Spectral Forensics of Diffusion Attention Graphs for Copy-Move Forgery Detection

Abstract: Copy-move forgery, where a region within an image is duplicated to hide or fabricate content, remains a persistent threat to visual media integrity. We introduce GraphSpecForge, a training-free framework that detects copy-move forgery by analysing the spectral structure of attention graphs from a pretrained Stable Diffusion U-Net. Our central insight is that copy-move manipulation induces approximate subgraph duplication in the self-attention graph, leading to measurable spectral redistribution in the normalized graph Laplacian. We formalise this link with perturbation-based arguments and build an image-level anomaly detector using Wasserstein distances between per-image Laplacian spectra and an authentic reference distribution. We evaluate GraphSpecForge on four copy-move benchmarks without forgery-specific retraining. On RecodAI-LUC (5,128 images), our best configuration achieves AUROC = 0.606 (95% CI: 0.580-0.638; permutation p = 0.005), and the normalized Laplacian outperforms raw attention spectra by +0.057 AUROC. On MICC-F220, CoMoFoD, and COVERAGE, the same pipeline attains AUROCs of 0.752, 0.774, and 0.673, respectively; on CoMoFoD it also reaches AUPRC = 0.833, balanced accuracy = 0.712, MCC = 0.499, and TPR@1%FPR = 32.5%. Additional ablation and falsification experiments confirm the signal's specificity and sensitivity to manipulation strength, while null-graph controls rule out trivial-statistic explanations.

• The paper introduces GraphSpecForge, a training-free framework that detects copy-move forgeries by analyzing spectral properties of self-attention graphs from Stable Diffusion U-Nets.
• It formalizes forgery as approximate subgraph duplication that perturbs the normalized Laplacian’s eigenvalue distribution, enabling robust spectral anomaly detection.
• Experimental results demonstrate statistically significant, generalizable detection across multiple benchmarks, highlighting both the strengths and limitations of the approach.

Spectral Analysis of Diffusion Attention Graphs for Copy-Move Forgery Detection

Introduction and Motivation

Copy-move forgery (CMF) is a pervasive manipulation technique where an image region is duplicated elsewhere in the same image. Traditional CMF detectors generally rely on hand-crafted features, block matching, or, more recently, deep-learning-based feature extraction. However, these methods tend to be task-specific, require dedicated training on manipulation labels, and frequently struggle to generalize across diverse forgery artifacts.

The work "Spectral Forensics of Diffusion Attention Graphs for Copy-Move Forgery Detection" (2604.17287) introduces a fundamentally distinct approach. Rather than training explicit classifiers or using pretrained diffusion models only as generic feature extractors, the authors propose GraphSpecForge, a training-free framework that detects copy-move forgeries by examining spectral properties of self-attention graphs induced by pretrained Stable Diffusion U-Nets. The method leverages perturbation theory to formalize the effect of forgery as an approximate subgraph duplication in the attention affinity graph, which is detectable via characteristic redistribution in the normalized graph Laplacian's spectrum.

Theoretical Framework: Subgraph Duplication in Attention Graphs

Self-Attention Graphs and Laplacian Spectra

Each self-attention map output by the diffusion U-Net's transformer layers can be viewed as a weighted affinity graph over spatial tokens. Symmetrization yields an undirected graph whose structure is analyzed through its normalized Laplacian, $L = I - D^{-1/2} \bar{A} D^{-1/2}$, where $D$ is the degree matrix and $\bar{A}$ the thresholded, symmetrized attention.

Hypothesis and Formalization

The central theoretical claim is that copy-move duplication introduces approximate duplicated subgraphs in the attention affinity graph, perturbing the normalized Laplacian. Drawing on classical results like Weyl's eigenvalue interlacing and the Hoffman–Wielandt inequality, the authors argue that this form of perturbation systematically compresses spacings among Laplacian eigenvalues and redistributes spectral mass—detectable in aggregate via transport distances (Wasserstein-$1$) between empirical spectral distributions (ESDs) of authentics and forgeries.

Figure 1: Illustrative diagram of the duplicated-subgraph hypothesis showing how copy-move forgeries induce approximate subgraph duplication, perturbing the Laplacian spectrum.

Critically, the authors demonstrate that degree normalization in the Laplacian removes confounds due to overall attention magnitude (unrelated to spatial structure), which is why the Laplacian's spectrum consistently outperforms analysis directly on raw attention eigenvalues.

Methodology: GraphSpecForge Pipeline

Pipeline Structure

GraphSpecForge comprises the following stages:

1. Attention Extraction: A single denoising forward pass of the target image through Stable Diffusion v1.5 captures 16 layers of self-attention matrices at spatial resolutions spanning from $64\times64$ to $8\times8$.
2. Graph Construction: For each layer, the raw affinity matrix is symmetrized and clipped to non-negativity, yielding a consistent undirected token graph.
3. Spectral Analysis: Both raw and normalized Laplacian eigenspectra are computed. A rich feature vector is derived from each, comprising Wasserstein-$1$ transport to a reference authentic ESD, filter-bank descriptors, duplication mass, band-pass energy, and non-spectral graph statistics for specificity control.

Figure 2: Overview of the GraphSpecForge pipeline, from attention extraction to spectral scoring and decision.

Layer Fusion and Expert Layer Selection

A critical empirical finding is that not all attention layers contribute equally to detection. The authors develop a "Forgery Spectral Expert Layer" (FSEL) selection scheme: layers are scored by their distributional separability, causal sensitivity (how much AUROC drops when leading eigenmodes are ablated), localization capacity, and score stability. Top-$k$ layers are fused using softmax-reweighted anomaly scores, with weights calibrated on authentic-only references.

Figure 3: Detailed view of spectral feature extraction and the FSEL fusion process, highlighting parallel processing of raw and Laplacian spectra and the feature groups used for scoring.

Detection Decision

Each image's anomaly score is computed by comparing its layerwise feature vectors to a reference ESD and robust summary statistics, all of which are established using only authentic (unmanipulated) images. No forgery labels are used at any stage—making the process formally training-free.

Experimental Results

Datasets and Evaluation Protocols

Evaluation spans four public CMF benchmarks: the large-scale RecodAI-LUC (5,128 images), MICC-F220, CoMoFoD, and COVERAGE. The protocol is strictly anomaly-based: all calibration, thresholding, and reference construction use authentic images only.

Figure 4: Sample authentic and forged copy-move images from RecodAI-LUC, illustrating the subtlety of manipulated regions.

Main Quantitative Results

On the challenging RecodAI-LUC set, the strongest configuration (normalized Laplacian spectrum, FSEL-based top-$k$ fusion, robust $z$-score normalization) achieves AUROC 0.606 (95% CI: 0.580–0.638, $D$0), with consistent improvement over raw attention spectrum (+0.057 AUROC). Numerical claims are sober: the detection signal is statistically significant but operationally moderate; balanced accuracy, MCC, and low-FPR TPRs further illustrate this.

Conversely, cross-dataset validation demonstrates clear generalization: GraphSpecForge yields AUROC 0.752 (MICC-F220), 0.774 (CoMoFoD), and 0.673 (COVERAGE), with CoMoFoD achieving AUPRC 0.833 and TPR@1%FPR of 32.5%. In all scenarios, the spectral mechanism's discriminatory signal is portable across varying CMF scenarios, dataset scales, and curation styles.

Figure 5: ROC curve for GraphSpecForge's final detector on RecodAI-LUC (AUROC = 0.606).

Qualitative and Case Study Analysis

A granular, image-pair case study demonstrates that, for visually near-indistinguishable authentic/forged examples, their per-layer Laplacian spectral densities differ in line with theoretical expectations: forgeries have flatter ESDs with more mass in outlying eigenvalue bands. Critically, this effect persists even when local duplication-mass features alone do not carry the signal.

Figure 6: Example authentic/forged pair with their Laplacian ESDs; the forgery spectrum shows characteristic flattening.

Specificity, Falsification, and Robustness Analysis

A comprehensive falsification suite rules out trivial explanations:

• Block and edge-weight shuffling controls preserve AUROC, indicating the anomaly is a property of the global eigenvalue distribution rather than localization or ordering.
• Label shuffling collapses detection to chance, confirming the signal is data-driven.
• Non-copy-move manipulations (blurring, splicing, JPEG, inpainting) yield systematically lower anomaly scores, highlighting specificity.
• Synthetic manipulations with parameter sweeps show monotonically rising AUROC as copy-move strength increases, matching theoretical bounds.

Figure 7: Falsification and specificity experiments, showing response to natural self-similarity, non-copy-move negatives, null-graph controls, and severity-sweep stress tests.

Layerwise and Feature Ablations

Decoder-side attention layers (notably up_blocks.2 and up_blocks.3) consistently dominate anomaly separability. Feature ablations reveal Wasserstein-$D$1 distance to the reference ESD embodies most of the usable signal; more complex duplication-specific or high-order descriptors contribute marginally. Adding non-spectral graph controls and spectral filter-bank features provides modest benefit only in the highest-noise regimes.

Additionally, robustness tests show that the detector's performance is stable across substantial variation in attention map size and resolution, supporting the claim that the spectral mechanism measures a nontrivial, portable property.

Discussion and Implications

Theoretical and Practical Impact

The presented approach bridges classical spectral graph theory and vision transformer-style self-attention analysis to create a new paradigm for forensics: spectral anomaly detection in pretrained diffusion model graphs. Unlike supervised CMF detectors, this framework is unsupervised and requires no synthetic forgeries or task-specific data—any authentic-only collection suffices for calibration. This property is particularly attractive for deployment scenarios or as a forensic filter in unstructured data environments.

Importantly, while the detection rates fall short of the highest-performing supervised literature (which regularly achieves AUROCs >0.9; see e.g., BusterNet, DOA-GAN), the method's portability, statistical grounding, and generalization across datasets distinguish its contribution. It also highlights the crucial role of token connectivity structure (rather than raw attention magnitude) in exposing duplicity, advocating for further adoption of graph-spectral diagnostics in deep generative model forensics.

Limitations and Future Work

• Detection Strength: The spectral signal, while real and reproducible, is modest in magnitude, especially for large-scale, in-the-wild benchmarks.
• Localization: The method operates on global layer-level summaries; pixelwise forgery localization is not accessible through this pipeline.
• Model Family: All experiments are conducted with Stable Diffusion v1.5; generality to SDXL or alternative generative backbones remains to be confirmed.
• Theory-Practice Gap: While the paper provides qualitative bounds on manipulation-induced spectral shifts, a quantitative, closed-form relationship between region duplication and minimum achievable AUROC remains an open theoretical challenge.

Future directions include combining spectral scores with supervised detectors; extending the framework to other manipulation types beyond copy-move; employing scalable spectral approximation schemes for efficient inference; and formalizing theoretical detection limits for general graph-perturbation classes.

Conclusion

This work establishes spectral perturbation analysis of diffusion model attention graphs as a viable, robust approach to training-free copy-move forgery detection. Although the method's absolute accuracy does not rival that of dedicated, supervised CMF architectures, its theoretical grounding, portability across manipulation styles and datasets, statistical significance, and forensic specificity support its adoption as a complementary unsupervised component in multimedia authenticity pipelines. The open-source GraphSpecForge framework provides a foundation for exploring richer spectral, causal, and multi-modal forensics paradigms built atop the representational layers of large generative models.