument, which is plausible but not dispositive. Second, there is no code, no model weights, \"data available on request,\" and no significance or variance testing anywhere. The small-region experiment (Table 6) uses a dataset-filtering procedure that is not described in enough detail to replicate, and it only runs the three baselines with public code. The guided-filter assumption — that the output approximates content Ic, leaving If as forgery trace — is a genuine theoretical soft spot, but the ablation against Bayar and SRM shows the choice has empirical support on CASIA, so I would not call it a load-bearing flaw.\n\nWho gets value: applied forensic researchers who want an incremental but well-rounded IFL model and a fair comparison of noise-extraction strategies. It should go to peer review — a serious editor should send it out, not desk-reject — but the review request should include code/weights, controlled baseline retraining at minimum on NIST16, and a threshold or calibration analysis to support the F1 headline.","headline":"Plausible IFL combination with honest ablations, but the headline F1 gains are not yet defensible until baselines are controlled and NIST16 is checked for calibration artifacts.","tokens_in":20828,"tokens_out":2473,"would_cite":false,"duration_ms":120805,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that guided-filter noise residuals, fused with RGB features by dynamic convolution and widened by an atrous residual pyramid, localize forged regions — above all small and post-processed ones — more accurately than prior…","keywords":["Image Forgery Localization","Guided Noise","Guided Filter","Feature Aggregation","Atrous Residual Pyramid","Dynamic Convolution","Small Forgery Regions","Digital Forensics"],"falsifier":"Replace the guided filter with a generic high-pass operator (Laplacian or difference-of-Gaussians) under identical training: if AUC on CASIA and NIST16 stays within the reported margins, the guided decomposition is not the source of the gains. Second, measure the residual energy on pristine images — the assumption predicts the residual of an unedited image is near-silent, so strong activation on authentic texture would falsify the noise-isolation story.","tokens_in":19701,"feed_emoji":"🔍","tokens_out":13671,"duration_ms":119165,"temperature":0.7,"pith_summary":"This paper tries to establish that forgery traces are best learned as a guided-filter residual: if an image is treated as content plus tampering information, then subtracting the guided-filter output from the image exposes the tampering, and adding a Sobel edge map keeps the boundary artifacts that post-processing blurs. The authors argue that prior forgery-localization networks degrade fine features through deep convolutions or self-attention, so they miss small forgeries and lose accuracy after compression, resizing, blur, or noise. Their answer is a dual-branch network on an EfficientNetV2 backbone — one branch on RGB, one on the guided noise — whose Feature Aggregation Module fuses the streams with dynamic convolution and whose Atrous Residual Pyramid Module merges four receptive fields. If the claim holds, the method gives a practical accuracy gain exactly where forgery detection matters most in the wild: tiny forged regions (up to a 19.3% F1 gain over the previous leader on NIST16) and images that have passed through social-media pipelines.","feed_headline":"Guided-filter noise lifts small-forgery detection by 19 percent","feed_subtitle":"A residual forged trace plus Sobel edges, fused across scales, spots tiny fakes and survives compression and blur.","key_machinery":"The argument is carried by three modules and one identity. The decomposition $I = I_c + I_f$ turns localization into residual estimation, and the guided noise extractor materializes it as $I_g = |I - \\mathrm{Guide}(I)| + \\mathrm{Sobel}(I)$: the guided filter (an edge-preserving local-linear filter) is assumed to strip tampering content while keeping genuine content, and the Sobel term re-injects edges that post-processing weakens. The Feature Aggregation Module (FAM) enhances the RGB stream by a Sobel pass, a $1\\times1$ convolution, a $3\\times3$ dynamic convolution — whose kernel adapts to the input, so different forgery types get different filters — and a $5\\times5$ convolution; it enhances the noise stream by a $1\\times1$ convolution, max pooling, and a $7\\times7$ convolution; then it concatenates the two streams through a $1\\times1$ convolution with batch norm and ReLU. The Atrous Residual Pyramid Module (ARPM) pools the aggregated feature globally and runs three $3\\times3$ atrous convolutions at dilations 6, 12, and 18, fusing everything with a $1\\times1$ convolution so that global and local features coexist. The final masks come from four progressive Spatial-Channel Correlation Modules, each supervised by binary cross-entropy.","core_discovery":"The central claim is that the guided filter turns forgery detection into a residual problem. Writing the image as $I = I_c + I_f$, the paper asserts that the guided filter output approximates the genuine content $I_c$, so the residual $I_f = |I - \\mathrm{Guide}(I)|$ concentrates tampering traces, and adding Sobel edges preserves the weakened boundary artifacts. A shared EfficientNetV2 backbone then learns RGB and noise features at four scales, and the Feature Aggregation Module fuses them with dynamic convolution instead of naive concatenation, which the authors argue prevents the two streams from hiding each other's forgery information. The Atrous Residual Pyramid Module, using dilations of 6, 12, and 18 alongside a global pooling branch, keeps both small local traces and wide context. On its own terms, the paper establishes that this combination beats state-of-the-art dual-branch methods on four of five public benchmarks, with the strongest margin on the small-forgery dataset NIST16, and that it holds the top robustness score on seven of eight post-processing settings on Columbia.","pith_inferences":["A testable extension is to feed the guided noise branch alone (no RGB stream) through a segmentation head: the paper's decomposition predicts the residual alone should trace splicing boundaries, so a standalone-noise run would isolate how much of the gain is forensic signal versus aggregated texture.","Because the residual is computed without learned parameters, one could swap the guided filter for any learned or fixed denoiser and re-measure the same benchmarks; if the gains survive the swap, the claim is about residual high-frequency content generally, not about guided filtering specifically.","The paper never quantifies how much of $|I - \\mathrm{Guide}(I)|$ on authentic images is non-forgery texture; a direct editor-level check would compare residual statistics of pristine versus forged images with matched content, which would tell whether the noise branch risks flagging natural detail as tampering.","If the small-region gains are mainly from the pyramid, a natural probe is to replace ARPM with a standard feature pyramid network under identical training and see whether the atrous dilations, rather than multi-scale fusion per se, are what recover tiny forged regions."],"forward_implications":["Small forged regions become the method's strongest suit: on images whose forged area is under 1% of the picture, the model reports AUC 87.1 versus 82.9 for PSCC-Net and 81.2 for HiFi-Net.","Post-processing robustness follows from the fusion, not from heavier denoising: on the Columbia dataset with resizing, blurring, Gaussian noise, and JPEG compression, the model keeps the best AUC on seven of the eight distorted settings.","The noise branch is parameter-free at extraction time — a guided filter and a Sobel filter — so the claimed gains do not depend on training a learned noise estimator.","The ablations indicate the specific design choices matter: swapping the guided filter's Sobel edge term for BayarConv or SRM drops AUC by about 3.6–3.7%, and swapping EfficientNetV2 for HRNet drops AUC by 7.9% on CASIA."],"supporting_citations":[{"why":"Supplies the guided filter whose output is assumed to equal the content component, making Eq. (3) the basis of the noise branch.","marker":"[9]"},{"why":"Provides the Sobel edge operator added to the guided residual in Eq. (4) to preserve boundary artifacts.","marker":"[10]"},{"why":"Antecedent work using guided filtering to expose small-size forgeries; the paper builds its residual extraction on this idea.","marker":"[48]"},{"why":"The EfficientNetV2 backbone that extracts both RGB and noise features; the paper credits it with part of the accuracy gain.","marker":"[11]"},{"why":"Defines the dynamic convolution used inside the Feature Aggregation Module to adapt the RGB feature kernel.","marker":"[12]"},{"why":"Defines the atrous (dilated) convolutions that give the Atrous Residual Pyramid Module its multiple receptive fields.","marker":"[13]"},{"why":"The progressive spatio-channel correlation network that is both a main baseline and the source of the training data protocol and the SCCM localization module.","marker":"[7]"},{"why":"The HiFi-Net baseline against which the headline F1 improvements of 8.1%, 2.7%, 19.3%, and 5.7% on four datasets are measured.","marker":"[8]"},{"why":"The MVSS dual-branch baseline used in the small-region and robustness comparisons.","marker":"[6]"},{"why":"The NIST16 test set, whose smallest average forged region (7.45% of the image) is where the paper reports its largest gain.","marker":"[57]"}],"fun_headline_variants":["Guided residual noise lifts small-forgery detection","Multi-scale dynamic fusion exposes tiny fakes","19% better at spotting small forged regions","Robust forgery locator via guided noise aggregation","Residual traces plus multi-scale catch fakes"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on the assumption that the guided-filter residual $|I - \\mathrm{Guide}(I)|$ is a faithful portrait of forgery traces, and that what the filter removes from a forged image is tampering evidence rather than ordinary texture, sensor noise, or compression artifacts.","fun_headline_variants_meta":{"raw":{"variants":["Guided residual noise lifts small-forgery detection","Multi-scale dynamic fusion exposes tiny fakes","19% better at spotting small forged regions","Robust forgery locator via guided noise aggregation","Residual traces plus multi-scale catch fakes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000494,"raw_usage":{"total_tokens":2435,"prompt_tokens":965,"completion_tokens":1470,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":581,"completion_tokens_details":{"reasoning_tokens":1399}},"tokens_in":581,"tokens_out":1470,"duration_ms":13687,"temperature":1.0,"reasoning_tokens":1399,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T18:59:00.137176+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Replace the guided filter with a generic high-pass operator (Laplacian or difference-of-Gaussians) under identical training: if AUC on CASIA and NIST16 stays within the reported margins, the guided decomposition is not the source of the gains. Second, measure the residual energy on pristine images — the assumption predicts the residual of an unedited image is near-silent, so strong activation on authentic texture would falsify the noise-isolation story.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the atrous (dilated) convolutions that give the Atrous Residual Pyramid Module its multiple receptive fields."}],"review_version":1}