{"id":"510a0179-ef70-4214-b5c8-c4dc6fdec8b3","arxiv_id":"2504.13759","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A hidden ICAO logo embedded by deep steganography degrades characteristically under image manipulation, allowing a ResNet-50 classifier to identify the type of tampering applied to certified facial images.","lead":"Deep steganography models can hide a known logo inside passport-style face photos, and any later edit to the photo degrades the recovered logo in ways a classifier can identify. The paper tests this as a fragile watermark for certifying ICAO-compliant identity images and reports high manipulation-type classification accuracy.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Morphing is tested only after embedding (Sec. IV-C), but real morphing attacks occur before enrollment; when the marker is embedded into an already-morphed face, the recovered logo stays clean and the proposed cue cannot detect the attack.","rationale":"The reader's weakest assumption identifies the same load-bearing concern that I find: the morphing experiments apply the attack after embedding, while the real-world morphing attack precedes enrollment. This is not an internal inconsistency in the reported measurements, but it is a direct mismatch with the paper's motivating application. If the marker is embedded into an already-morphed image, the recovered logo is clean and the proposed classifier has no morphing artifact to detect. The paper's own limitation statement in Section III concedes that a missing or mismatched marker is out of scope, and a pre-enrollment morph is precisely such a case. I considered the re-embedding attack as an alternative concern, since public models and a public marker allow an attacker to strip and re-embed a clean marker after any modification. However, re-embedding replaces the stego-image rather than applying a transformation to it, so it is less directly tied to the paper's central fragility claim. The pre-enrollment morphing timeline is the more immediate threat to the stated biometric application. The reader's conditional verdict already reflects this concern, so no change in verdict is needed; the paper remains a feasible post-embedding manipulation-classification study but not a validated certification mechanism for morphing attacks.","tokens_in":11479,"tokens_out":5949,"duration_ms":60012,"concrete_test":"Take two CFD identities, generate a morphed face M with FaceMorpher at alpha_M=0.9, then embed the ICAO marker into M using the paper's Steguz and Stegformer models (E(M, Is)). Decode D(E(M, Is)) and compare the recovered marker to the clean marker Is with SSIM/PSNR, and feed the decoded image into the trained ResNet-50 classifier (or a binary tamper detector). If the recovered marker stays near-identical (e.g., SSIM > 0.92, as in Table II) and the classifier does not assign it to the morphing class, the pre-enrollment threat is undetected and the paper's morphing conclusions do not transfer.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Section IV-C, morphing is applied to the already-certified stego-image: Eq. (2) applies T (FaceMorpher at alpha_M=0.9) to Istego, so the marker was embedded before the attack. The standard ePassport morphing attack instead creates the morph before enrollment; the authority then embeds the marker into an already-morphed face. In that timeline the morph is part of the cover image, and the decoder recovers the same clean ICAO logo as from an un-morphed certified image. No morphing artifact appears in the revealed marker, so the proposed fragile cue and the trained classifier cannot detect the attack. The paper's own Section III limitation states that the system assumes the marker is present and matches the expected reference, and that a separate detection stage is out of scope; a pre-enrollment morph produces exactly this undetectable case. Therefore the headline 'morphing attack detection' claim is unsupported for the standard attack model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a fragile watermarking framework for ICAO-compliant facial images, where a known marker (the ICAO logo) is embedded using deep steganographic models (Steguz and Stegformer). Any post-issuance modification of the stego-image is hypothesized to degrade the recovered marker, and the degradation pattern is used both as a tamper-detection cue and as input to a ResNet-50 classifier that categorizes the manipulation type (compression, resize, blur, Gaussian noise, salt-and-pepper noise, sharpening, morphing). The authors report high intra-stega classification accuracy (≥99.95%), a substantial drop in cross-stega scenarios (~25%), and define SSIM/PSNR thresholds for flagging manipulated images. The central claim is that this approach detects and categorizes post-issuance manipulations, including morphing attacks.","tokens_in":11689,"tokens_out":2843,"duration_ms":28372,"significance":"If the central claim held, the paper would be a useful feasibility study showing that off-the-shelf deep steganographic embedding can serve as a fragile watermark for biometric document certification, with the added benefit of manipulation-type classification. The experimental design has notable strengths: a held-out identity split that avoids identity-level overfitting, two diverse steganographic architectures, systematic parameter sweeps for most manipulations, and cross-stega generalization tests. The paper is also commendably explicit about its scope limitations in Section III. However, the morphing threat model is mismatched with the standard ePassport morphing attack, and the detection component (as opposed to classification among known manipulations) is not actually evaluated with a pristine class or false-alarm analysis. These issues bear directly on the headline claims, so the current evidence does not support the paper's stated conclusions for morphing detection.","major_comments":[{"comment":"The morphing experiments apply FaceMorpher to the already-certified stego-image Istego, i.e., after embedding. In the standard ePassport morphing attack, the morph is created before enrollment and the authority embeds the marker into an already-morphed face; in that timeline the morph is part of the cover image and the decoder recovers the same clean ICAO logo as from an un-morphed image, so the proposed fragile cue and the classifier cannot detect the attack. This is not a minor detail: the abstract and Introduction explicitly cite morphing as a key threat, and Section III's own limitation statement admits that a missing or mismatched marker requires a separate detection stage that is out of scope. Therefore the paper's claim of morphing-attack detection is unsupported for the standard attack model; the authors should either test pre-issuance morphing (embedding into an already-morphed image) or narrow the claimed contribution to post-issuance modifications.","section":"Section IV-C, Eq. (2)"},{"comment":"The operational thresholds (SSIM < 0.75, PSNR < 22 dB) are read off the unaltered certified samples used in the same evaluation, and the classifier is trained and tested on seven manipulation classes with no pristine 'no manipulation' class. As a result, the paper demonstrates classification among pre-known manipulation categories but does not provide evidence of binary tamper detection (e.g., false-alarm rate on unaltered stego-images, ROC analysis, or threshold tuning on a validation split). This is load-bearing because the proposed mechanism is described as an integrity-verification tool that detects 'any modification'; without a false-alarm analysis and an unaltered test class, the detection claim is not supported.","section":"Section V-A and Section IV-E"},{"comment":"The morphing class is evaluated at a single blending factor α_M = 0.9, and the classifier is never tested on other morphing strengths or on morphing algorithms other than FaceMorpher. Since the morphing cue is the paper's headline forensic signal, the lack of any generalization test for this manipulation class leaves the robustness claim for morphing detection essentially unexamined. A minimal addition would be a second morphing tool or a sweep over α_M values, with the classifier trained on held-out identities and unseen morphing parameters.","section":"Section IV-C, Table I"}],"minor_comments":[{"comment":"The paper title promises 'Image Certification' but the method assumes the marker is already present and matching; the authors should consider adding 'Post-Issuance' or 'Post-Embedding' to the title or abstract to align with the actual scope.","section":"General / Title"},{"comment":"The row label 'Certifyng' is misspelled; it should be 'Certifying'.","section":"Section V-A, Table II"},{"comment":"The caption says 'salt & paper noise' but the correct term is 'salt-and-pepper noise' (also in Figure 4).","section":"Figure 3 caption"},{"comment":"The sentence 'The first one, called P8-8, involves training and testing on the same eight variations of each manipulation type (e.g., levels of noise or compression)' has a double comma and should be rephrased for clarity.","section":"Section IV-E"},{"comment":"The conclusions section contains an exact duplicate sentence: 'To our knowledge, this is the first study to assess the use of standard deep steganographic models for this purpose in the context of biometric documents.' and 'To our knowledge, this is the first study to assess the use of standard deep steganographic models for this purpose in the context of document integrity.' The duplicate should be removed.","section":"Section VI"},{"comment":"The claim that 'any modification to the stego-image ... inevitably affects the extracted content' is stated as a certainty, but the paper provides only empirical evidence for the tested manipulations; a softer phrasing such as 'is expected to affect' would be more accurate.","section":"Section III"}],"recommendation":"major_revision","confidential_remarks":"The paper's Section III limitation directly undercuts the abstract's morphing claim; the editor may wish to emphasize to the authors that a pre-issuance morphing experiment or a substantially narrowed claim is required. The paper otherwise has a sound empirical core for post-embedding modifications."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look if you work on biometric document security. The paper is upfront that it is not proposing new steganography; it repurposes Stegformer and SteGuz as fragile watermarks and adds a ResNet-50 classifier that labels the manipulation type from artifacts in the recovered ICAO marker. That application framing is the new part, and it is done cleanly: identity-disjoint train/test splits, two embedding models, several manipulations at multiple strengths, and cross-stega protocols with unseen strengths. The in-distribution numbers (99.95%+ accuracy) are believable as a feasibility result, not as a deployed security claim.\n\nThe load-bearing soft spot is the morphing threat model. Eq. (2) applies morphing to the already-certified stego-image; Section III also says the system assumes the marker is present and matching. The standard ePassport morphing attack happens before enrollment, so the marker would be embedded into a morphed face and the recovered logo would look clean. The paper's morphing detection claim therefore does not cover the attack it cites as motivating. That is not a small caveat; it narrows the contribution to post-issuance tampering and degradation detection.\n\nTwo more weaknesses, both fixable. There is no pristine/no-tamper class and no ROC or false-alarm analysis; the SSIM<0.75 and PSNR<22 dB thresholds are read off the same unaltered samples, so we don't know the actual false-positive cost. And because the embedding models are public and the marker is the ICAO logo, an attacker can re-embed the same marker into a tampered face; secret-key embedding or per-document markers would be needed. The mild circularity noted in the report is real but minor — the central classification claim is tested on held-out identities.\n\nThe citation pattern is reasonable; self-citations are relevant and not inflated. The duplicated \"first study\" sentence in the conclusion is sloppy but trivial.\n\nThis is a solid feasibility study with an honest scope except for the morphing framing. I'd send it to a serious referee: the experiments are reproducible enough to check, the negative result on cross-stega is interesting, and the threat-model gap is a substantial but addressable revision. I would not cite it yet as evidence for morphing detection.","headline":"Honest feasibility study showing deep stego embedding can leave classifiable artifacts in recovered markers, but the morphing test only covers post-issuance tampering, not the real pre-enrollment attack.","tokens_in":12225,"tokens_out":2606,"would_cite":false,"duration_ms":24537,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A hidden logo inside a certified passport photo makes any modification visible and lets a classifier identify the manipulation type.","keywords":["fragile watermarking","deep steganography","image certification","morphing attack detection","biometric document integrity","manipulation classification","ICAO-compliant facial images"],"falsifier":"Create a morphed face first, then embed the ICAO logo into the already-morphed image and decode it; if the recovered marker is clean and the classifier reports no manipulation, the morphing cue is specific to post-issuance attacks rather than the canonical pre-issuance morphing scenario.","tokens_in":11306,"feed_emoji":"🛂","tokens_out":6047,"duration_ms":49854,"temperature":0.7,"pith_summary":"The paper proposes certifying ICAO-compliant facial images by hiding a small known image—the ICAO logo—inside the photo with a deep steganographic encoder at issuance. At verification a decoder recovers the marker; an untouched photo yields a clean marker, while compression, resizing, blur, sharpening, noise, or morphing leaves systematic artifacts in the recovered logo. The authors show these artifacts are measurable and visually consistent across two different steganographic models, and that a ResNet-50 classifier trained on the recovered marker can identify the manipulation type with accuracy above 99.9% in the same-embedding protocols and around 72–81% when training and test use different embedding models. If correct, official identity photos could carry a proactive integrity check that both detects post-issuance tampering and names the kind of alteration applied.","feed_headline":"A hidden logo exposes how a passport photo was altered","feed_subtitle":"Deep steganographic embedding makes any edit to a certified face image visible, and a classifier names the manipulation type.","key_machinery":"The central object is the recovered hidden marker, the decoded secret image obtained as $D(T(E(I_C, I_S)))$, where $E$ is the steganographic embedding of the ICAO logo $I_S$ into the face photo $I_C$, $T$ is a post-issuance transformation, and $D$ is the steganographic decoder. The argument is carried by the deliberate fragility of these deep decoders, which are trained to reconstruct the secret only when the cover is essentially unchanged, so any transformation of the stego-image injects manipulation-specific artifacts into the revealed logo. The second mechanism is the classification pairing: ResNet-50 features of the recovered marker, followed by dimensionality reduction, ReLU, dropout, and a final linear layer, map those artifacts to one of seven manipulation classes, with protocols that vary whether training and test use the same embedding model and whether all or only some manipulation strengths are seen in training.","core_discovery":"The central claim is that standard deep steganographic embedding, repurposed as a fragile watermark, makes any post-issuance modification of a certified facial image visible in the recovered hidden marker, and that the degradation pattern is systematic enough to classify the manipulation. Using Stegformer and SteGuz to embed a 224×224 ICAO logo into each face keeps both the certified photo and the recovered marker high-fidelity, with SSIM above 0.92 in both stages. JPEG and WebP compression, resizing, Gaussian and salt-and-pepper noise, Gaussian and median blur, sharpening, and morphing each degrade the marker in reproducible ways, with morphing and salt-and-pepper noise pushing SSIM below 0.5 in several cases. The revealed-marker artifacts are then fed to a ResNet-50 with fully connected layers, which separates seven manipulation classes with high accuracy in intra-steganography protocols and meaningful transfer in cross-steganography settings.","pith_inferences":["The paper's threat-model order—embed first, attack second—is not the canonical ePassport morphing order, in which the morph is created before enrollment; the authors' own protocol may therefore overstate the method's value against the headline morphing attack.","Because the ICAO logo is a known public image, the marker's fragility does not depend on secrecy, but an informed attacker could attempt to re-embed a clean marker into a modified photo; a per-document keyed marker would close that gap.","A natural testable extension is to see whether the same fragility signal appears when the attack is applied to the cover before embedding, and whether the classifier can be trained to detect morph-before-embedding cases at all.","The recovered-marker quality metrics could be turned into an interpretable tamper score for border officers, independent of the neural classifier, since the measured SSIM and PSNR drops are consistent per manipulation family."],"forward_implications":["An intact recovered marker would certify that the photo has not been altered after issuance, turning integrity verification into a simple comparison against the expected marker.","A degraded marker would not only flag tampering but also indicate the manipulation family, giving forensic examiners a starting point for further analysis.","The quality thresholds reported in the paper, such as SSIM below 0.75 or PSNR below 22 dB, could serve as a cheap pre-filter before running the classifier.","Cross-steganography accuracy of 72–81% suggests the forensic signal generalizes across embedding architectures well enough to support interoperability between certification systems.","Training on six of eight manipulation strengths and testing on all eight still yields reliable classification, indicating that the artifact patterns are not merely memorized from discrete parameter values."],"supporting_citations":[{"why":"Supplies Stegformer, the transformer-based autoencoder used as one of the two deep steganographic embedding and decoding engines.","marker":"[19]"},{"why":"Supplies SteGuz, the CNN-based steganographic model used as the second embedding and decoding engine.","marker":"[24]"},{"why":"Supplies the Chicago Face Database, the corpus of ICAO-compliant facial images into which the marker is embedded.","marker":"[20]–[22]"},{"why":"Defines the ICAO Doc 9303 standard that the certified facial images are required to satisfy.","marker":"[2]"},{"why":"Provides the fragile-versus-robust distinction that motivates choosing steganographic fragility for integrity verification.","marker":"[13]"},{"why":"Supplies the ResNet-50 architecture used as the feature extraction backbone for manipulation classification.","marker":"[30]"},{"why":"Supplies the ImageNet pretraining that initializes the classifier backbone before fine-tuning on recovered markers.","marker":"[31]"}],"fun_headline_variants":["Hidden logo in passport photo exposes any edit","Steganographic mark flags photo edits and classifies them","Fragile watermark certifies photo integrity via hidden image","Detect photo manipulation via embedded logo","Fragile watermark classifies manipulative edits"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes the watermark is embedded at issuance and that all tampering happens afterward; if an attacker morphed the face before the marker was embedded, the recovered logo would show no morphing artifact.","fun_headline_variants_meta":{"raw":{"variants":["Hidden logo in passport photo exposes any edit","Steganographic mark flags photo edits and classifies them","Fragile watermark certifies photo integrity via hidden image","Detect photo manipulation via embedded logo","Fragile watermark classifies manipulative edits"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000961,"raw_usage":{"total_tokens":4101,"prompt_tokens":961,"completion_tokens":3140,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":577,"completion_tokens_details":{"reasoning_tokens":3068}},"tokens_in":577,"tokens_out":3140,"duration_ms":18270,"temperature":1.0,"reasoning_tokens":3068,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:01:08.815382+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Create a morphed face first, then embed the ICAO logo into the already-morphed image and decode it; if the recovered marker is clean and the classifier reports no manipulation, the morphing cue is specific to post-issuance attacks rather than the canonical pre-issuance morphing scenario.","supporting_citations":[{"cited_title":"Stegformer: rebuilding the glo ry of autoencoder-based steganography,","cited_arxiv_id":null,"evidence_quote":"Supplies Stegformer, the transformer-based autoencoder used as one of the two deep steganographic embedding and decoding engines."},{"cited_title":"Imperceptible image stegano graphy using symmetry-adapted deep learning techniques,","cited_arxiv_id":null,"evidence_quote":"Supplies SteGuz, the CNN-based steganographic model used as the second embedding and decoding engine."},{"cited_title":"Doc 9303, Part 9, 2015, vol","cited_arxiv_id":null,"evidence_quote":"Defines the ICAO Doc 9303 standard that the certified facial images are required to satisfy."},{"cited_title":"Data hiding with deep learning: A survey unifying di gital watermarking and steganography,","cited_arxiv_id":null,"evidence_quote":"Provides the fragile-versus-robust distinction that motivates choosing steganographic fragility for integrity verification."},{"cited_title":"Resnet 50,","cited_arxiv_id":null,"evidence_quote":"Supplies the ResNet-50 architecture used as the feature extraction backbone for manipulation classification."}],"review_version":1}