Abstract: At present,the public is increasingly concerned about the image tampering technology because it will cause ethical and security issues.Deep neural networks can be used to locateimage tampering areas.However,with the development of deep neural networks,adversarial attacks against them have also developed,and these attack methods have also promoted the research on the robustness of the model.Existing adversarial attack methods mainly focus on tampering trace features,but different Image Manipulation Localization models focus on different tampering trace features,resulting in insufficient migration ability of adversarial attacks.Since convolutional neural networks or Transformer networks can also extract semantic features,and Image Manipulation Localization models often use these models as baseline models,which would inevitably extract some semantic features when extracting tampering features.In order to improve the generalization ability of adversarial samples,a attack method is proposed,focusing on eliminating the semantic features of tampered images,training a semantic segmentation network as the attack target,and proposing a loss function for attacking intermediate semantic features,making it difficult for the model to identify the semantic information of the tampered part of the image.This attack method has better transfer ability,can hide perturbations and genera-te more aggressive adversarial samples.It has been proven in multiple experiments that it can attack most existing models and outperform other adversarial attack methods,and provides novel insights for the image manipulation localization.

Key words: Adversarial attack, Deep network, Image manipulation localization