Multi-domain Analysis and Generalization of Image manipulation loCalization

We thank the reviewer for spending the time on this paper and giving us feedback, please see our replies below.

Lack of high-quality examples of manipulated images and corresponding GT segmentation mask (Fig. 2 presents low-resolution images)

The quality of the proposed dataset is a concern (Tab. 6) since some methods are just around 50%)

Thank you for your feedback. Our dataset is indeed mixed in terms of the quality of the manipulations images due to limitations of these manipulation methods. However, our goal is not to produce high-quality manipulations, but rather to understand how detection methods perform across various axes of generalization including manipulation type and different image domains. Thus, a low quality manipulation that goes unnoticed by a detector is also a concern. For example, consider the impact low-quality manipulations would have on moderation efforts in a form. Since they are easy to identify, they would likely get flagged by these users rather than flagged by a manipulation detector, which would identify it as authentic. Due to this conflict between the users and automatic detectors, a moderator may be tasked with reviewing the image as well, expending costly resources.

What’s more, in Table 8 our work also highlights that manipulation detectors find low and high quality manipulations equally challenging, with little difference between the two sets. This illustrates an important observation made by our work: human judgements and machine detectors do not use similar evidence to identify manipulations. This is to be expected to some degree, as automatic metrics judging image manipulation and generation quality are challenging to construct, making human judgements the gold standard for those tasks. Thus, we show the quality of the manipulations has little to do with the goal of our work: creating high quality manipulation detection methods that generalize across a range of distribution shifts.

Instead of just listing some numbers only, the visual charts should be used to summarize the statistics of datasets (e.g., editing areas statistics

We are preparing these visualizations and will update you once they are included in the paper.

A table of Editing technique summarization would also help, including the number of images, and examples.

Below is a table with the summarized numbers of images per technique, we refer to Figure 3 for a more detailed breakdown of the number of images for Magic-COCO and Magic-News based on manipulation type. We added it to the Appendix in Table 10. For illustrative examples for the same, please see Figure 2.

How to make sure the quality of the generated masks for MAGIC-News (since they are generated automatically from Mask2Former)

For our human evaluation because we have included Magic-News, this was a way for us to check how the manipulated objects looked overall, as we can see from question 1 and question 3, Magic-News which had generated masks performed around the same as Magic-COCO, which has ground truth segmentation masks. This suggests that there is little difference in the quality of the masks.

For the replacement operation, have you tested different-class replacements instead of same-class replacements

We did not test different-class replacements in order to keep the semantic content of the image unchanged. However based on this feedback we will run a small scale experiment to determine the image it has on the models and once we have finished this experiment we will update this comment

How to ensure the quality of GLIGEN since it is not a perfect method, any mechanism to ensure its quality?

GLIGEN’s ability to use spatially-aligned condition maps provides a unique framework to insert objects into specific locations within an image. Based on our experiments, the model often captures enough semantic and spatial information to create meaningful test cases for evaluating manipulation localization tasks. Specifically, in the human evaluation results we see that GLIGEN does perform similarly to other inpainting techniques like Blended Diffusion for question 3 (Does the object look realistic?) as reported in Table 6 with GLIGEN scoring 48.5 and Blended Diffusion scoring 51.0

How many images are used for training, val, test, and out-of-domain subsets?

We have created a further breakdown of the results for each of the manipulations, this is similar to the information shown in Figure 3.

For the Dataset Quality Survey, using a flowchart to visualize the process would be better.

The survey itself is simply a questionnaire and not a process, an example of which is provided in Figure 6 of our paper.

Lack of reporting IoU (along with AUC)

We have also added the F1 scores to Table 3, partly reproduced below with IoU scores as well, as you suggested. We observed that the F1 and IoU scores are also generally low across both manipulation OOD and image source OOD settings. The observed scores, particularly the low AUC (along with F1 and IoU) values in certain cases, reflect the core focus of our paper: highlighting that current models struggle to generalize across different domains for the problem of image manipulation detection.

Lack of classification performance (decide whether an image is a manipulated image or genuine one)

Following [k,l,m], we focus on the task of manipulation localization, whereas manipulation classification is an entirely different task. That said, since some (but not all) models are designed to accomplish both tasks, we will update our paper with these results as soon as we have them. Once that occurs, we will update you with those results.

[k] Liu, Weihuang, et al. "Explicit visual prompting for low-level structure segmentations." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.

[l] Hao, Jing, et al. "Transforensics: image forgery localization with dense self-attention." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2021.

[m] Zhou, Jizhe, et al. "Pre-training-free image manipulation localization through non-mutually exclusive contrastive learning." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023.

Demonstration of using the proposed datasets would help the performance of detection techniques on other datasets such as MagicBrush [a] and CocoGLIDE [b].

Based on this feedback we have begun testing a subset of our models on these datasets and once we have the results we will update this comment.

Instead of just listing some numbers only, the visual charts should be used to summarize the statistics of datasets (e.g., editing areas statistics

Based on this feedback we have added two other visual charts to make it easier to see more statistics of our dataset based on editing areas and manipulations sizes adapted from the statistics we described in Section 3.2 of our paper.

We have drafted two diagrams to address this comment. The first diagram is located in the Appendix as Figure 7 and it shows manipulation area sizes vs. editing techniques: This chart illustrates the distribution of manipulation area sizes across the three editing techniques: removal, insertion, and replacement. The second diagram is located in the Appendix as Figure 8, it is manipulation area sizes vs. image source: This chart compares the sizes of manipulated areas across the two sources, MAGIC-News and MAGIC-COCO.

Demonstration of using the proposed datasets would help the performance of detection techniques on other datasets such as MagicBrush [a] and CocoGLIDE [b].

We conducted an experiment whereby we trained on MAGIC-News and tested on MagicBrush, reported below. As seen in the table below EVP performs quite well when trained on MAGIC-News and evaluated on Magic-Brush.

For CocoGLIDE, we use the same three models trained on MAGIC-News, making CocoGLIDE images OOD. This is different from, say, the PSCC-Net reported in CocoGLIDE as that model is trained on 380K manipulated and pristine images extracted from COCO, whereas we use less than 100K news images. That said, as shown below, PSCC-Net trained on our dataset reports similar performance as the model reported in CocoGlide. What’s more, the EVP outperforms even the model proposed in the CocoGLIDE paper (TruFor). This helps illustrate the benefits that stem from using our dataset in other settings.

For the replacement operation, have you tested different-class replacements instead of same-class replacements

As we discussed earlier, we did not test different-class replacements in order to keep the semantic content of the image unchanged. However based on this feedback we ran a small scale experiment to determine the impact the image class has on the models. Using 100 images from Magic-News we created images that had new objects replace old objects, for instance we replaced a car with a bike and so on to try and keep the same semantic relevance with the initial object. The same was done with Magic-COCO, and we also included the experiment with replacing the object with the same object like we have done in all our experiments (e.g. replace bike with bike). We can see that overall for both EVP and DOLOS the difference between the replacing the object with a new one, or replacing the object with the same object type has similar scores.

I want to thank the authors for their detailed responses. Most of my concerns regarding the presentation of the paper have been addressed. I hope the authors will include the new experiments and analyses in the revised version. However, I share Reviewer GsP7’s concern about the quality of the manipulated images in the proposed datasets. Despite the authors’ claims about the datasets covering various dimensions, including editing types and diverse domains, the image quality appears to be quite low. Given that these datasets are based on manipulated images generated by diffusion-based editing methods, they should ideally exhibit a level of quality comparable to that of diffusion-generated images. I will increase my score from 5 to 6.

3. In Table 3, it's interesting that the OOD score is higher than the ID score when trained on MAGIC-News and tested on MAGIC-COCO. It's better to provide a more depth analysis.

For the last two columns of Table 3, if we look at the instance of EVP trained on Magic-News and tested on Magic-COCO we can see that MT-ID is 62.1% and MT-OOD is 67.6% for AUC. We have provided a breakdown of the results for each of the inpaintings present for MT-ID and MT-OOD seen below. We see that for MT-OOD, EVP tends to perform well on Stable Diffusion with 69.9% and Blended Latent Diffusion 72.6% AUC versus MT-ID like GLIDE at 64.2% and Latent Diffusion at 67.9%. This suggests that the Stable Diffusion and Blended Latent diffusion images are easier to localize the manipulations when trained on Magic-News and tested on OOD. Because of the latent space that Stable Diffusion is generated from and because Blended Latent Diffusion combines Blended and Latent diffusion together it can help explain why there is a higher performance for these models.

We thank the reviewer for spending the time on this paper and giving us feedback, please see our replies below.

1. The quality of the manipulated images in Figure 2 is worrying, especially for the removing class … Even with a human evaluation, I’m worried about the three categories (removal, replacement, and insertion) under high-quality annotations.

Thank you for your feedback. Our dataset is indeed mixed in terms of the quality of the manipulations images due to limitations of these manipulation methods. However, our goal is not to produce high-quality manipulations, but rather to understand how detection methods perform across various axes of generalization including manipulation type and different image domains. Thus, a low quality manipulation that goes unnoticed by a detector is also a concern. For example, consider the impact low-quality manipulations would have on moderation efforts in a form. Since they are easy to identify, they would likely get flagged by these users rather than flagged by a manipulation detector, which would identify it as authentic. Due to this conflict between the users and automatic detectors, a moderator may be tasked with reviewing the image as well, expending costly resources.

What’s more, in Table 8 our work also highlights that manipulation detectors find low and high quality manipulations equally challenging, with little difference between the two sets. This illustrates an important observation made by our work: human judgements and machine detectors do not use similar evidence to identify manipulations. This is to be expected to some degree, as automatic metrics judging image manipulation and generation quality are challenging to construct, making human judgements the gold standard for those tasks. Thus, we show the quality of the manipulations has little to do with the goal of our work: creating high quality manipulation detection methods that generalize across a range of distribution shifts.

2. The image manipulation methods used in the paper are not very new. Using SD series, like SD2, or even SDXL is better.

We emphasize that our focus in this paper is to broadly evaluate robustness of various image manipulation detection methods. Moreover, most prior datasets do not include any diffusion-based methods at all. That said, we conducted an experiment whereby we inpainted 1000 images from both Magic-News and Magic-COCO using SDXL [j] and tested EVP and DOLOS on these images, additionally we have included the results from our prior experiments from Table 3 with our Stable-Diffusion results. Looking at the results overall we can see that testing on SDXL still showcases the similar problem we are highlighting, that OOD distribution performance on average performs worse than in-distribution performance. In our camera ready we will expand on these initial results.

[j] Podell, Dustin, et al. "Sdxl: Improving latent diffusion models for high-resolution image synthesis." arXiv preprint arXiv:2307.01952 (2023).

We would like to thank you for your review, as a reminder the discussion period is coming to an end. We have responded to your current questions, if you have any other questions or further clarifications to improve our score we would be happy to answer them.

We thank the reviewer for spending the time on this paper and giving us feedback, please see our replies below.

The proposed dataset, while diverse, does not introduce fundamentally new manipulation detection methods or models … The proposed dataset only combines existing datasets and manipulation techniques …Thus, the contribution is more incremental than groundbreaking.

For our proposed dataset our main focus was not to propose a new method for inpainting or new models for detecting inpaintings. But to produce a new diffusion based inpainting benchmark dataset that allows researchers to study generalization across several axes of generalization for image manipulation detection. A major drawback of current image manipulation datasets is that they typically only focus on one axis of generalization, namely manipulation type and do not allow researchers the ability to determine how their models perform under axes like image source as well as manipulation type. In our experiments we highlight a major disadvantage of current models being able to generalize across these different axes as shown in Table 3 and highlight the need for better generalization for these image manipulation detection models

The paper lacks a detailed comparison with other recent datasets or techniques … The experiments only rely on existing architectures without substantial modifications.

In our paper we can see that in Table 1 we compare our model to other current manipulation detection datasets, additionally we discuss these datasets in the Related works section (Section 2). We additionally did provide experiments utilizing two domain generalization techniques namely Model Soups and SWAD and showed that these off the shelf techniques do not significantly improve performance in terms of generalization. We will highlight that this is a benchmark paper designed to highlight issues with existing methods, hence our main focus is not on providing new techniques in this paper. As you can see below [c,d,e], we have a number of papers being published at ICLR that do not propose new methods.

As this is an topic with increasing importance as image maniuplation methods become more sophisticated, our task's importance is likely only to grow. This makes datasets like ours that explore the generalization capabilities of these models and is complementary to existing datasets of vital importance for defending against misinformation such as applications to fighting crime (as defendants may claim an image has been altered by an AI model) and content moderation (where manipulated images may be presented as real). These are high impact applications that are meant to increase safety and security, highlighting their importance for study in our paper.

[c] Wang, Xingyao, et al. "Mint: Evaluating llms in multi-turn interaction with tools and language feedback." ICLR 2024

[d] Gu, Jiuxiang, et al. "ADOPD: A Large-Scale Document Page Decomposition Dataset." ICLR 2024

[e] Wu, Haoning, et al. "Q-bench: A benchmark for general-purpose foundation models on low-level vision." ICLR 2024

We would like to thank you for your review, as a reminder the discussion period is coming to an end. We have responded to your current questions, if you have any further questions or clarifications to improve our score we would be happy to answer them.

For dataset-focused papers, it’s common to include tests with standard vision backbones, such as ResNet or Swin … as a standard baseline.

Many AUC metrics in the tables are too close … Table 3 includes numerous metrics below 0.5, indicating the models have not effectively learned the corresponding distributions. More distinctive metrics such as F1 or IoU, may be needed to assess the model’s performance on each protocol.

We trained a Swin Transformer [g] trained to make pixel-level predictions using the Upernet strategy [h] for manipulation localization to act as a standard baseline. The results are shown below and we have added these results to Table 3. As shown below, most specialized models perform worse than a simple Swin-based model.

We have also added the F1 scores to Table 3, partly reproduced below with IoU scores as well, as you suggested. We observed that the F1 and IoU scores are also generally low across both manipulation OOD and image source OOD settings. The observed scores, particularly the low AUC (along with F1 and IoU) values in certain cases, reflect the core focus of our paper: highlighting that current models struggle to generalize across different domains for the problem of image manipulation detection.

[g] Liu, Ze, et al. "Swin transformer: Hierarchical vision transformer using shifted windows." Proceedings of the IEEE/CVF international conference on computer vision. 2021.

[h] Xiao, Tete, et al. "Unified perceptual parsing for scene understanding." Proceedings of the European conference on computer vision (ECCV). 2018.

We thank the reviewer for spending the time on this paper and giving us feedback, please see our replies below.

Although the authors claim to have used clustering for categorizing topics, some topics displayed in Figure 2 seem to vary significantly and do not appear entirely reasonable. For instance, it’s unclear how a bicycle image relates to the "ARTS" category, and both "People" and "Ruins" are grouped under "Media."

The grouping of the images is not based on image content, but rather the article content. Thus, a bicycle could fall under arts due to an event with bicycles, or even simply a photography competition. In addition, these categories are broad, and contain many subcategories (i.e., the original VisualNews dataset had 159 subcategories that represent distinct subsets of our 8 categories).

The results across many topic classes in Table 4 are quite similar, suggesting that the distribution between classes may not be as distinct as initially anticipated There is nearly a 7 point difference between the best and worst performing topic within Table 4. While this is not as large as some other shifts, it still provides a significant difference to compare various models.

A paper [A] proposed in Nov. 2023 on ArXiv and accepted by ACM MM 2024 also uses Visual News and COCO to create a fine-grained diffusion and GAN-generated dataset … it is recommended to reconsider the claim “"first diffusion-based manipulation dataset." on line 149.

Thank you for pointing out this paper and we have adjusted our associated discussions. We are unable to add the information to Table 1 at this time as many of the detailed statistics that breaks down the type of manipulation are not reported and we could not get access to the dataset in time for this response (although we have requested access and will include this information in our paper once we have been granted access). To summarize our comparisons, our dataset has many complementary benefits, as there is little overlap in the type of manipulation techniques utilized between our datasets. In addition, we focus on the impact of several axes of generalization that [A] did not study, including studying distribution shifts due to image statistics or topics. We also study the effect of manipulation quality on detection performance, whereas [A] did not consider this component. As such, our paper provides several notable contributions over even concurrent work like [A].

Since [A] retains the text prompts associated with images, which, with proper handling, could serve as a more accurate basis for topic categorization.

As we noted earlier, our topics are based on article content as opposed to image content. As these prompts are associated with image content, they are more akin to COCO captions, which our dataset also has access to (for the COCO subset). We also argue that comparing VisualNews vs. COCO images already provides an example of changes due to image content.