Veritas: Generalizable Deepfake Detection via Pattern-Aware Reasoning

## Abstract

Abstract Deepfake detection remains a formidable challenge due to the complex and evolving nature of fake content in real-world scenarios.
However, existing academic benchmarks suffer from severe discrepancies from industrial practice, typically featuring homogeneous training sources and low-quality testing images, which hinder the practical deployments of current detectors.
To mitigate this gap, we introduce HydraFake , a dataset that simulates real-world challenges with hierarchical generalization testing.
Specifically, HydraFake involves diversified deepfake techniques and in-the-wild forgeries, along with rigorous training and evaluation protocol, covering
unseen model architectures, emerging forgery techniques and novel data domains.
Building on this resource, we propose Veritas , a multi-modal large language model (MLLM) based deepfake detector.
Different from vanilla chain-of-thought (CoT), we introduce pattern-aware reasoning that involves critical reasoning patterns such as “planning” and “self-reflection” to emulate human forensic process.
We further propose a two-stage training pipeline to seamlessly internalize such deepfake reasoning capacities into current MLLMs.
Experiments on HydraFake dataset reveal that although previous detectors show great generalization on cross-model scenarios, they fall short on unseen forgeries and data domains.
Our Veritas achieves significant gains across different OOD scenarios, and is capable of delivering transparent and faithful detection outputs.

## 1 Introduction

Recent advances in Generative AI Esser et al. (2024); Tian et al. (2024) have revolutionized our digital life,
unprecedentedly enriching the diversity of content on social media and short-video platforms.
Though bringing immense creativity, such techniques also enable highly convincing deepfakes with minimal cost, posing significant security risks to society.
Consequently, Deepfake Detection (DFD), which aims at discerning between real and generated facial images, has become a heated research frontier, galvanizing extensive efforts.

However, current detectors mostly follow a standard evaluation, which involves training on one dataset Rossler et al. (2019) and testing on others Dolhansky et al. (2019); Li et al. (2020b); Dolhansky et al. (2020); Zi et al. (2020); Zhou et al. (2021).
Despite its popularity, this protocol fails to align with practical industrial scenarios, where abundant training samples are available yet significant out-of-distribution (OOD) generalization challenges (e.g., brand-new forgery types and meticulously synthesized facial images) emerge during testing.
Such discrepancy severely hinders the practical deployment of current detectors.
To mitigate the gap, we construct HydraFake dataset.
As shown in Figure [2](https://arxiv.org/html/2508.21048v1#S2.F2), we systematically collect and reproduce advanced deepfake methods, covering diversified deepfake techniques and in-the-wild forgeries from social media.
To simulate potential challenges in real-world scenarios, we establish a rigorous and holistic evaluation protocol, where the training set consists of abundant samples but is restricted to three basic forgery types, and the evaluation involves hierarchical OOD testing, spanning in-domain, cross-model, cross-forgery and cross-domain scenarios, enabling fine-grained understanding of the model’s capacities.
As presented in Figure [2](https://arxiv.org/html/2508.21048v1#S2.F2) (d), under such rigorous evaluation, current SOTA detectors show great generalization on cross-model deepfakes, but limited abilities in cross-forgery and cross-domain scenarios.

To improve the robustness on unseen forgeries and data domains, we seek to ground the generalization abilities of multi-modal large language models (MLLMs) into deepfake detection.
Recent efforts Huang et al. (2024); Guo et al. (2025b); Peng et al. (2025) have made initial attempts, while they focus on the explainability and the classification is still based on expert vision models.
In constrast, we explore to seamlessly internalize MLLMs into deepfake detection through their intrinsic reasoning abilities.
However, directly applying deep reasoning faces a critical challenge:
current MLLMs are extremely short for deepfake detection Ren et al. (2025); Tariq et al. (2025).
Effective reasoning data is necessary to ground the abilities of base model.
To achieve this goal, we must answer two key questions:
(1) what kind of reasoning process is helpful to DFD task?
and (2) with sufficient data, how can we ensure the model is learning to reason for DFD rather than memorizing?

For the first question, we introduce a pattern-aware reasoning framework.
Drawing inspiration from recent studies Zhao et al. (2025); Muennighoff et al. (2025) that demonstrate critical reasoning patterns greatly elevate the OOD performance of LLMs, we consider the human mindset for deepfake detection:
when determining the authenticity of an image, we tend to make a quick judgment based on our first impression (fast judgement), then identify one or two prominent features (reasoning) to draw a conclusion (conclusion).
For more challenging samples, we may conduct a layered analysis (planning), and may also engage in more in-depth thinking to support or overturn our initial judgement (self-reflection).
Based on this analogy, we extract these five thinking patterns to facilitate logical and holistic reasoning.
Table [2](https://arxiv.org/html/2508.21048v1#S4.T2) empirically shows the benefits of such pattern-aware reasoning over vanilla Chain-of-Thought (CoT).
For the second question, we introduce a two-stage training pipeline consisting of pattern-guided cold-start and pattern-aware exploration, yielding our Veritas (^1^11Veritas means “Truth” in Latin.)model.
During cold-start, we employ SFT to internalize thinking patterns.
Besides, we introduce a Mixed Preference Optimization (MiPO) strategy that leverages mixed non-preference data and human-annotated preference data to steer the model toward faithful and fine-grained reasoning.
As shown in Figure [1](https://arxiv.org/html/2508.21048v1#S1.F1), MiPO greatly improves the reasoning quality, mitigating the memorizing behavior.
To further facilitate adaptive planning and self-reflection, we propose Pattern-aware Group Relative Policy Optimization (P-GRPO), which shapes reasoning behavior through online sampling and pattern-aware reward mechanism.
As a result, Veritas  shows great generalization on unseen forgeries and data domains, providing transparent and precise decision process (Figure [1](https://arxiv.org/html/2508.21048v1#S1.F1)).

Figure: Figure 1: Comparison of the detection outputs. InternVL3-78B Zhu et al. (2025) gets incorrect answer. GPT-4o Hurst et al. (2024) and our model trained without the proposed MiPO both fail to provide precise explanation. In contrast, our model gives transparent and faithful decision process.
Refer to caption: x1.png

To sum up, our main contributions are:

- •
Dataset: We introduce HydraFake-100K, a dataset that simulates real-world challenges with hierarchical generalization testing, advancing the evaluation protocol in deepfake detection and helping developers better locate the deficiencies of their detectors.
- •
Method: We propose a two-stage training pipeline that grounds the capabilities of MLLMs into deepfake detection through pattern-aware reasoning.
Our model supports adaptive planning and self-reflection, delivering transparent and human-aligned decision end-to-end.
- •
Performance: Our Veritas  model achieves significant improvements over state-of-the-art detectors on cross-forgery and cross-domain scenarios, and our cold-start model serves as a strong reasoning foundation for further customization.

## 2 Related work

### 2.1 Deepfake Detection and Datasets

Deepfake detection aims to distinguish generated facial images from authentic human faces.
Previous efforts have explored spatial-level Ojha et al. (2023); Yan et al. (2024b); Tan et al. (2024b); Nguyen et al. (2024); Fu et al. (2025); Yan et al. (2024a; c); Yang et al. (2025c), frequency-level Qian et al. (2020); Tan et al. (2024a); Zhou et al. (2024); Kashiani et al. (2025) and sequence-level Gu et al. (2021; 2022b; 2022a); Yan et al. (2025) approaches, achieving remarkable progress on traditional benchmarks.
To train a generalizable detector, some methods attempt to find “bias-free” fake images either through spatial-domain blending Li et al. (2020a); Shiohara & Yamasaki (2022); Zhao et al. (2021), frequency-domain blending Zhou et al. (2024); Kashiani et al. (2025) or feature-level augmentation Yan et al. (2024b).
However, the commonly adopted protocol, i.e., training on FF++ Rossler et al. (2019) and testing on others Dolhansky et al. (2019); Li et al. (2020b); Dolhansky et al. (2020); Zi et al. (2020); Zhou et al. (2021), suffers from two problems:
(1) the training sources are overly narrow, and (2) the testing data exhibit limited forgery types and low-resolution, failing to align well with real-world scenarios, where advanced and high-fidelity forged faces are crafted for malicious purposes.
Although many timely datasets Yan et al. (2024a); Zhang et al. (2024b); Li et al. (2025); Huang et al. (2025b); Xia et al. (2025) have been proposed for AIGC detection, the pace of deepfake detection has lagged behind.
As a result, previous methods are biased towards such settings, exhibiting degraded generalization when learning from varying sources or mixed artifacts Yang et al. (2025b).
To overcome the obstacle, we introduce a hierarchical protocol in our HydraFake dataset, aiming to comprehensively reflect the generalization capability of the detectors.

### 2.2 MLLMs for Deepfake Detection

With the proliferation of MLLMs Liu et al. (2023); Bai et al. (2025); Zhu et al. (2025), recent focus has shifted to explainable deepfake detection and AIGC detection.
However, most methods still rely on small vision models for the final decision.
For instance, M2F2-Det Guo et al. (2025b) determines the authenticity purely based on CLIP models, where LLM is leveraged as a plug-in interpreter.
Similarly, DD-VQA Zhang et al. (2024a), FFAA Huang et al. (2024) and VLF-FFD Peng et al. (2025) develop post-processing system to aggregate outputs from small vision models.
Some methods He et al. (2025); Sun et al. (2025); Chen et al. (2025b) attempt to directly adopt the outputs from LLMs, e.g., Sun et al. Sun et al. (2025) construct precise forgery explanations to release the power of MLLMs.
Recent methods Huang et al. (2025a); Xu et al. (2024b); Zhou et al. (2025) also adopt MLLMs and curated datasets for explainable AIGC detection.
However, these methods first provide an answer and then generate post-hoc explanations.
The potential of reasoning abilities for deepfake detection is still underexplored.
The most recent methods Gao et al. (2025); Xia et al. (2025) explore the reasoning for AIGC detection, while neglecting the adaptive reasoning patterns and is not tailored for facial forgery.
Different from previous methods, we make the first attempt to introduce human-like reasoning into deepfake detection.
Our model achieves significant improvements in OOD scenarios, delivering transparent decisions end-to-end.

Figure: Figure 2: Overview of HydraFake-100K dataset. (a) We carefully collect and reimplement advanced deepfake techniques to construct our HydraFake dataset. Real images are collected from $8$ datasets. Fake images are from classic datasets, high-quality public datasets and our self-constructed deepfake data. (b) We introduce a rigorous and hierarchical evaluation protocol. Training data contains abundant samples but limited forgery types. Evaluations are split into four distinct levels. (c) Illustration of the subsets in different evaluation splits. (d) The performance of prevailing detectors on our HydraFake dataset. Most detectors show strong generalization on Cross-Model setting but poor ability on Cross-Forgery and Cross-Domain scenarios.
Refer to caption: x2.png

## 3 HydraFake Dataset

In this part, we introduce our HydraFake-100K dataset, including the construction process and evaluation protocol.
Detailed statistics and information are provided in Appendix [A.1](https://arxiv.org/html/2508.21048v1#A1.SS1).

### 3.1 Data Collection

Real Images. As shown in Figure [2](https://arxiv.org/html/2508.21048v1#S2.F2) (a), the real images are collected from $8$ public datasets, containing both low-resolution (i.e., LFW Huang et al. (2008), CelebA Liu et al. (2015), FaceForensics++ (FF++) Rossler et al. (2019), FFIW Dolhansky et al. (2019)) and high-resolution images (i.e., FFHQ Karras et al. (2019), VFHQ Xie et al. (2022), UADFV Yang et al. (2019) and CelebAHQ Karras et al. (2017)).
The collected images are rigorously partitioned for training and testing.

Fake Images. The fake images come from three sources:

- •
Classic deepfake data sampled from FF++ Rossler et al. (2019) DF40 Yan et al. (2024d) and FFIW Dolhansky et al. (2019), which mainly contain face swapping (FS) and face reenactment (FR) forgeries from $10$ generative models.
The artifacts are mostly localized.
- •
Public deepfake data sampled from WILD Bongini et al. (2025), seeprettyface(^2^22[https://seeprettyface.com](https://seeprettyface.com)) anb TalkingHeadBench Xiong et al. (2025). This contains carefully synthesized faces from $16$ popular generators.
However, there still exist corner cases such as fresh forgery types.
- •
Advanced deepfake data where we further reimplemented and crawled $10$K deepfake data from $10$ advanced generators.
Besides traditional deepfake techniques, HydraFake dataset contains Face Restoration Zhou et al. (2022), Face Relighting Zhang et al. (2025b), Face Personalization Jiang et al. (2025); Guo et al. (2024), Generative Face Swapping Han et al. (2024) and deepfakes from Visual AutoRegressive models (VAR) Han et al. (2025); Tang et al. (2024).
To simulate real-world challenges, we also crawled $1$K deepfake images from social media, which include practical deepfakes generated from commercial apps, including GPT-4o Hurst et al. (2024), Dreamina team (2025a) and Hailuo AI team (2025b).

Quality Control.
For classic deepfake datasets, we only select FF++ Rossler et al. (2019) and FFIW Zhou et al. (2021), while not involving DFDC Dolhansky et al. (2020), DFDCP Dolhansky et al. (2019) and WDF Zi et al. (2020) due to their low quality (e.g., unexpected blurring in real images).
For our self-constructed deepfake data, we conduct strict quality control, e.g.,
for face personalization, we use Qwen2.5-VL-72B to tailor sample-specific prompts rather than using template-like prompts as in Bongini et al. (2025).
For face relighting, we generate multiple lighting sources for each identity and manually select high-quality samples.
The data crawled from social media are also carefully filtered by manual inspection.
After filtering and balancing, our HydraFake dataset contains $50$K real images and $50$K fake images.

### 3.2 Evaluation Protocol

Training. As shown in Figure [2](https://arxiv.org/html/2508.21048v1#S2.F2) (b), the training set contains $48$K images.
Real images are from $5$ subsets, with other $3$ subsets left out for testing.
Fake images involves $21$ subsets while only contains $3$ forgery types (i.e., FS, FR and EFG).
This is to simulate practical setting, where abundant training images are available but various forgery types and generative models remain unseen.

Evaluation.
The evaluation is divided into four distinct levels:

- •
In-Domain (14K): testing images share the training data source but with different identities.
- •
Cross-Model (11K): fake images are generated by unseen models including FLUX1.1-Pro Black Forest Labs (2024), Adobe FireFly Adobe (2023), commercial models (e.g., Starry AI AI (2023)) and distinct model architectures (e.g., VAR Han et al. (2025); Tang et al. (2024) and Video AR model Sand-AI (2025)).
The real images are from in-domain set but with different identities.
This split is to evaluate the model’s capacity to detect fake images generated by unseen models.
- •
Cross-Forgery (12K): fake images are generated by unseen manipulation techniques, involving attribute editing, generative face swapping, IP-preserved personalization, face relighting and face restoration.
The real images are from in-domain set but with different identities.
This split is to evaluate the model’s capacity to detect fake images generated by unseen manipulation.
- •
Cross-Domain (15K): both real and fake images come from unseen domains.
The fake images are either from unseen forgeries, unseen models or social media.
The real images are from unseen datasets (i.e., VFHQ Xie et al. (2022), UADFV Yang et al. (2019) and FFIW Dolhansky et al. (2019)).
This split also contains images of different qualities, posing strong challenges.

## 4 Method

In this section, we detail the two-stage training pipeline of Veritas, including pattern-guided cold-start and pattern-aware reinforcement learning, as shown in Figure [3](https://arxiv.org/html/2508.21048v1#S4.F3).

Figure: Figure 3: Overview of two-stage training pipeline. (a) For Pattern-Guided Cold-Start, we first employ SFT to internalize thinking patterns. Then we introduce MiPO to facilitate human-aligned reasoning. The MiPO dataset consists of mixed non-preference data, encouraging model to perform precise and fine-grained reasoning. (b) For Pattern-Aware GRPO, we introduce pattern-aware reward to incentivize adaptive reasoning ability on pattern granularity, yielding our Veritas model.
Refer to caption: x3.png

### 4.1 Pattern-guided Cold-Start

To internalize the effective thinking patterns for deepfake detection task, we first employ a pattern-guided cold-start.
Different from common practice, our cold-start involves two steps: we first employ Supervised Fine-Tuning (SFT) for format injection,
and then we introduce a Mixed Preference Optimization (MiPO) strategy to align the reasoning process with human experts.

SFT Pattern Injection.
Suppose the SFT dataset is denoted as $\mathcal{D}_{1}=\{(\bm{q},\bm{s})_{i}\}_{i=1}^{N_{1}}$, where $\bm{s}$ is the target output sequence including pattern-aware reasoning and final answer. $\bm{q}$ denotes input image and user query.
The training objective maximizes the likelihood of generating $\bm{s}$ given input $\bm{q}$:

$$ $\mathcal{L}_{\mathrm{1}}=-\mathbb{E}_{(\bm{q},\bm{s})\thicksim\mathcal{D}_{1}}\sum_{t=1}^{T}\log\pi_{\theta}(\bm{s}_{t}\mid\bm{q},\bm{s}_{<t}),$ (1) $$

where $\pi_{\theta}$ denotes the token distribution from the current model.
In the following we introduce the construction process of our training data $\mathcal{D}_{1}$.

To minimize human costs, we use MLLMs for automated annotation, similar to recent practices Huang et al. (2024); Xu et al. (2024b).
However, this encounters two challenges in our case:
(1) The MLLMs tend to overlook some subtle artifacts such as abnormal optical focusing.
(2) The model prioritizes producing logical paths but struggles to accurately locate the artifacts.
To mitigate the two issues, we construct a multi-step annotation pipeline.
We first manually inspect a subset and summarize a comprehensive artifacts taxonomy (Figure [4](https://arxiv.org/html/2508.21048v1#S4.F4) (a)):
(1) Perceptible structural anomalies, which are immediately visible and easy to detect.
(2) Subtle low-level artifacts, which require careful inspection.
(3) Cognitive violations of physical laws, which are implicit and require connecting to the common sense or real-world knowledge.
Then, we decouple the annotation into three specialized yet coherent steps, as shown in Figure [4](https://arxiv.org/html/2508.21048v1#S4.F4) (b).
Detailed annotation process and all prompt templates are provided in Appendix [A.3](https://arxiv.org/html/2508.21048v1#A1.SS3).
We present an annotated example in Figure [4](https://arxiv.org/html/2508.21048v1#S4.F4) (c).

MiPO Reasoning Alignment.
To further facilitate human-aligned reasoning, we meticulously curate a mixed preference dataset $\mathcal{D}_{2}=\{(\bm{q},\bm{s}_{w},\bm{s}_{l}^{\phi})_{i}\}_{i=1}^{N_{2}}\cup\{(\bm{q},\bm{s}_{w},\bm{s}_{l}^{\psi})_{i}\}_{i=1}^{N^{\prime}_{2}}$.
Specifically, we collect two types of non-preference data for the fake images:
(1) the trajectories where the answer is correct but the reasoning content is not precise or detailed enough (i.e., $\bm{s}_{l}^{\phi}$).
(2) the trajectories where the answer is incorrect (i.e., $\bm{s}_{l}^{\psi}$).
$\bm{s}_{w}$ denotes preferred reasoning traces, which are precisely annotated by our human experts.
Both $\bm{s}_{l}^{\phi}$ and $\bm{s}_{l}^{\psi}$ are sampled from the outputs of the SFT model, yielding $3$K high-quality paired samples for dataset $\mathcal{D}_{2}$.
Note that the images in $\mathcal{D}_{2}$ strictly come from the in-domain training set, without introducing any OOD samples.
Suppose the SFT model is denoted as $\pi_{\theta_{\text{SFT}}}$, the training objective for MiPO is formulated as:

$$ $\mathcal{L}_{\mathrm{2}}=-\mathbb{E}_{(\bm{q},\bm{s}_{w},\bm{s}_{l})\thicksim\mathcal{D}_{2}}\left[\log\sigma\left(\beta\log\frac{\pi_{\theta}(\bm{s}_{w}|\bm{q})}{\pi_{\theta_{\text{SFT}}}(\bm{s}_{w}|\bm{q})}-\beta\log\frac{\pi_{\theta}(\bm{s}_{l}|\bm{q})}{\pi_{\theta_{\text{SFT}}}(\bm{s}_{l}|\bm{q})}\right)\right],$ (2) $$

where $\sigma(\cdot)$ denotes the sigmoid function and $\beta$ controls the strength that the model deviates from the reference model.
As shown in Figure [1](https://arxiv.org/html/2508.21048v1#S1.F1), by learning from such mixed rejected traces, our model can perform more precise and fine-grained reasoning compared to pure SFT cold-start.

Figure: Figure 4: Construction pipeline of the Pattern-Aware SFT data. (a) We first manually inspect a subset and summarize the artifacts into three clusters. (b) Then we introduce a multi-step strategy to progressively obtain pattern-aware reasoning data. (c) An annotated example of entirely generated image. The reasoning process evolves in complexity and depth (as highlighted in red), culminating in a final answer through synthesis of all evidence.
Refer to caption: x4.png

### 4.2 Pattern-Aware Exploration

After cold-start, the trained model possesses the fundamental reasoning capacities for deepfake detection.
However, it still fails on more challenging samples.
To mitigate this, we introduce Pattern-Aware GRPO (P-GRPO) to encourage the model to perform comprehensive reasoning and potential self-reflection.
Unlike recent approaches Tu et al. (2025); Xiao et al. (2025) that encourage adaptive reasoning through length reward, we suppose that absolute reasoning length is not critical.
Instead, we incentivize appropriate thinking patterns through our pattern-aware reward mechanism.

Suppose the training data for P-GRPO is $\mathcal{D}_{3}=\{(\bm{q},\bm{a})_{i}\}_{i=1}^{N_{3}}$, where $\bm{a}$ denotes the binary answer.
We randomly sampled $9$K images from in-domain training set.
For a given query $\bm{q}$, P-GRPO samples $G$ responses $\{o_{1},o_{2},...,o_{G}\}$ using the current policy model $\pi_{\theta_{\text{old}}}$.
The quality of each response $\{R_{1},R_{2},...,R_{G}\}$ is evaluated through reward functions.
Suppose the cold-started model $\pi_{\theta_{\text{cold}}}$ is adopted as reference policy,
the training objective is formulated as:

$$ $\displaystyle\mathcal{L}_{3}\!=$ $\displaystyle-\mathbb{E}_{(\bm{q},\bm{a})\thicksim\mathcal{D}_{3},\{\bm{o}_{i}\}_{i=1}^{G}\thicksim\pi_{\theta_{\text{old}}}(\cdot|\bm{q})}$ (3) $\displaystyle\frac{1}{\sum_{i=1}^{G}\!|\bm{o}_{i}|}\!\sum_{i=1}^{G}\!\sum_{t=1}^{|\bm{o}_{i}|}\left[\min\left(r_{i,t}(\theta)A_{i,t},\text{clip}(r_{i,t}(\theta),1\!-\!\epsilon,1\!+\!\epsilon)A_{i,t}\right)-\beta^{{}^{\prime}}\!D_{\mathrm{KL}}\!\left[\pi_{\theta}\|\pi_{\theta_{\mathrm{cold}}}\right]\right],$ $$

where

$$ $r_{i,t}(\theta)=\frac{\pi_{\theta}(o_{i,t}\mid\bm{I},\bm{o}_{i,<t})}{\pi_{\theta_{\text{old}}}(o_{i,t}\mid\bm{I},\bm{o}_{i,<t})},\quad A_{i,t}=\frac{R_{i}-\mathrm{mean}(\{R_{1},\ldots,R_{G}\})}{\mathrm{std}(\{R_{1},\ldots,R_{G}\})}.$ (4) $$

The reward $R_{i}$ for each response is evaluated from three perspectives:

Pattern-aware Reward.
Suppose $\mathcal{C}\in\{0,1\}$ represents the correctness of the final answer, with $\mathcal{C}=1$ denoting the answer is right.
$\mathcal{P}\in\{0,1\}$ and $\mathcal{R}\in\{0,1\}$ represents whether the reasoning involves “planning” and “self-reflection”, respectively.
The pattern-aware reward is defined as:

$$ $R_{\text{pattern}}=\left\{\begin{aligned} &2.0,\quad\text{if}\ \mathcal{C}\!=\!1\ \wedge(\mathcal{P}\!=\!1\vee\mathcal{R}\!=\!1),\\ &1.0,\quad\text{if}\ \mathcal{C}\!=\!1\ \wedge\mathcal{P}\!=\!0\wedge\mathcal{R}\!=\!0,\\ &0.0,\quad\text{if}\ \mathcal{C}\!=\!0\ \wedge\mathcal{P}\!=\!0\wedge\mathcal{R}\!=\!0,\\ -&0.5,\quad\text{if}\ \mathcal{C}\!=\!0\ \wedge\mathcal{P}\!=\!1\wedge\mathcal{R}\!=\!0,\\ -&1.0,\quad\text{if}\ \mathcal{C}\!=\!0\ \wedge\mathcal{R}\!=\!1.\\ \end{aligned}\right.$ (5) $$

Specifically, we encourage the model to reach correct answers through planning and self-reflection, by assigning a larger reward (i.e., $2.0$) if they are involved in the reasoning process.
However, if these patterns lead to incorrect answers, we impose a penalty for its overthinking.
Since self-reflection is a more decisive pattern, we assign a larger penalty (i.e., $-1.0$) for errors resulting from it.

Reflection Quality and Format Reward.
To facilitate meaningful self-reflection, we assess the quality of reflection by an external model $\mathcal{M}$: $R_{\text{ref}}=\mathcal{M}(\bm{S})$.
The criterion is the originality of the reflection, i.e., whether it introduces new perspectives rather than restating prior discoveries.
The model only obtains $R_{\text{ref}}$ when the answer is correct.
For format reward $R_{\text{fmt}}$, we predefine some combinations of reasoning patterns and set $R_{\text{fmt}}=1$ when the response conforms to valid formats.

Suppose $\mathbb{I}(\cdot)$ is the indicator function. The final reward $R$ for each response is defined as:

$$ $R=R_{\text{pattern}}+\lambda_{1}R_{\text{ref}}\cdot\mathbb{I}(\mathcal{C}\!=\!1)+\lambda_{2}R_{\text{fmt}}.$ (6) $$

In practice, given that only verifiable answers are required, the training data $\mathcal{D}_{3}$ can be freely expanded.
Our cold-start model serves as a solid reasoning foundation, upon which the community can utilize custom data with P-GRPO to achieve more powerful reasoning model for deepfake detection.

**Table 1: Performance comparison (Acc) on HydraFake dataset. In-domain (ID) results are averaged. The best results are bolded and second best are underlined. More metrics are reported in Appendix [A.4](https://arxiv.org/html/2508.21048v1#A1.SS4).**
| Method | ID | Cross-Model | Cross-Forgery | Cross-Domain | Avg. |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  |  | ADF | FLUX | StarryAI | MAGI-1 | HART | Infinity | St.GAN2 | ICLight | CodeF. | InfiniteY. | PuLID | FaceAda. | Deepface. | InfiniteY. | Dreamina | HailuoAI | GPT-4o | FFIW |  |
| F3Net (ECCV’20) | 85.3 | 86.7 | 87.8 | 78.6 | 85.0 | 86.0 | 82.9 | 41.3 | 48.9 | 71.9 | 84.9 | 85.5 | 72.6 | 57.7 | 78.5 | 55.6 | 68.6 | 66.2 | 66.4 | 73.2 |
| UniFD (CVPR’23) | 82.7 | 90.7 | 93.8 | 82.5 | 73.0 | 94.4 | 90.7 | 61.8 | 81.9 | 75.4 | 73.7 | 68.1 | 81.3 | 67.4 | 67.3 | 80.5 | 75.2 | 73.3 | 67.5 | 78.0 |
| IID (CVPR’23) | 83.4 | 83.3 | 82.8 | 80.0 | 80.2 | 81.1 | 82.2 | 41.4 | 53.3 | 79.7 | 81.8 | 81.8 | 73.7 | 65.2 | 69.9 | 63.8 | 63.3 | 63.8 | 64.2 | 72.4 |
| FreqNet (AAAI’24) | 66.8 | 60.3 | 76.7 | 59.0 | 69.2 | 77.1 | 75.1 | 33.1 | 73.1 | 70.3 | 72.8 | 77.4 | 67.7 | 50.6 | 67.0 | 62.1 | 59.3 | 58.3 | 51.2 | 64.6 |
| ProDet (NIPS’24) | 90.5 | 92.6 | 94.2 | 88.2 | 91.9 | 93.8 | 93.1 | 56.3 | 58.6 | 80.8 | 88.1 | 91.0 | 83.3 | 58.1 | 82.9 | 71.3 | 75.6 | 66.3 | 74.1 | 80.6 |
| NPR (CVPR’24) | 75.6 | 68.8 | 91.2 | 59.5 | 82.6 | 91.3 | 84.0 | 47.7 | 67.8 | 60.6 | 79.8 | 89.0 | 67.7 | 52.6 | 73.0 | 76.6 | 62.3 | 50.2 | 46.0 | 69.8 |
| AIDE (ICLR’25) | 80.4 | 68.8 | 86.3 | 64.0 | 88.9 | 95.4 | 76.0 | 56.7 | 79.2 | 86.1 | 74.2 | 62.4 | 75.7 | 59.7 | 67.9 | 49.7 | 58.0 | 51.9 | 59.2 | 70.6 |
| Co-SPY (CVPR’25) | 86.3 | 93.5 | 95.5 | 85.3 | 93.3 | 96.6 | 95.3 | 77.0 | 92.5 | 88.6 | 90.6 | 79.1 | 87.3 | 67.6 | 80.0 | 82.5 | 74.0 | 79.5 | 64.3 | 84.7 |
| D^3 (CVPR’25) | 87.3 | 93.6 | 95.6 | 91.3 | 90.7 | 95.8 | 95.5 | 62.4 | 71.6 | 82.9 | 80.0 | 82.4 | 73.7 | 69.7 | 74.6 | 78.1 | 70.9 | 80.8 | 64.3 | 81.1 |
| Effort (ICML’25) | 94.7 | 82.8 | 96.5 | 78.0 | 90.5 | 97.8 | 98.3 | 64.7 | 94.8 | 89.7 | 89.5 | 92.9 | 88.0 | 64.8 | 82.2 | 61.5 | 66.4 | 53.8 | 74.0 | 82.2 |
| Qwen2.5-VL-7B | 51.2 | 50.0 | 50.0 | 49.7 | 50.0 | 52.0 | 52.9 | 50.5 | 56.7 | 50.7 | 53.6 | 54.5 | 51.6 | 50.7 | 53.6 | 80.2 | 67.5 | 52.5 | 50.5 | 54.1 |
| InternVL3-8B | 54.0 | 54.0 | 49.8 | 49.0 | 56.6 | 55.8 | 57.2 | 62.9 | 54.2 | 62.9 | 63.6 | 54.8 | 67.7 | 54.4 | 67.1 | 77.1 | 66.5 | 47.4 | 51.8 | 58.3 |
| MiMo-VL-7B | 63.8 | 74.5 | 77.1 | 82.5 | 60.3 | 82.4 | 81.4 | 48.7 | 82.6 | 76.4 | 79.7 | 78.4 | 82.8 | 57.7 | 75.6 | 79.4 | 70.7 | 67.7 | 54.9 | 72.5 |
| GLM-4.1V-9BThink | 56.4 | 55.2 | 52.3 | 50.5 | 51.6 | 68.4 | 60.7 | 54.3 | 68.4 | 63.3 | 65.7 | 55.1 | 81.0 | 58.7 | 72.7 | 83.7 | 69.2 | 52.0 | 53.9 | 61.7 |
| GPT-4o | 53.5 | 57.7 | 52.0 | 51.4 | 59.9 | 81.2 | 54.8 | 66.4 | 58.9 | 52.5 | 64.4 | 60.9 | 55.5 | 49.4 | 62.0 | 90.7 | 73.7 | 58.0 | 52.8 | 60.8 |
| Gemini-2.5-Pro | 72.2 | 64.9 | 92.4 | 82.8 | 62.5 | 93.4 | 93.2 | 73.7 | 83.3 | 87.4 | 85.5 | 84.7 | 85.6 | 67.2 | 75.6 | 87.5 | 82.4 | 70.9 | 53.0 | 78.9 |
| Veritas (cold-start) | 96.8 | 79.5 | 99.6 | 96.0 | 99.9 | 99.7 | 99.9 | 84.0 | 65.3 | 94.8 | 86.2 | 93.4 | 86.7 | 55.9 | 73.5 | 93.7 | 89.3 | 88.1 | 76.4 | 87.3 |
| Veritas (ours) | 97.3 | 94.8 | 99.8 | 97.0 | 99.9 | 99.9 | 99.9 | 90.3 | 75.7 | 97.0 | 91.8 | 95.1 | 91.7 | 58.6 | 84.1 | 92.3 | 90.2 | 89.2 | 78.5 | 90.7 |

Figure: Table 2: Effect of the proposed pattern-aware reasoning.

## 5 Experiments

### 5.1 Experimental Setup

State-of-the-Art Methods.
We trained $10$ state-of-the-art (SOTA) detectors on our dataset, including F3Net Qian et al. (2020), UniFD Ojha et al. (2023), IID Huang et al. (2023), FreqNet Tan et al. (2024a), ProDet Cheng et al. (2024), NPR Tan et al. (2024b), AIDE Yan et al. (2024a), Co-SPY Cheng et al. (2025), D^3 Yang et al. (2025b), Effort Yan et al. (2024c).
We also assess $4$ open-source MLLMs of similar size to our model, including Qwen2.5-VL-7B Bai et al. (2025), InternVL3-8B Zhu et al. (2025), MiMo-VL-7B Team (2025) and GLM-4.1V-9B-Thinking Hong et al. (2025).
We provide prior knowledge and instruct the model to perform thinking in the prompts.
We further evaluate $2$ powerful closed-source models GPT-4o Hurst et al. (2024) and Gemini-2.5-Pro Comanici et al. (2025).
For Gemini-2.5-Pro, we enable thinking and searching.

Metrics.
Following previous works Zhang et al. (2024a); Guo et al. (2025b), we take Accuracy (Acc) to measure the model performance.
Precision and Recall are reported in Appendix [A.4](https://arxiv.org/html/2508.21048v1#A1.SS4).

Implementation Details.
We implement Veritas  with InternVL3-8B Zhu et al. (2025).
For the cold-start SFT, we train the model for $3$ epochs using LoRA Hu et al. (2022) (rank=128, $\alpha$=256).
The learning rate is set to $5\times 10^{-5}$, with a batch size of $64$.
For cold-start MiPO, the model is trained for $2$ epochs with the same setting of SFT.
For P-GRPO, we further train the model for $2$ epochs with the same LoRA setting.
The learning rate is set to $1\times 10^{-6}$ with a batch size of $16$.
$G$ is set to $4$, with a temperature of $1.0$.
$\beta$ and $\beta^{\prime}$ are set to 0.
We take UnifiedReward-Qwen-3B Wang et al. (2025b) as the reward model $\mathcal{M}$.
For each stage, we directly adopt model from the last step.

### 5.2 Main Results

Comparison to SOTA detectors.
As shown in Table [1](https://arxiv.org/html/2508.21048v1#S4.T1), our Veritas model achieves SOTA performance on four evaluation scenarios, achieving 6.0% averaged performance gains over the previous best method.
Existing detectors show great performance on cross-model split but fall short on cross-forgery and cross-domain scenarios.
Veritas greatly mitigates the gaps, achieving over 90.0% on unseen forgery such as face restoration and personalization, and over 90.0% on in-the-wild data from Dreamina and Hailuo AI.
The remarkable performance on cross-model data (i.e., over 99.9% on cross-model data such as VAR) further confirms the superiority of Veritas.
More results and analyses can be found in Appendix [A.4](https://arxiv.org/html/2508.21048v1#A1.SS4).

Comparison to SOTA MLLMs.
Compared to our base model, Veritas achieves 32.4% averaged performance gain, suggesting the effectiveness of our training strategy.
The models with similar sizes to our model show limited abilities for deepfake detection, with less than 60% accuracy.
Even GPT-4o fails on many cases, achieving only 60.8% averaged accuracy.
Gemini-2.5-Pro shows the best capacities among these MLLMs, even outperforming some of the fine-tuned detectors.
Our Veritas  model surpasses Gemini-2.5-Pro by 11.8%, demonstrating great generalization.

Figure: Table 5: Evaluation of reasoning quality. We utilize score and pairwise ELO rating.

Figure: Figure 5: Ablations on the training stages. “Avg” is directly averaged across four splits.
Refer to caption: x5.png

### 5.3 Ablation Studies

Effect of pattern-aware reasoning.
As shown in Table [2](https://arxiv.org/html/2508.21048v1#S4.T2), we compare different reasoning paradigms using SFT and P-GRPO training.
Although the improvements on in-domain datasets are marginal, our pattern-aware reasoning demonstrates clear advantages to flexible reasoning on OOD scenarios, achieving 6.2% and 3.3% gains on CF and CD testing respectively.
The post-hoc explanation adopted in recent methods exhibits degraded performance in OOD testing, further verifying the superiority of pattern-aware reasoning.

Ablations on different training stages.
As shown in Figure [6](https://arxiv.org/html/2508.21048v1#S5.F6), we investigate the effect of each training stage.
Applying MiPO or P-GRPO upon SFT model both achieve significant gains, with P-GRPO performing better, which is due to the online sampling and pattern-aware incentivization.
Applying MiPO before P-GRPO yields the best performance, achieving 2.9% and 2.1% gains on CF and CD testing respectively.
This is because MiPO ensures high-quality rollouts in subsequent stage, facilitating more accurate policy updates for online RL.

Effect of Pattern-guided Cold-Start.
As shown in Figure [6](https://arxiv.org/html/2508.21048v1#S5.F6), we investigate different RL settings without cold-start.
The training data keeps consistent with our two-stage pipeline.
Answer-only model achieves better ID results while incorporating thinking improves CM and CD performance.
However, all settings underperform the model with cold-start.
The low-quality explorations lead to unstable training.
Results in Figure [6](https://arxiv.org/html/2508.21048v1#S5.F6) further verify the effectiveness of MiPO during cold-start.

Effect of Pattern-aware GRPO.
As shown in Table [3](https://arxiv.org/html/2508.21048v1#S4.T3), our P-GRPO achieves noticeable improvements compared to original GRPO.
Specifically, pattern-aware reward outperforms the vanilla accuracy reward especially on CF and CD scenarios.
The reflection quality reward benefits both original GRPO and our P-GRPO, which demonstrates the importance of high-quality self reflection.

### 5.4 Further Analyses

Evaluation of reasoning quality.
To evaluate the reasoning quality, we take two types of assessments: (1) score evaluation which is based on predefined criteria to assess the output’s preciseness, comprehensiveness, clarity, creativity, and granularity.
(2) Pairwise comparison which directly compare outputs from two models and performs ELO rating.
Specifically, we adopt MLLM-as-a-Judge Chen et al. (2024a) approach, using GPT-4o and Gemini-2.5-Pro for score evaluation and Gemini-2.5-Pro for pairwise comparison.
Similar to Zhou et al. (2025), we use $1$K samples for evaluation.
As shown in Table [5](https://arxiv.org/html/2508.21048v1#S5.T5), our model achieves the best score and ELO rating, where MiPO greatly improves the reasoning quality.
Moreover, our MiPO outperforms DPO in raising reasoning quality, which verifies the effectiveness of mixed non-preference strategy.

Different base models and model sizes.
As shown in Table [4](https://arxiv.org/html/2508.21048v1#S4.T4), we adopt different MLLMs as our base model.
InternVL3-8B outperforms Qwen2.5-VL-7B and MiMo-VL-7B, due to the dynamic high resolution strategy.
InternVL3-2B achieves promising performance with fewer parameters, while scaling up to 14B yields considerable gains on CM and CF scenarios.

Robustness evaluation.
We investigate the performance under JPEG compression and Gaussian blur.
Results in Table [6](https://arxiv.org/html/2508.21048v1#S5.T6) highlight the robustness of our model.
Our model achieves consistently high performance under JPEG compression and maintains state-of-the-art results across different perturbations.
Notably, this robustness is achieved without training on corresponding data augmentations such as random Gaussian blur, which instead are commonly adopted in previous methods.

## 6 Conclusion

In this paper, we introduce HydraFake dataset and Veritas  model.
We recognize the discrepancy between current benchmarks and practical challenges and propose HydraFake, a dataset that simulates real-world challenges with holistic training and evaluation protocol.
Based on HydraFake, we further introduce Veritas, a multi-modal large language model (MLLM) based deepfake detector.
We propose a two-stage training pipeline consisting of pattern-guided cold-start and pattern-aware
exploration to internalize MLLMs into deepfake detection.
Results on HydraFake dataset shows that current detectors generalize well on cross-model data but struggle on cross-forgery and cross-domain scenarios, while our model greatly mitigates the gap and is capable of delivering transparent and faithful decision process.
We hope our dataset and model can benefit the community for more generalizable and reliable deepfake detection.

## References

- Adobe (2023)
Adobe.
*Adobe Firefly*, 2023.
[{https://firefly.adobe.com/}](%7Bhttps://firefly.adobe.com/%7D).
- AI (2023)
Starry AI.
Starry ai, 2023.
URL [https://starryai.com/](https://starryai.com/).
Accessed: 2025-03-11.
- Bai et al. (2025)
Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, et al.
Qwen2.5-vl technical report.
*arXiv preprint arXiv:2502.13923*, 2025.
- Black Forest Labs (2024)
Black Forest Labs.
Flux v1.1 pro, 2024.
URL [https://replicate.com/black-forest-labs/flux-1.1-pro](https://replicate.com/black-forest-labs/flux-1.1-pro).
- Bongini et al. (2025)
Pietro Bongini, Sara Mandelli, Andrea Montibeller, Mirko Casu, Orazio Pontorno, Claudio Vittorio Ragaglia, Luca Zanchetta, Mattia Aquilina, Taiba Majid Wani, Luca Guarnera, et al.
Wild: a new in-the-wild image linkage dataset for synthetic image attribution.
*arXiv preprint arXiv:2504.19595*, 2025.
- Chen et al. (2024a)
Dongping Chen, Ruoxi Chen, Shilin Zhang, Yaochen Wang, Yinuo Liu, Huichi Zhou, Qihui Zhang, Yao Wan, Pan Zhou, and Lichao Sun.
Mllm-as-a-judge: Assessing multimodal llm-as-a-judge with vision-language benchmark.
In *Forty-first International Conference on Machine Learning*, 2024a.
- Chen et al. (2025a)
Shuang Chen, Yue Guo, Zhaochen Su, Yafu Li, Yulun Wu, Jiacheng Chen, Jiayu Chen, Weijie Wang, Xiaoye Qu, and Yu Cheng.
Advancing multimodal reasoning: From optimized cold start to staged reinforcement learning.
*arXiv preprint arXiv:2506.04207*, 2025a.
- Chen et al. (2025b)
Tao Chen, Jingyi Zhang, Decheng Liu, and Chunlei Peng.
Mgffd-vlm: Multi-granularity prompt learning for face forgery detection with vlm.
*arXiv preprint arXiv:2507.12232*, 2025b.
- Chen et al. (2024b)
Yize Chen, Zhiyuan Yan, Guangliang Cheng, Kangran Zhao, Siwei Lyu, and Baoyuan Wu.
X2-dfd: A framework for explainable and extendable deepfake detection.
*arXiv preprint arXiv:2410.06126*, 2024b.
- Cheng et al. (2024)
Jikang Cheng, Zhiyuan Yan, Ying Zhang, Yuhao Luo, Zhongyuan Wang, and Chen Li.
Can we leave deepfake data behind in training deepfake detector?
*Advances in Neural Information Processing Systems*, 37:21979–21998, 2024.
- Cheng et al. (2025)
Siyuan Cheng, Lingjuan Lyu, Zhenting Wang, Xiangyu Zhang, and Vikash Sehwag.
Co-spy: Combining semantic and pixel features to detect synthetic images by ai.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp.  13455–13465, 2025.
- Choi et al. (2020)
Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Jung-Woo Ha.
Stargan v2: Diverse image synthesis for multiple domains.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp.  8188–8197, 2020.
- Comanici et al. (2025)
Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al.
Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities.
*arXiv preprint arXiv:2507.06261*, 2025.
- Dolhansky et al. (2019)
Brian Dolhansky, Russ Howes, Ben Pflaum, Nicole Baram, and Cristian Canton Ferrer.
The deepfake detection challenge (dfdc) preview dataset.
*arXiv preprint arXiv:1910.08854*, 2019.
- Dolhansky et al. (2020)
Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer.
The deepfake detection challenge (dfdc) dataset.
*arXiv preprint arXiv:2006.07397*, 2020.
- Esser et al. (2024)
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al.
Scaling rectified flow transformers for high-resolution image synthesis.
In *Forty-first international conference on machine learning*, 2024.
- Fu et al. (2025)
Xinghe Fu, Zhiyuan Yan, Taiping Yao, Shen Chen, and Xi Li.
Exploring unbiased deepfake detection via token-level shuffling and mixing.
In *Proceedings of the AAAI Conference on Artificial Intelligence*, volume 39, pp.  3040–3048, 2025.
- Gao et al. (2025)
Yueying Gao, Dongliang Chang, Bingyao Yu, Haotian Qin, Lei Chen, Kongming Liang, and Zhanyu Ma.
Fakereasoning: Towards generalizable forgery detection and reasoning.
*arXiv preprint arXiv:2503.21210*, 2025.
- Gu et al. (2021)
Zhihao Gu, Yang Chen, Taiping Yao, Shouhong Ding, Jilin Li, Feiyue Huang, and Lizhuang Ma.
Spatiotemporal inconsistency learning for deepfake video detection.
In *Proceedings of the 29th ACM international conference on multimedia*, pp.  3473–3481, 2021.
- Gu et al. (2022a)
Zhihao Gu, Yang Chen, Taiping Yao, Shouhong Ding, Jilin Li, and Lizhuang Ma.
Delving into the local: Dynamic inconsistency learning for deepfake video detection.
In *Proceedings of the AAAI conference on artificial intelligence*, volume 36, pp.  744–752, 2022a.
- Gu et al. (2022b)
Zhihao Gu, Taiping Yao, Yang Chen, Shouhong Ding, and Lizhuang Ma.
Hierarchical contrastive inconsistency learning for deepfake video detection.
In *European conference on computer vision*, pp.  596–613. Springer, 2022b.
- Guo et al. (2025a)
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al.
Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning.
*arXiv preprint arXiv:2501.12948*, 2025a.
- Guo et al. (2025b)
Xiao Guo, Xiufeng Song, Yue Zhang, Xiaohong Liu, and Xiaoming Liu.
Rethinking vision-language model in face forensics: Multi-modal interpretable forged face detector.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp.  105–116, 2025b.
- Guo et al. (2024)
Zinan Guo, Yanze Wu, Chen Zhuowei, Peng Zhang, Qian He, et al.
Pulid: Pure and lightning id customization via contrastive alignment.
*Advances in neural information processing systems*, 37:36777–36804, 2024.
- Han et al. (2025)
Jian Han, Jinlai Liu, Yi Jiang, Bin Yan, Yuqi Zhang, Zehuan Yuan, Bingyue Peng, and Xiaobing Liu.
Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp.  15733–15744, 2025.
- Han et al. (2024)
Yue Han, Junwei Zhu, Keke He, Xu Chen, Yanhao Ge, Wei Li, Xiangtai Li, Jiangning Zhang, Chengjie Wang, and Yong Liu.
Face-adapter for pre-trained diffusion models with fine-grained id and attribute control.
In *European Conference on Computer Vision*, pp.  20–36. Springer, 2024.
- He et al. (2025)
Xinan He, Yue Zhou, Bing Fan, Bin Li, Guopu Zhu, and Feng Ding.
Vlforgery face triad: Detection, localization and attribution via multimodal large language models.
*arXiv preprint arXiv:2503.06142*, 2025.
- Hong et al. (2025)
Wenyi Hong, Wenmeng Yu, Xiaotao Gu, Guo Wang, Guobing Gan, Haomiao Tang, Jiale Cheng, Ji Qi, Junhui Ji, Lihang Pan, et al.
Glm-4.1 v-thinking: Towards versatile multimodal reasoning with scalable reinforcement learning.
*arXiv e-prints*, pp.  arXiv–2507, 2025.
- Hu et al. (2022)
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al.
Lora: Low-rank adaptation of large language models.
*ICLR*, 1(2):3, 2022.
- Huang et al. (2023)
Baojin Huang, Zhongyuan Wang, Jifan Yang, Jiaxin Ai, Qin Zou, Qian Wang, and Dengpan Ye.
Implicit identity driven deepfake face swapping detection.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp.  4490–4499, 2023.
- Huang et al. (2008)
Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller.
Labeled faces in the wild: A database forstudying face recognition in unconstrained environments.
In *Workshop on faces in’Real-Life’Images: detection, alignment, and recognition*, 2008.
- Huang et al. (2024)
Zhengchao Huang, Bin Xia, Zicheng Lin, Zhun Mou, Wenming Yang, and Jiaya Jia.
Ffaa: Multimodal large language model based explainable open-world face forgery analysis assistant.
*arXiv preprint arXiv:2408.10072*, 2024.
- Huang et al. (2025a)
Zhenglin Huang, Jinwei Hu, Xiangtai Li, Yiwei He, Xingyu Zhao, Bei Peng, Baoyuan Wu, Xiaowei Huang, and Guangliang Cheng.
Sida: Social media image deepfake detection, localization and explanation with large multimodal model.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp.  28831–28841, 2025a.
- Huang et al. (2025b)
Zhenglin Huang, Tianxiao Li, Xiangtai Li, Haiquan Wen, Yiwei He, Jiangning Zhang, Hao Fei, Xi Yang, Xiaowei Huang, Bei Peng, et al.
So-fake: Benchmarking and explaining social media image forgery detection.
*arXiv preprint arXiv:2505.18660*, 2025b.
- Hurst et al. (2024)
Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al.
Gpt-4o system card.
*arXiv preprint arXiv:2410.21276*, 2024.
- Jaech et al. (2024)
Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al.
Openai o1 system card.
*arXiv preprint arXiv:2412.16720*, 2024.
- Jiang et al. (2025)
Liming Jiang, Qing Yan, Yumin Jia, Zichuan Liu, Hao Kang, and Xin Lu.
Infiniteyou: Flexible photo recrafting while preserving your identity.
*arXiv preprint arXiv:2503.16418*, 2025.
- Karras et al. (2017)
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen.
Progressive growing of gans for improved quality, stability, and variation.
*arXiv preprint arXiv:1710.10196*, 2017.
- Karras et al. (2019)
Tero Karras, Samuli Laine, and Timo Aila.
A style-based generator architecture for generative adversarial networks.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp.  4401–4410, 2019.
- Kashiani et al. (2025)
Hossein Kashiani, Niloufar Alipour Talemi, and Fatemeh Afghah.
Freqdebias: Towards generalizable deepfake detection via consistency-driven frequency debiasing.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp.  8775–8785, 2025.
- Kojima et al. (2022)
Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa.
Large language models are zero-shot reasoners.
*Advances in neural information processing systems*, 35:22199–22213, 2022.
- Li et al. (2020a)
Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo.
Face x-ray for more general face forgery detection.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp.  5001–5010, 2020a.
- Li et al. (2020b)
Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu.
Celeb-df: A large-scale challenging dataset for deepfake forensics.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp.  3207–3216, 2020b.
- Li et al. (2025)
Ziqiang Li, Jiazhen Yan, Ziwen He, Kai Zeng, Weiwei Jiang, Lizhi Xiong, and Zhangjie Fu.
Is artificial intelligence generated image detection a solved problem?
*arXiv preprint arXiv:2505.12335*, 2025.
- Liao et al. (2025)
Yuan-Hong Liao, Sven Elflein, Liu He, Laura Leal-Taixé, Yejin Choi, Sanja Fidler, and David Acuna.
Longperceptualthoughts: Distilling system-2 reasoning for system-1 perception.
*arXiv preprint arXiv:2504.15362*, 2025.
- Liu et al. (2023)
Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee.
Visual instruction tuning.
*Advances in neural information processing systems*, 36:34892–34916, 2023.
- Liu et al. (2015)
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.
Deep learning face attributes in the wild.
In *Proceedings of the IEEE international conference on computer vision*, pp.  3730–3738, 2015.
- Liu et al. (2025)
Ziyu Liu, Zeyi Sun, Yuhang Zang, Xiaoyi Dong, Yuhang Cao, Haodong Duan, Dahua Lin, and Jiaqi Wang.
Visual-rft: Visual reinforcement fine-tuning.
*arXiv preprint arXiv:2503.01785*, 2025.
- Muennighoff et al. (2025)
Niklas Muennighoff, Zitong Yang, Weijia Shi, Xiang Lisa Li, Li Fei-Fei, Hannaneh Hajishirzi, Luke Zettlemoyer, Percy Liang, Emmanuel Candès, and Tatsunori Hashimoto.
s1: Simple test-time scaling.
*arXiv preprint arXiv:2501.19393*, 2025.
- Nguyen et al. (2024)
Dat Nguyen, Nesryne Mejri, Inder Pal Singh, Polina Kuleshova, Marcella Astrid, Anis Kacem, Enjie Ghorbel, and Djamila Aouada.
Laa-net: Localized artifact attention network for quality-agnostic and generalizable deepfake detection.
In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp.  17395–17405, 2024.
- Ojha et al. (2023)
Utkarsh Ojha, Yuheng Li, and Yong Jae Lee.
Towards universal fake image detectors that generalize across generative models.
In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp.  24480–24489, 2023.
- Peng et al. (2025)
Siran Peng, Zipei Wang, Li Gao, Xiangyu Zhu, Tianshuo Zhang, Ajian Liu, Haoyuan Zhang, and Zhen Lei.
Mllm-enhanced face forgery detection: A vision-language fusion solution.
*arXiv preprint arXiv:2505.02013*, 2025.
- Qian et al. (2020)
Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao.
Thinking in frequency: Face forgery detection by mining frequency-aware clues.
In *European conference on computer vision*, pp.  86–103. Springer, 2020.
- Ren et al. (2025)
Simiao Ren, Yao Yao, Kidus Zewde, Zisheng Liang, Ning-Yau Cheng, Xiaoou Zhan, Qinzhe Liu, Yifei Chen, Hengwei Xu, et al.
Can multi-modal (reasoning) llms work as deepfake detectors?
*arXiv preprint arXiv:2503.20084*, 2025.
- Rossler et al. (2019)
Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner.
Faceforensics++: Learning to detect manipulated facial images.
In *Proceedings of the IEEE/CVF international conference on computer vision*, pp.  1–11, 2019.
- Sand-AI (2025)
Sand-AI.
Magi-1: Autoregressive video generation at scale, 2025.
- Shiohara & Yamasaki (2022)
Kaede Shiohara and Toshihiko Yamasaki.
Detecting deepfakes with self-blended images.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp.  18720–18729, 2022.
- Sun et al. (2025)
Ke Sun, Shen Chen, Taiping Yao, Ziyin Zhou, Jiayi Ji, Xiaoshuai Sun, Chia-Wen Lin, and Rongrong Ji.
Towards general visual-linguistic face forgery detection.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp.  19576–19586, 2025.
- Tan et al. (2024a)
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei.
Frequency-aware deepfake detection: Improving generalizability through frequency space domain learning.
In *Proceedings of the AAAI Conference on Artificial Intelligence*, volume 38, pp.  5052–5060, 2024a.
- Tan et al. (2024b)
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei.
Rethinking the up-sampling operations in cnn-based generative network for generalizable deepfake detection.
In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp.  28130–28139, 2024b.
- Tang et al. (2024)
Haotian Tang, Yecheng Wu, Shang Yang, Enze Xie, Junsong Chen, Junyu Chen, Zhuoyang Zhang, Han Cai, Yao Lu, and Song Han.
Hart: Efficient visual generation with hybrid autoregressive transformer.
*arXiv preprint arXiv:2410.10812*, 2024.
- Tariq et al. (2025)
Shahroz Tariq, David Nguyen, MAP Chamikara, Tingmin Wu, Alsharif Abuadbba, and Kristen Moore.
Llms are not yet ready for deepfake image detection.
*arXiv preprint arXiv:2506.10474*, 2025.
- team (2025a)
Dreamina AI team.
Dreamina.
[https://jimeng.jianying.com](https://jimeng.jianying.com), 2025a.
Accessed: 2025-07-25.
- team (2025b)
Hailuo AI team.
Hailuo video.
[https://hailuoai.com/video/create](https://hailuoai.com/video/create), 2025b.
Accessed: 2025-07-25.
- Team et al. (2025)
Kimi Team, Angang Du, Bohong Yin, Bowei Xing, Bowen Qu, Bowen Wang, Cheng Chen, Chenlin Zhang, Chenzhuang Du, Chu Wei, et al.
Kimi-vl technical report.
*arXiv preprint arXiv:2504.07491*, 2025.
- Team (2025)
Xiaomi LLM-Core Team.
Mimo-vl technical report.
2025.
URL [https://arxiv.org/abs/2506.03569](https://arxiv.org/abs/2506.03569).
- Tian et al. (2024)
Keyu Tian, Yi Jiang, Zehuan Yuan, Bingyue Peng, and Liwei Wang.
Visual autoregressive modeling: Scalable image generation via next-scale prediction.
*Advances in neural information processing systems*, 37:84839–84865, 2024.
- Tu et al. (2025)
Songjun Tu, Jiahao Lin, Qichao Zhang, Xiangyu Tian, Linjing Li, Xiangyuan Lan, and Dongbin Zhao.
Learning when to think: Shaping adaptive reasoning in r1-style models via multi-stage rl.
*arXiv preprint arXiv:2505.10832*, 2025.
- Wang et al. (2025a)
Runqi Wang, Sijie Xu, Tianyao He, Yang Chen, Wei Zhu, Dejia Song, Nemo Chen, Xu Tang, and Yao Hu.
Dynamicface: High-quality and consistent video face swapping using composable 3d facial priors.
*arXiv preprint arXiv:2501.08553*, 2025a.
- Wang et al. (2025b)
Yibin Wang, Yuhang Zang, Hao Li, Cheng Jin, and Jiaqi Wang.
Unified reward model for multimodal understanding and generation.
*arXiv preprint arXiv:2503.05236*, 2025b.
- Wei et al. (2022)
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al.
Chain-of-thought prompting elicits reasoning in large language models.
*Advances in neural information processing systems*, 35:24824–24837, 2022.
- Wen et al. (2025)
Siwei Wen, Junyan Ye, Peilin Feng, Hengrui Kang, Zichen Wen, Yize Chen, Jiang Wu, Wenjun Wu, Conghui He, and Weijia Li.
Spot the fake: Large multimodal model-based synthetic image detection with artifact explanation.
*arXiv preprint arXiv:2503.14905*, 2025.
- Xia et al. (2025)
Cheng Xia, Manxi Lin, Jiexiang Tan, Xiaoxiong Du, Yang Qiu, Junjun Zheng, Xiangheng Kong, Yuning Jiang, and Bo Zheng.
Mirage: Towards ai-generated image detection in the wild.
*arXiv preprint arXiv:2508.13223*, 2025.
- Xiao et al. (2025)
Wenyi Xiao, Leilei Gan, Weilong Dai, Wanggui He, Ziwei Huang, Haoyuan Li, Fangxun Shu, Zhelun Yu, Peng Zhang, Hao Jiang, et al.
Fast-slow thinking for large vision-language model reasoning.
*arXiv preprint arXiv:2504.18458*, 2025.
- Xie et al. (2022)
Liangbin Xie, Xintao Wang, Honglun Zhang, Chao Dong, and Ying Shan.
Vfhq: A high-quality dataset and benchmark for video face super-resolution.
In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp.  657–666, 2022.
- Xiong et al. (2025)
Xinqi Xiong, Prakrut Patel, Qingyuan Fan, Amisha Wadhwa, Sarathy Selvam, Xiao Guo, Luchao Qi, Xiaoming Liu, and Roni Sengupta.
Talkingheadbench: A multi-modal benchmark & analysis of talking-head deepfake detection.
*arXiv preprint arXiv:2505.24866*, 2025.
- Xu et al. (2024a)
Guowei Xu, Peng Jin, Hao Li, Yibing Song, Lichao Sun, and Li Yuan.
Llava-cot: Let vision language models reason step-by-step.
*arXiv preprint arXiv:2411.10440*, 2024a.
- Xu et al. (2024b)
Zhipei Xu, Xuanyu Zhang, Runyi Li, Zecheng Tang, Qing Huang, and Jian Zhang.
Fakeshield: Explainable image forgery detection and localization via multi-modal large language models.
*arXiv preprint arXiv:2410.02761*, 2024b.
- Yan et al. (2024a)
Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie.
A sanity check for ai-generated image detection.
*arXiv preprint arXiv:2406.19435*, 2024a.
- Yan et al. (2024b)
Zhiyuan Yan, Yuhao Luo, Siwei Lyu, Qingshan Liu, and Baoyuan Wu.
Transcending forgery specificity with latent space augmentation for generalizable deepfake detection.
In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp.  8984–8994, 2024b.
- Yan et al. (2024c)
Zhiyuan Yan, Jiangming Wang, Peng Jin, Ke-Yue Zhang, Chengchun Liu, Shen Chen, Taiping Yao, Shouhong Ding, Baoyuan Wu, and Li Yuan.
Orthogonal subspace decomposition for generalizable ai-generated image detection.
*arXiv preprint arXiv:2411.15633*, 2024c.
- Yan et al. (2024d)
Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Chengjie Wang, Shouhong Ding, Yunsheng Wu, et al.
Df40: Toward next-generation deepfake detection.
*Advances in Neural Information Processing Systems*, 37:29387–29434, 2024d.
- Yan et al. (2025)
Zhiyuan Yan, Yandan Zhao, Shen Chen, Mingyi Guo, Xinghe Fu, Taiping Yao, Shouhong Ding, Yunsheng Wu, and Li Yuan.
Generalizing deepfake video detection with plug-and-play: Video-level blending and spatiotemporal adapter tuning.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp.  12615–12625, 2025.
- Yang et al. (2025a)
An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al.
Qwen3 technical report.
*arXiv preprint arXiv:2505.09388*, 2025a.
- Yang et al. (2019)
Xin Yang, Yuezun Li, and Siwei Lyu.
Exposing deep fakes using inconsistent head poses.
In *ICASSP 2019-2019 IEEE international conference on acoustics, speech and signal processing (ICASSP)*, pp.  8261–8265. IEEE, 2019.
- Yang et al. (2025b)
Yongqi Yang, Zhihao Qian, Ye Zhu, Olga Russakovsky, and Yu Wu.
Dˆ 3: Scaling up deepfake detection by learning from discrepancy.
In *Proceedings of the Computer Vision and Pattern Recognition Conference*, pp.  23850–23859, 2025b.
- Yang et al. (2025c)
Zheng Yang, Ruoxin Chen, Zhiyuan Yan, Ke-Yue Zhang, Xinghe Fu, Shuang Wu, Xiujun Shu, Taiping Yao, Shouhong Ding, and Xi Li.
All patches matter, more patches better: Enhance ai-generated image detection via panoptic patch learning.
*arXiv preprint arXiv:2504.01396*, 2025c.
- Ye et al. (2025)
Fulong Ye, Miao Hua, Pengze Zhang, Xinghui Li, Qichao Sun, Songtao Zhao, Qian He, and Xinglong Wu.
Dreamid: High-fidelity and fast diffusion-based face swapping via triplet id group learning.
*arXiv preprint arXiv:2504.14509*, 2025.
- Yue et al. (2025)
Yang Yue, Zhiqi Chen, Rui Lu, Andrew Zhao, Zhaokai Wang, Shiji Song, and Gao Huang.
Does reinforcement learning really incentivize reasoning capacity in llms beyond the base model?
*arXiv preprint arXiv:2504.13837*, 2025.
- Zhan et al. (2025)
Yufei Zhan, Ziheng Wu, Yousong Zhu, Rongkun Xue, Ruipu Luo, Zhenghao Chen, Can Zhang, Yifan Li, Zhentao He, Zheming Yang, et al.
Gthinker: Towards general multimodal reasoning via cue-guided rethinking.
*arXiv preprint arXiv:2506.01078*, 2025.
- Zhang et al. (2025a)
Jingyi Zhang, Jiaxing Huang, Huanjin Yao, Shunyu Liu, Xikun Zhang, Shijian Lu, and Dacheng Tao.
R1-vl: Learning to reason with multimodal large language models via step-wise group relative policy optimization.
*arXiv preprint arXiv:2503.12937*, 2025a.
- Zhang et al. (2025b)
Lvmin Zhang, Anyi Rao, and Maneesh Agrawala.
Scaling in-the-wild training for diffusion-based illumination harmonization and editing by imposing consistent light transport.
In *The Thirteenth International Conference on Learning Representations*, 2025b.
- Zhang et al. (2025c)
Wayne Zhang, Changjiang Jiang, Zhonghao Zhang, Chenyang Si, Fengchang Yu, and Wei Peng.
Ivy-fake: A unified explainable framework and benchmark for image and video aigc detection.
*arXiv preprint arXiv:2506.00979*, 2025c.
- Zhang et al. (2024a)
Yue Zhang, Ben Colman, Xiao Guo, Ali Shahriyari, and Gaurav Bharaj.
Common sense reasoning for deepfake detection.
In *European conference on computer vision*, pp.  399–415. Springer, 2024a.
- Zhang et al. (2024b)
Zicheng Zhang, Haoning Wu, Chunyi Li, Yingjie Zhou, Wei Sun, Xiongkuo Min, Zijian Chen, Xiaohong Liu, Weisi Lin, and Guangtao Zhai.
A-bench: Are lmms masters at evaluating ai-generated images?
*arXiv preprint arXiv:2406.03070*, 2024b.
- Zhao et al. (2025)
Rosie Zhao, Alexandru Meterez, Sham Kakade, Cengiz Pehlevan, Samy Jelassi, and Eran Malach.
Echo chamber: Rl post-training amplifies behaviors learned in pretraining.
*arXiv preprint arXiv:2504.07912*, 2025.
- Zhao et al. (2021)
Tianchen Zhao, Xiang Xu, Mingze Xu, Hui Ding, Yuanjun Xiong, and Wei Xia.
Learning self-consistency for deepfake detection.
In *Proceedings of the IEEE/CVF international conference on computer vision*, pp.  15023–15033, 2021.
- Zhou et al. (2024)
Jiaran Zhou, Yuezun Li, Baoyuan Wu, Bin Li, Junyu Dong, et al.
Freqblender: Enhancing deepfake detection by blending frequency knowledge.
*Advances in Neural Information Processing Systems*, 37:44965–44988, 2024.
- Zhou et al. (2022)
Shangchen Zhou, Kelvin Chan, Chongyi Li, and Chen Change Loy.
Towards robust blind face restoration with codebook lookup transformer.
*Advances in Neural Information Processing Systems*, 35:30599–30611, 2022.
- Zhou et al. (2021)
Tianfei Zhou, Wenguan Wang, Zhiyuan Liang, and Jianbing Shen.
Face forensics in the wild.
In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pp.  5778–5788, 2021.
- Zhou et al. (2025)
Ziyin Zhou, Yunpeng Luo, Yuanchen Wu, Ke Sun, Jiayi Ji, Ke Yan, Shouhong Ding, Xiaoshuai Sun, Yunsheng Wu, and Rongrong Ji.
Aigi-holmes: Towards explainable and generalizable ai-generated image detection via multimodal large language models.
*arXiv preprint arXiv:2507.02664*, 2025.
- Zhu et al. (2025)
Jinguo Zhu, Weiyun Wang, Zhe Chen, Zhaoyang Liu, Shenglong Ye, Lixin Gu, Hao Tian, Yuchen Duan, Weijie Su, Jie Shao, et al.
Internvl3: Exploring advanced training and test-time recipes for open-source multimodal models.
*arXiv preprint arXiv:2504.10479*, 2025.
- Zi et al. (2020)
Bojia Zi, Minghao Chang, Jingjing Chen, Xingjun Ma, and Yu-Gang Jiang.
Wilddeepfake: A challenging real-world dataset for deepfake detection.
In *Proceedings of the 28th ACM international conference on multimedia*, pp.  2382–2390, 2020.

## Appendix A Appendix

### A.1 Details of HydraFake Dataset

In this section, we provide more details about our HydraFake Dataset.
We introduce the dataset from the perspective of training and evaluation protocols.

#### A.1.1 Training

Real Images.
HydraFake dataset contains real images from $8$ public datasets.
We extract $5$ subsets as the training set, containing $3$ low-quality subsets and $2$ high-quality subsets.
The low-quality images include FF++ Rossler et al. (2019), CelebA Liu et al. (2015) and LFW Huang et al. (2008).
The high-quality images include FFHQ Karras et al. (2019) and CelebAHQ Karras et al. (2017).
This results in $24$K real images for training.

Fake Images.
In practical scenario, there are abundant fake images for training, while these images have two attributes: (1) the quality of the images varies greatly, and (2) the forgery types are often limited.
To mimic such setting, we extract $21$ subsets as the training set and strictly control the seen forgeries.
We only include face swapping (FS), face reenactment (FR) and entire face generation (EFG) in our training set, leaving various forgery types unseen.
Moreover, the deepfake methods in our training set are not the latest, leaving fresh methods in the evaluation.

- •
FS: FF++, BlendFace, FSGAN, SimSwap, FaceDancer, MobileSwap.
- •
FR: FF++, Facevid2vid, Hallo, Hallo2, LivePortrait, AniPortrait, EmoPortrait
- •
EFG: Dall-e 1, StyleGAN, StyleGAN2, VQGAN, Midjourney, Seeprettyface, Stable Cascade, Stable Diffusion XL, Attend-and-Excite.

Figure: Figure 7: Examples of our self-constructed subsets in HydraFake datasets.
Refer to caption: x7.png

#### A.1.2 In-Domain Evaluation

For in-domain testing, we select $5$ subsets from the training set, and use the unseen identities as the testing samples.
Specifically, we make a balance on the image quality and forgery types, choosing a FS dataset FF++ (low-quality), two FR datasets Facevid2vid (low-quality) and Hallo2 (high-quality), and two EFG datasets StyleGAN Karras et al. (2019) (high-quality) and Midjourney (high-quality).
For low-quality subsets, the real images are sampled from FF++.
For high-quality subsets, the real images are sampled from FFHQ.

#### A.1.3 Cross-Model Evaluation

The cross-model testing images come from deepfakes generated using unseen models.
While the difficulty varies according to the model architectures.
This includes $6$ subsets, i.e., Adobe Firefly Adobe (2023), MAGI-1 Sand-AI (2025), Flux1.1 Pro Black Forest Labs (2024), StarryAI AI (2023), Infinity Han et al. (2025) and HART Tang et al. (2024).

Infinity.
Infinity is a Bitwise Visual AutoRegressive Model (VAR) capable of generating high-resolution and photorealistic images from textual prompts.
Infinity redefines visual autoregressive model under a bitwise token prediction framework with an infinite-vocabulary tokenizer and bitwise self-correction.
We reproduce the Infinity-8B model, which is capable of generating $1024\times 1024$ images.
The control prompts are generated using Qwen3-32B model, which leverages a template-like sentence, balances between gender and age and avoids any semantic conflicts (e.g., wrinkles on the little girl’s face) with the help of LLM.

HART.
Hybrid Autoregressive Transformer (HART) is an autoregressive (AR) visual generation model capable of directly generating $1024\times 1024$ images, rivaling diffusion models in image generation quality.
It contains a hybrid image tokenizer to improve the fidelity of the generated images.
We reproduce HART model, which is based on Qwen2-VL-1.5B.
The textual prompts are consistent with Infinity.

Adobe Firefly.
Adobe Firefly is a proprietary suite of multimodal generative AI models developed by Adobe.
It is built upon a deeply customized and optimized diffusion model.
It exclusively utilizes the Adobe Stock library, open-licensed content, and public domain works, thereby designed to ensure the commercial viability and mitigate copyright risks of its generated outputs.
We collect this subset from WILD Bongini et al. (2025), which is generated using template-like textual prompts.

StarryAI.
Starry AI is an advanced generative artificial intelligence model engineered for high-fidelity text-to-image synthesis. Its core architecture integrates a transformer-based encoder for the semantic interpretation of textual prompts with a latent diffusion model for the iterative synthesis of visual content.
The model excels at translating complex, abstract descriptions into visually coherent and stylistically nuanced imagery.
We collect this subset from WILD Bongini et al. (2025), which is generated using template-like textual prompts.

MAGI-1.
MAGI-1 is an autoregressive denoising video generation model (Video AR) generating videos chunk-by-chunk instead of as a whole.
It excels in generating high-quality, temporally consistent videos from text or image prompts.
With support for large-scale model sizes and long context lengths, it is well-suited for a wide range of creative and generative video applications.
We collect this subset from TalkingHeadBench Bongini et al. (2025).

Flux1.1 Pro.
Flux1.1 Pro is currently the most advanced model of Flux series, which is introduced by Black Forest Labs.
It is designed for fast, high-resolution and realistic text-to-image generation.
We collect this subset from WILD Bongini et al. (2025), which is generated using template-like textual prompts.

**Table 7: Data list of the hierarchical evaluation protocol in HydraFake dataset.**
| Evaluation Split | Method | Sub-Type | Venue | Data Scale | Resolution |
| --- | --- | --- | --- | --- | --- |
| In-Domain | FaceForensics++ | FS | ICCV’19 | 8,960 | $256\times 256$ |
|  | Facevid2vid | FR | Arxiv’19 | 2,000 | $256\times 256$ |
|  | Hallo2 | FR | ICLR’25 | 1,660 | $256\times 256$ |
|  | StyleGAN | EFG | CVPR’19 | 600 | $1024\times 1024$ |
|  | Midjourney | EFG | None | 600 | $1024\times 1024$ |
| Cross-Model | Adobe Firefly | Proprietary | None | 600 | $1024\times 1024$ |
|  | StarryAI | Proprietary | None | 600 | $1024\times 1024$ |
|  | Flux1.1 Pro | Customized | None | 600 | $1024\times 1024$ |
|  | MAGI-1 | Video AR | None | 1,048 | $256\times 256$ |
|  | HART | Image AR | Arxiv’24 | 4,200 | $1024\times 1024$ |
|  | Infinity | Image AR | CVPR’25 | 4,200 | $1024\times 1024$ |
| Cross-Forgery | StarGANv2 | Editing | CVPR’20 | 2,000 | $256\times 256$ |
|  | CodeFormer | Restoration | NIPS’22 | 1,750 | $512\times 512$ |
|  | IC-Light | Relighting | ICLR’25 | 1,676 | $1536\times 1536$ |
|  | FaceAdapter | Generative FS | ECCV’24 | 300 | $1024\times 1024$ |
|  | PuLID | Personalization | NIPS’24 | 3,360 | $1024\times 1024$ |
|  | InfiniteYou | Personalization | ICCV’25 | 3,244 | $1024\times 1024$ |
| Cross-Domain | Hailuo AI | Commercial | None | 1,000 | $256\sim 1536$ |
|  | Dreamina | Social media | None | 952 | $1024\times 1024$ |
|  | GPT-4o | Social media | None | 630 | $159\sim 1536$ |
|  | DeepFaceLab | Classic dataset | PR 2023 | 3,094 | $256\times 256$ |
|  | FFIW | Classic dataset | CVPR’21 | 6,832 | $256\times 256$ |
|  | InfiniteYou-CD | Personalization | ICCV’25 | 2,960 | $1024\times 1024$ |

#### A.1.4 Cross-Forgery Evaluation

The cross-forgery testing images come from deepfakes generated by unseen forgeries.
With the rapid development of generative techniques, novel types of forgery are constantly emerging, such as portrait relighting Zhang et al. (2025b) and IP-preserved personalization Jiang et al. (2025); Guo et al. (2024).
To assess the model’s generalization capacities when encountering these emerging deepfake methods, we collect $5$ representative forgery methods in our dataset, including face relighting Zhang et al. (2025b), face restoration Zhou et al. (2022), generative face swapping Han et al. (2024), facial attribute editing Choi et al. (2020) and face personalization Jiang et al. (2025); Guo et al. (2024).

Face Relighting.
The method is based on IC-Light Zhang et al. (2025b), which is an emerging ability in the generative models and is becoming prevailing.
“IC-Light” means “Imposing Consistent Light”, which is capable of adjusting the lighting sources and intensity in the image while keeping the subject highly unchanged.
The condition is based on textual prompts.
We sampled real images from FFHQ Karras et al. (2019) and reproduced IC-Light to change the lighting condition of these real images.
We implemented $10$ lighting types (e.g., “sunshine from window”, “soft studio lighting” and “neon light in city”) and $4$ lighting sources (i.e., “left”, “right”, “top” and “bottom”).
We use multiple seeds for each condition, and then manually filter out those of low quality.

Face Restoration.
The method is based on CodeFormer Zhou et al. (2022), which is capable of discovering low-quality (e.g., blurred) natural faces to high-quality counterparts, even when the inputs are severely degraded.
It can generate high-quality faces while maintaining the fidelity.
In fact, this is a helpful technique that has positive usage in many domains.
But considering this can be also used for low-quality deepfake images, we take this as an unseen forgery in our dataset.
Specifically, we sampled some low-quality fake images from DF40 Yan et al. (2024d) and TalkingHeadBench Xiong et al. (2025), and then employ CodeFormer to restore them into $512\times 512$ images.

Facial Attribute Editing.
Facial attribute editing is a common manipulation, involving altering facial attributes such as hairstyle and makeup.
In our dataset we leave this type out for testing.
We collect images generated by StarGANv2 Choi et al. (2020) from DF40 Yan et al. (2024d).

IP-preserved Face Personalization.
IP-preserved face personalization technology enables the generation of synthetic faces that closely retain the distinctive visual attributes of original intellectual property (IP).
By producing highly realistic and IP-consistent deepfakes, it can facilitate unauthorized exploitation or impersonation of protected characters and personalities.
With the advancement of generative models, face personalization techniques are now capable of maintaining high-fidelity while following complex contextual and subject-specific instructions (e.g., transforming an ID photo into an image of the singer in the bar).
We reproduce two timely methods PuLID Guo et al. (2024) and InfiniteYou Jiang et al. (2025).
We sample real images from FFHQ as the source images.
To enhance the realism and semantic coherence of face personalization, we employ Qwen2.5-VL-72B to generate customized prompts for each image.

Generative Face Swapping.
The face swapping data in existing datasets are often produced by conventional approaches such as graphics-based methods or GAN models.
While nowadays the generative-based methods are capable of generating high-fidelity swapped faces, which are based on Diffusion models.
Considering the latest methods such as DreamID Ye et al. (2025) and DynamicFace Wang et al. (2025a) are not open-sourced yet, we implemented FaceAdapter Han et al. (2024), which produces high-quality swapping data.
We will keep tracking the advancements in these methods and update our dataset.
The source faces are sampled from FFHQ.
We manually filter out those low-quality generated images, only maintaining high-fidelity samples.

#### A.1.5 Cross-Domain Evaluation

The “domain” in our dataset mainly refers to data source.
For instance, the cross-forgery data are generated using in-domain real images from FFHQ, which alters the manipulation methods but keeps the data source unchanged.
But for cross-domain testing, the fake images are either generated from unseen real data srouce or entirely generated by commercial models.
And we also crawled fake images from social media, which serves as a challenging cross-domain evaluation.
Specifically, our cross-domain testing can be clustered into three types:
(1) classic datasets, including DeepFaceLab from DF40 Yan et al. (2024d) and FFIW Dolhansky et al. (2019) which is widely adopted in existing benchmarks.
(2) Reproduced deepfakes, including face personalization generated using real images from VFHQ Xie et al. (2022).
(3) In-the-wild deepfakes, where we collect data from social media such as Xiaohongshu and TikTok.
We retrieved images through the tags of the posts and collected the images generated by GPT-4o Hurst et al. (2024) and Dreamina team (2025a), and cropped out the digital watermarks.
We further generate deepfake videos using Hailuo AI team (2025b), and extract $8$ frames for each video.

### A.2 More Discussions

Difference between explainable and reasoning deepfake detection.
In this part, we formulate different task settings of MLLM-based deepfake detection.
Given the input image $\bm{I}$, deepfake detection aims to determine its authenticity $\mathcal{Y}\in{\{0,1\}}$, where $1$ means the image is fake and vice versa.
Suppose the input image and query are collectively denoted as $\bm{q}$.
The sequential outputs of MLLM are denoted as
$\bm{s}=\{\bm{s}_{1},\bm{s}_{2},...,\bm{s}_{T}\}$, where $T$ is sequence length.
The conditional probability of sequence $\bm{s}$ is written as $P(\bm{s}|\bm{q})=\prod_{t=1}^{T}P(\bm{s}_{t}|\bm{q},\bm{s}_{<t})$.

Recent works Chen et al. (2024b); He et al. (2025) utilize MLLM for explainable deepfake detection, where LLM first generates the answer $\bm{s}_{\mathcal{A}}$ (e.g., “fake” or “this image is fake”).
Then a detailed explanation sequence $\bm{s}_{\mathcal{E}}$ is generated based on $\{\bm{q},\bm{s}_{\mathcal{A}}\}$ (where $\mathcal{A}\ll\mathcal{E}$).
For simplicity, we suppose the answer ${\bm{s}_{\mathcal{A}}}$ is in a single word.
The process can be decomposed into:

$$ $P(\bm{s}|\bm{q})=\prod_{t=1}^{\mathcal{A}}P(\bm{s}_{t}|\bm{q})\cdot\prod_{t=\mathcal{A}+1}^{\mathcal{A}+\mathcal{E}}P(\bm{s}_{t}|\bm{q},\bm{s}_{<\mathcal{A}+\mathcal{E}}),$ (7) $$

where the final decision (i.e., $\prod_{t=1}^{\mathcal{A}}P(\bm{s}_{t}|\bm{q})$) is solely conditioned on the input image.
This is fundamentally similar to the small vision models, where the distributional mapping $f:\bm{I}\rightarrow\mathcal{Y}$ is estimated directly within a single token, prone to overfitting.

In contrast, we formulate the deepfake detection as a reasoning task.
The MLLM first conduct holistic reasoning, denoted as $\bm{s}_{\mathcal{R}}$, and the final answer is then determined in $\bm{s}_{\mathcal{A}}$:

$$ $P(\bm{s}|\bm{q})=\prod_{t=1}^{\mathcal{R}}P(\bm{s}_{t}|\bm{q},\bm{s}_{<\mathcal{R}})\cdot\prod_{t=\mathcal{R}+1}^{\mathcal{R}+\mathcal{A}}P(\bm{s}_{t}|\bm{q},\bm{s}_{<\mathcal{R}+\mathcal{A}}),$ (8) $$

where the final answer (i.e., $\prod_{t=\mathcal{R}+1}^{\mathcal{R}+\mathcal{A}}P(\bm{s}_{t}|\bm{q},\bm{s}_{<\mathcal{R}+\mathcal{A}})$) is building on inputs and reasoning process.
The mapping is altered into $f^{\prime}:\bm{I}\rightarrow\mathcal{R}\rightarrow\mathcal{Y}$, enabling more comprehensive and adaptive modeling.

Large Reasoning Models.
Large Language Models (LLMs) are inherently good reasoners for general tasks.
A simple prompt engineering could activate the reasoning behaviors of LLMs Wei et al. (2022); Kojima et al. (2022), which is termed as Chain-of-Thought (CoT).
Building on the impressive capabilities of CoT, the community began to explore large-scale and structured reasoning, leading to powerful reasoning models Jaech et al. (2024); Guo et al. (2025a); Xu et al. (2024a) through tailored post-training.
For instance, DeepSeek-R1 Guo et al. (2025a) adopts reasoning cold-start followed by Reinforcement Learning with Verifiable Rewards (RLVR) to incentivize the general reasoning capabilities.
Inspired by the success of RLVR, recent works Liu et al. (2025); Zhang et al. (2025a) attempt to introduce pure rule-based RL into multimodal domain.
However, a recent study Yue et al. (2025) points out that pure RLVR can not introduce novel abilities to base model.
We also empirically reveal the suboptimal performance achieved by pure RL.
Therefore, we first introduce a high-quality cold-start Liao et al. (2025); Chen et al. (2025a); Team et al. (2025) to internalize the thinking patterns to the base model.
Unlike general tasks that require diverse and flexible thinking patterns Zhan et al. (2025), deepfake detection is a well-defined task.
Therefore, we establish a unified reasoning framework to facilitate efficient thinking.

### A.3 Multi-Step Annotation Pipeline of SFT data

The annotation pipeline is shown in Figure [4](https://arxiv.org/html/2508.21048v1#S4.F4).
We divide the process into three specialized yet coherent steps:

Step-I:
Based on human inspection, we found that most fake images exhibit $2$ to $3$ types of artifacts, hence we aim to find the two most prominent artifacts.
To reduce model bias, we employ an ensemble voting strategy, leveraging Qwen2.5-VL-72B Bai et al. (2025), Kimi-VL-A3B-Thinking Team et al. (2025) and InternVL3-78B Zhu et al. (2025) to sample 5 times individually.
Only the answers that receive more than 10 votes are selected, ensuring the reliability of the final results.

Step-II:
In this stage, we aim to extract visual details that conform to the identified artifacts.
We found that Qwen2.5-VL-72B performs better than GPT-4o Hurst et al. (2024) here, capable of generating detailed and factual responses.
This yields concrete explanatory texts, like recent practice Wen et al. (2025); Gao et al. (2025); Zhang et al. (2025c).
However, such plain explanations lack human-like reasoning logic, which hinders the generalization to OOD samples.

Step-III:
To emulate human mindset, we further transform the above explanations into logical chains.
We define five “thinking patterns” and instruct the model to rewrite the explanations into different tags strictly based on the original meaning.
We observed that large reasoning models are inherently adept at generating highly logical content.
Therefore, we use Qwen3-235B-A22B Yang et al. (2025a) for this step, yielding high-quality reasoning data.
Finally, the data undergo a filtering process, which involves rule-based filtering and balancing among different forgery types, resulting in $36$K training samples for dataset $\mathcal{D}_{1}$.

### A.4 More Experimental Results

We provide full experimental results for all subsets.
To help better understanding the model performance, we report Precision and Recall for each subset, with fake being the positive label.

The in-domain results are shown in Table [8](https://arxiv.org/html/2508.21048v1#A1.T8).
Effort achieves the best results among previous detectors.
It is worth noting that, under the mixed training sources, previous methods even struggle on in-domain datasets, i.e., most methods achieve less than 90% average performance.
This is mainly due to the degraded performance on low-resolution datasets such as FF++ and Facevid2vid.
We suppose this is a major deficiency in current deepfake detectors, which tend to bias towards image resolutions.
Our model achieves better performance, achieving over 99.5% on those high resolution images, while the results on low resolution subsets still have room for improvement.

**Table 8: Performance comparison on the In-Domain (ID) subset of HydraFake dataset. The best results are bolded and the second best are underlined. We report Accuracy (Acc.), Precision (P.) and Recall (R.) and the averaged results (Avg.) are reported in Accuracy.**
| Method | FaceForensics++ | Facevid2vid | Hallo2 | StyleGAN | Midjourney | Avg. |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. |  |
| F3Net (ECCV’20) | 84.5 | 80.5 | 90.9 | 89.6 | 83.6 | 98.6 | 85.0 | 78.3 | 97.0 | 82.5 | 77.4 | 91.6 | 84.8 | 78.6 | 95.6 | 85.3 |
| UniFD (CVPR’23) | 73.8 | 80.4 | 62.8 | 81.7 | 83.2 | 79.6 | 77.3 | 88.8 | 62.5 | 94.3 | 91.5 | 97.6 | 86.3 | 90.6 | 81.0 | 82.7 |
| IID (CVPR’23) | 83.8 | 86.6 | 79.9 | 92.8 | 89.5 | 97.0 | 79.1 | 72.2 | 94.6 | 80.7 | 72.1 | 100.0 | 80.5 | 71.9 | 100.0 | 83.4 |
| FreqNet (AAAI’24) | 52.2 | 51.2 | 94.4 | 54.5 | 52.3 | 100.0 | 71.2 | 66.7 | 84.5 | 77.5 | 69.8 | 96.6 | 78.8 | 70.8 | 98.0 | 66.8 |
| ProDet (NIPS’24) | 84.8 | 82.2 | 88.8 | 90.9 | 84.6 | 100.0 | 91.4 | 89.0 | 94.4 | 92.5 | 88.7 | 97.3 | 93.0 | 88.4 | 99.0 | 90.5 |
| NPR (CVPR’24) | 59.6 | 56.5 | 84.1 | 66.6 | 60.5 | 95.7 | 74.3 | 87.2 | 57.0 | 88.8 | 91.7 | 85.3 | 88.7 | 92.9 | 83.6 | 75.6 |
| AIDE (ICLR’25) | 58.9 | 58.7 | 59.6 | 78.6 | 70.3 | 99.0 | 84.5 | 92.4 | 75.2 | 86.8 | 93.1 | 99.0 | 93.0 | 92.7 | 93.3 | 80.4 |
| Co-SPY (CVPR’25) | 71.3 | 76.0 | 62.3 | 89.3 | 82.9 | 99.1 | 82.1 | 91.6 | 70.7 | 95.0 | 92.2 | 98.3 | 94.0 | 94.0 | 94.0 | 86.3 |
| D^3 (CVPR’25) | 72.5 | 70.3 | 77.8 | 82.1 | 74.7 | 96.9 | 91.1 | 91.7 | 90.3 | 96.3 | 94.2 | 98.6 | 94.7 | 91.3 | 98.6 | 87.3 |
| Effort (ICML’25) | 92.9 | 94.4 | 91.2 | 96.4 | 94.6 | 98.4 | 95.9 | 95.3 | 96.5 | 95.0 | 97.5 | 92.3 | 93.5 | 96.1 | 90.6 | 94.7 |
| Qwen2.5-VL-7B | 51.3 | 93.5 | 2.8 | 51.5 | 94.3 | 3.3 | 50.0 | 50.0 | 1.1 | 51.5 | 80.0 | 4.0 | 51.5 | 76.4 | 4.3 | 51.2 |
| InternVL3-8B | 55.9 | 55.5 | 59.0 | 53.7 | 53.6 | 54.6 | 56.3 | 83.8 | 15.6 | 52.0 | 66.6 | 8.0 | 52.3 | 69.4 | 8.3 | 54.0 |
| MiMo-VL-7B | 56.2 | 55.3 | 64.0 | 62.2 | 59.4 | 77.1 | 60.4 | 63.9 | 47.6 | 66.4 | 69.3 | 58.6 | 73.6 | 72.0 | 77.3 | 63.8 |
| GLM-4.1V-9BThink | 58.0 | 64.0 | 36.3 | 59.6 | 65.6 | 40.0 | 54.2 | 89.6 | 9.4 | 56.0 | 87.5 | 14.0 | 54.3 | 80.9 | 11.3 | 56.4 |
| GPT-4o | 49.2 | 20.0 | 0.5 | 53.0 | 84.2 | 8.0 | 49.8 | 33.3 | 0.5 | 63.2 | 100.0 | 26.5 | 52.5 | 91.6 | 5.5 | 53.5 |
| Gemini-2.5-Pro | 62.0 | 77.9 | 33.5 | 53.2 | 66.6 | 13.0 | 66.0 | 80.9 | 42.5 | 93.9 | 89.3 | 100.0 | 85.8 | 73.7 | 76.6 | 72.2 |
| Veritas (ours) | 90.9 | 90.2 | 91.7 | 96.1 | 92.7 | 100.0 | 99.8 | 99.6 | 100.0 | 99.8 | 99.6 | 100.0 | 100.0 | 100.0 | 100.0 | 97.3 |

**Table 9: Performance comparison on the Cross-Model (CM) subset of HydraFake dataset. The best results are bolded and the second best are underlined. We report Accuracy (Acc.), Precision (P.) and Recall (R.) and the averaged results (Avg.) are reported in Accuracy.**
| Method | Adobe Firefly | FLUX1.1Pro | StarryAI | MAGI-1 | HART (VAR) | Infinity (VAR) | Avg. |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. |  |
| F3Net (ECCV’20) | 86.7 | 80.0 | 97.7 | 87.8 | 80.4 | 100.0 | 78.6 | 76.2 | 83.3 | 85.0 | 78.6 | 96.2 | 86.0 | 78.6 | 99.0 | 82.9 | 78.6 | 90.4 | 84.5 |
| UniFD (CVPR’23) | 90.7 | 92.9 | 88.0 | 93.8 | 91.7 | 96.3 | 82.5 | 88.8 | 74.3 | 73.0 | 84.7 | 56.1 | 94.4 | 92.2 | 97.0 | 90.7 | 92.8 | 88.2 | 87.5 |
| IID (CVPR’23) | 83.3 | 75.0 | 100.0 | 82.8 | 74.4 | 100.0 | 80.0 | 72.1 | 97.6 | 80.2 | 72.6 | 96.5 | 81.1 | 72.6 | 100.0 | 82.2 | 73.7 | 100.0 | 81.6 |
| FreqNet (AAAI’24) | 60.3 | 59.5 | 64.3 | 76.7 | 68.4 | 99.0 | 59.0 | 59.1 | 58.3 | 69.2 | 65.5 | 81.1 | 77.1 | 69.4 | 96.7 | 75.1 | 68.7 | 92.3 | 69.6 |
| ProDet (NIPS’24) | 92.6 | 88.3 | 98.3 | 94.2 | 89.5 | 100.0 | 88.2 | 88.0 | 88.3 | 91.9 | 87.5 | 97.7 | 93.8 | 89.0 | 99.8 | 93.1 | 88.7 | 98.6 | 92.3 |
| NPR (CVPR’24) | 68.8 | 86.0 | 45.0 | 91.2 | 91.5 | 90.6 | 59.5 | 78.8 | 26.0 | 82.6 | 91.9 | 71.5 | 91.3 | 93.1 | 89.3 | 84.0 | 92.6 | 73.8 | 79.6 |
| AIDE (ICLR’25) | 68.8 | 85.5 | 43.3 | 86.3 | 91.0 | 80.6 | 64.0 | 86.6 | 33.0 | 88.9 | 93.6 | 83.6 | 95.4 | 94.3 | 96.6 | 76.0 | 91.0 | 57.7 | 79.9 |
| Co-SPY (CVPR’25) | 93.5 | 93.6 | 93.3 | 95.5 | 94.1 | 97.0 | 85.3 | 93.4 | 76.0 | 93.3 | 92.2 | 72.7 | 96.6 | 94.5 | 98.9 | 95.3 | 94.1 | 96.7 | 93.3 |
| D^3 (CVPR’25) | 93.6 | 90.3 | 97.7 | 95.6 | 92.3 | 99.6 | 91.3 | 92.2 | 90.3 | 90.7 | 90.5 | 91.0 | 95.8 | 92.2 | 99.9 | 95.5 | 93.1 | 98.3 | 93.8 |
| Effort (ICML’25) | 82.8 | 97.1 | 67.6 | 96.5 | 96.0 | 97.0 | 78.0 | 94.2 | 59.6 | 90.5 | 96.5 | 84.1 | 97.8 | 97.2 | 98.5 | 98.3 | 97.3 | 99.4 | 90.7 |
| Qwen2.5-VL-7B | 50.0 | 50.0 | 1.3 | 50.0 | 50.0 | 1.3 | 49.7 | 0.0 | 0.0 | 50.0 | 50.0 | 0.9 | 52.0 | 83.8 | 4.9 | 52.9 | 87.3 | 6.8 | 50.8 |
| InternVL3-8B | 54.0 | 74.0 | 12.3 | 49.8 | 47.3 | 3.0 | 49.0 | 28.5 | 1.3 | 56.6 | 83.5 | 16.4 | 55.8 | 83.1 | 14.5 | 57.2 | 84.5 | 17.6 | 53.7 |
| MiMo-VL-7B | 74.5 | 74.7 | 74.0 | 77.1 | 76.7 | 78.0 | 82.5 | 68.0 | 55.3 | 60.3 | 64.0 | 47.1 | 82.4 | 77.9 | 90.6 | 81.4 | 77.2 | 89.2 | 76.4 |
| GLM-4.1V-9BThink | 55.2 | 82.9 | 13.0 | 52.3 | 76.9 | 6.6 | 50.5 | 66.6 | 2.0 | 51.6 | 81.5 | 4.2 | 68.4 | 96.1 | 38.2 | 60.7 | 95.5 | 22.5 | 56.5 |
| GPT-4o | 57.7 | 96.9 | 16.0 | 52.0 | 83.3 | 5.0 | 51.4 | 85.7 | 3.0 | 59.9 | 80.0 | 26.4 | 81.2 | 92.5 | 67.9 | 54.8 | 87.5 | 10.6 | 59.5 |
| Gemini-2.5-Pro | 64.9 | 78.8 | 41.2 | 92.4 | 90.3 | 94.9 | 82.8 | 92.3 | 72.0 | 62.5 | 79.0 | 34.1 | 93.4 | 88.5 | 100.0 | 93.2 | 89.1 | 98.5 | 81.5 |
| Veritas (ours) | 94.8 | 99.6 | 89.9 | 99.8 | 99.6 | 100.0 | 97.0 | 100.0 | 94.0 | 99.9 | 99.8 | 100.0 | 99.9 | 99.8 | 100.0 | 99.9 | 99.8 | 99.9 | 98.6 |

The cross-model results are shown in Table [9](https://arxiv.org/html/2508.21048v1#A1.T9).
D^3 achieves the best results among previous detectors.
Lots of previous methods achieve good performance on cross-model scenarios, with averaged performance greater than 90%, such as D^3, ProDet, Co-SPY and Effort.
These models show great performance on cross-model data, especially on VAR architectures, achieving over 95% accuracy.
Our model demonstrates extraordinary generalization performance on cross-model data, achieving almost 99% accuracy, while the recall capacity on proprietary models (e.g., Adobe Firefly and StarryAI) still has room for improvement.

The cross-forgery results are shown in Table [10](https://arxiv.org/html/2508.21048v1#A1.T10).
Effort achieves the best performance among previous detectors.
The performance of most detectors are limited.
For instance, those detectors tailored for deepfake facial images (i.e., IID and ProDet), showing extremely limited recall capacities when encountering facial attribute editing and face relighting.
Most methods achieve moderate performance on face restoration and personalization.
These results verify that current detectors exhibit limited abilities to generalize unseen forgeries.
Besides, it is worth noting that Effort achieve excellent performance on face relighting, greatly surpassing our method.
We suppose the reason is that Effort freezes CLIP’s semantic encoder, allowing the model to focus solely on detecting whether an image has been manipulated, which is critical in detecting relighting where the identities and other semantics are largely unchanged.

**Table 10: Performance comparison on the Cross-Forgery (CF) subset of HydraFake dataset. The best results are bolded and the second best are underlined. We report Accuracy (Acc.), Precision (P.) and Recall (R.) and the averaged results (Avg.) are reported in Accuracy.**
| Method | StarGANv2 | IC-Light | CodeFormer | InfiniteYou | PuLID | FaceAdapter | Avg. |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. |  |
| F3Net (ECCV’20) | 41.3 | 20.7 | 6.2 | 48.9 | 47.9 | 24.8 | 71.9 | 72.8 | 69.8 | 84.9 | 78.2 | 96.8 | 85.5 | 79.5 | 95.7 | 72.6 | 77.5 | 62.8 | 67.5 |
| UniFD (CVPR’23) | 61.8 | 81.7 | 30.4 | 81.9 | 89.1 | 72.6 | 75.4 | 88.0 | 58.7 | 73.7 | 87.0 | 55.6 | 68.1 | 83.6 | 45.1 | 81.3 | 90.3 | 69.6 | 73.7 |
| IID (CVPR’23) | 41.4 | 32.8 | 16.6 | 53.3 | 54.3 | 41.0 | 79.7 | 72.9 | 94.4 | 81.8 | 73.4 | 99.6 | 81.8 | 73.3 | 99.9 | 73.7 | 68.2 | 87.1 | 68.6 |
| FreqNet (AAAI’24) | 33.1 | 11.4 | 5.0 | 73.1 | 67.6 | 88.9 | 70.3 | 66.6 | 81.5 | 72.8 | 67.4 | 88.3 | 77.4 | 69.9 | 96.2 | 67.7 | 64.9 | 75.0 | 65.7 |
| ProDet (NIPS’24) | 56.3 | 67.5 | 24.5 | 58.6 | 69.8 | 34.4 | 80.8 | 84.7 | 75.3 | 88.1 | 89.9 | 85.8 | 91.0 | 88.1 | 94.9 | 83.3 | 86.0 | 79.0 | 76.4 |
| NPR (CVPR’24) | 47.7 | 23.6 | 2.1 | 67.8 | 85.2 | 43.2 | 60.6 | 78.3 | 29.3 | 79.8 | 99.1 | 66.0 | 89.0 | 92.8 | 84.5 | 67.7 | 84.9 | 41.9 | 68.8 |
| AIDE (ICLR’25) | 56.7 | 74.6 | 20.3 | 79.2 | 91.5 | 64.3 | 86.1 | 90.8 | 80.2 | 74.2 | 89.4 | 55.0 | 62.4 | 83.9 | 30.5 | 75.7 | 90.3 | 56.7 | 72.4 |
| Co-SPY (CVPR’25) | 77.0 | 91.1 | 59.9 | 92.5 | 93.8 | 91.0 | 88.6 | 90.3 | 86.5 | 90.6 | 93.2 | 87.5 | 79.1 | 89.9 | 65.5 | 87.3 | 88.7 | 85.4 | 85.9 |
| D^3 (CVPR’25) | 62.4 | 82.4 | 31.5 | 71.6 | 86.3 | 51.4 | 82.9 | 90.9 | 73.1 | 80.0 | 88.7 | 68.7 | 82.4 | 89.8 | 73.1 | 73.7 | 84.1 | 57.4 | 75.5 |
| Effort (ICML’25) | 64.7 | 93.2 | 31.7 | 94.8 | 96.3 | 93.2 | 89.7 | 97.1 | 81.9 | 89.5 | 96.0 | 82.3 | 92.9 | 96.2 | 89.2 | 88.0 | 95.0 | 80.2 | 86.6 |
| Qwen2.5-VL-7B | 50.5 | 64.7 | 2.2 | 56.7 | 90.8 | 15.2 | 50.7 | 70.0 | 2.4 | 53.6 | 90.3 | 8.1 | 54.5 | 90.4 | 10.1 | 51.6 | 63.6 | 4.7 | 52.9 |
| InternVL3-8B | 62.9 | 87.7 | 30.0 | 54.2 | 77.1 | 12.0 | 62.9 | 86.9 | 30.5 | 63.6 | 92.1 | 29.7 | 54.8 | 80.1 | 12.7 | 67.7 | 96.3 | 35.8 | 61.0 |
| MiMo-VL-7B | 48.7 | 47.7 | 26.2 | 82.6 | 76.4 | 94.3 | 76.4 | 75.1 | 78.9 | 79.7 | 76.3 | 85.7 | 78.4 | 75.8 | 83.5 | 82.8 | 79.1 | 88.3 | 74.8 |
| GLM-4.1V-9BThink | 54.3 | 89.8 | 9.7 | 68.4 | 94.7 | 39.0 | 63.3 | 95.7 | 27.8 | 65.7 | 96.5 | 32.6 | 55.1 | 87.4 | 11.9 | 81.0 | 97.9 | 62.8 | 64.6 |
| GPT-4o | 66.4 | 82.6 | 41.5 | 58.9 | 100.0 | 18.0 | 52.5 | 91.6 | 5.5 | 64.4 | 100.0 | 29.0 | 60.9 | 94.0 | 23.5 | 55.5 | 100.0 | 10.1 | 59.8 |
| Gemini-2.5-Pro | 73.7 | 89.7 | 53.5 | 83.3 | 89.7 | 75.1 | 87.4 | 86.0 | 89.3 | 85.5 | 86.2 | 84.5 | 84.7 | 88.4 | 80.0 | 85.6 | 85.3 | 85.8 | 83.4 |
| Veritas (ours) | 90.3 | 99.5 | 81.0 | 75.7 | 99.5 | 51.5 | 97.0 | 98.6 | 95.3 | 91.8 | 98.9 | 84.5 | 95.1 | 99.5 | 90.6 | 91.7 | 98.6 | 84.6 | 90.3 |

**Table 11: Performance comparison on the Cross-Domain (CD) subset of HydraFake dataset. The best results are bolded and the second best are underlined. We report Accuracy (Acc.), Precision (P.) and Recall (R.) and the averaged results (Avg.) are reported in Accuracy.**
| Method | DeepFaceLab | InfiniteYou-CD | Dreamina | Hailuo AI | GPT-4o | FFIW | Avg. |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. | Acc. | P. | R. |  |
| F3Net (ECCV’20) | 57.7 | 54.7 | 89.1 | 78.5 | 72.6 | 91.6 | 55.6 | 55.0 | 60.9 | 68.6 | 63.3 | 88.6 | 66.2 | 63.6 | 75.5 | 66.4 | 64.8 | 71.4 | 65.5 |
| UniFD (CVPR’23) | 67.4 | 64.1 | 79.2 | 67.3 | 75.9 | 50.5 | 80.5 | 77.2 | 86.3 | 75.2 | 75.4 | 74.8 | 73.3 | 73.6 | 72.7 | 67.5 | 65.4 | 74.5 | 71.9 |
| IID (CVPR’23) | 65.2 | 65.1 | 65.5 | 69.9 | 63.0 | 95.9 | 63.8 | 58.0 | 99.6 | 63.3 | 57.6 | 100.0 | 63.8 | 58.2 | 97.8 | 64.2 | 66.6 | 56.6 | 65.0 |
| FreqNet (AAAI’24) | 50.6 | 50.3 | 98.7 | 67.0 | 62.3 | 85.8 | 62.1 | 58.4 | 83.4 | 59.3 | 56.9 | 76.8 | 58.3 | 56.3 | 73.3 | 51.2 | 50.6 | 95.0 | 58.1 |
| ProDet (NIPS’24) | 58.1 | 54.6 | 95.3 | 82.9 | 81.3 | 85.4 | 71.3 | 71.3 | 71.4 | 75.6 | 71.2 | 86.0 | 66.3 | 69.9 | 57.4 | 74.1 | 73.0 | 76.5 | 71.4 |
| NPR (CVPR’24) | 52.6 | 52.4 | 56.6 | 73.0 | 82.1 | 58.7 | 76.6 | 80.9 | 69.5 | 62.3 | 70.7 | 42.0 | 50.2 | 50.4 | 20.9 | 46.0 | 46.3 | 50.9 | 60.1 |
| AIDE (ICLR’25) | 59.7 | 57.5 | 73.9 | 67.9 | 75.2 | 53.2 | 49.7 | 49.4 | 25.2 | 58.0 | 60.6 | 45.8 | 51.9 | 53.0 | 33.3 | 59.2 | 57.3 | 71.2 | 57.7 |
| Co-SPY (CVPR’25) | 67.6 | 63.8 | 81.2 | 80.0 | 85.1 | 72.7 | 82.5 | 80.7 | 85.3 | 74.0 | 75.7 | 70.6 | 79.5 | 78.7 | 80.9 | 64.3 | 64.2 | 64.7 | 74.7 |
| D^3 (CVPR’25) | 69.7 | 70.0 | 69.1 | 74.6 | 78.8 | 67.2 | 78.1 | 72.2 | 91.4 | 70.9 | 67.7 | 79.8 | 80.8 | 75.1 | 92.0 | 64.3 | 66.0 | 58.7 | 73.1 |
| Effort (ICML’25) | 64.8 | 59.1 | 96.3 | 82.2 | 75.4 | 95.5 | 61.5 | 57.6 | 86.5 | 66.4 | 60.1 | 97.4 | 53.8 | 52.9 | 69.3 | 74.0 | 68.3 | 89.7 | 67.1 |
| Qwen2.5-VL-7B | 50.7 | 71.7 | 2.4 | 53.6 | 92.8 | 7.9 | 80.2 | 99.4 | 60.7 | 67.5 | 100.0 | 35.1 | 52.5 | 100.0 | 5.1 | 50.5 | 56.1 | 4.5 | 59.2 |
| InternVL3-8B | 54.4 | 55.5 | 44.1 | 67.1 | 83.6 | 42.7 | 77.1 | 85.4 | 65.3 | 66.5 | 78.9 | 45.0 | 47.4 | 37.5 | 7.6 | 51.8 | 52.0 | 45.1 | 60.7 |
| MiMo-VL-7B | 57.7 | 56.4 | 68.6 | 75.6 | 73.7 | 79.6 | 79.4 | 73.5 | 91.9 | 70.7 | 68.3 | 76.5 | 67.7 | 67.1 | 69.5 | 54.9 | 54.8 | 56.2 | 67.7 |
| GLM-4.1V-9BThink | 58.7 | 82.6 | 22.0 | 72.7 | 95.1 | 47.8 | 83.7 | 96.0 | 70.3 | 69.2 | 92.1 | 42.0 | 52.0 | 68.4 | 8.2 | 53.9 | 60.8 | 21.7 | 65.0 |
| GPT-4o | 49.4 | 41.7 | 2.5 | 62.0 | 98.0 | 24.5 | 90.7 | 98.8 | 82.4 | 73.7 | 100.0 | 47.5 | 58.0 | 94.4 | 17.0 | 52.8 | 59.3 | 17.8 | 64.4 |
| Gemini-2.5-Pro | 67.2 | 72.4 | 55.6 | 75.6 | 88.7 | 59.0 | 87.5 | 89.5 | 84.9 | 82.4 | 95.2 | 68.2 | 70.9 | 96.6 | 43.2 | 53.0 | 67.6 | 11.5 | 72.8 |
| Veritas (ours) | 58.6 | 54.7 | 100.0 | 84.1 | 94.1 | 72.8 | 92.3 | 90.0 | 95.1 | 90.2 | 86.5 | 95.2 | 89.2 | 86.3 | 93.2 | 78.5 | 76.1 | 83.0 | 82.2 |

The cross-domain results are shown in Table [11](https://arxiv.org/html/2508.21048v1#A1.T11).
Co-SPY achieves the best results among previous detectors.
Most methods including ours achieve degraded performance.
Specifically, previous methods almost fail on all cross-domain subsets, while our method still achieves robust performance on in-the-wild forgeries (e.g., 92.3% on Dreamina and 89.2% on GPT-4o).
The performance on DeepFaceLab is extremely limited.
Different from cross-forgery and cross-model scenarios, the poor performance is due to low Precision.
Similar problem also exists in previous detectors.
This means those unseen low resolution real images are hard for model to distinguish.
Overall, our model strikes great improvements on cross-domain scenarios.

Besides, the zero-shot MLLMs tend to classify facial images into real photographs.
Even GPT-4o fails on many cases, exhibiting extremely low recall (i.e., less than 10%).
Gemini-2.5-Pro demonstrates strong capacities for deepfake detection, especially on high-resolution images, even beating most fine-tuned specialized detectors.
Aggregating the above observations, we can find a intutive but interesting phenomenon: the MLLM-based detectors (especially reasoning MLLMs) are good at analyzing high-resolution images (typically over $512\times 512$) but fall short on low-resolution counterparts.
Once the MLLMs can “see” the image details, they are able to make accurate judgments and provide human-aligned reasoning process.
Conversely, small vision models exhibit certain advantages on low-resolution images, as such data is more suited for distribution modeling.
Therefore, a collaborative system of MLLMs and small models could be a promising future direction.

### A.5 Full Prompt Templates

In this section, we provide all the prompt templates used in our method.
This includes four parts:
(1) The prompts for pattern-aware SFT data annotation, which contains three stages as shown in Figure [14](https://arxiv.org/html/2508.21048v1#A1.F14), Figure [15](https://arxiv.org/html/2508.21048v1#A1.F15) and Figure [16](https://arxiv.org/html/2508.21048v1#A1.F16).
(2) The prompts for reasoning quality evaluation, which contains score evaluation (Figure [17](https://arxiv.org/html/2508.21048v1#A1.F17)) and pairwise evaluation (Figure [18](https://arxiv.org/html/2508.21048v1#A1.F18)).
(3) The prompt for generating personalization prompts, as shown in Figure [19](https://arxiv.org/html/2508.21048v1#A1.F19).
(3) The prompt for reflection quality reward model $\mathcal{M}$, as shown in Figure [20](https://arxiv.org/html/2508.21048v1#A1.F20)

### A.6 More Qualitative Results

We provide more examples of our model’s reasoning outputs.
Specifically, our model can perform adaptive pattern-aware reasoning, generating direct and concise analysis for obviously fake images.
It can also conduct thorough and holistic analysis for high-fidelity fake images.
All the examples except FF++ are from OOD scenarios.
It is worth noting that while being trained on pure in-domain facial data, Veritas  exhibits promising AIGC analysis abilities, e.g., the infeasible date of birth on ID card (Figure [13](https://arxiv.org/html/2508.21048v1#A1.F13)) and over-stylized texture of fabric (Figure [12](https://arxiv.org/html/2508.21048v1#A1.F12)).
Such abilities mainly emerges from the combination of MiPO and P-GRPO.
As mentioned in our main text, MiPO ensures high-quality rollouts in subsequent stage, which enables more accurate policy updates for online RL.
The effective explorations during RL facilitate the deep reasoning capacities.

### A.7 Ethics Statement

All real facial data used in this work are from publicly available academic datasets.
The fake images include those from public benchmarks and those generated by our team using generative models or face-swapping techniques.
The latter were created only from public or synthetic data, with no unauthorized use of personal images.
Our work focuses on improving deepfake detection to combat misinformation, and all data were used strictly for non-commercial, academic purposes.

Figure: Figure 8: Reasoning output of our Veritas model.
Refer to caption: x8.png

Figure: Figure 9: Reasoning output of our Veritas model.
Refer to caption: x9.png

Figure: Figure 10: Reasoning output of our Veritas model.
Refer to caption: x10.png

Figure: Figure 11: Reasoning output of our Veritas model.
Refer to caption: x11.png

Figure: Figure 12: Reasoning output of our Veritas model.
Refer to caption: x12.png

Figure: Figure 13: Reasoning output of our Veritas model.
Refer to caption: x13.png

Figure: Figure 14: Prompt for SFT data annotation (Stage 1: anomalies identification).

Figure: Figure 15: Prompt for SFT data annotation (Stage 2: visual facts forensics).

Figure: Figure 16: Prompt for SFT data annotation (Stage 3: thinking patterns injection). We remove the ¡difficulty¿ tags in our final data.

Figure: Figure 17: Prompt for reasoning quality evaluation (Score evaluation).

Figure: Figure 18: Prompt for reasoning quality evaluation (Pairwise evaluation).

Figure: Figure 19: Input for generating customized personalization prompts.

Figure: Figure 20: Prompt for Reflection Quality Reward model (UnifiedReward-Qwen-3B).

## Peer Reviews

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: see weaknesses
soundness: 3
strengths: a.The proposed dataset spans diverse domains and sources of real and manipulated images, including generative face‑swapping, visual autoregressive models, and deepfakes collected from social media.
b.The two‑stage training pipeline substantially outperforms existing deepfake detection methods, as demonstrated in Table 1.
summary: This paper first introduces the HydraFake dataset, which aggregates real and fake images from existing sources and by reimplementing and crawling 10K deepfake samples produced by 10 advanced generators, resulting in 50K real and 50K fake images. It also proposes a two-stage training pipeline for MLLM-based deepfake detection. In the first (SFT) stage, MiPO is introduced to internalize reasoning patterns; in the second stage, the pattern-aware GPRO promotes comprehensive reasoning and enables potential self-reflection. Extensive experiments on in-domain, cross-model, cross-forgery, and cross-domain evaluation sets demonstrate the effectiveness of the proposed method.
weaknesses: a.The proposed method employs SFT and GPRO within an MLLM‑based deepfake detection framework—an established post‑training strategy.
b.The difference between the proposed pattern "<fast><planning><reasoning><conclusion>" and the commonly used "<think>... </think>" paradigm has not been analyzed.

---

confidence: 3
contribution: 3
initial_rating: 8
presentation: 3
questions: None
soundness: 3
strengths: - The proposed HydraFake dataset addresses a crucial gap between academic benchmarks and industrial deployment scenarios, making it valuable for real-world applications.
- The authors have conducted comprehensive experiments, including comparisons with SOTA methods and detailed ablation studies, verifying the effectiveness of the proposed VERITAS model.
- The pattern-aware reasoning approach is reasonable, drawing inspiration from human cognitive processes to create more interpretable and robust detection systems.
summary: This paper introduces HydraFake, a deepfake detection dataset with hierarchical OOD evaluation (in-domain, cross-model, cross-forgery, cross-domain), and VERITAS, an MLLM-based detector using pattern-aware reasoning. VERITAS employs five thinking patterns (fast judgment, planning, reasoning, self-reflection, conclusion) trained via a two-stage pipeline: pattern-guided cold-start with MiPO and pattern-aware exploration with P-GRPO. The approach shows significant improvements in cross-forgery and cross-domain scenarios, which are important in real-life scenarios.
weaknesses: - The two-stage training pipeline with MiPO and P-GRPO, though modified for forgery detection tasks, still seems to be a direct application of vanilla DPO and GRPO methods, which may undercut its novelty.
- The paper evaluates VERITAS exclusively on the proposed HydraFake dataset, raising concerns about overfitting to their specific evaluation protocol. It would strengthen claims about VERITAS's superiority and provide more convincing evidence of its effectiveness if authors could perform evaluations on other benchmarks such as LOKI [cite 1] and Forensics-bench [cite 2].

[cite 1] LOKI: A COMPREHENSIVE SYNTHETIC DATA DETECTION BENCHMARK USING LARGE MULTIMODAL MODELS. In ICLR 2025.

[cite 2] Forensics-Bench: A Comprehensive Forgery Detection Benchmark Suite for Large Vision Language Models. In CVPR 2025.

---

confidence: 4
contribution: 4
initial_rating: 8
presentation: 4
questions: 1.	In Figure 1, the proposed Veritas can perceive the textual anomalies. Is such type of analysis contained in the training set? If not, can the base model conduct similar analysis?

2.	In the MiPO stage, how is the image selected? What if removing the non-preference $s_l^{\phi}$ in the training data? It would be great to provide some case studies.
soundness: 4
strengths: - The proposed dataset is well-motivated. The division of four evaluation levels (i.e., in-domain, cross-model, cross-forgery and cross-domain) is reasonable. A fine-grained evaluation protocol is critical and reasonable at the moment, and the constructed dataset is of high quality, providing a challenging evaluation suite for the community.
- The proposed pattern-aware reasoning is effective and insightful compared to previous explainable methods. Experiments clearly show its superiority compared to previous pipelines.
- The proposed MiPO and P-GRPO is coherent with the proposed reasoning framework. Thorough ablations are conducted to validate their effectiveness.
summary: This paper makes two primary contributions to the field of deepfake detection. First, it introduces HydraFake dataset, which extends the evaluation into a rigorous and hierarchical setting, providing a more realistic and challenging benchmark to the field. Second, the paper proposes Veritas, a novel MLLM-based detector. Experiments show both qualitatively and quantitatively the effectiveness of the model.
weaknesses: - The authors should provide some failure cases to understand the model’s limitations.
- More fine-grained ablations on the reasoning patterns could be done, e.g., what if removing the “reflection”/“planning” pattern?
- How "reflection" improves model's generalization capability to unseen forgeries? The author should provide more explanations to it.
- The human has very good reasoning capabilities. Why even human cannot accurately detect some (realistic) deepfakes? Is semantic-level reasoning capability truly crucial for deepfake detection?

---

confidence: 4
contribution: 3
initial_rating: 4
presentation: 3
questions: Q1: Could the authors provide additional comparisons or discussions with recent large multimodal reasoning-based detectors (e.g., FakeShield, M2F2-Det, SIDA) to better contextualize VERITAS?

If this question is properly addressed, it would increase my score, as a fair comparison with large models is the most critical issue.

Q2: Does the proposed VERITAS framework have the potential to generalize beyond face forgery detection — for example, to AIGC-generated or other cross-domain manipulation tasks?

If this aspect is explored or discussed, it would further raise my score, though it is secondary to the first point.
soundness: 3
strengths: The proposed VERITAS framework demonstrates strong innovation in the field of Deepfake detection. Its core contribution lies in transforming the traditional feature-memorization-based detection paradigm into a reasoning-based framework grounded in pattern-aware reasoning.Unlike previous models that rely on specific forgery artifacts, VERITAS explicitly models forgery patterns as transferable reasoning units, enabling the understanding of common structural characteristics shared across different forgery types. In addition, the authors introduce a Chain-of-Thought (CoT) reasoning mechanism, allowing the model to progressively identify manipulated regions through multi-step logical inference, thereby enhancing interpretability and robustness.
The paper further proposes a Mixed Preference Optimization (MiPO) strategy, which balances the learning preferences among various forgery patterns, effectively improving the model’s cross-manipulation and cross-domain generalization capabilities.Overall, this study presents substantial innovation and academic value across three dimensions — detection paradigm, reasoning mechanism, and optimization strategy.
summary: The paper introduces the HydraFake dataset and the VERITAS model.
The HydraFake dataset encompasses a diverse range of deepfake generation techniques and real-world forgery cases. It provides a rigorous training and evaluation protocol that covers unseen model architectures, emerging forgery techniques, and novel data domains.The VERITAS detector, built upon a Multimodal Large Language Model (MLLM), differs from conventional Chain-of-Thought (CoT) based reasoning frameworks. It employs a two-stage training pipeline — pattern-guided cold start followed by pattern-aware exploration — with a particular emphasis on key reasoning modes such as “planning” and “self-reflection”.By simulating the human forensic reasoning process, VERITAS integrates the cognitive capabilities of large language models into deepfake detection (DFD), thereby achieving enhanced cross-manipulation and cross-domain generalization performance.
weaknesses: 1. Lack of fair comparison with recent large-scale multimodal frameworks.

Although VERITAS demonstrates impressive performance, the experimental comparison is incomplete and lacks fairness.
The paper does not include evaluations against recent large-scale multimodal or reasoning-based deepfake detection frameworks, such as FakeShield (ICLR 2025), M2F2-Det (CVPR 2025), and SIDA (CVPR 2025).

These methods share similar reasoning or multimodal fusion paradigms and therefore represent the most relevant baselines for comparison.

In contrast, most of the reported baselines are lightweight detectors (with only tens or hundreds of millions of parameters), while VERITAS is built upon an 8B-scale MLLM.


2. Limited domain coverage.

The current work focuses exclusively on face-oriented deepfake detection, whereas a growing number of studies have begun exploring cross-domain and generalized forgery detection, such as AIGC-generated content, IMDL (image manipulation localization), and general multimedia forensics frameworks (e.g., Effort, FakeShield, ForensicHub(NeurIPS 2025) ).

Expanding the scope of VERITAS to handle non-facial or multi-domain forgery types would not only enhance its practical value but also align it with the emerging trend toward universal content authenticity verification.


Decision: Accept (Oral)