Synthetic image source attribution is a challenging task, especially in data scarcity conditions requiring few-shot or zero-shot classification capabilities. We present a new training-free one-shot attribution method based on image resynthesis. A prompt describing the image under analysis is generated, then it is used to resynthesize the image with all the candidate sources. The image is attributed to the model which produced the resynthesis closest to the original image in a proper feature space. We also introduce a new dataset for synthetic image attribution consisting of face images from commercial and open-source text-to-image generators. The dataset provides a challenging attribution framework, useful for developing new attribution models and testing their capabilities on different generative architectures. The dataset structure allows to test approaches based on resynthesis and to compare them to few-shot methods. Results from state-of-the-art few-shot approaches and other baselines show that the proposed resynthesis method outperforms existing techniques when only a few samples are available for training or fine-tuning. The experiments also demonstrate that the new dataset is a challenging one and represents a valuable benchmark for developing and evaluating future few-shot and zero-shot methods.
AI-generated speech is becoming increasingly used in everyday life, powering virtual assistants, accessibility tools, and other applications. However, it is also being exploited for malicious purposes such as impersonation, misinformation, and biometric spoofing. As speech deepfakes become nearly indistinguishable from real human speech, the need for robust detection methods and effective countermeasures has become critically urgent. In this paper, we present the ISPL's submission to the SAFE challenge at IH MMSec 2025, where our system ranked first across all tasks. Our solution introduces a novel approach to audio deepfake detection based on a Mixture of Experts architecture. The proposed system leverages multiple state-of-the-art detectors, combining their outputs through an attention-based gating network that dynamically weights each expert based on the input speech signal. In this design, each expert develops a specialized understanding of the shared training data by learning to capture different complementary aspects of the same input through inductive biases. Experimental results indicate that our method outperforms existing approaches across multiple datasets. We further evaluate and analyze the performance of our system in the SAFE challenge.
Limited data-availability and ethical concerns regarding individual privacy hinder large-scale understanding of protests using social media data. Current visual methods for human image understanding are capable of re-identifying faces, understanding complex scenes and objects, and associating them together. This presents an ethical dilemma, as large vision models can memorize and leak sensitive information from training data. To our knowledge, unfortunately, no existing protest analysis method takes privacy into consideration. To close the gap in the literature, we propose a simple and robust framework for understanding protest dynamics with privacy preservation, namely privacy preserving protest dynamics (P3D). Our P3D framework aims to replace private data with well labeled synthetic reproductions using conditional image synthesis. Extensive evaluation of the proposed P3D method demonstrates its ability to generate realistic and diverse imagery, and its efficacy in utility and privacy for downstream protest analysis. Moreover, unlike other private models, P3D can provide a moderate level of privacy by modeling complex visual features in protest images while maintaining downstream utility. Code is available at https://github.com/cgarchbold/P3D
The Data Act’s ‘Mandatory Smart Contract Kill Switch’, officially enforced by the EU fromJanuary 11, 2024, is sparking significant debate across Europe and within the cryptocurrency community. The primaryconcern is that this mandate could potentially render existing deployed smart contracts illegal and undermine the decentralization and immutability that are fundamental to DeFi. Analysis so far indicates that the biggest issue isthe lack of clear guidelines and scope regarding the implementation of the smart contract kill switch in the DataAct. In response, this paper proposes a private blockchain-based software transaction system to address the persistentissues in the software transaction process. The proposed system aims to construct a reliable software transaction environment by presenting methods and measures for applying smart contract kill switch that can address security incidents and license violations. This is achieved through the distribution of profits based on developer contributions, calculated using blockchain technology and peer evaluation, ensuring transparency, fairness, and decentralization.
In batch steganography, the sender spreads the secret payload among multiple cover images forming a bag. The question investigated in this paper is how many and what kind of images the sender should select for her bag. We show that by forming bags with a bias towards selecting images that are more difficult to steganalyze, the sender can either lower the probability of being detected or save on bandwidth by sending a smaller bag. These improvements can be quite substantial. Our study begins with theoretical reasoning within a suitably simplified model. The findings are confirmed on experiments with real images and modern steganographic and steganalysis techniques.
Recovering the place of origin of, e.g., a phone call can aid the reconstruction of events in a criminal case. For audio forensics, identifying the recording location exclusively from an audio signal still poses a challenge. While various works address this task, they evaluate on semi-synthetic reverberant speech data in a supervised setting. Thus, there barely exist any empirical insights on practical forensic recording environment identification, i.e., the handling of real-world audio data from case-dependent locations that are unknown to a tool in advance. In this work, we take a first step towards such a practical scenario. We collect a set of real-world speech from several rooms under varying recording parameters. In forensic cases, audio evidence usually stems from uncontrolled sources, such that factors like the recording position, speaker or microphone can be unknown and reverberation characteristics are of mixed quality. The influence of such factors for room identification is analysed in detail, with several results. For example, we find that prior knowledge about the recording position strongly aids classification, and that characteristics of a speaker’s voice notably impact performance. Instructions on how to obtain the data set are online: https://faui1-gitlab.cs.fau.de/mmsec/forreal
This demonstration presents CryptojackingTrap, an advanced cryptojacking malware detection solution that stands out among similar works due to its superior evasion resilience. The demonstration covers the architecture, design, and implementation of CryptojackingTrap, highlighting its effectiveness in detecting cryptojacking attempts, even in scenarios where attackers employ evasion techniques to reduce the hash rate by up to tenfold. The evaluation includes rigorous experimental testing against both miner and non-miner executables. This demonstration provides cybersecurity specialists with a deep understanding of the algorithm, showcasing its robustness and potential for extension, and offering insights into benchmarking detection solutions using publicly available datasets and opensource codebases.
Biometric systems are used in our daily life but are subject to attacks to bypass them as a security solution. Presentation attacks in digital fingerprints occur when an imposter tries to use a fake sample at the acquisition step to impersonate another individual or not to be identified. Providing an explanation for the operator (who is not an expert in biometrics) could be of great interest for many applications (border control, physical access control). In this paper, we propose a fingerprint presentation attack detection method with explainability feedback that can be understood by any user. The experiments has been realized on the Fingerprint Liveness Detection Competition (LivDet) dataset in 2015 and contains more than 58,000 bona fide and attack fingerprint images. The proposed method reaches an accuracy rate of 95.7% on LivDet2015 with feedback that can be understood by any user.
The rapid development of audio generation techniques has made it increasingly easy to create sophisticated audio deepfakes, posing significant threats to individual privacy and security. To combat this, effective methods for detecting audio deepfakes are crucial. Deep learning techniques, particularly pre-trained self-supervised speech representations, such as WavLM, have shown promise in addressing this challenge. However, their computational inefficiencies limit their deployment in real-world edge speech applications. This paper investigates the use of early exiting applied to WavLM, to achieve reliable classification of genuine and spoofed audio samples with a 50% reduction in the number of model parameters and a relative performance improvement of up to 12%. The proposed method is a powerful candidate for deepfake detection in edge applications with limited computational resources.
Multiparty private set intersection enables multiple parties to determine the intersection of their private sets without disclosing the actual content. It is pivotal for collaboration in cyber threat intelligence as it allows organizations to share compromising or sensitive data in a privacy-preserving manner. This data includes infected IP addresses, malware hashes and other indicators of compromise. Then, the organizations identify elements that overlap across all datasets and take action to mitigate the threat with the broadest impact. Although, in many cases, the condition that an element be present in all sets is too stringent. Therefore, in this work, we focus on threshold multiparty private set intersection (T-MPSI), a protocol that identifies elements present in a subgroup of the total sets instead of in all sets. We highlight the differences between three different perspectives when computing the threshold intersection: individual-only the party leader learns the elements from their set that meet the threshold, all-all parties learn the elements from their set that meet the threshold, and collective-all parties jointly learn all elements that are present in the threshold, regardless of whether they possess those elements themselves. While many implementations for T-MPSIindividual and T-MPSIall have been proposed, to the best of our knowledge, no implementation for T-MPSIcollective exists. Therefore, we present a generic composition that extends any T-MPSIindividual protocol into a T-MPSIcollective protocol. Our extension employs a multiparty private set union to aggregate outputs efficiently. We then provide a comprehensive analysis and runtime evaluation, demonstrating the feasibility of the extension.
Several text-to-speech (TTS) generation methods have been recently proposed which use diffusion models. Synthetic speech has been maliciously used for impersonation and to spread misinformation. Therefore, synthetic speech detection and attribution methods have been developed. Synthetic speech detection methods can detect synthetic speech. Synthetic speech attribution methods can identify the generator that was used for synthesizing a given speech. Existing attribution methods attribute a given speech to conventional speech generators, and their performance is demonstrated mainly on the ASVspoof2019 Dataset. In this work, we explore the attribution of latest, diffusion model based speech generators including commercial speech generation software. We experiment with four synthetic speech attribution methods, two of which demonstrate more than 99% attribution accuracy. These methods can also identify unseen speech generators which have not been used for their training.
The actual capacity to AI-generate realistic fully synthetic images is day-by-day improving and this is particularly true for pictures representing human faces that appear indistinguishable from real people. This poses the crucial need to develop instruments able to discern between true and do not existing people by detecting some eventual inconsistencies embedded within the images during the generation process. The main difference between a pristine picture and a deepfake generated one is that, in the second case, there has not been an effective camera acquisition; so all the various interrelationships among the elements belonging to the scene (lights, reflectance, object respective positions in the 3D space) are not taken by the real world in that precise time instant but just artificially reproduced. According to such consideration, in this work, we introduce local camera surface frames as a possible mean to represent these specific environmental characteristics in order to highlight differences. The experimental analysis carried out has witnessed that this feature can grant a very high level of accuracy and a significant degree of generalization.
The rapid advancement of biometric authentication requires extensive performance tests to inhibit the discriminatory treatment of travellers due to their demographic background. However, the European General Data Protection Regulation (GDPR) restricts the use of face images collected as part of border controls to be processed for no reason other than their original purpose. In this work, we explore altering the ethnicity using synthetic face image generation approaches to increase the diversity of datasets to represent multiple ethnicities of the same identity. In this work, we present a systematic study to assess the applicability of ethnicity alteration of face images by studying the performance of the face recognition system (FRS) and face image quality assessment (FIQA). Ethnicity-altered images were generated using Generative Adversarial Network-based (GAN) image-to-image translation and manifold learning models. We test these approaches on a publicly available Racial Faces in the Wild (RFW) dataset and focus on Asian, Black, and Indian ethnicity. We conduct experiments to benchmark the ethnicity-altered images for FRS performance using two recent deep learning models and complement it with FIQA analysis using three different algorithms. With the limited drop in FRS performance and a similar effect on quality scores, our results indicate the applicability of ethnicity alteration to diversify the datasets and make systems fair.
In the field of temporal image forensics, the main objective is to approximate the age of a digital image relative to images from the same device. For this purpose, classical methods exist where age inference is based on the presence of a hidden age signal (i.e., in-field sensor defects). In contrast to these classic methods, there exists also a method for image age approximation based on a Convolutional Neural Network (CNN). However, exploiting neural networks for age approximation carries the risk of learning non-age-related features to predict the age class. Usually, images taken in close temporal proximity (i.e., belonging to the same age class) share common scene properties (aka content bias), which can be exploited by the neural network. In this work, a new temporal image forensics dataset is proposed where content bias is limited. This dataset could help to, (i) develop deep learning based age approximation methods (ii) facilitate the discovery of new (unknown) age traces, (iii) assess the impact of content bias on existing age approximation methods and (iv) develop and verify new eXplainable Artificial Intelligence methods. A realization of the dataset as a benchmark for robustness against content bias is demonstrated in this work.
Morphing Attack Detection (MAD) is a critical task in biometric security, aimed at identifying and mitigating the risks posed by morphing attacks, where a face image is manipulated to resemble multiple individuals. Therefore, MAD systems are essential to prevent unauthorized access and ensure the integrity of biometric authentication procedures. However, the acquisition, storing and transfer of real biometric data on which they are based are limited by ethical, legal, and privacy concerns, and this hinders their accuracy. To address these issues, we propose and release MONOT, a new dataset of synthetic morphed images. The dataset includes high-quality synthetic morphed images that are ISO/ICAO compliant and have the characteristics of real biometric data without compromising individual privacy. The morphing procedure is applied through six different morphing algorithms, providing a great level of data variability. Our experimental results demonstrate MONOT morphed images show a high attack potential and that MAD systems trained on MONOT exhibit high detection performance across various morphing techniques. All these elements highlight the dataset's effectiveness in supporting the development of robust and generalized MAD systems.
The impact of long-term facial ageing on face recognition remains understudied due to a lack of openly available data. The age-related impermanence in facial identity affects many applications, including forensics and border control, limiting the accurate authentication of individuals in large-scale face image datasets. Recent advances in generative models have enabled facial ageing simulation with improved accuracy and identity preservation. In this work, we propose AgeDiff, a latent diffusion-based face age editing model using a Dual Cross-Attention conditioning mechanism to disentangle and control identity and age facial features. We conduct extensive performance evaluations and comparisons to existing methods, exploring how age simulations can assist with face image identification in forensic applications. We will publish our code and pre-trained models upon paper acceptance.
The escalating threats posed by cyber-attacks, particularly zero-day attacks, are projected to push the global annual cost of cybercrime to $10.5 trillion in 2025, with an anticipated 33 billion accounts breached [1]. Detecting these zero-day attacks, which exploit unknown vulnerabilities, is critical. This paper introduces the Graph-based Unknown Attack Recognition and Detection (GUARD) system, which combines autoencoders and graph theory to detect zero-day threats. GUARD translates latent representations and reconstruction errors from autoencoders into graphs, with edges weighted by similarity. Our novel technique, Hierarchical Quartet Loss, builds on the established triplet loss by using four elements and a hierarchical structure to enhance graph modularity by distinguishing both attacks and attack families. By analyzing patterns such as reconstruction error and cosine similarity, GUARD identifies unknown samples that deviate significantly from known patterns. Additionally, GUARD can discern multiple subclasses within the unknown dataset and represents them in a hierarchical family tree, offering a comprehensive visualization of network behaviors. Initial validation shows that GUARD improves zero-day attack detection precision and provides valuable insights into emerging threat characteristics and categorization.
The growing use of generative AI models for managing sensitive data presents substantial privacy risks. Differential privacy (DP) methods can mitigate such risks but approaches based on the Gaussian mechanism, such as Differentially Private Stochastic Gradient Descent (DPSGD) and Private Aggregation of Teacher Ensembles (PATE), often produce low-quality synthetic data due to the addition of noise during training. To address this issue, several approaches explored the distribution of private data in the latent space of a publicly-trained generative model, by either building a secondary DP-GAN on the latent space [1], [2] or direct sampling via exponential mechanism (EM) [3]. However, these methods still face challenges in identifying regions in the latent space that yield high-quality private images and in managing the privacy budget effectively. In this paper, we introduce DPGEM (Differentially Private Generative Model with Exponential Mechanism), which enhances the scoring function by employing a classifier trained on synthetic representations of private and public data. We propose a local differential privacy composition rule to achieve tighter privacy bounds and an Uncertainty-Based Spreader Identification Method (UBSIM) to improve privacy accounting. Experiments on MNIST and Fashion-MNIST datasets demonstrate that DPGEM generates high-quality images with competitive performance while maintaining strong privacy guarantees.
The wiretap channel model is based on two assumptions: (A1) the legitimate transmitter (Alice) is indeed communicating with the intended receiver (Bob) and not with an eavesdropper (Eve) and (A2) the channel from Alice to Bob is better than the one from Alice to Eve. This work proposes a protocol with physical unclonable functions (PUFs) as a security primitive to ensure that the two assumptions hold in practice. Furthermore, an implementation shows the feasibility of the concepts. To achieve semantic security in the wiretap channel, we use a seeded modular coding scheme for physical layer security (PLS).
The development of generative AI techniques such as Generative Adversarial Networks and Diffusion Models has made it accessible to create images, often extremely realistic, that do not represent reality. This capability has been exploited on multiple occasions by malicious actors to spread propaganda and fake news online. To trace the origin of generated content, the multimedia forensics community has developed techniques capable of identifying the specific model used to generate the content. However, these techniques often require access to the model in question or large quantities of images generated by it, two conditions that are frequently unattainable. In this paper, we show that tiny autoencoders can be effectively used as few-shot detectors capable of identifying a generative model using a small number of training images. Moreover, we show how this technique can be easily adapted in time to add new models to the attribution system, enabling its use in an incremental class scenario. Experiments demonstrate that the proposed technique is more effective than existing methods in all tested few-shot scenarios, proving its efficacy in situations where large training datasets are not available.
