{"id":"7d819ff5-cb34-4a5d-adc5-8f6a9798124e","arxiv_id":"2412.03261","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"JPEG AI compression adds upsampling-like artifacts that push pristine images into the deepfake class and blind splicing localization, an effect that is opposite to standard JPEG and stronger at low bitrates.","lead":"A new study of the JPEG AI neural image compression standard shows it pushes ordinary photos into the 'deepfake' category for current forensic detectors and degrades splicing localization. The finding matters because JPEG AI will be baked into everyday image pipelines, so forensic tools need retraining before false alarms avalanche.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The most load-bearing concern is generalizing from a single JPEG AI Verification Model 7.0 (HOP) to the whole standard: non-normative encoders and operation-point differences could shift the artifact spectrum and, with it, the measured FPR and localization drops.","rationale":"The paper is a solid empirical study with internally consistent tables, disclosed exclusion rules, a useful JPEG baseline, and a retraining experiment. The reader's conditional verdict is appropriate. My stress-test identifies the same weakest link: a single verification model stands in for a standard whose non-normative parts vary. This is not an accusation of sloppiness; the authors explicitly mark the normative/non-normative split and provide code. But the title and abstract make a claim about JPEG AI as a standard, and the evidence is from one implementation at one operation point. The proposed test (a second implementation or operation point) would settle whether the phenomenon is a property of the standard or of the reference software. Statistical testing would add confidence but is secondary to the implementation-generalization question. No other concern is as load-bearing: the threshold at 0 is supported by AUC trends in the supplement, and the exclusion rule, while worth a sensitivity analysis, would not flip the qualitative direction of the effect.","tokens_in":56349,"tokens_out":3394,"duration_ms":34819,"concrete_test":"Re-run the deepfake-detection FPR and splicing-localization AUC experiments at BPP = 0.12 using a second JPEG AI implementation: either the Verification Model at a different operation point (e.g., Medium or Low) or an independently trained encoder feeding the same normative decoder, if the reference software allows. If the FPR increase (from 0.00-0.30 to 0.56-0.99) and the localization AUC drop (from about 0.91 to about 0.72) are reproduced within, say, 0.1, the generalization to 'JPEG AI' holds; if the effect shrinks substantially, the conclusions should be re-scoped to the specific implementation tested.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim, that 'JPEG AI' systematically misleads forensic detectors, rests on experiments run with exactly one encoder-decoder pair: the official JPEG AI Verification Model 7.0 at the High Operation Point (Sec. 4.3). The paper's Sec. 2 argues that the normative decoder (blue modules in Fig. 2) forces similar artifacts across compliant implementations. However, the analysis transform and hyperprior encoder (red modules) are non-normative and may be retrained per manufacturer or per content type. The upsampling artifacts that trigger the detectors are produced by the normative decoder, but their magnitude and spectral location depend on the latents fed to it; different non-normative encoders can produce different latent statistics, hence different artifact strengths. The paper also tests only HOP, whereas the standard defines multiple operation points; a lower-complexity profile could use a different normative decoder or different tool configurations, changing the artifact spectrum. If a second compliant implementation yields a substantially smaller FPR increase or AUC drop, the headline conclusion about the standard rather than about one reference implementation would not be supported. This is a genuine generalization gap, not an internal inconsistency; the paper is transparent about using VM 7.0 and about the non-normative modules, and all code is promised available, but the external validity of the central claim is untested.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper investigates whether JPEG AI compression causes counter-forensic effects on deepfake image detection and image splicing localization. The authors compress pristine and synthetic test images with the official JPEG AI Verification Model 7.0 at the High Operation Point, using six BPP values (0.12, 0.25, 0.5, 0.75, 1.0, 2.0), and evaluate nine deepfake detectors and three splicing localization detectors on the datasets used by the original authors. They compare the results with standard JPEG compression, report image quality metrics, retrain one detector after mixing JPEG AI samples into training, and present preliminary double-compression experiments. The headline findings are that, at low BPP, pristine JPEG AI images are increasingly classified as synthetic (for most detectors the FPR rises from 0.00–0.30 to 0.56–0.99 at BPP = 0.12), splicing localization degrades markedly (e.g., AUC for TruFor drops from about 0.91 to 0.75 and F1 from 0.66 to 0.37), and these effects become weaker but do not fully disappear at higher BPP values.","tokens_in":56442,"tokens_out":3941,"duration_ms":36593,"significance":"If the results hold, the paper provides a timely and falsifiable warning: the forensic community should include JPEG AI-compressed images in training and benchmarking, because the artifacts of this standard can be misinterpreted as deepfake or manipulation traces. The study has notable strengths: it covers nine public deepfake detectors and three splicing detectors across several standard datasets, it includes a standard-JPEG control condition that supports the claim of a distinct artifact signature, it reports perceptual quality metrics, and it ships code for replication. The tables are internally consistent (spot-checks confirm that BA, FPR, and FNR satisfy BA = (1 − FPR + 1 − FNR)/2), and the consistency of the direction across detectors makes the main effect credible. The central limitation is external validity: all experiments use a single JPEG AI reference implementation, so the quantitative generalization from this one codec, and its HOP configuration, to the JPEG AI standard as a whole is not yet established.","major_comments":[{"comment":"","section":"Sec. 4.3 and Sec. 2"},{"comment":"All quantitative comparisons are point estimates with no confidence intervals, significance tests, or information about image-level variability. The paper makes strong quantitative statements, such as “a drop of more than 0.15 and 0.13 points in AUC and BA” and “FPR risks to be high”, but the reader cannot assess whether the moderate changes at BPP = 1.0 (e.g., BA around 0.65–0.87 in Table 1) are stable across images or datasets. I recommend adding per-image score distributions or bootstrap confidence intervals for the headline metrics, or softening the quantitative language; the qualitative direction of the effect is nevertheless consistent and convincing.","section":"Tables 1, 3, 4, 5 and Sec. 5.1–5.2"}],"minor_comments":[{"comment":"The sentence “we calculate these metrics for all the datasets considered and then average their values” is fine, but the reference to “Tab. 5 (second and third right column)” is confusing because the table has several columns separated by BPP/QF; please refer to the specific column blocks by the BPP value or by the metric name.","section":"Sec. 5.2"},{"comment":"The verb “prove” is too strong for an empirical measurement study; recommend “demonstrate” or “provide evidence” in the abstract and in the caption of Fig. 1.","section":"Abstract, Sec. 1, Fig. 1"},{"comment":"The double JPEG AI compression results are discussed only qualitatively in the main text and supported only by supplementary figures; adding one quantitative table or metric for the double-compression scenarios would make this preliminary analysis more useful.","section":"Sec. 5.3"},{"comment":"The text refers to “blue modules” and “red modules” in Fig. 2, but in a black-and-white print or a non-color PDF these distinctions may be invisible; please add labels or textures.","section":"Sec. 2, Fig. 2"},{"comment":"Several references contain stray trailing numbers (e.g., [1] ends with “2, 4, 5, 3” and [32] with “1, 13”), likely artifacts of the page-layout process; these should be removed.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The single-implementation generalization is the main risk to the paper's central claim, and I would ask the authors to address it either by adding a second implementation/operation point or by carefully narrowing the claim. The paper is otherwise technically sound and well positioned for a forensic audience; the breadth of detectors and the standard-JPEG control are particular strengths. I would not reject on the basis of the generalization gap, but it needs to be resolved or explicitly bounded before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a solid empirical vulnerability study. It tests nine deepfake detectors and three splicing localizers against the official JPEG AI Verification Model 7.0 (HOP) at six bitrates, with a JPEG baseline, a retraining experiment, and a double-compression probe. The main finding holds up on inspection: at low bitrates, pristine JPEG AI images shift toward the deepfake side of the decision boundary (FPR rises to 0.56–0.99 for several detectors at BPP 0.12), and splicing localization AUC/F1 drop substantially. The comparison with standard JPEG is well done and shows the effect is not just generic compression damage.\n\nWhat is new: the mechanism (neural compression leaves upsampling traces similar to generative artifacts) was already known from [22, 23, 24, 80]. The contribution is the end-to-end evaluation of the official JPEG AI reference software across a broad set of detectors and two tasks, plus the bitrate dependence. That is genuinely useful for the forensics community right now, because JPEG AI became an international standard in February 2025 and detector evaluation pipelines will need to include it.\n\nThe paper is honest. The AUC<0.75 exclusion rule is disclosed, the retraining result is called insufficient, and the double-compression analysis is labeled preliminary. Internal consistency checks pass.\n\nSoft spots, in proportion: (1) Everything rests on one implementation, VM 7.0 at the High Operation Point. The normative decoder may force similar artifacts, but the non-normative encoder (analysis transform and hyperprior) can shift the latent statistics and thus artifact strength. A second compliant implementation could give a different FPR increase or AUC drop. This is a real generalization gap, not an internal inconsistency, and the paper does not overclaim—but 'JPEG AI' in the title is stronger than what is tested. (2) No confidence intervals or significance tests anywhere. The reported drops are point estimates, so the bitrate dependence is suggestive, not pinned down. (3) The retraining experiment uses only the authors' own detector and 20% augmentation; fine as a preliminary probe, not as a mitigation recipe.\n\nWho this is for: anyone building or evaluating deepfake detectors or splicing localizers in the next few years. It deserves a serious referee; the main asks should be a second implementation when available, error bars or significance testing, and sensitivity analysis for the exclusion rule.","headline":"Solid empirical vulnerability study of JPEG AI against forensic detectors; the main caveat is generalization from one reference implementation.","tokens_in":57176,"tokens_out":1648,"would_cite":true,"duration_ms":16116,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"JPEG AI compression artifacts are mistaken for deepfake and splicing traces by state-of-the-art forensic detectors.","keywords":["JPEG AI","neural image compression","deepfake image detection","image splicing localization","counter-forensics","compression artifacts","false positives","image forensics"],"falsifier":"Take the same pristine and spliced datasets, compress them with a second JPEG AI implementation produced by a different vendor, and rerun the same detectors at the strongest compression setting (0.12 bits per pixel). If the false-positive rate stays near the uncompressed baseline and the splicing localization area under the curve remains near its original value, the measured counter-forensic effect is specific to the reference implementation rather than the standard.","tokens_in":55985,"feed_emoji":"🕵️","tokens_out":7198,"duration_ms":64940,"temperature":0.7,"pith_summary":"JPEG AI is the first international image-compression standard built on neural networks, and its decoder leaves upsampling artifacts that resemble traces left by GANs and diffusion generators. The paper tries to show that these artifacts are strong enough to break two standard forensic tasks: telling real from deepfake images, and localizing spliced regions. Across a set of state-of-the-art detectors, pristine images compressed with JPEG AI were increasingly flagged as synthetic as compression tightened, and tampering masks became unreliable in both directions. The concern matters because JPEG AI is designed for broad adoption, so a widespread codec could turn ordinary compressed photos into false forensic alarms.","feed_headline":"JPEG AI tricks forensic detectors into flagging real photos","feed_subtitle":"At the strongest compression tested, false-positive rates jump from near zero to as high as 0.99.","key_machinery":"The load-bearing object is the JPEG AI decoding pipeline, in particular the upsampling and synthesis transforms in its normative decoder that reconstruct the image from the compressed latent representation. The argument is that this transform imprints periodic spectral peaks and local pixel-interdependence patterns in the same family as the traces that deepfake detectors and splicing localizers are trained to recognize, so a detector reads compression artifacts as generation or manipulation artifacts. The Fourier-spectrum analysis of noise residuals is the diagnostic used to link JPEG AI outputs to synthetic-image artifacts.","core_discovery":"The central claim is that JPEG AI is a counter-forensic operation: its output carries frequency-domain and interpolation artifacts that forensic detectors interpret as evidence of synthesis or tampering. At the strongest compression tested (0.12 bits per pixel), most deepfake detectors' false-positive rate jumped from near zero to 0.56–0.99 while balanced accuracy collapsed, and the effect softened but persisted at higher bit rates. For splicing localization, the pixel-level area under the curve dropped by roughly 0.15 and the F1 score fell by up to 0.39, with detectors both missing tampered pixels and flagging pristine ones. The paper also shows standard JPEG acts in the opposite direction, mostly hiding synthetic traces by raising false negatives rather than creating false positives, and that including JPEG AI images in training reduces but does not eliminate the effect.","pith_inferences":["If JPEG AI adoption spreads, forensic pipelines may need a preprocessing or calibration step that distinguishes compression upsampling artifacts from generative upsampling artifacts, rather than treating every interpolation trace as manipulation evidence.","The measured failures suggest modern detectors rely heavily on generic spectral and upsampling cues, so a detector trained explicitly on paired JPEG AI-compressed and uncompressed versions of the same pristine images could provide a direct robustness benchmark.","The double-compression results hint that spatial inconsistencies in JPEG AI artifact strength might become a useful forensic trace for locating spliced regions, since a spliced area can carry compression history different from its surroundings.","Because the standard allows manufacturers to retrain parts of the encoder, the exact artifact spectrum may vary across compliant products; benchmarking the same detectors on images from several independent JPEG AI implementations would show how much of the effect is intrinsic to the standard."],"forward_implications":["At the strongest setting tested, several deepfake detectors flag roughly 56–99% of JPEG AI-compressed pristine images as synthetic, meaning false alarms become the norm rather than the exception.","Splicing localization masks degrade in both directions at low bit rates: manipulated pixels are missed while pristine areas are flagged, so JPEG AI compression can invalidate tampering localization evidence.","The failure mode is opposite to standard JPEG: JPEG mostly moves deepfake scores toward the pristine side, raising false negatives, whereas JPEG AI moves pristine scores toward the deepfake side, raising false positives.","Retraining a detector with 20% JPEG AI-compressed samples improves balanced accuracy and false-positive rate at low bit rates, but performance still stays below 0.7 balanced accuracy, so full robustness would require a much larger augmentation campaign.","A strong second JPEG AI compression can erase traces left by a first compression, mirroring double-JPEG behavior and adding a new wrinkle for image-history forensic scenarios."],"supporting_citations":[{"why":"Supplies the official JPEG AI reference software (Verification Model 7.0, High Operation Point) used to compress every test image.","marker":"[10]"},{"why":"Defines the target bit-rate values and the quality metrics used to show that the compressed images remain visually good despite the forensic failures.","marker":"[1]"},{"why":"Shows neural compression codecs leave frequency artifacts similar to synthetic-image traces, providing the premise that JPEG AI would fool detectors.","marker":"[23]"},{"why":"Provides one of the deepfake detectors evaluated, whose false-positive rate jumps from 0.00 to 0.97 at the lowest bit rate.","marker":"[32]"},{"why":"Provides a deepfake detector used in the retraining and fine-tuning experiments with JPEG AI samples.","marker":"[63]"},{"why":"Provides the detector whose false-positive rate reaches 0.99–1.00 under strong JPEG AI compression.","marker":"[81]"},{"why":"Provides a widely used deepfake detector variant set whose scores shift systematically across bit-rate settings.","marker":"[88]"},{"why":"Provides a splicing localization detector whose area under the curve drops from 0.91 to 0.75 at the strongest compression.","marker":"[43]"},{"why":"Provides a splicing localization detector with the largest F1-score drop (0.70 to 0.31) under JPEG AI.","marker":"[85]"},{"why":"Provides a splicing localization detector trained for robustness to social-network compression, used to test whether prior robustness helps.","marker":"[92]"}],"fun_headline_variants":["JPEG AI compression makes real images look fake to detectors","Neural JPEG tricks forensic tools into false-positive spikes","JPEG AI's artifacts expose deepfake and splicing detector flaws","New compression standard blinds forensics to manipulated content","JPEG AI: counter-forensic compression that fools image detectors"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The experiments use a single official reference implementation of JPEG AI, and the paper assumes that its compression artifacts represent those of every compliant JPEG AI product.","fun_headline_variants_meta":{"raw":{"variants":["JPEG AI compression makes real images look fake to detectors","Neural JPEG tricks forensic tools into false-positive spikes","JPEG AI's artifacts expose deepfake and splicing detector flaws","New compression standard blinds forensics to manipulated content","JPEG AI: counter-forensic compression that fools image detectors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000361,"raw_usage":{"total_tokens":1906,"prompt_tokens":857,"completion_tokens":1049,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":473,"completion_tokens_details":{"reasoning_tokens":968}},"tokens_in":473,"tokens_out":1049,"duration_ms":10232,"temperature":1.0,"reasoning_tokens":968,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T22:36:30.293088+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the same pristine and spliced datasets, compress them with a second JPEG AI implementation produced by a different vendor, and rerun the same detectors at the strongest compression setting (0.12 bits per pixel). If the false-positive rate stays near the uncompressed baseline and the splicing localization area under the curve remains near its original value, the measured counter-forensic effect is specific to the reference implementation rather than the standard.","supporting_citations":[{"cited_title":"When synthetic traces hide real content: Analysis of stable diffu- sion image laundering","cited_arxiv_id":null,"evidence_quote":"Provides a deepfake detector used in the retraining and fine-tuning experiments with JPEG AI samples."},{"cited_title":"Rethinking the up-sampling op- erations in cnn-based generative network for generalizable deepfake detection","cited_arxiv_id":null,"evidence_quote":"Provides the detector whose false-positive rate reaches 0.99–1.00 under strong JPEG AI compression."},{"cited_title":"CNN-generated images are sur- prisingly easy to spot","cited_arxiv_id":null,"evidence_quote":"Provides a widely used deepfake detector variant set whose scores shift systematically across bit-rate settings."},{"cited_title":"Watch your Up-Convolution: CNN Based Generative Deep Neural Networks are Failing to Reproduce Spectral Distributions","cited_arxiv_id":null,"evidence_quote":"Provides a splicing localization detector whose area under the curve drops from 0.91 to 0.75 at the strongest compression."},{"cited_title":"Exploring multi-modal fusion for image manipulation detection and lo- calization","cited_arxiv_id":null,"evidence_quote":"Provides a splicing localization detector with the largest F1-score drop (0.70 to 0.31) under JPEG AI."},{"cited_title":"Media forensics and deepfakes: an overview","cited_arxiv_id":null,"evidence_quote":"Provides a splicing localization detector trained for robustness to social-network compression, used to test whether prior robustness helps."}],"review_version":1}