Frozen DINO Localizes Image Edits Without a Localizer

2026-08-19

AI Summary

研究使用冻结的DINO编码器通过补丁级别的扰动响应来定位图像编辑，无需专门训练即可实现高精度的AI图像编辑定位。

Abstract

Localized image edits can change a photograph's meaning while leaving most of it authentic, so forensic analysis must identify where an edit occurred. We show that patch-level perturbation responses from frozen DINO encoders are themselves localization maps. Training-free Localization of AI-image Edits from patch-token Drift (TRAIL) applies one global Haar perturbation and maps cosine drift between corresponding patch tokens. On 80 source-disjoint CocoGlide test images, TRAIL reaches .903 patch AUROC versus .912 for the mask-supervised Detective SAM; fixed-threshold Dice is .619 versus .709, while an oracle threshold raises TRAIL to .790. Transferred unchanged to Poisson image interpolation, TRAIL reaches .855 AUROC versus .864, showing that the cue persists without a generator. Across sixteen DINO encoders, the best block lies at normalized depth .80-.94. Global context matters: AUROC falls from .903 globally to .857 for local-in-canvas perturbations and .735 for independently encoded crops. Frozen DINO patch tokens therefore contain a strong late-layer localization signal whose visibility depends on the perturbation and preserved context. Code: https://github.com/VishalJ99/trail-image-edit-localization.

Problem

• Localized image edits
• forensic analysis
• DINO encoders
• patch-level perturbation
• TRAIL

Innovation

• Frozen DINO
• Patch-level Perturbation
• Training-free Localization
• Cosine Drift
• Global Haar Perturbation