{"id":"1d19b9b0-4d53-4934-961c-01b27b79dce7","arxiv_id":"2603.02886","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"StegaFFD hides face images inside innocent cover photos and performs face-forgery detection directly on the stego image, preserving accuracy while hiding the face.","lead":"The paper introduces StegaFFD, a system that hides face images inside innocuous cover photos and performs face-forgery detection directly on the hidden image, so no raw face is sent to the server. If it works, it offers a way to check faces for forgery without exposing the face itself, at a small accuracy cost.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"StegaFFD's 'avoids raising suspicion' claim is untested: no steganalysis or human study, and 32.46 dB PSNR between cover and stego is weak evidence of imperceptibility, undermining the core privacy motivation.","rationale":"I read the paper in good faith. The detection-accuracy component of the claim is reasonably supported: Table 2 shows StegaFFD outperforms privacy-preserving baselines by 5.16% avg AUC and is only 1.96% below vanilla Xception, and the ablations (Tables 4-6) are consistent. The reader's weakest_assumption (frequency-separation, Sec. 3.2) is a genuine limitation, acknowledged by the authors in the failure-case paragraph, and deserves a conditional caveat; however, it affects a subset of covers and the average results confirm the method mostly works. The more severe gap is that the paper's headline privacy benefit—'without raising suspicion'—is never tested. PSNR 32.46 dB is actually weak for image hiding, and no steganalysis or human evaluation is provided. A stego image that is detectable as non-cover defeats the stated purpose per the paper's own threat model (Sec. 1). This is a correctness risk in the claim's security dimension, not just a missing benchmark. I therefore recommend keeping the CONDITIONAL verdict: accept the accuracy contribution, but condition acceptance of the privacy claim on steganalysis robustness and proper imperceptibility evaluation.","tokens_in":23827,"tokens_out":7749,"duration_ms":70234,"concrete_test":"Train a modern steganalysis detector (e.g., SRNet or a CNN on high-pass residuals) on a held-out set of StegaFFD stego images (generated with the released pipeline) versus natural covers from the same distribution. Measure binary detection AUC. If AUC is near 0.5, the covertness claim is supported; if AUC > 0.9, it fails. Additionally, run a human perceptual study comparing x_cover and x_stego side-by-side; report detection rate and compare with HiNet/BalujaNet stego images under identical settings.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that StegaFFD enables covert client-server FFD that 'avoids raising attackers' suspicion' (Abstract, Conclusion). The only evidence offered is Table 3, which reports PSNR=32.46 dB and SSIM=0.86 between x_cover and x_stego. These values are low by steganography standards (competitive methods typically exceed 40 dB) and are not compared against other hiding methods, human perception, or steganalysis. Crucially, no experiment tests whether a steganalysis detector can distinguish StegaFFD stego images from natural covers. The paper's threat model assumes attackers will see 'a normal image without faces' and not suspect hidden data; but if the stego image is statistically detectable or visibly artifacted, the entire privacy motivation collapses into the same cat-and-mouse game the authors claim to avoid (Sec. 1). The accuracy experiments (Table 2) show the detector works in a cooperative setting where the server knows the stego protocol, but they say nothing about whether the stego channel is covert to an adversarial observer. Because 'without raising suspicion' is explicitly listed as a contribution and in Table 1's comparison, this omission is load-bearing.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"StegaFFD proposes a client-server face forgery detection (FFD) framework in which the client hides a face image inside a natural cover image with a deep image hiding network, and the server classifies the stego image directly, without extraction or decryption. The paper introduces three components: LFAD, which estimates spatially varying low-pass cover features; SFDA, a differential-attention module with wavelet sub-band attention intended to suppress cover semantics; and SDA, a training-time distillation loss that aligns stego-domain features with features extracted from the raw face. The method is trained on FaceForensics++ and evaluated on seven other forgery datasets, comparing against combinations of four deep-image-hiding methods / one anonymization method and four FFD detectors. The authors report higher AUC than the tested baselines, as well as PSNR/SSIM between cover and stego images, and claim that the approach avoids raising attackers' suspicion.","tokens_in":24143,"tokens_out":10888,"duration_ms":104899,"significance":"If the claims hold, this would be a useful contribution to privacy-preserving facial forensics: the problem is real, and the idea of performing FFD directly in the steganographic domain is novel and plausible. The architecture is coherent, and the ablations in Tables 4-6 give some support to the contribution of each component. The cross-domain accuracy advantage over the tested DIH+FFD baselines in Table 2 is substantial on average. The training-time SDA distillation is not circular: raw-face features are used only as a training target, not as test-time input. However, the central privacy claim that StegaFFD 'avoids raising suspicion' is supported only by low-level similarity metrics and is not tested against steganalysis, human perception, or an adversarial threat model; the paper's own conclusion also concedes visible artifacts. The lack of error bars, significance tests, and code further weakens the reliability of the empirical claims. The failure-case discussion is honest and should be preserved, but it currently circumscribes the main claim more than the abstract admits.","major_comments":[{"comment":"The claim that StegaFFD 'avoids raising attackers' suspicion' is not empirically supported. The only evidence is PSNR=32.46 dB and SSIM=0.86 between x_cover and x_stego in Table 3, with no comparison against the DIH baselines in Table 2 and no steganalysis detector or human perceptual study. PSNR < 35 dB is low by current deep-steganography standards, and the Conclusion itself concedes 'slight visual artifacts in stego images.' Since the threat model in Sec. 1 relies on the attacker seeing only a normal cover, this omission concerns the paper's central contribution. Please report steganalysis detection rates and/or a perceptual study, or explicitly narrow the covertness claim.","section":"§4.2, Table 3; Abstract; Conclusion"},{"comment":"All accuracy numbers are single-run AUC percentages with no error bars, confidence intervals, or significance tests. Some comparisons that support the 'best' claim are close (e.g., CDFv2 72.43 vs 72.41 in Table 2; UADFV 73.63 vs 75.49 for HiNet in Table 7). Without repeated runs or paired tests, the ordering among top methods may not be stable. Please provide mean±std over at least three training runs and significance tests for the main comparison and for the ablations in Tables 4-6.","section":"§4.2, Table 2"},{"comment":"LoD is described as separating an 'orthogonal semantic subspace' from a 'forgery-specific subspace,' but the update rule as written does not enforce this. If ΔW is an arbitrary learnable matrix, then W = W_r + ΔW can change in the row/column space of the frozen W_r. To preserve the claimed separation, ΔW must be parameterized as U_{n-r} B V_{n-r}^T (or otherwise constrained). As written, the improvement in Table 6 cannot be attributed uniquely to subspace separation. Please clarify the parameterization or add the missing constraint.","section":"§3.3, Eqs. (15)-(16)"},{"comment":"The frequency-separation assumption behind LFAD/SFDA is stated in Sec. 3.2 (cover semantics in low frequencies, hidden information in high frequencies), and the failure cases in Sec. 4.2 concede that dense-object covers generate high-frequency content that interferes with detection. This is not a peripheral issue: it delimits what counts as a usable 'natural cover.' The paper should quantify the failure boundary (e.g., accuracy stratified by cover frequency energy or object density) and state a selection criterion; otherwise, the general claim that StegaFFD works with natural cover images is too broad.","section":"§3.2 and §4.2 Failure Cases"}],"minor_comments":[{"comment":"The phrase 'average value of the top-3 metrics' is unclear; it should specify whether this is the average AUC over the top-3 datasets or a top-3 metric.","section":"§4.1"},{"comment":"Stage 1 uses M'_D(f_stego) while Stage 3 uses M'_D(f_secret); Eq. (19) should disambiguate which prediction is y'.","section":"Algorithm 1, Eq. (19)"},{"comment":"The text says the decoder consists of differential attention followed by a feed-forward network, but no FFN is specified. Add the module or remove the claim.","section":"§3.2, Eq. (10)"},{"comment":"(1-λ_init) is called a fixed scaling factor, but λ_init is a hyperparameter; clarify that it is fixed after initialization.","section":"§3.2, Eq. (9)"},{"comment":"Specify the size and composition of the test set used for the similarity metrics, and report per-method PSNR/SSIM for the DIH baselines in Table 2.","section":"Table 3"},{"comment":"The text mentions Grad-CAM++ but the cited reference is the original Grad-CAM paper; update the citation if the implementation is actually Grad-CAM++.","section":"Fig. 4, Ref. [124]"},{"comment":"No code or trained models are released. Given the number of free hyperparameters (λ_init, λ_d, γ, γ_s, LoD rank), a public release would materially aid reproducibility.","section":"Overall"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses an interesting and timely problem, and the architecture is plausible. The main gap is experimental rather than conceptual: the covertness claim needs adversarial evaluation, and the accuracy comparison needs error bars. I would not reject on the current evidence, but I would require a steganalysis / perceptual study and repeated-run statistics before acceptance. The LoD parameterization should also be clarified. The authors' own failure-case discussion is honest and should be preserved."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know. The paper genuinely does something new: it runs Face Forgery Detection directly on stego images, so the server never sees a raw face and never decrypts. And the accuracy claim mostly holds up — on their benchmark, StegaFFD beats the tested DIH+FFD baselines by a clear margin. But the headline promise, 'without raising suspicion,' is asserted, not tested. No steganalysis, no human study, no PSNR/SSIM comparison to other hiding methods. A 32.46 dB PSNR between cover and stego is not obviously 'strong imperceptibility'; many steganography papers report over 40 dB.\n\nThe architecture work is legit. LFAD estimates cover semantics with spatially-variant low-pass filters, SFDA uses DWT-based differential attention to subtract cover information, and SDA aligns stego features with raw-face features during training only. The ablation study is genuinely informative — it tests LFAD vs HFAD, DWT vs no DWT, SDA loss variants, LoD rank, and different DIH backbones. The failure-case discussion is a real plus: they admit dense-object covers hurt because high-frequency cover content interferes. That is a real boundary condition, not a hidden bug.\n\nThe soft spots are as the stress-test says. The 'covert channel' is load-bearing because the whole motivation is avoiding the cat-and-mouse game. Yet the only evidence is a visual similarity figure and two numbers. A simple steganalysis classifier could probably separate these stego images from natural photos — nobody checked. Also, Table 2 has no error bars or significance tests, and no code is released. Those are secondary issues; they affect confidence, not the shape of the result. The frequency-separation assumption is explicitly acknowledged in the failure cases, so it's not a hidden flaw, just a scope limitation.\n\nWho should read it: people working on privacy-preserving deepfake detection or steganography. The paper deserves a serious referee — the idea is novel and the evaluation framework (pairing privacy methods with FFD detectors) is reusable. But an editor should send it out with the expectation that the privacy claims need a much harder look. If I were refereeing, I'd ask for a steganalysis experiment, a human perception study or at least a comparison to state-of-the-art imperceptibility metrics, error bars, and code.","headline":"StegaFFD has a real new idea—FFD directly on stego images—and its accuracy core holds up, but the 'without raising suspicion' claim is untested and the paper would need a hard privacy evaluation to support it.","tokens_in":24626,"tokens_out":2631,"would_cite":true,"duration_ms":24395,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"StegaFFD proposes that face forgery detection can and should run directly on steganographic images—faces hidden inside innocuous natural photos—so that privacy protection no longer alerts attackers or degrades detection.","keywords":["steganography","image hiding","face forgery detection","privacy protection","differential attention","frequency-aware decomposition","domain alignment","covert analysis"],"falsifier":"Train a binary classifier to distinguish StegaFFD stego images from their covers; if it exceeds chance accuracy on held-out pairs, the 'imperceptible/covert' claim fails. Alternatively, evaluate StegaFFD on covers with dense high-frequency content (e.g., foliage, crowds) and check whether AUC on a fixed forgery test set falls toward or below the unprotected-baseline gap; the paper's frequency-separation premise predicts a sharp degradation.","tokens_in":23701,"feed_emoji":"🕵️","tokens_out":4246,"duration_ms":40188,"temperature":0.7,"pith_summary":"This paper argues that the usual ways of protecting facial privacy during deepfake detection—anonymization, encryption, distortion—are self-defeating because they make protected images look protected, alerting attackers and destroying the subtle forgery traces detectors rely on. The proposed alternative, StegaFFD, hides the face inside an ordinary natural cover image and runs the forgery detector directly on the resulting stego image, without ever extracting or decrypting the face on the server. The authors claim that with low-frequency-aware decomposition to estimate and subtract cover semantics, differential attention to cancel cover noise, and a training-time alignment loss against raw-face features, StegaFFD achieves the best accuracy among privacy-preserving FFD methods and comes within roughly 2% average AUC of detection on unprotected faces. If true, this would make covert, suspicion-free facial analysis practical in client-server settings.","feed_headline":"StegaFFD hides faces in plain sight to detect deepfakes covertly","feed_subtitle":"Servers spot fake faces without ever seeing a real one, cutting privacy leaks within 2% of plain detectors.","key_machinery":"The central mechanism is the steganographic feature lifting network M_L, composed of Low-Frequency-Aware Decomposition (LFAD) and Spatial-Frequency Differential Attention (SFDA). LFAD predicts spatially variant low-pass filters to estimate the cover's low-frequency content; SFDA computes attention as the difference between two softmax attention maps, plus a discrete wavelet transform frequency-differential term, so that common-mode cover information cancels out and the secret facial signal survives. Steganographic Domain Alignment (SDA), used only in training, pulls stego features toward features of the raw face via a CORAL-MMD distance and attention alignment; low-rank decomposition keeps t","core_discovery":"On the paper's own terms: the hidden forgery-specific facial features, though much fainter than cover content, can be lifted directly from the stego image by suppressing the cover's low-frequency semantic information and enhancing the higher-frequency bands where steganographic secrets reside. The key evidence is that StegaFFD's features focus on facial forgery regions (eyes, nose, mouth) while remaining insensitive to the cover's content, and that it outperforms twenty combinations of four privacy methods and four FFD detectors across seven datasets, with an average AUC of 72.00 versus 73.96 for the unprotected Xception baseline.","pith_inferences":["The same hide-then-analyze recipe could generalize to other integrity checks on sensitive imagery—e.g., detecting manipulated medical scans or ID documents—where visible protection would itself be undesirable.","A natural stress test the paper leaves open is steganalysis: whether a learned classifier can distinguish x_stego from x_cover, or recover the embedded face; the imperceptibility numbers suggest it would be hard, but the paper does not attempt this attack.","Cover selection could be turned into an explicit optimization: pick covers whose high-frequency energy is low at embedding time, directly operationalizing the paper's failure-case advice.","The training-only alignment amounts to a distillation from a clean-domain detector into a stego-domain detector; pushing that distillation further (or using a stronger raw-domain teacher) could close the remaining 2% gap."],"forward_implications":["Server-side detection never needs to extract or decrypt the hidden face, so the transmitted image contains no facial content an attacker can grab.","Steganographic covers look like ordinary photos (PSNR 32.46 dB, SSIM 0.86 to the cover), so interception does not reveal that privacy protection is even in use.","FFD accuracy under StegaFFD trails unprotected detection by only about 2% average AUC, far smaller than the 7–20% drops seen with anonymization and prior steganography-based pairs.","Because the alignment branch is dropped at deployment, the added privacy costs nothing at inference time beyond the cover-hiding step.","Choosing covers with little high-frequency texture avoids the documented failure mode of dense-object covers."],"fun_headline_variants":["Spot fakes on hidden faces, not raw ones","Face forgery detection that never sees your face","Hide faces to catch fakes, no raw images","Steganography lifts fakes from hidden faces","Privacy-safe fake detection: hide faces, see fakes"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The pipeline assumes cover semantics live in low frequencies and hidden face information lives in higher frequencies; when the cover image contains dense objects or rich high-frequency textures, that separation breaks down and the hidden face signal is drowned out—a limitation the paper's own failure cases confirm.","fun_headline_variants_meta":{"raw":{"variants":["Spot fakes on hidden faces, not raw ones","Face forgery detection that never sees your face","Hide faces to catch fakes, no raw images","Steganography lifts fakes from hidden faces","Privacy-safe fake detection: hide faces, see fakes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000346,"raw_usage":{"total_tokens":1782,"prompt_tokens":839,"completion_tokens":943,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":583,"completion_tokens_details":{"reasoning_tokens":868}},"tokens_in":583,"tokens_out":943,"duration_ms":9093,"temperature":1.0,"reasoning_tokens":868,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T19:14:12.858514+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a binary classifier to distinguish StegaFFD stego images from their covers; if it exceeds chance accuracy on held-out pairs, the 'imperceptible/covert' claim fails. Alternatively, evaluate StegaFFD on covers with dense high-frequency content (e.g., foliage, crowds) and check whether AUC on a fixed forgery test set falls toward or below the unprotected-baseline gap; the paper's frequency-separation premise predicts a sharp degradation.","supporting_citations":[],"review_version":1}