{"id":"95d9d487-d683-4991-949b-e1b8ec54ef9d","arxiv_id":"2505.13327","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"The authors release UniAttackData+, a unified face attack detection dataset with 54 attack types and 697,347 videos, and propose HiPTune, a hierarchical prompt tuning model that outperforms baselines on multiple UAD benchmarks.","lead":"This paper introduces a huge benchmark for detecting physical face spoofs and digital deepfakes in one model, with 54 attack types across almost 700,000 videos. It also trains a hierarchical prompt-tuning model that adapts to different attack types and reports better accuracy than several baselines.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"HiPTune's central explanatory claim rests on an unvalidated assumption that the hand-defined attack taxonomy matches separable feature groups; a shuffled-hierarchy ablation is needed to rule out prompt capacity and supervised routing as the real source of the gains.","rationale":"The paper makes two contributions: a large unified dataset and a hierarchical prompt-tuning method. The dataset numbers are mostly consistent (18,250 real + 679,097 fake = 697,347), but editing issues remain—Table 3 has a row-sum typo in the P1 train column (the listed components sum to 344,676, not 355,676) and the P2 columns sum to 680,682 rather than 697,347; the conclusion and Fig. 1 rename the dataset 'HiFAB'; and placeholders like 'XX' in Section 4.3 are unresolved. These support the reader's CONDITIONAL verdict but are not the deepest threat to the paper's central claim. The more load-bearing issue is the semantic validity of the hand-built taxonomy in Section 4.3. The hierarchical-prompt story requires that the physical/digital, 2D/3D, and manipulation/adversarial/generation splits correspond to meaningful feature groupings; otherwise the VP-Tree is an arbitrary prompt-routing structure and the 'explainable hierarchical' contribution is not established. The only ablation in Section 5.6 varies tree depth and prompt length, not tree structure, so it cannot distinguish meaningful hierarchy from extra capacity. A shuffled-hierarchy control is the simplest decisive experiment. With that check unrun, the appropriate status is the same conditional verdict: no fatal flaw identified, but the central interpretability claim and dataset artifacts must be verified before the benchmark is adopted as a standard.","tokens_in":27205,"tokens_out":10285,"duration_ms":95175,"concrete_test":"Run Protocols 2 and 3 with the same VP-Tree size, prompt length, and training budget, but with the per-level attack labels randomly permuted (a shuffled tree of identical width and depth), and compare the resulting ACER with the reported 14.26% and 25.68%. If the shuffled-tree ACER is statistically indistinguishable from the true-hierarchy results, the hand-defined taxonomy is not the source of the generalization gains.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central methodological claim—that the VP-Tree's three-level taxonomy (physical/digital, 2D/3D, manipulation/adversarial/generation, plus sub-types) captures 'multi-level, fine-grained classification criteria'—is asserted rather than demonstrated. Section 4.3 states that different attacks 'demonstrate a more compact grouping relative to other categories' but provides no quantitative evidence, such as silhouette scores, clustering purity, or kNN separability, in the frozen CLIP feature space. Section 5.6 only ablates tree depth and prompt length; it never compares the true taxonomy with a shuffled or random tree of the same shape and parameter count. Since Protocols 2 and 3 are the headline generalization results (ACER 14.26% and 25.68%), and since the first-stage prompt training injects per-level ground-truth labels, the observed margins could come from added prompt parameters, supervised routing, or hierarchy inheritance rather than from the semantic correctness of the hand-defined hierarchy. If the taxonomy is arbitrary, the strongest interpretive contribution of HiPTune is unsupported even if the reported numbers reproduce.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript reports a new unified face attack detection (UAD) benchmark, UniAttackData+ (also called HiFAB in the Fig. 1(c) caption and the Conclusion), claimed to be the largest publicly available UAD dataset, with 54 attack types (14 physical, 40 digital) applied to 2,875 identities and 697,347 videos in total, and proposes HiPTune, a hierarchical prompt-tuning method that constructs a three-level Visual Prompt Tree (VP-Tree) from a hand-defined attack taxonomy, routes each sample to learned prompts via Adaptive Prompt Pruning (APP), and projects the selected prompts into the text encoder through a Dynamic Prompt Integration (DPI) module. Three intra-dataset protocols are defined: identity-disjoint (P1), cross-attack-method (P2), and cross-attack-type (P3). The paper reports the best ACER among the compared methods on all three protocols (7.31%, 14.26%, 25.68%), favorable results on JFSFDB and UniAttackData, and cross-domain evaluations; it also candidly acknowledges weaker results in some settings, including EER on ROSE and Celeb-DFv2 (Section 5.3) and ACER on UniAttackData Protocol 1.1 versus ResNet-50 (Section 5.4).","tokens_in":27393,"tokens_out":27594,"duration_ms":241584,"significance":"If the dataset statistics and the reported numbers are correct, the dataset contribution is significant: UniAttackData+ would give the community an identity-consistent UAD benchmark that is roughly an order of magnitude larger than existing video-based UAD sets, with more attack types and deliberately designed held-out protocols. The paper deserves credit for evaluating across multiple datasets (JFSFDB, UniAttackData, UniAttackData+) and for shipping links to data and code; the held-out identity (P1) and held-out attack type/method (P2, P3) splits, together with cross-dataset tests, mean the headline results are not forced by construction. The method's AUC gains over the compared baselines are consistent, and the paper is candid about settings where it does not win (P1.1 versus ResNet-50, EER on ROSE/Celeb-DFv2). However, the central interpretive claim, that the hand-defined taxonomy encodes meaningful coarse-to-fine classification criteria, is not directly validated, and the benchmark's credibility is currently undercut by arithmetic inconsistencies in Table 3 and by unspecified metric operating points. These issues are fixable, so the contribution remains promising.","major_comments":[{"comment":"The load-bearing interpretive claim of HiPTune, that the hand-defined three-level taxonomy (physical/digital, 2D/3D, manipulation/adversarial/generation, and their subtypes) corresponds to separable feature groupings and thereby provides 'multi-level, fine-grained classification criteria', is asserted rather than demonstrated. Section 4.3 states that features of different attacks 'demonstrate a more compact grouping relative to other categories' without any quantitative evidence (no silhouette score, cluster purity, or kNN separability computed in the frozen CLIP feature space). The ablation in Section 5.6 (Fig. 5) varies tree depth from 1 to 3, but a deeper tree also contains more prompts, so the gain cannot separate the semantic value of the hierarchy from added prompt parameters and supervised routing; note also that the first-stage prompt training (Section 4.4) injects ground-truth per-level attack labels, so the APP router is trained after the prompts have been specialized with oracle information. A shuffled or randomly rewired taxonomy of identical tree shape and parameter count, or a direct separability analysis of the frozen CLIP features for the chosen nodes, is required before the paper can claim that the taxonomy, rather than extra capacity or the routing mechanism, explains the P2/P3 generalization gains.","section":"Section 4.3, Section 5.6 (Fig. 5)"},{"comment":"Table 3's sample statistics do not add up as printed. In Protocol 1 the column values of the train row sum to 344,676 while the printed '#All' is 355,676, and the three printed subset totals sum to 708,347 instead of the claimed 697,347 (the column sums do yield 697,347, so the train total appears misprinted). In Protocol 2 the printed subset totals sum to 680,682, a shortfall of 16,665 videos relative to 697,347 that the protocol description does not explain, since all identities and a random 50/20/30 split of all attack methods are supposed to be used. For comparison, Protocol 3 sums correctly to 697,347. Separately, the Introduction says 'at least 30 frames' were randomly extracted per video while Section 3.1 says 'at least 25 frames per video'. Since the dataset statistics are the paper's primary artifact, these numbers must be reconciled and the frame extraction description made consistent.","section":"Table 3, Section 3.1"},{"comment":"The evaluation protocol is not fully specified and the reported metrics are hard to interpret. The paper never states the decision threshold used for ACER and ACC, and the comparisons appear to mix conventions: for several baselines ACER equals EER exactly (e.g., CLIP-V, CLIP, and CoOp across all three protocols), suggesting that ACER was computed at the EER operating point, while for HiPTune ACER is consistently lower than EER, which is only possible if a different, more favorable threshold is used; the paper must confirm that all methods are scored at the same operating point. Relatedly, the ACC values in Table 4 are difficult to reconcile with a well-tuned detector given the extreme class imbalance (the P1 test set contains 5,475 live versus 207,727 fake videos): HiPTune's ACC of 90.02% on P1 is below the trivial always-fake accuracy of 97.4%, as are most ACC entries in the table, and this should be explained or the operating point stated. Finally, all results in Tables 4-7 are single runs without variance, error bars, or significance tests, which matters given the small margins on P1 (ACER 7.31 for HiPTune versus 8.26 for FA3-CLIP) and on several JFSFDB cells.","section":"Section 5.1, Section 5.2, Table 4"},{"comment":"The main benchmark table for the new dataset omits the most relevant UAD baselines. Section 2.2 discusses UniFAD [37], UniAttackDetection [39], La-SoftMoE [57], and MoAE-CR [58] as the state of the art in unified detection, yet Table 4 compares HiPTune only against CLIP variants, single-task PAD/FFD methods, and FA3-CLIP; UniAttackDetection appears only in Table 6, on the older UniAttackData benchmark. Since the paper claims best ACER 'on the three proposed protocols', the benchmark should include these methods (at least UniAttackDetection, whose code is available and which is the authors' own prior work) so that the claimed superiority is demonstrated against the strongest existing UAD models rather than only against simpler alternatives.","section":"Table 4"},{"comment":"The method as described is not reproducible. No loss functions are given for either training stage (the stage-1 prompt specialization that uses ground-truth per-level labels, or the stage-2 joint training with binary live/fake labels). The APP module performs a hard TOPk=1 selection (Eq. 5), which is non-differentiable, yet the paper does not explain how the router is trained (e.g., Gumbel-softmax, straight-through estimator, or the softmax-weighted DPI aggregation). The DPI is described as projecting 'the three hierarchical prompts' to the text-feature dimension 'through a dedicated mapping layer', but the dimensionality, the trainable status of the mapping, and, critically, how the resulting unified prompt is combined with the frozen text encoder to produce the final live/fake score are never specified; Eqs. (1)-(5) only cover the visual side. The inheritance coefficient alpha introduced in Section 4.3 is never assigned a value, and no ablation on alpha is reported. These gaps must be filled before the experimental results can be independently reproduced.","section":"Sections 4.4, 4.5"}],"minor_comments":[{"comment":"The sentence 'Following the approach of XX' is an unresolved placeholder for a citation; it must be replaced with the actual reference or removed.","section":"Section 4.3"},{"comment":"The dataset is named UniAttackData+ in the Abstract and body but 'HiFAB' in the Fig. 1(c) caption and in the Conclusion; a single name should be adopted throughout.","section":"Abstract, Fig. 1(c), Section 6"},{"comment":"The module name is inconsistent: 'Dynamically Prompt Integration' in the Abstract and Section 1, 'Dynamic Prompt Integration' in the Section 4.5 heading, and 'Dynamic Prompt Interaction' in the first paragraph of Section 4.5; one name should be used everywhere.","section":"Abstract, Section 4.5"},{"comment":"The contribution bullet promises 'four intra-dataset protocols and nine cross-dataset benchmarks', but Section 3.5 defines only three protocols on UniAttackData+ (P1-P3) and no enumeration of nine cross-dataset benchmarks appears in the paper; the counts should be reconciled with the tables.","section":"Section 1 (contributions)"},{"comment":"The claim that 'All the attack methods included in our dataset were proposed after 2021' is contradicted by the paper's own references (SimSwap [21] is 2019, StarGAN [19] is 2018, AutoAttack [74] and PGD [75] predate 2021), and the nearby claim of covering 'all known attack types' (also phrased as 'almost all known attack types') is made without a survey or a comparison table against existing attack taxonomies.","section":"Section 3.1"},{"comment":"The header of the last three rows reads 'text' instead of 'test'.","section":"Table 3"},{"comment":"HiPTune's EER on ROSE-PAD (12.82) and Celeb-DFv2-FFD (28.77) is worse than FA3-CLIP's (9.61 and 25.51); the discussion should address these outliers directly rather than only reporting the averaged EER advantage.","section":"Section 5.3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript reads as an assembly of several versions: the dataset has two names (UniAttackData+ and HiFAB), the contribution list promises four intra-dataset protocols and nine cross-dataset benchmarks that do not match the body, Table 3 has the arithmetic problems detailed in the report, and Section 4.3 retains an 'XX' placeholder. The most likely review flashpoints are the missing control for the hierarchy claim, the Table 3 sums, and the unstated ACER/ACC operating points. The dataset, if released with exact protocol splits and checksums, is a genuine community asset, and I would not want the paper rejected over the method's mechanism alone. I recommend requiring the ranked-hierarchy control, the missing UAD baselines, and a precise statement of the evaluation protocol in revision. One further note: UniAttackDetection and La-SoftMoE are closely related to the authors' group, so their absence from Table 4 is especially noticeable; the comparison set and the configuration of each baseline should be verified and documented."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The dataset is the real thing. UniAttackData+ is a 54-attack, 697k-video, identity-consistent benchmark that is genuinely larger and more systematic than GrandFake or JFSFDB. That alone is worth the field's attention. HiPTune is a reasonable prompt-tuning method, but the paper's central interpretive claim—that the hand-built hierarchy matches separable feature groups—is asserted, not shown, and the manuscript has visible editing and arithmetic problems that need fixing before anyone should rely on the numbers.\n\nWhat is new and good: the identity-consistent design across 54 attack types is a big step up. Protocols 2 and 3, which test cross-attack-method and cross-attack-type generalization, are the right way to evaluate robustness to unseen attacks. The external benchmarks on JFSFDB and UniAttackData show the method is not just overfit to the new dataset. VP-Tree plus APP plus DPI is a sensible way to route samples to multiple criteria, and the gains over FA3-CLIP and CoOp on P2 and P3 are noticeable.\n\nSoft spots, in proportion. Table 3 does not add up: Protocol 1 rows sum to 708,347, not 697,347, and Protocol 2 to 680,682. Probably a typo in the train row, but it makes the dataset statistics untrustworthy on first read. There are no error bars or significance tests anywhere; some margins are small, and with single runs we cannot tell whether the hierarchy is helping or just adding parameters. The stress-test concern is legitimate: the paper says different attacks \"demonstrate a more compact grouping\" in encoder space but gives no quantitative evidence. The ablation varies tree depth and prompt length but never compares the true taxonomy to a shuffled or random tree of the same shape and parameter count. Without that control, the \"multi-level classification criteria\" story is not established. There are also unresolved placeholders—the \"XX\" reference, the empty citation, the dataset renamed HiFAB in the conclusion—and the claim of covering \"all known attack types\" is too strong for a field that moves quickly.\n\nNet: the dataset deserves to be built on, and the method plausibly works, but the paper as written is not a clean benchmark paper. It needs major revision, not desk rejection. I would send it to reviewers with specific requests: fix the tables, add error bars or multiple seeds, run a shuffled-hierarchy ablation, and soften the interpretability claims until they have evidence. If the authors ship clean dataset and code, this could become a standard testbed.","headline":"The dataset is the real contribution, but the paper's central hierarchy story is asserted rather than demonstrated, and the manuscript needs cleanup before the numbers can be trusted.","tokens_in":28026,"tokens_out":3938,"would_cite":true,"duration_ms":32557,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a new 697,347-video, 54-attack-type dataset plus hierarchical prompt tuning makes unified face attack detection work across physical and digital attacks, with better generalization to unseen attacks than…","keywords":["face anti-spoofing","deepfake detection","unified face attack detection","hierarchical prompt tuning","vision-language model","benchmark dataset","attack generalization","prompt tree"],"falsifier":"A concrete test: compute the silhouette score of CLIP features under the paper's three-level taxonomy on held-out UniAttackData+ frames. If the 2D/3D or manipulation/adversarial/generation groupings do not separate better than random groupings of the same cardinality, the hierarchy is not carrying the reported gains. Alternatively, retrain HiPTune with shuffled leaf labels; if ACER does not degrade, the advantage comes from prompt capacity or routing rather than meaningful hierarchical criteria.","tokens_in":26956,"feed_emoji":"🛡️","tokens_out":6800,"duration_ms":61230,"temperature":0.7,"pith_summary":"This paper tries to establish that unified face attack detection—a single model that catches both physical presentation attacks and digitally forged faces—is practical, and that prior attempts fell short for two reasons: there was no large, clean, identity-consistent benchmark, and detectors relied on one classification criterion within one semantic space. It introduces UniAttackData+, a dataset of 697,347 videos from 2,875 identities, each identity subjected to 54 different attack methods spanning physical, manipulation, adversarial, and generative forgery, arranged in a coarse-to-fine taxonomy. It then introduces HiPTune, which builds a visual prompt tree over that taxonomy and lets a frozen vision-language encoder route each sample through coarse-to-fine prompts, pruning to the most relevant criteria and fusing them into the text encoder. On its three protocols, HiPTune reports ACER of 7.31%, 14.26%, and 25.68%, and it reports the best average performance on JFSFDB and UniAttackData, supporting the claim that hierarchical, multi-criterion routing generalizes to unseen attacks better than single-criterion methods. If the claim holds, the field gains a standard benchmark and a model architecture that can adapt to new attack types without retraining a separate detector per attack family.","feed_headline":"54 attack types, 697k videos: unified face attack benchmark","feed_subtitle":"A 697,347-video benchmark plus hierarchical prompt routing covers physical and digital attacks in one model.","key_machinery":"The Visual Prompt Tree (VP-Tree): a three-level hierarchy of learnable prompts that mirrors the dataset's attack taxonomy, with each prompt inserted into the frozen CLIP image encoder at different Transformer depths. Higher-level prompts give coarse, generalizable boundaries for catching unknown forgeries; lower-level prompts give fine-grained discrimination for known attacks. The APP module prunes to the most relevant prompt per level for each sample, and the DPI module fuses the chosen prompts and projects them into the text encoder, so the model effectively acts as a router that selects classification criteria per sample rather than drawing a single real/fake line.","core_discovery":"The central claim is that multiple classification criteria, organized hierarchically, outperform any single semantic-space criterion for unified face attack detection. The VP-Tree encodes the dataset's taxonomy: level 1 splits physical vs digital, level 2 splits 2D/3D and manipulation/adversarial/generation, and level 3 holds fine-grained attack subtypes; each node is a learnable visual prompt inserted into a frozen CLIP ViT encoder at different depths. The Adaptive Prompt Pruning (APP) module scores each prompt against the image's CLS token and selects the top prompt per level per sample, while the Dynamic Prompt Interaction (DPI) module merges the selected prompts and projects them into the text encoder. Trained on 697,347 videos from 2,875 identities, HiPTune reports ACER of 7.31%, 14.26%, and 25.68% on the identity, cross-method, and cross-type protocols, and the best average AUC on JFSFDB and UniAttackData. The paper also argues the dataset itself is the largest publicly available unified face attack detection dataset, with identity consistency across all 54 attack types to prevent identity-memorization shortcuts.","pith_inferences":["The paper's taxonomy is assumed to match the encoder's feature geometry; a direct test would be clustering frames under the 2D/3D and manipulation/adversarial/generation splits and comparing cluster separation against random splits.","The same VP-Tree routing could be applied to other fine-grained classification problems with a known hierarchy (e.g., deepfake method sub-families or biological image taxonomies), reusing the coarse-to-fine prompt structure without retraining the full model.","Because the dataset includes 54 attack types but forgery methods keep evolving, an important stress test is appending a new generative attack as a new leaf and measuring whether the frozen top-level prompts still detect it."],"forward_implications":["If HiPTune's gains hold, a single frozen-CLIP UAD model can be trained once and retain reasonable accuracy on attack types never seen in training, cutting deployment cost relative to per-attack PAD/FFD models.","The UniAttackData+ protocols give the community a standard way to separate identity generalization (P1), unseen-method generalization (P2), and simple-to-advanced transfer (P3), so future UAD methods can be compared on the same axes.","The dataset's identity-consistent, hierarchically labeled structure lets researchers train on all 54 attack types per identity, reducing the risk of models exploiting identity-specific cues rather than forgery cues.","On JFSFDB cross-domain tasks, joint UAD training with HiPTune improves AUC on most test sets over separate PAD/FFD training, implying that unified training is complementary rather than harmful."],"supporting_citations":[{"why":"Supplies the identity-consistent dataset design and the UniAttackData benchmark that UniAttackData+ extends and that HiPTune is evaluated on.","marker":"[39]"},{"why":"JFSFDB is one of the two existing UAD datasets used as a comparison benchmark for cross-domain PAD/FFD/UAD evaluation.","marker":"[38]"},{"why":"GrandFake is the other existing UAD dataset; its limited attack types motivate the new benchmark and serve as a comparison point.","marker":"[37]"},{"why":"CLIP is the frozen vision-language backbone whose text and image encoders HiPTune builds on.","marker":"[83]"},{"why":"CoOp provides the learnable-prompt baseline that HiPTune's hierarchical prompts are compared against.","marker":"[86]"},{"why":"Visual prompt tuning supplies the mechanism for inserting learnable prompts into a frozen encoder, which VP-Tree adapts.","marker":"[87]"},{"why":"FA3-CLIP is the strongest unified-attack method baseline; HiPTune claims to outperform it on UniAttackData+ and JFSFDB.","marker":"[59]"}],"fun_headline_variants":["HiPTune: 54 attack types, 697k videos for unified detection","Hierarchical prompts unify face attack detection across 54 types","Largest face attack dataset: 54 types, 697k videos, one model","One model for physical and digital face attacks via hierarchy","VP-Tree and prompt pruning: unified face attack detection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The benefit of HiPTune depends on the assumption, stated without evidence, that the hand-built three-level taxonomy (physical/digital, 2D/3D, subtype) corresponds to separable feature groupings in the encoder, so the prompts encode meaningful rather than arbitrary criteria.","fun_headline_variants_meta":{"raw":{"variants":["HiPTune: 54 attack types, 697k videos for unified detection","Hierarchical prompts unify face attack detection across 54 types","Largest face attack dataset: 54 types, 697k videos, one model","One model for physical and digital face attacks via hierarchy","VP-Tree and prompt pruning: unified face attack detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000641,"raw_usage":{"total_tokens":3018,"prompt_tokens":1084,"completion_tokens":1934,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":700,"completion_tokens_details":{"reasoning_tokens":1842}},"tokens_in":700,"tokens_out":1934,"duration_ms":11928,"temperature":1.0,"reasoning_tokens":1842,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:15:40.302284+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete test: compute the silhouette score of CLIP features under the paper's three-level taxonomy on held-out UniAttackData+ frames. If the 2D/3D or manipulation/adversarial/generation groupings do not separate better than random groupings of the same cardinality, the hierarchy is not carrying the reported gains. Alternatively, retrain HiPTune with shuffled leaf labels; if ACER does not degrade, the advantage comes from prompt capacity or routing rather than meaningful hierarchical criteria.","supporting_citations":[{"cited_title":"Benchmark- ing joint face spoofing and forgery detection with visual and physiological cues,","cited_arxiv_id":null,"evidence_quote":"JFSFDB is one of the two existing UAD datasets used as a comparison benchmark for cross-domain PAD/FFD/UAD evaluation."},{"cited_title":"Unified detection of digital and physical face attacks,","cited_arxiv_id":null,"evidence_quote":"GrandFake is the other existing UAD dataset; its limited attack types motivate the new benchmark and serve as a comparison point."},{"cited_title":"FA^{3}-CLIP: Frequency-Aware Cues Fusion and Attack-Agnostic Prompt Learning for Unified Face Attack Detection","cited_arxiv_id":"2504.00454","evidence_quote":"FA3-CLIP is the strongest unified-attack method baseline; HiPTune claims to outperform it on UniAttackData+ and JFSFDB."}],"review_version":1}