Pith. sign in

REVIEW 5 major objections 6 minor 58 references

Injecting camera-style sensor noise into the RAW domain makes AI images slip past deepfake detectors.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 06:23 UTC pith:VK3TIAEX

load-bearing objection A clever optimization-free attack with good empirical ASR numbers, but the 'authentic hardware fingerprint' story is asserted, not demonstrated — worth a serious referee, not a desk reject. the 5 major comments →

arxiv 2607.21897 v1 pith:VK3TIAEX submitted 2026-07-24 cs.CV cs.AIcs.CR

ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors

Jiale Zhao , Jiajun Wan , Lei Tang , Ye Qin , Kebing Jin , Jinghui Qin This is my paper
classification cs.CV cs.AIcs.CR
keywords adversarial attackdeepfake detectionimage signal processingsensor noisePoisson-Gaussian noiseinvertible ISPtransferabilityoptimization-free
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that deepfake detectors have a physical blind spot: they look for digital synthesis artifacts but never check for the hardware-intrinsic noise statistics that real cameras imprint on photographs. To exploit this, it proposes ISPCloak, which runs an AI-generated image through a learned inverse ISP to reach the RAW sensor domain, injects Poisson-Gaussian shot and read noise, then re-renders through the forward ISP. Because photon shot noise scales with signal intensity and the ISP creates complex spatial and chromatic correlations, the resulting image carries a plausible hardware fingerprint. The authors show that this one-pass, optimization-free pipeline evades four diverse detectors on three datasets with higher success rates than PGD, Diff-PGD, DiffAttack, and StealthDiffusion, while running in milliseconds. If it works as claimed, it reveals that current forensic paradigms need physics-aware cues, not just synthetic-artifact features.

Core claim

ISPCloak's central claim is that adversarial examples can be made universally evasive without any gradient optimization, simply by imprinting authentic physical imaging characteristics onto AI-generated images. The method projects a denoised RGB image into RAW via an invertible ISP network, adds signal-dependent Poisson noise and signal-independent Gaussian noise, clips the perturbation to a tiny bound, and reconstructs the final image with the forward ISP. The authors argue that this process gives synthetic images a hardware-intrinsic statistical signature—noise variance that scales with intensity and ISP-induced spatial and chromatic correlations—that data-driven generative models cannot r

What carries the argument

The invertible ISP network (InvISP) that bidirectionally maps between RGB and Bayer RAW, paired with Poisson-Gaussian noise injection in RAW. The load-bearing identity is the Photon Transfer Curve: real sensor noise variance is proportional to signal intensity (σ²∝μ), whereas AI-generated images show constant variance. Injecting noise that obeys this relation and passing it through the forward ISP produces correlated, camera-like textures that detectors trained on real imagery fail to distinguish from genuine capture noise.

Load-bearing premise

The whole framework hinges on the learned inverse ISP mapping: for an arbitrary AI-generated RGB image, the network must recover RAW pixel values that are physically meaningful enough that noise injected there, after forward ISP, is statistically indistinguishable from genuine sensor noise—yet the paper provides no validation that this actually holds.

What would settle it

Measure the Photo Response Non-Uniformity (PRNU) of ISPCloak outputs and compare it to a real camera's PRNU, or run camera-model attribution on the adversarial images. If the outputs fail to match a genuine camera model or their noise-variance curve deviates from σ²∝μ across brightness levels, the physical-camouflage claim is refuted.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Attack success transfers across heterogeneous detectors, suggesting the camouflage is not tied to a surrogate model's feature space.
  • The method works on in-the-wild distributions (WildFake) and localized manipulations (FF++), not just full-image generations.
  • The near-real-time pipeline (32 s for 1000 images on one GPU) makes scalable adversarial workflows practical.
  • Detectors relying solely on digital artifacts cannot reliably authenticate images; physics-aware features are needed.
  • The approach is camera-agnostic, since the noise model rests on universal photon and readout physics.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If confirmed by sensor-statistics validation, this undermines any detector that trusts camera-like noise as a sign of authenticity; forensic systems would need to verify the fingerprint's source, not just its presence.
  • The same RAW-domain noise injection could be tested against camera-model attribution and PRNU-based forensic methods; the paper does not report those tests, and they are the natural stress test.
  • Because the method suppresses generative artifacts with a denoiser before injection, it may also generalize to generative architectures beyond the eight tested generators.
  • The adaptive-mask and clipping trade-offs suggest a tunable 'physical patch' that could be adapted for deployment-specific quality budgets.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper presents ISPCloak, an optimization-free adversarial attack against deepfake/AIGC detectors. The pipeline denoises a generated RGB image with DnCNN, projects it to RAW space with a trained invertible ISP (InvISP), injects Poisson-Gaussian noise intended to emulate real sensor statistics, clips the perturbation, and reconstructs the adversarial image via the forward ISP. An adaptive gradient-based mask concentrates changes in textured regions. Experiments on GenImage, WildFake, and FaceForensics++ report attack success rates for four black-box detectors (AIDE, SAFE, C2P-CLIP, LGrad) and compare with PGD, Diff-PGD, DiffAttack, and StealthDiffusion. The authors claim that the resulting images carry authentic hardware fingerprints and are statistically indistinguishable from real camera captures, and that this physical grounding confers universal transferability.

Significance. If validated, ISPCloak would be a genuinely novel attack mechanism: rather than adding gradient-optimized digital perturbations, it casts an image through a learned RAW/ISP cycle and imprints physical sensor noise. The paper is clearly motivated, provides a complete mathematical specification, and includes ablations, sensitivity analysis, and a computational-efficiency comparison. The reported mean ASRs outperform strong baselines across most evaluated settings, and the method runs over two orders of magnitude faster than diffusion-based attacks. The central weakness is that the load-bearing 'authentic hardware fingerprint' claim is asserted but not demonstrated; without validation of physical authenticity, the proposed explanation for black-box transferability is not established. The empirical comparison also lacks clean-image baselines and error bars, so the 'universal' claim is not yet supported.

major comments (5)
  1. [§3.3 (Eqs. 6–10); §5] The central claim that the pipeline produces 'authentic hardware fingerprints' and images 'statistically indistinguishable from real camera captures' is not validated. InvISP is trained for RGB↔RAW reconstruction fidelity, not forensic realism; Eq. (8) is a two-parameter noise model omitting PRNU, dark-current nonuniformity, and per-camera ISP nonlinearities. No experiment measures PRNU correlation, noise-variance curves, camera-model attribution, or compares against real captures from the same device. This matters because the paper explains transferability through physical authenticity; without validation, the observed ASR could arise from generic perturbation/denoising. Please add such validation or temper the physical-authenticity claims.
  2. [§4.2, Tables 1–3] No clean-image false-acceptance baseline is reported. ASR for a fake image is the probability the detector says 'real,' but the paper never gives the false-acceptance rate on unperturbed AI images. If detectors already accept a large fraction of original AI images (e.g., for some generators), then the reported ASR is not attributable to the attack. Report the attack's delta over the no-attack baseline, and ideally the true-acceptance rate on real images, for each detector and dataset.
  3. [§4.2, Tables 1–3] There are no error bars or statistical tests. All ASR values are point estimates from one fixed sample of 1,000 images per generator. The margin between Ours (86.59%) and StealthDiffusion (86.50%) on AIDE/GenImage is within plausible sampling noise, so the claim of superiority is not established. Provide mean±std over multiple random subsamples/seeds and, where possible, a paired significance test.
  4. [§4.1.5 and §4.4.2, Table 6] The five hyperparameters (σ_p, σ_g, α, ε, γ) are hand-set, and the sensitivity analysis shows large swings in ASR (e.g., ε 0.5× = 66.12%, 2× = 98.91%; γ 0.5× = 96.80%, 2× = 62.88%) and in FID (e.g., α 2× = 5.31). No criterion or validation set is given for choosing the defaults, which weakens the claim that the method is 'optimization-free' and robust. Report a selection principle or show that conclusions are stable across a plausible range.
  5. [§4.1.3 and §4.1.5] The four baselines are optimized against different surrogate models (ResNet-50, Swin, DeiT, EfficientNet). This confounds the comparison: differences in ASR may reflect surrogate strength rather than method quality. To support the transferability claim, run all attacks with the same surrogate (or report each attack under multiple surrogates) and then evaluate on the same black-box detectors.
minor comments (6)
  1. [Abstract, §1, §3.1] The pipeline is called 'parameter-free' but §4.1.5 lists five hand-tuned scalars. Suggest using 'optimization-free' and clarifying what 'parameter-free' means.
  2. [Table 5] The component ablation table is hard to read: the checkmarks under the component columns are not visually aligned with the headers, and the text describes rows without explicit row labels. Add a configuration column or use named rows.
  3. [Figure 1(a)] The motivating 'physics-violating' constant-noise claim for AI-generated images is presented without a citation or measurement. Provide a reference or a small experiment quantifying noise-variance curves of real vs. generated images.
  4. [§5] The sentence 'manipulated images become statistically indistinguishable from real camera captures' is stronger than the evidence supports; see the major comment on §3.3. Rephrase to match what is actually measured.
  5. [References] Some references lack complete venue/year information (e.g., [44] and [48]), and several entries are dated 2026. Please ensure all citations are complete and consistent.
  6. [Abstract] The term 'universally evasive' is too strong given only four detectors and three datasets; consider 'evasive across the evaluated detectors and datasets.'

Circularity Check

0 steps flagged

No circularity: empirical attack measured against external detectors; physical-authenticity claim is an unvalidated assumption, not a derivation from its own inputs.

full rationale

ISPCloak's construction is feed-forward and each stage is defined independently: artifact suppression (Eqs. 1–5), inverse ISP mapping (Eq. 6), Poisson-Gaussian noise injection (Eqs. 7–8), clipping (Eq. 9), and forward ISP reconstruction (Eq. 10). The adversarial output x* is not defined in terms of any detector output, and the reported ASR values are measured on held-out external detectors (AIDE, SAFE, C2P-CLIP, LGrad), so the central evaluation is not forced by construction. The hyperparameters (sigma_p=0.09, sigma_g=0.075, epsilon=0.006, alpha=0.2, gamma=2.5) are manually chosen constants; although the sensitivity analysis shows they affect ASR, they are not fitted to the detectors' predictions, so this is not 'fitted input called prediction.' The paper's key conceptual claim — that the resulting images carry an 'authentic hardware fingerprint' and are 'statistically indistinguishable from real camera captures' — is asserted without direct validation (e.g., PRNU attribution, measured noise-variance curve fitting, or comparison against real captures from the same camera). This is a genuine evidential gap and a soundness/interpretation concern, but it is not circular: the derivation does not assume the conclusion, and the empirical attack results would remain meaningful even if the physical-authenticity mechanism were weaker than claimed. The cited InvISP [46], DnCNN [49], and noise-physics works [4,10] have no author overlap with this paper, and no load-bearing self-citation or imported uniqueness theorem appears. Overall, no step in the claimed derivation reduces to its own inputs or to a self-citation chain.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

The paper introduces no new physical entities; it reuses InvISP, DnCNN, and Poisson-Gaussian noise models. The main unvalidated constructs are the claimed 'authentic hardware fingerprint' and the noise-injection parameters, captured above as free parameters and axioms.

free parameters (5)
  • sigma_p (Poisson noise scale) = 0.09
    Hand-set noise magnitude; sensitivity analysis (Table 6) shows ASR changes from 81.54 to 88.49 when halved, so the reported result depends on this choice.
  • sigma_g (Gaussian read-noise scale) = 0.075
    Hand-set; halving drops ASR to 71.59; used to emulate thermal read noise.
  • epsilon (RAW perturbation clip bound) = 0.006
    Hand-set bound; doubling raises ASR to 98.91 with much worse visual quality; the attack/quality trade-off hinges on it.
  • alpha (artifact-suppression blend) = 0.2
    Hand-set; halving drops ASR to 59.18, doubling lowers ASR to 71.97; controls suppression intensity.
  • gamma (mask power) = 2.5
    Hand-set; halving raises ASR to 96.80, doubling lowers to 62.88; controls selectivity of adaptive mask.
axioms (5)
  • domain assumption InvISP provides a valid bidirectional RAW-to-RGB mapping for arbitrary AI-generated RGB images
    §3.3 Eq. (6),(10); inverse mapping is ill-posed and no validation on AI images is provided.
  • domain assumption DnCNN residual separates generative artifacts from image content
    §3.2 Eq. (1)-(5); DnCNN is trained for Gaussian denoising, not artifact extraction, and no analysis of the residual is shown.
  • domain assumption Signal-dependent Gaussian noise (Eq. 8) adequately reproduces authentic Poisson sensor noise after ISP reconstruction
    §3.3 Eq. (8); the paper approximates Poisson with Gaussian but never measures whether reconstructed images match real sensor noise statistics.
  • domain assumption Deepfake detectors rely on digital artifacts and are blind to physical sensor statistics
    §1, §2.1; this motivates the attack, but the paper only tests four detectors and does not establish the general forensic claim.
  • domain assumption ASR thresholding is consistent across detectors and attack methods
    §4.1.4; the exact definition of attack success and detector decision thresholds are not specified.

pith-pipeline@v1.3.0-alltime-deepseek · 16005 in / 12157 out tokens · 110917 ms · 2026-08-01T06:23:52.682994+00:00 · methodology

0 comments
read the original abstract

The rapid advancement of generative models has spurred the critical need to evaluate the worst-case robustness of deepfake detectors. In this paper, we reveal a fundamental blind spot in current forensic paradigms: while existing detectors excel at capturing digital synthesis artifacts, their effectiveness drops drastically when AI-generated content is cloaked in authentic physical imaging characteristics. We posit that genuine photographs inherently possess hardware-intrinsic statistical signatures, which are imperceptible footprints imprinted by optical sensors and Image Signal Processing (ISP) pipelines, and are fundamentally absent in purely data-driven generative models. Driven by this insight, we propose ISPCloak, a novel optimization-free adversarial attack framework that explicitly weaponizes the ISP pipeline to mislead the judgment of deepfake detectors. Rather than relying on computationally expensive gradient perturbations, our method first employs an Invertible ISP network to project images into the RAW domain. Then, we seamlessly imprint the complex statistical priors of real cameras onto AI-generated images by injecting realistic Poisson-Gaussian sensor noise and conducting forward ISP reconstruction. Synergized with generative artifact suppression and adaptive masking, this streamlined physical simulation enables ultra-fast generation of adversarial examples. Extensive experiments show that embedding authentic physical perturbations fundamentally disrupts a broad range of current detection mechanisms, yielding universally evasive adversarial examples with imperceptible visual alterations.

Figures

Figures reproduced from arXiv: 2607.21897 by Jiajun Wan, Jiale Zhao, Jinghui Qin, Kebing Jin, Lei Tang, Ye Qin.

Figure 1
Figure 1. Figure 1: Overview of our proposed physical noise injection framework. (a) Motivation: Real photographs inherently follow [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Qualitative comparison of adversarial examples [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

58 extracted references · 3 linked inside Pith

  1. [1]

    Mahmoud Afifi, Zhongling Wang, Ran Zhang, and Michael S Brown. 2025. Mod- ular Neural Image Signal Processing.arXiv preprint arXiv:2512.08564(2025)

    arXiv 2025

  2. [2]

    Inzamamul Alam, Md Tanvir Islam, and Simon S Woo. 2025. Specxnet: A dual- domain convolutional network for robust deepfake detection. InProceedings of the 33rd ACM International Conference on Multimedia. 11667–11676

    2025

  3. [3]

    James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, et al . 2023. Improving im- age generation with better captions.Computer Science. https://cdn. openai. com/papers/dall-e-3. pdf2, 3 (2023), 8

    2023

  4. [4]

    Tim Brooks, Ben Mildenhall, Tianfan Xue, Jiawen Chen, Dillon Sharlet, and Jonathan T Barron. 2019. Unprocessing images for learned raw denoising. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 11036–11045

    2019

  5. [5]

    Keshigeyan Chandrasegaran, Ngoc-Trung Tran, and Ngai-Man Cheung. 2021. A closer look at fourier spectrum discrepancies for cnn-generated images detec- tion. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 7200–7209

    2021

  6. [6]

    Hongyang Chen and Kaisheng Ma. 2022. Lw-isp: A lightweight model with isp and deep learning.arXiv preprint arXiv:2210.03904(2022)

    Pith/arXiv arXiv 2022

  7. [7]

    Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. 2024. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence47, 2 (2024), 961– 977

    2024

  8. [8]

    Davide Cozzolino, Justus Thies, Andreas Rossler, Matthias Niessner, and Luisa Verdoliva. 2021. SpoC: Spoofing Camera Fingerprints. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Work- shops. 990–1000

    2021

  9. [9]

    Anurag Dutta, Arnab Kumar Das, Ruchira Naskar, and Rajat Subhra Chakraborty

  10. [10]

    Alessandro Foi, Mejdi Trimeche, Vladimir Katkovnik, and Karen Egiazarian

  11. [11]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572(2014)

    Pith/arXiv arXiv 2014

  12. [12]

    Fabrizio Guillaro, Giada Zingarini, Ben Usman, Avneesh Sud, Davide Cozzolino, and Luisa Verdoliva. 2025. A bias-free training paradigm for more general ai- generated image detection. InProceedings of the Computer Vision and Pattern Recognition Conference. 18685–18694

    2025

  13. [13]

    Xiaoxuan Han, Songlin Yang, Wei Wang, Yang Li, and Jing Dong. 2025. Probing unlearned diffusion models: A transferable adversarial attack perspective.Pattern Recognition(2025), 112916

    2025

  14. [14]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition. 770–778

    2016

  15. [15]

    Yan Hong and Jianfu Zhang. 2024. Wildfake: A large-scale challenging dataset for ai-generated images detection.arXiv preprint arXiv:2402.11843(2024)

    Pith/arXiv arXiv 2024

  16. [16]

    Chihan Huang and Xiaobo Shen. 2025. Huang: A robust diffusion model-based targeted adversarial attack against deep hashing retrieval. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 3626–3634

    2025

  17. [17]

    Hossein Kashiani, Niloufar Alipour Talemi, and Fatemeh Afghah. 2025. Fre- qDebias: Towards Generalizable Deepfake Detection via Consistency-Driven Frequency Debiasing. InProceedings of the Computer Vision and Pattern Recogni- tion Conference. 8775–8785

    2025

  18. [18]

    Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Fuli Feng

  19. [19]

    Yixuan Li, Xuelin Liu, Xiaoyang Wang, Bu Sung Lee, Shiqi Wang, Anderson Rocha, and Weisi Lin. 2025. Fakebench: Probing explainable fake image detection via large multimodal models.IEEE Transactions on Information Forensics and Security(2025)

    2025

  20. [20]

    Kaiqing Lin, Yuzhen Lin, Weixiang Li, Taiping Yao, and Bin Li. 2025. Standing on the shoulders of giants: Reprogramming visual-language model for general deepfake detection. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 5262–5270

    2025

  21. [21]

    InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V

    Improving synthetic image detection towards generalization: An image transformation perspective. InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1. 2405–2414

  22. [22]

    Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Jingdong Wang, and Yao Zhao. 2024. Forgery-aware adaptive transformer for generalizable synthetic image detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 10770–10780

    2024

  23. [23]

    Yuanwei Liu, Hui Wei, Chengyu Jia, Ruqi Xiao, Weijian Ruan, Xingxing Wei, Joey Tianyi Zhou, and Zheng Wang. 2025. Projattacker: A configurable physical adversarial attack for face recognition via projector. InProceedings of the Computer Vision and Pattern Recognition Conference. 21248–21257

    2025

  24. [24]

    Decheng Liu, Xijun Wang, Chunlei Peng, Nannan Wang, Ruimin Hu, and Xinbo Gao. 2024. Adv-diffusion: imperceptible adversarial face identity attack via latent diffusion model. InProceedings of the AAAI conference on artificial intelligence, Vol. 38. 3585–3593

    2024

  25. [25]

    Wei Lu, Lingyi Liu, Bolin Zhang, Junwei Luo, Xianfeng Zhao, Yicong Zhou, and Jiwu Huang. 2024. Detection of Deepfake Videos Using Long-Distance Attention.IEEE Transactions on Neural Networks and Learning Systems35, 7 (2024), 9366–9379. doi:10.1109/TNNLS.2022.3233063

    arXiv 2024

  26. [26]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. InInternational Conference on Learning Representations

    2018

  27. [27]

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. 2021. Swin transformer: Hierarchical vision transformer us- ing shifted windows. InProceedings of the IEEE/CVF international conference on computer vision. 10012–10022

    2021

  28. [28]

    Zhengzhao Pan, Hua Chen, and Xiaogang Zhang. 2025. DiffAdvMAP: Flexible Diffusion-Based Framework for Generating Natural Unrestricted Adversarial Examples. InForty-second International Conference on Machine Learning

    2025

  29. [29]

    Buu Phan, Fahim Mannan, and Felix Heide. 2021. Adversarial Imaging Pipelines. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recog- nition (CVPR). 16051–16061

    2021

  30. [30]

    Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. 2023. Towards universal fake image detectors that generalize across generative models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 24480–24489

    2023

  31. [31]

    Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Niessner. 2019. FaceForensics++: Learning to Detect Manipulated Facial Images. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)

    2019

  32. [32]

    Susim Roy, Anubhooti Jain, Mayank Vatsa, and Richa Singh. 2025. Taigen: Training-free adversarial image generation via diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision. 5903–5913

    2025

  33. [33]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10684–10695

    2022

  34. [34]

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. 2024. Frequency-aware deepfake detection: Improving generalizability through frequency space domain learning. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 5052–5060

    2024

  35. [35]

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. 2024. Rethinking the up-sampling operations in cnn-based generative network for generalizable deepfake detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 28130–28139

    2024

  36. [36]

    Chuangchuang Tan, Renshuai Tao, Huan Liu, Guanghua Gu, Baoyuan Wu, Yao Zhao, and Yunchao Wei. 2025. C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 7184–7192. Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Jiale Zhao, Jiaj...

    2025

  37. [37]

    Mingxing Tan and Quoc Le. 2019. Efficientnet: Rethinking model scaling for convolutional neural networks. InInternational conference on machine learning. PMLR, 6105–6114

    2019

  38. [38]

    Razaib Tariq, Minji Heo, Simon S Woo, and Shahroz Tariq. 2024. Beyond the screen: Evaluating deepfake detectors under Moire pattern effects. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 4429–4439

    2024

  39. [39]

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. 2023. Learning on Gradients: Generalized Artifacts Representation for GAN-Generated Images Detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 12105–12114

    2023

  40. [40]

    Kwang-Hyun Uhm, Kyuyeon Choi, Seung-Won Jung, and Sung-Jea Ko. 2021. Image compression-aware deep camera ISP network.IEEE Access9 (2021), 137824– 137832

    2021

  41. [41]

    Haoyue Wang, Sheng Li, Zhenxing Qian, and Xinpeng Zhang. 2026. Adversarial Diffusion Model: Generating High Quality and Undetectable Images from Scratch. IEEE Transactions on Information Forensics and Security(2026)

    2026

  42. [42]

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. 2021. Training data-efficient image transformers & distillation through attention. InInternational conference on machine learning. PMLR, 10347–10357

    2021

  43. [43]

    Wenjun Wei, Yanlin Qian, Huaian Chen, Junkang Dai, and Yi Jin. 2025. Integral Fast Fourier Color Constancy. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 26420–26429

    2025

  44. [44]

    Siwei Wen, Junyan Ye, Peilin Feng, Hengrui Kang, Zichen Wen, Yize Chen, Jiang Wu, Conghui He, Weijia Li, et al. [n. d.]. Spot the Fake: Large Multimodal Model- Based Synthetic Image Detection with Artifact Explanation. InThe Thirty-ninth Annual Conference on Neural Information Processing Systems

  45. [45]

    Hui Wei, Zhixiang Wang, Kewei Zhang, Jiaqi Hou, Yuanwei Liu, Hao Tang, and Zheng Wang. 2024. Revisiting adversarial patches for designing camera-agnostic attacks against person detection.Advances in Neural Information Processing Systems37 (2024), 8047–8064

    2024

  46. [46]

    Yazhou Xing, Zian Qian, and Qifeng Chen. 2021. Invertible Image Signal Process- ing. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 6287–6296

    2021

  47. [47]

    Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. 2023. Diffusion- based adversarial sample generation for improved stealthiness and controllability. Advances in Neural Information Processing Systems36 (2023), 2894–2921

    2023

  48. [48]

    Mengjie Wu, Jingui Ma, Run Wang, Sidan Zhang, Ziyou Liang, Boheng Li, Chen- hao Lin, Liming Fang, and Lina Wang. 2024. Traceevader: Making deepfakes more untraceable via evading the forgery model attribution. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 19965–19973

    2024

  49. [49]

    Kai Zhang, Wangmeng Zuo, Yunjin Chen, Deyu Meng, and Lei Zhang. 2017. Beyond a Gaussian denoiser: Residual learning of deep CNN for image denoising. IEEE Transactions on Image Processing26, 7 (2017), 3142–3155

    2017

  50. [50]

    Yin Zhang, Yongqiang Zhang, Zian Zhang, Man Zhang, Rui Tian, and Mingli Ding

  51. [51]

    Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie. [n. d.]. A Sanity Check for AI-generated Image Detection. InThe Thirteenth International Conference on Learning Representations

  52. [52]

    Ziyin Zhou, Ke Sun, Zhongxi Chen, Huafeng Kuang, Xiaoshuai Sun, and Ron- grong Ji. 2024. Stealthdiffusion: Towards evading diffusion forensic detection through diffusion model. InProceedings of the 32nd ACM International Conference on Multimedia. 3627–3636

    2024

  53. [53]

    Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. 2023. Genimage: A million-scale benchmark for detecting ai-generated image.Advances in neural information processing systems36 (2023), 77771–77782

    2023

  54. [54]

    Wenjun Zhu, Xiaoyu Ji, Xinfeng Li, Qihang Chen, Kun Wang, Xinyu Li, Ruoyan Xu, and Wenyuan Xu. 2025. Neural Invisibility Cloak: Concealing Adversary in Images via Compromised{AI-driven} Image Signal Processing. In34th USENIX Security Symposium (USENIX Security 25). 937–956

    2025

  55. [55]

    Guanglei Zhou, Bhargav Korrapati, Gaurav Rajavendra Reddy, Chen-Chia Chang, Jingyu Pan, Jiang Hu, Yiran Chen, and Dipto G Thakurta. 2025. Patternpaint: Practical layout pattern generation using diffusion-based inpainting. In2025 62nd ACM/IEEE Design Automation Conference (DAC). IEEE, 1–7

    2025

  56. [2008]

    Practical Poissonian-Gaussian noise modeling and fitting for single-image raw-data.IEEE transactions on image processing17, 10 (2008), 1737–1754

    2008

  57. [2024]

    InProceedings of the AAAI Conference on Artificial Intelligence, Vol

    Isp-teacher: Image signal process with disentanglement regularization for unsupervised domain adaptive dark object detection. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 7387–7395

  58. [2025]

    InProceedings of the Computer Vision and Pattern Recognition Conference

    WaveDIF: Wavelet sub-band based deepfake identification in frequency domain. InProceedings of the Computer Vision and Pattern Recognition Conference. 6312–6321