FakeIDet3-DB: Refining Digital Attacks and Patch Extraction for Secure ID Benchmarking

Source: arXiv:2607.26641 · Published 2026-07-29 · By Muñoz-Haro Javier, Teruel Andres, Tolosana Ruben, DeAlcala Daniel, Vera-Rodriguez Ruben, Morales Aythami et al.

TL;DR

To comply with strict privacy regulations like GDPR, the authors propose PACE, a novel Pseudo-Anonymized Contextual patch Extraction algorithm. PACE extracts over 5.2 million semantically rich patches from 6.4K+ pseudo-anonymized real/fake ID images while rigorously avoiding any Personally Identifiable Information (PII) leakage by contouring anonymization masks efficiently through integral image mappings and distance-aware greedy non-maximum suppression. In thorough evaluations with state-of-the-art forgery detection models, all tested architectures perform poorly on FakeIDet3-DB's challenging manipulations, yielding a detection Equal Error Rate (EER) of 32.45% and localization Area Under ROC Curve (AUC-ROC) of 83.48%, exposing significant shortcomings of current forensic approaches on real ID attacks. The paper establishes a reproducible privacy-aware benchmark for both detection and spatial localization of digital ID forgeries, enabling safer research on robust tools for ID authentication.

Key findings

• FakeIDet3-DB includes 6,436 images generated from 250 real images of 47 distinct government-issued IDs, covering 8 manipulation types.
• Over 5.2 million patches at 64×64 and 128×128 sizes extracted using PACE from pseudo-anonymized ID images.
• PACE achieves zero overlap with pitch-black anonymization masks while maximizing semantic density in peri-censorship regions.
• State-of-the-art forensic detection models yield a poor 32.45% Equal Error Rate (EER) on detection task.
• Localization of manipulated regions attains only 83.48% AUC-ROC, showing limited spatial awareness.
• Classical and GenAI-based manipulations are equally difficult, especially when enhanced by the refined post-processing pipeline.
• Refined attacks significantly reduce detectable visual artifacts compared to naive cheapfake approaches (Fig. 2).
• Prior synthetic databases suffered from severe domain shift and unrealistically high accuracy that does not translate to real IDs.

Threat model

Adversaries are digital attackers capable of injecting high-fidelity, localized manipulations into ID images, including classical copy-move and splicing as well as advanced Generative AI-based face morphing, swapping, and text inpainting. They aim to bypass image-based ID detection systems by seamlessly blending forgeries to circumvent structural integrity checks. Attackers do not have knowledge of the privacy patch extraction but can manipulate images at pixel or semantic level. Defenders face constraints in accessing original ID images due to GDPR and must rely on anonymized patch-based data for training and evaluation.

Methodology — deep read

The authors start by defining the threat model as attackers capable of precisely manipulating ID images digitally using classical techniques like copy-move and splicing, as well as modern Generative AI methods such as latent diffusion models, GANs, face morphing, and swapping. The adversary aims to produce localized, high-fidelity semantic edits that evade forensic detection while maintaining the complexity of real ID security features. The defender must detect and localize these subtle manipulations under strict privacy constraints preventing access to unredacted real ID data.

Data originates from 250 real government-issued IDs (FakeIDet2-db) expanded to 6,436 manipulated images by applying 8 distinct attack types, split between classical digital manipulations and GenAI-driven semantic inpainting and face transformations. The manipulations undergo a refined post-processing pipeline involving semantic segmentation, alpha blending, and inpainting to simulate plausible, artifact-free forgeries rather than naive pixel substitution (“cheapfake”). This pipeline improves realism by reconstructing ID backgrounds and smoothing transitions around manipulated text or faces.

To comply with GDPR and prevent Personally Identifiable Information (PII) leakage, the authors apply pitch-black anonymization masks over sensitive fields before extracting patches. Patch extraction is formulated as a geometrically constrained optimization problem designed to maximize forensic utility by selecting patches at the immediate borders of occlusions to capture residual subtle artifacts without including redacted pixels.

The PACE algorithm implements a three-stage extraction: (1) integral image computation for constant-time validity checking of whether a candidate patch overlaps redacted mask pixels; (2) distance transforms estimate proximity of candidate patch centroids to the censorship boundary, prioritizing patches closest to masked areas; (3) a greedy spatial Non-Maximum Suppression (NMS) ensures selected patches do not overlap and saturates the perimeter zones first, then expands outward. This achieves efficient extraction of maximally semantically dense patches while fully respecting privacy requirements.

Training and evaluation use patches at two scales (64×64 and 128×128) from the extracted dataset. Ground truth masks align perfectly with patches by slicing the original annotations. The benchmark includes detection (frame-level binary real/fake classification) and manipulation localization (pixel-level segmentation) tasks evaluated with equal error rate (EER) and area under ROC curve (AUC-ROC) metrics, respectively. The evaluation protocol tests multiple state-of-the-art image forensic models, some pretrained on synthetic/fake ID datasets, with no mention of cross-validation but extensive ablation on patch size and attack types.

The authors publicly release the FakeIDet3-DB dataset along with the PACE extraction code and evaluation benchmark at https://github.com/BiometricsAI/FakeIDet3-DB, enabling reproducibility and extension of this line of research while guaranteeing privacy compliance.

Technical innovations

• FakeIDet3-DB is the first publicly available large-scale database of digital attacks on real, government-issued IDs incorporating both classical and Generative AI manipulations with refined post-processing.
• The PACE patch extraction algorithm leverages integral images for O(1) validity checks combined with distance-aware greedy Non-Maximum Suppression to maximize semantic information around redacted areas without compromising privacy.
• The refined post-processing pipelines (text and face modalities) use semantic segmentation and alpha blending to embed synthetic content seamlessly, removing cheapfake artifacts to simulate realistic forgery scenarios.
• The pseudo-anonymized patch-based framework enables privacy-compliant research on real IDs by dismantling spatial layout while retaining forensic-relevant residual information near occlusions.

Datasets

• FakeIDet3-DB — 6,436 images from 250 real images of 47 government-issued IDs with 8 attack types — source: Universidad Autónoma de Madrid (public release on GitHub)

Baselines vs proposed

• State-of-the-art forensic models (unspecified exact names) on FakeIDet3-DB: Detection EER = 32.45%, Localization AUC-ROC = 83.48% (poor robustness)
• Prior synthetic datasets (e.g., IDNet) achieved near-perfect F1 on synthetic test but failed to generalize on real IDs with F1 dropping from 0.99 to 0.72 in DeepID challenge
• Prior physical forgery datasets (e.g., FakeIDet2-db) limited to physical attacks and lower complexity of manipulation types

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.26641.

Fig 1: An overview of the main contributions of the present article. The left panel illustrates the attack generation pipeline considered in FakeIDet3-DB,

Fig 2: Visual results of the digital attacks included in FakeIDet3-DB including different types of manipulations and post-processing techniques. It is noticeable

Fig 3 (page 2).

Fig 4 (page 2).

Fig 5 (page 2).

Fig 6 (page 2).

Fig 7 (page 2).

Fig 8 (page 2).

Limitations

• The evaluation suffers from limited disclosure of exact model architectures and training details (hyperparameters, seeds, hardware not specified).
• No detailed cross-validation or adversarial robustness testing described; generalization to unseen attack types not explicitly evaluated.
• Reliance on anonymization masks and pseudo-anonymized patches may still lose some spatial/contextual information compared to full images.
• Patch extraction priority favors peri-masked zones, which may bias models toward boundary artifacts rather than holistic document features.
• Dataset size may still be limited compared to massive synthetic datasets, potentially restricting deep learning scaling.
• No direct comparison with newer detector architectures specifically designed for generative AI manipulations presented.

Open questions / follow-ons

• How well do state-of-the-art anti-forensic or adversarially robust models perform on FakeIDet3-DB under targeted evasion attempts?
• Can patch aggregation or context-aware architectures better leverage geographically dispersed patches to improve detection/localization accuracy?
• How does performance vary across different government ID formats or acquisition conditions beyond the 47 IDs studied?
• What are optimal anonymization strategies that maximize data utility while preserving privacy for forensic model training?

Why it matters for bot defense

From a bot-defense and CAPTCHA research perspective, FakeIDet3-DB highlights the growing sophistication of localized, realistic manipulations on identity documents used in KYC and user verification pipelines. The demonstrated difficulty state-of-the-art forensic models have in detecting seamless GenAI-powered forgeries underscores the urgent need for enhanced anomaly detection and semantic integrity verification techniques in real-world authentication flows. The privacy-aware patch extraction framework (PACE) offers a practical method to leverage real document data for training robust models without compromising PII, which could inspire analogous privacy-preserving feature extraction approaches in other security domains. Overall, integrating such realistic attack datasets and privacy-preserving methodologies can improve robustness of user identity verification components in bot defense systems.

Cite

@article{arxiv2607_26641,
  title={ FakeIDet3-DB: Refining Digital Attacks and Patch Extraction for Secure ID Benchmarking },
  author={ Muñoz-Haro Javier and Teruel Andres and Tolosana Ruben and DeAlcala Daniel and Vera-Rodriguez Ruben and Morales Aythami and Fierrez Julian },
  journal={arXiv preprint arXiv:2607.26641},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.26641}
}

Read the full paper

• arXiv:2607.26641 (abstract)
• arXiv:2607.26641 (PDF)