Research map / Adversarial robustness and security / Black-box and transfer attacks
Query-efficient Attack for Black-box Image Inpainting Forensics via Reinforcement Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RLGC, a query-efficient black-box anti-forensics attack on inpainting forensics that uses pixel-wise A3C agents to add ±1/0 perturbations, averaging about 2.44 queries per image.
Problem
Inpainting forensics models are deployed as black-box systems, and existing anti-forensics attacks are white-box or transfer-based, or need many queries (over 10) for query-based methods; the paper targets attacks that succeed with very few queries while keeping images visually undistorted.
Approach
Model the query-based attack as an MDP in which pixel-wise actor-critic agents, trained with A3C, choose per-pixel perturbations of {-1, 0, +1} from query feedback, with a reward balancing forensic-mask disruption and image distortion, and a stopping rule that ends querying once the F1 drop falls below 0.02.
Key results
- Against IID-Net, RLGC reduces F1-score from 84.85% to 21.33% (-63.52%), outperforming white-box FGSM (22.40%) and Square Attack (52.82%) with up to 250 queries.
- Most attacked images (71.87%) need only 2 queries, with an average of 2.44 queries per image.
- Attack images keep high quality, with PSNR around 42.5-42.7 dB and SSIM around 0.976-0.980 across the three forensics models.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RLGC instead of no attack | Li-Net · Li-Net test set | F1-score: 71.71% -> 24.45% | Helped |
| Use RLGC instead of no attack | Li-Net · Li-Net test set | IOU: 62.13% -> 16.15% | Helped |
| Use RLGC instead of no attack | Li-Net · Li-Net test set | AUC: 83.13% -> 61.52% | Helped |
| Use RLGC instead of no attack | IID-Net · IID-Net test set | F1-score: 84.85% -> 21.33% | Helped |
| Use RLGC instead of no attack | IID-Net · IID-Net test set | IOU: 78.32% -> 14.93% | Helped |
| Use RLGC instead of no attack | IID-Net · IID-Net test set | AUC: 98.21% -> 61.44% | Helped |
| Use RLGC instead of no attack | Yang-Net · Yang-Net test set | F1-score: 85.07% -> 21.79% | Helped |
| Use RLGC instead of no attack | Yang-Net · Yang-Net test set | IOU: 79.56% -> 14.42% | Helped |
| Use RLGC instead of no attack | Yang-Net · Yang-Net test set | AUC: 95.58% -> 59.68% | Helped |
| Use RLGC instead of FGSM | Li-Net · Li-Net test set | F1-score: 25.92% -> 24.45% | Helped |
| Use RLGC instead of FGSM | IID-Net · IID-Net test set | F1-score: 22.40% -> 21.33% | Helped |
| Use RLGC instead of FGSM | Yang-Net · Yang-Net test set | F1-score: 29.89% -> 21.79% | Helped |
Surprising findings
- RLGC, a black-box method, outperforms the white-box FGSM baseline on most F1, IOU and AUC metrics.
- With training on a single inpainting method, RLGC still achieves IOU around 15-20% against IID-Net, showing generalization to unseen inpainting methods.
Limitations
- Attack is evaluated only on image inpainting forensics with a small set of detectors (IID-Net, Li-Net, Yang-Net) and a single attack-type setting.
- Relies on a stopping threshold (0.02 F1 drop) and a fixed perturbation magnitude of 1 per query, which are hand-set.
- Compute and training details are limited to one L40 GPU for about 25 hours.
Experimental setup
Datasets: Places Dresden CelebA ImageNet Liu et al. 2018 irregular masks
Benchmarks: DA test split (inpainting forensics attack)
Metrics: F1-score IOU AUC PSNR SSIM query times
Baselines: FGSM Square Attack
Builds on: A3C FGSM Square Attack IID-Net EfficientNet
Closest papers by meaning
- Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection (NeurIPS 2024 · similarity 0.85)
- Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters (AAAI 2025 · similarity 0.85)
- AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption (ICLR 2025 · similarity 0.84)
- PrefPaint: Aligning Image Inpainting Diffusion Model with Human Preference (NeurIPS 2024 · similarity 0.83)
- Distraction is All You Need: Memory-Efficient Image Immunization against Diffusion-Based Image Editing (CVPR 2024 · similarity 0.83)
- A Bias-Free Training Paradigm for More General AI-generated Image Detection (CVPR 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.