Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Active Adversarial Noise Suppression for Image Forgery Localization

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a learned pre-processing module can cancel adversarial noise in forged images, restoring forgery localization accuracy to roughly 90 percent or more of the original level without retraining the forensic model.

desk verdict Solid first defense for forgery localization with large non-adaptive gains, but the white-box claim needs adaptive evaluation before it earns the name. read the letter →

arxiv 2506.12871 v1 pith:MAJQBETC submitted 2025-06-15 cs.CV

Rongxuan Peng , Shunquan Tan , Xianbo Mo , Alex C. Kot , Jiwu Huang This is my paper
classification cs.CV
keywords imageforgerylocalizationadversarialdefensenoisesuppressionfeaturealignmentmask-guidedrefinementwhite-boxattackrobustnessdefensiveperturbation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a small preprocessing network, placed in front of any existing image forgery localization model, can cancel imperceptible adversarial noise before the model sees the image, so the model again finds the tampered region. It claims a two-stage training recipe: first align the forgery-relevant feature distributions of attacked and clean forged images, then refine the defensive perturbation using the predicted forgery mask as supervision. Trained only on one dataset and one attack, the module is reported to generalize to six white-box attacks and four datasets, restoring localization performance to roughly 90 percent or more of the original level while barely hurting performance on clean forged images. If right, the defense would work as a drop-in pre-filter that needs no retraining of the forensic model.

What carries the argument

The central object is the Adversarial Noise Suppression Module, a lightweight encoder-decoder that outputs a defensive perturbation added to the incoming image before the frozen forgery localization model runs. It is trained in two stages: Forgery-relevant Features Alignment minimizes channel-wise Kullback-Leibler divergence between middle-layer features of attacked and clean forged images extracted from the frozen victim model, and Mask-guided Refinement adds a dual-mask loss that supervises the module's output against the victim model's own mask on the clean image. This carries the argument because it targets the internal feature shift caused by adversarial noise rather than trying to reconstruct a clean image pixel by pixel.

What would settle it

Craft adversarial noise against the combined suppression-module-plus-victim pipeline in a white-box setting, using the same attack algorithms and budgets, and measure residual performance on the four datasets. If the module's accuracy falls back to the unprotected attack levels, or substantially below the reported 90 percent residual performance, the central claim about white-box robustness would be refuted.

Watch

Extended reading notes

Core claim

The central claim is that adversarial noise in forgery localization acts primarily by shifting the forgery-relevant internal features of the victim network, and that a defensive perturbation learned to reverse that shift can restore the network's output. The paper argues that pixel-space repairs fail because attacked and clean forged images are nearly indistinguishable in raw pixels yet clearly separated in feature space, and that aligning middle-layer features between the two, followed by mask-level supervision, is the mechanism that works. On the tested white-box attacks, FGSM, C&W, BIM, PGD, MI-FGSM, and PGN, and on four datasets, the optimized module is reported to recover the forgery localization model's residual performance to an overall level of at least 90 percent, with CoDE recovering from near-collapse to above 94 percent; applying the module to clean forged images leaves average residual performance between roughly 94 and 99 percent for the four models.

Load-bearing premise

Every test attack is computed against the unprotected forgery localization model alone and the defense is applied only afterward, so the reported robustness numbers assume an attacker who does not adapt to the presence of the pre-filter.

Editorial extensions

If this is right

  • A frozen forensic model can be hardened without retraining or access to its training set, because the module is inserted only at inference time.
  • Training on FGSM alone at one noise intensity generalizes empirically to C&W, BIM, PGD, MI-FGSM, and PGN attacks across datasets.
  • Applying the module to clean forged images causes only small degradation, so a defender does not need to detect an attack before activating it.
  • If the recovery figures hold, forensic systems can retain near-original localization accuracy even when an adversary crafts imperceptible noise against them.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, an adaptive attacker who computes gradients through both the suppression module and the victim model would be the decisive stress test, and the reported figures cannot rule out a sharp drop under that threat.
  • Beyond the paper, the feature-alignment principle should transfer to other pixel-level discriminative tasks, such as deepfake-frame localization or medical segmentation, where small input perturbations also displace internal features more than raw pixels.
  • Beyond the paper, the observed pixel-space overlap but feature-space separation suggests that monitoring feature drift of a frozen forensic model could serve as an unsupervised attack detector, flagging images for suppression processing only when needed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes an Adversarial Noise Suppression Module (ANSM), a preprocessing network that adds a defensive perturbation to the input forged image before it is passed to a frozen forgery localization model. The module is trained in two stages: Forgery-relevant Features Alignment (FFA), which minimizes channel-wise KL divergence between mid-layer features of the original and adversarially perturbed forged images, and Mask-guided Refinement (MgR), which supervises the predicted masks of both the adversarially perturbed and the clean forged images against the mask predicted on the original forged image. Experiments on four forgery localization models (IF-OSN, MVSS-Net, HDF-Net, CoDE), six attack algorithms (FGSM, C&W, BIM, PGD, MI-FGSM, PGN), and four datasets report large F1/RP recovery on adversarial inputs with relatively small degradation on clean inputs.

Significance. If the results hold, this is a useful and timely contribution: it is, to my knowledge, the first dedicated adversarial defense for image forgery localization, and it works as a plug-in preprocessing module without retraining the localization model. The strength of the empirical case is the generalization pattern: ANSM is trained only on CASIAv2 with FGSM, yet it is evaluated on six attack algorithms and four datasets, and the cross-attack recovery is large and consistent. The released source code and anti-forensics dataset are also valuable assets. The main weakness is that the claimed white-box robustness is evaluated only against attacks on the unprotected model, not against adaptive attacks on the full ANSM-plus-model pipeline. This makes the security claim broader than the evidence supports, though the method may still be valuable as a defense against non-adaptive or transfer-based attacks.

major comments (3)
  1. [Section V-A2, Section V-B, Eq. (6)] The white-box robustness claim is not yet supported by the evaluation protocol. In the experiments, adversarial images X_a are crafted against the unprotected forgery localization model V_theta, and ANSM is applied only afterward, as described in Section V-A2. However, in the stated threat model, the attacker has full knowledge of the system and can employ any attack algorithm. Because S_phi is a deterministic differentiable encoder-decoder (Eq. (6), Section IV-A), an adaptive attacker can compute gradients through the composed function F(X) = V_theta(TRUNC(X + S_phi(X))) and run FGSM, BIM, PGD, MI-FGSM, or C&W directly against F. Table III therefore demonstrates robustness against attacks that ignore the defense, not against white-box attacks on the protected pipeline. The authors should either add an adaptive-attack evaluation (e.g., end-to-end FGSM/PGD/C&W on the composed system) and report the resulting RPs, or explicitly restrict the claimed threat model to non-adaptive and transfer-based attacks. Without this, the headline 'white-box setting' claim in Section V-A2 and Section V-B is over-broad.
  2. [Section V-B, Table III] The statement that the optimized ANSM achieves 'an overall RP>=90%' is not supported by the per-cell numbers in Table III. For example, MVSS-Net on Columbia has RP values of 80.9% (BIM) and 80.8% (PGN), and CoDE on MISD drops to 91.8% even on original forged images. If 'overall' means an average across all entries, that should be stated with a precise aggregation rule; if it means every condition, it is contradicted. The same issue appears in the ablation Table VI, where IF-OSN with FFA+MgR(M_o) shows RP values of 82.3%, 83.6%, and 84.4% under PGN, PGD, and C&W, respectively. The central quantitative claim should be stated in a way that matches the reported data.
  3. [Section V-B, Section III-B] There is no quantitative comparison against existing adversarial defense baselines. Section III-B shows that conventional input transformations (JPEG compression, resizing, Gaussian noise, median filtering) fail, but the paper does not compare ANSM with learned input-purification methods such as Defense-GAN or GDMP, nor with an adversarially trained forgery localization model. Since the contribution is framed as a defense method, a comparison against at least one prior defense strategy adapted to forgery localization would strengthen the claims and clarify the incremental value. If such baselines are not applicable to the pixel-level forgery localization task, the authors should say so explicitly and justify why.
minor comments (6)
  1. [Figure 1] The word 'impercetible' in the figure is a typo; it should be 'imperceptible'.
  2. [Section V-B] 'Attribute to the two-stage training strategy' should be 'Attributed to the two-stage training strategy'.
  3. [Table II] The text in Section V-A5 says that batch size settings are detailed in Table II, but Table II has no batch size column; please add it or remove the reference.
  4. [Eq. (11)] The smoothed KL divergence formula is written as KL(m||q) = (1/N) sum_i m_i log((m_i + alpha)/(q_i + alpha)), but after Softmax_C the distributions sum to 1 and the addition of alpha without renormalization changes the distribution. Since alpha is tiny and the formula is used only as a training loss, the issue is minor, but the authors should clarify whether renormalization is applied or why the unnormalized form is acceptable.
  5. [Algorithm 1] Line 5 refers to {F_i_o} and {F_i_pa} while Eqs. (7)-(8) use F_o^(i) and F_pa^(i); the notation should be made consistent throughout the pseudocode and equations.
  6. [Abstract and Conclusion] 'To our best knowledge' appears in the abstract and elsewhere; the correct phrase is 'To the best of our knowledge'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the ANSM is trained against external targets (the frozen victim model's features and masks), and the headline cross-attack results are genuine extrapolations.

full rationale

The ANSM's two-stage training optimizes L_FFA (alignment of V_theta's intermediate features between X_o and X_pa) and L_MgR (mask supervision from M_o), so the supervision targets are the frozen victim model's outputs and the clean image's predicted mask, not the defense's own output. The headline claim of RP>=90% is evaluated on attack algorithms (C&W, BIM, PGD, MI-FGSM, PGN) not used to generate the training set, and on datasets (Columbia, CASIAv1, IMD20, MISD) other than the CASIAv2 training split, so the cross-attack and cross-dataset results are not forced by construction. The self-citations (CoDE as a victim model, prior black-box attack work) are not load-bearing: CoDE is an open-sourced benchmark model, and the vulnerability of forgery localizers is also demonstrated by the paper's own measurements. Two methodological weaknesses are noted but do not constitute definitional circularity: MgR explicitly trains P_po to match M_o, so the reported preservation on original forged images is partly an optimization target, and the feature-depth ablation in Section V-D is performed on the same CASIAv1/IMD20/MISD test sets later used for final evaluation, which can inflate numbers through selection. These affect validity and generalizability, not the derivational equivalence of the central claim.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The method is a supervised learning pipeline and does not introduce new physical entities. Its load-bearing premises are that adversarial noise is additive and that feature-space alignment transfers from FGSM to other attacks. The main manually set values are the BCE/Dice weight, the aligned feature depth, and the training attack budget.

free parameters (3)
  • lambda_bce = 0.3
    Weight between BCE and Dice loss in Eq. (16), set experimentally rather than derived.
  • aligned feature depth = middle one-third of layers
    Ablation on test sets (Table IV) selects middle layers; this is a hand-chosen design decision that directly affects FFA behavior.
  • FGSM training intensity = phi = 3/255
    Adversarial training set D_a uses FGSM with fixed intensity 3/255 (Section V-D); the defense is assumed to generalize to attacks of equal or smaller budget.
assumptions (3)
  • domain assumption Adversarial noise is additive: X_a = X_o + xi (Eq. 3, Eq. 5).
    ANSM's corrective perturbation is added in the same input space; non-additive attacks such as patches or geometric transformations are not modeled.
  • domain assumption Attacks are generated against the unprotected model V_theta, not against the full defended pipeline.
    Section V-A2 creates X_a from X_o and V_theta; ANSM is applied only afterwards. This excludes adaptive white-box attackers.
  • ad hoc to paper Channel-wise KL alignment of mid-level features can restore mask-level predictions after adding a defensive perturbation.
    This is the core FFA hypothesis; the paper notes in Section IV-C that FFA alone does not guarantee pixel precision, so it is supplemented with MgR.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Active Adversarial Noise Suppression for Image Forgery Localization." pith.science (2026). https://pith.science/paper/MAJQBETC

@misc{pith2026250612871,
  author       = {Pith},
  title        = {Pith review of: Active Adversarial Noise Suppression for Image Forgery Localization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MAJQBETC}},
  note         = {Machine review of arXiv:2506.12871}
}
read the original abstract

Recent advances in deep learning have significantly propelled the development of image forgery localization. However, existing models remain highly vulnerable to adversarial attacks: imperceptible noise added to forged images can severely mislead these models. In this paper, we address this challenge with an Adversarial Noise Suppression Module (ANSM) that generate a defensive perturbation to suppress the attack effect of adversarial noise. We observe that forgery-relevant features extracted from adversarial and original forged images exhibit distinct distributions. To bridge this gap, we introduce Forgery-relevant Features Alignment (FFA) as a first-stage training strategy, which reduces distributional discrepancies by minimizing the channel-wise Kullback-Leibler divergence between these features. To further refine the defensive perturbation, we design a second-stage training strategy, termed Mask-guided Refinement (MgR), which incorporates a dual-mask constraint. MgR ensures that the perturbation remains effective for both adversarial and original forged images, recovering forgery localization accuracy to their original level. Extensive experiments across various attack algorithms demonstrate that our method significantly restores the forgery localization model's performance on adversarial images. Notably, when ANSM is applied to original forged images, the performance remains nearly unaffected. To our best knowledge, this is the first report of adversarial defense in image forgery localization tasks. We have released the source code and anti-forensics dataset.

Figures

Figures reproduced from arXiv: 2506.12871 by the authors.

Figure 1
Figure 1. The diagram of forensics and anti-forensics. Once an attacker [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Visual comparisons before and after adversarial attack. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Defense effect of common defensive strategies. [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: Visualized distribution among 500 pairs of original forged images (red [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: The proposed defensive framework for image forgery localization task. [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Visual comparisons under various adversarial attacks. The forged area is denoted by white color and pristine area is denoted by black color. The [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Visualization of forgery-relevant features using the dimensionality reduction algorithm UMAP. The first row presents the results between [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. ForensicsSAM: Toward Robust and Unified Image Forgery Detection and Localization Resisting to Adversarial Attack

    cs.CV 2025-08 unverdicted novelty 6.0 of 10

    ForensicsSAM adds forgery- and adversary-specialized experts to the Segment Anything Model, claiming state-of-the-art forgery detection and localization that resists multiple attack methods.

Reference graph

Works this paper leans on

55 extracted references · 41 canonical work pages · cited by 1 Pith paper

  1. [1]

    Deep matching and validation network: An end-to-end solution to constrained image splicing localization and detection,

    Y . Wu, W. Abd-Almageed, and P. Natarajan, “Deep matching and validation network: An end-to-end solution to constrained image splicing localization and detection,” inProceedings of the 25th ACM Interna- tional Conference on Multimedia (ACM MM), 2017, pp. 1480–1502

    work page 2017

  2. [2]

    Color noise-based fea- ture for splicing detection and localization,

    C. Destruel, V . Itier, O. Strauss, and W. Puech, “Color noise-based fea- ture for splicing detection and localization,” inIEEE 20th International Workshop on Multimedia Signal Processing (MMSP), 2018, pp. 1–6

    work page 2018

  3. [3]

    Multi- task SE-network for image splicing localization,

    Y . Zhang, G. Zhu, L. Wu, S. Kwong, H. Zhang, and Y . Zhou, “Multi- task SE-network for image splicing localization,”IEEE Transactions on Circuits and Systems for Video Technology (TCSVT), vol. 32, no. 7, pp. 4828–4840, 2021

    work page 2021

  4. [4]

    BusterNet: Detecting copy-move image forgery with source/target localization,

    Y . Wu, W. Abd-Almageed, and P. Natarajan, “BusterNet: Detecting copy-move image forgery with source/target localization,” inProceed- ings of the European Conference on Computer Vision (ECCV), 2018, pp. 168–184

    work page 2018

  5. [5]

    DOA-GAN: Dual-order attentive generative adversarial network for image copy-move forgery detection and localization,

    A. Islam, C. Long, A. Basharat, and A. Hoogs, “DOA-GAN: Dual-order attentive generative adversarial network for image copy-move forgery detection and localization,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 4676– 4685

    work page 2020

  6. [6]

    A deep learning approach to patch-based image inpainting forensics,

    X. Zhu, Y . Qian, X. Zhao, B. Sun, and Y . Sun, “A deep learning approach to patch-based image inpainting forensics,”Signal Processing: Image Communication, vol. 67, pp. 90–99, 2018

    work page 2018

  7. [7]

    Spatiotemporal trident networks: detection and localization of object removal tampering in video passive forensics,

    Q. Yang, D. Yu, Z. Zhang, Y . Yao, and L. Chen, “Spatiotemporal trident networks: detection and localization of object removal tampering in video passive forensics,”IEEE Transactions on Circuits and Systems for Video Technology (TCSVT), vol. 31, no. 10, pp. 4131–4144, 2020

    work page 2020

  8. [8]

    PSCC-Net: Progressive spatio- channel correlation network for image manipulation detection and localization,

    X. Liu, Y . Liu, J. Chen, and X. Liu, “PSCC-Net: Progressive spatio- channel correlation network for image manipulation detection and localization,”IEEE Transactions on Circuits and Systems for Video Technology (TCSVT), 2022

    work page 2022

Show all 55 references
  1. [9]

    Learning JPEG compression artifacts for image manipulation detection and lo- calization,

    M.-J. Kwon, S.-H. Nam, I.-J. Yu, H.-K. Lee, and C. Kim, “Learning JPEG compression artifacts for image manipulation detection and lo- calization,”International Journal of Computer Vision (IJCV), vol. 130, no. 8, pp. 1875–1895, 2022

    2022

  2. [10]

    MVSS-Net: Multi- view multi-scale supervised networks for image manipulation detection,

    C. Dong, X. Chen, R. Hu, J. Cao, and X. Li, “MVSS-Net: Multi- view multi-scale supervised networks for image manipulation detection,” IEEE Transactions on Pattern Analysis and Machine Intelligence (T- PAMI), vol. 45, no. 3, pp. 3539–3553, 2022. 13

    2022

  3. [11]

    Robust image forgery detection against transmission over online social networks,

    H. Wu, J. Zhou, J. Tian, J. Liu, and Y . Qiao, “Robust image forgery detection against transmission over online social networks,”IEEE Trans- actions on information Forensics and Security (T-IFS), vol. 17, pp. 443– 456, 2022

    2022

  4. [12]

    Employing reinforcement learning to construct a decision-making environment for image forgery localization,

    R. Peng, S. Tan, X. Mo, B. Li, and J. Huang, “Employing reinforcement learning to construct a decision-making environment for image forgery localization,”IEEE Transactions on information Forensics and Security (T-IFS), vol. 17, pp. 4820–4834, 2024

    2024

  5. [13]

    HDF-Net: Capturing homogeny difference features to localize the tampered image,

    R. Han, X. Wang, N. Bai, Y . Wang, J. Hou, and J. Xue, “HDF-Net: Capturing homogeny difference features to localize the tampered image,” IEEE Transactions on Pattern Analysis and Machine Intelligence (T- PAMI), 2024

    2024

  6. [14]

    Poster: Query-efficient black- box attack for image forgery localization via reinforcement learning,

    X. Mo, S. Tan, B. Li, and J. Huang, “Poster: Query-efficient black- box attack for image forgery localization via reinforcement learning,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (ACM CCS), 2023, pp. 3552–3554

    2023

  7. [15]

    Query-efficient attack for black-box image inpainting forensics via reinforcement learning,

    X. Mo, S. Tan, B. Li, and J. Huang, “Query-efficient attack for black-box image inpainting forensics via reinforcement learning,” inProceedings of the AAAI Conference on Artificial Intelligence (AAAI), vol. 39, no. 18, 2025, pp. 19 503–19 511

    2025

  8. [16]

    How deep learning sees the world: A survey on adversarial attacks & defenses,

    J. C. Costa, T. Roxo, H. Proenc ¸a, and P. R. In ´acio, “How deep learning sees the world: A survey on adversarial attacks & defenses,”IEEE Access, 2024

    2024

  9. [17]

    Image tampering local- ization using a dense fully convolutional network,

    P. Zhuang, H. Li, S. Tan, B. Li, and J. Huang, “Image tampering local- ization using a dense fully convolutional network,”IEEE Transactions on Information Forensics and Security, vol. 16, pp. 2986–2999, 2021

    2021

  10. [18]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770–778

    2016

  11. [19]

    Recalibrating fully convo- lutional networks with spatial and channel “squeeze and excitation

    A. G. Roy, N. Navab, and C. Wachinger, “Recalibrating fully convo- lutional networks with spatial and channel “squeeze and excitation” blocks,”IEEE Transactions on Medical Imaging (TMI), vol. 38, no. 2, pp. 540–549, 2018

    2018

  12. [20]

    U-Net: Convolutional net- works for biomedical image segmentation,

    O. Ronneberger, P. Fischer, and T. Brox, “U-Net: Convolutional net- works for biomedical image segmentation,” inMedical image computing and computer-assisted intervention–MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part III

    2015

  13. [21]

    Springer, 2015, pp. 234–241

    2015

  14. [22]

    Asynchronous methods for deep rein- forcement learning,

    V . Mnih, A. P. Badia, M. Mirza, A. Graves, T. Lillicrap, T. Harley, D. Silver, and K. Kavukcuoglu, “Asynchronous methods for deep rein- forcement learning,” inInternational Conference on Machine Learning (ICML). PMLR, 2016, pp. 1928–1937

    2016

  15. [23]

    Rich models for steganalysis of digital images,

    J. Fridrich and J. Kodovsky, “Rich models for steganalysis of digital images,”IEEE Transactions on information Forensics and Security (T- IFS), vol. 7, no. 3, pp. 868–882, 2012

    2012

  16. [24]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv:1412.6572, 2014

    2014 arXiv

  17. [25]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” inIEEE Symposium on Security and Privacy (S&P), 2017, pp. 39–57

    2017

  18. [26]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” inArtificial Intelligence Safety and Security. Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  19. [27]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations (ICLR), 2018

    2018

  20. [28]

    Adversarial attacks for image segmentation on multiple lightweight models,

    X. Kang, B. Song, X. Du, and M. Guizani, “Adversarial attacks for image segmentation on multiple lightweight models,”IEEE Access, vol. 8, pp. 31 359–31 370, 2020

    2020

  21. [29]

    Adversarial attacks on yolact instance segmentation,

    Z. Zhang, S. Huang, X. Liu, B. Zhang, and D. Dong, “Adversarial attacks on yolact instance segmentation,”Computers & Security, vol. 116, p. 102682, 2022

    2022

  22. [30]

    Proximal splitting adversarial attack for semantic segmentation,

    J. Rony, J.-C. Pesquet, and I. Ben Ayed, “Proximal splitting adversarial attack for semantic segmentation,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023, pp. 20 524–20 533

    2023

  23. [31]

    Universal adversarial perturbations against object detection,

    D. Li, J. Zhang, and K. Huang, “Universal adversarial perturbations against object detection,”Pattern Recognition (PR), vol. 110, p. 107584, 2021

    2021

  24. [32]

    Adc: Adversarial attacks against object detection that evade context consistency checks,

    M. Yin, S. Li, C. Song, M. S. Asif, A. K. Roy-Chowdhury, and S. V . Krishnamurthy, “Adc: Adversarial attacks against object detection that evade context consistency checks,” inProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 2022, pp. 3278–3287

    2022

  25. [33]

    Adversarial patch attacks against aerial imagery object detectors,

    G. Tang, T. Jiang, W. Zhou, C. Li, W. Yao, and Y . Zhao, “Adversarial patch attacks against aerial imagery object detectors,”Neurocomputing, vol. 537, pp. 128–140, 2023

    2023

  26. [34]

    Adversarial risk and the dangers of evaluating against weak attacks,

    J. Uesato, B. O’donoghue, P. Kohli, and A. Oord, “Adversarial risk and the dangers of evaluating against weak attacks,” inInternational Conference on Machine Learning (ICML). PMLR, 2018, pp. 5025– 5034

    2018

  27. [35]

    Square attack: a query-efficient black-box adversarial attack via random search,

    M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square attack: a query-efficient black-box adversarial attack via random search,” inProceedings of the European Conference on Computer Vision (ECCV), 2020, pp. 484–501

    2020

  28. [36]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inProceedings of the IEEE Con- ference on Computer Vision and Pattern Recognition (CVPR), 2018, pp. 9185–9193

    2018

  29. [37]

    Boosting adversarial transferability by achieving flat local maxima,

    Z. Ge, H. Liu, W. Xiaosen, F. Shang, and Y . Liu, “Boosting adversarial transferability by achieving flat local maxima,”Advances in Neural Information Processing Systems (NIPS), vol. 36, pp. 70 141–70 161, 2023

    2023

  30. [38]

    Robustness may be at odds with accuracy,

    D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry, “Robustness may be at odds with accuracy,” inInternational Conference on Learning Representations (ICLR), no. 2019, 2019

    2019

  31. [39]

    A study of the effect of jpg compression on adversarial images,

    G. K. Dziugaite, Z. Ghahramani, and D. M. Roy, “A study of the effect of jpg compression on adversarial images,”arXiv preprint arXiv:1608.00853, 2016

    2016 arXiv

  32. [40]

    Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression,

    N. Das, M. Shanbhogue, S.-T. Chen, F. Hohman, L. Chen, M. E. Kounavis, and D. H. Chau, “Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression,”arXiv preprint arXiv:1705.02900, 2017

    2017 arXiv

  33. [41]

    Adversarial examples for semantic segmentation and object detection,

    C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” inProceed- ings of the IEEE International Conference on Computer Vision (ICCV), 2017, pp. 1369–1378

    2017

  34. [42]

    Defense-gan: Protect- ing classifiers against adversarial attacks using generative models,

    P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protect- ing classifiers against adversarial attacks using generative models,” in International Conference on Learning Representations (ICLR), 2018

    2018

  35. [43]

    Collaborative defense- gan for protecting adversarial attacks on classification system,

    P. Laykaviriyakul and E. Phaisangittisagul, “Collaborative defense- gan for protecting adversarial attacks on classification system,”Expert Systems with Applications, vol. 214, p. 118957, 2023

    2023

  36. [44]

    Guided diffusion model for adversarial purification,

    J. Wang, Z. Lyu, D. Lin, B. Dai, and H. Fu, “Guided diffusion model for adversarial purification,”arXiv preprint arXiv:2205.14969, 2022

    2022 arXiv

  37. [45]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Advances in Neural Information Processing Systems (NIPS), vol. 33, pp. 6840–6851, 2020

    2020

  38. [46]

    UMAP: Uniform manifold approximation and projection for dimension reduction,

    L. McInnes, J. Healy, and J. Melville, “UMAP: Uniform manifold approximation and projection for dimension reduction,”arXiv preprint arXiv:1802.03426, 2018

    2018 arXiv

  39. [47]

    EfficientNet: Rethinking model scaling for convolu- tional neural networks,

    M. Tan and Q. Le, “EfficientNet: Rethinking model scaling for convolu- tional neural networks,” inProceedings of the International Conference on Machine Learning (ICML), 2019, pp. 6105–6114

    2019

  40. [48]

    ImageNet Large Scale Visual Recognition Challenge,

    O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, A. C. Berg, and L. Fei-Fei, “ImageNet Large Scale Visual Recognition Challenge,” International Journal of Computer Vision (IJCV), vol. 115, no. 3, pp. 211–252, 2015

    2015

  41. [49]

    Visualizing and understanding convo- lutional networks,

    M. D. Zeiler and R. Fergus, “Visualizing and understanding convo- lutional networks,” inComputer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part I 13. Springer, 2014, pp. 818–833

    2014

  42. [50]

    V-net: Fully convolutional neural networks for volumetric medical image segmentation,

    F. Milletari, N. Navab, and S.-A. Ahmadi, “V-net: Fully convolutional neural networks for volumetric medical image segmentation,” in2016 fourth international conference on 3D vision (3DV). Ieee, 2016, pp. 565–571

    2016

  43. [51]

    A data set of authentic and spliced image blocks,

    T.-T. Ng, S.-F. Chang, and Q. Sun, “A data set of authentic and spliced image blocks,”ADVENT Technical Report, pp. 203–2004, 2004

    2004

  44. [52]

    Casia image tampering detection eval- uation database,

    J. Dong, W. Wang, and T. Tan, “Casia image tampering detection eval- uation database,” inIEEE China Summit and International Conference on Signal and Information Processing (ChinaSIP), 2013, pp. 422–426

    2013

  45. [53]

    IMD2020: a large-scale annotated dataset tailored for detecting manipulated images,

    A. Novozamsky, B. Mahdian, and S. Saic, “IMD2020: a large-scale annotated dataset tailored for detecting manipulated images,” inProceed- ings of the IEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACV), 2020, pp. 71–80

    2020

  46. [54]

    Multiple image splicing dataset (MISD): a dataset for multiple splicing,

    K. D. Kadam, S. Ahirrao, and K. Kotecha, “Multiple image splicing dataset (MISD): a dataset for multiple splicing,”Data, vol. 6, no. 10, p. 102, 2021

    2021

  47. [55]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv:1412.6980, 2014

    2014 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.