PaperlayerView exact revision on arXiv

Source-linked AI summary

Can Pixels Alone Reveal Image Origin? Minimax Limits and Learnable Interfaces for Passive Provenance

Kai Yao

arXiv:2609.30997v1cs.CRcs.AIcs.CVcs.LG

TL;DR

Passive image provenance asks whether pixels identify an image’s source despite targeted edits. The paper characterizes an image-only statistical ceiling and a separate public-interface attack mechanism, then evaluates these ideas on finite-state and same-prompt image benchmarks. The evaluated public CLIP verifiers fail under targeted pixel attacks, while abstention reduces measured attack success.

  • Problem

    Passive provenance asks whether pixels reveal a human, aggregate AI, or particular-generator origin, and targeted editing makes the source–target separation question central.

    Source: §1 · pp. 1–2

  • Method

    The paper formulates source–target verification under allowed edits, proves a total-variation minimax ceiling, and bounds surrogate attacks when deployed scores are emulable.

    Source: §1 · p. 1, §4 · p. 4

  • Results

    On same-prompt benchmarks, evaluated public CLIP verifiers fail under targeted pixel attacks; a ResNet-18 victim shows partial fake-to-real transfer, and abstention reduces measured attack success.

    Source: §9 · p. 10, §8 · p. 10

  • Takeaways & Limitations

    Robust provenance evaluation should report the source–target direction, edit class, and released interface, because each affects the conclusion.

    Source: §8 · p. 10

    Image experiments use same-prompt real/diffusion benchmarks and bounded pixel edits; semantic edits, non-diffusion sources, and live commercial APIs are not evaluated.

    Source: §8 · p. 10

Abstract

from arXiv · show

Passive image provenance asks whether pixels alone can reveal where an image came from: a human, an aggregate AI class, or a particular generator. This becomes a robustness problem once a source image can be edited before the verifier sees it. We study the problem as source--target verification under adversarial distribution shift. Our first result gives the exact best-case limit for any image-only verifier: the largest robust target-acceptance gap equals the minimum total-variation distance between the target distribution and the set of attacked source distributions. This quantity depends on the source, target, and edit class, not on the verifier architecture. Our second result explains why deployed public verifiers can fail before this statistical limit is reached. If the verifier can be emulated on the attack region to error $\varepsilon$, then a surrogate black-box attack reaches target acceptance within $2\varepsilon$ plus optimization error of the white-box optimum; score-revealing logistic and softmax heads over public features are identifiable, and approximate score access gives stable recovery bounds. A finite-state experiment checks the minimax identity where both sides are computable. On same-prompt real/diffusion benchmarks, the evaluated public CLIP verifiers fail under targeted pixel attacks, while a ResNet-18 victim exhibits partial fake-to-real transfer. Binary feedback with abstention reduces measured attack success, but positive empirical gap upper bounds do not establish robustness. These results motivate separate evaluation of the source--target statistical ceiling and the information released by a deployed verifier.

1 Introduction

Passive image provenance infers whether pixels came from a human, an AI class, or a particular generator. The paper frames targeted editing as a source–target verification problem with distinct statistical and interface-based barriers.

1 Introduction

  • The source–target setup defines the source distribution, admissible edits, and verifier score as target acceptance.The score ranges from 0 to 1.Source: §1 · p. 1
  • The central question is how much more a verifier can score true target images than any edited source images.The attacker edits a source image to make it accepted as a chosen target.Source: §1 · pp. 1–2
  • Two barriers can undermine separation: edited sources may approach the target distribution, or a public verifier may be learnable enough to attack through a surrogate.These require different remedies: training cannot beat the statistical ceiling, while interface design can reduce verifier learnability.Source: §1 · p. 2
  • The paper separates an exact total-variation minimax ceiling from a deployed-interface failure mode in which black-box attacks can approach white-box performance.In the evaluated CLIP comparison, binary feedback with abstention reduces attack success, but positive empirical gap upper bounds leave the true robust gap unresolved.Source: §1 · p. 2

1. Exact minimax limit for target verification. We define the attackability radius

The paper presents a statistical ceiling for passive verification and separate results on verifier learnability, score recovery, private interfaces, and empirical evaluations.

1. Exact minimax limit for target verification

  • The optimal passive verifier is governed by the target’s distributional distance from the family of attacked source distributions.This identifies the image-only statistical limit independently of a particular verifier architecture.Source: §1 · p. 2
  • If a deployed verifier is ε-emulable on the attack region, surrogate black-box attacks reach target acceptance within 2ε plus optimization error of the white-box optimum.The bound connects score emulation accuracy and attack optimization error to the acceptance achievable by a black-box attack.Source: §1 · p. 2
  • Full score access identifies logistic and softmax heads over public features, while bounded log-odds error yields stable emulation when probe features are well conditioned.These recovery guarantees concern score-revealing heads over public features.Source: §1 · p. 2
  • A conditional query bound in a stylized hidden-state model shows how private, low-bandwidth feedback can raise attack cost without changing the image-only statistical ceiling.The result is a query-cost separation, not a change to the underlying ceiling.Source: §1 · p. 2
  • On same-prompt real/diffusion benchmarks, evaluated public CLIP verifiers retain negative empirical gap upper bounds after stronger clean or adversarial retraining.The experiments also include a finite-state minimax check, partial fake-to-real transfer to a ResNet-18 victim, and paired image-quality measurements.Source: §1 · p. 2

2 Related Work

Related work spans passive forensic provenance and attribution, adversarial robustness, active watermarking, and private auditing. This paper distinguishes an image-only source–target limit from the learnability of one deployed interface.

2 Related Work

  • Adversarial-robustness methods include worst-case perturbations, robust optimization, transfer, black-box attacks, and gradient-based attacks.The paper applies total-variation characterization and Sion’s minimax theorem to derive a source–target ceiling; model extraction, distillation [59], and surrogate attacks are established tools.Source: §2 · p. 2
  • Passive provenance builds on sensor and camera-model traces, forensic embeddings [3], synthetic-image detection, and generator attribution.Prior work reports clean accuracy and empirical attack failures [20].Source: §2 · p. 3
  • Watermarking modifies generators, training, or artifacts, whereas this work studies passive verification without trusted marks or metadata.The paper treats the released verifier interface as another possible attack surface.Source: §2 · p. 3
  • Keyed passive attribution methods such as SPRINT keep reconstruction private [47], while the paper’s private-interface theorem models hidden state and low-bandwidth feedback rather than any one auditor.That model isolates a query-complexity mechanism: search instead of direct score optimization.Source: §2 · p. 3

3 Target Verification under Adversarial Distribution Shift

The framework treats a provenance task as verification from a source label to a target label under an explicitly specified set of allowed edits. It defines the verifier score and the distributions reachable through editing.

3 Target Verification under Adversarial Distribution Shift

  • The image space is finite for the elementary main proof, with an extension to general measurable spaces under a stated total-variation compactness assumption.Labels may denote HUMAN, an aggregate AI class, or a particular generator.Source: §3 · p. 3
  • For a source–target task, s and t denote the source and target labels, and f_t scores an image’s acceptance as target t.The score can represent a binary AI detector or a target component of a multiclass attribution model.Source: §3 · p. 3
  • The edit correspondence Γ specifies allowed outputs for each source image, and stochastic editors induce attacked source distributions collected in Q_s.The target changes the objective but not the reachable family Q_s, which is nonempty, convex, and compact.Source: §3 · p. 3
  • The robust target-verification gap compares clean target acceptance with the worst-case acceptance over edited source distributions.A positive gap favors clean targets; a negative gap means an edited source can score higher than clean target samples.Source: §3 · p. 3
  • A mixture of generator distributions with weights π_j is used only when discussing coarse AI-versus-human verification.Each P_j denotes the distribution of generator j.Source: §3 · p. 4

4 Barrier I: A Minimax Statistical Ceiling

The best robust target-verification gap is set by the distance from the target distribution to the closest attacked source distribution, not by the verifier architecture. The ceiling can shrink to zero, and aggregate targets need not share the robustness profile of generator-specific targets.

Barrier I: A Minimax Statistical Ceiling

  • The attackability radius is the minimum total-variation distance between the target distribution and the family of attacked source distributions.For a fixed attacked distribution, the best [0, 1]-valued test achieves its total-variation distance; minimax exchange yields the closest distance over the attacker’s choices.Source: §4 · p. 4
  • If the attackability radius is zero, no passive verifier can maintain positive robust target separation under the edit class.The bound is determined by distribution geometry rather than a model class or training algorithm.Source: §4 · p. 4
  • An aggregate AI label mixes generator-specific targets and can be easier to hit, so binary detection and generator attribution need not have the same robustness profile.The paper also reports no universal ordering between human-evasion and model-impersonation radii.Source: §4 · p. 4
  • The empirical gap upper bounds diagnose failure on evaluated samples but do not directly estimate the statistical ceiling.The ceiling itself is the distributional distance characterized by the attackability radius.Source: §4 · p. 4

5 Barrier II: Learnable Interfaces Collapse to Surrogate Attacks

A deployed verifier can be vulnerable when an attacker learns an accurate surrogate on the attack region and optimizes against it. The paper gives a near-white-box bound, shows exact recovery for score-revealing public heads, and qualifies recovery by interface access and feature conditioning.

Surrogate attacks

  • An ε-emulator on the attack region lets a surrogate attack approach the white-box optimum, with losses from emulation error and surrogate optimization.The proof accounts for surrogate error at the white-box maximizer, optimization loss on the surrogate, and surrogate error when the chosen point is evaluated.Source: §5 · p. 5

Learned emulators

  • A query procedure that learns a good emulator on the attack region suffices for a near-white-box targeted attack; exact parameter recovery is unnecessary.The corollary allows a random returned surrogate with a high-probability emulation guarantee.Source: §5 · p. 5

Score-revealing heads

  • Full probability vectors from a softmax head over public features allow exact head recovery from p queries when the probe feature matrix is invertible.The binary logistic case is the two-class specialization, and attacks on the recovered head match white-box attacks up to optimization error.Source: §5 · p. 5

Stable recovery

  • Approximate log-odds recovery is stable when probe features are well conditioned, with bounds also depending on attack-region feature norms.Deriving a bound from noisy or quantized probabilities additionally requires probabilities in the ratios to stay bounded away from zero.Source: §5 · p. 5

Scope

  • These recovery results require score-revealing interfaces and public features; they do not claim exact recovery for every public verifier or sufficient information from top-1 labels alone.They are presented as specific instances of the broader learnability barrier.Source: §5 · p. 5

6 Private Interfaces Raise Query Cost, Not the Statistical Ceiling

A low-bandwidth interface can raise attack cost under a hidden-state model, but it does not change the image-only statistical ceiling. The bound is conditional on each fixed action succeeding on only a limited fraction of hidden states; the hidden-support example is deliberately simplified.

Hidden-state search

  • If each fixed action succeeds on at most a ρ fraction of hidden verifier states, the theorem bounds every adaptive q-query attacker using an interface with at most M output symbols per query.The result concerns query access to a hidden verifier state, not the image-only statistical ceiling.Source: §6 · p. 6

Bound conditions

  • The query bound depends on the fixed-action success condition as well as interface bandwidth; low bandwidth alone does not imply security.The proof counts possible query transcripts and the actions they induce.Source: §6 · p. 6

Scope and abstention

  • The hidden-support model is a clean illustration of the hidden-state theorem, not a literal model of a deployed provenance service.With abstention, the interface alphabet may grow while the accepting region shrinks, which can reduce attack success.Source: §6 · p. 6

7 Empirical Evaluation

The evaluation tests targeted pixel attacks on same-prompt real/diffusion benchmarks while varying verifier interfaces and model settings. Public CLIP verifiers collapse under these attacks; interface changes and cross-model tests show important limits to that finding.

7 Empirical Evaluation

  • The image experiments vary what the verifier reveals, fit or recover emulators from replies, run targeted PGD, and evaluate final images on the deployed verifier.The study uses two same-prompt benchmarks and pixel budgets of 2/255, 4/255, or 8/255.Source: §7 · p. 6

7.1 Public score access collapses the controlled verifier

  • Score-revealing queries recover the controlled CLIP verifier, and all four source–target directions collapse under attack with negative empirical gap upper bounds.Attacks on the recovered verifier approach white-box performance.Source: Figure 1 · p. 7, §7.1 · p. 7

7 Empirical Evaluation

  • In 20 finite-state settings, independent transport and verifier-side minimax linear programs agree within 4.44 × 10−16, but the realistic-image minimax radius remains unestimated.Image-table bounds are held-out sample estimates without a population confidence guarantee and do not estimate the minimax radius.Source: §7 · p. 7

7.2 Interface limits matter more than clean strength

  • On the expanded benchmark, full vectors, single scores, and plain binary feedback remain highly attackable, while binary feedback with abstention reduces ASR across three systems.Positive estimated gap upper bounds with abstention do not certify robustness; top-1 attacks still succeed against the MLP and off-the-shelf detector despite ϵ95 = 1.0.Source: Table 1 · p. 8, §7.2 · p. 8

7.3 Stronger retraining still does not restore robustness

  • The stronger clean retrain improves accuracy from 0.517 to 0.869 and fake AUC from 0.887 to 0.982, yet empirical gap upper bounds remain negative; adversarial retraining also leaves them negative at 8/255.Table 2 summarizes attack outcomes across four evaluated directions.Source: §7.3 · p. 8, Table 2 · p. 8

7.4 Transfer beyond CLIP and paired image quality

  • The ResNet-18 victim shows partial fake-to-real transfer: 45/117 initially correct sources succeed at 8/255, while real-to-fake succeeds on 0/122.At 2/255, 45/50 paired attacks succeed; at 8/255, 50/50 succeed, with lower per-direction SSIM and higher LPIPS-Alex, a quality trade-off not assessed by a human perceptual study.Source: §7.4 · pp. 8–9, Figure 2 · p. 9

8 Discussion and Limitations

The discussion separates an image-only statistical ceiling from failures caused by learnable verifier interfaces. It argues that evaluation must account for source–target direction, allowed edits, and the exposed interface, while noting important limits in the evidence.

8 Discussion and Limitations

  • The attackability-radius law sets an image-only ceiling, while a learnable public interface can make a deployed verifier fail before that ceiling is reached.A large statistical gap leaves room for a good verifier in principle, but does not establish that a deployed model is safe.Source: §8 · p. 9
  • In evaluated settings, public CLIP interfaces allowed targeted attacks to reach or exceed clean target acceptance, and stronger retraining did not restore positive empirical robust-gap upper bounds.A negative empirical upper bound indicates attacked source samples receive higher target scores than clean target samples under the deployed verifier.Source: §8 · p. 9
  • Abstention reduced measured attack success in the CLIP experiments, but positive estimated gap upper bounds leave robustness unresolved.The private-interface result is conditional on hidden verifier state and a fixed-action success bound; it does not change the statistical ceiling.Source: §8 · pp. 9–10
  • The image evidence is primarily CLIP-centered and uses same-prompt real/diffusion benchmarks with bounded pixel edits; semantic edits, non-diffusion sources, and live commercial APIs are unevaluated.The ResNet-18 evidence covers one victim, one seed, one score interface, and partial transfer in one direction.Source: §8 · p. 10
  • A robust evaluation should report source–target direction, edit class, and released interface rather than treating clean accuracy as a robustness certificate.The discussion also recommends reporting attack success, the empirical robust-gap upper bound, and surrogate learnability when public scores are released.Source: §8 · pp. 9–10

9 Conclusion

The paper characterizes passive provenance under editing through two distinct barriers: an exact statistical ceiling and the learnability of public verifier interfaces. Its conclusion draws together the minimax identity, recovery results, private-interface bounds, and controlled CLIP attack evidence.

9 Conclusion

  • The best robust target-verification gap equals the minimum total-variation distance between the target distribution and the family of attacked source distributions.The conclusion frames this as an image-level ceiling, distinct from failures caused by a learnable verifier interface.Source: §9 · p. 10

B.2 Exact recovery of score-revealing heads

  • A public verifier emulable within ε on the attack region permits black-box targeted attacks within 2ε plus optimization error of the white-box optimum.For score-revealing logistic and softmax heads over public features, full-score recovery is exact with invertible probe features; approximate log-odds access has stable recovery bounds.Source: §9 · p. 10, §B.2 · p. 17

A.1 Reachable attacked distributions

  • The finite-state proof uses convex, compact reachable attacked distributions and minimax interchange to equate the verifier optimum with the minimum total-variation distance.For a fixed attacked distribution, the best verifier attains total variation; randomized attacks do not outperform pointwise maximizers.Source: §A.1 · p. 15, §A.3 · p. 16

A.4 Coarsening and directional asymmetry

  • Human evasion and impersonation of a particular model have no universal ordering: either the human-evasion or model-impersonation radius can be larger.The paper supports both strict orderings with finite-space examples.Source: §A.4 · p. 16

C Private-Interface Counting Proofs

  • In the hidden-state model, a private low-bandwidth interface can raise query costs conditionally, but does not change the image-only statistical ceiling.The hidden-support instantiation gives an explicit sparse-support query lower bound under its stated assumption.Source: C Private-Interface Counting Proofs · p. 18, §C.1 · p. 18

D.1 Controlled public CLIP-softmax baseline

  • The controlled public CLIP-softmax study reports that score recovery becomes operationally white-box by 2,048 queries, while all four targeted directions reach ASR 1.0 by 8/255 with negative empirical gap upper bounds.The evaluated human-to-AI mixture attacks also finish with ASR 1.0 at 8/255; these empirical results do not establish the statistical ceiling.Source: §D.1 · pp. 19–20, Table 3 · p. 19, Table 4 · p. 20

D.2 Expanded five-class interface study

The expanded interface study finds that attackability depends on what feedback the verifier releases: binary feedback with abstention reduces measured attack success, whereas ordinary binary feedback remains attackable under tested transcript caps. The accompanying sections qualify the image-level bounds, report related controls, and describe the benchmark and evaluation scope.

D.2 Expanded five-class interface study

  • Binary feedback with abstention reduces measured attack success, while ordinary binary feedback remains at ASR 1.0 with negative estimated gap upper bounds across tested transcript caps.Table 6 compares interfaces on a fixed benchmark, target-direction family, budget, and representative verifiers; positive estimated upper bounds do not certify robustness.Source: §D.2 · pp. 20–21, Table 6 · p. 21, Table 7 · p. 21

D.3 Adversarially trained and stronger clean three-class models

  • Stronger clean-only performance does not remove the observed interface-learnability failure: targeted attacks reach ASR 1.0 for all four directions by 4/255.The clean-only model has accuracy 0.8689 and fake AUC 0.9822, with non-positive empirical gap upper bounds throughout the evaluated budgets.Source: §D.3 · p. 22, Table 9 · p. 22

E Empirical Bracketing of Barrier I

  • For realistic images, the attackability radius is difficult to estimate, and the image experiments do not bound it tightly enough to recover ∆s,t.The reported empirical gap from heuristic attacks upper-bounds the fixed-verifier gap; it does not thereby lower-bound the minimax ceiling.Source: E Empirical Bracketing of Barrier I · pp. 22–23

F Extension Beyond Finite Image Spaces

  • The minimax identity extends beyond finite image spaces when the reachable attacked-distribution set is nonempty, convex, and compact in total-variation norm.The proof uses Sion’s minimax theorem and the variational characterization of total variation.Source: F Extension Beyond Finite Image Spaces · p. 23

G Reproducibility, Societal Impact, and AI-Assisted Writing

  • Image attack results are descriptive held-out evaluations without population confidence bounds; the ResNet-18 transfer result uses one seed, and experiments were offline on controlled benchmarks.The authors also identify dual-use implications for targeted-forgery techniques and provenance or moderation pipelines.Source: G Reproducibility, Societal Impact,… · p. 24

H.1 Surrogate training and attack protocol

  • The image evaluation fits emulators on released interface responses, then uses targeted PGD; validation-set ϵ95 does not bound the uniform attack-region error required by the surrogate theorem.The interface sweep also does not estimate average surrogate optimization error separately.Source: §H.1 · p. 25

H.2 Finite-state validation of Barrier I

  • Across 20 finite-state population settings, independently computed minimax values differ by at most 4.44 × 10^-16.The plug-in estimation study uses empirical histograms and 20 repeats per setting; it does not estimate the radius for real high-dimensional image distributions.Source: §H.2 · pp. 25–26, Table 10 · p. 26

H.3 Transfer to a non-CLIP victim

  • A CLIP-feature emulator transfers partially to an RGB ResNet-18 victim: 45/117 initially correct fake sources succeed fake-to-real, versus 0/122 in the reverse direction.The study uses one victim architecture and one seed; positive empirical gap estimates leave the true robust-gap sign unresolved.Source: §H.3 · p. 26, Table 11 · p. 26

H.4 Paired image quality and attack success

Paired image-quality measurements quantify the trade-off between attack success and fidelity to the clean source. The selected visual examples illustrate outcomes but do not establish perceptual or semantic preservation.

H.4 Paired image quality and attack success

  • At 2/255, attacks induce the target in 45 of 50 initially correct instances; the pooled induced-success medians are 0.9784 SSIM, 0.0063 LPIPS-Alex, and 43.82 dB PSNR.The evaluation covers 64 instances per budget, including 14 that already had target-side predictions before attack.Source: §H.4 · pp. 26–27, Table 12 · p. 27
  • Increasing the budget to 8/255 induces five additional successes, with lower SSIM and higher LPIPS medians, trading lower paired image quality for higher induced success.All evaluated instances remain within the prespecified ℓ∞ budget tolerance; the metrics measure source-image fidelity, not human perception or semantic preservation.Source: §H.4 · p. 27, Table 12 · p. 27
  • At 2/255, selected paired examples include an attack failure; at 8/255, all four selected examples are induced successes, and amplified perturbations do not establish imperceptibility.The figures show the same clean images at both budgets; selected examples illustrate individual outcomes rather than estimate their prevalence.Source: §H.4 · p. 27, Figure 4 · p. 28, Figure 5 · p. 29

Related papers

Loading 2609.30997v1…