Creating Blank Canvas Against AI-enabled Image Forgery

TL;DR

This paper tackles the rising threat of AI-enabled image forgery by shifting tamper localization from post-hoc analysis to proactive protection. It introduces a blank-canvas strategy that makes tampering more detectable by the Segment Anything Model when perturbed in a frequency-aware manner. Through a training-free framework combining wavelet-domain high-frequency disruption, structural preservation, and adaptive spectral optimization, the method achieves robust tamper localization on classical benchmarks and AIGC-edited images. The results suggest a scalable, model-agnostic path toward reliable image authentication in real-world settings.

Abstract

AIGC-based image editing technology has greatly simplified the realistic-level image modification, causing serious potential risks of image forgery. This paper introduces a new approach to tampering detection using the Segment Anything Model (SAM). Instead of training SAM to identify tampered areas, we propose a novel strategy. The entire image is transformed into a blank canvas from the perspective of neural models. Any modifications to this blank canvas would be noticeable to the models. To achieve this idea, we introduce adversarial perturbations to prevent SAM from ``seeing anything'', allowing it to identify forged regions when the image is tampered with. Due to SAM's powerful perceiving capabilities, naive adversarial attacks cannot completely tame SAM. To thoroughly deceive SAM and make it blind to the image, we introduce a frequency-aware optimization strategy, which further enhances the capability of tamper localization. Extensive experimental results demonstrate the effectiveness of our method.

Figures (5)

• Figure 1: Predicted segmentation confidence maps from the segment anything model. Previous adversarial attack zhang2023attack could not fully disrupt the SAM's perception, especially in edges and texture areas.
• Figure 2: Overview of our tamper localization framework. (a) The protection process transforms an original image into a protected image through our blank canvas creation mechanism. (b) Illustration of potential malicious image manipulation on the protected image. (c) The blank canvas creation process demonstrates how the original image generates detailed SAM segmentation results while our protected image appears as a blank canvas to SAM kirillov2023segment. (d) The tampering detection phase shows SAM kirillov2023segment successfully identifying the tampered region when the protected image is maliciously manipulated.
• Figure 3: Overall of our method. We enable the source image to be a "blank canvas" from the perspective of SAM. Frequency-aware optimization is proposed to disrupt the high-frequency areas to deceive the SAM model fully. After the image is protected, the tampered locations become noticeable to SAM.
• Figure 4: Visual results of localized tampering areas. Our method achieves superior performance compared to previous passive tamper localization methods, including OSN wu2022robust, CAT-Net kwon2021cat, MVSS dong2022mvss, and FakeShield xu2024fakeshield. We also achieve comparable performance compared to protective methods EditGuard zhang2024editguard across each scene.
• Figure 5: Ablation study on the proposed frequency-aware optimization. False positive results could occur in high-frequency areas as they are more likely to be noticed by SAM. The red/blue box indicates the false/true positives of localized regions.