ABSTRACT Deepfake detection models achieve high accuracy, yet their interpretability remains underexplored. This study presents a unified evaluation pipeline for post hoc visual explanations, grounded in the Co‐12 attributes of explanation quality and operationalised through a structured framework that assesses Coherence, Composition, Correctness, Completeness, Compactness, Covariate completeness and Continuity. Applying this pipeline to 16 representative explanation methods reveals systematic differences across methodological categories. CAM‐based approaches demonstrate strong spatial coherence and temporal continuity; gradient‐based techniques such as Guided Backprop and LRP yield compact and accurate attributions; and redistribution‐based methods including ExcitationBP and Deep Taylor maintain high consistency across evaluation conditions. In contrast, perturbation‐based approaches such as SHAP and LIME exhibit weaker localisation and reduced temporal stability. By enabling controlled, attribute‐level comparison of explanation methods, the proposed pipeline bridges conceptual interpretability frameworks and empirical analysis, offering practical guidance for the development and deployment of interpretable deepfake detectors in forensic and auditing applications. The source code is publicly available at: https://github.com/junxinchenieee/EAI‐Deepfake‐Detection .

ABSTRACT In recent years, artificial intelligence technologies have been widely used, bringing security, convenience and certain risks. Deepfake techniques raise significant security concerns by manipulating facial images to create convincing but false representations. We introduce a novel mask‐supervision‐based deepfake detection method to improve detection performance in this context. Our approach corrects the model's focus on irrelevant regions through mask supervision, using pixel‐level labels to guide the model towards synthetic facial regions and ensure more accurate extraction of spatial features. In addition, we incorporate a frequency‐domain feature extraction module that exploits the robustness of frequency‐domain cues to compression artefacts. We first preprocess the input image and then feed it into the mask supervision and frequency‐domain feature extraction modules. The mask supervision module extracts intermediate features using the High‐Resolution Network (HRNet) and refines spatial features by guiding the prediction mask with the ground‐truth mask. The frequency‐domain module extracts features via the Discrete Cosine Transform (DCT) and filtering across different frequency bands. Finally, spatial and frequency‐domain features are concatenated and fed into a classification network to output the final prediction. Experimental results show that our method maintains good robustness in compressed scenarios.

With the growing deployment of text-to-image diffusion models in real-world applications, concerns about model copyright have become increasingly prominent. Model watermarking has emerged as a promising solution. However, existing methods often suffer from degradation of model fidelity and poor scalability in model distribution scenarios. Moreover, recent studies have shown that some watermarking approaches lack robustness against ambiguity attacks. To address these challenges, we propose TD-MoW, a lightweight and plug-and-play watermarking framework that enables robust and scalable watermark embedding. TD-MoW consists of a two-stage process: In the first stage, we independently optimize the word embeddings of the watermark trigger along with a Low-Rank Adaptation (LoRA) module, effectively decoupling watermark learning from the original generation objective without modifying the base model. In the second stage, inspired by the Mixture-of-Experts (MoE), we introduce the MoW mechanism, which integrates multiple specialized watermark experts into the model. Through encoding optimization for watermarking, we enablenwatermark experts to support up to2nusers, reducing the complexityO(2n) toO(n). Moreover, by leveraging gated activation, the watermark experts remain inactive during standard inference, thereby preserving generation fidelity. Extensive experiments demonstrate that our method not only achieves superior efficiency and generation fidelity compared to prior approaches, but also exhibits strong robustness.

Visual Prompt (VP) learning has rapidly emerged as a popular paradigm for parameter-efficient task adaptation in CLIP-based models. However, while VP optimizes pixel-space vectors without altering CLIP’s internal weights, this decoupled design inadvertently introduces critical security vulnerabilities. Attackers can exploit VP to implant covert backdoors using imperceptible trigger patterns that bypass traditional anomaly detection mechanisms, posing significant risks to real-world applications. Existing backdoor techniques, however, rely on visually noticeable patterns and exhibit inconsistencies in representation alignment, which make them prone to detection and ineffective against robust defenses. In response to these limitations, we propose Stealthy Backdoor Carriers (SBC), a novel attack framework that leverages CLIP’s inherent vulnerabilities to covertly and persistently inject backdoors.SBCadopts a dual-constrained optimization strategy that balances imperceptibility—minimizing trigger perturbations for visual stealth—and cross-modal embedding alignment—ensuring poisoned and target samples share consistent representations within CLIP’s multimodal space. Experimental results across five benchmark datasets demonstrateSBC’s exceptional effectiveness, achieving a +49.63% improvement in attack success rate relative to existing methods while maintaining robustness against advanced defenses like Neural Cleanse. Our work highlights the need for reevaluating the security implications of VP learning frameworks and provides valuable insights for mitigating prompt-based vulnerabilities in AI systems. Our code is available at https://github.com/Maozhen-Zhang/sbc.git.

With the increasingly widespread application of federated learning (FL) in various fields, the issue of backdoor attacks against FL has garnered significant attention from both academia and industry. While there has been some progress in researching backdoor attacks against FL, data backdoor attacks are easily mitigated in federated environments, and model backdoor attacks are susceptible to detection by defense mechanisms. Therefore, we propose a refined backdoor attack method tailored for FL under the image classification task. Our method involves the collaborative operation of three key modules. Firstly, the parameter importance analysis module identifies parameters with minimal impact on model performance, and creates parameter importance masks to provide precise targets for subsequent operations. Subsequently, the activation difference computation module calculates the activation differences between backdoor samples and benign samples to locate trigger-sensitive parameters. Our method implants the backdoor by flipping and zeroing the precisely located layer parameters, while maintaining the model's classification performance on benign samples. Experimental results show that our method is feasible to achieve an average attack success rate more than 99% across the three victim models. This demonstrates the effectiveness of our method in FL environments and its robustness against various FL defense mechanisms.

As privacy protection gains momentum, federated learning has emerged as a cutting-edge approach in medical image analysis. However, the intricacies of medical image segmentation task have led to a dearth of research in this domain, with existing studies falling short in tackling two pivotal challenges: The traditional model with the uniform global model underperforms for certain clients due to the heterogeneity and non-Independent Identically Distributed(non-IID) data across medical institutions. And the communication between the server and clients often incurs significant time costs. This paper introduces a novel Personalized Asynchronous Federated learning for Medical Image Segmentation model, dubbed PAFedMIS, to mitigate the negative impact of the heterogeneous data and fully utilized the waiting time, in medical image segmentation. Comprehensive experiments on ISIC2018 demonstrate the enhanced model accuracy and training efficiency of PAFedMIS.

Detecting deepfake media remains an ongoing challenge, particularly as forgery techniques rapidly evolve and become increasingly diverse. Existing face forgery detection models typically attempt to discriminate fake images by identifying either spatial artifacts (e.g., generative distortions and blending inconsistencies) or predominantly frequency‐based artifacts (e.g., GAN fingerprints). However, a singular focus on a single type of forgery cue can lead to limited model performance. In this work, we propose a novel cross‐domain approach that leverages a combination of both spatial and frequency‐aware cues to enhance deepfake detection. First, we extract wavelet features using wavelet transformation and residual features using a specialized frequency domain filter. These complementary feature representations are then concatenated to obtain a composite frequency domain feature set. Furthermore, we introduce an adaptive feature fusion module that integrates the RGB color features of the image with the composite frequency domain features, resulting in a rich, multifaceted set of classification features. Extensive experiments conducted on benchmark deepfake detection datasets demonstrate the effectiveness of our method. Notably, the accuracy of our method on the challenging FF++ dataset is mostly above 98%, showcasing its strong performance in reliably identifying deepfake images across diverse forgery techniques.

In recent years, the field of audio deepfake detection has witnessed significant advancements. Nonetheless, the majority of solutions have concentrated on high-quality audio, largely overlooking the challenge of low-quality compressed audio in real-world scenarios. Low-quality compressed audio typically suffers from a loss of high-frequency details and time-domain information, which significantly undermines the performance of advanced deepfake detection systems when confronted with such data. In this paper, we introduce a deepfake detection model that employs knowledge distillation across the frequency and time domains. Our approach aims to train a teacher model with high-quality data and a student model with low-quality compressed data. Subsequently, we implement frequency-domain and time-domain distillation to facilitate the student model's learning of high-frequency information and time-domain details from the teacher model. Experimental evaluations on the ASVspoof 2019 LA and ASVspoof 2021 DF datasets illustrate the effectiveness of our methodology. On the ASVspoof 2021 DF dataset, which consists of low-quality compressed audio, we achieved an Equal Error Rate (EER) of 2.82%. To our knowledge, this performance is the best among all deepfake voice detection systems tested on the ASVspoof 2021 DF dataset. Additionally, our method proves to be versatile, showing notable performance on high-quality data with an EER of 0.30% on the ASVspoof 2019 LA dataset, closely approaching state-of-the-art results.

Aremarkable number of backdoor attack methods have been proposed in the literature on deep neural networks (DNNs). However, it hasn't been sufficiently addressed in the existing methods of achieving true senseless backdoor attacks that are visually invisible and label-consistent. In this paper, we propose a new backdoor attack method where the labels of the backdoor images are perfectly aligned with their content, ensuring label consistency. Additionally, the backdoor trigger is meticulously designed, allowing the attack to evade DNN model checks and human inspection. Our approach employs an auto-encoder (AE) to conduct representation learning of benign images and interferes with salient classification features to increase the dependence of backdoor image classification on backdoor triggers. To ensure visual invisibility, we implement a method inspired by image steganography that embeds trigger patterns into the image using the DNN and enable sample-specific backdoor triggers. We conduct comprehensive experiments on multiple benchmark datasets and network architectures to verify the effectiveness of our proposed method under the metric of attack success rate and invisibility. The results also demonstrate satisfactory performance against a variety of defense methods.

Though existing researches have achieved impressive results in controlled text generation, they focus mainly on single-attribute control. However, in applications like automatic comments, the topic and sentiment need to be controlled simultaneously. In this work, we propose a new framework for multi-attribute controlled text generation. To achieve this, we design a contrastive-generator that can effectively generate texts with more attributes. In order to increase the convergence of the text on the desired attributes, we adopt an external-discriminator to distinguish whether the generated text holds the desired attributes. Moreover, we propose top-n weighted decoding to further improve the relevance of texts to attributes. Automated evaluations and human evaluations show that our framework achieves remarkable controllability in multi-attribute generation while keeping the text fluent and diverse. It also yields promising performance on zero-shot generation.

As image and video forgery can be easily used for malicious purposes, the detection of such forgeries has social and technical significance. In this work, we are particularly interested in the detection of Deepfake. For privacy and sensitive data preserving reasons, we engage a flank attack using Federated Learning, a distributed framework-based model which keeps data locally during training while uploading model parameters for aggregate instead. We propose a shallow network for tampering face detection. Also, we made some progress in promoting cross-dataset detection performance which is crucial in Deepfake detection. Our experiments show a well-balanced trade-off result between detection performance and privacy preservation.

Face tampering is an intriguing task in video/image genuineness identification and has attracted significant amounts of attention in recent years. In this work, we propose a face forgery detection method that consists of preprocessing, an improved Siamese network-based feature extractor (including a feature alignment module), and postprocessing (a voting principle). Roughly speaking, our method extracts the features in the grey space of face/background image pairs and measures the difference to make decisions. Experiments on several standard databases prove the effectiveness of our method, and especially on the low-quality subdataset of the FaceForensics++ , our method achieves a competitive result.

In recent years, there has been increasing interest in studying the adversarial attack, which poses potential risks to deep learning applications and has stimulated numerous researches, e.g. improving the robustness of deep neural networks. In this work, we propose a novel double-stream architecture – Guided Erasable Adversarial Attack (GEAA) – for protecting high-quality labeled data with high commercial values under data-sharing scenarios. GEAA contains three phases, the double-stream adversarial attack, denoising reconstruction, and watermark extraction. Specifically, the double-stream adversarial attack injects erasable perturbations into the training data to avoid database abuse. The denoising reconstruction rebuilds the traceable denoising data from adversarial examples. The watermark extraction recovers identity information from the denoised data for copyright protection. Additionally, we introduce the annealing optimization strategy to balance these phases and a boundary constraint to degrade the availability of adversarial examples. Through extensive experiments, we demonstrate the effectiveness of the proposed framework in data protection. The Pytorch® implementations of GEAA can be downloaded from an open-source Github project https://github.com/Dlut-lab-zmn/ GEAA-for-data-protection.

Recent studies highlight the vulnerability of convolutional neural networks (CNNs) to adversarial attacks, which also calls into question the reliability of forensic methods. Existing adversarial attacks generate one-to-one noise, which means these methods have not learned the fingerprint information. Therefore, we introduce two powerful attacks, fingerprint copy-move attack, and joint feature-based auto-learning attack. To validate the performance of attack methods, we move a step ahead and introduce the higher possible defense mechanism relation mismatch. which expands the characterization differences of classifiers in the same classification network. Extensive experiments show that relation mismatch is superior in recognizing adversarial examples and prove that the proposed fingerprint-based attacks are more powerful. Both proposed attacks show excellent attack transferability to unknown samples. The Pytorch® implementations of these methods can download from an open-source GitHub projecthttps://github.com/Dlut-lab-zmn/Source-attack.

Deep neural networks (DNNs) have seen extensive studies on image recognition and classification, image segmentation, and related topics. However, recent studies show that DNNs are vulnerable in defending adversarial examples. The classification network can be deceived by adding a small amount of perturbation to clean samples. There are challenges when researchers want to design a general approach to defend against a wide variety of adversarial examples. To solve this problem, we introduce a defensive method to prevent adversarial examples from generating. Instead of designing a stronger classifier, we built a more robust classification system that can be viewed as a structural black box. After adding a buffer to the classification system, attackers can be efficiently deceived. The real evaluation results of the generated adversarial examples are often contrary to what the attacker thinks. Additionally, we do not assume a specific attack method premise. This incognizance to underlying attacks demonstrates the generalizability of the buffer to potential adversarial attacks. Extensive experiments indicate that the defense method greatly improves the security performance of DNNs.

In recent years, dictionary learning (DL) has shown significant potential in various classification tasks. However, most of previous works aim to learn a synthesis dictionary. The other major category of DL-analysis dictionary learning has not been fully exploited yet. This paper proposes a novel DL method, named Topology Preserving Dictionary Learning (TPDL). First, we propose a triplet-constraint-based topology preserving loss function to capture the underlying local topological structures of data in a supervised manner. Second, a sparse-label-matrix-based function is integrated into the basic analysis model to improve discriminative ability. Third, Huber M-estimator is employed as a robust metric to handle the errors (e.g., outliers and noise) that possibly exist in data. Then, an alternating optimization algorithm is developed based on half-quadratic minimization and alternate search strategy. Closed-form solutions in each alternating optimization stage speed up the minimization process. Experiments on four commonly used datasets show that our proposed TPDL achieves competitive performance in contrast to state-of-the-art DL methods.

In this study, the authors consider additive spread‐spectrum (SS) data embedding in transform‐domain host data. Conventional additive SS embedding schemes use an equal‐amplitude modulated carrier to deposit one information symbol across a group of host data coefficients which act as interference to SS signal of interest. If there is a flexibility of assigning different amplitudes across symbol bits, the probability of error can be further reduced by adaptively allocating amplitude to each symbol bit based on its own host/interference. In this study, they present a novel amplitude‐adaptive SS embedding scheme. Particularly, symbol‐by‐symbol adaptive amplitude allocation algorithms are developed to compensate for the impact from the known interference. They aim at designing the SS embedding amplitude for each symbol adaptively in order to minimise the receiver bit‐error‐rate (BER) at any given distortion level. Then, optimised amplitude allocation for multi‐carrier/multi‐message embedding in the same host data is studied as well. Finally, they consider the problem of amplitude optimisation for an ideal scenario where no external noise is introduced during embedding and transmission. Extensive experimental results illustrate that the proposed amplitude‐adaptive SS embedding scheme can provide order‐of‐magnitude performance improvement over several other state‐of‐the‐art SS embedding schemes.

Discriminative dictionary learning (DDL) has been applied to various pattern classification problems. Despite satisfying experimental results, most existing discriminative dictionary learning methods emphasize too much on the role of l0or l1-norm sparsity, while the underlying local structure of original data is totally ignored. In this paper, we present a novel dictionary learning method, named Locality Sensitive Discriminative Dictionary Learning (LSDDL), which combines basic dictionary learning scheme and locality relationship of original data which is propagated to the coding vectors. The learned discriminative dictionary can map the original data points into a new space in which the nearby points with the same label are close to each other while the nearby points with different labels are far apart. Experiments clearly show that our method has very competitive performance in contrast to previous discriminative dictionary learning methods.

Most universal JPEG steganalysis approaches rely on the assumption that training and testing samples come from the same distribution. They fail when training set and testing set are mismatched. In this paper, we propose generalized transfer component analysis for mismatched JPEG steganalysis to derive new representations from original features for training and testing samples to correct the mismatches. We first apply domain alignment to transform source domain (training set) to an intermediate domain closer to target domain (testing set). Then a set of common transfer components are learnt across two domains by minimizing the distribution distance between them. In the space spanned by these transfer components, two domains manifest similar characteristics and preserve enough discrimination to different categories. Extensive experiments demonstrate our method performs well in mismatched JPEG steganalysis.

Cell-phones have become a necessary communication accessory in daily life. MMS (Multimedia Messaging Service) used by smart phones has caused higher requirement on mobile image manipulation. Classifying image source cell-phones has become a major issue in the cell-phone communication forensics. There are two ways usually used for tracing and identifying the source device: image characteristics and equipment fingerprint. Both of the above schemes require a set of images captured by known source cell-phones for training a classification model. To avoid using any prior knowledge in practical scenarios, a graph based approach was proposed to classify the source cell-phones. Though an acceptable result has been obtained, a problem of incomplete classification appears in the case that one image is classified wrong into a single subset. In this paper, a silhouette coefficient based algorithm is proposed for source cell-phone classification. The spectral clustering algorithm is adopted in graph partitioning and the silhouette coefficient is used to extract the optimal classification from all the possibilities of classification. Experimental results show the validity of the proposed method.

Double compression usually occurs after the image has gone through some kinds of tampering, so double compression detection is a basic mean to assess the authenticity of a given image. In this paper, we propose to model the distribution of the mode based first digits of DCT (Discrete Cosine Transform) coefficients using Markov transition probability matrix and utilize its stationary distribution as features for double compression detection. Experiment results show the effectiveness of the proposed method and comparison has been made to show the improvement by using this second order statistical model.