Certification of Real Images through Calibrated Content Authentication

Certification of Real Images through Calibrated Content Authentication. By Sarim Hashmi and four others, from the Mohamed bin Zayed University of Artificial Intelligence. Published on the fifth of October. Its code repository is worked out: about fifty-five source files, with a readme.

Generative models can synthesize high-quality inauthentic content, and that content is already being misused at scale. The authors begin by testing the usual defence. They evaluate twenty deepfake detectors against ten generators released over the last four years, and find accuracy decreasing over time, from a near-perfect ninety-nine point five percent down to seventy-six percent. Adversarial perturbations then push every baseline detector below two percent accuracy, which effectively inverts the label the detector assigns.

Their argument is that this unreliability is not a matter of building a better classifier. It reflects a fundamental ambiguity. A generator can reproduce authentic content exactly, through memorization for instance, so content alone cannot reveal its true provenance. If a generator can output an image that is pixel for pixel identical to a real one, no detector looking only at those pixels can say which of the two it was shown. Falling accuracy and collapse under attack are, on this view, symptoms of asking a question that has no answer in the content.

The reframing follows from that. Content produced by a generator must admit a faithful reconstruction by that same generator. If such a reconstruction can be found, synthetic provenance is plausible, and authenticity is plausibly deniable. Instead of asking whether an image is fake, the proposed detector outputs a calibrated prediction of whether its authenticity is plausibly deniable. An image that no known generator can reproduce faithfully is one whose authenticity cannot be plausibly denied, and that is what gets certified as real.

Two pieces make that concrete. A faithful reconstruction by any known generator establishes plausible deniability. Calibration then bounds how often content that really did come from a known generator fails to be reproduced. That failure is the dangerous error, because it is how generated content would end up wrongly certified as real.

Three results are reported. First, the detector can be calibrated so that at most one percent of generated content is wrongly certified. At that operating point most baseline detectors reach near-zero recall, including the strongest of them, which has ninety-three percent accuracy.

Second, calibrating a stricter security threshold on attacked samples preserves that bound against adaptive adversaries, within the evaluated attack space of bounded perturbations, the same perturbations that break every baseline. The authors state the limit plainly: this does not cover arbitrary adversarial transformations.

Third, post-hoc verifiability is eroding. Of three thousand Reddit images, one thousand one hundred and sixteen resist reproduction by a generator from two thousand twenty-two. Against generators from two thousand twenty-four, only fifty-five to seventy-nine resist. The newer the generator, the more real photographs it can reconstruct, and the fewer remain that can be certified after the fact.

At bottom the paper swaps one question for another. Real or fake asks content to reveal something the authors argue it cannot reveal. Whether a known generator could have produced this content is a question a detector can answer with a bounded error rate. The Reddit figures add a caution that runs the other way, and the authors do not hide it: the window in which a real image can be told apart from what generators could have made is narrowing.