Certification of Real Images through Calibrated Content Authentication

AI summary

Overview

Research area: Computer vision and AI content provenance, specifically post-hoc deepfake detection, calibration of error rates, and adversarial robustness of content authentication.

Technical level: Advanced. The paper assumes familiarity with diffusion and flow-matching generative models, latent inversion, PGD-style adversarial attacks, and selective prediction with false-positive-rate calibration.

Scope (one sentence): The paper benchmarks twenty deepfake detectors against ten generators released over four years, argues that content alone cannot establish provenance, and proposes a calibrated detector that certifies an image as authentic only when no known generator can faithfully reconstruct it.

What This Paper Is About

Deepfake detectors that separate real from fake images are losing ground: their best accuracy falls from 99.5% on generators available in 2022 to 76% on generators available in 2026, and all twenty detectors the authors test drop below 2% accuracy under ℓ∞ perturbations with ϵ = 8/255. The authors argue this is not merely an engineering gap but a fundamental ambiguity: a capable generator can reproduce authentic content exactly, for example through memorization, so content alone cannot reveal the true provenance label.

Their response is to stop asking "is this real or fake?" and instead ask "could any known generator have produced this?" A suspect image is inverted through each known generator; if any generator faithfully reconstructs it, authenticity is treated as plausibly deniable and the detector abstains. Only when every generator fails to reconstruct the image is it certified as authentic, with the decision threshold calibrated so that at most 1% of generated content is wrongly certified.

Key Contributions

1. The authors evaluate twenty deepfake detectors against ten generators released over four years (December 2022 through May 2026), showing that the best accuracy declines from 99.5% to 76% and that all twenty fall below 2% accuracy under adversarial perturbations.
2. They propose a sound detector that certifies content as authentic only when no known generator can faithfully reproduce it, calibrated so that at most 1% of generated content is wrongly certified. At this error rate, most existing detectors reach near-zero recall despite accuracy up to 93.25%.
3. They are the first to calibrate against adaptive adversaries, distinguishing a safety threshold for unaware users from a stricter security threshold for efficient attackers with limited compute and a perturbation budget of ϵ = 8/255.
4. They study 3,000 Reddit images to forecast erosion of post-hoc verifiability, showing the certifiable set shrinking from 1,116 images (under a 2022 generator) to at most 79 images (under 2024 generators), and they extend the method to video.

Main Findings

• Detector accuracy decays with generator releases: Among detectors available at each generator's release, the best accuracy falls from 99.5% on 2022 generators to 76% on 2026 generators. The best detector itself changes twice, from PROBE to SICA to D3, while most other detectors perform close to the 50% chance level on the newest generators.

• Adversarial perturbations collapse every baseline: Under ℓ∞-bounded perturbations with ϵ = 8/255, all twenty detectors fall below 2% accuracy, and even the strongest, D3, retains only 1.75%.

• Default accuracy hides asymmetric errors: On a zero-shot test set of 1,000 authentic and 1,000 generated images from six generators excluded from training, default-threshold accuracy ranges from 36.95% to 93.25%, but seven detectors correctly classify 96.2%–99.5% of authentic images and only 0.1%–5.5% of generated images. UFD and FatFormer each classify exactly 1 of the 1,000 generated images correctly; FreqNet classifies 53 generated and 995 authentic images correctly; FerretNet 40 and 962; AllPatchesMatter 34 and 987; IAPL 14 and 980; C2PClip 51 and 949.

• Asymmetry is not universal: D3 classifies 736 generated and 942 authentic images correctly, and SICA classifies 716 and 924. NPR fails differently, with accuracy decreasing on both classes to 36.95% overall, and DGS-Net classifies only 10 generated and 847 authentic images correctly.

• High accuracy does not survive calibration: At a fixed 1% false positive rate, overlapping score distributions force most baselines to near-zero true positive rate, including OmniAID, which reaches 93.25% accuracy at its default threshold but almost no certifiable authentic images after calibration. The authors' A-index distributions remain separated in the same zero-shot setting.

• Semantic transforms stay within bounds: Twenty-three of twenty-four semantic transformations stay below the safety threshold and the remaining one stays below the security threshold. The transformations cover photometric changes, spatial transformations, text and box overlays, resampling, JPEG compression, blur, and Gaussian noise.

• Security threshold survives a bounded adaptive attack: For SD3-Medium, attacking the calibration samples raises the threshold from 0.0365 to 0.038 and preserves the 1% bound under the same attack. A best-of-100 attacker spending 19.5 minutes of search raises its best candidate only from 0.0148 to 0.0154.

• Generator-specific thresholds rise with capability: Safety thresholds are 0.015 for SD2.1, 0.0365 for SD3 Medium, 0.0365 for SD3.5 Medium, 0.035 for FLUX.1 Dev, and 0.038 for FLUX.1 Dev with the Realism LoRA. The 2022 generator admits a threshold of 0.015 while every 2024 configuration requires at least 0.035. The Realism LoRA adapter requires the strictest threshold although it modifies the same FLUX.1 base model.

• Metric combination beats any single metric: The full four-metric combination reduces the authentic/generated distribution overlap to 0.3436 at an effective AUC of 0.8852, compared with 0.4401 for CLIP similarity as the best single metric. The fitted weights are α1 = −0.0181 (PSNR), α2 = 1.380 (SSIM), α3 = −4.058 (1−LPIPS), and α4 = 8.066 (CLIP), concentrating on semantics. Removing CLIP raises the overlap from 0.3436 to 0.5284; removing SSIM raises it to 0.3936; removing 1−LPIPS raises it to 0.4035; removing PSNR changes it by only 0.0040. Cohen's d rises from 1.2996 for CLIP similarity alone to 1.5870 for the full combination. An RBF-kernel SVM reaches a higher effective AUC of 0.9125, while the linear combination comes within 0.0273 AUC using four parameters.

• Reconstruction fidelity separates the classes: Generated images reconstruct more faithfully than authentic ones, with mean PSNR of 23.69 dB versus 22.00 dB and mean CLIP similarity of 0.9666 versus 0.9293.

• Post-hoc verifiability is eroding: On 3,000 images collected from Reddit, a 2022 generator fails to reproduce 1,116 images, while 2024 generators fail on only 55 to 79. The certifiable share of this corpus falls from 37.2% to at most 2.63%, a decline of more than 14× within two years of generator releases.

• The method extends to video: On 100 in-the-wild videos, frame aggregation preserves the reconstruction signal while no video baseline exceeds 0.615 AUC.

• Certification is slower than feed-forward detection: Inverting and scoring one image under one generator takes 11.67 seconds on one NVIDIA RTX 5000 Ada, versus milliseconds for feed-forward detectors, which the authors say makes the approach suitable for forensic verification rather than feed-scale screening.

Methodology in Plain English

The authors reframe the detection problem. Instead of training a classifier to spot artifacts of generation, they take a suspect image and run it backwards through each known open-weight generator using an inversion method (RF-Inversion), producing a reconstruction of what that generator would have produced. They then measure how closely the reconstruction matches the original across four complementary levels: pixel fidelity (PSNR), structural fidelity (SSIM), perceptual distance (1−LPIPS), and semantic consistency (CLIP cosine similarity). A calibrated weighted combination of these four metrics produces a scalar authenticity score in [0,1], called the A-index.

A faithful reconstruction yields a low score and means anyone holding that generator could have made the image, so authenticity is plausibly deniable and the detector abstains, returning the reconstruction and the generator's identity as checkable evidence. If every generator in the set fails to reconstruct the image faithfully, the image is certified as authentic relative to that set.

Thresholds are set from data the defender generates themselves. They invert held-out generated samples and take the threshold as the quantile such that at most a fraction α of generated outputs would be certified, using α = 1%. They then repeat calibration on adversarially perturbed versions of the same samples, using projected gradient ascent through a differentiable approximation of the inversion pipeline, to obtain a stricter security threshold that bounds the false positive rate against bounded ℓ∞ perturbations with ϵ = 8/255. Because nothing is trained, adding a new generator requires only recalibration, not retraining.

Experimental setup: five open-weight generator configurations (Stable Diffusion 2.1, SD3 Medium, SD3.5 Medium, FLUX.1 Dev, and FLUX.1 Dev with a Realism LoRA adapter), all inverted with 28 inference steps, a guidance scale of 3.5, float16 precision, and a fixed random seed. Calibration uses 2,000 images from De-Factify 4 containing 1,000 authentic and 1,000 generated images at 512×512 resolution, with the generated portion comprising 200 images each from SD2.1, SDXL, SD3, DALL·E 3, and Midjourney 6. Weights are fitted on a disjoint split with Differential Evolution (population 20, mutation factor 0.6, crossover probability 0.7, at most 300 iterations) to minimize distribution overlap, and the sigmoid scale is set to σ = 0.9. For video, they sample k = 8 frames per clip, score each frame with the image pipeline, and average the per-frame scores.

Why This Matters

The paper argues that an untrustworthy detector is worse than no detector, because each wrong prediction feeds the "liar's dividend," in which authentic content is dismissed as fake. It offers a way to build detectors that make claims only with a measured error rate and abstain otherwise, which is a different design contract from the binary real-or-fake classification that all twenty evaluated baselines use. It also quantifies how quickly the set of certifiable content is shrinking as generators improve, which the authors frame as a forecast they expect to continue.

Real-world applications:

• Platform labeling and community notes: A platform hosting millions of images and videos can certify only the few items that go viral or get flagged, with a bounded false positive rate and abstention otherwise.
• Newsroom verification: Journalists verifying footage from social media get either a certificate scoped to a named generator set and calibration date, or an abstention accompanied by reconstruction evidence they can inspect.
• Legal and forensic evidence: Courts weighing whether submitted imagery is authentic can obtain a one-sided certificate with a stated error rate rather than an uncalibrated score.
• Tracking verifiability over time: The method doubles as an instrument for measuring how much existing content remains certifiable after each new generator release.

Industry relevance: the paper positions itself against active provenance signals such as Google's SynthID watermarks, OpenAI's Content Credentials, and C2PA signed metadata, which require provider cooperation and can be removed by fine-tuning or stripped by common processing. It notes that open-weight releases such as SD3 and FLUX put generation capability in anyone's hands with no provider observing use, and that the EU AI Act imposes marking and disclosure requirements for AI-generated content from August 2026. Recalibration costs scale linearly with the calibration set size and the number of generators, which the authors flag as the practical operating cost for providers deploying this approach.

Future Directions

• Recalibrating against future generators: The authors say the method must be recalibrated with each new generator release to measure how much content remains verifiable, and note their released code is meant to enable calibration against future generators. A new generator that cannot be inverted or that reconstructs faithfully would shrink the certifiable set further.

• Stronger optimizers and new attack classes: The security threshold holds within the evaluated bounded-perturbation attack space, but the paper states explicitly that a stronger optimizer or a new attack class may exceed the thresholds, and that a defender counters this by recalibrating with the new attack.

• Compute-constrained versus unbounded adversaries: The threat model considers efficient adversaries who cannot fine-tune generators, on the grounds that an adversary with unbounded compute defeats any post-hoc detector. How the thresholds behave against adversaries with intermediate compute budgets is left open.

• Scaling beyond images and preliminary video: Video is treated as a preliminary study using k = 8 averaged frames per clip on 100 in-the-wild videos, leaving broader multimodal extension and more extensive video evaluation open.

• Deployment cost: Certification at 11.67 seconds per image and generator on one NVIDIA RTX 5000 Ada is acknowledged as unsuitable for feed-scale screening, raising the question of how to make the approach practical at larger scale.

Target Audience

Researchers working on deepfake detection, content provenance, and adversarial robustness of vision systems; practitioners at platforms, news organizations, and forensics teams who need to label content with a defensible error rate rather than an uncalibrated score; and policy or standards groups working on provenance regimes such as C2PA and the EU AI Act's marking requirements. The paper is also relevant to readers interested in selective prediction and calibration under distribution shift, since its central claim concerns reframing detection as a one-sided certification problem. The material is advanced: it assumes comfort with diffusion and flow-matching inversion, quantile-based calibration, and PGD attacks.

Authors’ abstract

Generative models can synthesize high-quality inauthentic multimedia content that is already being misused at scale. We evaluate twenty deepfake detectors against ten generators released in the last four years and find accuracy decreasing over time, from near-perfect 99.5% to 76%. Adversarial perturbations further reduce every baseline detector to below 2% accuracy, effectively inverting the detector's assigned label. We argue that this unreliability reflects a fundamental ambiguity: generators can reproduce authentic content exactly (e.g., through memorization), so content alone cannot reveal the true provenance label.For this reason, content produced by a generator must admit a faithful reconstruction by that same generator, and finding such a reconstruction makes synthetic provenance plausible and authenticity plausibly deniable.We therefore propose and evaluate a detection paradigm that outputs a calibrated prediction of whether authenticity is plausibly deniable: a faithful reconstruction by any known generator establishes plausible deniability, while calibration bounds how often content from known generators fails to be reproduced. Our evaluation shows that (i) our detector can be calibrated so that at most 1% of generated content is wrongly certified, an operating point at which most baseline detectors reach near-zero recall, including the strongest with 93% accuracy; (ii) calibrating a stricter security threshold on attacked samples preserves this bound against adaptive adversaries within the evaluated bounded-perturbation attack space, whose perturbations break every baseline, but does not cover arbitrary adversarial transformations; and (iii) post-hoc verifiability is eroding, as 1,116 of 3,000 Reddit images resist reproduction by a 2022 generator, but only 55 to 79 resist reproduction by 2024 generators.