# Improving the security of Image Manipulation Detection through One-and-a-half-class Multiple Classification

arXiv: https://arxiv.org/abs/1902.08446 · HTML: https://mlsanity.com/paper/1902.08446/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Feb 2019.

## Built on by (most cited first, 3 of 3)

- [Leveraging Ensembles and Self-Supervised Learning for Fully-Unsupervised Person Re-Identification and Text Authorship Attribution](https://mlsanity.com/paper/2202.03126/) (2022)
- [Employing Deep Ensemble Learning for Improving the Security of Computer Networks against Adversarial Attacks](https://mlsanity.com/paper/2209.12195/) (2022)
- [Spritz-PS: Validation of Synthetic Face Images Using a Large Dataset of Printed Documents](https://mlsanity.com/paper/2304.02982/) (2023)

## Abstract (arXiv)

Protecting image manipulation detectors against perfect knowledge attacks requires the adoption of detector architectures which are intrinsically difficult to attack. In this paper, we do so, by exploiting a recently proposed multiple-classifier architecture combining the improved security of 1-Class (1C) classification and the good performance ensured by conventional 2-Class (2C) classification in the absence of attacks. The architecture, also known as 1.5-Class (1.5C) classifier, consists of one 2C classifier and two 1C classifiers run in parallel followed by a final 1C classifier. In our system, the first three classifiers are implemented by means of Support Vector Machines (SVM) fed with SPAM features. The outputs of such classifiers are then processed by a final 1C SVM in charge of making the final decision. Particular care is taken to design a proper strategy to train the SVMs the 1.5C classifier relies on. This is a crucial task, due to the difficulty of training the two 1C classifiers at the front end of the system. We assessed the performance of the proposed solution with regard to three manipulation detection tasks, namely image resizing, contrast enhancement and median filtering. As a result, the security improvement allowed by the 1.5C architecture with respect to a conventional 2C solution is confirmed, with a performance loss in the absence of attacks that remains at a negligible level.