The paper’s starting point is what Di Giorgio calls the ontological fracture: the gap between the lived, contextual fabric of social reality and the finite vocabulary of variables and categories into which any computational system must translate it. Encoding race as a discrete feature, or substituting the six-point Fitzpatrick skin-type scale in computer vision evaluations, does not dissolve the problem; it merely relocates the decision about which distinctions count as relevant. Two epistemic consequences follow. The first is a resolution limit, which the paper terms epistemic grain: like the grain of photographic film, a model’s feature space determines the finest distinctions it can register, and phenomena below that grain are unavailable in principle to any analysis conducted in the system’s own terms. The second is more insidious. Once categories are fixed, whatever exceeds them registers not as evidence of an inadequate category scheme but as residual error, noise to be reduced with more data. The paper calls this systematic misreading computational fog: the distortions introduced by representational choices are not representable within the representation that produced them. Gender classifiers trained on a binary scheme illustrate the structure, since a person whose identity does not fit the binary confronts an inadequacy of the scheme itself, which the system can only record as noise.

What makes the computational case distinctive, the paper argues, is not abstraction as such, which all modelling shares, but the timing of precisification. Drawing on Friedrich Waismann’s notion of open texture and H.L.A. Hart’s account of legal adjudication, Di Giorgio observes that social concepts such as race, merit, risk and need are never delimited in all possible directions; human decision-makers sharpen them case by case, in view of particulars, and can revise the sharpening when the next case differs. A computational system cannot do this. It fixes the precisification of every open-textured concept once, ex ante, at design time, and applies it uniformly at scale, with no interpreter positioned to notice that the present case exceeds the scheme and re-open it. This also explains why the familiar reassurance that a human remains in the loop underdelivers: an overseer reviewing outputs under the EU AI Act’s Article 14 can check decisions, but cannot re-open the precisification itself, because the information that would motivate re-opening has typically been discarded below the system’s epistemic grain.

The paper’s central contribution is a criterion for deciding when representational discrimination is remediable, borrowed from an unexpected source: the less-discriminatory alternative construct of United States disparate-impact doctrine. In litigation, a challenger who shows a facially neutral policy produces disparate impact can prevail by exhibiting an alternative policy serving the same legitimate purpose with a smaller disparity. Di Giorgio shifts that comparative logic one level up, from models to operationalisations. A disparity is contingent, relative to a legitimate purpose, a measure of disparity, and a class of admissible designs, when some alternative operationalisation within that class serves the purpose while reducing the disparity. It is constitutive when no such alternative exists. Nothing is constitutive in the abstract; every classification is elliptical for the purpose, the disparity measure, and the design space against which it is made. Debates that sound metaphysical, whether a bias is inherent to computation, thereby dissolve into three tractable questions: what the purpose is, what the relevant disparity is, and what the admissible design space actually contains.

The criterion’s logical form carries real teeth. Contingency is verified by exhibition: produce one admissible alternative and the classification is settled. Constitutivity, by contrast, is a negative existential claim, that no alternative exists, and can never be conclusively verified over a design space that is not surveyable. It is established only by provisional exhaustion of the known alternatives and remains permanently open to refutation by a single new exhibit. This asymmetry generates a burden structure: the critic must show contingency by exhibit, while the deployer claiming a disparity is unavoidable owes documented exhaustion of the alternatives considered and the grounds for excluding each. Neither burden is discharged by assertion. The result converts an unfalsifiable rhetorical endpoint into a procedure that specifies in advance what would show any constitutivity claim to be wrong.

Three case studies test the criterion adversarially, and the first delivers a striking reversal. The ImageNet benchmark inherited, from the WordNet lexical taxonomy beneath it, derogatory categories under the person synset, so photographs of real people were assigned to demeaning classes because the conceptual vocabulary admitted them. The bias sat exactly where the paper’s framework looks, in the category scheme itself, upstream of any training, which would ordinarily invite the label constitutive. Yet the criterion returns the opposite verdict: an admissible alternative, filtering and rebalancing the person subtree while preserving the dataset’s benchmarking purpose, was not merely available in principle but actually carried out by researchers in 2020. Upstream, the paper concludes, does not mean constitutive, and the slide from upstream to irremediable is the single most productive source of misclassification in the field.

The second case, tokenisation in large language models, resists a single verdict and forces a decomposition. Byte pair encoding builds vocabularies from corpus statistics, so well-represented languages receive compact tokenisations while under-represented ones fragment into many small units; research shows the same content can require up to fifteen times more tokens in some languages than others, compounding into higher costs, shorter outputs and less context for speakers already economically constrained. The contingent component, attributable to the construction method and allocation policy, has demonstrable remedies. The residual component is subtler: even character-level and byte-level encoding shows more than a fourfold difference in length for some language pairs, reflecting the differing information densities of scripts and the uneven byte costs of UTF-8. Within the class of systems that segment all languages with one shared inventory and price by segment count, every known alternative relocates the disparity rather than eliminating it. The paper classifies that residual layer as constitutive only relative to that class and to current knowledge, hedged exactly as the criterion demands, and refutable by any scheme achieving cross-linguistically uniform encoding costs.

The third pair of cases shows the criterion operating where layers are entangled. Amazon’s abandoned CV-screening tool penalised indicators of being a woman, and neutralising explicit indicators failed against subtler proxies; under the criterion, that documented disparity was contingent along at least one dimension, since outcome-based targets and structured competency assessments exist within the class of automated screening, while the failure of particular remedies counts as evidence about the depth of the disparity, never as proof of inevitability. The clinical case supplies the empirical anchor: Obermeyer and colleagues’ landmark 2019 study found that a widely deployed algorithm operationalising health need as health cost systematically underserved Black patients, because unequal access depresses spending conditional on illness. Re-operationalising the target through measures of health reduced the disparity by 84 percent, a remedy invisible at the model level. The paper even rereads the famous impossibility theorems through this lens: they are a constitutivity result, but one proved relative to a class of designs that holds fixed a population partition and base rates which are themselves representational commitments, not primitives of nature.

The regulatory payoff is a proposal the paper calls ontological auditing: an upstream evaluation of representational choices during design, documented in an Ontological Impact Statement. For each socially consequential construct, the statement would record what the variable purports to represent, which dimensions it excludes, what proxy relationships link it to protected characteristics, which alternative operationalisations were considered and why each was excluded, and, for any disparity the deployer deems unremediable, the parameters and exhaustion supporting that claim. Filed before deployment, such a statement in the clinical case would have exposed the cost-as-need choice while it was still cheap to revise. The paper locates the practice within the EU AI Act’s risk management and data governance provisions, noting that current obligations discipline data quality and outputs but never ask the question disparate-impact doctrine has long asked: was a less-discriminatory way of achieving the same end available? The proposal is explicitly untested, and its administrative cost unknown.

What the framework ultimately buys is a change of register. Only one of the disparities examined is classified as constitutive, and that classification is relative to a class and hedged to current knowledge, because the design space expands with technique and unhedged inevitability claims are exactly what the criterion forbids. Where a representational choice is genuinely forced, the paper asks that the fact be established, documented and weighed openly rather than discovered after deployment. Where it is not forced, and the evidence suggests that is the more common case, the criterion poses the simpler question that the vocabulary of inevitability has tended to obscure: what else could have been built, and why was it not?

Subject of Research: A criterion for distinguishing contingent from constitutive algorithmic discrimination arising from upstream representational choices in AI systems

Article Title: When algorithms cannot be fair: constitutive and contingent discrimination and the limits of less-discriminatory alternatives

Article References: Di Giorgio, A. (2026). When algorithms cannot be fair: constitutive and contingent discrimination and the limits of less-discriminatory alternatives. AI & SOCIETY. https://doi.org/10.1007/s00146-026-03384-0

Image Credits: AI Generated

DOI: 10.1007/s00146-026-03384-0

Keywords: algorithmic fairness, algorithmic discrimination, less-discriminatory alternative, open texture, ontological auditing, EU AI Act, ImageNet, tokenisation, clinical risk scoring, disparate impact, computational opacity, AI & Society

The team, led by Zhuxian Liu of Fujian Agriculture and Forestry University, together with Yunyu Kang and Xiaolong Liu, set out to solve a problem that has long limited the practical value of adversarial attacks. Since researchers first demonstrated that deep neural networks could be deceived by imperceptible perturbations—tiny mathematical nudges to pixel values that cause a classifier to see a gibbon where a human sees a panda—security researchers have explored how such attacks might work in the real world. But most adversarial examples embed what the authors describe as fragile, task-agnostic noise: essentially meaningless static that serves only to disrupt a model’s calculations. Such images carry no useful payload, survive transmission poorly, and offer nothing beyond the act of disruption itself.

StegoAdv-GAN takes a fundamentally different approach. Instead of treating the perturbation as disposable noise, the framework treats it as a carrier of semantically meaningful content. The system is trained end-to-end and consists of three competing neural components: a generator, an extractor, and a discriminator. The generator receives a cover image and a secret payload, and produces a stego-image—an image that looks essentially identical to the original but contains both the adversarial perturbation needed to mislead a target classifier and the embedded secret data. The extractor’s job is to recover that secret payload from the stego-image, even after the image has been processed by the target model or passed through various transformations. The discriminator, meanwhile, tries to distinguish stego-images from natural images, forcing the generator to produce outputs that evade steganalysis, the statistical techniques used to detect hidden data.

This three-way adversarial game is what gives the method its dual functionality. Because all three networks are jointly optimized, the generator cannot simply prioritize one goal at the expense of the other. It must learn perturbations that are simultaneously robust enough to survive real-world conditions and transferable enough to fool models it has never seen, while also encoding a high-capacity secret message that remains extractable on the other end. The authors report that the resulting images maintain high visual fidelity, meaning human observers would find it difficult or impossible to tell that anything unusual is hidden inside them, while the framework achieves what they describe as state-of-the-art performance in both steganographic capacity and attack effectiveness.

The experimental evaluation focused on black-box attack settings, the most challenging and realistic scenario in adversarial machine learning. In a black-box attack, the adversary has no access to the internal parameters, gradients, or architecture of the target model. The attacker can only observe inputs and outputs, which means any adversarial example must transfer across model boundaries. The researchers tested StegoAdv-GAN on two widely used benchmark datasets: Caltech-256, a collection of object photographs spanning 256 categories, and ImageNet1k, the million-image classification benchmark that has anchored computer vision research for over a decade. The framework was evaluated against a battery of well-known classifier architectures, including VGG, ResNet, DenseNet, SqueezeNet, ShuffleNet V2, and Inception-style networks, architectures that span the history of convolutional neural network design from deep plain networks to densely connected and efficiency-optimized models.

The results, according to the paper, show that StegoAdv-GAN achieves superior cross-model transferability compared with prior methods, meaning adversarial images crafted against one model are highly likely to fool other models as well. This property matters enormously in practice, because a real-world attacker rarely knows exactly which model is running behind an application programming interface or an autonomous system. Transferability is also what separates laboratory demonstrations from genuine security threats: an attack that only works against the exact network it was optimized on can be mitigated simply by keeping the model secret, whereas a transferable attack undermines that entire defense strategy.

The work builds on a rich lineage of research. The theoretical foundation of adversarial examples was laid by Ian Goodfellow and colleagues, who explained and harnessed the phenomenon, and by subsequent methods such as DeepFool, the Carlini-Wagner attack, and decision-based attacks that operate without gradient access. Generative approaches to adversary creation, including AdvGAN and its successors, showed that generative networks could produce adversarial perturbations faster and more flexibly than iterative optimization methods. On the steganography side, the field has progressed from simple least-significant-bit substitution, a technique dating back decades in which secret bits replace the lowest-order bits of pixel values, to sophisticated deep learning schemes such as StegoGAN and invertible neural network approaches that can hide entire images inside other images at large capacity. More recently, researchers have begun fusing the two domains, with adversarial watermarking methods like Adv-Watermark, FAWA, and BHI embedding invisible watermarks that double as adversarial perturbations.

What distinguishes StegoAdv-GAN from those earlier fusion attempts, the authors argue, is the combination of robustness, extractability, and capacity within a single jointly trained architecture. Earlier adversarial watermark schemes often produced payloads that degraded when images were resized, compressed, or otherwise processed—the very operations that any image undergoes when shared on social media, transmitted over messaging platforms, or ingested by a web service. By training the extractor alongside the generator under realistic conditions, the new framework aims to ensure the hidden message survives the journey. The authors also point to the semantic meaningfulness of the embedded content as a key advance: rather than random noise, the payload is genuine covert information, which opens the door to scenarios in which the stego-image functions as a covert communication channel that also happens to disrupt automated analysis of the image itself.

The implications cut in several directions at once. For defenders, the work is a warning: content moderation systems, malware-scanning pipelines, and computer-vision-driven security tools cannot assume that a visually innocuous image is harmless, because a single image may now carry both an attack against the AI analyzing it and a hidden message for a human recipient. Detection strategies will need to account for the possibility that adversarial perturbations are not noise-like artifacts but structured, information-bearing signals designed to evade steganalysis. For the steganography community, the paper demonstrates that adversarial objectives, usually viewed purely as threats, can serve as a form of camouflage, since perturbations crafted to fool classifiers may also help hidden data escape statistical detection. And for anyone thinking about the provenance and authenticity of images in the generative AI era, the study adds another layer of complexity to an already difficult problem: the same generative modeling techniques that power synthetic media can also embed layered, dual-purpose payloads that are invisible to both humans and machines.

The research, which was supported in part by the Guangzhou Institute of Science and Technology and a Ministry of Education project in China, remains purely algorithmic, built entirely on publicly available benchmark datasets, and the authors note that no human participants were involved. Its publication in Multimedia Tools and Applications signals that the fusion of steganography and adversarial machine learning is moving from a speculative idea toward a mature research program. As deep neural networks continue to mediate what software sees, reads, and decides, techniques like StegoAdv-GAN make clear that the images flowing through those systems can be far more than they appear: simultaneously a picture, a weapon against the machine that views it, and a sealed letter for whoever knows how to look. The arms race between those who build AI systems and those who seek to deceive them has just acquired a new dimension—one hidden, quite literally, in plain sight.

Subject of Research: Fusion of image steganography and adversarial attacks using generative adversarial networks

Article Title: Generative image steganography fusion with adversarial perturbations based on generative adversarial networks

Article References: Liu, Z., Kang, Y., & Liu, X. (2026). Generative image steganography fusion with adversarial perturbations based on generative adversarial networks. Multimedia Tools and Applications, 85(10), Article 783. https://doi.org/10.1007/s11042-026-21939-7

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21939-7

Keywords: adversarial attacks, steganography, generative adversarial networks, deep learning, black-box attack, image processing, neural network security, cross-model transferability, steganalysis, ImageNet, Caltech-256, covert communication

The study, led by doctoral researcher Dane Williamson together with Yangfeng Ji and Matthew Dwyer, begins with a deceptively simple observation. When the popular Grad-CAM method is asked to explain why a network chose its top prediction for an image, and then asked again to explain the second-ranked prediction, the highlighted regions barely change. This happens even when the two candidate labels describe semantically unrelated objects, such as an airplane and a barbell. If an explanation method highlights the same pixels whether the model claims to see a bird or an airplane, the researchers argue, that explanation is not telling anyone what distinguishes one hypothesis from another. It is, in effect, a plausible-looking picture with little diagnostic content.

The stakes are higher than they might seem. Prior human-centered research cited in the paper, including the HIVE evaluation study, found that visual explanations can increase user trust even when the underlying model is wrong. In other words, a beautiful heatmap can manufacture confidence in a decision that the heatmap does not actually illuminate. The problem becomes acute in domains such as medical imaging, where documented failures have shown networks latching onto dataset artifacts like text tokens or positional cues instead of actual pathology. If the saliency maps generated in those settings are insensitive to the class label, clinicians auditing a diagnosis could be misled by an explanation that looks informative but is essentially identical to the explanation the model would have produced for any other condition.

To move beyond anecdotes, the researchers formalized a diagnostic test for what they call class sensitivity. For each validation image, they generated saliency maps for the top-1 and top-2 predicted classes and measured the overlap between the top 5 percent of pixels highlighted in each map. A method that genuinely distinguishes between competing labels should produce substantially different maps. They then applied a one-sided Wilcoxon signed-rank test, asking whether the median agreement between maps fell below 50 percent. If a method cannot statistically beat a coin-flip level of overlap, it fails the test of distinguishing one class explanation from another. This framework is deliberately method-agnostic and model-agnostic, meaning it can be applied to any saliency technique and any convolutional backbone.

The results of that diagnostic were sobering. Across five widely used class activation map methods, Grad-CAM, Grad-CAM++, ScoreCAM, AblationCAM, and LayerCAM, evaluated on four architectures spanning ResNet-50, VGG-19, DenseNet-201, and ConvNeXt-Large, and on two datasets, ImageNet and CIFAR-100, most baseline methods failed to distinguish between competing classes in a large fraction of settings. Grad-CAM and AblationCAM in particular frequently produced explanations for the top and second predictions that were statistically indistinguishable. The failure was not confined to one model family or benchmark, suggesting a systemic weakness in how activation-based attribution is computed rather than an artifact of any single network.

Motivated by these findings, the team introduced CASE, short for Contrastive Activation for Class-Sensitive Explanations. The method works by explicitly removing the attribution that a target class shares with its most confusable competitors. Concretely, CASE first computes the gradient of the target class score with respect to the final convolutional activation maps. It then identifies a contrast set consisting of the classes the model most frequently confuses with the target, using the model’s confusion matrix computed on a held-out validation set. The gradients for those contrast classes are averaged into a single vector, and the component of the target gradient that points along this shared direction is subtracted away through an orthogonal projection. What remains is a residual gradient encoding only evidence that is uniquely discriminative for the target class, which is then used to weight the activation maps and produce the final heatmap after a ReLU and upsampling step.

The design choices behind CASE are notable for what they avoid. Unlike prior contrastive explanation approaches such as CWOX, which relies on learned cluster structures, or Contrastive LRP, which is tied to backpropagation-based relevance propagation, CASE requires no architectural modifications, no external baselines, and no auxiliary models. It operates directly on the internal activations of any already-trained convolutional network. The confusion-based contrast selection is also behaviorally grounded: because the contrast set is drawn from classes the model empirically mixes up, the method suppresses exactly the attribution directions that compete with the target in practice, rather than those suggested by semantic similarity alone.

In evaluations across all four architectures and both datasets, CASE was the only method that consistently rejected the null hypothesis of the class-sensitivity test with high confidence, achieving p-values below 0.0001 in every tested setting. ScoreCAM also performed well on most models but stumbled on VGG, while traditional methods failed more often. The study also uncovered a surprising architectural insight: DenseNet proved the most naturally class-sensitive network, and a channel-activity analysis revealed why. Its final convolutional layer activates fewer than 20 channels per class on average, an unusually sparse but highly selective representation, whereas VGG and ConvNeXt activate hundreds of channels that dilute class-specific signals. When the researchers swapped DenseNet’s attribution layer to the final normalization layer, which activates nearly all channels uniformly, most methods lost their class sensitivity entirely. Even retraining across five random seeds confirmed the effect was a stable property of the architecture, and CASE retained its sensitivity even in the diffuse regime.

Class sensitivity alone is not sufficient, of course. A good explanation should also be faithful, meaning the highlighted regions should genuinely matter to the model’s output. The team tested this by ablating the top 5 percent of salient pixels and measuring the drop in the model’s confidence. Here the picture was more nuanced. CASE matched the strongest baselines on DenseNet, ResNet, and ConvNeXt, and significantly outperformed AblationCAM and LayerCAM on ConvNeXt, but on VGG three methods, Grad-CAM++, LayerCAM, and ScoreCAM, produced larger confidence drops. The authors are candid about these failure cases, noting that uniquely discriminative regions are not always the regions whose removal maximally reduces confidence. When class evidence is diffuse and shared across labels, perturbing broadly activated regions can produce bigger confidence swings even if those regions are less informative for separating one class from another.

The paper also probes the robustness of the method itself. A pre-registered degenerate-residual check searched for cases where the target and contrast gradients were nearly collinear, which would collapse the orthogonal projection toward zero; across 4,774 generated maps, not a single near-zero residual was found. Ablations over the contrast set size showed that three confused classes are sufficient, with larger sets yielding no consistent benefit. The authors are explicit about the method’s boundaries: CASE applies to single-label classification with convolutional networks, and extending it to transformers, multi-label tasks, or multimodal models would require rethinking the contrast formulation. Those limitations aside, the study delivers a message that should resonate far beyond the machine learning community. Explanation tools are trusted as safeguards, and this work shows that trust must be earned through formal diagnostics rather than visual plausibility. As deep learning spreads into medicine, safety monitoring, and high-stakes auditing, the researchers argue, we need explanations that reveal what truly sets a model’s decision apart, not just what makes a convincing picture.

Subject of Research: Class sensitivity and contrastive saliency methods for explaining convolutional neural network image classifiers

Article Title: CASE: Contrastive Activation for Class-Sensitive Explanations

Article References: Williamson, D., Ji, Y., & Dwyer, M. (2026). CASE: Contrastive Activation for Class-Sensitive Explanations. Machine Learning, 115(10), Article 230. https://doi.org/10.1007/s10994-026-07169-w

Image Credits: AI Generated

DOI: 10.1007/s10994-026-07169-w

Keywords: explainable AI, saliency maps, Grad-CAM, contrastive explanations, convolutional neural networks, class activation mapping, machine learning, attribution fidelity, ImageNet, CIFAR-100, DenseNet, model interpretability

To understand why DuoDiT matters, it helps to recall how contemporary image generators actually work. Diffusion models learn to create images by iteratively removing noise from a random starting point, gradually sculpting a clean picture out of static. The most powerful recent versions of these systems replace the older convolutional backbones with transformers, the same architecture that revolutionized language modeling. These Diffusion Transformers, or DiTs, chop a latent representation of the image into small patches, treat each patch as a token, and process the sequence with scalable attention mechanisms. The result is state-of-the-art fidelity, but also enormous models: the DiT-XL/2 backbone that DuoDiT builds upon contains roughly 690 million parameters.

The problem the Iranian researchers set out to solve concerns adaptation rather than initial training. Training a diffusion transformer from scratch costs millions of dollars of compute, so practitioners increasingly rely on parameter-efficient fine-tuning, or PEFT, techniques that freeze the pre-trained backbone and update only a small subset of weights. Methods such as LoRA and DiffFit have shown that adding low-rank updates or tuning selected layers can customize a model at a fraction of the usual cost. Yet, as the DuoDiT authors point out, existing PEFT approaches for diffusion transformers share a structural limitation: they operate at the same compressed token resolution as the frozen backbone, which constrains their ability to recover fine texture and boundary details without updating a large number of parameters.

DuoDiT’s central idea is elegantly simple. Instead of modifying the frozen backbone at its own coarse resolution, the architecture adds a second, trainable stream that looks at the same noisy latent input through a much finer lens. This auxiliary stream uses a smaller patch size, producing a denser grid of tokens that capture localized visual information the coarse backbone tokens tend to blur over. The design echoes the spirit of side-tuning and multi-scale vision transformers, but applies it to the denoising process of a diffusion model, where detail recovery during generation is precisely what separates adequate images from striking ones.

The technical machinery of the second stream is where the paper’s engineering shows through. Because the fine-grained stream produces many more tokens than the frozen DiT, naively fusing the two representations would be computationally prohibitive. DuoDiT instead employs local CLS-token aggregation: fine-grained tokens are grouped, and a learnable summary token distills each group into a single aligned detail token. These aggregated detail tokens are then fused back into the frozen DiT representation just before the output head. In effect, the backbone continues to supply its powerful global denoising prior, the statistical knowledge of how images should look that it acquired during pre-training, while the second stream injects content-aware local refinements exactly where they are needed.

The numbers reported in the study are striking. On ImageNet-1K class-conditional generation at 256 by 256 resolution, the DuoDiT-200 configuration updates only 17.95 million of the backbone’s 690.39 million parameters, a mere 2.6 percent of the total. Despite this tiny trainable footprint, the model achieves a Fréchet Inception Distance, or FID, of 2.219, a Kernel Inception Distance of 0.0014, and an LPIPS-Mean of 0.7162. FID measures how statistically similar generated images are to real ones, with lower being better, while KID and LPIPS probe distributional fidelity and perceptual quality from complementary angles. Among all the methods evaluated in the paper, DuoDiT obtained the lowest KID and LPIPS-Mean scores while maintaining a competitive FID, suggesting that its gains are concentrated exactly where the dual-stream design predicts: in perceptual detail and distributional precision.

Automated metrics only tell part of the story, and the authors supplemented them with a human evaluation. In a preference study comparing DuoDiT against LightningDiT, an established efficient diffusion transformer baseline, human raters chose DuoDiT’s outputs in 53.26 percent of non-tie responses. That margin may appear modest, but in the world of image generation benchmarks, where differences between top systems are often imperceptible, a consistent human preference achieved with a fraction of the trainable parameters is a meaningful result. The study’s ethics declarations note that participation was voluntary and fully anonymized, with informed consent collected from all subjects.

The broader significance of DuoDiT lies in what it implies for the economics of generative AI. As diffusion transformers scale up to power photorealistic text-to-image systems, video generation, and multimodal assistants, the ability to adapt them cheaply becomes a strategic advantage. A technique that preserves a frozen backbone’s learned knowledge while adding a lightweight, task-specific refinement path means that multiple specializations can share a single expensive pre-trained model. It also lowers the barrier for academic groups and smaller organizations that cannot afford full fine-tuning runs, potentially diversifying who gets to push the frontier of image synthesis. The DuoDiT authors have released their data and implementation openly on GitHub, a move that should accelerate adoption and follow-up research.

The paper also situates itself within a rapidly evolving lineage. Diffusion models first overtook generative adversarial networks in image quality in 2021, latent diffusion made high-resolution synthesis practical, and vision transformers supplied the scalable backbone that modern systems like PixArt and video diffusion models now depend on. Parameter-efficient fine-tuning, meanwhile, migrated from natural language processing into vision and diffusion settings through methods like LoRA, SVDiff, and DiffFit. DuoDiT’s contribution to this lineage is architectural rather than merely algorithmic: rather than squeezing more efficiency out of the same token resolution, it changes the resolution at which adaptation happens, arguing that fine-grained detail recovery demands fine-grained tokens.

There are, of course, caveats worth keeping in mind. The reported results are for class-conditional generation on ImageNet-1K, a well-controlled benchmark that differs from the open-ended text-to-image setting of commercial systems, and the auxiliary stream still adds inference-time computation even if its trainable parameter count is small. The authors report no external funding and declare no competing interests, and the work was published in the journal’s special collection on rich media with generative AI. Whether the dual-stream principle transfers to text-conditioned and video-scale diffusion transformers remains an open question that the community will now be eager to test. For now, DuoDiT offers a compelling demonstration that in generative AI, as in so much of science, knowing precisely where to add a little capacity can matter far more than adding a lot of it everywhere.

Subject of Research: Parameter-efficient fine-tuning of diffusion transformers for image generation using a dual-stream architecture

Article Title: DuoDiT: a parameter-efficient dual-stream architecture for image generation in diffusion transformers

Article References: Shahbazi Dil, M., Mahmoudabadi, M., & Rezghi, M. (2026). DuoDiT: a parameter-efficient dual-stream architecture for image generation in diffusion transformers. Multimedia Tools and Applications, 85(10), Article 780. https://doi.org/10.1007/s11042-026-21926-y

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21926-y

Keywords: diffusion transformers, image generation, parameter-efficient fine-tuning, DuoDiT, vision transformers, generative AI, deep learning, computer vision, LoRA, ImageNet, FID, dual-stream architecture

The research, led by Yutong Wu and Songfeng Lu of Huazhong University of Science and Technology together with colleagues at Guangxi Normal University, Chongqing University, and other institutions, targets a structural weakness in what the authors call the behavior-only interface of model watermarking. Most black-box watermarking schemes, whether they use backdoored trigger sets, adversarial frontier stitching, dynamic adversarial watermarking, or parameter encoding, ultimately verify ownership by checking whether a suspect model maps certain inputs to certain labels. The problem, the researchers argue, is that a successful trigger response does not reveal how that response came to be. A third-party arbiter sees the model answering the secret key correctly, but cannot distinguish between a model that was genuinely watermarked at training time and one that simply happens to respond to a cleverly constructed set of forged inputs.

FakeMark exploits this ambiguity through a two-stage pipeline that operates entirely on a surrogate model. In the first stage, called clean feature caching, the attacker runs ordinary, unmodified images through a publicly available surrogate network and records the outputs of selected convolutional and fully connected layers. These cached activations serve as a library of clean reference features. In the second stage, adversarial feature fusion, the attacker optimizes a bounded perturbation on a batch of inputs while repeatedly injecting randomly permuted copies of the cached clean references into the surrogate’s forward pass. The injection is stochastic: at each iteration, a Bernoulli gate decides whether a given layer participates, a fresh permutation shuffles the reference features across the batch, and per-channel interpolation weights are drawn uniformly from a fixed range. The perturbation itself is guided by the gradient of the target-class logit, so the inputs are pushed toward whatever internal representations make the surrogate predict the attacker’s chosen label.

The crucial design insight is that this stochastic fusion prevents the perturbation from overfitting to architecture-specific quirks of the surrogate. Because the forward map changes at every iteration, successive gradients need not follow a single narrow trajectory, and the resulting adversarial inputs generalize better to unseen victim architectures. The authors support this intuition with a simplified theoretical analysis. Under a regularized linear classifier, they prove that a bounded perturbation maximizing the margin toward a watermarked class necessarily acquires a nonzero component along the watermark-trigger direction, with an explicit lower bound on the fraction of the perturbation’s norm that lies in that direction. The result is deliberately conditional: it explains why a successful linear watermark creates a trigger-aligned vulnerability, but the authors are careful to note that it does not prove the nonlinear optimization recovers the actual trigger of a deep network.

The empirical results are striking, though the authors frame them with unusual care. Across sixteen distinct architectures, an additional adversarially trained ResNet-50 checkpoint, and eight watermark variants spanning model-independent, model-dependent, active, and parameter-encoding schemes, the retrospective best-case behavioral target-label accuracy reaches 1.00 on CIFAR-10 and 0.99 on ImageNet. In other words, when the best surrogate in the pool is used, forged keys can induce the victim model to answer with the attacker’s chosen label on essentially every verification sample. On a fixed ADI-watermarked target under a matched protocol, FakeMark achieved a targeted attack success rate of 0.990, compared with 0.860 to 0.940 for canonical transferable attacks such as PGD, MI-FGSM, and DI-FGSM. A controlled component analysis showed that removing the batch permutation or the channel-wise mixing reduced transfer, and that replacing the clean cache with current-batch features actually raised surrogate-side success while lowering victim-side accuracy, indicating that the stochastic fusion genuinely shapes cross-model behavior rather than merely optimizing the surrogate.

Yet the study is equally notable for what it does not claim. ImageNet transfer varied enormously across checkpoint and surrogate settings, ranging from near zero to 0.99. Two ImageNet surrogates, ResNet-18 and VGG16, produced almost no transfer at all, while the adversarially trained ResNet-50 checkpoint and DenseNet-121 performed strongly. The ordering was not explained by model size or computational cost: MobileNetV2, the smallest and cheapest surrogate tested, matched ResNet-50 at 0.990, while Inception-v3, with the largest FLOP count, reached only 0.727. Architecture and checkpoint compatibility, the authors conclude, is a central condition for the attack, and the reported maxima are retrospective upper bounds over the surrogate pool rather than an operational guarantee that an attacker could pick a good surrogate without any victim feedback. Auxiliary experiments on clean, unwatermarked models showed comparable targeted transfer in several settings, so the evidence does not establish a universal watermark-specific amplification effect.

The threat model is deliberately austere. The attacker has white-box gradient access to one or more surrogate models trained on public data, but during attack construction has no query access, no gradients, no parameters, and no architectural knowledge of the victim. The victim model is invoked only at the end, through the normal ownership-verification procedure. The attacker does not modify the victim’s parameters, does not observe the legitimate watermark key, and does not need to estimate any victim-specific decision threshold. On CIFAR-10, the surrogates and watermarked targets share the standard public training split, so the controlled setting involves substantial sample-level overlap; on ImageNet, only dataset-level overlap can be asserted because external pretrained checkpoints do not publish training manifests. The authors acknowledge these limitations explicitly, along with the fact that the evaluation is restricted to image classification and uses a single surrogate at a time.

The study also probes whether forged keys can be detected. Perceptual measurements showed that the perturbations remain bounded, with PSNR between roughly 24 and 27 decibels and structural similarity scores between 0.72 and 0.91 depending on the setting. Input-level screening told a mixed story: the ADI scheme’s forged keys stayed below all four diagnostic thresholds tested, while Frontier and DAWN exceeded three of them, and median filtering changed forged predictions more often than legitimate ones. Feature-based detectors, including Mahalanobis distance, local intrinsic dimensionality, and ODIN, flagged forged groups at higher rates than clean calibration data, with the largest increase under LID. The authors interpret these results as evidence of detector-dependent artifacts rather than broad evasion, and they caution that the detector study is not a fully tuned learned-detector benchmark. The picture that emerges is nuanced: some schemes leave fingerprints on forged evidence, others do not, and no single screening method reliably separates genuine from fabricated triggers.

The practical implications reach beyond the laboratory. As models are increasingly deployed through APIs, fine-tuned by third parties, and extracted by adversaries, ownership disputes will hinge on verification evidence that courts, marketplaces, and standards bodies can trust. FakeMark shows that behavioral evidence alone cannot carry that weight, because a successful trigger response is compatible with both legitimate embedding and independent forgery. The authors argue that future ownership protocols should pair behavioral tests with signals that are harder to construct after the fact: cryptographic commitments to watermark keys or training provenance, structural fingerprints that cannot be derived from black-box outputs, and multi-factor validation that survives model post-processing. Parameter-encoding schemes that bind selected weights to a hashed secret, such as NeuralMark, represent one step in this direction, but the broader lesson is procedural rather than technical. Any verification protocol that accepts a single trigger-response score as proof of ownership is, in principle, exposed to fabricated evidence.

The FakeMark code and experimental data have been released publicly, and the authors hope the framework will serve as a stress test for the next generation of watermarking defenses rather than as a tool for intellectual property fraud. The study’s most enduring contribution may be its reframing of the ownership question. Watermarking research has largely focused on making triggers robust to removal, extraction, and fine-tuning; FakeMark shifts attention to the provenance of the evidence itself. A model that answers the secret questions correctly is not necessarily a stolen model, and a claimant who produces the right answers is not necessarily the rightful owner. Until verification protocols can distinguish between these possibilities, the researchers conclude, the evidentiary value of any behavioral watermark remains fundamentally limited, and the growing market for machine learning intellectual property will need stronger, multi-factor guarantees to stay ahead of those who would forge them.

Subject of Research: Gradient-guided forgery of behavioral model watermarks in deep neural networks

Article Title: FakeMark: gradient-guided false watermark claims via robust feature fusion

Article References: Wu, Y., Li, W., Nie, H., Zhou, Z., Li, J., Gong, Y., & Lu, S. (2026). FakeMark: gradient-guided false watermark claims via robust feature fusion. Cybersecurity, 9(1), Article 217. https://doi.org/10.1186/s42400-026-00654-8

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00654-8

Keywords: model watermarking, false ownership claims, adversarial transferability, deep neural network security, intellectual property protection, FakeMark, surrogate models, feature fusion, CIFAR-10, ImageNet, Cybersecurity, machine learning

The biological inspiration at the heart of NB-Net comes from a structural principle familiar to neuroscientists. In living nervous systems, a single neuron frequently fans its output out to many downstream targets, and those signals are later gathered and integrated at convergent junctions further along the pathway. This divergent-convergent pattern allows nervous systems to process multiple aspects of a stimulus simultaneously before reconciling them into a unified response. The research team asked a deceptively simple question: if biological computation relies so heavily on this broad, parallel organization rather than on arbitrarily long chains of processing, could artificial networks benefit from a similar width-first philosophy, achieving strong representation quality without resorting to very deep backbones?

NB-Net answers that question with a concrete architectural recipe. The building block of the network is the Neuron Bundle Layer, a multi-branch structure in which several parallel convolutional branches all receive the same input tensor and process it simultaneously. Rather than forcing every branch to use identical operations, the design employs grouped convolutions with different kernel sizes across the branches. This means that at any given stage of the network, the model is simultaneously extracting features at multiple spatial scales from the very same signal. Small kernels capture fine-grained local detail, while larger kernels perceive coarser structure, and the network as a whole maintains a rich, multi-scale view of its input that a single-pathway design of comparable cost would struggle to match.

Of course, running many branches in parallel creates its own challenge: at some point, the network must fuse the separate streams of features back together into a coherent representation. Early attempts at such fusion in multi-branch architectures have often relied on a single 1×1 convolution that collapses all channels at once, a move that can be numerically unstable when the incoming branches are numerous or heterogeneous. NB-Net instead introduces a two-stage 1×1 convolution fusion module. In the first stage, the module performs a moderate compression of the concatenated channel dimension, gently reducing the volume of information rather than merging everything in one abrupt step. In the second stage, the module completes the integration of the compressed features. The authors report that this progressive fusion improves training stability compared with a single 1×1 merge, because the network is never forced to reconcile wildly different feature distributions in a single transformation.

Repeat the Neuron Bundle Layer and its fusion module in succession, and the result is a network that grows primarily in width rather than depth. The team subjected this design to a systematic set of ablation experiments, examining how branch configuration, residual connections, and width settings each affect performance. Residual connections, the shortcut pathways popularized by deep residual networks, were found to interact meaningfully with the multi-branch structure, helping gradients flow through the widened architecture during training. The analysis of width settings demonstrated that the framework scales in a controlled fashion: increasing the number of parallel channels raises capacity, but parameter counts grow in a disciplined, predictable manner rather than exploding as they often do when architectures are naively broadened.

The empirical case for NB-Net rests on two of the most widely used benchmarks in computer vision. On CIFAR-10, the standard small-image classification suite that serves as a proving ground for new architectural ideas, the network delivered competitive classification accuracy against established baselines. More significantly, on ImageNet, the large-scale benchmark whose thousand object categories have historically rewarded sheer architectural depth, NB-Net achieved accuracy on par with competing designs while keeping parameter growth under tight control. In a field where improvements are often purchased with dramatic increases in model size, the ability to hold the line on parameters while remaining competitive is itself a noteworthy result, and it supports the paper’s central claim that width-oriented design, when done systematically, deserves a seat at the table alongside depth scaling.

The publication arrives at a moment of genuine ferment in architectural research. As the costs of training ever-larger monolithic models attract scrutiny, many groups are revisiting efficiency-driven strategies such as grouped convolutions, multi-branch topologies, and staged feature fusion. NB-Net contributes to this conversation a coherent biological rationale that ties these elements together. The divergent-convergent organization it emulates is not merely a decorative metaphor; it dictates the concrete structure of the network, from the parallel branches of each Neuron Bundle Layer to the progressive, two-stage reconciliation of their outputs. The result is an architecture in which the biological principle and the engineering mechanism reinforce one another, a combination that has historically produced some of the most durable ideas in machine learning, from convolutional receptive fields to attention mechanisms.

Openness was clearly a priority for the research team. The article is published open access under a Creative Commons Attribution 4.0 license, meaning that anyone can read, reuse, and build upon the work with appropriate credit. In addition, the authors have released their implementation in a public code repository on GitHub, allowing other researchers to reproduce the reported benchmarks, stress-test the two-stage fusion module on their own tasks, or graft Neuron Bundle Layers into entirely different network families. The study was supported by funding from the National Natural Science Foundation of China, the Hunan Provincial Natural Science Foundation, and the Science and Technology Innovation Program of Hunan Province, reflecting sustained institutional investment in fundamental artificial intelligence research in China.

Whether NB-Net or its descendants will change mainstream practice remains to be seen, but the study makes a persuasive case that the width of a network is not a second-class design variable. By borrowing a page from the divergent-convergent wiring of biological neurons, the researchers have shown that parallel, multi-scale branches, fused with care, can rival deep stacks of layers on the benchmarks that matter, all while keeping parameter budgets in check. For a discipline searching for ways to advance without simply building bigger and taller models, the message is timely: sometimes the most productive direction is sideways.

Subject of Research: A biologically inspired, width-oriented multi-branch neural network architecture with two-stage feature fusion

Article Title: NB-Net: A Biologically-Inspired Framework for Neural Network Width Expansion

Article References: Tan, L., Zhao, H., & Meng, W.-L. (2026). NB-Net: A Biologically-Inspired Framework for Neural Network Width Expansion. Neural Processing Letters. https://doi.org/10.1007/s11063-026-11880-z

Image Credits: AI Generated

DOI: 10.1007/s11063-026-11880-z

Keywords: neural networks, network width, biologically-inspired architecture, NB-Net, feature fusion, grouped convolutions, deep learning, image classification, CIFAR-10, ImageNet, multi-branch architecture, parameter efficiency