# Creating Blank Canvas Against AI-enabled Image Forgery

arXiv: https://arxiv.org/abs/2511.22237 · HTML: https://mlsanity.com/paper/2511.22237/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 28 of its 53 references that are in the map.
- First posted on arXiv 27 Nov 2025.

## Builds on (most cited first, 28 of 28)

- [Segment Anything](https://mlsanity.com/paper/2304.02643/) (2023)
- [Hierarchical Text-Conditional Image Generation with CLIP Latents](https://mlsanity.com/paper/2204.06125/) (2022)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis](https://mlsanity.com/paper/2307.01952/) (2023)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [Image Segmentation Using Deep Learning: A Survey](https://mlsanity.com/paper/2001.05566/) (2020)
- [Adversarial Examples for Semantic Segmentation and Object Detection](https://mlsanity.com/paper/1703.08603/) (2017)
- [On the Robustness of Vision Transformers to Adversarial Examples](https://mlsanity.com/paper/2104.02610/) (2021)
- [MVSS-Net: Multi-View Multi-Scale Supervised Networks for Image Manipulation Detection](https://mlsanity.com/paper/2112.08935/) (2021)
- [Image Manipulation Detection by Multi-View Multi-Scale Supervision](https://mlsanity.com/paper/2104.06832/) (2021)
- [EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection](https://mlsanity.com/paper/2312.08883/) (2023)
- [Universal Adversarial Perturbations Against Semantic Image Segmentation](https://mlsanity.com/paper/1704.05712/) (2017)
- [SPAN: Spatial Pyramid Attention Network forImage Manipulation Localization](https://mlsanity.com/paper/2009.00726/) (2020)
- [Image Splicing Localization Using A Multi-Task Fully Convolutional Network (MFCN)](https://mlsanity.com/paper/1709.02016/) (2017)
- [OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking](https://mlsanity.com/paper/2412.01615/) (2024)
- [Rethinking Image Editing Detection in the Era of Generative AI Revolution](https://mlsanity.com/paper/2311.17953/) (2023)
- [Transferable Adversarial Attacks on SAM and Its Downstream Models](https://mlsanity.com/paper/2410.20197/) (2024)
- [Learning to Immunize Images for Tamper Localization and Self-Recovery](https://mlsanity.com/paper/2210.15902/) (2022)
- [Protecting NeRFs' Copyright via Plug-And-Play Watermarking Base Model](https://mlsanity.com/paper/2407.07735/) (2024)
- [SAFIRE: Segment Any Forged Image Region](https://mlsanity.com/paper/2412.08197/) (2024)
- [Geometry Cloak: Preventing TGS-based 3D Reconstruction from Copyrighted Images](https://mlsanity.com/paper/2410.22705/) (2024)
- [From Image to Imuge: Immunized Image Generation](https://mlsanity.com/paper/2110.14196/) (2021)
- [DRAW: Defending Camera-shooted RAW against Image Manipulation](https://mlsanity.com/paper/2307.16418/) (2023)
- [MarkSplatter: Generalizable Watermarking for 3D Gaussian Splatting Model via Splatter Image Structure](https://mlsanity.com/paper/2509.00757/) (2025)
- [RWN: Robust Watermarking Network for Image Cropping Localization](https://mlsanity.com/paper/2110.05687/) (2021)
- [Practical Region-level Attack against Segment Anything Models](https://mlsanity.com/paper/2404.08255/) (2024)
- [Attack-SAM: Towards Attacking Segment Anything Model With Adversarial Examples](https://mlsanity.com/paper/2305.00866/) (2023)
- [ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generation](https://mlsanity.com/paper/2510.12119/) (2025)

## Built on by (most cited first, 1 of 1)

- [Generating Multi-view Adversarial Examples for Visual Geometry Grounded Transformer](https://mlsanity.com/paper/2608.20748/) (2026)

## Abstract (arXiv)

AIGC-based image editing technology has greatly simplified the realistic-level image modification, causing serious potential risks of image forgery. This paper introduces a new approach to tampering detection using the Segment Anything Model (SAM). Instead of training SAM to identify tampered areas, we propose a novel strategy. The entire image is transformed into a blank canvas from the perspective of neural models. Any modifications to this blank canvas would be noticeable to the models. To achieve this idea, we introduce adversarial perturbations to prevent SAM from ``seeing anything'', allowing it to identify forged regions when the image is tampered with. Due to SAM's powerful perceiving capabilities, naive adversarial attacks cannot completely tame SAM. To thoroughly deceive SAM and make it blind to the image, we introduce a frequency-aware optimization strategy, which further enhances the capability of tamper localization. Extensive experimental results demonstrate the effectiveness of our method.