Papers

Field

Top tools here

Open problems in Adversarial training

Robust adversarial detection with theoretical guarantees3 papers raise it · 3 address it
Current detectors rely on heuristics and fail under adaptive attacks, leaving models vulnerable to adversarial inputs.
Emergent misalignment in multimodal models1 paper raises it · 1 addresses it
Fine-tuning on narrow tasks can induce broadly harmful behaviors in vision-language models, but its mechanisms and mitigation are poorly understood.
- Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises · addresses
Safe and high-quality generation trade-off1 paper raises it · 1 addresses it
Restricting training data for safety reduces model quality, while post-hoc unlearning risks catastrophic forgetting.
- Pristine Modelsraises · addresses
Robustness of decision models under adversarial manipulation1 paper raises it · 1 addresses it
Decision models are increasingly used for automated tasks, but their reliability under attacks is untested and unstandardized.
- DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
Watermark removal resilience1 paper raises it · 2 address it
Invisible watermarks for ownership verification are vulnerable to simple, training-free attacks that preserve image quality.
- BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Paintingraises · addresses
- SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verificationaddresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

deepfake detection · forensic cues · image forgery107 papers21 this week
adversarial training · adversarial attacks · adversarial images107 papers13 this week
watermarking schemes · watermarking · based watermarking76 papers10 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Coming with more sources: repos

Activity

Recent papers

All in Research →

arXiv cs.CVSep 26
JEPA Learns What the Mask Leaves Unrecoverable
Peng Xie, Amr Alanwar
Joint-embedding predictive architectures are unusually sensitive to how the input is masked: block masks work, scattered masks do not, and the explanations are empirical. We give a measurement account. A mask is a linear measurement, and in a compactly supported wavelet basis every atom whose support lies inside the hidden region falls in the measurement's null space and leaves no trace in the data. The JEPA loss asks only that the encoded context suffice for the target, so a target that a low-level prior can recover admits a shortcut, one the moving-average target encoder can make self-consistent. What removes the shortcut is the coarse-scale content the mask leaves unrecoverable, provided enough context stays within reach of each target. We score that content before training and test the account's distinctive predictions in 151 pre-training runs. On ImageNet-100, strip masks match blocks in area and contiguity yet are recoverable, and they land at 40.3% linear top-1, beside random masks at 40.8%, against 64.3% for blocks; within one geometry family, the placements that leave the least unrecoverable content lose 6.5 points to those that leave the most, over five seed pairs;…
PDF arXiv
arXiv cs.CRSep 26
Residual Transferability in Neural Image Watermarking
Ziping Dong, Qi Li, Xinchao Wang
Neural image watermarks can be forged by extracting watermark-bearing residuals from released images and transferring them to unrelated content. While prior work has demonstrated this vulnerability, what makes these residuals transferable remains poorly understood. We formalize this vulnerability with \textbf{residual transferability (RT)}, a metric that quantifies how well watermark evidence remains decodable after transfer across unrelated images. Through comparative analyses and controlled interventions, we find that common training-side variations do not account for the large RT differences across watermarking systems; instead, architectural design plays a central role. By contrasting high- and low-RT systems and validating their architectural differences through controlled interventions, we identify two mechanisms that strengthen the dependence of watermark evidence on the cover image, thereby suppressing the residual transferability. These findings provide concrete design guidance for developing more forgery-resistant watermarking architectures. Complementarily, for existing watermarking systems where architectural redesign is impractical, we introduce \textbf{CoverLock}, a…
PDF arXiv
arXiv cs.CVSep 26
Gaussian Image Steganography via Parameter-Domain Keyed Embeddings
Tong Wu, Runze Cheng, Xiaoyue Fan, Kaan Akşit
2D Gaussian-based image representation is becoming increasingly popular, and our work proposes a new approach to steganography by embedding information within Gaussian parameters rather than image pixels. We first fit the parameters of this representation to the target image and employ a secret key to select a subset of these parameters for fine-tuning, allowing us to embed an 8-bit message while maintaining high visual fidelity in the reconstructed image. Thirty fitting experiments on three synthetic images show that the correct key can recover the message without error, while decoding with incorrect keys yields a Bit Error Rate (BER) of $0.543$, close to random guessing. Compared with random selection using the key, selecting the least-disturbing edits recovers the message more reliably (one-sided $p=0.031$), and the average PSNR cost is only $0.091$ dB in visual quality. The embedding method transfers to 112 natural images at $256\times256$ using 4,096 Gaussians. The correct-key BER is $0.000$, and decoding under a wrong key stays close to random guessing at $0.520$. Our method embeds the payload through three Gaussian parameter types: log-anisotropy, opacity, and color…
PDF arXiv
arXiv stat.MESep 25
Statistical attribute alignment for black-box generative AI via output post-processing
Kevin Jiang, Morgane Austern, Edgar Dobriban, Jason M. Klusowski
Generative AI systems are increasingly used, but aligning their outputs with user requirements poses a continuing challenge. Here, we aim to ensure that the distribution of an attribute of an AI-generated output aligns with a user-specified target. This is motivated by examples such as fairness, where we want to ensure that a protected attribute (e.g., gender, race, or age categories) follows a desired distribution, and synthetic data generation, where we want the generated data to be representative of a target distribution. We study the practically important black-box access setting, where a user can repeatedly query a generative AI model. The goal is to return $m\ge 1$ outputs whose joint attribute distribution is as close as possible to this target. For both exact and approximate alignment, we develop algorithms that minimize the expected number of queries to the generator, and we further demonstrate their optimality as the number of requested outputs $m \rightarrow \infty$. Experiments on text-to-image generation and geocoded persona generation tasks show that our post-processing algorithms improve statistical attribute alignment, complementing prompting-based interventions.
PDF arXiv
arXiv cs.CVSep 25
Region-Level Black-Box Defense Against Stealthy Embedding-Space Backdoors in CLIP
Ahmed Abdelnaby, Mohamed Elmahallawy
Contrastive Language--Image Pretraining (CLIP) has emerged as a dominant vision backbone due to its strong transferability and zero-shot capabilities. However, recent studies reveal a critical vulnerability: embedding-space backdoor attacks. By poisoning only a tiny fraction of image--text pairs, adversaries can implant stealthy triggers that induce targeted shifts in CLIP's joint embedding space. Unlike conventional backdoors that manipulate classifier logits, these attacks corrupt representations directly, making them highly effective under extremely low poisoning ratios and difficult to detect. Existing defenses require access to model parameters, gradients, logits, or clean validation data---assumptions that rarely hold in realistic black-box deployments. Moreover, current black-box methods struggle to accurately localize small or out-of-distribution triggers. We propose CLIPGuard, a lightweight and fully black-box defense specifically designed to mitigate embedding-space backdoors in CLIP encoders. CLIPGuard identifies malicious regions by measuring segment-wise embedding perturbations and selectively purifies only suspicious segments via semantic inpainting, preserving…
PDF arXiv
arXiv cs.CVSep 25
Forensic Twins: Self-Supervised Residual Learning for AI-Generated Image Forensics
Javier Muñoz-Haro, Ruben Tolosana, Ruben Vera-Rodriguez, Aythami Morales, Julian Fierrez
Detectors of AI-generated images are typically trained using samples from all Generative AI architectures they must catch, and struggle as soon as a new architecture emerges. Recent approaches have explored self-supervised pre-training as an alternative solution, yet standard frameworks work against the forensic task, e.g., their augmentations overwrite the micro-statistics of image formation. This paper introduces Forensic Twins, a Self-Supervised Residual Learning (SSRL) framework whose pretext task suppresses macroscopic content availability. Each image is mapped through a frozen, off-the-shelf forensic residual extractor, from which two spatially disjoint crops are drawn. Sharing no pixel, the two views retain minimal semantic structure to align, leaving a redundancy-reduction objective with a predominant common signal: the stationary fingerprint of the image acquisition pipeline. Additionally, Forensic Twins is trained exclusively on real images; no AI-generated image is observed at any stage. Experiments show that Forensic Twins attributes AI generator sources with 56.61% accuracy, i.e., 6.13% above the previous state-of-the-art zero-shot method at 375x lower latency. We…
PDF arXiv

Papers

Topics in this field

deepfake detection · forensic cues · image forgery107 papers21 this week
adversarial training · adversarial attacks · adversarial images107 papers13 this week
watermarking schemes · watermarking · based watermarking76 papers10 this week

Active contributors · 90 days

Recent papers

All in Research →

arXiv cs.CVSep 26
JEPA Learns What the Mask Leaves Unrecoverable
Peng Xie, Amr Alanwar
Joint-embedding predictive architectures are unusually sensitive to how the input is masked: block masks work, scattered masks do not, and the explanations are empirical. We give a measurement account. A mask is a linear measurement, and in a compactly supported wavelet basis every atom whose support lies inside the hidden region falls in the measurement's null space and leaves no trace in the data. The JEPA loss asks only that the encoded context suffice for the target, so a target that a low-level prior can recover admits a shortcut, one the moving-average target encoder can make self-consistent. What removes the shortcut is the coarse-scale content the mask leaves unrecoverable, provided enough context stays within reach of each target. We score that content before training and test the account's distinctive predictions in 151 pre-training runs. On ImageNet-100, strip masks match blocks in area and contiguity yet are recoverable, and they land at 40.3% linear top-1, beside random masks at 40.8%, against 64.3% for blocks; within one geometry family, the placements that leave the least unrecoverable content lose 6.5 points to those that leave the most, over five seed pairs;…
PDF arXiv
arXiv cs.CRSep 26
Residual Transferability in Neural Image Watermarking
Ziping Dong, Qi Li, Xinchao Wang
Neural image watermarks can be forged by extracting watermark-bearing residuals from released images and transferring them to unrelated content. While prior work has demonstrated this vulnerability, what makes these residuals transferable remains poorly understood. We formalize this vulnerability with \textbf{residual transferability (RT)}, a metric that quantifies how well watermark evidence remains decodable after transfer across unrelated images. Through comparative analyses and controlled interventions, we find that common training-side variations do not account for the large RT differences across watermarking systems; instead, architectural design plays a central role. By contrasting high- and low-RT systems and validating their architectural differences through controlled interventions, we identify two mechanisms that strengthen the dependence of watermark evidence on the cover image, thereby suppressing the residual transferability. These findings provide concrete design guidance for developing more forgery-resistant watermarking architectures. Complementarily, for existing watermarking systems where architectural redesign is impractical, we introduce \textbf{CoverLock}, a…
PDF arXiv
arXiv cs.CVSep 26
Gaussian Image Steganography via Parameter-Domain Keyed Embeddings
Tong Wu, Runze Cheng, Xiaoyue Fan, Kaan Akşit
2D Gaussian-based image representation is becoming increasingly popular, and our work proposes a new approach to steganography by embedding information within Gaussian parameters rather than image pixels. We first fit the parameters of this representation to the target image and employ a secret key to select a subset of these parameters for fine-tuning, allowing us to embed an 8-bit message while maintaining high visual fidelity in the reconstructed image. Thirty fitting experiments on three synthetic images show that the correct key can recover the message without error, while decoding with incorrect keys yields a Bit Error Rate (BER) of $0.543$, close to random guessing. Compared with random selection using the key, selecting the least-disturbing edits recovers the message more reliably (one-sided $p=0.031$), and the average PSNR cost is only $0.091$ dB in visual quality. The embedding method transfers to 112 natural images at $256\times256$ using 4,096 Gaussians. The correct-key BER is $0.000$, and decoding under a wrong key stays close to random guessing at $0.520$. Our method embeds the payload through three Gaussian parameter types: log-anisotropy, opacity, and color…
PDF arXiv
arXiv stat.MESep 25
Statistical attribute alignment for black-box generative AI via output post-processing
Kevin Jiang, Morgane Austern, Edgar Dobriban, Jason M. Klusowski
Generative AI systems are increasingly used, but aligning their outputs with user requirements poses a continuing challenge. Here, we aim to ensure that the distribution of an attribute of an AI-generated output aligns with a user-specified target. This is motivated by examples such as fairness, where we want to ensure that a protected attribute (e.g., gender, race, or age categories) follows a desired distribution, and synthetic data generation, where we want the generated data to be representative of a target distribution. We study the practically important black-box access setting, where a user can repeatedly query a generative AI model. The goal is to return $m\ge 1$ outputs whose joint attribute distribution is as close as possible to this target. For both exact and approximate alignment, we develop algorithms that minimize the expected number of queries to the generator, and we further demonstrate their optimality as the number of requested outputs $m \rightarrow \infty$. Experiments on text-to-image generation and geocoded persona generation tasks show that our post-processing algorithms improve statistical attribute alignment, complementing prompting-based interventions.
PDF arXiv
arXiv cs.CVSep 25
Region-Level Black-Box Defense Against Stealthy Embedding-Space Backdoors in CLIP
Ahmed Abdelnaby, Mohamed Elmahallawy
Contrastive Language--Image Pretraining (CLIP) has emerged as a dominant vision backbone due to its strong transferability and zero-shot capabilities. However, recent studies reveal a critical vulnerability: embedding-space backdoor attacks. By poisoning only a tiny fraction of image--text pairs, adversaries can implant stealthy triggers that induce targeted shifts in CLIP's joint embedding space. Unlike conventional backdoors that manipulate classifier logits, these attacks corrupt representations directly, making them highly effective under extremely low poisoning ratios and difficult to detect. Existing defenses require access to model parameters, gradients, logits, or clean validation data---assumptions that rarely hold in realistic black-box deployments. Moreover, current black-box methods struggle to accurately localize small or out-of-distribution triggers. We propose CLIPGuard, a lightweight and fully black-box defense specifically designed to mitigate embedding-space backdoors in CLIP encoders. CLIPGuard identifies malicious regions by measuring segment-wise embedding perturbations and selectively purifies only suspicious segments via semantic inpainting, preserving…
PDF arXiv
arXiv cs.CVSep 25
Forensic Twins: Self-Supervised Residual Learning for AI-Generated Image Forensics
Javier Muñoz-Haro, Ruben Tolosana, Ruben Vera-Rodriguez, Aythami Morales, Julian Fierrez
Detectors of AI-generated images are typically trained using samples from all Generative AI architectures they must catch, and struggle as soon as a new architecture emerges. Recent approaches have explored self-supervised pre-training as an alternative solution, yet standard frameworks work against the forensic task, e.g., their augmentations overwrite the micro-statistics of image formation. This paper introduces Forensic Twins, a Self-Supervised Residual Learning (SSRL) framework whose pretext task suppresses macroscopic content availability. Each image is mapped through a frozen, off-the-shelf forensic residual extractor, from which two spatially disjoint crops are drawn. Sharing no pixel, the two views retain minimal semantic structure to align, leaving a redundancy-reduction objective with a predominant common signal: the stationary fingerprint of the image acquisition pipeline. Additionally, Forensic Twins is trained exclusively on real images; no AI-generated image is observed at any stage. Experiments show that Forensic Twins attributes AI generator sources with 56.61% accuracy, i.e., 6.13% above the previous state-of-the-art zero-shot method at 375x lower latency. We…
PDF arXiv

Activity · 12 weeks

Coming with more sources: repos

Fields · AI · updated 1h ago

Adversarial training

Found by the topic model: adversarial training, deepfake detection, watermarking schemes.

44papers this week−24.1% vs last week

All papers · 290 With code · 3

Newest Most relevant

272 papers this month

Open problems in Adversarial training

Robust adversarial detection with theoretical guarantees3 papers raise it · 3 address it
Current detectors rely on heuristics and fail under adaptive attacks, leaving models vulnerable to adversarial inputs.
Emergent misalignment in multimodal models1 paper raises it · 1 addresses it
Fine-tuning on narrow tasks can induce broadly harmful behaviors in vision-language models, but its mechanisms and mitigation are poorly understood.
- Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises · addresses
Safe and high-quality generation trade-off1 paper raises it · 1 addresses it
Restricting training data for safety reduces model quality, while post-hoc unlearning risks catastrophic forgetting.
- Pristine Modelsraises · addresses
Robustness of decision models under adversarial manipulation1 paper raises it · 1 addresses it
Decision models are increasingly used for automated tasks, but their reliability under attacks is untested and unstandardized.
- DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
Watermark removal resilience1 paper raises it · 2 address it
Invisible watermarks for ownership verification are vulnerable to simple, training-free attacks that preserve image quality.
- BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Paintingraises · addresses
- SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verificationaddresses

Named by an AI from these papers' abstracts.