Image Copy Detection (ICD) aims to identify manipulated content between image pairs through robust feature representation learning. While self-supervised learning (SSL) has advanced ICD systems, existing view-level contrastive methods struggle with sophisticated edits due to insufficient fine-grained correspondence learning. We address this limitation by exploiting the inherent geometric traceability in edited content through two key innovations. First, we propose PixTrace - a pixel coordinate tracking module that maintains explicit spatial mappings across editing transformations. Second, we introduce CopyNCE, a geometrically-guided contrastive loss that regularizes patch affinity using overlap ratios derived from PixTrace's verified mappings. Our method bridges pixel-level traceability with patch-level similarity learning, suppressing supervision noise in SSL training. Extensive experiments demonstrate not only state-of-the-art performance (88.7% uAP / 83.9% RP90 for matcher, 72.6% uAP / 68.4% RP90 for descriptor on DISC21 dataset) but also better interpretability over existing methods.
Figures & tables
Figure 1: Traceability of pixels. Image B copy edits upon image A. The edits includes image matting, affine transform and color jitter. Pixels of the copy region could be tracked back to the original image if specific edit functions are available.
Figure 2: a). Overview of PixTrace. Images Ia and Ib are both derived from Io through copy edits. Coordinate tables Tao and Tbo describe coordinate correspondence of each pixel in Ia and Ib relative to Io . Furthermore, with Io as a bridge, shared pixels in Ia and Ib can also be tracked against one another. Notice, edits in this figure are for demonstration purposes, actual edits are significantly more complex. b). Illustration of reverse operation of table T . After reversion, coordinate (i,j) at position (m,n) will be used to place coordinate (m,n) .
Figure 3: a). Typical noise of heuristic matching methods. Match A: despite the nearest patch on query, LocNN still brings false match without overlapping since the original patch has no counterpart on Query 1; Match B: Neither LocNN nor FeatNN could retrieve all positive patches; Match C: FeatNN could be misled by semantically similar objects. b). Overview of CopyNCE . Patch Riq in query edits upon patches in Rr and their area proportions in Riq are 12% , 20% , 20% and 48% . c). Matcher Architecture. Matcher consists of encoder and fusion modules. Fusion takes concatenated tokens from encoder as input. Encoders in matcher share weights.
Matcher
Settings
Metrics
Arch
Res.
Local
μ AP
RP90
Separate‡ [ 24 ]
ViT-S
224×112
✗
75.4
68.7
ViT-B
✗
78.4
72.9
ViT-L
✗
84.7
80.3
CopyNCE
ViT-S
224×224
✗
83.5
75.4
CopyNCE
ViT-S
336×336
✗
85.8
79.9
Table 1: Comparison with other SOTA methods. Left is for matcher and Right is for descriptor. Local denotes inference ensembling with multiple local crops. Pre/Post is the pre-/post-processing, in which SN is score normalization, YL is YOLO pre-processing and Str is feature stretching. † denotes the method leverages extra data for training. ‡ means that we reproduce the results with its open-source code. Multi in D 2 LV stands for 11 × R50 [ 17 ] , 11 × R152 [ 17 ] and 11 × R50IBN [ 57 ] .
Method
Parameter
μ AP
Parameter
μ AP
CopyNCE
default
70.5
wNCE=0
68.9
wNCE=3
70.5
wNCE=8
69.9
γ=0
67.9
γ=0.5
69.7
γ=1
70.0
γ=2
70.4
γ=3
70.5
γ=+∞
70.1
w/o NCE
68.6
layer=10
70.3
Table 2: Ablation studies and parameter analysis on descriptor . default denotes the default parameters in Sec. 4.2 and baseline is marked by Grey . GHNM means global hard negative mining, detailed in Supp. The lower part presents results of heuristic matching methods. FeatNN [ 29 , 54 , 60 ] and LocNN [ 2 ] utilize feature and patch centroid k -NN respectively to match positives. And Both combines FeatNN and LocNN. Cos and NCE denote cosine loss and InfoNCE loss respectively. R50 † experiments are conducted under 448×448 . More details are provided in Supp.
Method
Parameter
μ AP
Parameter
μ AP
CopyNCE
default
83.5
wNCE=0
70.9
wNCE=1
81.7
wNCE=5
83.5
γ=0
82.5
γ=0.5
82.6
γ=1
83.5
γ=2
82.9
γ=3
83.0
γ=+∞
82.6
enc-6-fus-6
84.0
enc-10-fus-2
79.4
Table 3: Ablation studies and parameter analysis on matcher . “enc- m -fus- n ” denotes encoder of m layers and fusion of n layers. default denotes the default parameters in Sec. 4.2 and baseline is marked by Grey . The lower part presents results of heuristic matching methods.
Figure 4: Visualization of token affinity and affinity entropy. The left part displays reference and query images. Green box is the probe patch to draw token affinity heatmaps. The subsequent section contains token affinity heatmaps and affinity entropy of different models.
Descriptor Track
Matching Track
Team
μ AP
RP90
Team
μ AP
RP90
CopyNCE†
65.8
61.0
CopyNCE†
85.6
80.0
lyakaap†
63.5
55.4
CopyNCE
84.6
78.2
CopyNCE
60.9
56.7
VisionForce
83.3
73.1
S-square
59.1
50.9
separate†
82.9
79.2
visionForce
57.9
48.9
imgFp†
76.8
67.2
Table 4: Leaderboard of DISC21 Phase 2. † denotes the results achieved after finetuning on dev set part I . Note that finetuning is allowed by official rules [ 34 ] .
Method
Model Arch.
μ AP
RP90
CopyNCE
ViT-B+ViT-S
72.5
36.8
Strong ASL
Multi
64.1
-
D 2 LV ASL
Multi
61.3
-
Table 5: Results on NDEC. Multi in “D 2 LV ASL” and “Strong ASL” stands for 11 × R50, 11 × R152 and 11 × R50IBN.
Training Set
Reference Set
Dev Set Part I
Dev Set Part II
Test Set
Data
Labels
Data
Labels
Data
Labels
Scale
1,000,000
1,000,000
25,000
25,000
50,000
Accessible
Phase 1
✓
✓
✓
✓
✓
✗
✗
✗
Phase 2
✓
✓
✓
✓
✓
✗
✓
✗
After
✓
✓
✓
✓
✓
✓
✓
✓
Table 6: Details of DISC21 datasets. In “Accessible” part, ✓denotes that corresponding data is available during that period of time, and ✗denotes unavailability.
Figure 5: mAP v.s. μ AP. In this case, mAP is 100%, because all positive samples are ranked at the first place in the view of each query. While no threshold could be set to achieve that perfect performance. In μ AP, results are concatenated together to calculate precision of each threshold. Thus, μ AP could better reflect the real performance of model. Mathematically, mAP also serves as an upper bound of μ AP.
Method
μ AP
R@1
Method
μ AP
R@1
SSCD [ 36 ]
14.22
20.24
ViT-S
27.07
34.68
S-square [ 33 ]
14.51
21.05
ViT-B
31.66
37.78
Lyakaap [ 59 ]
13.80
18.02
ViT-S †
25.38
31.57
AnyPat. Base. [ 48 ]
16.18
20.54
ViT-B †
28.05
34.36
Table 7: Results on AnyPattern. All methods are evaluated with “SmallPattern” protocol . “AnyPat. Base.” denotes Baseline in AnyPattern. CopyNCE results are marked in blue and † means results achieved with augmentations that aligned with Lyakaap.
SSCD SN [ 36 ]
ViT-S SN
ViT-B SN
Descriptor μ AP
64.99
70.59
71.57
Matching μ AP
46.92
51.32
50.05
Table 8: Results on VSC2022. Results are produced by official baseline implementation of VSC2022 on its training set.
Test Set
Model
Resolution
Metrics
mAP
μ AP
RP90
Dev II
ViT-S
224×224
90.6
83.5
75.4
Dev II
ViT-B
90.5
83.5
76.7
Dev II
ViT-S
336×336
91.3
85.8
79.9
Dev II
ViT-B
91.3
85.7
80.1
Table 9: Scaling of matcher. All results are achieved without finetuning on dev set part I .
Test Set
Model
Resolution
Metrics
mAP
μ AP
RP90
Dev II
ViT-S
224×224
76.5
70.5
63.6
Dev II
ViT-B
77.9
72.3
65.2
Dev II
ViT-S
336×336
75.0
69.8
63.9
Dev II
ViT-B
76.2
71.3
66.0
Table 10: Scaling of descriptor. All results are achieved without finetuning on dev set part I .
Settings
Parameters
Matching
Descriptor
Resolution
224×224 / 336×336
Input
Augmentation
color jitter, random grayscale, random blur, overlay text, overlay emoji, random flipping, affine, perspective, random resized-crop, overlay image, random erasing, etc.
Table 11: All detailed settings in our training pipeline. For the aspects of data augmentation that have been omitted, please refer to our code.
Settings
Parameters
Matching
Descriptor
Resolution
224×224 / 336×336
Input
Augmentation
resize
Positive Rate
0.3
-
Hard Negative Mining
Off
Off
Model
Linear Head
-
256 dims
Table 12: All detailed settings in our finetune pipeline. If certain settings are not listed in this table, they are set to be the same settings used in training by default.
Encoder
Fusion
Extensive
Task
Descriptor
Att. Block
Cosine
1 v.s. N
Coarse Retrieval
Matcher
Att. Block
Att. Block
1 v.s. 1
Fine Matching
Table 13: Property of descriptor and matcher. “Att. Block” denotes Attention block for short. Descriptor extends well because it retrieves images through vector similarity and can yield N results with a single matrix multiplication. While matcher has to perform classification pair by pair.
Figure 6: Detailed architecture of matcher and descriptor.
Figure 7: Demonstration of GHNM.
Method
Parameter
Metrics
mAP
μ AP
RP90
Baseline
76.4
68.9
60.6
Baseline
w/o GHNM
77.1
57.7
30.0
Table 14: Ablation studies of GHNM on descriptor .
Step
Model
Tricks
# Candidates
Recall
Type
Method
Backbone
Resolution
0
-
-
1,000,000
100.0%
1
Descriptor
Baseline
ViT-B
224×224
LCE
400
94.3%
CopyNCE
2
Matcher
CopyNCE
ViT-S
224×224
LCE
10
93.4%
Table 15: Recall of dev set part II in different candidates retrieval steps.
Step
Model
Tricks
# Candidates
Recall
Type
Method
Pre-train
Backbone
Resolution
0
-
-
1,000,000
100.0%
1
Descriptor
Finetune
Baseline
ViT-B
224×224
LCE
400
91.3%
CopyNCE
2
Matcher
Finetune
CopyNCE
ViT-S
224×224
LCE
10
90.1%
Table 16: Recall of test set in different candidates retrieval steps.
Figure 8: Reverse issue of table T .
Figure 9: Success cases of matcher. In each row, the query image is placed in the first column, followed by five recalled reference images sorted by score in descending order. Each image is titled with its rank, ID and copy score. Notably, the ground truth is always ranked first.
Figure 10: Failure cases of matcher. In each row, the query image is placed in the first column, followed by four recalled reference images sorted by score in descending order. Each image is labeled with its rank, ID and copy score. In these cases, the ground truth copied image is placed last.
Figure 11: Success cases of descriptor. In each row, the query image is placed in the first column, followed by five recalled reference images sorted by score in descending order. Each image is titled with its rank, ID and copy score. Notably, the ground truth is always ranked first.
Figure 12: Failure cases of descriptor. In each row, the query image is placed in the first column, followed by four recalled reference images sorted by score in descending order. Each image is labeled with its rank, ID and copy score. In these cases, the ground truth copied image is placed last.
Image editors built on diffusion transformers (DiTs), such as Flux Kontext, make it possible to turn a single photograph into a convincing manipulated image, including harmful and non-consensual edits. Proactive defenses aim to prevent such manipulations by adding an imperceptible perturbation before an image is shared. Existing defenses for DiT-based in-context editors make the output attend less to the protected reference image. But this leaves the model free to follow the edit instruction using the text and its own generated tokens, often producing a new, weakly grounded image rather than preventing the edit. We find that the opposite strategy is more effective: instead of leading the model to ignore the reference, we encourage it to copy it. Through controlled attention interventions, we show that concentrating target-token attention on the reference image in only a few early blocks is sufficient to collapse the editing behavior, causing the model to reproduce its input, often as a lossy copy, rather than execute the requested transformation. Based on this insight, we introduce Copying-as-Defense (CaD), which maximizes per-token target-to-reference attention mass in early transformer blocks. Since attention rows are normalized, increasing reference attention suppresses the attention allocated to the text and generated canvas. Restricting the objective to early blocks also lets us truncate the backpropagation path, keeping optimization cheap. Across editors and benchmarks, CaD reduces average edit success from 81.4% on unprotected images to 24.0%, a 70.6% relative reduction, and by a further 44.3% relative to DeContext, the strongest baseline (43.0%). CaD is also roughly 1.8-2.0x faster per optimization step than comparable methods.
Localized image edits can change a photograph's meaning while leaving most of it authentic, so forensic analysis must identify where an edit occurred. We show that patch-level perturbation responses from frozen DINO encoders are themselves localization maps. Training-free Localization of AI-image Edits from patch-token Drift (TRAIL) applies one global Haar perturbation and maps cosine drift between corresponding patch tokens. On 80 source-disjoint CocoGlide test images, TRAIL reaches .903 patch AUROC versus .912 for the mask-supervised Detective SAM; fixed-threshold Dice is .619 versus .709, while an oracle threshold raises TRAIL to .790. Transferred unchanged to Poisson image interpolation, TRAIL reaches .855 AUROC versus .864, showing that the cue persists without a generator. Across sixteen DINO encoders, the best block lies at normalized depth .80-.94. Global context matters: AUROC falls from .903 globally to .857 for local-in-canvas perturbations and .735 for independently encoded crops. Frozen DINO patch tokens therefore contain a strong late-layer localization signal whose visibility depends on the perturbation and preserved context. Code: https://github.com/VishalJ99/trail-image-edit-localization.
Zane Kumar, Vishal Jain, Bernhard Kainz
Department of Computing St Paul’s School London London, United Kingdom · Department of Computing Imperial College London London, United Kingdom · Computing / AIBE Imperial College London / FAU London, UK / Erlangen, Germany
Replacing an object with one that differs in category or shape requires complete source removal, natural target formation unconstrained by the source silhouette, and preservation of unrelated content. Existing training-free editors either localize edits from terminal predictions under source and target prompts or preserve unrelated content through spatially unselective source-feature reuse without explicit region discovery. Before reaching the terminal predictions, prompt-induced semantic differences undergo additional network transformations that may obscure their spatial localization, reducing localization precision. Spatially unselective feature reuse forces a trade-off between edit completeness and background preservation. Therefore, we propose PC-Edit, a prompt-contrastive framework for training-free MM-DiT editing. PC-Edit contrasts the image-token attention outputs under the source and target prompts, capturing prompt-induced semantic differences directly where text-conditioned information is delivered to image tokens. The same contrast identifies a source-erasure region during inversion and a target-emergence region during denoising. Their union suppresses source remnants while allowing the target object to form naturally. PC-Edit further couples region discovery and background preservation within each sampling step by estimating the current edit region from preceding attention blocks and immediately injecting cached source K/V features outside it in subsequent blocks, thereby protecting unrelated content before the latent update. Experiments on PIE-Bench and our EditRegion-Bench, with human-verified edit-region annotations for single- and multi-object addition and replacement, show that PC-Edit achieves the best editing quality and background preservation among methods without user-specified edit regions.
Jian Zhang, Zhijun Zhang
School of Electronic and Information Engineering, South China University of Technology, Guangzhou, China