Pith. sign in

REVIEW 3 major objections 6 minor 60 references

Adversarial Deepfake Generation and an Investigation of Purification-Based Adversarial Detection

T0 review · 3 major / 6 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Raw logit shift under median-3 purification separates adversarial and clean images at AUROC 0.81–0.98, but only for a detector fine-tuned by SVD-residual decomposition on uncompressed inputs.

desk verdict Useful empirical observation about EFFORT and median-3 purification, but the mechanistic 'refutation' claim is undercut by a confounded six-detector ablation. read the letter →

arxiv 2607.25842 v1 pith:RI74YK5F submitted 2026-07-28 cs.CV cs.CR

Junghyun Kim , Seunghyun Kim , Jiyoung Woo This is my paper
classification cs.CVcs.CR
keywords DeepfakeDetectionGenerationAdversarialAttackInputPurificationFine-TuningAblationLogitShiftMedianFilter
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper, written around a deepfake detection and generation competition entry, goes beyond the submitted systems to ask whether a detector that has been fooled by an adversarial patch can still flag the attack. The core finding is that a weight-free signal—the absolute change in a detector's raw logit when a 3×3 median filter is applied—separates adversarial inputs from clean inputs with AUROC 0.81–0.98 across four attack/source types, but only for a specific fine-tuning style: SVD-residual decomposition of a CLIP ViT-L/14 backbone (the 'EFFORT' detector). This contradicts the simple backbone-preservation hypothesis that freezing more pretrained parameters would make a detector more purification-sensitive; in the paper's ablation, a linear probe and full fine-tuning both outperform a low-rank LoRA, and the heaviest modification wins. The signal is brittle—JPEG compression to quality 70 or below erases it entirely. If the claim holds, purification scoring offers a cheap first-pass adversarial screen for uncompressed images and shifts design attention from parameter counts to the geometric structure of fine-tuning.

What carries the argument

The central mechanism is the purification response: apply a fixed 3×3 median filter T to the input, compute the raw (pre-sigmoid) logit shift |f(T(x)) − f(x)| at the detector's fake-class output, and use that scalar as an adversarial score. Median filtering removes gradient-aligned high-frequency perturbations, so a large shift indicates the input carried an adversarial pattern the filter destroyed. The signal is carried by the EFFORT detector, a CLIP ViT-L/14 model fine-tuned via SVD-residual decomposition, which the paper finds is the only fine-tuning style among six that yields a large, generalizable shift under this operator. The paper also documents the operator combination (median-3, m

What would settle it

Train an SVD-residual detector and an adapter or LayerNorm-fine-tuned detector on identical data and hyperparameters, then run the median-3 purification logit-shift probe on the same adversarial/clean split; if the SVD-residual variant's AUROC advantage narrows to within noise, or a non-SVD variant matches it, the paper's central attribution fails.

Watch

Extended reading notes

Core claim

This paper demonstrates that, on uncompressed inputs, the raw logit shift |f(median3(x)) − f(x)| computed at the final fake-class output of the EFFORT detector—a CLIP ViT-L/14 model fine-tuned by SVD-residual decomposition—separates adversarially perturbed images from clean ones with AUROC 0.81–0.98 across four adversarial source types: the paper's own production attacks, cross-generator AI images, face-swap, and reenactment manipulations, each attacked with PGD/FGSM/BIM. Five other detectors sharing the same backbone but fine-tuned differently (linear probe, LoRA, full fine-tuning, LayerNorm-only, adapters) plateau at 0.40–0.78, and the ordering by parameter-update fraction contradicts the

Load-bearing premise

The attribution of EFFORT's superiority to fine-tuning strategy assumes the six compared detectors differ only in fine-tuning method; the three publicly released checkpoints were trained on different datasets and with different recipes, so EFFORT's advantage could stem from its training distribution instead.

Editorial extensions

If this is right

  • A detector that is fooled by an adversarial perturbation can still serve as an adversarial-input screen: its raw logit shift under median-3 filtering flags the input with AUROC ≥0.81 across production, AI-generated, face-swap, and reenactment sources, on uncompressed images.
  • Fine-tuning geometry, not backbone parameter-preservation fraction, governs purification sensitivity: the linear probe and full fine-tune beat a ~1%-parameter LoRA, directly contradicting the backbone-preservation hypothesis in its strongest form.
  • The signal is quality-dependent: JPEG-Q80 post-processing costs 0.15–0.25 AUROC and shifts the dominant operator from median-3 to median-5, while Q70 and below kills the signal entirely, so any deployment must be quality-aware.
  • Probability-domain metrics conceal the signal: a +31 logit shift compresses to +0.30 after sigmoid and inverse-sigmoid with clipping, so raw logit shifts must be monitored to avoid falsely concluding the signal is absent.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If SVD-residual geometry is what makes EFFORT special, deliberately training detectors to align their modified singular directions with adversarial perturbation directions could produce purification-sensitive detectors on demand; an SVD-rank sweep on identical training data would test this directly—a step the paper leaves open.
  • The Q70 cliff hints that adversarial high-frequency residuals and JPEG quantization artifacts occupy overlapping bands, so a frequency-domain or perceptual-loss purification operator might push the usable quality threshold below Q70; the paper's spatial median filter does not.
  • Because the raw-logit shift needs only one extra filtered forward pass, it could complement any deployed detector as a low-cost post-hoc screen; pairing it with a second detector's purification response might extend coverage beyond EFFORT, though the paper's multi-detector experiments suggest such extensions must be recalibrated per deployment.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper reports team "Go To Germany" participation in the ImageCLEF 2026 deepfake detection and generation task. The generation pipeline combines FLUX.1-dev with PuLID identity injection and a multi-model PGD attack targeting 12 white-box detectors, achieving 90% organizer evasion and a final generation score of 0.4170. The detection pipeline uses a max-probability ensemble of SigLIP+DINOv2 and GenD-DINOv3 with an auxiliary prob_min rule, achieving 99.4% accuracy on baseline deepfakes but high false-positive rates on real images, for a final detection score of 0.6986. The main scientific contribution is a self-contained investigation of purification-based adversarial detection. Across six detectors sharing a CLIP ViT-L/14 backbone, the authors find that raw |Δlogit| under median-3 purification, applied through the EFFORT detector, separates adversarial inputs from clean inputs with AUROC 0.81–0.98 across four adversarial source types. They also report a sharp JPEG-quality cliff at Q70 where the signal collapses, and claim this refutes the simple backbone-preservation hypothesis.

Significance. If the cross-source results hold, the paper makes a practically useful and falsifiable contribution: a single off-the-shelf detector, EFFORT, combined with a simple median-3 purification operator, can serve as a first-pass adversarial-input screen on uncompressed images, and the JPEG Q70 cliff is a concrete boundary condition. The paper is unusually transparent: it reports the pilot-to-deployment collapse of the Mahalanobis approach (§6.2), a post-competition analysis of its own calibration error (§4.5), bootstrap confidence intervals for representative cells in Table 12, and an explicit statement that the mechanism of EFFORT's generalization "is not addressed by our data" (§6.4). The cross-source cells (AI-generated, face-swap, reenactment) are independent of EFFORT because the underlying attacks targeted ForAda, SigLIP, and joint objectives, which protects the screening claim from the circularity that affects the production cell. However, the mechanistic headline—that fine-tuning strategy, not backbone identity, governs purification-signal strength—exceeds what the six-detector comparison can support because the public checkpoints differ in training data and recipe, not only in f

major comments (3)
  1. [§6.3.3 Setup and Table 12] The six-detector ablation is confounded. Only LP, LoRA, and FullFT are trained by the authors on an identical FaceForensics++ split; GenD-CLIP, ForAda, and EFFORT are public checkpoints that "share the same backbone but with different fine-tuning strategies and training data," as the text itself states. The ranking in Table 12 (EFFORT > LP > FullFT > GenD-CLIP > ForAda/LoRA) can therefore be explained by differences in dataset composition, class balance, training recipe, or checkpoint selection, rather than by SVD-residual fine-tuning. The paper's own §6.4 concedes that the mechanism "is not addressed by our data." Consequently, the abstract's claim that the results "refute the simple backbone-preservation hypothesis" is not supported by the reported design. To support the mechanistic claim, the authors should train an EFFORT-style SVD-residual model and a LayerNorm/adapter variant on th
  2. [§6.3.3, Table 12, production cell] The production AUROC of 0.982 is partly self-referential: the production adversarial images were generated by a PGD attack that targeted EFFORT as one of its 12 white-box detectors (Section 3.3). The perturbation was therefore optimized against EFFORT's gradients, making it unsurprising that EFFORT sees a large purification shift. The abstract's headline range "AUROC 0.81–0.98 across four adversarial source types" includes this self-referential cell without caveat. The cross-source cells (0.81–0.89), where the attacks targeted ForAda/SigLIP/joint and not EFFORT, are the independent evidence. The authors should either report the cross-source range separately in the abstract or add an explicit caveat that the 0.98 figure is a self-defense result. The acknowledgment in §6.4 is a good step, but the abstract currently overstates the generality of the strongest number.
  3. [§6.3.3, Table 13 (multi-operator refinement)] The multi-operator logistic-regression AUROCs for EFFORT are reported without any cross-validation or train/test split. The earlier multi-operator result on GenD-DINOv3 used 5-fold CV (Section 6.3.2), but Table 13 gives no indication that the LR weights were fit on a held-out portion. If the logistic regression was fit and evaluated on the same adversarial source set, the reported gains (+0.02 to +0.09 AUROC) are optimistic, and the recommendation to "switch to the multi-operator combination when input quality is degraded" is not evidence-based. Please report 5-fold CV results, or state explicitly which split was used.
minor comments (6)
  1. [Abstract] Spacing typo: "achieving99.4%accuracy" should read "achieving 99.4% accuracy." Similar missing spaces appear throughout (e.g., "the0.5-baseline", "cross-face-swap").
  2. [Figure 4 caption] The caption states that at Q95 the single-operator signal "clears the broad-claim threshold of AUROC 0.85 on every source," but the listed values include cross AI-gen at 0.81, which is below 0.85. The caption or the values should be corrected.
  3. [§6.2.2, Figure 3 caption] The caption contains "our100 submitted adversarials" and similar spacing issues; also, the pilot AUROC of 1.000 is reported without confidence intervals. Given the subsequent deployment collapse, a small-sample caveat at the pilot point would help readers calibrate the result.
  4. [Table 12] Bootstrap 95% CIs are given for four representative cells only. The EFFORT cross-AI-gen cell (0.81) has no interval, so the reader cannot assess the uncertainty of the lower bound of the headline range. Please report CIs for all cells or list them in a supplement.
  5. [§6.1, Table 6] The color labels "(grey)" in Table 6 are unexplained. If they refer to a visual threshold in a figure, the criterion should be stated in text or the labels removed.
  6. [Reproducibility] The paper does not mention whether code or trained detector weights will be released. For a notebook paper whose further-experiments section makes a testable claim about a public detector, providing the attack-generation and purification-evaluation code would significantly strengthen reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: purification signal is measured, not fitted; cross-source results are independent, and the one self-defense condition is explicitly disclosed.

full rationale

No significant circularity found. The central purification result is an empirical measurement of a raw logit shift under a fixed median-3 operator; no parameter is fitted to the target and then renamed a prediction, and no equation reduces to its own input by construction. The cross-source AUROC results (Table 12) were produced from adversarial sets that targeted ForAda, SigLIP, or joint ensembles, not EFFORT, so they are independent evidence for EFFORT's generalization. The production-set result (AUROC 0.982) is in-sample in the sense that EFFORT was one of the twelve white-box attack targets in the generation pipeline, but the paper explicitly flags this as a self-defense scenario in Section 6.4 and notes that realistic deployments should be judged by the cross-source numbers; this is a transparent evaluation limitation rather than a circular derivation. The six-detector fine-tuning ablation is confounded because EFFORT, GenD-CLIP, and ForAda are public checkpoints trained on different data and recipes, so the mechanistic claim about fine-tuning strategy is weakened as a causal inference; however, confounding is a correctness/validity issue, not circularity. No load-bearing self-citation appears: references to EFFORT and GenD are to external prior work by other authors, and no uniqueness theorem or ansatz is imported from the present authors' own prior work. The paper explicitly leaves the mechanism of EFFORT's behavior untested, further confirming that it is not presenting a derivation that could be self-referential.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central purification claim itself uses a single unthresholded feature (raw |Δlogit| under median-3) that is not fitted to the data, but the detector and operator were selected post hoc on the evaluation matrix, and the public-checkpoint comparison is confounded by training data. The attack hyperparameters define the adversarial distribution being tested.

free parameters (5)
  • median-3 operator choice = 3x3 median filter
    Selected as the purification operator for the headline claim after exploration; no separate validation set was used to confirm the choice.
  • EFFORT detector selection = EFFORT (SVD-residual)
    EFFORT was identified as the best detector by inspecting AUROC on the same four-source test matrix (Table 12); model selection on the evaluation data inflates apparent generalization.
  • tau_min (prob_min rule) = 0.04
    Calibrated on a held-out 7,000-image set for the official detection task (Section 4.4); selected by count-based net gain, later shown to be miscalibrated on the official real-heavy distribution.
  • Multi-operator LR coefficients (GenD-DINOv3 L19) = median5 -2.01, bit-depth -1.96, Gaussian +1.41, raw-logit +1.21
    Logistic regression weights fitted on pilot data (Section 6.3.2); used in the auxiliary multi-operator result, not the headline single-operator signal.
  • Attack hyperparameters (epsilon, alpha, T, mu) = epsilon=2/255, alpha=0.5/255, T=25, mu=1.0
    Hand-chosen settings for the PGD attack that produced the adversarial images used in both the generation task and the purification evaluation; define the attack distribution under test.
assumptions (3)
  • domain assumption The six detectors share the same CLIP ViT-L/14 backbone and differ primarily in fine-tuning strategy, so purification-signal differences are attributable to fine-tuning method.
    Invoked in Section 6.3.3 to interpret the ablation; violated for the three public checkpoints, which also differ in training data and recipe.
  • domain assumption Adversarial perturbations are gradient-aligned and concentrated in high frequencies removed by small median filters, while JPEG quantization at Q>=80 leaves a separable signature.
    This is the mechanistic hypothesis behind the purification signal (Section 6.3); the paper provides empirical support but no independent test of the mechanism.
  • domain assumption The organizers' scoring rules and the external benchmarks (FF++, BitMind, ImageCLEF test set) are correct and unbiased for evaluating the claims.
    All scores and AUROC values depend on these black-box evaluation protocols as ground truth.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Deepfake Generation and an Investigation of Purification-Based Adversarial Detection." pith.science (2026). https://pith.science/paper/RI74YK5F

@misc{pith2026260725842,
  author       = {Pith},
  title        = {Pith review of: Adversarial Deepfake Generation and an Investigation of Purification-Based Adversarial Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RI74YK5F}},
  note         = {Machine review of arXiv:2607.25842}
}
abstract

This paper describes the participation of team "Go To Germany" in the ImageCLEF 2026 Deepfake Detection and Generation Task. For the image generation task, we employ FLUX.1-dev with PuLID for identity-preserving face synthesis, combined with a multi-model PGD adversarial attack targeting 12 detectors simultaneously (DiffJPEG-in-loop, MI/DI/EoT, adaptive weighting, two-stage warm-start). Our approach achieved 90% evasion against organizer detectors and 57.6% against participant detectors, with a final generation score of 0.4170. For the image detection task, we combine two complementary detectors - SigLIP+DINOv2 for AI-generated images and GenD-DINOv3 for face manipulations - in a max-probability ensemble, achieving 99.4% accuracy on baseline deepfakes but suffering from high false-positive rates on real images, resulting in a final detection score of 0.6986. Beyond the official submission, we conducted a self-initiated investigation of purification-based adversarial detection, comparing three families of detection signals across six detectors that share a CLIP ViT-L/14 backbone. We find that raw $|\Delta \text{logit}|$ under median-3 purification, applied through the EFFORT detector, separates adversarial inputs from clean inputs with AUROC 0.81-0.98 across four adversarial source types - a finding that refutes the simple backbone-preservation hypothesis and exposes a sharp JPEG-quality cliff at Q70 where the signal collapses.

Figures

Figures reproduced from arXiv: 2607.25842 by the authors.

Figure 1
Figure 1. Base generation pipeline for one identity (ID_139, frame 3), shown at the final 256×256 submission resolution. (a) PuLID reference crop; (b) competition-supplied MediaPipe landmark map; (c) our OpenPose-style ControlNet input; (d) final submission image. Panel (d) was generated at 512×512 by FLUX.1-dev with PuLID identity injection and OpenPose-style ControlNet conditioning, downsampled to 256×256 via cv2.INTER_AREA… view at source ↗
Figure 2
Figure 2. Image detection pipeline. An input is first matched against the perceptual hashes of our own 1,002 generated submissions; an exact match short-circuits to Fake. Otherwise the image is scored by two complementary detectors — SigLIP+DINOv2 (AI-generated content) and GenD-DINOv3 (face manipulation) — and classified by the decision rule of Section 4.4. 4. Image Detection 4.1. Task Overview The detection task requires cl… view at source ↗
Figure 3
Figure 3. Section 6.2.2 — multi-layer Mahalanobis t-SNE on the pilot (a) and after refitting on the full test feature corpus (b) [PITH_FULL_IMAGE:figures/full_fig_p025_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Section 6.3.3 — EFFORT single median-3 AUROC across the JPEG quality range. The sharp transition between 𝑄70 and 𝑄80 (red shading) marks where adversarial residuals survive compression sufficiently to be discriminated; at 𝑄70 and below all sources collapse to random. A…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

60 extracted references · 6 linked inside Pith

  1. [1]

    Stanciu, A

    D. Stanciu, A. Radu, R. Bolborici, M. Negru, A. Ene, V. Vasilescu, A.-A. Nicolae, B. Ionescu, L. Ştefan, M. Constantin, M. Dogariu, A. Andrei, Overview of ImageCLEF 2026 deepfake task: Multimodal detection and generation of deepfakes, in: CLEF 2026 Working Notes, CEUR Workshop Proceedings, CEUR-WS.org, Jena, Germany, 2026

    2026

  2. [2]

    Yermakov, J

    A. Yermakov, J. Cech, J. Matas, M. Fritz, Deepfake detection that generalizes across benchmarks, in: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 2026, pp. 773–783

    2026

  3. [3]

    Z. Yan, J. Wang, Z. Wang, P. Jin, K.-Y. Zhang, et al., Orthogonal subspace decomposition for generalizable AI-generated image detection, in: Proceedings of the International Conference on Machine Learning (ICML), 2025. Oral

    2025

  4. [4]

    Ionescu, H

    B. Ionescu, H. Müller, D. Stanciu, et al., Overview of ImageCLEF 2026: Multimodal challenges in medicine, science, agritech, and security, in: Proceedings of the Seventeenth International Conference of the CLEF Association (CLEF 2026), Lecture Notes in Computer Science, Springer, Jena, Germany, 2026

    2026

  5. [5]

    L. Li, J. Bao, H. Yang, D. Chen, F. Wen, FaceShifter: Towards high fidelity and occlusion aware face swapping, arXiv preprint arXiv:1912.13457 (2019)

    arXiv 1912

  6. [6]

    R. Chen, X. Chen, B. Ni, Y. Ge, SimSwap: An efficient framework for high fidelity face swapping, in: Proceedings of the 28th ACM International Conference on Multimedia (MM), 2020, pp. 2003–2011

    2020

  7. [7]

    Thies, M

    J. Thies, M. Zollhöfer, M. Stamminger, C. Theobalt, M. Nießner, Face2Face: Real-time face capture and reenactment of RGB videos, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 2387–2395

    2016

  8. [8]

    Thies, M

    J. Thies, M. Zollhöfer, M. Nießner, Deferred neural rendering: Image synthesis using neural textures, ACM Transactions on Graphics (TOG) 38 (2019) 1–12

    2019

Show all 60 references
  1. [9]

    K. R. Prajwal, R. Mukhopadhyay, V. P. Namboodiri, C. V. Jawahar, A lip sync expert is all you need for speech to lip generation in the wild, in: Proceedings of the 28th ACM International Conference on Multimedia (MM), 2020, pp. 484–492

    2020

  2. [10]

    J. Ho, A. Jain, P. Abbeel, Denoising diffusion probabilistic models, in: Advances in Neural Information Processing Systems (NeurIPS), 2020

    2020

  3. [11]

    Rombach, A

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, B. Ommer, High-resolution image synthesis with latent diffusion models, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 10684–10695

    2022

  4. [12]

    Peebles, S

    W. Peebles, S. Xie, Scalable diffusion models with transformers, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023

    2023

  5. [13]

    Diffusion Transformer model used for face generation

    Black Forest Labs, FLUX.1-dev: An open-source diffusion transformer for image generation, https://huggingface.co/black-forest-labs/FLUX.1-dev, 2024. Diffusion Transformer model used for face generation

    2024

  6. [14]

    Zhang, A

    L. Zhang, A. Rao, M. Agrawala, Adding conditional control to text-to-image diffusion models, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 3836–3847

    2023

  7. [15]

    1-dev-ControlNet-Union-Pro-2.0, 2024

    Shakker Labs, FLUX.1-dev ControlNet Union Pro 2.0, https://huggingface.co/Shakker-Labs/FLUX. 1-dev-ControlNet-Union-Pro-2.0, 2024. Pretrained on OpenPose input convention

    2024

  8. [16]

    Z. Cao, G. Hidalgo, T. Simon, S.-E. Wei, Y. Sheikh, OpenPose: Realtime multi-person 2D pose esti- mation using part affinity fields, IEEE Transactions on Pattern Analysis and Machine Intelligence 43 (2019) 172–186

    2019

  9. [17]

    H. Ye, J. Zhang, S. Liu, X. Han, W. Yang, IP-Adapter: Text compatible image prompt adapter for text-to-image diffusion models, arXiv preprint arXiv:2308.06721 (2023)

    2023 arXiv

  10. [18]

    Z. Guo, Y. Wu, Z. Chen, L. Chen, Q. He, PuLID: Pure and lightning ID customization via contrastive alignment, arXiv preprint arXiv:2404.16022 (2024)

    2024 arXiv

  11. [19]

    L. Li, J. Bao, T. Zhang, H. Yang, D. Chen, F. Wen, B. Guo, Face X-ray for more general face forgery detection, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 5001–5010

    2020

  12. [20]

    Frank, T

    J. Frank, T. Eisenhofer, L. Schönherr, A. Fischer, D. Kolossa, T. Holz, Leveraging frequency analysis for deep fake image recognition, in: Proceedings of the International Conference on Machine Learning (ICML), 2020, pp. 3247–3258

    2020

  13. [21]

    Durall, M

    R. Durall, M. Keuper, J. Keuper, Watch your up-convolution: CNN-based generative deep neu- ral networks are failing to reproduce spectral distributions, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 7890–7899

    2020

  14. [22]

    Shiohara, T

    K. Shiohara, T. Yamasaki, Detecting deepfakes with self-blended images, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 18720–18729

    2022

  15. [23]

    Z. Yan, Y. Zhang, X. Yuan, S. Lyu, B. Wu, DeepfakeBench: A comprehensive benchmark of deepfake detection, in: Advances in Neural Information Processing Systems (NeurIPS), 2023, pp. 4534–4565

    2023

  16. [24]

    Z. Yan, Y. Luo, S. Lyu, Q. Liu, B. Wu, Transcending forgery specificity with latent space aug- mentation for generalizable deepfake detection, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024, pp. 8984–8994

    2024

  17. [25]

    R. Chen, J. Xi, Z. Yan, K.-Y. Zhang, S. Wu, J. Xie, X. Chen, L. Xu, I. Guan, T. Yao, S. Ding, Dual data alignment makes AI-generated image detector easier generalizable, in: Advances in Neural Information Processing Systems (NeurIPS), 2025

    2025

  18. [26]

    Haliassos, K

    A. Haliassos, K. Vougioukas, S. Petridis, M. Pantic, Lips don’t lie: A generalisable and robust approach to face forgery detection, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 5039–5049

    2021

  19. [27]

    Zheng, J

    Y. Zheng, J. Bao, D. Chen, M. Zeng, F. Wen, Exploring temporal coherence for more general video face forgery detection, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 15044–15054

    2021

  20. [28]

    U. Ojha, Y. Li, Y. J. Lee, Towards universal fake image detectors that generalize across generative models, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023, pp. 24480–24489

    2023

  21. [29]

    Radford, J

    A. Radford, J. W. Kim, C. Hallacy, et al., Learning transferable visual models from natural language supervision, in: Proceedings of the International Conference on Machine Learning (ICML), 2021, pp. 8748–8763

    2021

  22. [30]

    X. Zhai, B. Mustafa, A. Kolesnikov, L. Beyer, Sigmoid loss for language image pre-training, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023

    2023

  23. [31]

    Oquab, et al., DINOv2: Learning robust visual features without supervision, arXiv preprint arXiv:2304.07193 (2023)

    M. Oquab, et al., DINOv2: Learning robust visual features without supervision, arXiv preprint arXiv:2304.07193 (2023)

    2023 arXiv

  24. [32]

    Siméoni, H

    O. Siméoni, H. V. Vo, M. Seitzer, F. Baldassarre, M. Oquab, et al., DINOv3, arXiv preprint arXiv:2508.10104 (2025)

    2025 arXiv

  25. [33]

    E. J. Hu, Y. Shen, P. Wallis, et al., LoRA: Low-rank adaptation of large language models, in: Proceedings of the International Conference on Learning Representations (ICLR), 2022

    2022

  26. [34]

    C. Kong, H. Li, S. Wang, Enhancing general face forgery detection via vision transformer with low-rank adaptation, in: IEEE 6th International Conference on Multimedia Information Processing and Retrieval (MIPR), 2023, pp. 102–107

    2023

  27. [35]

    X. Cui, Y. Li, A. Luo, J. Zhou, J. Dong, Forensics adapter: Adapting CLIP for generalizable face forgery detection, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025, pp. 19207–19217

    2025

  28. [36]

    Kundu, H

    R. Kundu, H. Xiong, V. Mohanty, A. Balachandran, A. K. Roy-Chowdhury, Towards a universal synthetic video detector: From face or background manipulations to fully AI-generated content, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025

    2025

  29. [37]

    Huang, J

    Z. Huang, J. Li, H. Wen, T. Li, X. Yang, et al., Rethinking cross-generator image forgery detection through DINOv3, arXiv preprint arXiv:2511.22471 (2025)

    2025

  30. [38]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial examples, in: Proceedings of the International Conference on Learning Representations (ICLR), 2015

    2015

  31. [39]

    Kurakin, I

    A. Kurakin, I. J. Goodfellow, S. Bengio, Adversarial examples in the physical world, in: Proceedings of the International Conference on Learning Representations (ICLR) Workshop, 2017

    2017

  32. [40]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards deep learning models resistant to adversarial attacks, in: Proceedings of the International Conference on Learning Representations (ICLR), 2018

    2018

  33. [41]

    Carlini, D

    N. Carlini, D. Wagner, Towards evaluating the robustness of neural networks, in: Proceedings of the IEEE Symposium on Security and Privacy (S&P), 2017, pp. 39–57

    2017

  34. [42]

    Croce, M

    F. Croce, M. Hein, Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks, in: Proceedings of the International Conference on Machine Learning (ICML), 2020

    2020

  35. [43]

    Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, J. Li, Boosting adversarial attacks with momentum, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2018, pp. 9185–9193

    2018

  36. [44]

    C. Xie, Z. Zhang, Y. Zhou, S. Bai, J. Wang, Z. Ren, A. Yuille, Improving transferability of adversarial examples with input diversity, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 2730–2739

    2019

  37. [45]

    Athalye, L

    A. Athalye, L. Engstrom, A. Ilyas, K. Kwok, Synthesizing robust adversarial examples, in: Proceedings of the International Conference on Machine Learning (ICML), 2018, pp. 284–293

    2018

  38. [46]

    R. Shin, D. Song, JPEG-resistant adversarial images, in: NIPS 2017 Workshop on Machine Learning and Computer Security, 2017. Differentiable JPEG simulation

    2017

  39. [47]

    W. Xu, D. Evans, Y. Qi, Feature squeezing: Detecting adversarial examples in deep neural networks, in: Proceedings of the Network and Distributed System Security Symposium (NDSS), 2018

    2018

  40. [48]

    K. Lee, K. Lee, H. Lee, J. Shin, A simple unified framework for detecting out-of-distribution samples and adversarial attacks, in: Advances in Neural Information Processing Systems (NeurIPS), 2018

    2018

  41. [49]

    X. Ma, B. Li, Y. Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, J. Bailey, Characterizing adversarial subspaces using local intrinsic dimensionality, in: Proceedings of the International Conference on Learning Representations (ICLR), 2018

    2018

  42. [50]

    Rössler, D

    A. Rössler, D. Cozzolino, L. Verdoliva, C. Riess, J. Thies, M. Nießner, FaceForensics++: Learning to detect manipulated facial images, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019, pp. 1–11

    2019

  43. [51]

    Y. Li, X. Yang, P. Sun, H. Qi, S. Lyu, Celeb-DF: A large-scale challenging dataset for deepfake foren- sics, in: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 3207–3216

    2020

  44. [52]

    Dolhansky, R

    B. Dolhansky, R. Howes, B. Pflaum, N. Baram, C. C. Ferrer, The DeepFake detection challenge dataset, arXiv preprint arXiv:2006.07397 (2020)

    2006 arXiv

  45. [53]

    Z. Yan, T. Yao, S. Chen, Y. Zhao, X. Fu, J. Zhu, D. Luo, C. Wang, S. Ding, Y. Wu, et al., DF40: Toward next-generation deepfake detection, in: Advances in Neural Information Processing Systems (NeurIPS), 2024, pp. 29387–29434

    2024

  46. [54]

    M. Zhu, H. Chen, Q. Yan, X. Huang, G. Lin, W. Li, Z. Tu, H. Hu, J. Hu, Y. Wang, GenImage: A million-scale benchmark for detecting AI-generated image, in: Advances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  47. [55]

    Z. Wang, J. Bao, W. Zhou, W. Wang, H. Hu, H. Chen, H. Li, DIRE for diffusion-generated image detection, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 22445–22455

    2023

  48. [56]

    Cheng, Y

    H. Cheng, Y. Guo, T. Wang, L. Nie, M. Kankanhalli, Diffusion facial forgery detection, in: Proceedings of the 32nd ACM International Conference on Multimedia (MM), 2024

    2024

  49. [57]

    J. Deng, J. Guo, X. An, Z. Zhu, S. Zafeiriou, InsightFace: An open source 2d and 3d deep face analysis toolbox, https://github.com/deepinsight/insightface, 2018–present. buffalo_s model used for identity embedding

    2018

  50. [58]

    Hugging Face model repository

    Bombek, ai-image-detector-siglip-dinov2: Siglip + dinov2 lora fine-tuned detector for ai-generated images, https://huggingface.co/Bombek1/ai-image-detector-siglip-dinov2, 2025. Hugging Face model repository

    2025

  51. [59]

    Hugging Face model repository

    Yermandy, GenD_DINOv3_L: Dinov3 vit-l face-manipulation detector, https://huggingface.co/ yermandy/GenD_DINOv3_L, 2025. Hugging Face model repository

    2025

  52. [60]

    Hugging Face model repository

    Yermandy, GenD_CLIP_L_14: Clip vit-l/14 face-manipulation detector, https://huggingface.co/ yermandy/GenD_CLIP_L_14, 2025. Hugging Face model repository. (a) Pilot t-SNE: 400 pilot points (100 each from the four categories defined in Section 6.2.1) plus 500 random points from ...

    2025

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.