Spotlight

Papers

Field

Top tools here

Open problems in Deepfake detection

Generalization to unseen generators and attacks3 papers raise it · 1 addresses it
Detectors fail as new generators emerge or face adversarial perturbations, making them unreliable in the wild.
Factuality assessment beyond binary detection1 paper raises it · 1 addresses it
Binary AI-generated labels do not capture whether the depicted scene is factually supported or not.
- EviScene: Beyond "Is It AI?" for Agentic Image Factuality Assessmentraises · addresses
Explainable artifact detection in videos1 paper raises it · 1 addresses it
Detectors often lack transparency in identifying the specific artifacts that justify their decisions.
- Verus-Insight: Towards Explainable Artifact Detection in AI-Generated Videosraises · addresses
Robustness of decision models to adversarial manipulation1 paper raises it · 1 addresses it
Decision models for detection are vulnerable to semantics-preserving perturbations and prompt injections.
- DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
Emergent misalignment in multimodal fine-tuning1 paper raises it · 0 address it
Narrow fine-tuning can induce harmful behaviors in multimodal models, including visual factual dishonesty.
- Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

deepfake detection · multimodal · image forgery136 papers24 this week
adversarial attack · adversarial training · adversarial attacks122 papers14 this week
multi bit watermarking · bit watermarking · watermarking scheme61 papers6 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Activity

★ Spotlight this month

arXiv cs.CVOct 15

Beyond Generation: Using Multimodal LLMs as Detectors of LLM-Generated Deepfake Facial Images

Olivia Salamon, Virginia N. L. Franqueira, Shujun Li

As image generation models become increasingly capable of producing highly realistic content, traditional forensic techniques are struggling to keep up. This paper investigates whether MLLMs can instead be used as a form of forensic analysis by identifying synthetic media. Specifically, the study aims to determine whether these models detect fake images by recognising physical inconsistencies, or whether they rely on digital artefacts such as embedded watermarks. Six MLLMs (GPT-4o, GPT-5, GPT-5.2, Gemini 2.5, Gemini 3, and Seed 1.6) are benchmarked using a dataset of 400 images. Fifty images are authentic photographs, while the remaining 350 are generated using seven leading image models: Gemini 3, Gemini 2.5, Flux.2 Pro, GPT-Image-1, GPT-Image-1.5, Seedream 4.0, and Seedream 4.5. The evaluation is structured in three stages: single-image classification, pairwise comparison, and a focused "self-detection" experiment on Gemini. Several MLLMs achieved a high detection accuracy, with GPT-5.2 reaching a peak of 97.9% in the pairwise experiment, against specific generators and an overall mean pairwise accuracy of 82.5% by identifying structural or physical inconsistencies within…

PDF arXiv page Details

Spotlight

Recent papers

All papers in Research

arXiv cs.CVOct 22
SpectralCanary: Embarrassingly Simple Low-Frequency Traces for T2I Dataset-Use Auditing
Sy-Tuyen Ho, Anirudh Satheesh, Soham Chawathe, Huy Nghiem, Yongkyun Lee +2
Auditing whether a text-to-image (T2I) model was fine-tuned on a particular image collection is difficult: a model can absorb collection-level visual characteristics without reproducing training images. Proactive dataset-use auditing plants a shared signal in a dataset before release, then later checks whether that signal appears in a suspect model's generated outputs. Existing approaches often trade off verifiability, fidelity, robustness, and deployability. We introduce $\textbf{SpectralCanary}$, which uses a smooth low-pass mask to blend a fixed canary image into every collection image while leaving captions unchanged and requiring neither auxiliary generation nor per-image optimization. A lightweight verifier detects the transferred signal in suspect-model outputs. Across eight tests on the Pokemon dataset and three realistic data transformations, spanning two architectures families, SpectralCanary achieves the highest average per-generation TPR@$1\%$ FPR ($91.1\%$) and fixed threshold model-level accuracy using 30 generations ($94.8\%$) among the evaluated methods. Across five datasets spanning artistic, medical, satellite, and fashion domains with SD3.5, SpectralCanary…
PDF arXiv
arXiv cs.CVOct 22
WildFakeToolBench: Benchmarking AI-Generated Image Detectors with Web-Sourced Image Processing
Mingjie Li, Yukun Jiang, Yicong Tan, Yang Zhang
As AI generated images are getting popular these days, discussions on such generations are widely existed in current public forums, software repositories, and photography tutorials. Moreover, with the help of LLM-assisted code translation, malicious actors can adopt such information to evade detectors without specialized knowledge or local GPU execution of the resulting tools. To evaluate such risks, we introduce \textsc{WildFakeToolBench}, a benchmark suite of $156$ executable image-processing tools derived from $220$ public sources across $142$ domains. Each tool retains its source evidence and passes syntax, execution, and output-distortion checks without using feedback from the evaluated detectors. On $105$ generated images from five generators, we evaluate six state-of-the-art detectors with images processed by the tools in our collected bench to assess their effectiveness against such in-the-wild risks. The strongest individual tools achieve attack success rates of $25.25\%$--$100\%$ across detectors, exceeding the strongest of six selected image-processing baselines for each detector. Evaluating subsets of an eight-tool pool yields worst-case coverage above $80\%$ for…
PDF arXiv
arXiv cs.CROct 22
MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition
Wonjune Seo, Joonhyuk Baek, Yeseong Jung, Saerom Park
Despite recent advances, deepfake detectors remain vulnerable to adversarial examples, particularly in diverse, real-world settings. We propose MIG-COW, a novel adversarial attack framework that generates highly generalizable and visually imperceptible adversarial examples. By combining momentum-integrated gradients with a consensus-orthogonal decomposition, MIG-COW captures both shared and model-specific vulnerabilities across heterogeneous CNN and ViT detectors. On the AADD-2025 Challenge benchmarks, MIG-COW achieves a 99.96% white-box attack success rate (ASR) with high perceptual similarity (SSIM), significantly outperforming existing baselines. However, its limited 7.16% ASR against official black-box targets - despite achieving the best overall score - highlights the ongoing challenge of transferability. We also demonstrate that incorporating low-performing but diverse models in the ensemble can degrade attack effectiveness, underscoring the need for careful surrogate model selection in real-world adversarial settings.
PDF arXiv
arXiv cs.CVCodeOct 22▲ 18
Verus-Insight: Towards Explainable Artifact Detection in AI-Generated Videos
Zhuoran Zhang, Yang Shi, Qixun Wang, Tengfei Liu, Yuqi Tang +9
Recent advances in video generation have made synthetic videos increasingly realistic, placing greater demands on reliable AI-generated video detection. Existing artifact-based detectors typically identify generation artifacts as evidence for source prediction, yet they may either fail to recognize subtle artifacts or reach the correct source decision without faithfully identifying the evidence underlying it. In this work, we systematically investigate how to design and train effective artifact detectors and formulate artifact detection as a structured process comprising three complementary capabilities: Inspection Planning, which determines what should be examined; Evidence Verification, which verifies whether the inspected content exhibits genuine generation artifacts; and Evidence Aggregation, which integrates the verified evidence into the final source decision. Building on this formulation, we introduce Verus-Insight, trained with human-anchored full-process supervision and progressive capability training to strengthen both fine-grained artifact detection and video-level detection. We further introduce Verus-Bench, a benchmark with fine-grained human annotations of…
PDF arXiv Code
arXiv cs.CROct 21
Beyond End-to-End Recovery: Towards a Better Understanding of LLM Steganography via Rolewise Decomposition
Om Tailor, Yucheng Pan, Solaleh Mohammadi, Xinyan Liu, Kaiqing Zhang
In large language model (LLM) steganography, an encoder hides a private message in an otherwise ordinary response, as text transmitted to a decoder, who attempts to recover it. The success of this private-message transmission is commonly measured through end-to-end (E2E) recovery, which checks whether the decoder correctly reconstructs the private message. However, E2E recovery cannot distinguish encoding failures from decoding failures or reveal how the private message is represented in the encoder's transmitted text. To address these limitations, we introduce a rolewise decomposition framework that separately examines how private messages are represented in encoder transmitted texts, what decoders recover, and what deterministic verification can establish. Across 7,200 encoder responses, we identify 168 verifiable encodings missed by decoders and 706 responses containing private messages reconstructed through word-length or token-initial patterns not explicitly specified in the encoder's instructions. These findings demonstrate that E2E recovery alone may obscure important distinctions between encoding and decoding, motivating their separate evaluation to better understand and…
PDF arXiv
arXiv cs.CVOct 21
FiLM-CAM: Keyed Feature Modulation for Conditional-Access Watermarking
Yash Kulthe, Vishal Asnani, Shruti Agarwal, Andrew Gilbert, John Collomosse
We propose FiLM-CAM; a conditional-access image watermarking approach that enforces authorized encoding, decoding, and removal through keyed feature modulation. A secret key conditions a Feature-wise Linear Modulation (FiLM) mechanism that transforms the internal representation of the watermark signal before embedding, thereby coupling the payload to the key at the feature, rather than pixel level. The same key must be presented to condition the decoder to correctly recover the payload embedded in an image. To enforce conditional access, we train the system to maximize the performance gap between authorized and unauthorized use, ensuring reliable extraction under the correct key while inducing failure under incorrect keys. In addition, we design our encoder to estimate the watermark residual invariant to the presence of pre-existing watermarks. This design enables conditional watermark removal via simple re-encoding and subtraction of the residual using iterative refinement, contingent on knowledge of the secret key. We evaluate FiLM-CAM across multiple watermarking encoder-decoder backbones, demonstrating that keyed feature modulation serves as an effective,…
PDF arXiv

Papers

Topics in this field

deepfake detection · multimodal · image forgery136 papers24 this week
adversarial attack · adversarial training · adversarial attacks122 papers14 this week
multi bit watermarking · bit watermarking · watermarking scheme61 papers6 this week

★ Spotlight this month

arXiv cs.CVOct 15

Beyond Generation: Using Multimodal LLMs as Detectors of LLM-Generated Deepfake Facial Images

Olivia Salamon, Virginia N. L. Franqueira, Shujun Li

As image generation models become increasingly capable of producing highly realistic content, traditional forensic techniques are struggling to keep up. This paper investigates whether MLLMs can instead be used as a form of forensic analysis by identifying synthetic media. Specifically, the study aims to determine whether these models detect fake images by recognising physical inconsistencies, or whether they rely on digital artefacts such as embedded watermarks. Six MLLMs (GPT-4o, GPT-5, GPT-5.2, Gemini 2.5, Gemini 3, and Seed 1.6) are benchmarked using a dataset of 400 images. Fifty images are authentic photographs, while the remaining 350 are generated using seven leading image models: Gemini 3, Gemini 2.5, Flux.2 Pro, GPT-Image-1, GPT-Image-1.5, Seedream 4.0, and Seedream 4.5. The evaluation is structured in three stages: single-image classification, pairwise comparison, and a focused "self-detection" experiment on Gemini. Several MLLMs achieved a high detection accuracy, with GPT-5.2 reaching a peak of 97.9% in the pairwise experiment, against specific generators and an overall mean pairwise accuracy of 82.5% by identifying structural or physical inconsistencies within…

PDF arXiv page Details

Active contributors · 90 days

Recent papers

All papers in Research

arXiv cs.CVOct 22
SpectralCanary: Embarrassingly Simple Low-Frequency Traces for T2I Dataset-Use Auditing
Sy-Tuyen Ho, Anirudh Satheesh, Soham Chawathe, Huy Nghiem, Yongkyun Lee +2
Auditing whether a text-to-image (T2I) model was fine-tuned on a particular image collection is difficult: a model can absorb collection-level visual characteristics without reproducing training images. Proactive dataset-use auditing plants a shared signal in a dataset before release, then later checks whether that signal appears in a suspect model's generated outputs. Existing approaches often trade off verifiability, fidelity, robustness, and deployability. We introduce $\textbf{SpectralCanary}$, which uses a smooth low-pass mask to blend a fixed canary image into every collection image while leaving captions unchanged and requiring neither auxiliary generation nor per-image optimization. A lightweight verifier detects the transferred signal in suspect-model outputs. Across eight tests on the Pokemon dataset and three realistic data transformations, spanning two architectures families, SpectralCanary achieves the highest average per-generation TPR@$1\%$ FPR ($91.1\%$) and fixed threshold model-level accuracy using 30 generations ($94.8\%$) among the evaluated methods. Across five datasets spanning artistic, medical, satellite, and fashion domains with SD3.5, SpectralCanary…
PDF arXiv
arXiv cs.CVOct 22
WildFakeToolBench: Benchmarking AI-Generated Image Detectors with Web-Sourced Image Processing
Mingjie Li, Yukun Jiang, Yicong Tan, Yang Zhang
As AI generated images are getting popular these days, discussions on such generations are widely existed in current public forums, software repositories, and photography tutorials. Moreover, with the help of LLM-assisted code translation, malicious actors can adopt such information to evade detectors without specialized knowledge or local GPU execution of the resulting tools. To evaluate such risks, we introduce \textsc{WildFakeToolBench}, a benchmark suite of $156$ executable image-processing tools derived from $220$ public sources across $142$ domains. Each tool retains its source evidence and passes syntax, execution, and output-distortion checks without using feedback from the evaluated detectors. On $105$ generated images from five generators, we evaluate six state-of-the-art detectors with images processed by the tools in our collected bench to assess their effectiveness against such in-the-wild risks. The strongest individual tools achieve attack success rates of $25.25\%$--$100\%$ across detectors, exceeding the strongest of six selected image-processing baselines for each detector. Evaluating subsets of an eight-tool pool yields worst-case coverage above $80\%$ for…
PDF arXiv
arXiv cs.CROct 22
MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition
Wonjune Seo, Joonhyuk Baek, Yeseong Jung, Saerom Park
Despite recent advances, deepfake detectors remain vulnerable to adversarial examples, particularly in diverse, real-world settings. We propose MIG-COW, a novel adversarial attack framework that generates highly generalizable and visually imperceptible adversarial examples. By combining momentum-integrated gradients with a consensus-orthogonal decomposition, MIG-COW captures both shared and model-specific vulnerabilities across heterogeneous CNN and ViT detectors. On the AADD-2025 Challenge benchmarks, MIG-COW achieves a 99.96% white-box attack success rate (ASR) with high perceptual similarity (SSIM), significantly outperforming existing baselines. However, its limited 7.16% ASR against official black-box targets - despite achieving the best overall score - highlights the ongoing challenge of transferability. We also demonstrate that incorporating low-performing but diverse models in the ensemble can degrade attack effectiveness, underscoring the need for careful surrogate model selection in real-world adversarial settings.
PDF arXiv
arXiv cs.CVCodeOct 22▲ 18
Verus-Insight: Towards Explainable Artifact Detection in AI-Generated Videos
Zhuoran Zhang, Yang Shi, Qixun Wang, Tengfei Liu, Yuqi Tang +9
Recent advances in video generation have made synthetic videos increasingly realistic, placing greater demands on reliable AI-generated video detection. Existing artifact-based detectors typically identify generation artifacts as evidence for source prediction, yet they may either fail to recognize subtle artifacts or reach the correct source decision without faithfully identifying the evidence underlying it. In this work, we systematically investigate how to design and train effective artifact detectors and formulate artifact detection as a structured process comprising three complementary capabilities: Inspection Planning, which determines what should be examined; Evidence Verification, which verifies whether the inspected content exhibits genuine generation artifacts; and Evidence Aggregation, which integrates the verified evidence into the final source decision. Building on this formulation, we introduce Verus-Insight, trained with human-anchored full-process supervision and progressive capability training to strengthen both fine-grained artifact detection and video-level detection. We further introduce Verus-Bench, a benchmark with fine-grained human annotations of…
PDF arXiv Code
arXiv cs.CROct 21
Beyond End-to-End Recovery: Towards a Better Understanding of LLM Steganography via Rolewise Decomposition
Om Tailor, Yucheng Pan, Solaleh Mohammadi, Xinyan Liu, Kaiqing Zhang
In large language model (LLM) steganography, an encoder hides a private message in an otherwise ordinary response, as text transmitted to a decoder, who attempts to recover it. The success of this private-message transmission is commonly measured through end-to-end (E2E) recovery, which checks whether the decoder correctly reconstructs the private message. However, E2E recovery cannot distinguish encoding failures from decoding failures or reveal how the private message is represented in the encoder's transmitted text. To address these limitations, we introduce a rolewise decomposition framework that separately examines how private messages are represented in encoder transmitted texts, what decoders recover, and what deterministic verification can establish. Across 7,200 encoder responses, we identify 168 verifiable encodings missed by decoders and 706 responses containing private messages reconstructed through word-length or token-initial patterns not explicitly specified in the encoder's instructions. These findings demonstrate that E2E recovery alone may obscure important distinctions between encoding and decoding, motivating their separate evaluation to better understand and…
PDF arXiv
arXiv cs.CVOct 21
FiLM-CAM: Keyed Feature Modulation for Conditional-Access Watermarking
Yash Kulthe, Vishal Asnani, Shruti Agarwal, Andrew Gilbert, John Collomosse
We propose FiLM-CAM; a conditional-access image watermarking approach that enforces authorized encoding, decoding, and removal through keyed feature modulation. A secret key conditions a Feature-wise Linear Modulation (FiLM) mechanism that transforms the internal representation of the watermark signal before embedding, thereby coupling the payload to the key at the feature, rather than pixel level. The same key must be presented to condition the decoder to correctly recover the payload embedded in an image. To enforce conditional access, we train the system to maximize the performance gap between authorized and unauthorized use, ensuring reliable extraction under the correct key while inducing failure under incorrect keys. In addition, we design our encoder to estimate the watermark residual invariant to the presence of pre-existing watermarks. This design enables conditional watermark removal via simple re-encoding and subtraction of the residual using iterative refinement, contingent on knowledge of the secret key. We evaluate FiLM-CAM across multiple watermarking encoder-decoder backbones, demonstrating that keyed feature modulation serves as an effective,…
PDF arXiv

Activity · 12 weeks

Fields · AI · updated 41m ago

Deepfake detection

Found by the topic model: deepfake detection, adversarial attack, multi bit watermarking.

44papers this week−10.2% vs last week

All papers · 319 With code · 5

Newest Most relevant

267 papers this month

Open problems in Deepfake detection

Generalization to unseen generators and attacks3 papers raise it · 1 addresses it
Detectors fail as new generators emerge or face adversarial perturbations, making them unreliable in the wild.
Factuality assessment beyond binary detection1 paper raises it · 1 addresses it
Binary AI-generated labels do not capture whether the depicted scene is factually supported or not.
- EviScene: Beyond "Is It AI?" for Agentic Image Factuality Assessmentraises · addresses
Explainable artifact detection in videos1 paper raises it · 1 addresses it
Detectors often lack transparency in identifying the specific artifacts that justify their decisions.
- Verus-Insight: Towards Explainable Artifact Detection in AI-Generated Videosraises · addresses
Robustness of decision models to adversarial manipulation1 paper raises it · 1 addresses it
Decision models for detection are vulnerable to semantics-preserving perturbations and prompt injections.
- DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
Emergent misalignment in multimodal fine-tuning1 paper raises it · 0 address it
Narrow fine-tuning can induce harmful behaviors in multimodal models, including visual factual dishonesty.
- Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises

Named by an AI from these papers' abstracts.