FakeShield: Explainable Image Forgery Detection and Localization via Multi-modal Large Language Models

## Abstract

Abstract The rapid development of generative AI is a double-edged sword, which not only facilitates content creation but also makes image manipulation easier and more difficult to detect. Although current image forgery detection and localization (IFDL) methods are generally effective, they tend to face two challenges: 1) black-box nature with unknown detection principle, 2) limited generalization across diverse tampering methods (e.g., Photoshop, DeepFake, AIGC-Editing). To address these issues, we propose the explainable IFDL task and design FakeShield, a multi-modal framework capable of evaluating image authenticity, generating tampered region masks, and providing a judgment basis based on pixel-level and image-level tampering clues. Additionally, we leverage GPT-4o to enhance existing IFDL datasets, creating the Multi-Modal Tamper Description dataSet (MMTD-Set) for training FakeShield’s tampering analysis capabilities. Meanwhile, we incorporate a Domain Tag-guided Explainable Forgery Detection Module (DTE-FDM) and a Multi-modal Forgery Localization Module (MFLM) to address various types of tamper detection interpretation and achieve forgery localization guided by detailed textual descriptions. Extensive experiments demonstrate that FakeShield effectively detects and localizes various tampering techniques, offering an explainable and superior solution compared to previous IFDL methods.

## 1 Introduction

With the rapid development of AIGC, powerful image editing models have provided a breeding ground for convenient image tampering, blurring the boundaries between true and forgery. People can use AIGC image editing methods (Rombach et al., ; Zhang et al., ; Suvorov et al., ; Mou et al., ) to edit images without leaving a trace. Although it has facilitated the work of photographers and illustrators, AIGC editing methods have also led to an increase in malicious tampering and illegal theft. The authenticity of images in social media is difficult to guarantee, which will lead to problems such as rumor storms, economic losses, and legal concerns.
Therefore, it is important and urgent to identify the authenticity of images.
In this context, the image forgery detection and localization (IFDL) task aims to identify whether an image has been tampered with and locate the specific manipulation areas. It can be widely applied in the real world, such as filtering false content on social media, preventing
the spread of fake news, and court evidence collection.

State-of-the-art IFDL methods have utilized well-designed network structures, elaborate network constraints, and efficient pre-training strategies to achieve remarkable performance (Yu et al., ; Ma et al., ; Dong et al., ).
However, previous IFDL methods face two key problems, limiting their practicality and generalizability. First, as shown in Figure 1(a), most existing IFDL methods are black-box models, only providing the authenticity probability of the image, while the principle of detection is unknown to users. Since the existing IFDL methods cannot guarantee satisfactory accuracy, manual subsequent judgment is still required. Given that the information provided by the IFDL methods is insufficient, it is difficult to support the human assessment and users still need to re-analyze the suspect image by themselves.
Second,
in real-world scenarios, tampering types are highly diverse, including Photoshop (copy-and-move, splicing, and removal), AIGC-Editing, DeepFake, and so on. Existing IFDL methods (Yu et al., ; Ma et al., ) are typically limited to handling only one of these techniques, lacking the ability to achieve comprehensive generalization. This forces users to identify different tampering types in advance and apply specific detection methods accordingly, significantly reducing these models’ practical utility.

Figure: Figure 1: Illustration of the conventional IFDL and explainable IFDL framework. Conventional methods offer only detection results and tampered masks. We extend this into a multi-modal framework, enabling detailed explanations and conversational interactions for a deeper analysis.
Refer to caption: x1.png

Benefiting from the rapid advancements in Transformer architectures, Large Language Models (LLMs) have attracted significant attention. Furthermore, (Liu et al., ) introduced a Multi-modal Large Language Model (M-LLM) that aligns visual and textual features, thereby endowing LLMs with enhanced visual comprehension abilities. Given that LLMs are pre-trained on an extensive and diverse corpus of world knowledge, they hold significant potential for a wide range of applications, such as machine translation (Devlin, ), code completion, and visual understanding (Liu et al., ). Consequently, we explored the feasibility of employing M-LLMs for explainable Image Forgery Detection and Localization (e-IFDL). This approach allows for a more comprehensive explanation of the rationale behind tampering detection and provides a more precise identification of both the authenticity of images and the suspected manipulation regions.

To address the two issues of the existing IFDL methods, we propose the explainable-IFDL (e-IFDL) task and a multi-modal explainable tamper detection framework called FakeShield. As illustrated in Figure1(b), the e-IFDL task requires the model to evaluate the authenticity of any given image, generate a mask for the suspected tampered regions, and provide a rationale based on some pixel-level artifact details (e.g., object edges, resolution consistency) and image-level semantic-related errors (e.g., physical laws, perspective relationships).
Leveraging the capabilities of GPT-4o (OpenAI, ), we can generate a comprehensive triplet consisting of a tampered image, a modified area mask, and a detailed description of the edited region through a meticulously crafted prompt.
Then, we develop the Multi-Modal Tamper Description dataSet (MMTD-Set) by building upon existing IFDL datasets. Utilizing the MMTD-Set, we fine-tune M-LLM (Liu et al., ) and visual segmentation models (Kirillov et al., ; Lai et al., ), equipping them with the capability to provide complete analysis for judgment, detecting tampering, and generate accurate tamper area masks. This process ultimately forms a comprehensive forensic pipeline for analysis, detection, and localization. Our contributions are summarized as follows:

❑ (1) We present the first attempt to propose a multi-modal large image forgery detection and localization model, dubbed FakeShield. It can not only decouple the detection and localization process but also provide a reasonable judgment basis, which alleviates the black-box property and unexplainable issue of existing IFDL methods.

❑ (2) We use GPT-4o to enrich the existing IFDL dataset with textual information, constructing the MMTD-Set. By guiding it to focus on distinct features for various types of tampered data, GPT-4o can analyze the characteristics of tampered images and construct ”image-mask-description” triplets.

❑ (3) We develop a Domain Tag-guided Explainable Forgery Detection Module (DTE-FDM) to spot different types of fake images in a united model and effectively alleviate the data domain conflict. Meanwhile, an Multi-modal Forgery Localization Module (MFLM) is adopted to align visual-language features, thus pinpointing tampered areas.

❑ (4) Extensive experiments demonstrate that our method can accurately analyze tampering clues, and surpass most previous IFDL methods in the detection and localization of many tampering types like copy-move, splicing, removal, DeepFake, and AIGC-based editing.

## 2 Related works

### 2.1 Image Forgery Detection and Localization

Prevailing IFDL methods mainly target at the localization of specific manipulation types (Wu et al., ; Salloum et al., ; Islam et al., ). In contrast, universal tamper localization methods (Kwon et al., ; Wu et al., ; Hu et al., ; Li et al., ; Yu et al., ; Zhang et al., ) aim to detect artifacts and irregularities across a broader spectrum of tampered images. For instance, MVSS-Net (Dong et al., ) utilized multi-scale supervision and multi-view feature learning to simultaneously capture image noise and boundary artifacts. OSN (Wu et al., ) employed a robust training strategy to overcome the difficulties associated with lossy image processing. HiFi-Net (Guo et al., ) adopted a combination of multi-branch feature extraction and localization modules to effectively address alterations in images synthesized and edited by CNNs.
IML-ViT (Ma et al., ) integrated Swin-ViT into the IFDL task, employing an FPN architecture and edge loss constraints to enhance its performance. DiffForensics (Yu et al., ) adopted a training approach akin to diffusion models, strengthening the model’s capacity to capture fine image details.
Additionally, some researchers (Zhang et al., ; ; Asnani et al., ) have pursued proactive tamper detection and localization by embedding copyright and location watermarks into images/audio/videos preemptively. However, despite their acceptable performances, these IFDL methods cannot explain the underlying principles and rationale behind their detection and localization judgments, offering no interaction. Moreover, they suffer from limited generalization and accuracy, exhibiting significant performance disparities across different testing data domains.

### 2.2 Large Language Model

Large language models (Dubey et al., ; OpenAI, ) have garnered global attention in recent years for their exceptional instruction-following and text-generation abilities.
Based on the Transformer architecture, LLMs are pre-trained on massive datasets, allowing them to accumulate broad world knowledge that enhances their ability to generalize across a wide range of downstream tasks.
Subsequently, some researchers (Li et al., ) expanded LLMs’ powerful understanding and world knowledge to the visual domain by incorporating image encoders and projection layers, which enable images encoded into tokens that align with the text.
Some recent works (Chen et al., ; Wang et al., ; Chen et al., ) equipped M-LLMs with enhanced visual understanding capabilities by expanding the visual instruction datasets and increasing the model size during fine-tuning.
Currently, M-LLMs demonstrate impressive performance across various downstream tasks. LISA (Lai et al., ) integrated SAM (Kirillov et al., ) with M-LLM to implement reasoning segmentation, enabling the generation of masks from text descriptions. GLaMM (Rasheed et al., ) further enhanced this by using a more advanced region image encoder to improve text-to-mask grounding. Additionally, some studies (Yang & Zhou, ; Zhang et al., ) have explored the application of M-LLMs in DeepFake detection. For instance, (Zhang et al., ) introduced the DD-VQA dataset, combining a manual inference process for rating real and fake faces that can be distinguished using common sense.
Targeted at Deepfake detection, (Huang et al., ) used GPT-4o to create image-analysis pairs, and introduced a multi-answer intelligent decision system into MLLM, achieving good effect. However, it cannot be generalized to other types of tampering such as Photoshop and AIGC-Editing, and cannot accurately locate the tampered areas. Besides, using M-LLMs to realize universal tamper localization and detection remains unexplored.

## 3 Methodology

### 3.1 Construction of the proposed MMTD-Set

Figure: Figure 2: Illustration of the construction process of our MMTD-Set, where Au and Tp denote authentic and tampered respectively. We sample the tampered image-mask data pairs from IFDL(PhotoShop-tampering), DeepFake, and AIGC-editing benchmarks, and then use tamper-type-specific prompts to guide GPT-4o in constructing the judgment basis.
Refer to caption: x2.png

Motivation: Most existing IFDL datasets consist of a single visual modality, lacking training visual-language samples adapted to M-LLMs. The challenge of constructing our MMTD-Set lies in accurately translating the visual tampering information from the existing IFDL image datasets into precise textual descriptions. To address this challenge, our core contributions focus on two aspects: (1) We leverage GPT-4o to generate text description and provide both the tampered image and its corresponding mask to GPT-4o, enabling it to accurately identify the tampered location. (2) For each tamper type, we design specific prompts to their unique characteristics, guiding GPT-4o to focus on different tampering artifacts and providing more detailed visual cues.

Data collection: Based on (Ma et al., ; Nirkin et al., ), we categorize common tampering into three types: PhotoShop (copy-move, splicing, removal), DeepFake (FaceAPP (FaceApp Limited, )), and AIGC-Editing (SD-inpainting (Lugmayr et al., )). As shown in Figure 2, we gathered three types of tampered images along with their corresponding authentic images from public datasets (Dong et al., ; Dang et al., ) and self-constructed data.

GPT assisted description generation: Given that manual analysis of tampered images is time-consuming and inefficient, inspired by (Liu et al., ), we employed GPT-4o to automate the analysis of tampered images. As depicted in Figure 2(^1^11The layout and design of Figure 2 are inspired by (Huang et al., )), the output analysis is required to follow the format of detected results, localization descriptions, and judgment basis.

For tampered images, we input the edited image, its corresponding forgery mask, and our carefully constructed tamper type specific prompts into the powerful GPT-4o to more accurately describe the tampered regions. For authentic images, GPT-4o is provided with only the real image and a set of prompts, guiding it to confirm its authenticity. The full-text prompts are detailed in the Appendix A.4. To more clearly and specifically describe and analyze the tampering of images, GPT-4o describes the image from two key aspects: the location and content of the tampered areas, and any visible artifacts or semantic errors caused by the tampering: (1) For the tampering location, GPT-4o is required to describe it in both absolute positions (e.g., top, bottom, upper left corner, lower right corner) and relative positions (e.g., above the crowd, on the table, under the tree). When analyzing the tampered content, it is tasked with providing detailed information about the types, quantities, actions, and attributes of the objects within the tampered region.
(2) For the visible artifacts and semantic errors, since different tampering methods produce distinct types of artifacts, we craft specific prompts to guide the analysis. It can broadly be categorized into pixel-level artifact details and image-level semantic-related errors. For PhotoShop (PS) tampering, operations like copy-move and splicing often introduce pixel-level issues such as edge artifacts, abnormal resolution, and inconsistencies in lighting. Additionally, semantic-level errors, including violations of physical laws or common sense, are frequently observed. In AIGC-Editing (AIGC), for instance, it often fails to generate text accurately, resulting in disordered symbols or characters appearing in the tampered area. For the DeepFake (DF), tampering with facial features frequently results in localized blurring. Further details are illustrated in Figure 2 and Appendix A.5. Noted that the concurrent work (Huang et al., ) also introduced GPT to constructing multi-modal datasets, but we added the description of the tampering region’s location and paid more attention to visible artifacts and semantic errors in different tamper-type images.

Figure: Figure 3: The pipeline of FakeShield. Given an image $\mathbf{I}_{ori}$ for detection, it is first processed by the Domain Tag Generator $\mathcal{G}_{dt}(\cdot)$ to obtain a data domain tag $\mathbf{T}_{tag}$. The tag $\mathbf{T}_{tag}$, along with the text instruction $\mathbf{T}_{ins}$ and image tokens $\mathbf{T}_{img}$, are simultaneously input into the fine-tuned LLM, generating tamper detection result and explanation $\mathbf{O}_{det}$. Subsequently, $\mathbf{O}_{det}$ and $\mathbf{I}_{ori}$ are input into the Tamper Comprehension Module $\mathcal{C}_{t}(\cdot)$, and the last-layer embedding for the <SEG> token $\mathbf{h}_{\texttt{<SEG>}}$ serves as a prompt for SAM, guiding it to generate the tamper area mask $\mathbf{M}_{loc}$.
Refer to caption: x3.png

### 3.2 Overall Framework of FakeShield

Our goals involve two issues: 1): Utilizing the textual understanding ability and world prior knowledge of the M-LLM to analyze and judge the authenticity of tampered images; 2): Adopting the analysis and interpretation of tampered images to assist the segmentation model in pinpointing the tampered areas. To solve these two tasks, an intuitive approach is to fine-tune a large multimodal model to simultaneously output analysis and tampered masks. However, we find that joint training of multiple tasks will increase the difficulty of network optimization and interfere with each other. Considering that detection and interpretation focus more on language understanding and organization, while localization requires more accumulation of visual prior information, the proposed FakeShield contains two key decoupled parts, namely DTE-FDM and MFLM, as illustrated in Figure. 3. Specifically, a original suspected image $\mathbf{I}_{ori}$ and an instruction text $\mathbf{T}_{ins}$ (e.g. “Can you identify manipulated areas in the photograph?”) are fed to the proposed DTE-FDM to predict the detection result and judgment basis $\mathbf{O}_{det}$. In this process, we use a learnable generator to produce a domain tag $\mathbf{T}_{tag}$, thus avoiding the tampered data domain conflict. Furthermore, we input the interpretation $\mathbf{O}_{det}$ and the image $\mathbf{I}_{ori}$ to the MFLM to accurately extract the tampered mask $\mathbf{M}_{loc}$. To promote cross-modal interaction for tamper localization, we introduce a tamper comprehension module to align the visual and textual features and enhance the ability of the vision foundation model to understand long descriptions.

### 3.3 Domain Tag-guided Explainable Forgery Detection Module

Motivation: In real-life scenarios, images can be tampered with and attacked through various methods, including copy-move, splicing, removal, DeepFake, and AIGC-based methods.
However, these tampered images have different distribution characteristics, and domain differences, making it difficult to apply a single IFDL method to all forgery data.
For example, DeepFake focuses on face modification, often resulting in partial blurring of the face, as well as unnatural appearances of the lips, teeth, and eyes. In contrast, tools like PhotoShop (splicing, copy-move, removal) tend to leave noticeable artifacts at the edges of the tampered areas. In the case of AIGC-Editing, the characteristic is blurring within the tampered region, which frequently alters or obscures some texture details.
To mitigate these significant domain discrepancies, inspired by (Sanh et al., ), we introduce the Domain Tag Generator(DTG), which utilizes a specialized domain tag to prompt the model to distinguish between various data domains.

First, the original image $\mathbf{I}_{ori}$ is input into a classifier $\mathbf{G}_{dt}$ to obtain the domain tag $\mathbf{T}_{tag}$. Specifically, we classify all common tampering types into three categories: Photoshop-based editing, DeepFake, and AIGC-based tampering, and use the template “This is a suspected {data domain}-tampered picture.” as the identifier.
Simultaneously, consistent with (Liu et al., ), $\mathbf{I}_{ori}$ is passed through the image encoder $\mathcal{F}_{enc}(\cdot)$ and linear projection layer $\mathcal{F}_{proj}(\cdot)$ to generate the image tokens [IMG] $\mathbf{T}_{img}$.
Next, $\mathbf{T}_{tag}$ and $\mathbf{T}_{img}$ are concatenated with the instruction $\mathbf{T}_{ins}$ and then fed into the $\operatorname{LLM}(\cdot)$. To be noted, $\mathbf{T}_{ins}$ is a prompt that instructs the model to detect tampering and describe the location of the manipulation, for example: “Can you identify manipulated areas in the photograph?”. After several autoregressive predictions, the output $\mathbf{O}_{det}$ comprises three components: detection results, a description of the location of tampered area, and the interpretive basis for the detection. We describe the process as follows.

$$ $\mathbf{T}_{tag}=\mathcal{G}_{dt}(\mathbf{I}_{ori}),\quad\mathbf{T}_{img}= \mathcal{F}_{proj}(\mathcal{F}_{enc}(\mathbf{I}_{ori}))$ (1) $$

$$ $\mathbf{O}_{det}=\operatorname{LLM}(\mathbf{T}_{ins},\mathbf{T}_{tag}\mid \mathbf{T}_{img}).$ (2) $$

Given the large size of LLMs and limited computational resources, full parameter training is impractical. Thus, we freeze the LLM and leverage LoRA fine-tuning technology (Hu et al., ) to preserve semantic integrity while enabling efficient image forgery detection.

### 3.4 Multi-modal Forgery Localization Module

Motivation: Although $\mathbf{O}_{det}$ provides a textual description of the tampered area, it lacks precision and intuitive clarity. To address this issue, we aim to transform $\mathbf{O}_{det}$ into an accurate binary mask, providing a clearer and more accurate representation of the tampered region. Existing prompt-guided segmentation algorithms (Kirillov et al., ; Lai et al., ) struggle to capture the semantics of long texts and hard to accurately delineate modified regions based on detailed descriptions. Inspired by (Lai et al., ), we propose a Tamper Comprehension Module (TCM), which is an LLM serving as an encoder aligns long-text features with visual modalities, enhancing SAM’s precision in locating the forgery areas. To generate the prompt fed into SAM, following (Lai et al., ), we introduce a specialized token <SEG>.

As illustrated in Figure.3, the tokenized image $\mathbf{T}_{img}$ and the tampered area description $\mathbf{O}_{det}$ are input into the TCM $\mathcal{C}_{t}$. Then, we extract the last-layer embedding of TCM and transform it into $\mathbf{h}_{\texttt{<SEG>}}$ via an MLP projection layer.
Simultaneously, the original image $\mathbf{I}_{ori}$ is processed through the SAM encoder $\mathcal{S}_{enc}$ and decoder $\mathcal{S}_{dec}$, where $\mathbf{h}_{\texttt{<SEG>}}$ serve as a prompt for $\mathcal{S}_{dec}$ guiding the generation of the mask $\mathbf{M}_{loc}$.

$$ $\displaystyle\mathbf{E}_{mid}$ $\displaystyle=\mathcal{S}_{enc}(\mathbf{I}_{ori})$ (3) $\displaystyle\mathbf{h}_{\texttt{<SEG>}}$ $\displaystyle=\operatorname{Extract}(\mathcal{C}_{t}(\mathbf{T}_{img},\mathbf{ O}_{det}))$ $\displaystyle\mathbf{M}_{loc}$ $\displaystyle=\mathcal{S}_{dec}(\mathbf{E}_{mid}\mid\mathbf{h}_{\texttt{<SEG>} }),$ $$

where $\mathbf{E}_{mid}$ represents the intermediate features of SAM, and $\operatorname{Extract}(\cdot)$ denotes the operation of extracting the last-layer embedding corresponding to the <SEG> token. Similar to DTE-FDM, we also apply LoRA fine-tuning to MFLM for greater efficiency. With the integration of TCM, SAM will achieve more precise localization of the forgery areas.

### 3.5 Training Objectives

The two submodules of our FakeShield are trained end-to-end separately. For DTE-FDM, the domain tag generator utilizes cross-entropy loss $\ell_{ce}$ as its training objective, enabling it to distinguish between different data domains. Following the approach of LLaVA (Liu et al., ), our LLM’s training objective is the autoregressive text generation cross-entropy loss. The training target of DTE-FDM $\ell_{det}$ can be formulated as:

$$ $\ell_{det}=\ell_{ce}(\hat{\mathbf{O}}_{det},\mathbf{O}_{txt})+\lambda\cdot\ell _{ce}(\hat{\mathbf{T}}_{tag},\mathbf{T}_{tag}),$ (4) $$

where $\ell_{ce}$ represents cross-entropy loss, and $\lambda$ denotes the weight used for balancing different loss components. For MFLM, we apply $\ell_{ce}$ to constrain TCM to produce high-quality prompt $\hat{\mathbf{y}}_{txt}$ with <SEG> token. Meanwhile, we use a linear combination of binary cross-entropy loss $\ell_{bce}$ and dice loss $\ell_{dice}$ to encourage the output of MFLM $\hat{\mathbf{M}}_{loc}$ to be close to the GT mask $\mathbf{M}_{loc}$. Given the ground-truth prompt $\mathbf{y}_{txt}$ (such as “It is <seg>”) and mask $\mathbf{M}_{loc}$, our training losses for MFLM $\ell_{loc}$ can be formulated as:

$$ $\ell_{loc}=\ell_{ce}(\hat{\mathbf{y}}_{txt},\mathbf{y}_{txt})+\alpha\cdot\ell_ {bce}(\hat{\mathbf{M}}_{loc},\mathbf{M}_{loc})+\beta\cdot\ell_{dice}(\hat{ \mathbf{M}}_{loc},\mathbf{M}_{loc}),$ (5) $$

where $\alpha$ and $\beta$ are weighting factors used to balance the respective losses. $\ell_{ce}$, $\ell_{bce}$, and $\ell_{dice}$ refer to cross-entropy loss, binary cross-entropy loss, and dice loss (Sudre et al., ) respectively.

**Table 1: Detection performance comparison between our FakeShield and other competitive methods. Our method can achieve the best detection accuracy in PhotoShop, DeepFake, and AIGC-Editing tampered datasets. The best score is highlighted in bold and the second-best score is underlined.**
| Method | PhotoShop | DeepFake | AIGC-Editing |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| CASIA1+ | IMD2020 | Columbia | Coverage | DSO |  |  |  |  |  |  |  |  |  |  |
| ACC | F1 | ACC | F1 | ACC | F1 | ACC | F1 | ACC | F1 | ACC | F1 | ACC | F1 |  |
| SPAN | 0.60 | 0.44 | 0.70 | 0.81 | 0.87 | 0.93 | 0.24 | 0.39 | 0.35 | 0.52 | 0.78 | 0.78 | 0.47 | 0.05 |
| ManTraNet | 0.52 | 0.68 | 0.75 | 0.85 | 0.95 | 0.97 | 0.95 | 0.97 | 0.90 | 0.95 | 0.50 | 0.67 | 0.50 | 0.67 |
| HiFi-Net | 0.46 | 0.44 | 0.62 | 0.75 | 0.68 | 0.81 | 0.34 | 0.51 | 0.96 | 0.98 | 0.56 | 0.61 | 0.49 | 0.42 |
| PSCC-Net | 0.90 | 0.89 | 0.67 | 0.78 | 0.78 | 0.87 | 0.84 | 0.91 | 0.66 | 0.80 | 0.48 | 0.58 | 0.49 | 0.65 |
| CAT-Net | 0.88 | 0.87 | 0.68 | 0.79 | 0.89 | 0.94 | 0.23 | 0.37 | 0.86 | 0.92 | 0.85 | 0.84 | 0.82 | 0.81 |
| MVSS-Net | 0.62 | 0.76 | 0.75 | 0.85 | 0.94 | 0.97 | 0.65 | 0.79 | 0.96 | 0.98 | 0.84 | 0.91 | 0.44 | 0.24 |
| FakeShield | 0.95 | 0.95 | 0.83 | 0.90 | 0.98 | 0.99 | 0.97 | 0.98 | 0.97 | 0.98 | 0.93 | 0.93 | 0.98 | 0.99 |

## 4 Experiment

### 4.1 Experimental Setup

Dataset:
We employ the dataset construction method outlined in Section 3.1 to build the training and test sets of the MMTD-Set.
For the training set, we utilize PhotoShop tampering (e.g., CASIAv2 (Dong et al., ), Fantastic Reality (Kniaz et al., )), DeepFake tampering (e.g., FFHQ, FaceApp (Dang et al., )), and some self-constructed AIGC-Editing tampered data as the source dataset. For the testing set, we select several challenging public benchmark datasets including PhotoShop tampering (CASIAv1+ (Dong et al., ), Columbia (Ng et al., ), IMD2020 (Novozamsky et al., ), Coverage (Wen et al., ), DSO (De Carvalho et al., ), Korus (Korus & Huang, )), DeepFake tampering (e.g., FFHQ, FaceApp (Dang et al., )), and some self-generated AIGC-Editing data. See the Appendix for more details.

State-of-the-Art Methods: To ensure a fair comparison, we select competitive methods that provide either open-source code or pre-trained models. To evaluate the IFDL performance of FakeShield, we compare it against SPAN (Hu et al., ), MantraNet (Wu et al., ), OSN (Wu et al., ), HiFi-Net (Guo et al., ), PSCC-Net (Liu et al., ), CAT-Net (Kwon et al., ), and MVSS-Net (Dong et al., ), all of which are retrained on the MMTD-Set for consistency with the same training setup. For DeepFake detection, CADDM (Dong et al., ) and HiFi-DeepFake (Guo et al., ) are chosen as comparison methods. Additionally, to assess the explanation ability of FakeShield, we compare it with open-source M-LLMs such as LLaVA-v1.6-34B (Liu et al., ), InternVL2-26B (Chen et al., ), and Qwen2-VL-7B (Wang et al., ), as well as the closed-source model GPT-4o (OpenAI, ).

Evaluation Metrics: For detection, we report image-level accuracy (ACC) and F1 scores. We use Intersection over Union (IoU) and F1 scores for localization. To evaluate interpretability, we use Cosine Semantic Similarity (CSS) to assess the similarity between the predicted text and ground truth text by calculating the cosine similarity between their high-dimensional semantic vectors. For the IFDL, a default threshold of $0.5$ is applied unless otherwise specified.

Implementation Details: On the MMTD-Set, we initially fine-tune the M-LLM using LoRA (rank=$128$, alpha=$256$), such as LLaVA-v1.5-13B (Liu et al., ), while simultaneously training the Domain Tag Generator with full parameters. The model is trained for $10$ epochs on $4$ NVIDIA A100 40G GPUs, with a learning rate of $2$$\times$$10^{-4}$ and a batch size of $24$. Afterward, we fine-tune the Tamper Comprehension Module and Segment Anything Model (Kirillov et al., ) with LoRA (rank=$8$, alpha=$16$), training for $24$ epochs on the same hardware configuration, with a learning rate of $3$$\times$$10^{-4}$ and a batch size of $48$.

### 4.2 Comparison with Image Forgery Detection Method

To verify the superiority and generalization of our method on the image forgery detection task, we test the detection accuracy on MMTD-Set (Photoshop, DeepFake, AIGC-Editing). As shown in Table 1, our FakeShield almost achieves optimal performance across various tampering and testing data domains. For example, our method outperforms the second-best method, MVSS-Net, with an ACC of 0.08 and an F1 of 0.05 on the IMD2020 dataset. Notably, since we introduce the domain-tag guidance strategy, our method not only achieves excellent performance on the traditional IFDL benchmark but also generalizes to DeepFake and AIGC tampering, achieving 0.93 and 0.98 detection accuracy, respectively. However, other works lack an effective mechanism to handle data domain conflicts. Even when trained using the same multi-data domain training set as ours, their detection accuracy remains insufficient.

**Table 2: Performance comparison with competitive DeepFake detection methods.**
| Method | CADDM | HiFi-DeepFake | Ours |
| --- | --- | --- | --- |
| ACC | 0.5227 | 0.5177 | 0.9835 |
| F1 | 0.5982 | 0.6403 | 0.9915 |

Furthermore, we compare our method with several state-of-the-art DeepFake detection approaches on the MMTD-Set(DeepFake), including CADDM and HiFi-DeepFake. As shown in Table 2, our approach significantly outperforms the other two methods. Notably, the domain tag mechanism we introduce not only alleviates conflicts across diverse data domains but also promotes complementarity and mutual enhancement between them. Despite being specifically designed for DeepFake detection, these comparison methods still fall short of the performance achieved by FakeShield.

### 4.3 Comparison with M-LLMs

To assess the quality of explanation text generation, we employ the tampered area descriptions generated by GPT-4o as ground truth on the MMTD-Set(Photoshop, DeepFake, AIGC-Editing), using cosine semantic similarity (CSS) to compare the performance of pre-trained M-LLMs against FakeShield. The results, presented in Table 3, demonstrate that our approach consistently achieves the best performance across nearly all test sets. For instance, on the DSO, our method attains a CSS score of 0.8873, significantly surpassing the second-best result from InternVL2-26B, which only achieves 0.6484. A selection of model outputs is illustrated in the Appendix.

It is important to highlight that some pre-trained M-LLMs still exhibit a degree of proficiency in detecting tampered content. For instance, in cases involving blatant violations of physical laws due to tampering, these M-LLMs leverage their pre-training knowledge to make reasonably correct judgments. However, they struggle to perform more precise analyses, such as identifying inconsistencies in lighting or perspective, leading to lower overall accuracy.

**Table 3: Comparative results(CSS$\uparrow$) of the pre-trained M-LLMs and FakeShield in tampering explanation capabilities on the MMTD-Set. Our framework is in the leading position in all test sets and has strong interpretation and analysis capabilities.**
| Method | PhotoShop | DeepFake | AIGC-Editing |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| CASIA1+ | IMD2020 | Columbia | Coverage | NIST | DSO | Korus |  |  |  |
| GPT-4o | 0.5183 | 0.5326 | 0.5623 | 0.5518 | 0.5732 | 0.5804 | 0.5549 | 0.5643 | 0.6289 |
| LLaVA-v1.6-34B | 0.6457 | 0.5193 | 0.5578 | 0.5655 | 0.5757 | 0.5034 | 0.5387 | 0.6273 | 0.6352 |
| InternVL2-26B | 0.6760 | 0.5750 | 0.6155 | 0.6193 | 0.6458 | 0.6484 | 0.6297 | 0.6570 | 0.6751 |
| Qwen2-VL-7B | 0.6133 | 0.5351 | 0.5603 | 0.5702 | 0.5559 | 0.4887 | 0.5260 | 0.6060 | 0.6209 |
| FakeShield | 0.8758 | 0.7537 | 0.8791 | 0.8684 | 0.8087 | 0.8873 | 0.7941 | 0.8446 | 0.8860 |

### 4.4 Comparison with Image Forgery Location Method

To assess the model’s capability to locate tampered regions, we conduct comparisons to establish some competitive IFDL methods on MMTD-Set (Photoshop, AIGC-Editing). As present in Table 4, our method consistently surpasses the performance of others across almost all test datasets. For instance, on the IMD2020, our method outperforms the suboptimal method, OSN, with notable advantages of 0.12 in IoU and 0.1 in F1 score. On the CASIA1+, we also lead the sub-optimal method OSN with an IoU of 0.07 and an F1 of 0.09.

Additionally, subjective comparisons of several methods are illustrated in Figure 4, where it is evident that our approach precisely captures the boundaries of tampered areas, producing clean and complete segmentations. In contrast, methods like PSCC-Net exhibit dispersed attention over the image, resulting in blurred segmentations and an overly broad predicted tampering range. Notably, as our segmentation module MFLM is based on the pre-trained visual segmentation model SAM, it inherits SAM’s powerful semantic segmentation capabilities and can accurately segment targets with clear semantic information (Columns 1 and 2 of Figure 4). Additionally, due to the diverse tampering types in MMTD-Set, our method is also capable of accurately segmenting tampered areas that lack distinct semantic information (Columns 3 of Figure 4).

**Table 4: Comparative results of tamper localization capabilities between competing IFDL methods and FakeShield, tested on MMTD-Set(Photoshop, AIGC-Editing).FakeShield consistently achieves the highest IoU and F1 scores across most test sets.**
| Method | CASIA1+ | IMD2020 | Columbia | NIST | DSO | Korus | AIGC-Editing |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| IoU | F1 | IoU | F1 | IoU | F1 | IoU | F1 | IoU | F1 | IoU | F1 | IoU | F1 |  |
| SPAN | 0.11 | 0.14 | 0.09 | 0.14 | 0.14 | 0.20 | 0.16 | 0.21 | 0.14 | 0.24 | 0.06 | 0.10 | 0.09 | 0.12 |
| ManTraNet | 0.09 | 0.13 | 0.10 | 0.16 | 0.04 | 0.07 | 0.14 | 0.20 | 0.08 | 0.13 | 0.02 | 0.05 | 0.07 | 0.12 |
| OSN | 0.47 | 0.51 | 0.38 | 0.47 | 0.58 | 0.69 | 0.25 | 0.33 | 0.32 | 0.45 | 0.14 | 0.19 | 0.07 | 0.09 |
| HiFi-Net | 0.13 | 0.18 | 0.09 | 0.14 | 0.06 | 0.11 | 0.09 | 0.13 | 0.18 | 0.29 | 0.01 | 0.02 | 0.13 | 0.22 |
| PSCC-Net | 0.36 | 0.46 | 0.22 | 0.32 | 0.64 | 0.74 | 0.18 | 0.26 | 0.22 | 0.33 | 0.15 | 0.22 | 0.10 | 0.15 |
| CAT-Net | 0.44 | 0.51 | 0.14 | 0.19 | 0.08 | 0.13 | 0.14 | 0.19 | 0.06 | 0.10 | 0.04 | 0.06 | 0.03 | 0.05 |
| MVSS-Net | 0.40 | 0.48 | 0.23 | 0.31 | 0.48 | 0.61 | 0.24 | 0.29 | 0.23 | 0.34 | 0.12 | 0.17 | 0.18 | 0.24 |
| FakeShield | 0.54 | 0.60 | 0.50 | 0.57 | 0.67 | 0.75 | 0.32 | 0.37 | 0.48 | 0.52 | 0.17 | 0.20 | 0.18 | 0.24 |

Figure: Figure 4: Testing results on MMTD-Set for FakeShield are compared with PSCC-Net, OSN, CAT-Net, and MVSS-Net. The test samples, from left to right, are drawn from IMD2020, CASIA1+, Columbia, NIST16, Korus, and DSO.
Refer to caption: x4.png

### 4.5 Robustness Study

With the widespread use of the Internet and social media, individuals are increasingly receiving images degraded by transmission artifacts such as JPEG compression and Gaussian noise. Our model’s performance on MMTD-Set(CASIA1+) under these degradations is reported in Table 4.5, which includes four common degradation types: JPEG compression qualities of $70$ and $80$, and Gaussian noise variances of $5$ and $10$. As M-LLMs primarily emphasize high-level semantic information, although we do not specifically add degraded data during training, FakeShield demonstrates robustness to low-level visual distortions and noise. JPEG compression and Gaussian noise, commonly associated with social media, have minimal effect on its performance, highlighting the stability, robustness, and practical advantages of our approach.

Figure: Table 5: Explanation and location performance of our FakeShield under different degradations.

Figure: Figure 5: Ablation studies on the LLM in the DTE-FDM.
Refer to caption: extracted/5979425/line_chart.png

### 4.6 Ablation Study

Ablation Study on Domain Tag Generator: To validate that the proposed domain tag effectively mitigates domain discrepancies and enhances the model’s generalization across diverse data domains, we conducted an ablation study. Specifically, we removed the domain tag generator (DTG) and trained the FakeShield with identical configurations on the MMTD-Set, the test results are displayed in Table 6.
Without the DTG module, the model’s detection performance declined across test sets from each data domain. Notably, the detection ACC and F1 score for DeepFake decreased by 0.09. This demonstrates that without the support of the DTG module, the model struggles to effectively differentiate between various data domains, leading to more pronounced data conflicts and a significant reduction in both generalization and practical applicability.

**Table 6: Performance comparison of FakeShield with and without DTG on different datasets.**
| Method | CASIA1+ | DeepFake | AIGC-Editing |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| ACC | F1 | ACC | F1 | ACC | F1 |  |
| Ours w/o DTG | 0.92 | 0.92 | 0.89 | 0.90 | 0.72 | 0.78 |
| Ours | 0.95 | 0.95 | 0.98 | 0.99 | 0.93 | 0.93 |

Ablation Study on LLM in the DTE-FDM: Furthermore, to verify the necessity of the LLM in the DTE-FDM, we design a variant of FakeShield, which removes the LLM and directly input {$\mathbf{T}_{ins}$, $\mathbf{T}_{tag}$, $\mathbf{T}_{img}$} into the tamper comprehension module, adjusting its training objective to directly produce the description $\mathbf{O}_{det}$ and the mask $\mathbf{M}_{loc}$. Using the same training configurations, we train the variant and our original framework for $25$ epochs, evaluating their localization accuracy on the CASIA1+ dataset.
As shown in Figure 4.5, after removing the LLM, the localization performance consistently lags behind the original framework throughout the entire training process and it converges earlier. It proves that joint training detection and localization via a single MFLM tends to cause notable performance degradation than our decoupled module design, which further highlights the critical role of our LLM module in enhancing the semantic understanding of the proposed framework.

## 5 Conclution

In this work, we present the first application of an M-LLM for the explanation IFDL, marking a significant advancement in the field. Our proposed framework, FakeShield, excels in tampering detection while delivering comprehensive explanations and precise localization, demonstrating strong generalization across a wide range of manipulation types. These features make it a versatile and practical tool for diverse real-world applications. Looking to the future, this work can play a crucial role in several areas, such as aiding in the improvement of laws and regulations related to digital content manipulation, informing the development of guidelines for generative artificial intelligence, and promoting a clearer and more trustworthy online environment. Additionally, FakeShield can assist in evidence collection for legal proceedings and help correct misinformation in public discourse, ultimately contributing to the integrity and reliability of digital media.

## Appendix A Appendix

### A.1 Limitations and Future Works

One limitation of our current framework is its suboptimal performance when handling more complex types of deepfake tampering, such as identity switching and full-face generation. These types of manipulations introduce unique challenges that our model currently struggles to address effectively. To address this, future work will focus on several key optimizations. First, we plan to incorporate a Chain-of-Thought (CoT) (Wei et al., ) mechanism to enhance the model’s reasoning abilities, enabling it to detect more subtle manipulations in deepfake content. Second, we will expand our training dataset to include a broader range of deepfake samples, encompassing various tampering techniques and scenarios, to improve the model’s generalization. Finally, we will optimize specific modules within the framework to better handle these complex tampering types, creating a more robust and adaptable detection system. These improvements are expected to significantly enhance the framework’s performance across a wider spectrum of deepfake domains.

### A.2 Data Sources

We collected source data from the dataset mentioned in Section 4.1, with the details provided in Table 7.

It is noted that the FaceApp and FFHQ datasets are part of the DFFD (Dang et al., ) dataset. We follow their original configuration to divide the training and validation sets. FFHQ () consists of real face images, while FaceApp (FaceApp Limited, ) contains fake faces generated by the FaceApp (FaceApp Limited, ) tool, which manipulates facial attributes in the images.

Regarding the construction process of the AIGC-Editing dataset, we first collected 20,000 real images from the COCO (Lin et al., ) dataset and used the SAM (Kirillov et al., ) tool to segment the masks of all targets. We then selected the target mask with the third-largest area in each image and applied the Stable-Diffusion-Inpainting (Lugmayr et al., ) method to partially redraw this section. To ensure a balance between positive and negative samples, we further extracted an additional 20,000 images from the COCO dataset, distinct from the previously selected ones.

**Table 7: Summary of datasets used for training, and evaluation.**
| Dataset | Real | Fake | Copy-Move | Splicing | Removal | DeepFake | AIGC-Edit |
| --- | --- | --- | --- | --- | --- | --- | --- |
| #Training |  |  |  |  |  |  |  |
| Fantastic Reality | 16,592 | 19,423 | - | 19,423 | - | - | - |
| CASIAv2 | 7,491 | 5,123 | 3,295 | 1,828 | - | - | - |
| FFHQ | 10000 | - | - | - | - | - | - |
| FaceAPP | - | 7,308 | - | - | - | 7,308 | - |
| COCO | 20,000 | - | - | - | - | - | - |
| AIGC-Editing | - | 20,000 | - | - | - | - | 20,000 |
| #Evaluation |  |  |  |  |  |  |  |
| CASIAv1+ | 800 | 920 | 459 | 461 | - | - | - |
| Columbia | - | 180 | - | 180 | - | - | - |
| Coverage | - | 100 | 100 | - | - | - | - |
| NIST | - | 564 | 68 | 288 | 208 | - | - |
| IMD2020 | 414 | 2,010 | - | 2,010 | - | - | - |
| DSO | - | 100 | - | 100 | - | - | - |
| Korus | - | 220 | - | 220 | - | - | - |
| FFHQ | 1,000 | - | - | - | - | - | - |
| FaceAPP | - | 1,000 | - | - | - | 1,000 | - |
| COCO | 20,000 | - | - | - | - | - | - |
| AIGC-Editing | - | 20,000 | - | - | - | - | 20,000 |

### A.3 Answer Analysis

Figure 6 presents the adjective and noun word clouds for the ground truth (GT) descriptions in the MMTD-Set and the answer descriptions generated by our FakeShield. It is evident that, through effective fine-tuning, FakeShield can be guided by the dataset to assess both image-level semantic plausibility (e.g., ”physical law,” ”texture”) and pixel-level tampering artifacts (e.g., ”edge,” ”resolution”) to determine whether an image is real.

### A.4 Prompts

During the process of using GPT-4o to construct the MMTD-Set, we meticulously designed distinct prompts for each category of tampered data to guide GPT-4o in focusing on specific aspects for image analysis, as illustrated in Figure 7 and Figure 8.

### A.5 Examples

Comparison of subjective results of mainstream M-LLM: As mentioned in Section 4.3, we selected some M-LLM output samples, as shown in Figures 9 and 10.

FakeShield output subjective samples: We selected several results from FakeShield’s testing on PhotoShop, DeepFake, and AIGC-Editing datasets, as displayed in Figures 11, 12, 13, 14, 15 and 16.

MMTD-Set data set example: We select some samples from the MMTD-Set data set and display them in Figures 17, 18, and 19.

Figure: Figure 6: The noun and verb word clouds in the MMTD-Set and the FakeShield Generated Answer. It can be seen that the high-frequency vocabulary of the two is basically the same.
Refer to caption: x5.png

Figure: Figure 7: Prompts for GPT-4o when constructing MMTD-Set. (a) Analysis guide prompt designed for PhotoShop tampered and AIGC-Editing tampered images. (b) Analysis guidance prompt designed for real scene images.
Refer to caption: x6.png

Figure: Figure 8: More prompts for GPT-4o when constructing MMTD-Set. (a) Analysis guide prompt designed for DeepFake tampered images. (b) Analysis guidance prompt designed for real face images.
Refer to caption: x7.png

Figure: Figure 9: The response of mainstream pre-trained M-LLM and FakeShield to tampered pictures. This is a sample from the CASIA1+ (Dong et al., ) test set, which has been tampered with by Splicing. The black animal at the bottom of the picture is pasted later. It can be seen that only FakeShield made the correct judgment and accurately described the tampered area.
Refer to caption: x8.png

Figure: Figure 10: The response of mainstream pre-trained M-LLM and FakeShield for real images. This is a sample from the IMD2020 (Novozamsky et al., ) test set, which is a real picture. It can be seen that only FakeShield makes the correct judgment, the rest of the methods consider the image to be tampered with.
Refer to caption: x9.png

Figure: Figure 11: Dialogue examples of FakeShield when receiving PhotoShop tampered images. The first image comes from the CASIA1+ (Dong et al., ) dataset and has been tampered with by Copy-Move. The yellow petals in the center of the picture are the parts pasted later. The second picture comes from the CASIA1+ (Dong et al., ) dataset and has been tampered with by Splicing. The penguin in the center of the picture is the part pasted later.
Refer to caption: x10.png

Figure: Figure 12: More dialogue examples of FakeShield when receiving PhotoShop tampered images. The first image comes from the Columbia (Ng et al., ) dataset and has been tampered with by Splicing. The elliptical area in the center of the screen is the post-processing area. The second picture comes from the IMD2020 (Novozamsky et al., ) dataset and has been tampered with by Copy-Move. The car on the right side of the image is copied and pasted from the first car.
Refer to caption: x11.png

Figure: Figure 13: Dialogue examples of FakeShield when receiving authentic scene images. The first image comes from the CASIA1+ (Dong et al., ) dataset. The second image comes from the IMD2020 (Novozamsky et al., ) dataset.
Refer to caption: x12.png

Figure: Figure 14: Dialogue examples of FakeShield when receiving DeepFake tampered images. The three images all come from the DFFD (Dang et al., ) dataset and have been tampered with by FaceAPP (FaceApp Limited, ). The first picture has a beard added to the chin, the first picture has glasses added, and the third picture has some hair added to the right side of the face.
Refer to caption: x13.png

Figure: Figure 15: Dialogue examples of FakeShield when receiving authentic face images. The three images all come from the DFFD (Dang et al., ) dataset.
Refer to caption: x14.png

Figure: Figure 16: Dialogue examples of FakeShield when receiving AIGC-Editing tampered images. The three images all come from the self-generated AIGC-Editing dataset and have been tampered with by Stable-Diffusion-Inpainting (Lugmayr et al., ). The window in the upper left corner of the first picture has been redrawn, and the circular clock area on the left side of the second picture has been redrawn.
Refer to caption: x15.png

Figure: Figure 17: MMTD-Set data samples related to PhotoShop tampering. The four images are all from the CASIAv2 data set. The first two pictures have been tampered with, but the last two pictures have not been tampered with.
Refer to caption: x16.png

Figure: Figure 18: MMTD-Set data samples related to AIGC-Editing tampering. The four images are all from the self-generated AIGC-Editing dataset. The first two pictures have been tampered with, but the last two pictures have not been tampered with.
Refer to caption: x17.png

Figure: Figure 19: MMTD-Set data samples related to DeepFake tampering. The four images are all from the DFFD (Dang et al., ) dataset. The first two pictures have been tampered with, but the last two pictures have not been tampered with.
Refer to caption: x18.png

## Peer Reviews

confidence: 5
contribution: 3
initial_rating: 8
presentation: 3
questions: It is recommended that the authors further validate model generalizability as well as quantify and validate the quality of the model explanations.
soundness: 3
strengths: 1. FakeShield is the first proposed multimodal large-scale image forgery detection and localization model, which can provide a more reasonable basis for judgment.
2. By combining visual and language models, the paper's method can provide more comprehensive image analysis. The paper enhances the existing IFDL dataset through GPT-4o and constructs MMTDSet, which also makes a certain contribution to the field of forgery detection.
3. The DTEFDM and MFLM modules proposed in the paper enable the model to flexibly handle different types of image tampering. This paper has potential value in practical applications.
summary: The paper designs a multimodal framework called FakeShield, which uses the power of large language models to train the model by building a Multi-Modal Tamper Description dataSet (MMTDSet), enabling it to analyze, detect, and locate image tampering. The author uses GPT-4o to generate text descriptions and convert the existing IFDL image dataset into a dataset containing accurate text descriptions.
weaknesses: 1. The model proposed in the paper may require high computing resources and training time.
2. The generalization ability of the model on new types of tampering that have not been seen yet needs further verification.  Also further work may be needed to quantify and verify the quality of the model's explanation.

---

confidence: 5
contribution: 3
initial_rating: 5
presentation: 2
questions: - Table 2: Why do competitors CADDM and HiFi-Net only achieve an accuracy close to random guessing? It seems unreasonable that competitors perform so poorly when both the training and testing sets are sourced from FFHQ and FaceAPP. Or, maybe it is because CADDM and HiFi-Net have not been retrained? (Lines 355-357 did not explicitly mention whether these methods were retrained).

- Figure 5: Why does the untrained FakeShield (epoch=0) already achieve an IoU of 0.40 on the CASIA1+ dataset? This result far surpasses the results of well-trained comparative algorithms, such as ManTraNet with 0.09 IoU and HiFi-Net with 0.13 IoU.

- Why is the localization of Deepfake-type data not evaluated in the experiment? From Figures 2 and 19, Deepfake data has masks that mark the forged areas, but the experimental results on Deepfake (Figures 4, 14, and Table 4) are deliberately omitted.
soundness: 3
strengths: The paper generates language descriptions for some existing IFDL datasets based on GPT-4o, so as to explain the types and causes of forgeries.

The introduction of the Domain Tag Generator offers initial predictions of the domain O_det of input images, thereby avoiding conflicts in tampered data domains and precisely guiding subsequent detection/localization models towards the forgery types of interest.

The proposal of MFLM involves the alignment of textual (O_det) and image features, facilitating the joint prediction of forgery masks from a multimodal perspective.

The experiment compares the traditional forgery detection and localization with the existing IFDL methods, and also compares with the existing LLMs from the perspective of forgery interpretability.
summary: The paper employs LLM to enhance existing IFDL datasets from a forgery perspective. Based on these new data, a multimodal and explainable forgery detection method (FakeShield) is proposed. FakeShield first derives text description of the possible forgery type and reasons based on the finetuned LLM, and then uses the text description to guide the output of the forgery location mask. Experimental demonstrations in forgery detection, localization, and explanation aspects demonstrate the effectiveness of the proposed method.
weaknesses: I believe there are some critical issues in the following aspects:

Dataset:
- Using GPT to generate textual descriptions for forgery regions and treating them as ground-truth (GT) lacks comparative validation. While the generation process of these textual GTs involves multiple rounds of dialogue and expert proofreading to ensure accuracy, I believe it lacks internal validation. Specifically, the mask GTs of existing datasets are (mainly) constructed based on the residual comparison between the original (authentic) images and forged ones to prevent mislabeling authentic regions as forgery. However, in creating textual GTs, this comparative process is missing, making it challenging to ensure the credibility of the textual GTs. Therefore, I suggest that GPT should simultaneously receive "original image, forged image, and/or forgery mask" for joint assessment, potentially enhancing the precision of the generated textual GTs.
- Furthermore, Figure 2 depicts the dataset construction process involving "expert proofreading", but this procedure is not mentioned in the main text.

Methodology:
- The modules (LLM, SAM, specialized token <seg>, etc.) and loss functions (ce, bce, dice, etc.) involved in the FakeShield are largely derived from existing works. Therefore, I think its original contribution is not solid enough.
- Given that the final predicted mask M_loc relies on the guidance of O_det, a natural concern arises: if O_det produces incorrect content (for example, it generates a completely authentic description for forgery data), could M_loc be significantly misled? Along this line, incorporating a corrective mechanism in TCM might better mitigate the aforementioned situation.

Experiments:
- **Lack of cross-validation**: Although FakeShield can provide detailed explanations for forgery  reasons, it appears to forcefully interpret all forgeries from preset perspectives. For example, in the last case of Figure 16, the inside of the clock is forged, while the external background/shadow, etc. are original (real). However, FakeShield still believes that its shadows do not conform to the light source logic. Therefore, it is necessary to add some forgeries that only contain some types to cross-validate whether FakeShield has truly learned the knowledge of different types of forgeries. For example, manipulating only the shadow part of an image while keeping other aspects such as lighting, edges, resolution, perspective relationships, and physical laws unchanged, to assess whether FakeShield can identify this specific manipulation involving only shadows without affecting the rest.
- **Lack of stronger generalization evaluation**: Based on the data distribution summarized in Table 7, the evaluation data is not completely cross-domain for training data. Specifically, the sources and creation processes of Deepfake and AIGC data in both training and testing are highly similar (e.g., all the AIGCs are generated by SD-inpainting). Therefore, the claim in Line 382 that FakeShield generalizes well to Deepfake and AIGC tampering is overstated. It is recommended to add completely cross-database data for evaluation, such as adding data from FFIW, CelebA-DF, DFDC, etc. for Deepfake detection.
- **Ablation experiment is not sufficient**:
  - Line 505 only evaluates the performance of FakeShield with and without DTG. However, the more critical question is why it is decided to use three forgery domain tags instead of more detailed tags? For instance, following HiFi-Net, it is possible to subdivide Photoshop-type data into splicing, pasting, and inpainting; and subdivide AIGC data into categories like “GANs” or “Diffusion” (of course I understand that all AIGC data in MMTD-Set is produced by the SD-inpainting technique). Similarly, the issue extends to the authentic domain (as per Figure 2, defining only “Scene” and “Face” as authentic tags). Could a broader range of authentic/forgery domain tags lead to performance improvements? I think it requires more in-depth discussion.
  - The ablation design in the paragraph at Line 515 is inadequate and should further evaluate the results when using only T_tag or T_img. Additionally, the experimentation in this section solely focuses on the CASIA1+ dataset, and there may be potential data bias.

Presentation:
- While the core focus of this paper is on "explainable", the main body of the experiments is still on forgery detection and localization. It may not be appropriate to put the experimental results on explanation in the appendix.

Incorrect formulas/symbols:
- Eq. (4): \hat{\mathbf{O}}_{det} and \mathbf{O}_{txt} are never defined or explained. The same problem applies to \hat{\mathbf{T}}_{tag}.
- The description of Line 318~322 (including Eq. (5)) is inconsistent with the previous text. Please confirm whether the model's predicted output is \hat{\mathbf{M}} or \mathbf{M}.
- Does the second case in Figure 14 show an incorrect response? The response is exactly the same as the first case.

Minor Issues:
- The symbol of Domain Tag Generator in Fig. 3 is a handwritten G, which should be consistent with the bold G used in the text (line 266).
- The caption of Fig. 3 describes that I_ori will be input into the Tamper Comprehension Module, but this does not match the content of the picture.
- Line 245: change "a original" to "an original"
- Line 1292: change "the first picture has glasses …" to "the second picture has glasses …"

---

confidence: 5
contribution: 3
initial_rating: 6
presentation: 4
questions: Please refer to the weakness.
soundness: 4
strengths: This paper possesses several notable strengths: 

1.Clear motivation and remarkable innovation: This paper firstly proposes an explainable image forgery detection and localization task and innovatively designs a multi-modal large model Fakeshield, which enhances the transparency of forgery detection and effecitively pinpoints the tampered areas. 

2.Cross-domain generalization and satisfactory performance: The proposed FakeShield can effectively differentiate and handle various tampering domains such as PS-tampered, DeepFake, and AIGC-based editing. The detection, explaination, and localization performance outperforms most of the SOTA methods, as reported on Tab.1, 2, 3, 4. 

3.Dataset construction and potantial contribution: This paper uses GPT-4o to enrich existing datasets through carefully designed prompts, constructing the Multi-Modal Tamper Description dataSet (MMTD-Set). It has the potantial to serve for the IFDL community and future explorations.

4.Clear organization and good writing: The writing and organization of this paper is generally good, easily comprehensible, and effectively presents its methods in Figures 1-3.
summary: The paper presents FakeShield, a multi-modal framework for explainable image forgery detection and localization. It uses multi-modal large language model to detect manipulations, generate tampered region masks, and provide detailed explanations based on visual artifacts and semantic inconsistencies. Utilizing carefully designed prompts, GPT-4o constructs the MMTD-Set to enhance model training. Incorporating modules like DTE-FDM and MFLM, FakeShield achieves superior performance in detection accuracy and localization across various forgery techniques compared to existing IFDL methods.
weaknesses: 1.Unclear statement about domain tag generator: The paper does not clearly explain how the domain-tag generator works to handle different types of image tampering. It is suggested to explain the network structure, working principle and training method of domain-tag generator more clearly.

2.Insufficient comparison with DeepFake detection methods: In Tab.2, the paper only compares FakeShield with two other DeepFake detection methods. This limited number of comparison models may not provide a comprehensive evaluation of FakeShield’s performance against a wider range of existing state-of-the-art methods. Please add more deepfake detection method for comparison.

3.Incomplete ablation studies: In Tab.6, the authors only conducted experiments on CASIA1+ dataset for PS tampering, which may have some bias. It is suggested to verify the role of domain-tag generator on more datasets.

Meta-review: 1x accept, 2x borderline accept. This paper introduces a multimodal large-language-model-based approach to detect, localize, and explain image forgeries by constructing and leveraging a new multimodal dataset enriched with GPT-generated textual descriptions. The reviewers agree on the (1) effective combination of visual and textual cues for detection and explanation, (2) strong cross-domain performance against various tampering types, and (3) clear potential for practical applications in forgery analysis. However, they note (1) potentially high computational overhead, (2) the need for stronger evidence of generalization to unseen tampering domains, and (3) the importance of thoroughly quantifying the explanation quality. The authors’ follow-up responses address these concerns through detailed clarifications on resource requirements, extensive additional experiments on new data, and user/GPT-based evaluations of the explanations, so the AC leans to accept this submission.

Decision: Accept (Poster)