Papers

Field

Top tools here

Open problems in Adversarial training

Robust adversarial detection with theoretical guarantees3 papers raise it · 3 address it
Current detectors rely on heuristics and fail under adaptive attacks, leaving models vulnerable to adversarial inputs.
Emergent misalignment in multimodal models1 paper raises it · 1 addresses it
Fine-tuning on narrow tasks can induce broadly harmful behaviors in vision-language models, but its mechanisms and mitigation are poorly understood.
- Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises · addresses
Safe and high-quality generation trade-off1 paper raises it · 1 addresses it
Restricting training data for safety reduces model quality, while post-hoc unlearning risks catastrophic forgetting.
- Pristine Modelsraises · addresses
Robustness of decision models under adversarial manipulation1 paper raises it · 1 addresses it
Decision models are increasingly used for automated tasks, but their reliability under attacks is untested and unstandardized.
- DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
Watermark removal resilience1 paper raises it · 2 address it
Invisible watermarks for ownership verification are vulnerable to simple, training-free attacks that preserve image quality.
- BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Paintingraises · addresses
- SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verificationaddresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

deepfake detection · forensic cues · image forgery107 papers21 this week
adversarial training · adversarial attacks · adversarial images107 papers13 this week
watermarking schemes · watermarking · based watermarking76 papers10 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Coming with more sources: repos

Activity

Recent papers

All in Research →

arXiv cs.CRSep 25
FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models
Haoyang Li, Ruoxi Sun, Qingqing Ye, Benjamin Zi Hao Zhao, Yaxin Xiao +2
Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual. A common countermeasure is to embed imperceptible, low-energy watermarks, yet recent studies show these signatures are brittle: modest post-processing or lightweight adversarial perturbations readily suppress detection, exposing a fundamental tension between imperceptibility and robustness. We introduce FeatMark, a watermarking framework that shifts from pixel-level, energy-starved perturbations to inconspicuous semantic features: small, scene-consistent micro-features that remain natural to humans while providing a stronger, machine-verifiable provenance signal. FeatMark builds domain-specific feature banks that encode each watermark as a compact concept program, pairing open-vocabulary semantic cues with reliable edit regions and instruction templates. It then automatically selects features that are both feasible and executable and injects them through modular, mask-guided concept editing, yielding highly localized, scene-consistent micro-edits that are difficult to perceive. We…
PDF arXiv
arXiv cs.CVSep 25
ManiVid: Unified and Explainable Forensic Analysis of Manipulated Videos
Hengrui Kang, Zhonghao Yan, Yuxuan Yang, Ruoyan Jing, Yuncheng Guo +5
Rapid advances in AI-generated video (AIGV) have increased the risks posed by deceptive video manipulation. Unlike fully synthetic videos, manipulated videos retain most source content and alter only localized regions, making forensic analysis particularly challenging. Existing video forgery research faces two limitations in both data and methodology: (1) High-quality datasets and benchmarks tailored for manipulated videos remain scarce. (2) Multimodal large language models (MLLMs) extend forgery analysis beyond binary classification but struggle to use low-level forensic cues and provide precise pixel-level grounding. Specifically, we introduce ManiVid, a unified forensic analysis task covering forgery detection, artifact grounding, and anomaly explanation for manipulated videos. We construct ManiVid-38K, the first dataset to combine paired, open-vocabulary localized manipulations of general videos with authenticity labels, forgery masks, and anomaly explanations. It comprises about 19K manually verified real-fake video pairs, mostly at 1080P resolution, generated under 2 paradigms with 15 powerful generation models. We sample 1K pairs for ManiVidBench, balanced across six…
PDF arXiv
arXiv cs.CVSep 25
MM-VeriAgent: Learning to Use Extensive Tools to Verify Multimodal Misinformation with Reinforcement Learning
Peipei Li, Shuhan Xia, Shengyang Liu, Zekun Li, Ran He
Real-world multimodal misinformation often involves mixed forgery sources, requiring sample-specific detection strategies. Existing tool-augmented methods rely on predefined workflows or inference-time planning, limiting adaptability or increasing inference cost. To address this issue, we introduce \textbf{MM-VeriAgent}, which learns to verify mixed-source multimodal misinformation with tools. We first build \textbf{MM-VeriTools}, a specialized toolkit for misinformation detection agents. By benchmarking various candidate models and methods on the sub-tasks required by mixed-source detection, we select the strongest for textual, visual, and cross-modal forgery analysis and encapsulate them as callable tools with a unified interface. On top of this toolkit, we train the LVLM agent with reinforcement learning to teach it how to use these tools to better solve mixed-source detection. Since many of the tools are specialized models whose online execution at every rollout severely limits RL efficiency, we further introduce \textbf{Tool-Execution Cache}, which pre-executes candidate tool calls and reuses their cached outputs during training. This preserves multi-step rollouts while…
PDF arXiv
arXiv cs.CVSep 24
UNMATCH: Selective Unbalanced Token-Patch Matching for Forensic Image-Claim Verification
Xinjin Li, Lian Lian, Yuanzhe Yang, Yudi Xia, Calvin Chang Liu +4
Contextual image misuse pairs an image with a misleading claim. We study image-claim correspondence in fact-checked pairs containing out-of-context reuse, visual manipulation, or both. Existing pair-based detectors often compress the two modalities into a global compatibility score or learn a highly flexible interaction module, which can obscure a decisive local mismatch. We introduce directional multiscale coverage, a compact representation that summarizes local image-claim affinity in both directions and at three spatial scales. At each scale, each direction is summarized by its mean, lower quartile, and two thresholded support ratios; the signed difference between directional means completes a nine-dimensional scale descriptor. Concatenating the three scales yields a compact local representation for a lightweight global-local classifier. Under leakage-aware three-fold, three-seed evaluation on the Snopes subset of the Fauxtography benchmark, UNMATCH achieves 69.82 Macro-F1 and 71.05 balanced accuracy, exceeding the MCOT adaptation by 2.60 and 2.16 points. A matched-reassigned intervention shows that breaking the observed pairing lowers coverage and increases both discrepancy…
PDF arXiv
arXiv cs.CRSep 24
TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement
Haoyang Li, Yaxin Xiao, Linyan Dai, Jiawen Fu, Zi Liang +3
Multimodal training relies on image-text corpora collected from external sources, creating opportunities for attackers to poison the data. Stealthy attacks can preserve plausible image-text pairs while concealing the differences used by detectors, so apparently clean data can still redirect the trained model. We therefore ask which properties a poison set must preserve for the attack to remain effective. A small poison set must still exert enough collective influence during training to induce the attacker's target behavior. We analyze this influence in terms of how often an attack pattern occurs and how strongly the examples carrying it jointly affect the model. This analysis motivates six corpus-level features that examine cross-modal neighborhoods, recurring text, and changes after text-span erasure without training the victim model. We introduce TraceGuard, an adaptive rank-based filtering method that uses agreement among complementary feature rankings to identify suspicious examples. It refines the selected set through shared patterns and adapts the removal threshold to each corpus without knowing the attack or poison rate. Across 19 attack configurations spanning image-text…
PDF arXiv
arXiv cs.CVSep 24
EIB-Net: Entropy-Guided Information Bottleneck for Generalizable AI-Generated Image Detection
Zhida Zhang, Xinlei Ma, Jie Cao
The proliferation of photorealistic AI-generated images demands robust detection methods that generalize across diverse generative models. While existing approaches target manipulation-based forgeries with local artifacts, generation-based images (e.g., from diffusion models) lack such traces, posing a fundamental challenge. We observe that generative models prioritize global semantics at the expense of local texture fidelity, making low-texture regions key indicators of synthetic origin. To exploit this, we propose EIB-Net, an Entropy-guided Information Bottleneck Network. EIB-Net introduces a novel Image Entropy (IE) metric to automatically select the most informative (lowest-entropy) patch, then processes it with a Variational Information Bottleneck (VIB) to learn compact, generalizable features. Extensive experiments on DIFF, DiffusionForensics, and GenImage benchmarks demonstrate state-of-the-art performance: EIB-Net achieves 85.7\% accuracy using only 2\% of training data, outperforming full-image baselines by over 15\%, and maintains robust cross-generator generalization (83.5\% average accuracy on GenImage). Furthermore, our entropy-guided patch selection (EGPL)…
PDF arXiv

Papers

Topics in this field

deepfake detection · forensic cues · image forgery107 papers21 this week
adversarial training · adversarial attacks · adversarial images107 papers13 this week
watermarking schemes · watermarking · based watermarking76 papers10 this week

Active contributors · 90 days

Recent papers

All in Research →

arXiv cs.CRSep 25
FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models
Haoyang Li, Ruoxi Sun, Qingqing Ye, Benjamin Zi Hao Zhao, Yaxin Xiao +2
Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual. A common countermeasure is to embed imperceptible, low-energy watermarks, yet recent studies show these signatures are brittle: modest post-processing or lightweight adversarial perturbations readily suppress detection, exposing a fundamental tension between imperceptibility and robustness. We introduce FeatMark, a watermarking framework that shifts from pixel-level, energy-starved perturbations to inconspicuous semantic features: small, scene-consistent micro-features that remain natural to humans while providing a stronger, machine-verifiable provenance signal. FeatMark builds domain-specific feature banks that encode each watermark as a compact concept program, pairing open-vocabulary semantic cues with reliable edit regions and instruction templates. It then automatically selects features that are both feasible and executable and injects them through modular, mask-guided concept editing, yielding highly localized, scene-consistent micro-edits that are difficult to perceive. We…
PDF arXiv
arXiv cs.CVSep 25
ManiVid: Unified and Explainable Forensic Analysis of Manipulated Videos
Hengrui Kang, Zhonghao Yan, Yuxuan Yang, Ruoyan Jing, Yuncheng Guo +5
Rapid advances in AI-generated video (AIGV) have increased the risks posed by deceptive video manipulation. Unlike fully synthetic videos, manipulated videos retain most source content and alter only localized regions, making forensic analysis particularly challenging. Existing video forgery research faces two limitations in both data and methodology: (1) High-quality datasets and benchmarks tailored for manipulated videos remain scarce. (2) Multimodal large language models (MLLMs) extend forgery analysis beyond binary classification but struggle to use low-level forensic cues and provide precise pixel-level grounding. Specifically, we introduce ManiVid, a unified forensic analysis task covering forgery detection, artifact grounding, and anomaly explanation for manipulated videos. We construct ManiVid-38K, the first dataset to combine paired, open-vocabulary localized manipulations of general videos with authenticity labels, forgery masks, and anomaly explanations. It comprises about 19K manually verified real-fake video pairs, mostly at 1080P resolution, generated under 2 paradigms with 15 powerful generation models. We sample 1K pairs for ManiVidBench, balanced across six…
PDF arXiv
arXiv cs.CVSep 25
MM-VeriAgent: Learning to Use Extensive Tools to Verify Multimodal Misinformation with Reinforcement Learning
Peipei Li, Shuhan Xia, Shengyang Liu, Zekun Li, Ran He
Real-world multimodal misinformation often involves mixed forgery sources, requiring sample-specific detection strategies. Existing tool-augmented methods rely on predefined workflows or inference-time planning, limiting adaptability or increasing inference cost. To address this issue, we introduce \textbf{MM-VeriAgent}, which learns to verify mixed-source multimodal misinformation with tools. We first build \textbf{MM-VeriTools}, a specialized toolkit for misinformation detection agents. By benchmarking various candidate models and methods on the sub-tasks required by mixed-source detection, we select the strongest for textual, visual, and cross-modal forgery analysis and encapsulate them as callable tools with a unified interface. On top of this toolkit, we train the LVLM agent with reinforcement learning to teach it how to use these tools to better solve mixed-source detection. Since many of the tools are specialized models whose online execution at every rollout severely limits RL efficiency, we further introduce \textbf{Tool-Execution Cache}, which pre-executes candidate tool calls and reuses their cached outputs during training. This preserves multi-step rollouts while…
PDF arXiv
arXiv cs.CVSep 24
UNMATCH: Selective Unbalanced Token-Patch Matching for Forensic Image-Claim Verification
Xinjin Li, Lian Lian, Yuanzhe Yang, Yudi Xia, Calvin Chang Liu +4
Contextual image misuse pairs an image with a misleading claim. We study image-claim correspondence in fact-checked pairs containing out-of-context reuse, visual manipulation, or both. Existing pair-based detectors often compress the two modalities into a global compatibility score or learn a highly flexible interaction module, which can obscure a decisive local mismatch. We introduce directional multiscale coverage, a compact representation that summarizes local image-claim affinity in both directions and at three spatial scales. At each scale, each direction is summarized by its mean, lower quartile, and two thresholded support ratios; the signed difference between directional means completes a nine-dimensional scale descriptor. Concatenating the three scales yields a compact local representation for a lightweight global-local classifier. Under leakage-aware three-fold, three-seed evaluation on the Snopes subset of the Fauxtography benchmark, UNMATCH achieves 69.82 Macro-F1 and 71.05 balanced accuracy, exceeding the MCOT adaptation by 2.60 and 2.16 points. A matched-reassigned intervention shows that breaking the observed pairing lowers coverage and increases both discrepancy…
PDF arXiv
arXiv cs.CRSep 24
TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement
Haoyang Li, Yaxin Xiao, Linyan Dai, Jiawen Fu, Zi Liang +3
Multimodal training relies on image-text corpora collected from external sources, creating opportunities for attackers to poison the data. Stealthy attacks can preserve plausible image-text pairs while concealing the differences used by detectors, so apparently clean data can still redirect the trained model. We therefore ask which properties a poison set must preserve for the attack to remain effective. A small poison set must still exert enough collective influence during training to induce the attacker's target behavior. We analyze this influence in terms of how often an attack pattern occurs and how strongly the examples carrying it jointly affect the model. This analysis motivates six corpus-level features that examine cross-modal neighborhoods, recurring text, and changes after text-span erasure without training the victim model. We introduce TraceGuard, an adaptive rank-based filtering method that uses agreement among complementary feature rankings to identify suspicious examples. It refines the selected set through shared patterns and adapts the removal threshold to each corpus without knowing the attack or poison rate. Across 19 attack configurations spanning image-text…
PDF arXiv
arXiv cs.CVSep 24
EIB-Net: Entropy-Guided Information Bottleneck for Generalizable AI-Generated Image Detection
Zhida Zhang, Xinlei Ma, Jie Cao
The proliferation of photorealistic AI-generated images demands robust detection methods that generalize across diverse generative models. While existing approaches target manipulation-based forgeries with local artifacts, generation-based images (e.g., from diffusion models) lack such traces, posing a fundamental challenge. We observe that generative models prioritize global semantics at the expense of local texture fidelity, making low-texture regions key indicators of synthetic origin. To exploit this, we propose EIB-Net, an Entropy-guided Information Bottleneck Network. EIB-Net introduces a novel Image Entropy (IE) metric to automatically select the most informative (lowest-entropy) patch, then processes it with a Variational Information Bottleneck (VIB) to learn compact, generalizable features. Extensive experiments on DIFF, DiffusionForensics, and GenImage benchmarks demonstrate state-of-the-art performance: EIB-Net achieves 85.7\% accuracy using only 2\% of training data, outperforming full-image baselines by over 15\%, and maintains robust cross-generator generalization (83.5\% average accuracy on GenImage). Furthermore, our entropy-guided patch selection (EGPL)…
PDF arXiv

Activity · 12 weeks

Coming with more sources: repos

Fields · AI · updated 21m ago

Adversarial training

Found by the topic model: adversarial training, deepfake detection, watermarking schemes.

44papers this week−22.8% vs last week

All papers · 290 With code · 3

Newest Most relevant

271 papers this month

Open problems in Adversarial training

Robust adversarial detection with theoretical guarantees3 papers raise it · 3 address it
Current detectors rely on heuristics and fail under adaptive attacks, leaving models vulnerable to adversarial inputs.
Emergent misalignment in multimodal models1 paper raises it · 1 addresses it
Fine-tuning on narrow tasks can induce broadly harmful behaviors in vision-language models, but its mechanisms and mitigation are poorly understood.
- Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises · addresses
Safe and high-quality generation trade-off1 paper raises it · 1 addresses it
Restricting training data for safety reduces model quality, while post-hoc unlearning risks catastrophic forgetting.
- Pristine Modelsraises · addresses
Robustness of decision models under adversarial manipulation1 paper raises it · 1 addresses it
Decision models are increasingly used for automated tasks, but their reliability under attacks is untested and unstandardized.
- DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
Watermark removal resilience1 paper raises it · 2 address it
Invisible watermarks for ownership verification are vulnerable to simple, training-free attacks that preserve image quality.
- BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Paintingraises · addresses
- SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verificationaddresses

Named by an AI from these papers' abstracts.