# Attacking Image Splicing Detection and Localization Algorithms Using Synthetic Traces

arXiv: https://arxiv.org/abs/2211.12314 · HTML: https://mlsanity.com/paper/2211.12314/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 45 references that are in the map.
- First posted on arXiv 22 Nov 2022.

## Builds on (most cited first, 20 of 20)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey](https://mlsanity.com/paper/1801.00553/) (2018)
- [Detecting and Simulating Artifacts in GAN Fake Images](https://mlsanity.com/paper/1907.06515/) (2019)
- [Media Forensics and DeepFakes: an overview](https://mlsanity.com/paper/2001.06564/) (2020)
- [Fighting Fake News: Image Splice Detection via Learned Self-Consistency](https://mlsanity.com/paper/1805.04096/) (2018)
- [Technical Report on the CleverHans v2.1.0 Adversarial Examples Library](https://mlsanity.com/paper/1610.00768/) (2016)
- [Noiseprint: a CNN-based camera model fingerprint](https://mlsanity.com/paper/1808.08396/) (2018)
- [Evading Deepfake-Image Detectors with White- and Black-Box Attacks](https://mlsanity.com/paper/2004.00622/) (2020)
- [Towards Transferable Adversarial Attack against Deep Face Recognition](https://mlsanity.com/paper/2004.05790/) (2020)
- [Recasting Residual-based Local Descriptors as Convolutional Neural Networks: an Application to Image Forgery Detection](https://mlsanity.com/paper/1703.04615/) (2017)
- [Forensic Similarity for Digital Images](https://mlsanity.com/paper/1902.04684/) (2019)
- [Aligned and Non-Aligned Double JPEG Detection Using Convolutional Neural Networks](https://mlsanity.com/paper/1708.00930/) (2017)
- [Exposing Fake Images with Forensic Similarity Graphs](https://mlsanity.com/paper/1912.02861/) (2019)
- [LOTS about Attacking Deep Features](https://mlsanity.com/paper/1611.06179/) (2016)
- [On the Transferability of Adversarial Examples Against CNN-Based Image Forensics](https://mlsanity.com/paper/1811.01629/) (2018)
- [A Counter-Forensic Method for CNN-Based Camera Model Identification](https://mlsanity.com/paper/1805.02131/) (2018)
- [Adversarial Attack on Deep Learning-Based Splice Localization](https://mlsanity.com/paper/2004.08443/) (2020)

## Built on by (most cited first, 3 of 3)

- [Transferable Adversarial Attack on Image Tampering Localization](https://mlsanity.com/paper/2309.10243/) (2023)
- [Hiding Local Manipulations on SAR Images: a Counter-Forensic Attack](https://mlsanity.com/paper/2407.07041/) (2024)
- [Advantage-based Temporal Attack in Reinforcement Learning](https://mlsanity.com/paper/2602.19582/) (2026)

## Abstract (arXiv)

Recent advances in deep learning have enabled forensics researchers to develop a new class of image splicing detection and localization algorithms. These algorithms identify spliced content by detecting localized inconsistencies in forensic traces using Siamese neural networks, either explicitly during analysis or implicitly during training. At the same time, deep learning has enabled new forms of anti-forensic attacks, such as adversarial examples and generative adversarial network (GAN) based attacks. Thus far, however, no anti-forensic attack has been demonstrated against image splicing detection and localization algorithms. In this paper, we propose a new GAN-based anti-forensic attack that is able to fool state-of-the-art splicing detection and localization algorithms such as EXIF-Net, Noiseprint, and Forensic Similarity Graphs. This attack operates by adversarially training an anti-forensic generator against a set of Siamese neural networks so that it is able to create synthetic forensic traces. Under analysis, these synthetic traces appear authentic and are self-consistent throughout an image. Through a series of experiments, we demonstrate that our attack is capable of fooling forensic splicing detection and localization algorithms without introducing visually detectable artifacts into an attacked image. Additionally, we demonstrate that our attack outperforms existing alternative attack approaches. %