Diffusion-Based Multi-Class Normality for OOD Detection: An Application to CDP Authentication

Source: arXiv:2607.00609 · Published 2026-07-01 · By Bolutife Atoki, Iuliia Tkachenko, Bertrand Kerautret, Carlos Crispim-Junior

TL;DR

This paper addresses the challenge of unsupervised out-of-distribution (OOD) detection in multi-class normality modeling, focusing on copy detection pattern (CDP) authentication. Authentic and counterfeit CDPs are visually very similar, differing only in subtle printing-and-digitisation (P&D) device signatures, making counterfeit detection difficult. Existing methods either train separate models per printer type or require counterfeit samples for supervised training, limiting scalability and adaptability to novel attacks. The authors propose a diffusion-based multi-class normality framework using a single class-conditional ControlNet trained exclusively on authentic CDPs from multiple P&D classes. Counterfeits are detected via elevated reconstruction error when conditioned on authentic-class prompts, and a novel dual template masking technique selectively hides complementary template regions to focus the anomaly score on withheld pixels rather than visible binary structure. Evaluated on the Indigo 1 × 1 Base dataset, this approach outperforms prior generative and analytical baselines, achieving a balanced error rate (Perr) of 0.055 and AUROC of 0.975 versus 0.106 Perr and 0.962 AUROC for the best baseline. It supports a single calibrated global threshold for authentication across multiple printer classes, enabling scalable and robust multi-class OOD detection without counterfeit training data or threshold tuning. The study’s comprehensive experiments demonstrate promise for practical multi-device CDP authentication and suggest extensions to broader OOD detection tasks involving subtle class-specific distribution differences.

Key findings

• The proposed diffusion-based multi-class normality framework achieves a balanced error rate (Perr) of 0.055 and AUROC of 0.975 on the Indigo 1 × 1 Base dataset, outperforming the best adapted baseline (Chaban et al.) which scored Perr=0.106 and AUROC=0.962 (Table I, Fig 3).
• Dual template masking, which scores only pixels hidden behind complementary masks in two reconstruction passes, improves the AUROC from 0.968 (no masking) to 0.975 and reduces Perr from 0.070 to 0.055, stabilizing the operating point (Table IV).
• The diffusion classifier correctly infers authentic printing device classes at test time with 91% balanced accuracy, enabling prompt conditioning without ground-truth labels (Table III).
• The method yields comparably low false acceptance rates (Pfa = 0.010) with an acceptable miss rate (Pmiss = 0.101) at a fixed global threshold calibrated only on authentic validation samples (Table I).
• Cross-class score calibration is demonstrated by compact authentic score distributions for different printer families under a single global threshold, unlike baselines which show score drift across classes (Fig 5).
• Per-family AUROC remains strong (>0.88) showing the model detects family-specific P&D deviations as well as simultaneous multi-class authentication (Fig 4).
• Training uses only authentic CDPs without counterfeit samples and the model is evaluated fully in an unsupervised OOD detection protocol with threshold tuning based exclusively on authentic validation data.
• Data augmentation including random cropping, flipping, and photometric perturbations improves generalization to imaging variability.

Threat model

The adversary is a forger capable of estimating authentic CDP templates and producing high-fidelity counterfeits via unauthorized reprinting on one of several printing devices. They cannot manipulate the stored original binary templates or the authentication system’s internal decision threshold. The attacker’s counterfeit samples closely resemble authentic prints visually and structurally, differing only in subtle, spatially non-uniform printing and digitisation signatures arising from device-specific physical variations. The defender assumes access only to authentic CDP data during training, with no examples of counterfeit or OOD samples available.

Methodology — deep read

1. Threat Model & Assumptions: The adversary can produce counterfeit CDPs via unauthorized template estimation and reprinting on devices different from authentic printers. The attacker does not have privileged access to the authentication system or threshold, and only subtle spatially non-uniform P&D signatures differentiate authentic from counterfeit samples. The system has access to authentic CDPs from known printers but no counterfeit samples for training or threshold calibration.

2. Data: The Indigo 1 × 1 Base dataset is used, containing 720 binary templates printed by two authentic devices (HP Indigo 5500 - HP55 and HP Indigo 7600 - HP76) and four counterfeit types generated by reprinting estimated authentic templates across devices, totaling 4,320 samples. Training/validation/test splits are 70%/10%/20% based on non-overlapping template identities, ensuring no leakage. The input includes binary templates and corresponding printed CDP images.

3. Architecture / Algorithm: A class-conditional ControlNet diffusion model backbone is used, adapted from prior work. The model encodes the binary template (via a VAE encoder) and authentic printed CDP images, conditioning denoising on a textual prompt representing printer class via a CLIP text encoder. The denoising U-Net learns to predict noise added at diffusion timestep t. The model is trained to reconstruct authentic CDPs conditioned on their printing device class, minimizing squared error between predicted and true noise. At inference, reconstruction error under the inferred authentic-class conditioning is used as an anomaly score.

Dual template masking is introduced: input templates are masked with complementary checkerboard masks in two passes, reconstructing and scoring only withheld pixels per pass. The final anomaly score averages the errors, thus reducing reliance on visible binary structure and enhancing sensitivity to subtle P&D device-specific variations.

4. Training Regime: Data augmentation includes 20x augmentation per sample via random crop and flip for templates, photometric perturbations for printed CDPs. The VAE encoder is fine-tuned, U-Net and CLIP text encoders are frozen. Optimization uses AdamW with a learning rate of 8e-5, batch size 8 with gradient accumulation of 4, a cosine scheduler with 500-step warmup, and 200 epochs on an RTX 3090 with mixed precision. All authentic classes are trained simultaneously with a shared model.

5. Evaluation Protocol: Metrics are balanced error rate (Perr), missed authentic rate (Pmiss), false acceptance rate (Pfa), mean squared error (MSE), binary error rate (BER), and Pearson correlation coefficient (PCC) on reconstruction error. A global threshold is calibrated solely on authentic validation samples using µ + 1σ (λ=1). ROC curves sweeping this threshold yield AUROC scores comparing all authentic vs all counterfeit samples across printer classes. Baselines include NCC, Pix2Pix-based print synthesis, OC-SVM on engineered features, and an energy-based authentic-only model. Per-family and multi-class evaluations are conducted to assess both discrimination and cross-class score calibration.

6. Reproducibility: The authors provide a public repository with code and trained models at https://gitlab.liris.cnrs.fr/anr-trustit/cdp-multiclass-normality.git, enabling reproduction of results. The Indigo 1 × 1 Base dataset is publicly referenced though access details are not stated here.

Concrete Example: For a candidate CDP image y, the binary template b is masked twice with complementary checkerboard masks and encoded. The diffusion model, conditioned on an inferred authentic printer prompt, reconstructs the missing pixels in each masked pass. Reconstruction errors computed only on these hidden pixels are averaged to produce an anomaly score edual. If edual exceeds the calibrated threshold τ, y is flagged as counterfeit; otherwise authentic. This single threshold applies jointly across authentic HP55 and HP76 classes due to the normalized score induced by class-conditional diffusion.

Overall, the methodology innovatively combines conditional latent diffusion reconstruction and strategic masking to enable multi-class unsupervised OOD detection on highly visually similar copy detection patterns without requiring negative samples or per-class thresholds.

Technical innovations

• A diffusion-based multi-class normality modelling framework using a single class-conditional ControlNet trained only on authentic classes for unsupervised OOD detection.
• The introduction of dual template masking that hides complementary input template regions in two reconstruction passes and scores only withheld pixels to reduce reliance on visible binary structure and better detect subtle printing-device-specific deviations.
• Test-time conditioning prompt inference selects the authentic class minimizing reconstruction error without access to counterfeit labels, enabling operational deployment with unknown class membership.
• Application and adaptation of diffusion model-based reconstruction error for calibrated multi-class authentication with a single global threshold across multiple P&D classes.

Datasets

• Indigo 1 × 1 Base dataset — 4,320 printed CDP samples from 720 binary templates — public (source detailed in paper)

Baselines vs proposed

• Chaban et al. [14]: Perr = 0.106 vs Proposed (MSE): Perr = 0.055
• Chaban et al. [14]: AUROC = 0.962 vs Proposed (MSE): AUROC = 0.975
• Tutt et al. [10]: Perr = 0.238 vs Proposed (MSE): Perr = 0.055
• NCC: Perr = 0.286 vs Proposed (MSE): Perr = 0.055
• Chapus et al. [17]: Perr = 0.335 vs Proposed (MSE): Perr = 0.055

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.00609.

Fig 1: Overview of the proposed framework. A class-conditional ControlNet learns authentic P&D manifolds and detects counterfeits via dual-mask

Fig 2: Training architecture. The printed CDP is fed to the ControlNet encoder as a spatial conditioning signal alongside the class prompt via the CLIP text

Limitations

• Evaluation conducted on a limited number of printer classes (K=2 authentic devices) and counterfeit types, limiting generalizability to broader printer populations.
• No explicit adversarial robustness evaluation; sophisticated attackers aware of the detection method might attempt to mimic P&D signatures to evade detection.
• Test-time prompt inference accuracy is high (91%) but still imperfect, potentially reducing detection performance if misclassification occurs.
• Score calibration relies on a fixed global threshold set from authentic validation only; adaptive or device-specific thresholds might improve operating points.
• Dependence on the availability of accurate binary templates stored securely for inference; in practical deployment, template tampering risks are unclear.
• While augmentations simulate some imaging variability, real-world variations in printing and scanning conditions may degrade performance and require further study.

Open questions / follow-ons

• How does the proposed diffusion-based multi-class normality framework generalize to larger printer device sets and more varied counterfeit fabrication methods?
• Can adaptive or dynamic thresholding strategies improve detection performance and robustness across varying production environments?
• What is the robustness of the approach against adversarial counterfeits intentionally crafted to mimic authentic P&D signatures?
• Could incorporating additional conditioning signals or multi-modal embeddings further enhance the sensitivity to subtle distributional differences in OOD detection?

Why it matters for bot defense

For bot-defense and CAPTCHA engineers, this work demonstrates a principled approach to unsupervised OOD detection in settings with multiple authentic classes exhibiting subtle but critical distributional differences, analogous to differentiating between legit user behaviors generated by different sources or devices. The use of a single class-conditional generative diffusion model that captures multiple authentic manifolds and outputs comparable anomaly scores allows deployment of a unified threshold-based detector across diverse authentic classes, simplifying operational complexity. The dual masking technique offers a novel way to focus anomaly detection on subtle, hard-to-spoof localized features rather than gross structural cues, which is crucial when counterfeit (or bot) signals closely mimic authentic ones. Although centered on CDP authentication, the insights into calibration, prompt inference, and reconstruction-based scoring under authentic-only training highlight strategies to handle evolving attack types without supervised attack data, a critical challenge in bot defense. However, practical application would need adaptation to behavioral or network CAPTCHA data distributions and consideration of real-time efficiency constraints of diffusion-based reconstruction.

Cite

@article{arxiv2607_00609,
  title={ Diffusion-Based Multi-Class Normality for OOD Detection: An Application to CDP Authentication },
  author={ Bolutife Atoki and Iuliia Tkachenko and Bertrand Kerautret and Carlos Crispim-Junior },
  journal={arXiv preprint arXiv:2607.00609},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.00609}
}

Read the full paper

• arXiv:2607.00609 (abstract)
• arXiv:2607.00609 (PDF)