Active Adversarial Noise Suppression for Image Forgery Localization

TL;DR

This paper introduces an adversarial noise suppression method for image forgery localization that effectively defends against adversarial attacks while preserving localization accuracy on original images.

Contribution

It proposes a novel Adversarial Noise Suppression Module with Forgery-relevant Features Alignment and Mask-guided Refinement strategies for robust forgery localization.

Findings

Significantly improves localization performance on adversarial images.

Maintains high accuracy on original forged images.

First to address adversarial defense in image forgery localization.

Abstract

Recent advances in deep learning have significantly propelled the development of image forgery localization. However, existing models remain highly vulnerable to adversarial attacks: imperceptible noise added to forged images can severely mislead these models. In this paper, we address this challenge with an Adversarial Noise Suppression Module (ANSM) that generate a defensive perturbation to suppress the attack effect of adversarial noise. We observe that forgery-relevant features extracted from adversarial and original forged images exhibit distinct distributions. To bridge this gap, we introduce Forgery-relevant Features Alignment (FFA) as a first-stage training strategy, which reduces distributional discrepancies by minimizing the channel-wise Kullback-Leibler divergence between these features. To further refine the defensive perturbation, we design a second-stage training strategy, termed Mask-guided Refinement (MgR), which incorporates a dual-mask constraint. MgR ensures that the perturbation remains effective for both adversarial and original forged images, recovering forgery localization accuracy to their original level. Extensive experiments across various attack algorithms demonstrate that our method significantly restores the forgery localization model's performance on adversarial images. Notably, when ANSM is applied to original forged images, the performance remains nearly unaffected. To our best knowledge, this is the first report of adversarial defense in image forgery localization tasks. We have released the source code and anti-forensics dataset.