Perturb, Attend, Detect and Localize (PADL): Robust Proactive Image Defense

TL;DR

PADL introduces a proactive image defense method that generates image-specific, hard-to-reverse perturbations to detect and localize manipulations, demonstrating improved robustness and generalization across diverse generative models.

Contribution

The paper proposes PADL, a novel proactive defense framework using symmetric cross-attention encoding to produce unpredictable perturbations, enhancing robustness and generalization in manipulation detection.

Findings

PADL outperforms prior methods in generalization to unseen models.

It effectively localizes manipulated regions in images.

PADL resists adaptive attacks and reverse engineering.

Abstract

Image manipulation detection and localization have received considerable attention from the research community given the blooming of Generative Models (GMs). Detection methods that follow a passive approach may overfit to specific GMs, limiting their application in real-world scenarios, due to the growing diversity of generative models. Recently, approaches based on a proactive framework have shown the possibility of dealing with this limitation. However, these methods suffer from two main limitations, which raises concerns about potential vulnerabilities: i) the manipulation detector is not robust to noise and hence can be easily fooled; ii) the fact that they rely on fixed perturbations for image protection offers a predictable exploit for malicious attackers, enabling them to reverse-engineer and evade detection. To overcome this issue we propose PADL, a new solution able to generate image-specific perturbations using a symmetric scheme of encoding and decoding based on cross-attention, which drastically reduces the possibility of reverse engineering, even when evaluated with adaptive attack [31]. Additionally, PADL is able to pinpoint manipulated areas, facilitating the identification of specific regions that have undergone alterations, and has more generalization power than prior art on held-out generative models. Indeed, although being trained only on an attribute manipulation GAN model [15], our method generalizes to a range of unseen models with diverse architectural designs, such as StarGANv2, BlendGAN, DiffAE, StableDiffusion and StableDiffusionXL. Additionally, we introduce a novel evaluation protocol, which offers a fair evaluation of localisation performance in function of detection accuracy and better captures real-world scenarios.