arXiv subjects

Heqi Peng

Publications and source records attributed to Heqi Peng.

4 recordsLinked to original sources

arXiv2025

Generalizable AI-Generated Image Detection Based on Fractal Self-Similarity in the Spectrum

With the rapid development of image synthesis techniques, AI-generated images have become increasingly realistic, which heightens the potential risk associated with their misuse and creates a growing need for reliable detection. However, the growing diversity of generative models makes it increasingly difficult for detectors to generalize to images produced by unseen generators. Most existing methods rely on artifacts associated with specific generators, which limits their generalization to images produced by unseen models. To address this problem, we investigate structural characteristics arising from the image generation process itself. Image generation fundamentally involves constructing spatially rich content from more compact representations, while preserving the semantic identity of structures across different spatial locations. We formalize these properties through dimension-increasing shift-equivariant transformations and show that such transformations induce a self-similar structure in the Fourier spectrum. Across successive generation stages, this structure can propagate recursively and form a hierarchical fractal self-similar pattern. Consequently, different spectral sub-regions exhibit consistent structural correspondences inherited from the generation process, providing a generator-agnostic cue for detection. Based on this observation, we propose Fractal-CNN, which captures spectral self-similarity rather than generator-specific spectral values. Extensive experiments across diverse GAN- and diffusion-based generators demonstrate that Fractal-CNN achieves strong cross-generator generalization, with an average detection accuracy of 93.93% across 16 test generators.

cs.CV↗

arXiv2025

Deepfake Detection via Knowledge Injection

Deepfake detection technologies become vital because current generative AI models can generate realistic deepfakes, which may be utilized in malicious purposes. Existing deepfake detection methods either rely on developing classification methods to better fit the distributions of the training data, or exploiting forgery synthesis mechanisms to learn a more comprehensive forgery distribution. Unfortunately, these methods tend to overlook the essential role of real data knowledge, which limits their generalization ability in processing the unseen real and fake data. To tackle these challenges, in this paper, we propose a simple and novel approach, named Knowledge Injection based deepfake Detection (KID), by constructing a multi-task learning based knowledge injection framework, which can be easily plugged into existing ViT-based backbone models, including foundation models. Specifically, a knowledge injection module is proposed to learn and inject necessary knowledge into the backbone model, to achieve a more accurate modeling of the distributions of real and fake data. A coarse-grained forgery localization branch is constructed to learn the forgery locations in a multi-task learning manner, to enrich the learned forgery knowledge for the knowledge injection module. Two layer-wise suppression and contrast losses are proposed to emphasize the knowledge of real data in the knowledge injection module, to further balance the portions of the real and fake knowledge. Extensive experiments have demonstrated that our KID possesses excellent compatibility with different scales of Vit-based backbone models, and achieves state-of-the-art generalization performance while enhancing the training convergence speed.

cs.CV↗

arXiv2024

LSP Framework: A Compensatory Model for Defeating Trigger Reverse Engineering via Label Smoothing Poisoning

Deep neural networks are vulnerable to backdoor attacks. Among the existing backdoor defense methods, trigger reverse engineering based approaches, which reconstruct the backdoor triggers via optimizations, are the most versatile and effective ones compared to other types of methods. In this paper, we summarize and construct a generic paradigm for the typical trigger reverse engineering process. Based on this paradigm, we propose a new perspective to defeat trigger reverse engineering by manipulating the classification confidence of backdoor samples. To determine the specific modifications of classification confidence, we propose a compensatory model to compute the lower bound of the modification. With proper modifications, the backdoor attack can easily bypass the trigger reverse engineering based methods. To achieve this objective, we propose a Label Smoothing Poisoning (LSP) framework, which leverages label smoothing to specifically manipulate the classification confidences of backdoor samples. Extensive experiments demonstrate that the proposed work can defeat the state-of-the-art trigger reverse engineering based methods, and possess good compatibility with a variety of existing backdoor attacks.

cs.CR↗

arXiv2024

AED-PADA:Improving Generalizability of Adversarial Example Detection via Principal Adversarial Domain Adaptation

Adversarial example detection, which can be conveniently applied in many scenarios, is important in the area of adversarial defense. Unfortunately, existing detection methods suffer from poor generalization performance, because their training process usually relies on the examples generated from a single known adversarial attack and there exists a large discrepancy between the training and unseen testing adversarial examples. To address this issue, we propose a novel method, named Adversarial Example Detection via Principal Adversarial Domain Adaptation (AED-PADA). Specifically, our approach identifies the Principal Adversarial Domains (PADs), i.e., a combination of features of the adversarial examples generated by different attacks, which possesses a large portion of the entire adversarial feature space. Subsequently, we pioneer to exploit Multi-source Unsupervised Domain Adaptation in adversarial example detection, with PADs as the source domains. Experimental results demonstrate the superior generalization ability of our proposed AED-PADA. Note that this superiority is particularly achieved in challenging scenarios characterized by employing the minimal magnitude constraint for the perturbations.

cs.CV↗