{"id":"64973a97-6721-418c-aad5-cf446c2e8ffb","arxiv_id":"2506.20548","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"PLADA improves compressed deepfake detection on OSNs by redirecting attention away from JPEG block effects and aggregating paired and unpaired data.","lead":"PLADA, a new framework for detecting compressed deepfakes, teaches a CLIP-based detector to ignore JPEG block artifacts while using both paired and unpaired training data. The authors report consistent gains over prior methods across GAN and diffusion model datasets, though without error bars.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"PLADA's claimed SOTA margin is not yet established: Tables 1-4 mix original-paper (†) and retrained (‡) baseline numbers, and no variance is reported, so the 4-5 point wins over ODDN/QAD may reflect protocol mismatch or noise.","rationale":"The reader's weakest assumption concerned feature separability in B2E. That is a real mechanism-level risk, and I do not dispute it. I chose a different, more immediately load-bearing issue: the empirical evidence for the headline claim. The paper's own table captions distinguish † (results from original papers) from ‡ (retrained), and the closest baselines are mostly †. If those numbers were obtained under different training data, compression ratios, or test splits, the 4-5 point mean advantage of PLADA is an artifact of protocol, not method. The absence of error bars compounds this: with 17 per-dataset accuracies, a mean computed without variance cannot separate a genuine improvement from seed noise. I still view the work as plausible and conditionally acceptable: the code is released, the design is coherent, and the broad 26-dataset evaluation is a real effort. The proposed check is expensive but decisive: rerun the key table with matched baselines and error bars. If the margin survives, the central claim holds; if not, the verdict should be revised downward. Because the current verdict is already conditional, I recommend keeping it unchanged rather than escalating, pending this verification.","tokens_in":23017,"tokens_out":10832,"duration_ms":127882,"concrete_test":"Reproduce Table 1 under one matched protocol: retrain ODDN, QAD, and the remaining † baselines with their official code on the identical 4-class ForenSynths training split with 20% paired JPEG at QP=50, evaluate on the same 17 test sets, and report mean ± std over at least three seeds. If ODDN's retrained accuracy reaches 76.7% within error bars, the claimed SOTA margin is not established; if it stays more than 2 standard deviations below PLADA, the comparison holds.","verdict_should_be":"UNCHANGED","load_bearing_attack":"PLADA's central claim is empirical: it outperforms prior SOTA on compressed deepfakes. That claim requires matched head-to-head comparisons, and the paper does not clearly provide them. In Table 1, most baselines are marked † (\"results from the original paper or previous work\"), including the closest competitor ODDN and the compression-targeted QAD, rather than retrained under PLADA's protocol (4-class ForenSynths split, 20% paired data at QP=50, same test images). The text says \"Unless stated otherwise, all the above methods are retrained using our experimental settings,\" which conflicts with the †/‡ legend, so the reader cannot tell which comparisons are actually matched. This matters because ODDN is the strongest prior method; PLADA's 76.7% versus ODDN's 72.6% is only a win if that number was produced under identical conditions. Per-dataset, PLADA is below ODDN on nine of the seventeen GAN datasets (InfoGAN, CramGAN, MMD-GAN, RelGAN, SNGAN, STG-GAN, ProGAN, StyleGAN2, CycleGAN), and the aggregate gain is driven by a few large wins. No seeds or error bars are reported anywhere, so the mean superiority could be within run-to-run noise. Tables 2 and 4 show the same †/‡ mixing for diffusion datasets. The headline claim therefore rests on unmatched baselines and uncontrolled variance rather than on demonstrated superiority.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes PLADA, a deepfake detection framework for JPEG-compressed images, consisting of two modules: B2E (Block Effect Eraser), which redirects attention away from compression block effects via two prompt-based attention variants (RG and CG), and ODA (Open Data Aggregation), which clusters features into real/fake and raw/compressed centers and applies a distance-based loss. The authors report mean accuracies of 76.7% (quality-aware) and 77.4% (quality-agnostic) over 17 GAN datasets, competitive raw-image accuracy of 80.4%, and strong results on diffusion datasets, along with ablations on components, prompts, distance functions, and layer depths. The paper also claims that PLADA works with limited paired data and provides a public code link.","tokens_in":23353,"tokens_out":7268,"duration_ms":69783,"significance":"If the claimed results hold under matched conditions, PLADA would be a meaningful advance: it targets a realistic gap, namely JPEG block effects on OSNs, and shows large gains on several GAN and diffusion datasets while retaining raw-image performance. Strengths include the broad benchmark (17 GAN and 8 diffusion datasets), the public code release, and a structured ablation that separates the roles of RG, CG, and ODA. However, the central claim is explicitly comparative, and the current reporting does not yet establish that the baseline comparisons are fair or that the observed margins exceed run-to-run noise. The significance is therefore conditional on the experimental protocol being clarified and the comparisons being re-run under identical conditions.","major_comments":[{"comment":"The comparison protocol is not well-defined. The text states \"Unless stated otherwise, all the above methods are retrained using our experimental settings,\" but the legend of Table 1 marks FF++, F3Net, MAT, SBI, QAD, and ODDN as † (results from the original paper/previous work) while Ojha, NPR, and FaT are ‡ (retrained). The same mixing appears in Tables 2–4. Because ODDN is the closest competitor, its 72.6% in Table 1 and 72.1% in Table 3 must be produced under the same 4-class ForenSynths split, the same 20% paired data with QP=50, and the same test images; otherwise the 4.1- and 5.3-point aggregate margins are not evidence of superiority. Please retrain all baselines under the identical protocol, or state for each number whether it is transferred from the original publication, and report the per-dataset comparison under matched conditions.","section":"Section 4.1, Tables 1 and 3"},{"comment":"No measure of variance or statistical significance is provided anywhere. Every table reports a single accuracy or AP value with no seeds, error bars, or significance tests. In Table 1, PLADA is below ODDN on nine of the seventeen GAN datasets (InfoGAN, CramGAN, MMD-GAN, RelGAN, SNGAN, STG-GAN, ProGAN, StyleGAN2, and CycleGAN), so the mean advantage of 76.7% over 72.6% is driven by a few large wins. Under run-to-run variability, the aggregate superiority may not be reproducible. Please report mean ± std over at least three random seeds and, if possible, a paired test over the per-dataset differences.","section":"Section 4.2, Tables 1–6"},{"comment":"The definition of β is circular: β appears inside L_dis in the term β Σ H, yet β is defined as σ(γ · ∂L_dis/∂Θ) ∈ (0,1), a function of L_dis itself. Moreover, ∂L_dis/∂Θ is a parameter gradient, not a scalar, so applying the sigmoid to it and requiring the result to lie in (0,1) is not well-defined. Please give a non-circular, scalar definition of β or state that it is a fixed hyperparameter; this is needed to reproduce the ODA loss.","section":"Section 3.4, Eq. (12)"},{"comment":"The main experimental configuration is incomplete. The paper does not report the values of τ and γ in Eq. (12), the guide prompt pool size N, the guide prompt length, or the number of RG and CG layers used for the results in Tables 1–6. Figure 9 shows ablations over some of these choices but does not state which values were selected for the final model. Without this information the method cannot be reproduced from the text alone.","section":"Section 4.1, Section 3.3"},{"comment":"The load-bearing assumption of B2E is that the attention-shifting mechanism can suppress block-effect features while preserving deepfake traces. The only direct evidence offered is the t-SNE visualization on ProGAN and CycleGAN (Figure 10) plus downstream accuracy; this does not show which features B2E actually removes. A concrete test, e.g., comparing the frequency/spatial content of features before and after B2E or measuring block-boundary statistics, would support the causal claim that block effects are being erased rather than that the method implicitly learns a better overall classifier.","section":"Section 3.3, Section 4.6"}],"minor_comments":[{"comment":"The training data description says compression is set to \"approximately 50% image quality,\" while Section 4.2 says \"constant quantization parameter of 50\"; these need not be the same, so please specify the exact compression setting and the codec parameters used.","section":"Section 3.1 and Section 4.2"},{"comment":"\"ODDA trails behind\" should read \"ODDN trails behind\"; there are also several other typographical errors, including \"and ODA and\" in the introduction, \"the another\" in Section 2, \"creates noisy for deepfake detection\" in Section 2.1, and \"with an simple additional linear projection\" in Section 4.3.","section":"Section 4.2"},{"comment":"The sentence \"PLADA achieves the highest AP\" is not supported by Table 5, which contains only accuracy columns; Table 6 reports AP only for the Ojha-test diffusion datasets, so the claim should be restricted to those results or AP columns should be added.","section":"Section 4.4"},{"comment":"Figure 4 and Figure 5 appear to summarize many experimental conditions, but the captions do not define the axes or the color/area encoding; please make the figures self-contained.","section":"Figures 4 and 5"},{"comment":"The ablation text gives numerical accuracies for baseline (70.14%), ODA (70.40%), RG (74.89%), RG+CG (77.86%), and full method (78.03%), but it does not state on which dataset or paired-data setting these numbers were obtained; please specify the experimental condition for the ablation study.","section":"Section 4.5.1"}],"recommendation":"major_revision","confidential_remarks":"The manuscript reports a broad empirical study, but the headline claim of state-of-the-art performance depends on matched baseline comparisons and variance reporting that are currently missing. I would be willing to evaluate a revised version that re-runs or clearly marks all baselines under the identical protocol, reports seeds and error bars, and fixes the circular definition of β in Eq. (12)."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the method is a sensible incremental extension of the authors' own ODDN and the paper is honest about that, but the headline 'outperforms SOTA by 4-5 points' is not established. Tables 1-4 mix † results taken from other papers with ‡ results retrained here, and the text says 'unless stated otherwise' everything was retrained, so I can't tell which numbers are matched. ODDN, the closest competitor, is marked † in the quality-aware tables; per-dataset PLADA is actually below ODDN on about half the GAN datasets and the aggregate win is driven by a few large gains. No seeds or error bars anywhere, so the mean difference could be within run noise.\n\nWhat's actually good: the technical pieces are coherent. The residual and coordination guidance both manipulate key/value prompts to shift attention, and the open data aggregation gets extra signal from unpaired data. The ablation is informative: the baseline at 70.14 goes to 78.03, with RG+CG contributing most, which suggests the machinery does something. Code is public, the evaluation covers a wide range of GAN and diffusion generators, and the authors plainly state this is an extension of their AAAI paper.\n\nSoft spots, in order: (1) Baseline protocol ambiguity—this is the load-bearing one. If the real comparisons are matched, the claim is plausible; if not, the margin evaporates. (2) Missing error bars and unreported hyperparameters (tau, gamma, CG depth), so the chosen settings may be tuned on the test benchmarks. (3) Eq. 12 defines beta as a function of the gradient of the same loss Ldis; that's circular-looking and needs a clearer explanation or a re-formulation. (4) The 'block effect' novelty claim is overstated—JPEG block artifacts are textbook. (5) The assumption that gradient reversal separates block effects from forgery cues is only tested via t-SNE on two generators, which is suggestive, not conclusive.\n\nOverall: for people working on compressed deepfake detection, this is a useful paper to engage with, and it deserves a serious referee. But the acceptance decision should be conditional on the authors providing a matched-comparison table with variance and a full hyperparameter list.","headline":"A plausible but undersupported SOTA claim: the method extends ODDN well, but the comparisons mix retrained and original-paper baselines and nothing has error bars.","tokens_in":23900,"tokens_out":3794,"would_cite":false,"duration_ms":40298,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PLADA detects compressed deepfakes by learning to ignore JPEG block effects, reporting 76.7–77.4% mean accuracy on compressed GAN images and 80.4% on raw images.","keywords":["deepfake detection","JPEG compression","block effect","attention shifting","quality-agnostic detection","online social networks","unpaired data","multi-task learning"],"falsifier":"A direct test: train PLADA on images compressed at a very high quality factor so that no block grid is visible, then compare accuracy with and without the gradient-reversed compression branch; if the branch still causes accuracy to drop, the attention shift is deleting genuine deepfake signal rather than block-effect noise. A complementary check is to train a probe classifier on PLADA's feature space and ask whether it can simultaneously ignore compression type and preserve real/fake separability; if those two objectives cannot be met together, the separability premise fails.","tokens_in":22819,"feed_emoji":"🕵️","tokens_out":9684,"duration_ms":99296,"temperature":0.7,"pith_summary":"PLADA addresses a gap between deepfake detection research and real-world online images: social platforms recompress uploads with JPEG, and the resulting $8\\times8$ block grid visually mimics the artifacts detectors are trained to find, degrading accuracy. The paper argues that the right response is to teach the model to pay less attention to those block effects, not to treat them as extra evidence. To do this, PLADA combines a Block Effect Eraser that shifts attention inside a pretrained transformer backbone towards deepfake traces, and an Open Data Aggregation module that clusters compressed and raw real/fake images so the real/fake boundary survives compression. On 17 GAN-generated image collections the method reports mean accuracies of 76.7% under quality-aware and 77.4% under quality-agnostic compression, roughly 4–5 points above prior methods, while retaining 80.4% on uncompressed images. If the claim holds, detectors can be built for the images people actually encounter on social platforms instead of laboratory-clean originals.","feed_headline":"Ignore JPEG blocks to spot compressed deepfakes at 77%","feed_subtitle":"Attention-shifting detector erases block-effect noise while keeping raw-image accuracy, beating prior methods on compressed GAN images.","key_machinery":"Attention shifting is the load-bearing mechanism: during training, an auxiliary task predicts whether an image is compressed, and its gradient is reversed so the backbone learns to stop relying on compression fingerprints. B2E stores that guidance in per-layer guide prompt pools and injects it through two self-attention variants, Residual Guidance and Coordination Guidance, which together redirect attention away from block effects and toward deepfake artifacts at both coarse and fine scales. ODA then enforces a clustering structure in feature space, pushing real and fake centers apart within both compressed and raw groups while using the Hilbert-Schmidt Independence Criterion divergence to align a real image with its compressed counterpart. The combination is trained with a weighted sum of the real/fake loss, the compression loss, and the ODA separation loss.","core_discovery":"The paper's central claim is that JPEG's block effect is a deceptive artifact: it looks enough like a deepfake trace that compressed images mislead detectors, and the right countermeasure is to redirect attention away from it rather than learn it as evidence. PLADA does this with two mechanisms. The Block Effect Eraser (B2E) replaces standard self-attention in the shallow layers with two guided variants, Residual Guidance and Coordination Guidance, while a gradient-reversed compression-classification task converts the compression signal into a prompt that shifts attention toward real forgery cues. The Open Data Aggregation (ODA) module computes cluster centers for real, fake, compressed-real, and compressed-fake images and amplifies the separations, using both paired and unpaired data. The reported result is that on 17 GAN-generated datasets PLADA reaches 76.7% mean accuracy when test compression matches training and 77.4% when compression type is unknown, versus roughly 72% for the best prior method, with raw-image accuracy remaining at 80.4%.","pith_inferences":["A natural extension the paper does not test: the same attention-shifting recipe should transfer to other OSN artifacts such as resizing, sharpening, or platform overlays by swapping the auxiliary task, since the underlying assumption is that post-processing fingerprints occupy a separable feature direction.","If block effects are genuinely separable from deepfake traces, a lighter test-time route, projecting features away from the estimated compression direction without retraining, might recover much of PLADA's gain; the paper does not explore this cheaper option.","The largest average gains are reported on GAN-generated images; on some diffusion-model datasets the margin is thinner, so extending the recipe to diffusion artifacts likely needs additional guidance signals beyond the compression task."],"forward_implications":["A detector trained this way can handle unknown compression settings: quality-agnostic accuracy on 17 GAN datasets is 77.4%, about 5 points above the closest prior method.","Robustness to compression does not force a raw-image trade-off: PLADA stays at 80.4% mean accuracy on uncompressed images, close to baselines that ignore compression entirely.","The method remains effective when only 10% of training data has paired compressed copies, relaxing the need for expensive raw/compressed image pairs.","ODA replaces the strict paired-data machinery of HSIC-based approaches by exploiting unpaired data through cluster centers, so the training setup matches real open-world data availability.","Identifying block effects as a deceptive artifact gives future detectors a new target: modeling the OSN post-processing pipeline itself instead of only the generator's fingerprints."],"supporting_citations":[{"why":"Supplies the training protocol and the CNN-generated-image detection baseline that PLADA inherits and improves upon.","marker":"(Wang et al., 2020)"},{"why":"The CLIP-based universal fake image detector is PLADA's backbone and its primary shared-backbone baseline; the ablation starts from this model.","marker":"(Ojha et al., 2023)"},{"why":"QAD is the quality-agnostic paired-data method that ODA is designed to outperform, and it motivates the need to handle unpaired data.","marker":"(Le and Woo, 2023)"},{"why":"ODDN is PLADA's preliminary version and closest prior competitor; the paper positions PLADA as replacing its gradient-correction mechanism and HSIC pairing.","marker":"(Tao et al., 2025)"},{"why":"Documents the Facebook OSN image processing pipeline including JPEG compression, the real-world scenario motivating the block-effect claim.","marker":"(Sun et al., 2016)"},{"why":"Releases the GANGen-Detection dataset collection used for nine of the 17 GAN evaluation datasets.","marker":"(Tan and Tao, 2024)"},{"why":"Supplies the DiffusionForensics dataset and the NPR baseline used for diffusion-model evaluation.","marker":"(Tan et al., 2024)"},{"why":"DIKI's single-specialized-MSA prompt design is the contrast that motivates B2E's dual-stage attention variants.","marker":"(Tang et al., 2025)"},{"why":"PKT, which combines a standard MSA with a novel MSA variant, is another comparator behind the design of Residual and Coordination Guidance.","marker":"(Park et al., 2024)"}],"fun_headline_variants":["Ignore JPEG blocks to catch compressed deepfakes at 77%","Block-effect eraser boosts compressed deepfake detection to 77%","Redirect attention past block noise to spot deepfakes on OSNs","PLADA skips deceptive artifacts, hits 77% on compressed images","Compressed deepfakes exposed by ignoring block effects"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The account assumes that the $8\\times8$ JPEG block grid leaves a feature signature separable from the traces left by deepfake generators, so steering attention away from block effects removes compression noise without erasing forgery evidence.","fun_headline_variants_meta":{"raw":{"variants":["Ignore JPEG blocks to catch compressed deepfakes at 77%","Block-effect eraser boosts compressed deepfake detection to 77%","Redirect attention past block noise to spot deepfakes on OSNs","PLADA skips deceptive artifacts, hits 77% on compressed images","Compressed deepfakes exposed by ignoring block effects"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000239,"raw_usage":{"total_tokens":1549,"prompt_tokens":1013,"completion_tokens":536,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":629,"completion_tokens_details":{"reasoning_tokens":446}},"tokens_in":629,"tokens_out":536,"duration_ms":6306,"temperature":1.0,"reasoning_tokens":446,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T22:45:46.269179+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A direct test: train PLADA on images compressed at a very high quality factor so that no block grid is visible, then compare accuracy with and without the gradient-reversed compression branch; if the branch still causes accuracy to drop, the attention shift is deleting genuine deepfake signal rather than block-effect noise. A complementary check is to train a probe classifier on PLADA's feature space and ask whether it can simultaneously ignore compression type and preserve real/fake separability; if those two objectives cannot be met together, the separability premise fails.","supporting_citations":[{"cited_title":"Cnn-generated images are surprisingly easy to spot","cited_arxiv_id":null,"evidence_quote":"Supplies the training protocol and the CNN-generated-image detection baseline that PLADA inherits and improves upon."},{"cited_title":"Quality-agnostic deepfake detection with intra-model collaborative learning","cited_arxiv_id":null,"evidence_quote":"QAD is the quality-agnostic paired-data method that ODA is designed to outperform, and it motivates the need to handle unpaired data."},{"cited_title":"Processing-aware privacy-preserving photo sharing over online social networks","cited_arxiv_id":null,"evidence_quote":"Documents the Facebook OSN image processing pipeline including JPEG compression, the real-world scenario motivating the block-effect claim."},{"cited_title":"Mind the interference: Retaining pre-trained knowledge in parameter efficient continual learning of vision-language models","cited_arxiv_id":null,"evidence_quote":"DIKI's single-specialized-MSA prompt design is the contrast that motivates B2E's dual-stage attention variants."},{"cited_title":"Pre-trained vision and language transformers are few-shot incremental learners","cited_arxiv_id":null,"evidence_quote":"PKT, which combines a standard MSA with a novel MSA variant, is another comparator behind the design of Residual and Coordination Guidance."}],"review_version":1}