Digital cameras embed device-specific artifacts into every acquired image through demosaicing, in-camera post-processing, and lossy compression. These traces constitute a forensic signal that can be exploited to assess image authenticity. Existing passive methods rely predominantly on the green channel of the Bayer residual, discarding the correlated information available in the remaining color channels and typically requiring training data or device enrollment. This work proposes a zero-shot, training-free blind image manipulation localization pipeline that estimates a reference artifact pattern directly from the noise residual of a single suspect image, without assuming a fixed filter configuration, color layout, or block period. The pipeline incorporates a principled denoiser selection criterion based on the acquired-to-interpolated noise variance ratio, a block-level correlation analysis against the estimated reference pattern, and a two-component Gaussian Mixture Model scoring stage that produces a pixel-level tampering probability map. An ablation study evaluates the impact of denoiser choice and block size on localization accuracy, and comparisons against state-of-the-art passive methods demonstrate the competitiveness of the proposed zero-shot approach.
Figures & tables
Figure 1: Artifact-inducing stages of the digital image acquisition and compression pipeline. The statistical traces left by lossy, irreversible processing steps are exploited by passive forensic methods for tampering localization.
Algorithm
Best parameters θ∗
ρ(θ∗)
Selected
denoise_wavelet
L=1 , wavelet = bior4.4, σest =0.034
1.717
denoise_tv_chambolle
λ=0.002 , ϵ=0.001
2.414
denoise_bilateral
w=3 , σr=0.014
1.235
Table 1: Best configurations and acquired-to-interpolated standard deviation ratios ρ(θ∗) for each candidate denoising algorithm.
Figure 2: Acquired-to-interpolated variance ratio ρ(θ) as a function of the estimated noise standard deviation σ^ for wavelet-based denoising ( denoise_wavelet ), evaluated across decomposition levels L∈{1,…,5} and six wavelet families. In general, a single decomposition level ( L=1 ) yields the highest ρ , suggesting that shallow decompositions better preserve the acquired noise structure while suppressing interpolated content.
Figure 3: Overview of the proposed zero-shot localization pipeline.
Figure 4: Pipeline execution on two representative examples from the RTD dataset. Each column shows, from left to right: the input image, the noise residual W , the estimated reference pattern P∗ (for the green channel), the block correlation map F , the soft tampering probability map T , the binary localization mask S , and the ground-truth annotation.
Figure 5: Effect of block size B on pixel-level localization performance across camera models of the RTD dataset. The dashed line denotes the per-metric average over all devices.
Method
Metric
Precision
Recall
F 1
IoU
MCC
AUC
Ferrara [ 11 ] 0.578
0.445
0.467
0.672
0.163
0.354
0.685
Gonzalez [ 13 ] 0.772
0.673
0.670
0.710
0.253
0.450
0.781
Park [ 25 ] 0.689
0.739
0.697
0.698
0.155
0.417
0.774
Proposed 0.825
0.526
0.597
0.725
0.329
0.483
0.839
Table 2: Comparison with blind image manipulation localization methods. Results are averaged over all datasets. Best result per metric in bold.
Proactive tamper localization embeds an imperceptible signal into an image prior to distribution, enabling pixel-level manipulation detection. Existing methods assume a spliced (SP) setting, where synthesized regions are composited onto the original background, leaving embedded signals intact. However, real-world diffusion-based inpainting operates in a fully regenerated (FR) setting, where the entire image undergoes denoising, disrupting background signals and rendering existing frameworks ineffective. We propose APT, a semi-fragile latent-space perturbation that embeds a dense, vector-wise localization signal. By aligning each spatial feature vector toward a fixed anchor direction, APT localizes tampering via the alignment disparity between synthesized foreground and anchor-aligned background features after inpainting. The proposed hard negative mining loss and noisy perturbation branch further enforce uniform alignment. Experiments on COCO demonstrate that APT achieves an FR IoU of 0.92, outperforming the strongest baseline (WAM, 0.84), while existing methods collapse to near-random performance (AUC 0.5), establishing APT as a practical forensic framework generalizable across tampering types unknown at test time.
Image forgery localization remains challenging due to diverse manipulation techniques and distribution shifts. Existing forgery localization models achieve high accuracy on benchmarks but often struggle with cross-domain generalization and robustness. In this paper, we propose SARIF (Segment Anything for Robust Image Forensics), a framework that leverages the Segment Anything Model (SAM), which has a promptable architecture and strong generalization ability. SARIF introduces a feedback-guided mask decoder and a dual-encoder design that extracts forgery-specific information to capture forensic traces while exploiting the SAM architecture. To localize manipulated regions, we design a block-wise prompting mechanism that derives forgery-specific cues from residual features between an adapted encoder and its frozen counterpart. These features are fused with the previous mask prompt to drive a feedback-based mask refinement process, enabling automatic forgery segmentation without manual input. Extensive experiments on standard forgery-localization benchmarks show that SARIF achieves strong average cross-dataset performance and robustness to common image corruptions.
Dong-Hyun Moon, Ju-Hyeon Nam, Sang-Chul Lee
Department of Electrical and Computer Engineering, Inha University, 100 Inha-ro, Michuhol-gu, Incheon, 22212, Republic of Korea
With the rapid advancement of deep generative models, realistic fake images have become increasingly accessible, yet existing localization methods rely on complex designs and still struggle to generalize across manipulation types and imaging conditions. We present a simple but strong baseline based on DINOv3 with LoRA adaptation and a lightweight convolutional decoder. Under the CAT-Net protocol, our best model improves average pixel-level F1 by 17.0 points over the previous state of the art on four standard benchmarks using only 9.1,M trainable parameters on top of a frozen ViT-L backbone, and even our smallest variant surpasses all prior specialized methods. LoRA consistently outperforms full fine-tuning across all backbone scales. Under the data-scarce MVSS-Net protocol, LoRA reaches an average F1 of 0.774 versus 0.530 for the strongest prior method, while full fine-tuning becomes highly unstable, suggesting that pre-trained representations encode forensic information that is better preserved than overwritten. The baseline also exhibits strong robustness to Gaussian noise, JPEG re-compression, and Gaussian blur. We hope this work can serve as a reliable baseline for the research community and a practical starting point for future image-forensic applications. Code is available at https://github.com/Irennnne/DINOv3-IML.
Jieming Yu, Qiuxiao Feng, Zhuohan Wang +1
The Hong Kong University of Science and Technology · Harvard University