APT: Anchor-aligned Perturbations for Tamper Localization in Fully Regenerated Images
2026-08-31 • Computer Vision and Pattern Recognition
Computer Vision and Pattern Recognition
AI summaryⓘ
The authors look at ways to detect tampering in images by embedding hidden signals before sharing them. Current methods work if only small parts of the image are changed, but fail when large parts are fully redone using advanced techniques like diffusion inpainting. They propose a new method called APT that hides signals in a way that helps spot differences between original and altered parts, even after heavy editing. Their tests show APT works much better than older methods and can handle various kinds of tampering that it hasn't seen before.
proactive tamper localizationimage inpaintingdiffusion modelslatent-space perturbationsemi-fragile watermarkingfeature alignmenthard negative miningCOCO datasetimage forensicsintersection over union (IoU)
Authors
Suhyeon Ha, Woo Jae Kim, Joonsung Jeon, Sooel Son, Sung-eui Yoon
Abstract
Proactive tamper localization embeds an imperceptible signal into an image prior to distribution, enabling pixel-level manipulation detection. Existing methods assume a spliced (SP) setting, where synthesized regions are composited onto the original background, leaving embedded signals intact. However, real-world diffusion-based inpainting operates in a fully regenerated (FR) setting, where the entire image undergoes denoising, disrupting background signals and rendering existing frameworks ineffective. We propose APT, a semi-fragile latent-space perturbation that embeds a dense, vector-wise localization signal. By aligning each spatial feature vector toward a fixed anchor direction, APT localizes tampering via the alignment disparity between synthesized foreground and anchor-aligned background features after inpainting. The proposed hard negative mining loss and noisy perturbation branch further enforce uniform alignment. Experiments on COCO demonstrate that APT achieves an FR IoU of 0.92, outperforming the strongest baseline (WAM, 0.84), while existing methods collapse to near-random performance (AUC 0.5), establishing APT as a practical forensic framework generalizable across tampering types unknown at test time.