The paper evaluates twenty deepfake detectors against ten recent generators, finding that accuracy has dropped from 99.5% to 76% and that adversarial perturbations can reduce detector performance to below 2%. It proposes a new detection paradigm that certifies authenticity only when a faithful reconstruction by a known generator is impossible, and shows that this calibrated detector can limit false certifications to at most 1% while remaining robust to bounded‑perturbation attacks. The study also highlights the erosion of post‑hoc verifiability, noting that newer generators can reproduce a larger fraction of previously unreplicable images.
By Sarim Hashmi, Abdelrahman Elsayed, Mohammed Talha Alam, Samuele Poppi, Nils Lukas
The paper examines the reliability of deepfake detectors, noting a decline in accuracy from 99.5% to 76% over four years and a drastic drop below 2% when adversarial perturbations are applied. It argues that content alone cannot determine provenance because generators can perfectly reproduce authentic images, so a new detection approach is proposed that certifies authenticity only if a generator cannot faithfully reconstruct the content. The authors demonstrate that their calibrated detector can limit false certifications to 1% while maintaining robustness against bounded‑perturbation attacks, though it struggles with arbitrary transformations.
arXiv:2503.05794v4 Announce Type: replace-cross
Abstract: Speaker verification models are trained on large-scale public datasets whose licenses usually prohibit unauthorized commercial use, yet such...
By Yiming Li, Kaiying Yan, Jiawen Diao, Shuo Shao, Tongqing Zhai, Shu-Tao Xia, Dacheng Tao
The paper introduces REMARK, a watermark‑based fingerprint framework designed to verify ownership of Graph Neural Networks (GNNs). REMARK generates in‑distribution watermark graphs that maximize output differences between GNN models, thereby reducing performance loss from out‑of‑distribution watermarks. It then extracts robust fingerprints from these output differences, eliminating the need for surrogate models trained on watermark data or reliance on specific output levels, and achieves state‑of‑the‑art verification accuracy across real‑world datasets and GNN architectures.
By Han Zhang, Yan Wang, Guanfeng Liu, Pengfei Ding, Huaxiong Wang, Kwok-Yan Lam
arXiv:2606. 01437v1 Announce Type: cross Abstract: Deep Neural Networks (DNNs) are highly susceptible to adversarial perturbations, leading to extensive research on robustness for safety-critical applications.
By Daniel Sadig, Mohammadreza Maleki, Hamed Karimi, Reza Samavi
MRCert is a masking‑based certified recovery defender that aims to maintain high prediction accuracy while verifying the benignity of labels for adversarially patched inputs in post‑deployment scenarios. It introduces type‑specific necessary properties for both benign and patched samples, enabling a novel label recovery and certification function pair that avoids the accuracy degradation typical of smoothing methods. Experiments show MRCert achieves 35.1% adversarial certified accuracy on ImageNet with 16‑pixel patches, outperforming the state‑of‑the‑art PatchCURE.
By Qilin Zhou, Zhengyuan Wei, Haipeng Wang, Zhuo Wang, Shuo Liu, W. K. Chan
The paper introduces Imperfect Restoration Poisoning (IRP), a new data poisoning technique that maintains high image quality while effectively disrupting both supervised and self‑supervised learning models. It builds on a theoretical critique of the existing Convolution-based Unlearnable Dataset (CUDA) method, revealing CUDA’s sub‑optimal gradients and class‑bias strategy. Extensive experiments demonstrate IRP’s superiority over eight baseline attacks and its resilience against five defense methods.
By Yi Huang, Jeremy Styborski, Mingzhi Lyu, Fan Wang, Adams Kong
arXiv:2606. 31653v1 Announce Type: cross Abstract: Certified training aims to produce models whose predictions can be formally verified against adversarial perturbations, typically by optimising upper bounds on the worst-case loss over an allowed perturbation set.
By Matteo Melis, Jesus Martinez Del Rincon, Vishal Sharma
arXiv:2606. 08467v1 Announce Type: cross Abstract: While confidence calibration is essential for trustworthy decision-making in safety-critical applications, the robustness of calibrated GNNs to adversarial structural perturbations remains largely unexplored.
By Cuong Dang, Jiahao Zhang, Hieu Ta Quang, Dung Le, Lu Cheng, Suhang Wang
arXiv:2504. 14798v2 Announce Type: replace Abstract: Machine Unlearning (MUL) has emerged as a key mechanism for privacy protection and content regulation, yet current techniques often fail to guarantee the complete removal of sensitive information.
By Hao Xuan, Xingyu Li
The paper introduces TP-CRIV, a framework for verifying the identity of AI models through third‑party challenge‑response interactions without requiring white‑box or API access. TP-CRIV operates in a black‑box setting, using fresh, undisclosed challenges and network isolation to ensure that verification relies solely on the claimant’s local model. The authors demonstrate the approach on ten ImageNet‑pretrained CNNs, achieving clear separation between same and cross‑model responses with statistically calibrated thresholds.
By Teruki Sano, Minoru Kuribayashi, Masao Sakai, Shuji Isobe, Eisuke Koizumi, Zhang Zhang, Satoru Matsumoto
arXiv:2410. 01574v4 Announce Type: replace-cross Abstract: The rapid advancement of Generative Artificial Intelligence (GenAI) capabilities is accompanied by a concerning rise in its misuse.
By Sina Mavali, Jonas Ricker, David Pape, Asja Fischer, Lea Sch\"onherr