BioTamperNet: Affinity-Guided State-Space Model Detecting Tampered Biomedical Images
Authors: Soumyaroop Nandi
Prem Natarajan
Venue: ICLR 2026 Poster (2026)
Keywords: Generative Local Forgery Detection
Information-Theoretic Gradient Fingerprints
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning

Abstract: We propose BioTamperNet, a novel framework for detecting duplicated regions in tampered biomedical images, leveraging affinity-guided attention inspired by State Space Model (SSM) approximations. Existing forensic models, primarily trained on natural images, often underperform on biomedical data where subtle manipulations can compromise experimental validity. To address this, BioTamperNet introduces an affinity-guided self-attention module to capture intra-image similarities and an affinity-guided cross-attention module to model cross-image correspondences. Our design integrates lightweight SSM-inspired linear attention mechanisms to enable efficient, fine-grained localization. Trained end-to-end, BioTamperNet simultaneously identifies tampered regions and their source counterparts. Extensive experiments on the benchmark bio-forensic datasets demonstrate significant improvements over competitive baselines in accurately detecting duplicated regions. All source code and dataset will be publicly available.

Published as a conference paper at ICLR 2026
BIOTAMPERNET: AFFINITY-GIIDED STATE-SPACE MODEL DETECTING TAMPERED BIOMEDICAL IMAGES
Soumyaroop Nandi Prem Natarajan 1,2,3
USC Information Sciences Institute, Marina del Rey, CA, USA USC Thomas Lord Department of Computer Science, Los Angeles, CA, USA, 'Capital One { soumyarn, premkumn) @usc. edu
ABSTRACT
We propose BioTamperNet, a novel framework for detecting duplicated regions in tampered biomedical images, leveraging affinity-guided attention inspired by State Space Model (SSM) approximations. Existing forensic models, primarily trained on natural images, often underperform biomedical data where subtle manipulations can compromise experimental validity. To address this, BioTeeeeerNet introduces affinity-guided self-attention module to capture intra-image similarities and an affinity-guided cross-attention module to model cross-image correspondences. Our design integrates lightweight SSM-inspired linear attention mechanisms enable efficient, gra-ggr localization. Trained end-to-ens BioTaameeNNet si- multaneously identifies tampered regions and their source counterparts. Extensive experiments the benchmark bio-forent vio-forensic datasets demonstrate significant im- provements over competitive baselines in accurately detecting duplicated regions. Code - https://github.comm/ hwapllhhuboom/SSuuuuuun www.s//oooomooooannnoaoaoooo TamporrTt
INTRODUCTION
Scientific integrity is fundamental to credible research, yet instances of image manipulation in biomedical publications continue to raise serious concerns. Such misconduct not only damages scientific reputation but also contributes to the reproducibility crisis and imposes significant financial costs on the research community Miyakawa (2020); Bik et al. (2018); Stern al. (2014). Manual review processes often inadequate, particularly when manipulations involve subtle duplications complex alterations Bik et al. (2016). As image forgeries grow increasingly sophisticated, there is a critical need for automated forensic tools ensure the reliability and integrity of scientific findings.
Biomedical images exhibit significant semantic and visual diversity, posing greater challenges than in natural images. They vary widely in structure, content, and acquisition techniques. Following Sabir et al. (2021), we categorize biomedical images into four types: microscopy (cell and tissue images under microscope), blot/gel (protein, RNA, and DNA analysis such Western blots), Fluorescence- Activated Cell Sorting- SoCS (scatter plots for cytometry analysis), and macroscopy (miscellancous biomedical images such as scans and leaves), shown in Figure 1. Each modality introduces distinct forensic challenges, motivating the need for models adaptive across diverse image types.
The BioFors dataset Sabir et al. (2021) defines three key forensic tasks, illustrated in Figure 2. External Duplication Detection (EDD) involves identifying duplicated regions between two images, arising from either image repurposing (cropping from shared source) or splicing (pasting regions across images). Internal Duplication Detection (IDD) focuses on detecting repeated regions within single image without assuming the manipulation type; often, it is unclear which duplicated patch, if any, is authentic. Cut Sharp Transition Detection (CSTD) targets sharp transitions indicative of stitched or composite images, unique to the biomedical domain. Additionally, blot/gel images exhibit patch removal, where regions are blurred inpainted obscure unfavorable results.
In this work, we propose Bio TemppeNet, unified framework based on State Space Models (SSMs) for detecting duplicated and manipulated regions in biomedical images. BioTTamerNNet consists of two key components: an affinity affinit--uiied self- attention module to detect similar regions within an image (for internal duplications), and an affinity-giided cross-attention module identify duplicated

---

Published as a conference paper at ICLR 2026
Repcated Regions
Repcated Regions
Tampered Regions
MICROSCOPY
BLOT/GEL
FACS
MACROSCOPY
EDO
CSTD
Figure I: Microscopy, Blot/Gel,, FACS, Macroscopy in BioFors Sabir et al. (2021).
Figure 2: EDD uses image pairs for detection; IDD and CSTD use single image each.
regions between image pairs (for external duplications). By leveraging SSMs as efficient attention mechanisms, Tamperett accurately localizes duplications while maintaining efficiency.
As the BioFors dataset Sabir et al. (2021) lacks manipulated training samples, we create synthetic datasets by inserting duplicated patches with extensive augmentations (scaling, rotation, cropping. flipping, noise addition). and further enhance realism using techniques. To address EDD, Bammapee operates on image pairs, predicting source and target duplicated regions. For IDD and CSTD, we synthetically generate image pairs by cutting forged single images, allowing a single architecture to handle both tasks without requiring modifications. This unified design simplifies training and inference across diverse biomedical manipulations.
patches and blending
Our contributions are summarized as follows:
We propose BioTTameerNet, unified architecture for both paired-image and single-image forgery localization in biomedical images.
We design affinity-guided self-attention and cross-attention modules based on lightweight SSM -nnspred linear attention for structured duplication detection.
We generate synthetic and GAN-augmentatton, mitigating scarcity in biomedical forensics.
We achieve state-of-the-art performance on the BioFors Sabir et al. (2021) test set, which contains real-world forged experimental images from retracted scientific publications.
TRAINING DATASET
BioFors Sabir et al. (2021) provides benchmark for biomedical image forgery detection but its train split only includes pristine images without forgeries corresponding ground truth masks. To enable supervised training of Bio TemperNet, truth masks from the train split of Sabir et al. (2021). The training setup EDD differs from that of IDD and CSTD, EDD requires a pair of images with corresponding ground truth masks, whereas IDD and CSTD training use a single image with its ground truth mask. To unify training within single model, we devised novel strategy for Bio TemperNet. Bio TamperNet is designed to handle EDD by processing image pairs and predicting a pair of manipulated masks as illustrated Figure 3. To incorporate IDD and CSTD images into the EDD training framework, split each IDD and CSTD image into two parts, generating a corresponding pseudo-pair of input images and ground truth masks, enabling their within the EDD training setup, illustrated in Figure 4.
generate synthetic datasets with paired images and ground
To increase data diversity and realism, we apply extensive augmentations, including geometric transformations (scaling, rotation, flipping, cropping) and noise perturbations. Additionally, employ Generative Adversarial Networks (GANs) to synthesize realistic duplicated patches that better simulate complex manipulations found real biomedical images. This synthetic, augmented, and blended training strategy improves Bio'TamperNed robustness, generalization, and adaptability diverse forgery patterns observed biomedical research publications.
3 PROPOSED METHOD
3.1 PRELIMINARIES STATE SPACE MODELS
State Space Models (SSMs) Gu et al. (2021); Gu & Dao (2023); Liu et al. (2024) represent complex sequences using linear time-invariant (LTT) dynamies, generalizing classical approaches such as the
2

---

Published as a conference paper at ICLR 2026
DONOX
EDO
EDO O7
PRODUCTED
PREDUCTED
INAGGES
IAANGEL
SANTEERE TAANING HANGE CONEVATOR
IMACE GINERAPOR
INAG
GT
RDD
PRIOKTTD
BWAGER
IMAGEE
TAIGET RMAGE
Figure 3: The EDD Synthetic Training Setup.
Figure 4: The IDD Synthetic Training Setup.
Kalman Filter Kalman (1960). Given continuous input sequence x(t) R. the system evolves hidden state h(t) E R.V through learnable dynamics defined by A RNNN B E Nx1 and projects an output via RII.N trained end-to-end:
K' (t()) = (h(t) + Bx((), y(t) = Ch(t)
Discrete-time dynamics incorporate a timescale A using zero-order hold (ZOH) discretization Gu et al. (2021), resulting in the following discrete updates:
A exp(eppe (A), B (AA) (exp( A) C=C
(2)
hg Alk-1 + Bar
yk:
Cha
Dar
Approximating B via Taylor expansion and D working residual connection yields:
B (exp(A) B (АА)(A))-A-- (AA
AB, yh Cli
Mamba Gu & Dao (2023) dynamically generates B, C, and A from input x E Lx by modeling interactions in long sequences through selective scanning to maintain contextual awareness, where L the input token size and D is the embedding dimension. VMamba Liu et al. (2024) extends this to 2D via Cross-Scan and Cross-Mert operations, where Visual State Space Blocks process sequences along four directions independently and fuse outputs for global spatial modeling.
3.2 BIOTAMPERNET ARCHITECTURE OVERVIEW
BioTTmmerNett is deep Siamese architecture for tampered region localization, consisting of Vision Transformer based Feature Extractor, Siamese Duplication Detector with Affinity-guided SSM attention modules, and lightweight Decoder illustrated in Figure 5. Given pair of input images 31, 22 E R Bx H x x3 with image height and width W, high-dimensional hierarchical feature representations V1, V22 E xxCC are extracted using Vision Transformer pretrained on the four classes of BioFors dataset (classes described in Section 1), where B is the batch size, N = H x W, and C 384 represents the embedding dimension for our proposed Siamese Duplication Detector:
V1 = Feature__eeeeeeee (tabure_EEttaacto(((z))
V22 = Feature (xtruure__ttact((())))
These features are processed by the Si Siaee Dupl i cation Detector module to compute affinity maps, self- and cross-attention features guided by inter-image similarity and duplication cues:
VI. V22 Siamese Duplication Detector(Vi, V22)
(5)
The attention-refined features are decoded into binary tampering mask pairs O, = Decoder(VV)) and O₂ Decoder(VV)) Viz) via convolutional layers that highlight duplicated regions.
3.3 SIAMESE DUPLICATION DETECTOR MODULE
The Siamese Multi-Level Attention (Siamese Duplication Detector) module in Figure is designed to enhance feature representations of paired images by leveraging affinity maps for both self-attention and cross-attention guidance. Given two feature maps V,, V/2 BxNXC the module returns contextually enriched representations V and V for robust duplicate tampering detection.
3

---

Published as a conference paper at ICLR 2026
SIAMESE DUPLICATION DETECTOR MODULE
SEL ATTENTIONN BL BLOCK12
ATTENTION
HE RERMANN
AGGIM
IK DOOK
V1
O
BLOOKKS
QUERY
KEYY VALUE
APFINITY BLOCK
BLOCKS
HULTHHEAD ATTENTION
DECODER
CONVOLUTION
OUT
Ve
TOPL
DISOFTMAL
Oge
21
AIT RINOL
ATTENTION BLOCKO
PLATTEN
CROSS ATTENTION BLOCK
SIANESE DECODER
CLU
AGOGM
KEY
AGSSM GOOKKE
TOPK
DISOPTMMAS
AGBER
NULTHEEAD
CONVOLUTION
Figure 5: Tam architecture: Paired input images are processed through feature extraction, affinity-guided self-attention, cross-attention, followed by decoders to produce binary mask pair.
Affinity Block. Before computing affinities, we first contextualize spatial tokens using selective- scan State Space Model (SSM). Given the feature map E BxxNxx we apply an input-adaptive SSM backbone implemented using the selective scan operator to obtain SSM-encoded features. The affinity matrix Aff Bx Nx N is then constructed over these SSM-encoded representations using the State Space Similarity mechanism introduced in Eq. 2. Specifically, we normalize the term Ch+- where hę- Σラ= BJ zy and n₁ Σÿ= attention is formulated as:
B,, following Gu & Dao (2023). The resulting similarity
Chu Crl
yk
DUk, ha Ala-1 1 Buk
(6)
Equation defines global-context similarity mechanism, where the SSM transition matrix A aggregates contextual information from preceding inputs v and outputs y, for j S k. Normalization by Cr2 ensures the attention weights sum to one. In practice, this recurrence is implemented using the selective scan operator, and the affinity is computed over SSM-encoded features rather than raw transformer outputs. To stabilize affinity estimation, we apply an ELU activation with positive shift and inject spatial inductive bias using Rotary Positional Embeddings (RoPE) Su al. (2024).
RoPE(CL)
RoPE(BA)
C₁, B = ELU(VR) + 1.0, C =
B = [oPP(B.)]]]
(7)
(ROPE(C*)])
Finally, the explicit affinity matrix is computed via the dot-product:
Aff, = C Aff, E BXNNN
(8)
This results in structured affinity representation that preserves spatial relationships while maintaining computational efficiency. However, the computed affinity matrix Aff, (for each & E {1,2]) often exhibits dominant diagonal values due high self-correlations. To mitigate this, introduce spatial suppression kernel:
(i 11)3 (j j')²
Ki..j,i'j (i-i) 77)2 + (j
(9)
We apply it via wise modulation: Aff, = Aff, o K, where c denotes Hadamard product. To enforce mutual similarity, we adopt bidirectional softmax strategy inspired by Cheng et al. (2019).
exp(a
exp(aAAf (i..)
Afp (i. Ex exp(aamf
(I.) = Σ. (F
(10)
Aftimall (i, Aff (1. Ante (i.
(11)
4

---

Published as a conference paper at ICLR 2026
AGSSM BLOCK
AFFINITY MAP
SILU
FCour
DROP PATH
FCH
DWCONV,
LINEAR ATTN
DWCONV,
DROP PATH
MLP
NORM
AFFINITY MAP ATTN,
Figure 6: @ffinityMMaphi
flat is processed by the AGSSM Block to generate Affinity_ Map_Atti
Here, a = 5 is a temperature hyperparameter. The refined affinity matrix Aff E N is passed through convolutional refinement module comprising four convolutional layers with SiLU activations, yiclding the final affinity map Sefinit_Maapi E RVNxVN which highlights the top-k most similar regions per spatial location.
Afiidety-Guided Self-Attention. Each input feature map undergoes self-attention via three parallel Affinity-Guin Suiide modules operating on SSM-encoded features (AGSSM) Figure 6. Each AGSSM block is modulated by flattened affinity map Affinity_ _Map fal gw obtained by reshaping the Affinity Lffinit_Maap.-. This flattened representation is directly integrated into the self-attention mechanism as described below:
AffinityMapph flat' Affinity + (Affiityy
(N Bat' )))
& I LinearAtt (ffeaAAtt((NCCCorr////ffffffnfn
)), Affinity_Mapf
z Sefinity_Maphi Bat' DFopPath(FC..u@ a))
Affinity_Man Attn; = x + DWConva (z) + DropPat((MLP(Normms))
(12)
To promote diverse local interactions, three parallel AGSSM blocks are applied and averaged:
AGSSM Self Attme AGSSM,(AffinityyMM Map Mat__Att,)))
(13)
The aggregated representation is reshaped and projected using a 1 x convolution:
AGSSM SeSSM_Self_Pe SelfS_eelftill_
Attn out Convix1 (AGSSM_SS) LerSSMMSeef_Atni
(14)
Affinity maps also enhance cross-view contextual consistency between paired inputs:
AGSSM
= V1 + AGSSM "Mtmn out
AGSSM Attn, = V22 + AGSSM Self 2 out
(15)
Alinity-Guidee Cross-Attention. After celf-attention enhancement, cross-attention is applied to promote interaction between paired features, guided by the projected affinity maps.
In the CrossAttr block, the inputs are first flattened, where Q Flatten(AGSSi) Self Attn;) and K = Flatten Cww.ovixwASSSS SSeff Attnz)) E IR NxC Multi- attention is computed as CrossAttn_Ouaa, MultiHeadAAtn(() K, K), and the result is reshaped back to BBxxxxx
Vi' AGSSM__Sef__ae CrossAttn (AGSSSSSSSSSAAA.A
Conv SeGSSM_SSll_Auunn
V AGSSM Self Aetf_ CrossAttn (AGSSM Self Self_Attng C Attf_AAttt/
(16)
Proposition (Cross-Viww Duplication Alignment Under Affinity-Gideed Attention). Let
Vi, 1/2 E R Nxd denote patch embeddings extracted from two image views. The affinity-guided cross-attention update is defined as:
V Vi a (WvVa),
5

---

Published as a conference paper at ICLR 2026
where Wv Rdxd is the learned value-projection matrix and Softmax(A) with
A = (Wq (W + A,
where Wo, WK E lddd are the query/key projection matrices and A is the affinity-guidance term derived from the AGSSM similarity module.
For patch i in V1, suppose there exists duplicated counterpart, j in V22 such that the affinitygguided similarity satisfies the margin condition
Aij 2 Aa +
Vk + j.
for some Then the cross-attention update satisfies
[[V((() (V) + Wvv2(()) || - 6,
where
auk [[Vv))())) Vv
Softmax(A))
Thus, when the margin 8 is sufficiently large, the dffinity-guidee aross-attention for patch is dominated by its duplicated counterpart j. yielding an update that is close Vi (1) + Wv
Proof. The cross-attention update for patch i is
Vi( = (1) +
Wv
Softmax(A A).
h=1
Let j be the duplicated patch corresponding to i. Subtracting and adding Wy V2(i) yields: Vi((i) - (Vi Wv
an (WrV2(k)) Wv))())
Taking norms both sides and using the triangle inequality: Vi(()) - (1) + WvVs()) <
Oak Wi WvV0()]|
It remains to analyze agk. The dffiintyy-guide score margin Aij 2 As + 5 implies:
Any
Au+
5
Ogi
Em Asm
Σm Adim
Thus, as increases, Ogy sharply dominates all askk for k + j. making the residual term e small. Hence the update is numerically dominated by Wy V2j), resulting in the stated bound.
3.4 SIAMESE DECODER
Each decoder branch maps the enriched features V and V to binary tampering masks using lightweight convolutional head. Specifically, each feature V is processed through an intermediate stacked convolutional layers module é. This is followed by 1 x 1 convolution and a sigmoid activation a to produce a single-channel probability map. The result is then upsampled via bilinear interpolation to match the original image resolution:
0, Upsample(a(Conmy (Con))x((((())))
(17)
3.5
TRAINING DETAILS
Input images are resized to 224 x 224. Feature hierarchies span from 4096 x 4096 to 40 x 40.
Training minimizes weighted sum of binary cross-entropy losses:
L = Weell_am Lielf + Weross_ant alt Cenes + Wiused BBCE
ffused
(18)
where LACE denotes binary segmentation loss at each output stage.
We initialize with ViT-Base encoder pretrained on ImageNet-1k and optimize using AdamW 10-4 learning rate). BioTTameerNet is pretrained for 74 epochs on synthetic triplet patches and fine-tuned for 100 epochs on BioFors for External Duplication Detection (EDD), For Internal Duplication Detection (IDD) and Cut/Sharp Transition Detection (CSTD), images are split based on duplication masks. Early stopping and cosine learning decay applied.

---

Published as a conference paper at ICLR 2026
Table 1: Image and Pixel level MCC scores for EDD and IDD on the BioFors test set from retracted publications. All models are trained on the BioFors train set. Best in bold, Second best underlined.
Easerual Duplication Detection (EDD)
Internal Duplication Detection (ID))
Method
BlsuGe Pool
FACS Pivel
Combined Piat
Macrosoupy Piuel
Camhined Pioel
Imagg
Piuel
Pood
Pivel
Irouge
Piurl
SIF Taevan
0.130
0.145
0.113
01145
0.130
0.01
0.110
0.755
0.842
0.132
088
0.319
01342
0.887
01127
0.126
0.226
0.209
0.187
0.207
0.252
0.255
0.227
0.135
0.180
0.44
0.180
0.515
0.449
0.564
0.353
0.543
035
0.361
0258
0.185
0.78
0.310
0.34
DF #CTrccn
0.764
0,202
0.528
0.466
0.712
0.487
0,507
0.364
Di-IMTnassss
0.618
0.167
0.440
0.400
0.325
11.08
1.99
11316
0.181
0.178
0.276
0.076
01011
1.399
0.00
0.264
0.10
0.337
0.21
0.317
0.094
0.133
UR8
0.323
0.235
0.547
0.352
0.379
0.000
0.310
0.150
0.308
0.35
8.435
0.395
0,532
13507
0,362
0.331
0.256
0.313
0.41%
0.412
Sparse Fasstoos
0.384
0.269
0.482
01.00
0.271
0.371
0.76
0.200
0.378
0.286
0.342
0.211
0.356
0.112
0.331
0.305
0.543
0.211
EamperNet
0.739
0.48
0.672
0.589
0.743
0.377
8.62
0.448
0.781
0.326
0.327
0.336
0.681
0.617
0.701
0.534
4 EXPERIMENTAL EVALUATION
4.1 DATASET AND METRICS
We conduct our experiments on the BioFors Sabir et al. (2021) dataset, which includes 30,536 training images and 17,269 test images. The dataset is categorized into four distinct image types: Microscopy. Blot/Gel, Macroscopy, and Fluorescence- Activated Cell Sorting (FACS). BioTameerNet achieves state-of-the-art performance across all four categories as well as the combined set for the EDD, IDD and CSTD tasks, as shown in Table 1 and Appendix. Since the FACS subset does not contain internal duplication (IDD) cases, we evaluate Bio'TmmeeNett on the remaining three categories for IDD, as reported in Table 1. Each category presents unique semantic content and domain- specific visual characteristics, introducing diverse challenges for detection. We follow the evaluation protocol of Sabir et al. (2021), assessing performance at both the image and pixel levels. Image- level metrics are computed using binary labels per image, while pixel-level evaluation aggregates detection results across all pixels. We further evaluated two synthetic scientific integrity benchmarks RSIID Cardenuto & Rocha (2022) (4,912 Microscopy test images), Western Blots Manjunath et al. (2024) (6,146 test images) and reported ofte-of-thheaar performance in Table 2(c). We report the Matthews Correlation Coefficient (MCC) Chicco & Jurman (2020) for consistency with prior work.
4.2 RESULTS AND ANALYSIS
We achieve tate-offthheart performance on the BioFors Sabir et al. (2021) test set-comprising real-world duplication forgeries from retracted scientific across EDD, IDD and CSTD tasks (Tables 1, 2(a)). Unlike MONet Sabir et al. (2022), which is limited to EDD and performs comparably to earlier baselines, BioTameerNet consistently outperforms across all biomedical image types- types-microoe micesscccos,.pyy blot/gel, FACS, macroscopy and all combined. Dense feature matching methods (DF-ZM, DF-PCT Cozzolino et al. (2015)) surpass traditional keypoint- descriptor techniques (DCT Fridrich et al. (2003), DWT Bashar et al. (2010), Zernike Ryu al. (2010)) and low-level feature models like Trufor Guillaro et al. (2023), SpT Su et al. (2025), ManTra-Net Wu et al. (2019), though their efficacy is limited by repetitive biomedical patterns.
demonstrating robust results
Bio' Tem is uniquely capable of localizing both duplicated regions and their corresponding sources, as illustrated in Figure 7-a capability rarely supported by existing forensic approaches. Conventional deep learning models Wu et al. (2019); Islam et al. (2020); Sabir et al. (2022); Guillaro al. (2023); Su et al. (2025), primarily trained for splicing detection, are tailored capture low- level manipulation artifacts. Consequently. they struggle with duplication- based manipulations in biomedical images. As shown in Figure 7(a), BioTammerNet accurately predicts both source and target regions in alignment with the ground-truth masks. In contrast, Wu et al. (2019) fails to distinguish duplication structure, capturing only low-level artifacts. Similarly, Sabir al. (2021) and Guillaro et al. (2023) rely on patch-level comparisons and noiseprint features, causing frequent misdetections.
Figure 7(b) shows IDD results using both single-image and paired-image inputs. This dual evaluation is necessary because existing methods Wu et al. (2019); Islam et al. (2020); Guillaro et al. (2023) are designed to localize only target forgeries from single images, whereas Bio BiomameeNNet is explicitly built to localize both source and target regions using paired inputs. As observed, Guillaro al. (2023) generates numerous false positives due to the misclassification of structured biomedical textures as tampered regions from noiseprint-basee extracted features. Wu et al. (2019) captures superficial
7

---

Published as a conference paper at ICLR 2026
Figure 7:
Qualitative results (a) EDD (b) IDD. Zoom in to view untampered, source, target regions.
Table 2: Additional Evaluation on CSTD, Classification and Scientific Integrity Synthetic Benchmarks
(RSIID Cardenuto & Rocha (2022), Western Blots Manjunath et (2024))
(a) CSTD Detection on BioFors
(b) Classification Accuracy
(c) Scientific Integrity Synthetic (Pixel-level MCC)
F1
MCC
Model
Train
Method
RSUD
Western Blots
Arg.
Method
Image]
Image|
RedNe
93%
97.47%
ManTraNot
0.462
0.196
0,284
VIT MedSaam
98.5 09.699%
98.42%
TruFor
0.825
0.457
0.553
MarTraNer
0.253
0.090
0.170
0.080
99.63%
99.54%
SparseVIT
0.842
0.739
0.612
Thilfor
0.311
0.104
0.173
0.092
BieaaamerNer
0.965
0.628
BioThmperNeet
0.537
0.378
0.514
0.346
low-level features without contextual understanding, and Islam et al. (2020) fails detect coherent duplication patterns. In contrast, BioTamperNet robustly localizes both source and target regions with high spatial accuracy, even in challenging IDD scenarios.
This superior performance arises from Tampemee jointly modeling affinity-guided self-attention and duplication-awarr cues-capabilities that lacking in prior deep learning and traditional keypoint-desscrittrr-bss methods, which primarily focus on RGB, frequency artifacts or boundary inconsistencies. For BioFors classification (Table 2(b)), the ImageNet-pretraingg highest accuracy, likely due to superior global context modeling leveraged in Eqn 4. Timpareer the first set baselines for IDD and CSTD and achieves offte-of-the-ar forgery detection with single and paired inputs across all three tasks and synthetic biomedical datasets (Table 2(c)).
ViT achieves the
4.3 ROBUSTNESS ANALYSIS
To assess resilience under perturbations, evaluate BioTTmmeerNet and competitors BioFors Sabir et al. (2021). As shown in Figure 9, BioTTamperNet consistently outperforms others, showing robust- to brightness change, JPEG compression, contrast adjustment, and noise. While BioTamperNet emphasizes localized contextual modeling, we also test lightweight Global SSM layer after affinity- guided enrichment to extend long-range reasoning. Yet, since biomedical duplications are usually local or moderately displaced, global modeling adds little, yielding marginal changes (Table 3); further analysis is in the appendix.
4.4
ABLATION STUDIES
4.4.1
WHY BIOTAMPERNET TAILORED FOR BIOMEDICAL FORENSICS
Bio'emmpeNeet addresses unique challenges in biomedical image forensics, including structurally repetitive duplications (e.g., cell clusters, gel bands), low-texture environments, and modality incon- sistencies that cause traditional copy-move detectors and ViT to overfit or forget previously learned patterns- akin catastrophic forgetting. To mitigate this, Biomarertee combines affinity-guide Siamese attention modules that explicitly model source-target duplication relationships with SSMs that offer superior long-range context modeling and convergence in low-data regimes. Unlike VIT or CNN backbones, SSMs maintain temporal continuity across spatial axes without requiring large training corpora. Additionally, domain-specific normalization stabilizes learning across microscopy, blot/gel, and macroscopy without separate models or modality-wise fine-tuning. We ablate key components of Bio BioTTmmerNeet to assess their role. Replacing the SSM with 4-layer CNN (w/o SSM (CNN)) restricts the receptive field and weakens global consistency. Alternatively, substituting with a 4-layer ViT encoder (w/o SSM (ViT-MHA)) using multi-hee attention and two-layer MLP blocks impairs convergence in data-sparse scenarios. As shown in Table 3, removing affinity or SSM
8

---

Published as a conference paper at ICLR 2026
Table MCC for TampereNt EDD Ablation. Figure 8: Limitations in EDD, IDD, and CSTD.
PROME IMAGE PAIR
GROUNDTRUTH MASKS
BIOTAMPERNET MASKS
Model
Mieroscopy
Blot/Gel Macroscopy
wio Affinity
0.421
0.462
w/o
wfo SSM (VIT-MHA)
0.407
0.466
0.445
w/o Self-Attn
0.451
0,509
0.492
wio Cross-Attn
0.444
0.497
0.481
w/ LayerNorm
0.439
0.492
0.476
Bio Tamperperet (Full)
0.487
0.589
0.577
Global SSM
0.467
0.539
0.580
Table 4: MCC for Cross-Modalls Fine- Finennuning Ablation on EDD.
Figure 9: Forgery Robustness under attacks on BioFors.
humes of Bugery Detoclin Netbods Solecte Alliska (Btater))
Source
Target
Avg.
Model
Microscopy
BloUGel
Retention
Naive Fine Tuning
0.387
0.409
0.398
+ Frozen Affinity
0.430
0.424
0.427
BloTamperNet 0.487
0.589
0.538
components consistently reduces MCC across modalities, validating the architecture's 's effectiveness in preserving cross-modality generalization while avoiding collapse from domain shifts.
4.4.2 CROSS-MODANE FINE-TUNING CATASTROPHIC FORGETTING
We investigate the effect of training BioTamperNNe on one biomedical modality (e.g., microscopy) and fine-tuning on another (e.g., blot/gel), simulating domain expansion scenarios common in biomedical deployments. We compare three variants: (i) naive fine-tuning without batch normalization adaptation, (ii) fine-tuning with frozen aefinity-guiden modules but re-learned SSMs, and (iii) our full Bio BioTamperNet with domain-adaptive batch normalization. Metries are computed on both source and target domains to assess retention and adaptation. shown in Table 4, naive fine-tuning suffers from catastrophic forgetting (-17.2% drop in source MCC), whereas our full model maintains balanced performance, confirming its biomedical robustness. Additional ablation results are supplementary.
4.5 MODEL COMPLEXITY COMPARISON
Tio performs affinity computation on a compact 40 x 40 token grid 1600) where the full N N operation adds only =1.0 GFLOPs (< 4% of total cost). As shown in Table 5, the model uses 36.7M parameters and 29.6 GFLOPs for a 512x512 input, making it lighter than detectors such as TruFor and Sparse ViT while achieving stronger accuracy. This efficient design highlights BioTamperNet's scalability and suitability for high- high-fidelity and real-time forensic workloads.
4.6 LIMITATIONS AND FUTURE WORK
Despite strong performance, TampereNe exhibits three notable failure modes: (i) perfectly
overlapping source-target regions where duplication boundaries vanish (Fig. 8, row 1); (ii) false positives in highly repetitive textures or clustered biomedical structures (row 2); and (iii) Blot/Gel images with dense stains and small-scale CSTD masks that reduce boundary contrast (row 3). To address these issues, we propose overlap-aware post-processing and auxiliary boundary heads for (i), enhanced with sycle-consistency and uniqueness regularizers and frequency-avee filtering to preserve duplication boundaries; semantic regularization via adaptive thresholding, entropy-based hard-negative mining, 2D RoPE integration, and localized non-max suppression for (ii) to suppress spurious matches in repetitive patterns: and invariinvariat augmentations combined with multi- scale feature refinement and grayscale-focuse preprocessing for (iii) to improve detection of weak boundaries under chemical noise. Future work will extend Tampenett to video-level forgery detection by incorporating temporal attention and spatio-temporal consistency constraints.

---

Published as a conference paper at ICLR 2026
Figure 10: BioTamperNet Aflinity Heatmaps.
Table 5: Model complexity comparison.
FORGED IMAG!
SALINI MAP CROSS APFINIT MAP SOURCE TARGET MASE
Method
Backhone
Input
Params
FLOPs
BusterNet
VGG
256 x 256
15.5M
45.7G
ManTraNet
256 256
274.0G
MONet
ResNet
512 512
31.0M
78.0G
TruFor
VIT
512 512
68.7M
236.5G
McCISCOM
SparseVIT
VIT
512 x 512
50.3M
46.2G
BioTameerNet
SSM
512 x 512
36.7M
29.6G
The affinity heatmaps in Fig. 10 offer interpretable view by showing: (1) self-affinity revealing similar structures, (2) cross-affinitg highlighting source target duplication links, and (3) ground untampered, source, and target regions across biomedical modal- ities. These cues demonstrate BioTamperNert ability to find similar patterns and refine duplicate detection.
5 RELATED WORK
Biomedical Image Forensies and Research Misrepresentation. Image manipulation in biomedical research is serious, with 3.8% papers containing at least one case Bik et al. (2016). Manual corrections exist, but the growing volume of publications makes this unsustainable. Computer vision has been widely applied to medical imaging tasks such segmentation Shamshad et al. (2023); Heidari et al. (2023); Wu et al. (2022), super-resolution Jeelani et al. (2023), and disease diagnosis Esteva et al. (2021). In contrast, its use in detecting fraudulent scientific content received limited attention. This gap is largely due to the scarcity of large-scale annotated datasets, which hinders the development of robust deep learning models. Early efforts in biomedical forensics include duplication screening Koppers et al. (2017), copy-move forgery detection (CMFD) Bucci (2018), and SIFT-based matching Acuna et al. (2018), but lacking standardized benchmarks like TrainFors Nandi et al. (2023).
Detection in Natural and Biomedical Images. Traditional forgery detectors Lowe (2004); Rublee al. (2011); Calonder et al. (2010); Fridrich et al. (2003) work well natural images but struggle with the subtle textures of biomedical data. Deep splicing in Wu et al. (2019); Sabir et al. (2022); Guillaro al. (2023) and copy-move models Wu al. (2018); Islam al. (2020) still rely mainly on low-level cues, while dense feature matching Cozzolino et al. (2015) remains computationally expensive. BioFors Sabir et al. (2021) introduced unified benchmarks for EDD, IDD, and CSTD, yet recent systems- e.g.. MONet Sabir et al. (2022) focused on external duplications and URN Lin al. (2024) tailored for splicing- -ffer limited transfer to the diverse, duplication-centric manipulations found in biomedical figures. In contrast, Bampamper provides purpose-built, unified architecture that handles both source and duplicated regions across modalities with significantly improved accuracy and efficiency, addressing the shortcomings of prior approaches.
Duplication
State Space Models for Vision Tasks. Structured State Space Models (SSMs) such as S4 Gu et al. (2021) and Mamba Gu & Dao (2023), Mamba2 Dao & Gu (2024) model long-range dependencies efficiently and have recently been extended to vision applications Zhu et al. (2024); Liu et al. (2024). gating and block structure-the
MILA Han et al. (2024) further analyzes design factors- distinguish effective SSMs from linear-attention Transformers. However, these general-purpon models lack the task-specific structure needed for fine-grained forgery analysis. We adapt SSMs for duplication localization, yielding improved accuracy and efficiency for biomedical forensics.
CONCLUSION
We presented Bio Siomperrr,,, unified framework for detecting both external and internal duplications in biomedical images. By leveraging affinity- self-attention and cross-attention modules built on linear approximations of State Space Models (SSMs), BioTamperNNe efficiently captures fine- grained correspondences and semantic inconsistencies across paired views. Extensive experiments on retracted and synthetic datasets demonstrate that our method achieves fate--of-the-at localization performance while remaining lightweight and modular. Pretraining on adversarially augmented synthetic tampering datasets further improves performance BioFors by enhancing robustness to diverse manipulation patterns. Our approach simplifies forgery detection by unifying paired-imag and single-image localization within single architecture.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Daniel E Acuna, Paul S Brookes, and Konrad P Kording. Bioscience-scale automated detection of figure element reuse. BioRxiv, pp. 269415, 2018.
M Bashar, K Noda, Ohnishi, and K Mori. Exploring duplicated regions in natural images. IEEE Transactions Image Processing, 2010.
Elisabeth M Bik, Arturo Casadevall, and Ferric C Fang- The prevalence of inappropriate image
duplication in biomedical research publications. MBio, 7(3):10-1128, 2016.
Elisabeth M Bik, Ferric C Fang, Amy L Kullas, Roger J Davis, and Arturo Casadevall. Analysis and correction of inappropriate image duplication: the molecular and cellular biology experience. Molecular and cellular biology, 2018.
Enrico M Bucci. Automatic detection of image manipulations in the biomedical literature. Cell death & disease, 933):000, 2018.
Michael Calonder, Vincent Lepetit, Christoph Strecha, and Pascal Fua. Brief: Binary robust inde- pendent elementary features. Computer Vision-ECCV 2010: 11th European Conference on Computer Vision, Heraklion, Crete, Greece, September 5-11, 2010, Proceedings, Part IV 11, pp. 778-792. Springer, 2010.
João P Cardenuto and Anderson Rocha. Benchmarking scientific image forgery detectors. Science and Engineering Ethics, 28(4):35, 2022.
Jiaxin Cheng, Yue Wu, Wacl AbdAlmageed, and Premkumar Natarajan. Qatm:
Quality-aware template matching for deep learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2019.
Davide Chicco and Giuseppe Jurman. The advantages of the matthews correlation coefficient (mec) over fl score and accuracy in binary classification evaluation. BMC genomics, 21:1-13, 2020.
Davide Cozzolino, Giovanni Poggi, and Luisa Verdoliva. Efficient dense-field copy-move forgery detection. IEEE Transactions on Information Forensics and Security.
2015.
Tri Dao and Albert Gu. Transformers are SSMs: Generalized models and efficient algorithms through structured state space duality. In International Conference on Machine Learning (ICML), 2024.
Andre Esteva, Katherine Chou, Serena Yeung, Nikhil Naik, Ali Madani, Ali Mottaghi, Yun Liu, Eric Topol, Jeff Dean, and Richard Socher. Deep learning-enabled medical computer vision. NPJ digital medicine, 4(1 4(1):5, 2021.
Jessica Fridrich, David Soukal, Jan Lukas, et al. Detection of copy-move forgery in digital images. In Proceedings of digital forensic research workshop, volume pp. 652-63. Cleveland, OH, 2003.
Albert Gu and Tri Dao. Mamba: Linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:23/2.0072 2023.
Albert Gu. Karan Goel, and Christopher Ré. Efficiently modeling long sequences with structured state spaces. arXiv preprint arXiv:2/ 1100/11100000 2021.
Fabrizio Guillaro, Davide Cozzolino, Avneesh Sud, Nicholas Dufour, and Luisa Verdoliva. Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization. In Proceedings of the IEFF/CVF conference computer vision and paltern recognition, pp. 20606-20615, 2023.
Dongehen Han, Ziyi Wang. Zhuofan Xia, Yizeng Han, Yifan Pu, Chunjiang Ge, Jun Song, Shiji Song. Bo Zheng, and Gao Huang. Demystify mamba in vision: A linear attention perspective. In NeurlPS, 2024.
Moein Heidari, Amirhossein Kazerouni, Milad Soltany, Reza Azad, Ehsan Khodapanah Aghdam, Julien Cohen-Adad and Dorit Merhof. Hiformer: Hierarchical multi-scale representations using transformers for medical image segmentation. Proceedings of the IEEE/CVF winter conference applications of computer vision, pp. 6202-6212, 2023.

---

Published as a conference paper at ICLR 2026
Ashraful Islam, Chengjiang Long, Arslan Basharat, and Anthony Hoogs. Doa-gan: Dual-orde attentive generative adversarial network for image copy-move forgery detection and localization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.
4676-4685, 2020.
Mehran Jeelani, Noshaba Cheema, Klaus Illgne--Fehns, Philipp Slusallek, Sunil Jaiswal, et al.
Expanding synthetic real-world degradations for blind video super resolution. In Proceedings of the JEEE/CVF conference on computer vision and pattern recognition, pp. 1199-1208, 2023.
Rudolph Emil Kalman. A new approach to linear filtering and prediction problems. 1960.
Lars Koppers, Holger Wormer, and Katja Ickstadt. Towards a systematic screening tool for quality as- surance and semiautomatic fraud detection for images in the life sciences. Science and engineering ethics, 113-):11,3-1128, 1328,28, 2017.
Xun Lin, Wenzhong Tang. Haoran Wang, Yizhong Liu, Yakun Ju, Shuai Wang, and Zitong Yu. Ex- posing image splicing traces in scientific publications via uncertainty-guinn refinement. Patterns, 5(9), 2024.
Yue Liu, Yunjie Tian, Yuzhong Zhao, Hongtian Yu, Lingxi Xie, Yaowei Wang. Qixiang Ye, and Yunfan Liu. Vmamba: Visual state space model. arXiv preprint arXiv:2401.10166 2024.
David G Lowe. Distinetive image features from scale-invariant keypoints. International journal of computer vision, 60:91-110, 2004.
Anmol Manjunath, Viola Negroni, Sara Mandelli, Daniel Moreira, and Paolo Bestagini. Localization of synthetic manipulations in western blot images. In 2024 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-6. IEEE, 2024.
Tsuyoshi Miyakawa. No raw data, science: another possible source of the reproducibility crisis, 2020.
Soumyaroop Nandi, Prem Natarajan, and Wael Abd-Almagced. Trainfors: A large benchmark training dataset for image manipulation detection and localization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 403-414, 2023.
Ethan Rublee, Vincent Rabaud, Kurt Konolige, and Gary Bradski. Orb: efficient alternative to sift or surf. In 201 International conference on computer vision, pp. 2564-2571. leee, 2011.
Seung-Jin Ryu, Min-Jeong Lee, and Heung- Kyu Lee. Detection of copy-rotate-movy forgery using zernike moments. In Information Hiding: 12th International Conference, 2010, Calgary, AB, Canada, June 28-30, 2010, Revised Selected Pupers 12, pp. 51-65. Springer, 2010.
Ekraam Sabir, Soumyaroop Nandi, Wacl Abd-Almageed, and Prem Natarajan. Biofors: A large biomedical image forensics dataset. Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 10963-10973, 2021.
Ekraam Sabir, Soumyaroop Nandi, Wael AbdAlmageed. and Prem Natarajan. Monet: Multi-scale overlap network for duplication detection biomedical images. In 2022 IEEE International Conference Image Processing (ICIP), pp. 7793-3797. IEFF, 2022.
Fahad Shamshad, Salman Khan, Syed Waqas Zamir, Muhammad Haris Khan, Munawar Hayat, Fahad Shahbaz Khan, and Huazhu Fu. Transformers in medical imaging: A survey. Medical image analysis, 88: 102802, 2023.
Andrew M Stern, Arturo Casadevall, R Grant Steen, and Ferric C Fang. Financial costs and personal consequences of research misconduct resulting in retracted publications. Elife. 3:e02956, 2014.
Jianlin Su, Murtadha Ahmed, Yu Lu, Shengfeng Pan, Wen Bo, and Yunfeng Liu. Roformer: Enhanced transformer with rotary position embedding. Neurocomputing. 568: 127063, 2024.
Lei Su, Xiaochen Ma, Xuekang Zhu, Chaoqun Niu, Zeyu Lei, and Ji-Zhe Zhou. Can we get parameter-efficien
rid of handcrafted feature extractors? sparsevit: Nonsemantics-cemten image manipulation localization through spare-coding transformer. In Proceedings of the AAA! Conference Artificial Intelligence, volume 39, pp. 7024-7032, 2025.
12

---

Published as a conference paper at ICLR 2026
Huisi Wu, Shihuai Chen, Guilian Chen, Wei Wang, Baiying Lei, and Zhenkun Wen. Fat-net: Feature adaptive transformers for automated skin lesion segmentation. Medical image analysis, 76:102327, 2022.
Yue Wu, Wael Abd-Almageed, and Prem Natarajan. Busternet: Detecting copy-move image forgery with source/target localization. In Proceedings of the European conference on computer vision (ECCV), pp. 168-184, 2018.
Yue Wu, Wael AbdAlmageed, and Premkumar Natarajan. Mantra-net: Manipulation tracing network for detection and localization of image forgeries with anomalous features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9543-9552, 2019.
Lianghui Zhu, Bencheng Liao, Qian Zhang, Xinlong Wang, Wenyu Liu, and Xinggang Wang. Vision mamba: Efficient visual representation learning with bidirectional state space model. arXiv preprint arXiv:2401009417, 2024.
13


Reviews:
[{"review_id": "amRkXXiC0u", "reviewer": "Reviewer_ZM5M", "summary": "This paper proposes BioTamperNet, a unified framework for detecting duplicated regions in tampered biomedical images. The authors generate synthetic forgeries to train their model, as real forged training data is unavailable, and claim state-of-the-art performance on the BioFors test set of real manipulated images.", "questions": "1) The paper claims to use State Space Models (SSMs), but the method only uses linear similarity (Equations 6–8) without key SSM components like selective scan or input-dependent parameters. Where exactly are SSMs used? If it’s just linear attention, why call it SSM-based?\n\n2) All training data is synthetic (geometric transforms + GANs), but real biomedical forgeries may have complex patterns not covered by synthesis. Is there evidence that the high performance isn’t just due to accidental alignment between synthetic training and real test forgeries?\n\n3) The ablation study is weak. Table 3 only removes modules but doesn’t test: (a) the benefit of the “pseudo-pair” strategy vs training separate models; (b) whether the proposed affinity-guided attention is better than standard linear attention.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 1, "contribution": 2, "strengths": "The main strength is that the paper proposes a unified framework that simultaneously handles EDD, IDD, and CSTD in biomedical images by converting single-image tasks into pseudo image pairs, enabling one model to support all three forgery detection tasks without architectural changes.", "weaknesses": "1) The paper has poor writing and organization. The training dataset description should move from Section 2 to the experimental setup.  \n2) State Space Models are basic model to the proposed method. Section 2 should be renamed “Preliminaries” and include SSMs.  \n3) The paper claims BioTamperNet uses affinity-guided SSM attention modules but gives no clear explanation of how they integrate with or adapt SSMs.  \n4) Tables list baseline methods without citations which hurts readability and reproducibility.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WmWWIOn1qw", "reviewer": "Reviewer_grFH", "summary": "This paper addresses the critical and increasingly relevant problem of forgery detection in biomedical images. The authors propose a unified framework, BIOTAMPERNET, designed to detect various manipulation types, including copy-move, splicing, and inpainting.", "questions": "See Weaknesses.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The motivation is good, as the authors correctly identify the potentially severe long-term consequences of tampering in the biomedical domain, which could be as, if not more, damaging than in the natural image domain. The paper presents a commendable application and includes extensive comparisons against a range of existing methods.", "weaknesses": "Despite its promising direction, the manuscript suffers from several major flaws in its current form that significantly weaken its conclusions. These concerns relate to the validity of the experimental evaluation, the rigor of the theoretical claims, the completeness of the literature review, and the clarity of the methodology and figures. \n\n1. The evaluation protocol: The authors state that the BioFors dataset provides annotations in the form of bounding boxes, not precise pixel-level masks. However, the paper insists on using pixel-level segmentation metrics to evaluate the model's performance.\n\n2. The literature review overlooks recent and highly relevant work in the field of scientific image forgery detection. For example, the paper fails to compare against [r1] URN (Uncertainty-guided Refinement Network), a method explicitly designed to expose image splicing in scientific publications. Furthermore, the associated SciSp dataset introduced in [r1] is not considered.\n\n[r1] Exposing Image Splicing Traces in Scientific Publications via Uncertainty-guided Refinement. Patterns 2024.\n\n3. The authors present Proposition 1 and a corresponding Proof to justify their Cross-View Duplication Detection mechanism. However, I must point out that the provided text is not a formal proof but rather an intuitive, high-level description of the module's intended behavior. It suffers from several critical flaws:\n\n    (1) The entire argument relies on qualitative language (\"emphasizes,\" \"mainly attends to,\" \"close to\") and the use of an approximation symbol in the proposition itself. A formal proof would require precise definitions, equalities, or explicitly bounded inequalities, none of which are present. \n\n    (2) The proof's cornerstone is the assumption that \"position i attends mainly to j.\" This is precisely what the module is supposed to achieve, and thus cannot be used as a premise. This argument borders on circular reasoning. It also fails to consider practical scenarios, such as the presence of multiple similar patches (distractors) that would dilute the attention weights, invalidating the claim that the output is \"close to Linear(V_2(j))\".\n\n    (3) Key components like AGSSM_Self_Attn, Linear, and the \"projected cross-view affinity\" are treated as black boxes. Without formal definitions, the proposition is unverifiable.\n\n\n4. The BioFors dataset is known to have a severe class imbalance between tampered and authentic samples. A naive training approach would likely result in a model that defaults to predicting \"authentic,\" as this would easily minimize the training loss. The authors do not specify how they address this critical issue. Furthermore, other implementation details appear to be missing.\n\n5. In Section 4.4.1, the authors claim that modality inconsistencies can cause a ViT to overfit or forget the learned patterns. This is a strong assertion made without sufficient evidence or rigorous analysis. For instance, CLIP, which is also based on a ViT architecture, successfully handles a wide range of modalities (e.g., RGB, depth, infrared) without the \"forgetting\" phenomenon described.\n\n6. The organization of Figures 3 and 4 is confusing. At first glance, it appears that the same input is fed into BIOTAMPERNET and then produced as an output. The transition labeled \"IDD TO EDD\" in Figure 4 is difficult to understand without multiple readings. These figures should be redesigned to clearly illustrate the model's workflow, distinguishing between inputs, intermediate representations, and final outputs.\n\n7. Several details in Figure 1 hinder comprehension. For example: (1) In the AFFINITY BLOCK, it is unclear if both V1 and V2 are inputs to the ELU function; the arrows do not clearly indicate this. (2) The diagram does not explicitly show how the data flow differs for IDD versus CSTD. The authors should revise Figure 1 with clearer arrows and layout to precisely trace the data paths for different forgery types.\n\n8. The quality of the samples generated by the proposed Synthetic Training seems to be relatively low and may not always be semantically consistent with real biomedical images. This raises a question: could this online data augmentation technique also improve the performance of other baseline methods? An ablation study applying this augmentation to one or two baseline methods would be very insightful. It would help determine if the performance gain is a general benefit of the augmentation strategy or if it is uniquely synergistic with the proposed architecture.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Y1ptqkt3dm", "reviewer": "Reviewer_hTED", "summary": "This article provides an original and empirically validated method for biomedical image tampering detection. But its clarity, interpretability, and wider comparability need to be further improved to enhance its readability and credibility.", "questions": "1、How robust is BioTamperNet to real-world artifacts such as illumination changes, JPEG compression, or partial occlusion—especially when no duplicated texture is visible?\n\n2、Could the authors provide interpretability analysis (e.g., affinity heatmaps, attention rollouts) to demonstrate what visual cues the model relies on when detecting duplications?\n\n3、How does BioTamperNet generalize when trained purely on synthetic duplications but evaluated on unseen real manipulations, such as retouched microscopy or gel bands?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "This work presents a novel and unified framework for tampering detection in biomedical images. The key innovation lies in its integration of affinity-guided attention with state-space models, yielding a computationally efficient and high-performing architecture. Extensive experiments across diverse biomedical modalities and benchmarks demonstrate clear superiority over prior works", "weaknesses": "1、The affinity-guided attention mechanism is conceptually appealing, but lacks qualitative visualizations (e.g., attention heatmaps, affinity evolution) that illustrate how the model distinguishes genuine vs tampered regions.\n\n2、The model’s training relies heavily on synthetic duplications and GAN-generated patches. This may cause domain shift when applied to real, unannotated biomedical images.\n\n3、Some equations and architectural diagrams are dense, reducing accessibility for readers. Section 3 could be reorganized with clearer sub-figures and step-by-step pseudocode.\n\n4、The paper primarily compares to traditional forensic or transformer methods, but omits recent vision SSMs (e.g., Vision Mamba, S4ND) that could provide meaningful context.\n\n5、 The anonymous code link provided by the author returns a 404 error.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gfPcNBALL9", "reviewer": "Reviewer_dVdC", "summary": "This paper introduces BioTamperNet, a new deep learning model for detecting tampering in biomedical images. The authors target the poor performance of existing forensic models on specific biomedical data (microscopy, blots, etc.). The model uses an \"affinity-guided\" attention mechanism, reportedly inspired by State Space Models, to capture similarities. This includes both a self-attention module for intra-image similarities and a cross-attention module for inter-image correspondences . The main contribution is a unified architecture designed to handle three distinct tasks: External Duplication Detection, Internal Duplication Detection, and Cut Sharp Transition Detection. The paper claims state-of-the-art (SOTA) results on the BioFors benchmark.", "questions": "1.Regarding the N*N affinity matrix: Can the authors clarify the computational complexity? How can the model be \"efficient\" if it computes this quadratic matrix? Please provide concrete metrics (FLOPs, parameters, inference time) comparing BioTamperNet to the ViT and CNN variants from Table 3.\n\n2. Please provide a precise description of the \"pseudo-pair\" generation for IDD/CSTD. How are the images \"split\"? Did you investigate if this splitting process itself introduces artifacts that the CSTD detector might be learning?\n\n3. Can the authors comment on the large discrepancy between Image-level (0.739) and Pixel-level (0.487) MCC for EDD-Microscopy in Table 1? Does this indicate a failure in precise segmentation, and if so, why?\n\n4. What was the design rationale for using three parallel AGSSM blocks (Eq. 13)? Have the authors ablated this choice (e.g., using one or two blocks)?\n\n5. What was the process for selecting the sigma^2 hyperparameter in the spatial suppression kernel (Eq. 10) ? How sensitive is the model's performance to this value?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "The model's strongest point is its unified design. The strategy to convert single-image tasks into \"pseudo-pairs\" (as shown in Fig. 4) is a clever idea, allowing a single Siamese architecture to handle all three major forgery types\n\nThe affinity-guided attention modules are well-thought-out. The design explicitly models the source-target relationship, which is fundamental to copy-move detection. Details like the spatial suppression kernel (Eq. 10) to handle high self-correlation and the bidirectional softmax (Eq. 11) show a careful approach to the problem \n\nOn paper, the model shows impressive quantitative results, apparently outperforming all baselines by a large margin across all categories in Table 1\n\nThe ablation studies (Table 3) are thorough and effectively demonstrate the utility of each proposed component (the affinity block, the SSM, etc.) . The analysis of catastrophic forgetting during cross-modality fine-tuning (Table 4) is also a valuable addition", "weaknesses": "The model's greatest weakness is its complete reliance on synthetic training data. This raises serious doubts about its real-world performance. The model might just be overfitting to the specific artifacts of the synthetic generation pipeline (e.g., GAN artifacts, specific blending boundaries) rather than learning the semantic inconsistencies of real human-made forgeries.\n\nThe paper's claims of being \"lightweight\" are unsubstantiated and appear contradictory to the methodology. The architecture in Figure 5 is extremely complex. More importantly, the Affinity Block (Section 3.3) computes a full N*N affinity matrix (where N=H*W), which is a computationally prohibitive O(N^2) operation that SSMs are typically designed to avoid\n\nThe \"pseudo-pair\" generation strategy for IDD/CSTD is critically under-described. The paper only states images are \"split into two parts\" (Fig. 4). It is unclear if this is a naive centerline cut, a random cut, or a mask-guided split. This is a crucial detail, as a naive split could introduce new edge artifacts that the CSTD detector might be learning as a spurious cue.\n\nA closer look at the results in Table 1 reveals a significant performance gap. For the EDD Microscopy task, the model achieves a high Image-level MCC (0.739) but a much lower Pixel-level MCC (0.487). This disparity suggests that while the model can successfully flag an image as \"tampered,\" it struggles with the precise pixel-level localization of the forgery, which is arguably the core goal.\n\nThe architecture includes several arbitrary design choices that are not justified by ablation. For instance, the \"Affinity-Guided Self-Attention\" module uses three parallel AGSSM blocks whose outputs are averaged (Eq. 13). There is no explanation for why three blocks are used, or why this averaging approach is superior to a simpler, single block.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)