Tracing Copied Pixels and Regularizing Patch Affinity in Copy Detection

Yichen Lu; Siwei Nie; Minlong Lu; Xudong Yang; Xiaobo Zhang; Peng Zhang

cs.CVFeb 19, 2026

Tracing Copied Pixels and Regularizing Patch Affinity in Copy Detection

Authors: Yichen Lu, Siwei Nie, Minlong Lu, Xudong Yang, Xiaobo Zhang, Peng Zhang

Organizations: Ant Group, China

Abstract

Image Copy Detection (ICD) aims to identify manipulated content between image pairs through robust feature representation learning. While self-supervised learning (SSL) has advanced ICD systems, existing view-level contrastive methods struggle with sophisticated edits due to insufficient fine-grained correspondence learning. We address this limitation by exploiting the inherent geometric traceability in edited content through two key innovations. First, we propose PixTrace - a pixel coordinate tracking module that maintains explicit spatial mappings across editing transformations. Second, we introduce CopyNCE, a geometrically-guided contrastive loss that regularizes patch affinity using overlap ratios derived from PixTrace's verified mappings. Our method bridges pixel-level traceability with patch-level similarity learning, suppressing supervision noise in SSL training. Extensive experiments demonstrate not only state-of-the-art performance (88.7% uAP / 83.9% RP90 for matcher, 72.6% uAP / 68.4% RP90 for descriptor on DISC21 dataset) but also better interpretability over existing methods.

Figures & tables

Figure 1: Traceability of pixels. Image B copy edits upon image A. The edits includes image matting, affine transform and color jitter. Pixels of the copy region could be tracked back to the original image if specific edit functions are available.

Figure 2: a). Overview of PixTrace. Images $\text{I}_{a}$ and $\text{I}_{b}$ are both derived from $\text{I}_{o}$ through copy edits. Coordinate tables $\mathbb{T}_{ao}$ and $\mathbb{T}_{bo}$ describe coordinate correspondence of each pixel in $\text{I}_{a}$ and $\text{I}_{b}$ relative to $\text{I}_{o}$ . Furthermore, with $\text{I}_{o}$ as a bridge, shared pixels in $\text{I}_{a}$ and $\text{I}_{b}$ can also be tracked against one another. Notice, edits in this figure are for demonstration purposes, actual edits are significantly more complex. b). Illustration of reverse operation of table $\mathbb{T}$ . After reversion, coordinate $(i,j)$ at position $(m,n)$ will be used to place coordinate $(m,n)$ .

Figure 3: a). Typical noise of heuristic matching methods. Match A: despite the nearest patch on query, LocNN still brings false match without overlapping since the original patch has no counterpart on Query 1; Match B: Neither LocNN nor FeatNN could retrieve all positive patches; Match C: FeatNN could be misled by semantically similar objects. b). Overview of CopyNCE . Patch $\mathcal{R}_{i}^{q}$ in query edits upon patches in $\mathcal{R}^{r}$ and their area proportions in $\mathcal{R}_{i}^{q}$ are 12% , 20% , 20% and 48% . c). Matcher Architecture. Matcher consists of encoder and fusion modules. Fusion takes concatenated tokens from encoder as input. Encoders in matcher share weights.

Matcher	Settings			Metrics
Matcher	Arch	Res.	Local	$\mu$ AP	RP90
Separate‡ [ 24 ]	ViT-S	$224\times 112$	✗	75.4	68.7
	ViT-B		✗	78.4	72.9
	ViT-L		✗	84.7	80.3
CopyNCE	ViT-S	$224\times 224$	✗	83.5	75.4
CopyNCE	ViT-S	$336\times 336$	✗	85.8	79.9

Table 1: Comparison with other SOTA methods. Left is for matcher and Right is for descriptor. Local denotes inference ensembling with multiple local crops. Pre/Post is the pre-/post-processing, in which SN is score normalization, YL is YOLO pre-processing and Str is feature stretching. † denotes the method leverages extra data for training. ‡ means that we reproduce the results with its open-source code. Multi in D 2 LV stands for 11

\times

R50 [ 17 ] , 11

\times

R152 [ 17 ] and 11

\times

R50IBN [ 57 ] .

Method	Parameter	$\mu$ AP	Parameter	$\mu$ AP
CopyNCE	default	70.5	$w_{\text{NCE}}=0$	68.9
	$w_{\text{NCE}}=3$	70.5	$w_{\text{NCE}}=8$	69.9
	$\gamma=0$	67.9	$\gamma=0.5$	69.7
	$\gamma=1$	70.0	$\gamma=2$	70.4
	$\gamma=3$	70.5	$\gamma=+\infty$	70.1
	w/o NCE	68.6	layer=10	70.3

Table 2: Ablation studies and parameter analysis on descriptor . default denotes the default parameters in Sec. 4.2 and baseline is marked by Grey . GHNM means global hard negative mining, detailed in Supp. The lower part presents results of heuristic matching methods. FeatNN [ 29 , 54 , 60 ] and LocNN [ 2 ] utilize feature and patch centroid

k

-NN respectively to match positives. And Both combines FeatNN and LocNN. Cos and NCE denote cosine loss and InfoNCE loss respectively. R50

{\dagger}

experiments are conducted under

448\times 448

. More details are provided in Supp.

Method	Parameter	$\mu$ AP	Parameter	$\mu$ AP
CopyNCE	default	83.5	$w_{\text{NCE}}=0$	70.9
	$w_{\text{NCE}}=1$	81.7	$w_{\text{NCE}}=5$	83.5
	$\gamma=0$	82.5	$\gamma=0.5$	82.6
	$\gamma=1$	83.5	$\gamma=2$	82.9
	$\gamma=3$	83.0	$\gamma=+\infty$	82.6
	enc-6-fus-6	84.0	enc-10-fus-2	79.4

Table 3: Ablation studies and parameter analysis on matcher . “enc-

m

-fus-

n

” denotes encoder of

m

layers and fusion of

n

layers. default denotes the default parameters in Sec. 4.2 and baseline is marked by Grey . The lower part presents results of heuristic matching methods.

Figure 4: Visualization of token affinity and affinity entropy. The left part displays reference and query images. Green box is the probe patch to draw token affinity heatmaps. The subsequent section contains token affinity heatmaps and affinity entropy of different models.

Descriptor Track			Matching Track
Team	$\mu$ AP	RP90	Team	$\mu$ AP	RP90
CopyNCE†	65.8	61.0	CopyNCE†	85.6	80.0
lyakaap†	63.5	55.4	CopyNCE	84.6	78.2
CopyNCE	60.9	56.7	VisionForce	83.3	73.1
S-square	59.1	50.9	separate†	82.9	79.2
visionForce	57.9	48.9	imgFp†	76.8	67.2

Table 4: Leaderboard of DISC21 Phase 2. † denotes the results achieved after finetuning on dev set part I . Note that finetuning is allowed by official rules [ 34 ] .

Method	Model Arch.	$\mu$ AP	RP90
CopyNCE	ViT-B+ViT-S	72.5	36.8
Strong ASL	Multi	64.1	-
D 2 LV ASL	Multi	61.3	-

Table 5: Results on NDEC. Multi in “D 2 LV ASL” and “Strong ASL” stands for 11

\times

R50, 11

\times

R152 and 11

\times

R50IBN.

		Training Set	Reference Set	Dev Set Part I		Dev Set Part II		Test Set
		Training Set	Reference Set	Data	Labels	Data	Labels	Data	Labels
Scale		1,000,000	1,000,000	25,000		25,000		50,000
Accessible	Phase 1	✓	✓	✓	✓	✓	✗	✗	✗
	Phase 2	✓	✓	✓	✓	✓	✗	✓	✗
	After	✓	✓	✓	✓	✓	✓	✓	✓

Table 6: Details of DISC21 datasets. In “Accessible” part, ✓denotes that corresponding data is available during that period of time, and ✗denotes unavailability.

Figure 5: mAP v.s.

\mathbf{\mu}

AP. In this case, mAP is 100%, because all positive samples are ranked at the first place in the view of each query. While no threshold could be set to achieve that perfect performance. In

\mu

AP, results are concatenated together to calculate precision of each threshold. Thus,

\mu

AP could better reflect the real performance of model. Mathematically, mAP also serves as an upper bound of

\mu

AP.

Method	$\mu$ AP	R@1	Method	$\mu$ AP	R@1
SSCD [ 36 ]	14.22	20.24	ViT-S	27.07	34.68
S-square [ 33 ]	14.51	21.05	ViT-B	31.66	37.78
Lyakaap [ 59 ]	13.80	18.02	ViT-S †	25.38	31.57
AnyPat. Base. [ 48 ]	16.18	20.54	ViT-B †	28.05	34.36

Table 7: Results on AnyPattern. All methods are evaluated with “SmallPattern” protocol . “AnyPat. Base.” denotes Baseline in AnyPattern. CopyNCE results are marked in blue and † means results achieved with augmentations that aligned with Lyakaap.

	SSCD SN [ 36 ]	ViT-S SN	ViT-B SN
Descriptor $\mu$ AP	64.99	70.59	71.57
Matching $\mu$ AP	46.92	51.32	50.05

Table 8: Results on VSC2022. Results are produced by official baseline implementation of VSC2022 on its training set.

Test Set	Model	Resolution	Metrics
Test Set	Model	Resolution	mAP	$\mu$ AP	RP90
Dev II	ViT-S	$224\times 224$	90.6	83.5	75.4
Dev II	ViT-B	$224\times 224$	90.5	83.5	76.7
Dev II	ViT-S	$336\times 336$	91.3	85.8	79.9
Dev II	ViT-B	$336\times 336$	91.3	85.7	80.1

Table 9: Scaling of matcher. All results are achieved without finetuning on dev set part I .

Test Set	Model	Resolution	Metrics
Test Set	Model	Resolution	mAP	$\mu$ AP	RP90
Dev II	ViT-S	$224\times 224$	76.5	70.5	63.6
Dev II	ViT-B	$224\times 224$	77.9	72.3	65.2
Dev II	ViT-S	$336\times 336$	75.0	69.8	63.9
Dev II	ViT-B	$336\times 336$	76.2	71.3	66.0

Table 10: Scaling of descriptor. All results are achieved without finetuning on dev set part I .

Settings		Parameters
		Matching	Descriptor
	Resolution	$224\times 224$ / $336\times 336$
Input	Augmentation	color jitter, random grayscale, random blur, overlay text, overlay emoji, random flipping, affine, perspective, random resized-crop, overlay image, random erasing, etc.
	Positive Rate	0.3	-
	Hard Negative Mining	p=0.5, k -NN ( k =128)	p=1.0, k -NN ( k =8)
Model	Arch	ViT-S/16 ViT-B/16 [ 9 ] 8 Encoder Layers + 4 Fusion Layers	ViT-S/16 ViT-B/16 [ 9 ]

Table 11: All detailed settings in our training pipeline. For the aspects of data augmentation that have been omitted, please refer to our code.

Settings		Parameters
Settings		Matching	Descriptor
	Resolution	$224\times 224$ / $336\times 336$
Input	Augmentation	resize
	Positive Rate	0.3	-
	Hard Negative Mining	Off	Off
Model	Linear Head	-	256 dims

Table 12: All detailed settings in our finetune pipeline. If certain settings are not listed in this table, they are set to be the same settings used in training by default.

	Encoder	Fusion	Extensive	Task
Descriptor	Att. Block	Cosine	1 v.s. N	Coarse Retrieval
Matcher	Att. Block	Att. Block	1 v.s. 1	Fine Matching

Table 13: Property of descriptor and matcher. “Att. Block” denotes Attention block for short. Descriptor extends well because it retrieves images through vector similarity and can yield N results with a single matrix multiplication. While matcher has to perform classification pair by pair.

Figure 6: Detailed architecture of matcher and descriptor.

Figure 7: Demonstration of GHNM.

Method	Parameter	Metrics
Method	Parameter	mAP	$\mu$ AP	RP90
Baseline		76.4	68.9	60.6
Baseline	w/o GHNM	77.1	57.7	30.0

Table 14: Ablation studies of GHNM on descriptor .

Step	Model				Tricks	# Candidates	Recall
	Type	Method	Backbone	Resolution
0	-				-	1,000,000	100.0%
1	Descriptor	Baseline	ViT-B	$224\times 224$	LCE	400	94.3%
		CopyNCE
2	Matcher	CopyNCE	ViT-S	$224\times 224$	LCE	10	93.4%

Table 15: Recall of dev set part II in different candidates retrieval steps.

Step	Model					Tricks	# Candidates	Recall
	Type	Method	Pre-train	Backbone	Resolution
0	-					-	1,000,000	100.0%
1	Descriptor	Finetune	Baseline	ViT-B	$224\times 224$	LCE	400	91.3%
			CopyNCE
2	Matcher	Finetune	CopyNCE	ViT-S	$224\times 224$	LCE	10	90.1%

Table 16: Recall of test set in different candidates retrieval steps.

Figure 8: Reverse issue of table $\mathbb{T}$ .

Figure 9: Success cases of matcher. In each row, the query image is placed in the first column, followed by five recalled reference images sorted by score in descending order. Each image is titled with its rank, ID and copy score. Notably, the ground truth is always ranked first.

Figure 10: Failure cases of matcher. In each row, the query image is placed in the first column, followed by four recalled reference images sorted by score in descending order. Each image is labeled with its rank, ID and copy score. In these cases, the ground truth copied image is placed last.

Figure 11: Success cases of descriptor. In each row, the query image is placed in the first column, followed by five recalled reference images sorted by score in descending order. Each image is titled with its rank, ID and copy score. Notably, the ground truth is always ranked first.

Figure 12: Failure cases of descriptor. In each row, the query image is placed in the first column, followed by four recalled reference images sorted by score in descending order. Each image is labeled with its rank, ID and copy score. In these cases, the ground truth copied image is placed last.

Image Forgery Detection

Image Forgery Detection studies how to identify manipulated or synthetic images and locate the visual evidence of tampering.

See all 126 papers

Copying As Defense: Protecting Images from Editing By Eliciting Model Copying
Oct 26, 2026Salma Abdel Magid, Sanghyuk Chun, Eric Slyman +2Adversarial Perturbations Diffusion-Based Image Editing
Princeton University · Adobe Research
Frozen DINO Localizes Image Edits Without a Localizer
Aug 19, 2026Zane Kumar, Vishal Jain, Bernhard KainzImage Forgery Localization Digital Image Forensics
Department of Computing St Paul’s School London London, United Kingdom · Department of Computing Imperial College London London, United Kingdom · Computing / AIBE Imperial College London / FAU London, UK / Erlangen, Germany
PC-Edit: Prompt-Contrastive Region Discovery and Region-Guided Editing
Jul 23, 2026Jian Zhang, Zhijun ZhangDiffusion Transformer Text-Guided Image Editing
School of Electronic and Information Engineering, South China University of Technology, Guangzhou, China

Oct 26, 2026J/K move · Enter open · S save

Copying As Defense: Protecting Images from Editing By Eliciting Model Copying

Salma Abdel Magid, Sanghyuk Chun, Eric Slyman, Kushal Kafle+1

Princeton University · Adobe Research

Adversarial Perturbations Diffusion-Based Image Editing Attention Control in Diffusion Models Diffusion Transformer

Open paper AskPDF arXiv

Image editors built on diffusion transformers (DiTs), such as Flux Kontext, make it possible to turn a single photograph into a convincing manipulated image, including harmful and non-consensual edits. Proactive defenses aim to prevent such manipulations by adding an imperceptible perturbation before an image is shared. Existing defenses for DiT-based in-context editors make the output attend less to the protected reference image. But this leaves the model free to follow the edit instruction using the text and its own generated tokens, often producing a new, weakly grounded image rather than preventing the edit. We find that the opposite strategy is more effective: instead of leading the model to ignore the reference, we encourage it to copy it. Through controlled attention interventions, we show that concentrating target-token attention on the reference image in only a few early blocks is sufficient to collapse the editing behavior, causing the model to reproduce its input, often as a lossy copy, rather than execute the requested transformation. Based on this insight, we introduce Copying-as-Defense (CaD), which maximizes per-token target-to-reference attention mass in early transformer blocks. Since attention rows are normalized, increasing reference attention suppresses the attention allocated to the text and generated canvas. Restricting the objective to early blocks also lets us truncate the backpropagation path, keeping optimization cheap. Across editors and benchmarks, CaD reduces average edit success from 81.4% on unprotected images to 24.0%, a 70.6% relative reduction, and by a further 44.3% relative to DeContext, the strongest baseline (43.0%). CaD is also roughly 1.8-2.0x faster per optimization step than comparable methods.

Abstract

Image Forgery Detection

Explore similar work

Copying As Defense: Protecting Images from Editing By Eliciting Model Copying

Frozen DINO Localizes Image Edits Without a Localizer

PC-Edit: Prompt-Contrastive Region Discovery and Region-Guided Editing