Papers

Field

Top tools here

Open problems in Deepfake detection

Generalization to unseen generators and attacks3 papers raise it · 1 addresses it
Detectors fail as new generators emerge or face adversarial perturbations, making them unreliable in the wild.
Factuality assessment beyond binary detection1 paper raises it · 1 addresses it
Binary AI-generated labels do not capture whether the depicted scene is factually supported or not.
- EviScene: Beyond "Is It AI?" for Agentic Image Factuality Assessmentraises · addresses
Explainable artifact detection in videos1 paper raises it · 1 addresses it
Detectors often lack transparency in identifying the specific artifacts that justify their decisions.
- Verus-Insight: Towards Explainable Artifact Detection in AI-Generated Videosraises · addresses
Robustness of decision models to adversarial manipulation1 paper raises it · 1 addresses it
Decision models for detection are vulnerable to semantics-preserving perturbations and prompt injections.
- DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
Emergent misalignment in multimodal fine-tuning1 paper raises it · 0 address it
Narrow fine-tuning can induce harmful behaviors in multimodal models, including visual factual dishonesty and unsafe actions.
- Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

deepfake detection · multimodal · image forgery137 papers24 this week
adversarial attack · adversarial training · adversarial attacks125 papers17 this week
multi bit watermarking · bit watermarking · watermarking scheme62 papers7 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Activity

Recent papers

All papers in Research

arXiv cs.CROct 15
Erase the Mark, Preserve the Motion: Temporally Consistent Removal of Video Watermarks
Yifan Liao, Zhen Sun, Zhicong Huang, Jiaming He, Zongmin Zhang +4
Recent advances in video generation have increased the demand for reliable watermarking for copyright protection, yet the robustness of video watermarks against removal attacks remains underexplored. Most watermark-removal methods originate from the image domain: signal optimization injects imperceptible pixel-domain perturbations, whereas generative resynthesis produces a visually similar instance through diffusion synthesis. When extended to videos, the former introduces temporally varying noise that causes visible flickering, while the latter regenerates fine-grained structures inconsistently across frames, leading to structural motion inconsistency. To evaluate video watermark robustness, we propose PoseRegen, a pose-consistent reconstruction framework that removes watermarks while preserving the original content and motion. PoseRegen first applies a temporally shared viewpoint transformation to disrupt watermark-bearing spatial patterns and then jointly reconstructs the transformed sequence with a pose-conditioned video model. A frozen video DiT processes the complete sequence with its reference-video latent, and full-sequence Flow Matching supervision keeps identity and…
PDF arXiv
arXiv cs.CROct 15
An Agentic ENF Framework for Forensic Video Authentication Against Generative AI
Ryan Wyton, Bacha Rehman
Generative models now synthesise video that is hard to distinguish from genuine footage, and learned detectors that key on a generator's artefacts degrade sharply on unseen models. This paper develops a forensic framework that authenticates video by a signal that generation does not control: the electric network frequency (ENF), the mains-driven hum in audio and flicker in video. A unified two-channel detector extracts the ENF from audio and from rolling-shutter video through one second harmonic estimator and a shared network; a synthetic-injection training method, driven by an Ornstein-Uhlenbeck drift model and anchored to real recordings, overcomes the scarcity of labelled ENF data; a reference-matching channel verifies a claimed time of recording and recovers an unknown one; and a two-axis agentic orchestrator fuses recording authenticity with content-manipulation evidence under an asymmetric rule, escalating expensive detectors only when needed. A central finding reframes the task: an ENF-band flicker is present in generated video at a prominence indistinguishable from real footage, so its presence is not proof of authenticity, and authentication must rest on consistency with…
PDF arXiv
arXiv cs.CVOct 15
DINO-FIL: Multi-Layer Transformer Fusion for Generative Inpainting Forgery Localization
Simon Freitter, David Fischinger, Silvia Poletti, Marcel Hasenbalg, Martin Boyer
We propose DINO-FIL, a transformer-based framework for pixel-level localization of generative image forgeries. The method leverages multi-layer representations from a pretrained DINOv3 ViT-H+/16 encoder combined with a lightweight fusion decoder to capture both semantic structure and fine-grained texture inconsistencies introduced by image editing. By aggregating intermediate transformer features across depths, the model improves sensitivity to subtle, spatially localized artifacts that are often missed by standard single-layer approaches. We evaluate DINO-FIL in a cross-dataset setting, training on B-Free and testing on Beyond the Brush, CocoGlide, TGIF, and SAGI-D. The model achieves strong generalization, outperforming existing baselines on average and on four of five evaluated datasets, while maintaining a high true negative rate on pristine images.
PDF arXiv
arXiv cs.CVOct 15
Beyond Generation: Using Multimodal LLMs as Detectors of LLM-Generated Deepfake Facial Images
Olivia Salamon, Virginia N. L. Franqueira, Shujun Li
As image generation models become increasingly capable of producing highly realistic content, traditional forensic techniques are struggling to keep up. This paper investigates whether MLLMs can instead be used as a form of forensic analysis by identifying synthetic media. Specifically, the study aims to determine whether these models detect fake images by recognising physical inconsistencies, or whether they rely on digital artefacts such as embedded watermarks. Six MLLMs (GPT-4o, GPT-5, GPT-5.2, Gemini 2.5, Gemini 3, and Seed 1.6) are benchmarked using a dataset of 400 images. Fifty images are authentic photographs, while the remaining 350 are generated using seven leading image models: Gemini 3, Gemini 2.5, Flux.2 Pro, GPT-Image-1, GPT-Image-1.5, Seedream 4.0, and Seedream 4.5. The evaluation is structured in three stages: single-image classification, pairwise comparison, and a focused "self-detection" experiment on Gemini. Several MLLMs achieved a high detection accuracy, with GPT-5.2 reaching a peak of 97.9% in the pairwise experiment, against specific generators and an overall mean pairwise accuracy of 82.5% by identifying structural or physical inconsistencies within…
PDF arXiv
arXiv cs.CVOct 15
International Multi-Centre Validation of Unsupervised Domain Adaptation for Precise Discrimination between Normal and Abnormal Retinal Development
Zhanhan Tu, Nikhil Reddy, Helen J. Kuht, Ha-Jun Yoon, Gail D. E. Maconachie +25
Arrested retinal development can cause childhood visual impairment, but grading optical coherence tomography scans is difficult to standardise across devices and centres. We developed and evaluated an unsupervised domain adaptation model to classify normal and abnormal retinal development across different OCT systems. This retrospective multicentre study used OCT scans from five centres in four countries and the UK Biobank. Data covered four OCT devices, including table mounted and handheld systems. A ResNet50 based Domain Adversarial Neural Network was trained using labelled images from a source device and unlabelled images from a target device. We evaluated six source to target pairings and compared model performance with seven clinician graders. A separate Heidelberg Spectralis dataset was reserved for external evaluation. Across validation sets, accuracy ranged from 87.75% to 96.06%, sensitivity from 88.68% to 98.38%, and specificity from 78.00% to 98.02%. The best performing model, adapted from TM OCT1 to HH OCT1, achieved 96.06% accuracy and an area under the receiver operating characteristic curve of 0.994, with a 95% confidence interval from 0.981 to 0.999. Several models…
PDF arXiv
arXiv cs.CVOct 15
FusionAudit: Pathway-Conditioned Robustness Auditing for Native Multimodal Models
Jiaming Zhang, Zherui Li, Siqi Guo, Junhao Dong, Kun Wang +1
As vision-language models (VLMs) transition from frozen-encoder pipelines to native multimodal architectures, the visual channel increasingly serves as both a perceptual input and a carrier of rendered text that competes with user prompts. Current single-attack, pixel-centric evaluations fail to capture this complexity: they collapse distinct visual attack surfaces into a single scalar and ignore how architectural shifts alter vulnerability. We introduce PaRMA, an evidence-based auditing framework that defines pathway-conditioned risk over two primary image-level interventions: pixel perturbation and rendered-text insertion. Instead of arbitrary attack enumeration, PaRMA uses pathway-specific diagnostics to expose architecture-specific blind spots. Notably, we uncover a see-but-not-deceived signature where native VLMs attend heavily to typographic overlays but visually reject them, and we identify an objective mismatch between encoder-level and answer-level attacks in deep-fusion models. To exploit these findings, we instantiate FusionAudit, introducing two diagnostic-motivated attacks: MANTIS (margin-aware pixel perturbation) and Nat-Evid (host-congruent semantic insertion).…
PDF arXiv

Papers

Topics in this field

deepfake detection · multimodal · image forgery137 papers24 this week
adversarial attack · adversarial training · adversarial attacks125 papers17 this week
multi bit watermarking · bit watermarking · watermarking scheme62 papers7 this week

Recent papers

All papers in Research

arXiv cs.CROct 15
Erase the Mark, Preserve the Motion: Temporally Consistent Removal of Video Watermarks
Yifan Liao, Zhen Sun, Zhicong Huang, Jiaming He, Zongmin Zhang +4
Recent advances in video generation have increased the demand for reliable watermarking for copyright protection, yet the robustness of video watermarks against removal attacks remains underexplored. Most watermark-removal methods originate from the image domain: signal optimization injects imperceptible pixel-domain perturbations, whereas generative resynthesis produces a visually similar instance through diffusion synthesis. When extended to videos, the former introduces temporally varying noise that causes visible flickering, while the latter regenerates fine-grained structures inconsistently across frames, leading to structural motion inconsistency. To evaluate video watermark robustness, we propose PoseRegen, a pose-consistent reconstruction framework that removes watermarks while preserving the original content and motion. PoseRegen first applies a temporally shared viewpoint transformation to disrupt watermark-bearing spatial patterns and then jointly reconstructs the transformed sequence with a pose-conditioned video model. A frozen video DiT processes the complete sequence with its reference-video latent, and full-sequence Flow Matching supervision keeps identity and…
PDF arXiv
arXiv cs.CROct 15
An Agentic ENF Framework for Forensic Video Authentication Against Generative AI
Ryan Wyton, Bacha Rehman
Generative models now synthesise video that is hard to distinguish from genuine footage, and learned detectors that key on a generator's artefacts degrade sharply on unseen models. This paper develops a forensic framework that authenticates video by a signal that generation does not control: the electric network frequency (ENF), the mains-driven hum in audio and flicker in video. A unified two-channel detector extracts the ENF from audio and from rolling-shutter video through one second harmonic estimator and a shared network; a synthetic-injection training method, driven by an Ornstein-Uhlenbeck drift model and anchored to real recordings, overcomes the scarcity of labelled ENF data; a reference-matching channel verifies a claimed time of recording and recovers an unknown one; and a two-axis agentic orchestrator fuses recording authenticity with content-manipulation evidence under an asymmetric rule, escalating expensive detectors only when needed. A central finding reframes the task: an ENF-band flicker is present in generated video at a prominence indistinguishable from real footage, so its presence is not proof of authenticity, and authentication must rest on consistency with…
PDF arXiv
arXiv cs.CVOct 15
DINO-FIL: Multi-Layer Transformer Fusion for Generative Inpainting Forgery Localization
Simon Freitter, David Fischinger, Silvia Poletti, Marcel Hasenbalg, Martin Boyer
We propose DINO-FIL, a transformer-based framework for pixel-level localization of generative image forgeries. The method leverages multi-layer representations from a pretrained DINOv3 ViT-H+/16 encoder combined with a lightweight fusion decoder to capture both semantic structure and fine-grained texture inconsistencies introduced by image editing. By aggregating intermediate transformer features across depths, the model improves sensitivity to subtle, spatially localized artifacts that are often missed by standard single-layer approaches. We evaluate DINO-FIL in a cross-dataset setting, training on B-Free and testing on Beyond the Brush, CocoGlide, TGIF, and SAGI-D. The model achieves strong generalization, outperforming existing baselines on average and on four of five evaluated datasets, while maintaining a high true negative rate on pristine images.
PDF arXiv
arXiv cs.CVOct 15
Beyond Generation: Using Multimodal LLMs as Detectors of LLM-Generated Deepfake Facial Images
Olivia Salamon, Virginia N. L. Franqueira, Shujun Li
As image generation models become increasingly capable of producing highly realistic content, traditional forensic techniques are struggling to keep up. This paper investigates whether MLLMs can instead be used as a form of forensic analysis by identifying synthetic media. Specifically, the study aims to determine whether these models detect fake images by recognising physical inconsistencies, or whether they rely on digital artefacts such as embedded watermarks. Six MLLMs (GPT-4o, GPT-5, GPT-5.2, Gemini 2.5, Gemini 3, and Seed 1.6) are benchmarked using a dataset of 400 images. Fifty images are authentic photographs, while the remaining 350 are generated using seven leading image models: Gemini 3, Gemini 2.5, Flux.2 Pro, GPT-Image-1, GPT-Image-1.5, Seedream 4.0, and Seedream 4.5. The evaluation is structured in three stages: single-image classification, pairwise comparison, and a focused "self-detection" experiment on Gemini. Several MLLMs achieved a high detection accuracy, with GPT-5.2 reaching a peak of 97.9% in the pairwise experiment, against specific generators and an overall mean pairwise accuracy of 82.5% by identifying structural or physical inconsistencies within…
PDF arXiv
arXiv cs.CVOct 15
International Multi-Centre Validation of Unsupervised Domain Adaptation for Precise Discrimination between Normal and Abnormal Retinal Development
Zhanhan Tu, Nikhil Reddy, Helen J. Kuht, Ha-Jun Yoon, Gail D. E. Maconachie +25
Arrested retinal development can cause childhood visual impairment, but grading optical coherence tomography scans is difficult to standardise across devices and centres. We developed and evaluated an unsupervised domain adaptation model to classify normal and abnormal retinal development across different OCT systems. This retrospective multicentre study used OCT scans from five centres in four countries and the UK Biobank. Data covered four OCT devices, including table mounted and handheld systems. A ResNet50 based Domain Adversarial Neural Network was trained using labelled images from a source device and unlabelled images from a target device. We evaluated six source to target pairings and compared model performance with seven clinician graders. A separate Heidelberg Spectralis dataset was reserved for external evaluation. Across validation sets, accuracy ranged from 87.75% to 96.06%, sensitivity from 88.68% to 98.38%, and specificity from 78.00% to 98.02%. The best performing model, adapted from TM OCT1 to HH OCT1, achieved 96.06% accuracy and an area under the receiver operating characteristic curve of 0.994, with a 95% confidence interval from 0.981 to 0.999. Several models…
PDF arXiv
arXiv cs.CVOct 15
FusionAudit: Pathway-Conditioned Robustness Auditing for Native Multimodal Models
Jiaming Zhang, Zherui Li, Siqi Guo, Junhao Dong, Kun Wang +1
As vision-language models (VLMs) transition from frozen-encoder pipelines to native multimodal architectures, the visual channel increasingly serves as both a perceptual input and a carrier of rendered text that competes with user prompts. Current single-attack, pixel-centric evaluations fail to capture this complexity: they collapse distinct visual attack surfaces into a single scalar and ignore how architectural shifts alter vulnerability. We introduce PaRMA, an evidence-based auditing framework that defines pathway-conditioned risk over two primary image-level interventions: pixel perturbation and rendered-text insertion. Instead of arbitrary attack enumeration, PaRMA uses pathway-specific diagnostics to expose architecture-specific blind spots. Notably, we uncover a see-but-not-deceived signature where native VLMs attend heavily to typographic overlays but visually reject them, and we identify an objective mismatch between encoder-level and answer-level attacks in deep-fusion models. To exploit these findings, we instantiate FusionAudit, introducing two diagnostic-motivated attacks: MANTIS (margin-aware pixel perturbation) and Nat-Evid (host-congruent semantic insertion).…
PDF arXiv

Active contributors · 90 days

Activity · 12 weeks

Fields · AI · updated 14m ago

Deepfake detection

Found by the topic model: deepfake detection, adversarial attack, multi bit watermarking.

48papers this week−4.0% vs last week

All papers · 324 With code · 5

Newest Most relevant

270 papers this month

Open problems in Deepfake detection

Generalization to unseen generators and attacks3 papers raise it · 1 addresses it
Detectors fail as new generators emerge or face adversarial perturbations, making them unreliable in the wild.
Factuality assessment beyond binary detection1 paper raises it · 1 addresses it
Binary AI-generated labels do not capture whether the depicted scene is factually supported or not.
- EviScene: Beyond "Is It AI?" for Agentic Image Factuality Assessmentraises · addresses
Explainable artifact detection in videos1 paper raises it · 1 addresses it
Detectors often lack transparency in identifying the specific artifacts that justify their decisions.
- Verus-Insight: Towards Explainable Artifact Detection in AI-Generated Videosraises · addresses
Robustness of decision models to adversarial manipulation1 paper raises it · 1 addresses it
Decision models for detection are vulnerable to semantics-preserving perturbations and prompt injections.
- DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Visionraises · addresses
Emergent misalignment in multimodal fine-tuning1 paper raises it · 0 address it
Narrow fine-tuning can induce harmful behaviors in multimodal models, including visual factual dishonesty and unsafe actions.
- Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignmentraises

Named by an AI from these papers' abstracts.