DETER: Detecting Edited Regions for Deterring Generative Manipulations

Q1: The size of the dataset is not large, which I am afraid cannot be termed as 'large-scale'.

A1: As shown in Table 1, our dataset contains significantly more fake images (300,000) than existing datasets, such as DFFD (3,000), OpenForensics (115,325), and DGM (152,574), even though OpenForensics is claimed to be a large-scale dataset (the title of the work is "OpenForensics: Large-Scale Challenging Dataset For Multi-Face Forgery Detection And Segmentation In-The-Wild"). Thus, we believe it is justifiable to claim that our dataset is in fact large-scale in the domain of regional fake image detection.

---

Q2: In section 4.2, method DINO (Zhang et al., 2023) is published in 2023, in Table 4, it is referred to as DINO 22'.

A2: Thank you for pointing this out. We will correct it to DINO 23' to keep consistent following the suggestion.

---

Q3: In Table 4, the methods are relatively not up-to-date.

A3: We selected a range of classic and representative methods for regional detection and segmentation, as shown in Table 4, which are widely used in both academia and industry. However, despite the significant performance differences across these methods on the classic detection dataset COCO, their performance on our dataset is relatively minor. Therefore, there is no urgent need to use some up-to-date methods.

---

Q4: Grammar errors and long sentences.

A4: Thank you for the careful reading and suggestions. We will correct the grammar and shorten the mentioned sentences accordingly.

Q1: (a) There is no clear discussion of whether they have rights to modify/redistribute CelebA and WiderFace images. For example, the CelebA dataset has the following agreement: “You agree not to further copy, publish or distribute any portion of the CelebA dataset. Except, for internal use at a single site within the same organization it is allowed to make copies of the dataset.” (b) And there is no discussion of consent from individuals in the images. (c) And there is no discussion of rights clearance for redistributing modified faces.

A1: Thank you for raising these important points regarding licensing. The WiderFace dataset is distributed under a Creative Commons (CC) license, as mentioned in Lines 210 and 530 of our paper. According to the terms of the CC license, the dataset can be reproduced and distributed for non-commercial and research purposes, which aligns with the goals of our work.

For the CelebA dataset, as carefully pointed out by the reviewer, we acknowledge that this statement precludes redistribution. To address this concern, we propose a solution that ensures compliance with the dataset's terms. Specifically, instead of redistributing the original images, we will provide only the masks and our construction and evaluation scripts. This approach allows researchers to reproduce our work using the CelebA dataset under their own institutional access while adhering to the licensing agreement. We believe this solution balances open science and legal compliance. If you have any other suggestions, please let us know, we want to make sure we do the right thing here.

While the CelebA and WiderFace datasets are publicly available and widely used in academic research, we acknowledge that they do not explicitly address consent from individuals depicted in the images. Our work strictly adheres to the datasets' licensing terms and is conducted solely for academic purposes. Additionally, we plan to distribute only masks and construction scripts, not the original images, to minimize ethical concerns while ensuring reproducibility.and we appreciate the reviewer’s input as part of this broader conversation in the research community.

Our work will follow the standard Creative Commons license for non-commercial research use, which we will further clarify in the paper and upon the release.

---

Q2: How do you ensure the dataset remains relevant as new generative models emerge?

A2:

Our dataset construction pipeline is designed to be flexible and adaptable, making it straightforward to incorporate newer generative models as they emerge. If more powerful models become available, they can be easily integrated into the pipeline to enhance the dataset’s diversity and utility.

We will release the construction code as part of our work. We appreciate this valuable feedback and agree on the importance of keeping updated with advancements in generative modeling. As part of our maintenance plan, we will regularly update the testing set to reflect emerging methods, encouraging the generalizability of detection models trained on DETER against more diverse generators.

---

Q3: How does the post-processing pipeline affect the natural artifacts that might help in detection?

A3: The post-processing pipeline employs computer graphics techniques such as color matching, Poisson blending, and image sharpening to harmonize the colors between the generated region and the original image. It also smooths the boundary where the generated region meets the original image, thereby reducing visible artifacts that can be detected by the detection model.

---

Q4: Why not include more diverse manipulation techniques beyond facial modifications?

A4: Thank you for your question. In this work, we focus on datasets involving human faces because the manipulation of human images, particularly faces, poses some of the most harmful and urgent societal implications. By targeting this critical area, we aim to address one of the most pressing challenges in the realm of generative model misuse and detection.

However, our proposed construction method has strong generalization capability and can be readily applied to other scenarios, such as natural scenes or animals. As described in Section 3.2, our dataset construction pipeline includes pre-processing, regional editing, and post-rendering, all of which are adaptable to different contexts. For instance, pre-processing can involve specifying regions to be edited, either manually or using segmentation methods like SAM. Regional editing can be performed using generative models tailored to specific scenes, and the post-processing step is not constrained by the input's nature.

To support broader use cases, we will release our construction code, enabling the research community to extend the approach to manipulation techniques beyond human faces.

---

Other ethical concerns: Please refer to our A1 for detailed responses.

Q1: In the user study, it is a bad idea to include "I'm not sure" as an option, which will greatly harm the data quality and amount of information. Instead, binary selections can still be enforced, and you can ask participants to indicate their confidence scores. The same is true for GPT-4.

A1: Thank you for this suggestion. When a user is unable to determine the authenticity of an image, it indicates that the image is either genuinely real or very close to appearing real. Forcing a binary “yes or no” decision in such cases could introduce noise into the evaluation, and including an "I'm not sure" option allows us to capture this ambiguity, which is valuable for understanding the limitations of human perception in distinguishing real from fake images.

Typical instantiations of Likert scale ratings often include an odd number of options, with the middle one representing neutrality, such as “neither agree nor disagree.” In our case, this middle option corresponds to “both images look similarly real,” which aligns with our evaluation objectives.

---

Q2: The dataset only includes edited images from four different models, which might be insufficient for a comprehensive dataset, especially considering the current flourishing development of generative AI technologies.

A2: Thank you for raising this important point. We address your concern from two perspectives:

Selection of generative methods: While there is indeed a flourishing development of generative AI technologies, not all models are designed to generate highly realistic human images, which is the focus of our dataset for deepfake detection modeling community. Our goal is to select models that best support the construction of a high-quality dataset for this specific task. We experimented with multiple (more than 20) methods during development, partially illustrated in Figure 3 of the main text, and chose the ones that performed most effectively in producing realistic and diverse human faces, and which would thus pose the most challenge for deepfake detection..

Flexibility of construction pipeline: Our dataset construction pipeline is designed to be flexible and adaptable, making it straightforward to incorporate newer generative models as they emerge. If more powerful models become available, they can be easily integrated into the pipeline to enhance the dataset’s diversity and utility.

Additionally, we will release the construction code as part of our work. We appreciate this valuable feedback and agree on the importance of keeping updated with advancements in generative modeling. As part of our maintenance plan, we intend to regularly update the testing set to reflect emerging methods, encouraging the generalizability of detection models trained on DETER against more diverse generators.

---

Q3: The claims of difficulty of predicting regions edited by GANs over Diffusion Models are not well supported.

A3: As we wrote in the Line 511-513: “We observe that detection models trained with the GANs-based generators can generalize well to the DMs-based testing images, while the inverse setting induces a non-trivial performance drop”. Supported with the experimental results in Table 6 (right), where the model trained with GAN-based generators achieved an AP of 0.87 on GAN-based and 0.88 on DM-based test images, while the model trained with DM-based generators achieved an AP of 0.71 on GAN-based and 0.89 on DM-based test images, respectively. This is an empirical yet valid observation under the current task scenario, and we do not believe it constitutes an overclaim or misconception.

Since this work is positioned as a dataset and benchmark paper, we believe this finding could be of interest to readers in its current context. While a deeper investigation into this particular research question from a broader or theoretical perspective would indeed be valuable, we consider it to be beyond the scope of this work.

Q1: In the first paragraph, the authors wrote “the upstream SOTA generative models and their applications, the midstream existing deep fake datasets, as well as the downstream fake detection formulation and models”. I am just curious why the authors define “upstream, midstream, downstream” this way.

A1: Thank you for the question. Our categorization is based on the intuitive flow of the research pipeline in this domain. This structure reflects the natural progression in the pipeline: generative models produce synthetic content (upstream), datasets organize and standardize this content (midstream), and detection models apply this data to tackle real-world challenges (downstream). We hope this clarifies the rationale behind our terminology.

---

Q2: The authors consider datasets that include humans in this work, and target human face (either the whole face or part of it) manipulation. What about other datasets of natural scenes, animals, etc.? Can the proposed method be applied there as well?

A2: Yes, our proposed construction method has strong generalization ability and can also be applied to other scenarios, such as natural scenes or animals. The dataset construction pipeline described in Section 3.2 includes pre-processing, regional editing, and post-rendering, all of which are adaptable to different contexts. In pre-processing, the regions to be edited are specified, which can be done manually or through segmentation methods like SAM. Regional editing can be performed using a generative model suitable for the specific type of scene, and the post-processing step is not constrained by the nature of the input.

That said, we focus on datasets involving human faces in this work because the manipulation of human images, particularly faces, often has the most harmful and urgent societal implications. By targeting this critical area, we aim to address one of the most pressing challenges in the realm of generative model misuse and detection.