Research map / Adversarial robustness and security / Certified and empirical robustness

Towards Better Robustness Against Natural Corruptions in Document Tampering Localization

AAAI 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Adversarial training with feature consistency

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes adversarial forensic regularization (mutual-information min-max training with JSD estimation) plus a distribution divergence regularizer to improve document tampering localization robustness against natural corruptions such as JPEG, Gaussian noise and WeChat OSN transmission, and releases the TSroie-CRP corruption dataset.

Problem

Document tampering localization models are highly vulnerable to natural corruptions (noise, JPEG compression, OSN transmission), and this robustness has been under-explored compared with adversarial robustness.

Approach

Treats forensic dependency between tampered and authentic pixel representations as mutual information, approximates it with a JSD-based estimator using in-batch empirical sampling, and uses it in a min-max adversarial training loop (AFR), combined with a divergence regularizer between clean and perturbed representations (DDR).

Key results

• On TSroie-CRP under WeChat OSN corruption, the proposed method reaches 69.8% F1 versus 46.9% for vanilla DTL and 66.1% for the best prior AT baseline (DDC-AT).
• Under Gaussian noise with sigma=30 the method achieves 77.6% F1, about 101.6% higher than the second-best AT method.
• Against FGSM adversarial attack it reaches 85.1% F1, 2.6% above the second-best (LM-AT, 82.5%), with clean F1 of 90.9% versus 95.2% for vanilla DTL.

Measured effects reported in the paper

Surprising findings

• Standard data augmentation with JPEG or Gaussian noise at specific parameters improves robustness only to that exact corruption and can drop to near 0% on other corruption types.
• MI maximization alone (adversarial example generation without the minimization step) lowers clean F1 from 95.2% to 86.9%.

Limitations

• Only a limited set of natural corruptions (Gaussian noise, JPEG, WeChat) is covered in TSroie-CRP.
• Evaluated on a single vanilla DTL backbone and one benchmark dataset (TSroie).
• Clean F1 drops relative to vanilla DTL (90.9% vs 95.2%).

Experimental setup

Datasets: TSroie

Benchmarks: TSroie-CRP TSroie

Metrics: F1

Baselines: Vanilla DTL PGD-AT Trades-AT DDC-AT SegPGD-AT LM-AT JPEG/GN data augmentation

Builds on: adversarial training Jensen-Shannon MI estimation (Hjelm et al. 2019) TRADES PGD-AT LM-AT

Closest papers by meaning

• Toward Real-world Text Image Forgery Localization: Structured and Interpretable Data Synthesis (NeurIPS 2025 · similarity 0.84)
• Learning Discriminative Noise Guidance for Image Forgery Detection and Localization (AAAI 2024 · similarity 0.83)
• SUMI-IFL: An Information-Theoretic Framework for Image Forgery Localization with Sufficiency and Minimality Constraints (AAAI 2025 · similarity 0.83)
• Average Certified Radius is a Poor Metric for Randomized Smoothing (ICML 2025 · similarity 0.82)
• DiffForensics: Leveraging Diffusion Prior to Image Forgery Detection and Localization (CVPR 2024 · similarity 0.82)
• StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.82)