提出防御图像伪造定位中对抗噪声的新方法,提升模型鲁棒性。
Active Adversarial Noise Suppression for Image Forgery Localization
- 通过特征对齐减少对抗与原始伪造图像的特征分布差异
- 双掩码约束使防御扰动在对抗和原始图像上均有效
- 首次实现伪造定位任务的对抗防御,适合安全检测场景
深度学习推动了图像伪造定位的发展,但现有模型易受对抗攻击:细微噪声可严重误导模型。本文提出对抗噪声抑制模块(ANSM),生成防御扰动以抑制对抗噪声影响。观察发现,对抗与原始伪造图像中的伪造相关特征分布不同。为此,我们引入第一阶段训练策略——伪造相关特征对齐(FFA),通过最小化通道级KL散度减少分布差异。第二阶段设计掩码引导精炼(MgR),引入双掩码约束,确保扰动在对抗与原始伪造图像上均有效,使定位准确率恢复至原始水平。大量实验表明,该方法显著提升模型在对抗图像上的表现;当应用于原始伪造图像时,性能几乎不受影响。据我们所知,这是首个针对图像伪造定位任务的对抗防御报告。代码与反取证数据集已开源。
原文摘要 · Abstract (English)
Recent advances in deep learning have significantly propelled the development of image forgery localization. However, existing models remain highly vulnerable to adversarial attacks: imperceptible noise added to forged images can severely mislead these models. In this paper, we address this challenge with an Adversarial Noise Suppression Module (ANSM) that generate a defensive perturbation to suppress the attack effect of adversarial noise. We observe that forgery-relevant features extracted from adversarial and original forged images exhibit distinct distributions. To bridge this gap, we introduce Forgery-relevant Features Alignment (FFA) as a first-stage training strategy, which reduces distributional discrepancies by minimizing the channel-wise Kullback-Leibler divergence between these features. To further refine the defensive perturbation, we design a second-stage training strategy, termed Mask-guided Refinement (MgR), which incorporates a dual-mask constraint. MgR ensures that the perturbation remains effective for both adversarial and original forged images, recovering forgery localization accuracy to their original level. Extensive experiments across various attack algorithms demonstrate that our method significantly restores the forgery localization model's performance on adversarial images. Notably, when ANSM is applied to original forged images, the performance remains nearly unaffected. To our best knowledge, this is the first report of adversarial defense in image forgery localization tasks. We have released the source code and anti-forensics dataset.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。