FakeShield: Explainable Image Forgery Detection and Localization via Multi-modal Large Language Models
Authors: Zhipei Xu
Xuanyu Zhang
Runyi Li
Zecheng Tang
Qing Huang
Jian Zhang
Venue: ICLR 2025 Poster (2025)
Keywords: Image Forgery Detection and Localization
Multi-modal Large Language Model
Tamper Detection
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: The rapid development of generative AI is a double-edged sword, which not only facilitates content creation but also makes image manipulation easier and more difficult to detect. Although current image forgery detection and localization (IFDL) methods are generally effective, they tend to face two challenges: \textbf{1)} black-box nature with unknown detection principle, \textbf{2)} limited generalization across diverse tampering methods (e.g., Photoshop, DeepFake, AIGC-Editing). To address these issues, we propose the explainable IFDL task and design FakeShield, a multi-modal framework capable of evaluating image authenticity, generating tampered region masks, and providing a judgment basis based on pixel-level and image-level tampering clues. Additionally, we leverage GPT-4o to enhance existing IFDL datasets, creating the Multi-Modal Tamper Description dataSet (MMTD-Set) for training FakeShield's tampering analysis capabilities. Meanwhile, we incorporate a Domain Tag-guided Explainable Forgery Detection Module (DTE-FDM) and a Multi-modal Forgery Localization Module (MFLM) to address various types of tamper detection interpretation and achieve forgery localization guided by detailed textual descriptions. Extensive experiments demonstrate that FakeShield effectively detects and localizes various tampering techniques, offering an explainable and superior solution compared to previous IFDL methods. The code is available at https://github.com/zhipeixu/FakeShield.

Published as a conference paper at ICLR 2025
FAKESHIELD: EXPLAINABLE IMAGE FORGERY DE- TECTION AND LOCALIZATION VIA MULTI-MODAL LARGE LANGUAGE MODELS
Zhipei Xu Xuanyu Zhang', Runyi Li', Zecheng Qing Huang', Jian Zhang-22.31
1 Schooo of Electronic and Computer Engineering, Peking University
Peking University Shenzhen Graduate School School-Rabbippre AIGC Joint Research Laboratory
'Guangdong Provincial Key Laboratory of Ultra High Definition Immersive Media Technology,
Shenzhen Graduate School, Peking University
"School of Future Technology, South China University of Technology
ABSTRACT
The rapid development of generative Al is a double-edged sword, which not only facilitates content creation but also makes image manipulation easier and more dif- ficult to detect. Although current image forgery detection and localization (IFDL) methods are generally effective, they tend to face two challenges: 1) black-box nature with unknown detection principle, 2) limited generalization across diverse tampering methods (e.g.. Photoshop. DeepFake, AIGC-Fditing). To address these issues, we propose the explainable IFDL task and design FakeShield, a multi- modal framework capable of evaluating image authenticity, generating tampered region masks, and providing judgment basis based on pixel-level and image- level tampering clues. Additionally, we leverage GPT-4o to enhance existing IFDL datasets, creating the Multi-Modal Tamper Description dataSet (MMTD- Set) for training FakeShield's tampering analysis capabilities. Meanwhile, we incorporate a Domain Tag-guided Explainable Forgery Detection Module (DTE- FDM) and Multi-modal Forgery Localization Module (MFLM) to address ious types of tamper detection interpretation and achieve forgery localization guided by detailed textual descriptions. Extensive experiments demonstrate that FakeShield effectively detects and localizes various tampering techniques, offer- ing an explainable and superior solution compared to previous IFDL methods. The code is available at at/ttps: /ttp:://gtttbtb/t// https//////eeeee////eee.....
INTRODUCTION
With the rapid development of AIGC, powerful image editing models have provided a breeding ground for convenient image tampering, blurring the boundaries between true and forgery. People can use AIGC image editing methods (Rombach et al.) 2022] Zhang et al. 2023) Suvorov et al., 2022 Mou et al. 2023) to edit images without leaving a trace. Although has facilitated the work of photographers and illustrators, AIGC editing methods have also led to an increase in malicious tampering and illegal theft. The authenticity of images social media is difficult to guarantee, which will lead to problems such rumor storms, economic losses, and legal concerns. Therefore, is important and urgent to identify the authenticity of images. In this context, the image forgery detection and localization (IFDL) task aims to identify whether an image has been tampered with and locate the specific manipulation areas. It can be widely applied in the real world, such as filtering false content social media, preventing the spread of fake news, and court evidence collection.
State-of-tth-aar IFDL methods have utilized well-designed network structures, elaborate network constraints, and efficient pre-training strategies to achieve remarkable performance (Yu al. 2024b Ma et al. 2023 Dong et al. 2022). However, previous IFDL methods face two key problems, lim-
Corresponding author: Jian Zhang. This work was supported in part by Guangdong Provincial Key Laboratory of Ultra High Definition Immersive Media Technology (No. 0024B12120100 and Shenzhen General Research Project (No. JCYJ20241202125500

---

Published as a conference paper at ICLR 2025
True/folse detectice
Detector Confidence
Gan you identify moripuleted arezol the photogroph?
Princppe explosation Multmodzi inhoraction
Tarpered anea loeation
Tamperdd 2713
Imputirage
Instructin
Lecator
The perspective and soale relafienshpp setwoonn the roam appears pergar with
Iepul inage
The picture has been tempened with, the
Tangard ana rask
FakeShield
cotter of the image. there 4 pergain stonding Bogr
+
being frast- -it while the room &s fllrmeened by diffuce light. discrepcnctes sugest tomporing
Towr Mer
True foiie detectice
Princ ple explinentoo
Tompared location
Mult roddal internction
inege.
Detect reall:
Pricciple explanation
(a) Com convestional IFDL Framework
(b) Our Explainable IFDL Frameworkc: FakeShield
Figure 1:
Illustration of the conventional IFDL and explainable IFDL framework. Conventional methods offer only detection results and tampered masks. We extend this into multi-modal frame- work, enabling detailed explanations and conversational interactions for deeper analysis.
iting their practicality and generalizability. First, as shown in Figure Ta), most existing IFDI. methods are black-hox models, only providing the authenticity probability of the image, while the principle of detection is unknown to users. Since the existing IFDL methods cannot guarantee satisfactory accuracy, manual subsequent judgment still required. Given that the information provided by the IFDL methods is insufficient, it is difficult to support the human assessment and users still need re-analyze the suspect image by themselves. Second, in real- real-world scenarios, tampering types are highly diverse, including Photoshop (copy-and copy-and-move, move, splicing, and removal), AIGC-Editing, DeepFake, and so on. Existing IFDL methods Yuu et al.] 2024b) Ma al., (023) are typically limited to handling only one of these techniques, lacking the ability to achieve compre- hensive generalization. This forces users to identify different tampering types in advance and apply specific detection methods accordingly, significantly reducing these models' practical utility.
Benefiting from the rapid advancements in Transformer architectures, Large Language Models (LLMs) have attracted significant attention. Furthermore, (Liu et al. 2024) introduced Multi- modal Large Language Model (M-LLM) that aligns visual and textual features, thereby endowing LLMs with enhanced visual comprehension abilities. Given that LLMS are pre-trained tensive and diverse corpus of world knowledge, they hold significant potential for a wide range of applications, such as machine translation (Devlin) 2018). code completion, and visual under- standing (Liu et al. 2024). Consequently, we explored the feasibility of employing M-LLMs for explainable Image Forgery Detection and Localization (e-IFDL). This approach allows for a more comprehensive explanation of the rationale behind tampering detection and provides more precise identification of both the authenticity of images and the suspected manipulation regions.
To address the two issues of the existing IFDL methods, we propose the explainable-IFDL (c-IFDL) task and a multi-modal explainable tamper detection framework called FakeShield. As illustrated in [i) the e-IFDL task requires the model to evaluate the authenticity of any given image, generate a mask for the suspected tampered regions, and provide a rationale based on some pixel- level artifact details (e.g.. object edges, resolution consistency) and image-level semantic-related errors (e.g., physical laws, perspective relationships). Leveraging the capabilities of GPT-4o (Ope- nAI 2023), we can generate a comprehensive triplet consisting of tampered image. modified area mask and a detailed description of the edited region through a meticulously crafted prompt. Then, we develop the Multi-Modal Tamper Description dataSet (MMTD-Set) by building upon isting IFDL datasets. Utilizing the MMTD--et, we fine-tune M-LIM (Liu et al.) (2024) and visual segmentation models (Kirillov et al., 2023, Lai et al., (024). equipping them with the capability to provide complete analysis for judgment, detecting tampering, and generate accurate tamper area masks. This process ultimately forms a comprehensive forensic pipeline for analysis, detection, and localization. Our contributions are summarized as follows:
D (1) We present the first attempt to propose a multi-modal large image forgery detection and local- ization model, dubbed FakeShield. It can not only decouple the detection and localization process but also provide reasonable judgment basis, which alleviates the black-box property and unex- plainable issue of existing IFDL methods.
D (2) We GPT-4o enrich the existing IFDL dataset with textual information, constructing the MMTD-Set. By guiding it to focus on distinct features for various types of tampered data, GPT-4o analyze the characteristics of tampered images and construct "image-mask-dee desssiaiiideeeiionn triplets.
2

---

Published as a conference paper at ICLR 2025
O (3) We develop Domain Tag-guided Explainable Forgery Detection Module (DTE-FDM) to spot different types of fake images in a united model and effectively alleviate the data domain con- flict. Meanwhile, an Multi-modal Forgery Localization Module (MFLM) is adopted to align visual- language features, thus pinpointing tampered areas.
(4) Extensive experiments demonstrate that our method can accurately analyze tampering clues, and surpass most previous IFDL methods in the detection and localization of many tampering types like copy-move, splicing, removal, DeepFake, and AIGC-based editing.
2 RELATED WORKS
2.1 IMAGE FORGERY DETECTION AND LOCALIZATION
Prevailing IFDL methods mainly target at the localization of specific manipulation types (Salloum
jt al., 2018: Islam et al.
2020: Li & Zhou 2018 Zhu et al.
2018 Li & Huang 2019).
con-
trast, universal tamper localization methods (Li et al. 2018
K Lwon et al. [021] Chen et al. 2021
Ying et al. 2023 2021 Hu al. [023] Ying et al. 2022; Li al. 2024 Yu al. 2024a
Zhang
ct al. 2024b) aim to detect artifacts and irregularities across a broader spectrum of tampered images.
For instance, MeSS-Net (Dong et al. 2022) utilized multi-scale supervision and multi-view feature
learning simultancously capture image noise and boundary artifacts. OSN (Wu et al.) 2022)
employed a robust training strategy to overcome the difficulties associated with lossy image pro- cessing. HiFi-Net (Guo al. 2023) adopted combination of multi-branch feature extraction and localization modules to effectively address alterations in images synthesized and edited by CNNs. IML-ViT (Ma al. 2023) integrated Swin-Vit ViT into the IFDL task, employing an FPN architecture and edge loss constraints to enhance its performance. DiffForensies (Yu et al., 2024b) adopted a training approach akin to diffusion models, strengthening the model's capacity to capture fine image details. Additionally, some researchers (Zhang et al. 2024a c proactive tamper detection and localization by embedding copyright and location watermarks into images/audio/viden preemptively. However, despite their acceptable performances, these IFDL methods cannot explain the underlying principles and rationale behind their detection and local- ization judgments, offering interaction. Moreover, they suffer from limited generalization and accuracy, exhibiting sigmificant performance disparities across different testing data domains.
Asmani et al. 2023) have pursued
2.2 LARGE LANGUAGE MODEL.
Large language models (Dubey et al., 2024; OpenAl 2023) have garnered global attention in re- and text-generation abilities. Based on the
cent years for their exceptional instruction-followe Transformer architecture, LLMS are pre-trained on massive datasets, allowing them to accumulate broad world knowledge that enhances their ability to generalize across wide range of downstream tasks. Subsequently, some researchers (Li et al. 2022) expanded LLMs' powerful understanding and world knowledge to the visual domain by incorporating image encoders and projection layers, which enable images encoded into tokens that align with the text. Some recent works (Chen et al., 2023a Wang al., [023] Chen et al. 2023b) equipped M-LLMs with enhanced visual understand- ing capabilities by expanding the visual instruction datasets and increasing the model size during fine-tuning. Currently, M-LLMs demonstrate impressive performance across various downstream tasks. LISA (Lai et al. 2024) integrated SAM (Kirillov et al. (023) with M-LLM to implement rea- soning segmentation, enabling the generation of masks from text descriptions. GLaMM (Rasheed) et al. 2024) further enhanced this by using more advanced region image encoder to improve text- to-mask grounding. Additionally, some studies (Yang Zhou 2024 Zhhng et al., 2024d) have explored the application of M-LLMs in DeepFake detection. For instance, (Zhang et al.) 2024d) introduced the DD-VQA dataset, combining a manual inference process for rating real and fake faces that can be distinguished using common sense. Targeted at Deepfake detection, (Huang al.) 2024) used GPT-4o to create image-analyen pairs, and introduced a multi-answer intelligent deci- sion system into MLLM, achieving good effect. However, it cannot be generalized to other types of tampering such as Photoshop and AIGC- Edditin, and cannot accurately locate the tampered areas. Besides, using M-LLMs to realize universal tamper localization and detection remains unexplored.
3

---

Published as a conference paper at ICLR 2025
Source Datasets
Quary
Targer Freegrn
Pantasitic Realiyy (PR)
TacoAPP
ATOC-Edling
Nay
When duy (iing the image hore one aond and reed poy special citemn on to...
and mock forpaned
CAS
Phsticiia Targers
Tamper
Loucle ceppire lnnee leakedd
O Q
Lightig
Commice
Serue
Basckution
Edge
Aur Face
Crryy Puri
Plycical Lowss
Text
Expert Proofreading
ASSC Editing Tamger
GPT-4b
Loadne The hanparad unea licated.
Trature
Common Serrie
No rol
Nof
1
Dotai Anatorty
Docpf sie Teapen
partare tomgored
Kowen
Symmettiy
Expressions
Htarstyle
Text
Aufare Teshhoorrag
Decalidk Ty- Tecsora
Accossories
Figure 2: Illustration of the construction process of our MMTD-Set. Set. We sample the tampered image- mask pairs from PS, DeepFake, and AIGC benchmarks, and then use domain tags to guide GPT-44o in constructing the judgment basis and focusing on both pixel-level details and image-level content.
3 METHODOLOGY
3.1 CONSTRUCTION OF THE PROPOSED MMTD-SET
Most existing IFDL datasets consist of a single visual modality, lacking training visual- language samples adapted to M-LLMs. The challenge of constructing our MMTD-Set lies in ac- curately translating the visual tampering information from the existing IFDL image datasets into precise textual descriptions. To address this challenge, our contributions focus on two aspects: (1) We leverage GPT-4o to generate text description and provide both the tampered image and its corresponding mask to GPT-4o, enabling to accurately identify the tampered location. (2) For each lamper type, we design specific prompts to their unique characteristics, guiding GPT-4o to focus on different tampering artifacts and providing more detailed visual cues.
Motivation:
Data collection:
Based on (Ma et al. 2023 Nirkin et al. (021). we categorize common tamper-
ing into three types: PhotoShop soopy-moe, splicing, removal), DeepFake (FaceAPP (FaceApp Limited 2017)), and AIGC- (SD-inpainntin (Lugmayr et al,, (022)). As shown in Figure we gathered three types of tampered images along with their corresponding authentic images from public datasets (Dong et al., 2013: Dang et al. 2020) and self-constructed data.
GPT assisted description generation: Given that manual analysis of tampered images is time- consuming, inspired by (Liu et al., 2024 Chen et al. 2202aa Huang et al., 2024), we used GPT-4o to automate the analysis of tampered images. As depicted Figure 2 the output analysis is required to follow the format of detected results, localization descriptions, and judgment basis.
For tampered images, we input the edited image, its corresponding forgery mask, and our carefully constructed tamper type specific prompts into the powerful GPT-4o more accurately describe the tampered regions. For authentic images, GPT-40 is provided with only the real image and a set of prompts, guiding it to confirm its authenticity. The full-text prompts are detailed in the Appendix[A.6 To more clearly and specifically describe and analyze the tampering of images, GPT-4o describes the image from two key aspects: the location and content of the tampered areas, and any visible artifacts or semantic errors caused by the tampering: (1) For the tampering location, GPT-4o is required to describe it in both absolute positions (c.g.. top, bottom, upper left corner, lower right corner) and relative positions (c.g., above the crowd, on the table, under the tree). When analyzing the tampered content, it is tasked with providing detailed information about the types, quantities, actions, and attributes of the objects within the tampered region. (2) For the visible artifacts and semantic errors, since different tampering methods produce distinct types of artifacts, we craft specific prompts to guide the analysis. It can broadly be categorized into pixel-level artifact details and image-level semantic-related errors. For PhotoShop (PS) tampering, operations like copy-move and splicing often introduce pixel-level issues such as edge artifacts, abnormal resolution, and inconsistencies in lighting. Additionally, semantic-level errors, including violations of physical laws or common sense, are frequently observed. In AIGC-Editing (AIGC), for instance, it often fails to generate text
4

---

Published as a conference paper at ICLR 2025
"The picture tampered of the image...
Full Parameter Training
LoRA Finetune
Frozen
Large Language Model
Con you identify maripulsted crens the photogroph?
suspected
[MG.]. (1M6)) [IMG.)
T
Tay tempered picture.
PRS/DexpFoka/// AIGC)
C
Tamper
Comprehension Module
Layer
Domain Tag Generator
heeg
Image Encoder
M
y
S
Sec
esc
Segment Anything
Figure 3: The pipeline of FakeShield. Given an image Lors for detection, it is first processed by the Domain Tag Generator Gat to obtain a data domain tag Trog. The tag Trag. along with the text instruction Tims and image tokens Ting are simultaneously input into the fine-tuned LLM, generating tamper detection result and explanation Odet- Subsequently, Odet and T Timg input into the Tamper Comprehension Module C₁, and the last-layer embedding for the <SEC> token hesrg> serves prompt for SAM, guiding generate the tamper area mask Mioc-
accurately, resulting in disordered symbols or characters appearing in the tampered area. For the DeepFake (DF), tampering with facial features frequently results in localized blurring.
3.2 OVERALL FRAMEWORK OF FAKESHIELD
Utilizing the textual understanding ability and world knowledge of the M-LLM to analyze and judge the authenticity of images; 2): Adopting the analysis and in- terpretation tampered images to assist the segmentation model in pinpointing the tampered areas. To solve these two tasks, intuitive approach is to fine-tune a large multimodal model to simulta- neously output analysis and tampered masks. However, we find that joint training of multiple tasks will increase the difficulty of network optimization and interfere with each other. Considering that detection and interpretation focus more on language understanding and organization, while localiza- tion requires more accumulation of visual prior information, the proposed Fakelhield contains two key decoupled parts, namely DTE-FDM and MFLM, as illustrated in Fig. Specifically, an original suspected image Tori and instruction text ins (e.g- "Can you identify manipulated areas the photograph?") are fed to the proposed DTE- O In this process, we use a Iearnable generator to produce domain tag Tregs thus avoiding the tampered data domain conflict. Furthermore, we input the interpretation Odet and the image Lore to the MFLM to accurately extract the tampered mask M To promote cross-modes interaction for tamper localization, introduce tamper comprehension module align the visual and textual features and enhance the ability of the vision foundation model to understand long descriptions.
Our goals involve two issues: 1):
predict the detection result and judgment basis
3.3 DOMATN TAG-GUIDED EXPLAINABLE FORGERY DETECTION MODULE
In real-life scenarios, images can be tampered with and attacked through various meth- ods, including copy-move, splicing, removal, DeepFake, and JGCC-based methods. However, these tampered images have different distribution characteristics, and domain differences, making it dif- ficult to apply single IFDL method to all forgery data. For example, DeepFake focuses face modification, often causing partial blurring and unnatural features the lips, teeth, and eyes. In contrast, tools like PhotoShop (splicing, copy-move, removal) tend leave noticeable artifacts the edges of the tampered areas. In the case of AIGC-Editing, blurring within the tampered region often alters or obscures texture details. To mitigate these significant domain discrepancies, inspired
Motivation:

---

Published as a conference paper at ICLR 2025
by (Sanh et al. 2022). we introduce the Domain Tag Generator(DTG), which utilizes specialized domain tag to prompt the model to distinguish between various data domains.
First, the original image Lori is input into classifier Gar to obtain the domain tag Ttag. Specifically, we classify all common tampering types into three categories: Photoshop-bet and AIGC-based tampering. and use the template "This is a suspected {data domain) -tampered picture." as the identifier. Simultaneously, consistent with (Liu et al., 2024). Lovs is passed through the image encoder Fene and linear projection layer Foroj generate the image tokens [IMG] T img-- Next, Taag and T Timg are concatenated with the instruction Tims and then fed into the LLM. To be noted, ins a prompt that instructs the model to detect tampering and describe the location of the manipulation, for example: "Can you identify manipulated areas in the photograph?" After several autoregressive predictions, the output Odet comprises three components: detection results, a description of the location of tampered area, and the interpretive basis for the detection.
editing. DeepFake,
tag = Gat (Tori): Timg = Fyros (Fene(Iort)
(1)
Odet LLM(TTis: ins: Tzag Ting).
(2)
Given the large size of LLMS and limited computational resources, full parameter training is im- practical. Thus, we freeze the LLM and leverage LoRA fine-tuning technology (Hu et al. 2022 to preserve semantic integrity while enabling efficient image forgery detection.
3.4 MULTI-MODAL FORGERY LOCALIZATION MODULE
Motivation: Although Oaet provides a textual description of the tampered area, it lacks preci- sion and intuitive clarity. To address this issue, we aim to transform Odet into an accurate binary mask, providing a clearer and more accurate representation of the tampered region. Existing prompt- guided segmentation algorithms (Kirillov et al. 2023 Lai et al., 2024) struggle capture the seman- ties of long texts and hard to accurately delineate modified regions based on detailed descriptions. Inspired by (Lai et al. 2024). we propose Tamper Comprehension Module (TCM), which is an LLM serving as an encoder aligns long-text features with visual modalities, enhancing SAM's precision in locating the forgery areas. To generate the prompt fed into SAM, following (Lai et al, 2024), we introduce specialized token <SEG>.
As shown in Fig 3 the tokenized image Timg and the tampered description O are fed into the TCM C. Then, we extract the last-layer embedding of TCM and transform it into heszs> via MLP projection layer. Simultaneously, the original image Iori is processed through the SAM encoder Senc and decoder Sancs where h.sEas serve prompt for Sãce guiding the mask generation M
Emid = Senc (oor)) hesne = Extract (Timg Oder))
M Sdee (Emaid hesEc>),
where Emiid represents the intermediate features of SAM, and Extract(-) denotes the operation of extracting the last-layer embedding corresponding to the <SEG> token. Similar to DTE-FDM, we also apply LoRA fine-tuning to MFLM for greater efficiency. With the integration of TCM, SAM will achieve more precise localization of the forgery areas.
3.5 TRAINING OBJECTIVES
The two submodules of our FakeShield trained end-to-end separately. For DTE-FDM, the domain tag generator utilizes cross-entropy loss foe as its training objective, enabling it to distinguish between different data domains. Following the approach of LLaVA, our LLM's training objective is the cross-entropy loss loe. The training target of DTE-FDM Edet can be formulated as:
(4) where À denotes the weight balancing different loss components, Odet and Trog represent the pre- dictions of LLM and DTG, while Ódet and Trag represent their corresponding ground truth. For MFLM, we apply fee constrain TCM to produce high-quality prompt Ytat with <SEG> token. Meanwhile, we use a linear combination of binary cross-entropy loss lace and dice loss Edice to en- courage the output of MFLM Mise to be close to the GT mask M Given the ground-truth prompt Yent (e.g., "It is <SEG>") and mask Mioc. our training losses for MFLM Éle can be formulated as:
Edet = ( O + A Lee (Trag: Tiag):
lioc lea (Sezt, Ytas) + Lbce (Moc, Mioc) B . Edice E Mtoe);
(5)

---

Published as a conference paper at ICLR 2025
Table Detection performance comparison between our FakeShield and other competitive methods. Our method can achieve the best detection accuracy in PhotoShop, DeepFake, and AIGC-Editing tampered datasets. The best score highlighted in bold and the second-bes score is underlined.
PhotoShop
DeepFake
AIGC-Editing
Method
CASIAI+
IMD2020
Columbia
Coverage
DSO
ACC
F1
ACC
FI
ACC
Fi
ACC
F1
ACC
F1
ACC
F1
ACC
F1
SPAN
0.60
0.44
0.70
0.81
0.87
0.93
0.24
0.39
0.35
0.52
0.78
0.78
0.47
0.05
ManTraNet
0.52
0.68
0.75
0.85
0.95
0.97
0.95
0.97
0.90
0.95
0.50
0.67
0.50
0.67
HiFi-Net
0.46
0.44
0.62
0.75
0.68
0.81
0.34
0.51
0.96
0.98
0.56
0.61
0.49
0.42
PSCC-Net
0.90
0.89
0.67
0.78
0.78
0.87
0.84
0.91
0.66
0.80
0.48
0.58
0.49
0.65
CAT-Net
0.88
0.87
0.68
0.79
0.89
0.94
0.23
0.37
0.86
0.92
0.85
0.84
0.82
0.81
MVSS-Net 0.62
0.76
0.75
0.85
0.94
0.97
0.65
0.79
0.96
0.98
0.84
0.91
0.44
0.24
FakeShield
0.95
0.95
0.83
0.90
0.98
0.99
0.97
0.98
0.97
0.98
0.93
0.93
0.98
0.99
where a and / are weighting factors used to balance the respective losses. lee. foce, and Edice refer to cross-entropy loss, binary cross-entropy loss, and dice loss (Sudre et al. (017) respectively.
4 EXPERIMENT
4.1 EXPERIMENTAL SETUP
Dataset: We employ the dataset construction method outlined in Section 3.1 to build the train- ing and test sets of the MMTD-Set. For the training set, we utilize PhotoShop tampering (e.g.,
CASIAv2 (Dong et al., 2013), Fantastic Reality (Kniaz et al.] 2019)). DeepFake tampering (e.g..
FFHQ FaceApp (Dang al. 20200), and some self-constructed AlGC-Editing tampered data as the source dataset. For the testing set, we select several challenging public benchmark datasets
including PhotoShop tampering (CASIA1+ (Dong al. 2013). Columbia (Ng et al.
2009).
IMD2020 (Noozzassky et al. 2020), Coverage (Wen et al. 2016). DSO (De Carvalho et al.
2013
Korus (Korus Huang 2016 ), DeepFake tampering (e.g., FFHQ FaceApp (Dang et al.
2020
Seq-DeepPaake (Shao et al. 2022)) ) and some self-generater AIGC-Editing data.
State-of-the-Art Methods: To ensure a fair comparison, we select competitive methods that provide either open-source code or pre-trained models. To evaluate the IFDL performance of FakeShield,
we compare against SPAN (Hu et al.. 2020), MantraNet (Wu et al. 2019), OSN (Wu et al.) 2022).
HiFi-Net (Guo et al.] 2023). PSCC-Net (Liu et al. 2022). CAT-Net K won al.) 2021), and MVSS-
Net (Dong et al. 2022). all of which are retrained on the MMTD-Set for consistency with the same training setup. For DeepFake detection, CADDM (Dong et al., 2023). HiFi-DeepFake (Guo)
ct al. 2023). RECCE (Cao et al. 2022) and Exposing (Ba et al. 2024) are chosen as comparison methods. Additionally, assess the explanation ability of FakeShield, we compare it with open-
source M-LLMs such as
(Liu et al.) 2024), Intern VL2-26B (Chen et al.) 2024). and
Qwen2-VL-7B (Wang et al. 2024), as well as the closed-source model GPT-4o (OpenAl 2023).
For detection, we report image-level accuracy (ACC) and F1 scores. For lo- calization, provide Intersection over Union (IoU) and F1 scores. To evaluate interpretability. we use Cosine Semantic Similarity (CSS) to assess the similarity between the predicted text and ground truth text by calculating the cosine similarity between their sige-dimensional semantic vectors. For both detection and localization, default threshold of 0.5 is applied unless otherwise specified.
Evaluation Metrics:
Implementation Details: On the MMTD-Sed we initially fine-tune the M-LLM using LoRA (rank=128, alpha=256), such as LLaVA-v1.5-115 13B (Liu et al. (024)), while simultaneously training the Domain Tag Generator with full parameters. The model is trained for 10 epochs on 4 NVIDIA A100 40G GPUs, with a learning rate of 2x 10-1, Afterward, we fine-tune the Tamper Comprehen- sion Module and Segment Anything Model (Kirillov et al.) (203) with LoRA (rank=8, alpha=16), training for 24 epochs on the same hardware configuration, with learning rate of 3x100~
4.2 COMPARISON WITH IMAGE FORGERY DETECTION METHOD
To verify the superiority and generalization of our method on the image forgery detection task, we test the detection accuracy MMTD-Set (Photoshop, DeepFake, AlGC-Editing) As shown in
7

---

Published as a conference paper at ICLR 2025
Mindeer the peture hew sepernt with Geoogpion the Ietorred one
bected
topp
ligttr
Ugriig The citttige the figine jert cod nork
poee oved lece them fromt
Cdat clje are fighte you
wich dejasting ty
18946 care joolured with conmen arter iecr
Hes this iage been forged whth? Why? Gine the tompured oren
can uncred jett cover dioquutnnct arg peopl demo derute
Fake, O
we prosud the guee tee drren
reeet the wand superts the par any wiy purt
Figure 4: Detection, localization and explanation results of our FakeShield.
Table 1 our FakeShield almost achieves optimal performance across various tampering and testing data domains. For example, our method outperforms the second-best method, MVSS-Net, with an ACC of 0.08 and an Fl of 0.05 the IMD2020 dataset. Notably, since we introduce the domain- tag guidance strategy, our method not only achieves excellent performance on the traditional IFDL benchmark but also generalizes DeepFake and AIGC tampering, achieving 0.93 and 0.98 de- tection accuracy, respectively. However, other works lack an effective mechanism to handle data domain confticts. Even when trained using the same multi-data domain training detection accuracy remains insufficient.
ours, their
Furthermore, compare method with some cent DeepFake detection approaches on the DFFD (FaceApp. FFHQ) and Seq-DeepFake, where Expos- ing and RECCE were retrained on our datasets. As reported in Table 2 our approach significantly out- performs all other methods. Notably, the domain tag mechanism not only alleviates conflicts across diverse data domains but also promotes complementarity and mutual enhancement between them. Although specifi- cally designed for DeepFake detection, these methods still underperform compared to our FakeShield.
Table 2:
Performance comparison on DFFD and Seq- Deeppeaeaak datasets.
DFFD
Seq Beq-DeepFake
Method
ACC
F1
ACC
Fl
CADDM
0.52
0.60
0.53
0.59
HiFi-DeepFake
0.52
0.64
0.52
0.57
Exposing RECCE
0.82
0.84
0.71
0.78
0.92
0.92
0.75
0.79
FakeShiekd
0.98
0.99
0.84
0.91
4.3 COMPARISON WITH M-LLMS
To assess the quality of explanation text generation, we employ the tampered descriptions generated by GPT-4o ground truth the semantic similarity (CSS) to compare the performance of pre-trained M-LLMs against FakeShield. The results in Table 3 show that our approach consistently achieves the best performance across nearly all test sets. For instance, on the DSO, our method attains CSS score of 0.8873, signifi- cantly surpassing the second-best result from VL2-26B 4 presents an example of our explanation. The model identifies the three airplanes in the sky as fake and explains its judgment based on lighting and edges, providing an accurate manipulation region mask.
Set(Photoshop, DeepFake, AIGC-Editing), using cosine
Notably, some pre-trained M-LLMs exhibit limited proficiency in detecting tampered content. For instance, when tampering causes clear physical law violations, these M-LLMs leverage their pre- training knowledge make reasonably correct judgments. However, they struggle perform more precise analyses, like detecting lighting or perspective inconsistencies, reducing overall accuracy.
Table 3: Comparative results(CSST) of the pre-trained M-LLMs and FakeShield in tampering ex- planation capabilities on the MMTD-Set.
PhotoShop
Method
DeepPake
AIGC--Fditin
CASIA1+
IMD2020
Columbia
Coverage
NIST
DSO
Korus
GPTT4o
0.5183
0.5326
0.5623
0.5518
U.5732
0.5814
0.5549
0.5643
0.6289
LLaVA-v1.6-44B
0.6457
0.5193
0,5578
0.5655
0,5757
0.5034
0,5387
0.6273
0.6352
IntemVL2-226
0.6760
0,5750
0.6155
0.6193
0.6458
0.6484
0.6297
0.6570
0.6751
Qwen2-Vi VL-7B
0.6133
0.5351
0,5603
0,5702
0,5559
0.4887
0,5260
0.6060
0.6200
FakeShield
0.8758
0.7537
0.8791
0.8684
0.8087
0.8873
0.7941
0.8446
0.8860
4.4
COMPARISON WITH IMAGE FORGERY LOCATION METHOD
To assess the model's capability to locate tampered regions, we conduct comparisons with some competitive IFDI methods on the MMTD-Set. As present in Table method consistently
8

---

Published as a conference paper at ICLR 2025
Table Comparative results of lamper localization capabilities between competing IFDL methods and FakeShield, tested on MMTD- SMTTD-SSt(Photoshoop DeepFake, AIGC-Editing)
CASIAL+
IMD2020
Columbia
NIST
DSO
Korus
DeepFake
AIGC-Edittng
Method
IoU
F1
IoU
F1
IoU
F1
IoU
F1
IoU
F1
IoU
F1
IoU
F1
IoU
FI
SPAN
0.11
0.14
0.09
0.14
0.14
0.20
0.16
0.21
0.14
0.24
0.06
0.10
0.04
0.06
0.09
0.12
ManTraNet
0.16
0.04
0.07
0.14
0.20
0.08
0.13
OSN
0.51
0.38
0.47
0.58
0.69
0.25
0.33
0.32
0.45
0.14
0.19
HiFi-No
0.13
0.18
0.09
0.14
0.06
0.11
0.09
0.13
0.18
0.29
0.01
0.02
0.07
0.13
0.22
PSCC-Net
0.36
0.46
0.22
0.32
0.64
0.74
0,18
0.26
0.22
0.33
0.15
0.22
0.12
0.18
0.10
0.15
Net
0.44
0.51
0.14
0.19
0.08
0.13
0.14
0.19
0.06
0.10
0.04
0.06
0.10
0.15
0.03
0.05
MVSS- Net
0.40
0.48
0.23
0.31
0.48
0.61
0.24
0.29
0.23
0.34
0.12
0.17
0.10
0.09
0.18
0.24
FakeShield
0.54
0.60
0.50
0.57
0.67
0.75
0.32
0.37
0.48
0.52
0.17
0.20
0.14
0.22
0.18
0.24
POLC-MM
CATAA
FuleCtaal
Figure 5: Comparisons between our FakeShield and other competitive methods. The samples, from left to right, are drawn from IMD2020, CASIA1+, Columbia, NIST16, Korus, DSO, and DeepFake.
surpasses other methods across almost all test datasets. For instance, on the IMD2020, our method outperforms the suboptimal method OSN with notable advantages of 0.12 in IoU and 0.1 in F1 score. On the CASIAI+, we also lead OSN with an IoU of 0.07 and an 0.09.
Additionally, subjective comparisons of several methods shown in Figure where approach precisely captures the tampered areas, producing clean and complete masks. In contrast, methods like PSCC-Net exhibit dispersed attention over the image, resulting in blurred segmentations and an overly broad predicted tampering area. Notably, as our segmentation module MFLM is based on the pre-trained visual model SAM, it inherits SAM's powerful semantic segmentation capabilities and can accurately segment targets with clear semantic information (Columns and of Figure 5). Additionally, due the diverse tampering types in MMTD-Set, our method can also accurately segmenting tampered areas that lack distinct semantic information (Columms 3 of Figure 5).
4.5 ROBUSTNESS STUDY
With the widespread use of the Internet and social media, individuals are increasingly receiving im- ages degraded by transmission artifacts such as JPEG compression and Gaussian noise. Our model's performance on LMMTD-Se(CAAT) cludes four common degradation types: JPEG compression qualities of 70 and 80, and Gaussian
under these degradations is reported in Table [] which in-

---

Published as a conference paper at ICLR 2025
noise variances of 5 and 10. As M-LLMM primarily emphasize high-level semantic information, although we do not specifically add degraded data during training, FakeShield demonstrates robust- ness to low-level visual distortions and noise. JPEG compression and Gaussian noise, commonly associated with social media, have minimal effect on its performance, highlighting the stability, robustness, and practical advantages of our approach.
Table 5:
Explanation and location perfor-
mance under different degradations.
Explanation
Location
Method
CSS
IoU
JPEG 70
0,8355
0.5022
0.5645
JPEG 80
0,8511
0.5026
0.5647
FakeShield wio LLM
Gaussian
0,8283
0.4861
0.5494
FakuShield
Gaussian 10
0.8293
0,4693
0.5297
Original
0,8758
0.5432
0.6032
Number Training Epochs
Figure 6: Ablation study on the DTE-FDM.
4.6 ABLATION STUDY
Ablation Study on Domain Tag Generator: To validate that the proposed domain tag effectively mitigates domain discrepancies and enhances the model's generalization across diverse data do- mains, we conducted an ablation study. Specifically, we removed the domain tag generator (DTG) and trained the FakeShield with identical configurations played in Table 6 Without the DTG, the model's detection performance declined across test sets from each data domain. Notably, the detection ACC and F1 score for IMD2020 decreased by 0.12 and 0. 1. This demonstrates that without the support of the DTG module, the model struggles to effectively differentiate between various data domains, leading to more pronounced data conflicts and significant reduction in both generalization and practical applicability.
the MMTD-Sed the test results are dis-
Ablation Study LLM in the DTE-FDM: Furthermore, to verify the necessity of the LLM in the DTE-FDM, we design a variant of FakeShield, which removes the LLM and di- rectly input ins. Trag. Timg) into the tam- per comprehension module, adjusting its train- ing objective to directly produce the description
Table 6: Performance comparison of FakeShield with and without DTG on different datasets.
CASIAL+
IMD3200
Deeplake
AIGC-Edinngg
Methad
ACC
F1
ACC
F1
ACC
F1
ACC
Fl
Ours DTG
0.92
0.92
0.71
0.79
0.89
0.90
0.72
0.78
Ours
0.95
0.95
0.83
0.90
0.98
0.99
0.93
0.93
Odet and the mask Mioe. Using the same training configurations, train the variant and our orig- inal framework for 25 epochs, evaluating their localization accuracy on the CASIAI+ dataset. As shown in Figure 6 after removing the LLM, the localization performance consistently lags behind the original framework throughout the entire training process and it converges earlier. It proves that joint training detection and localization via a single MFLM tends to cause notable performance degradation than our decoupled module design, which further highlights the critical role of our LLM module in enhancing the semantic understanding of the proposed framework.
CONCLUTION
In this work, we present the first application of an M-LLM for the explanation IFDL, marking significant advancement in the field. Our proposed framework, FakeShield, excels in tampering de- tection while delivering comprehensive explanations and precise localization, demonstrating strong generalization across wide range of manipulation types. These features make it a versatile and practical tool for diverse real-world applications. Looking to the future, this work can play a crucial role in several areas, such as aiding in the improvement of laws and regulations related to digital content manipulation, informing the development of guidelines for generative artificial intelligence, and promoting clearer and more trustworthy online environment. Additionally, Fake can sist in evidence collection for legal proceedings and help correct misinformation in public discourse, ultimately contributing to the integrity and reliability of digital media.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Vishal Asnani, Xi Yin, Tal Hassner, and Xiaoming Liu, Malp: Manipulation localization using a proactive scheme. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023.
Zhongjie Ba, Qingyu Liu, Zhenguang Liu, Shuang Wu, Feng Lin, Li Lu, and Kui Ren. Exposing the deception: Uncovering more forgery clues for deepfake detection, In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 719-728, 2024.
Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang. End-to-end ceannstructtonccassfficiil learning for face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4113-4122, 2022.
Lin Chen, Jisong Li, Xiaoyi Dong, Pan Zhang, Conghui He, Jiaqi Wang, Feng Zhao, and Dahua Lin. Sharegpt4v: Improving large multi multi-modal models with better captions. arXiv preprint arXiv:2311.12795 2023a.
Xinru Chen, Chengbo Dong, Jiaqi Ji, Juan Cao, and Xirong Li. Image manipulation detection by multi-view multi-scale supervision. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021.
Yirong Chen, Zhenyu Wang. Xiaofen Xing, Zhipei Xu, Kai Fang, Junhong Wang, Sihang Li, Jieling Wu, Qi Liu, Xiangmin Xu, et al. Bianque: Balancing the questioning and suggestion ability of health Ilms with multi-turn health conversations polished by chatgpt. arXiv preprint arXiv:2310. 15896, 2023b.
Zhe Chen, Jiannan Wu, Wenhai Wang. Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, et al. Internvl: Scaling up vision foundation models and aligning for generic visual- lingu-iiig tasks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 11185-24198, 2024.
Hao Dang, Feng Liu, Joel Stehouwer, Xiaoming Liu, and Anil K Jain. On the detection of digital face manipulation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern recognition, pp. 5781-5790, 2020.
Tiago José De Carvalho, Christian Riess, Elli Angelopoulou, Helio Pedrini, and Anderson de Rezende Rocha. Exposing digital image forgeries by illumination color classification. IEEE Transactions on Information Forensics and Security, ((7):1182-11) 11941199411,11111111111111111191 2013.
Jacob Devlin. Bert: Pre-training of deep bidirectional transformers for language understanding.
arXiv preprint arXiv:1810.04800 2018
Chengbo Dong. Xinru Chen, Ruohan Hu, Juan Cao, and Xirong Li. Mvss-net: Multi-view multi- scale supervised networks for image manipulation detection. IEEE Transactions on Pattern Anal- ysis and Machine Intelligence, 45(3):3539-355 2022.
Jing Dong. Wei Wang, and Tieniu Tan. Casia image tampering detection evaluation database. In Proceedings of the IEEE China Summit and International Conference on Signal and Information Processing (ChinaSIP), 2013.
Shichao Dong, Jin Wang, Renhe Ji, Jiajun Liang, Haoqiang Fan, and Zheng Ge. Implicit identity leakage: The stumbling block to improving deepfake detection generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3994-4000 2023.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21788 2024.
FaceApp Limited. Faccapp. https: www. faceapp.com. 2017. Accessed: 2024-08-16.
Xiao Guo, Xiaohong Liu, Zhiyuan Ren, Steven Grosz, Iacopo Masi, and Xiaoming Liu. Hierar- chical fine-grained image forgery detection and localization. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR),202)

---

Published as a conference paper at ICLR 2025
Edward J Hu, belong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Con- ference Learning Representations (ICLR), 2022.
Xiaoxiao Hu, Qichao Ying, Zhenxing Qian, Sheng Li, and Xinpeng Zhang. Draw: Defending camera-shooted raw against image manipulation. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023.
Xuefeng Hu, Zhihan Zhang, Zhenye Jiang, Syomantak Chaudhuri, Zhenheng Yang, and Ram Neva- tia. Span: Spatial pyramid attention network for image manipulation localization. In Proceedings of the European Conference on Computer Vision (ECCV), 2020.
Zhengchao Huang, Bin Xia, Zicheng Lin, Zhun Mou, and Wenming Yang. Ffaa: Multimodal large language model based explainable open-world face forgery analysis assistant. arXiv preprint arXiv:2408. 10072, 2024.
Ashraful Islam, Chengjiang Long, Arslan Basharat, and Anthony Hoogs. Doa-gan: Dual-order at- tentive generative adversarial network for image copy-move forgery detection and localization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), 2020.
Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander Berg, Wan- Yen Lo, et al. Segment anything. arXiv preprint AxXi::2304.02644 2023.
Vladimir V Kniaz, Vladimir Knyaz, and Fabio Remondino. The point where reality meets fan- tasy: Mixed adversarial generators for image splice detection. Advances in neural information processing systems, 32, 2019.
Pawel Korus and Jiwu Huang. Multi-scale analysis strategies in prnu-based tampering localization.
IEEE Transactions Information Forensics and Security, 12(4):809-824 2016.
Myung-Joon Kwon, In-Jae Yu, Seung-Hun Nam, and Heung-Kyu Lee. Cat-net: Compression tifact tracing network for detection and localization of image splicing. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 2021.
Xin Lai, Zhuotao Tian, Yukang Chen, Yanwei Li, Yuhui Yuan, Shu Liu, and Jiaya Jia. Lisa: Rea- soning segmentation via large language model. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 9579-9589, 2024.
Haodong Li and Jiwu Huang. Localization of deep inpainting using high-pass fully convolutional network. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019.
Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-ing imaage pre- training for unified vision-language understanding and generation. In International Conference Machine Learning (ICML), 2022.
Runyi Li, Xuanyu Zhang, Zhipei Xu, Yongbing Zhang, and Jian Zhang. Protect-your-ip: Scalable
source-tracing and attribution against personalized generation. arXiv preprint arXiv:2405.16590 2024.
Yuanman Li and Jiantao Zhou. Fast and effective image copy-move forgery detection via hicrar- chical feature point matching. IEEE Transactions Information Forensics and Security, 14(5): 1307-1322, 2018
Yue Li, Dong Liu, Houqiang Li, Li Li. Zhu Li, and Feng Wu. Learning a convolutional neural network for image compacct-esolluion. IEEE Transactions on Image Processing. 1093):1092- 2018.
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Proceedings of the European Conference on Computer Vision (ECCV), 2014.
12

---

Published as a conference paper at ICLR 2025
Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning, Advances in neural information processing systems, 36, 2024.
Xiaohong Liu, Yaojie Liu, Jun Chen, and Xiaoming Liu. Psce-net: Progressive spatio-channe correlation network for image manipulation detection and localization. IEEE Transactions on Circuits and Systems for Video Technology, 32(1 1):7505-7517, 2022.
Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Repaint: Inpainting using denoising diffusion probabilistic models. In Proceedings of the IEEE/CVF Conference Computer Vision and Paltern Recognition (CVPR), 2022.
Xiaochen Ma, Bo Du, Xianggen Liu, Ahmed
Hammadi, and Jizhe Zhou. Iml-vit: Image manipulation localization by vision transformer. arXiv preprint 2tt.::233..14666 2023.
Chong Mou, Xintao Wang, Jiechong Song, Ying Shan, and Jian Zhang. Dragondiffusion: Enabling
drag-style manipulation on diffusion models. arXiv preprint arXiv:2307.02421, 2023.
Tian-Tsong Ng. Jessie Hsu, and Shih-Fu Chang. Columbia image splicing detection evaluation dataset. DVMM lab. Columbia Univ CalPhotos Digit Libr, 2009.
Yuval Nirkin, Lior Wolf. Yosi Keller, and Tal Hassner. Deepfake detection based on discrepancies between faces and their context. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(10):61 11-611,, 2021.
Adam Novozamsky, Babak Mahdian, and Stanislav Saic. Imd2020: large-scale annotated dataset tailored for detecting manipulated images. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision Workshops, pp. 71-80, 2020.
NVIDIA Corporation. Flickr-faces-hq dataset (ffhq).
Accessed: 2024-09-30.
OpenAI. Gpt-4 technical report. arxiv 2303.08774. View Article, 2(5), 2023.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhor, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01992, 2023.
Hanoona Rasheed, Muhammad Maaz, Sahal Shaji, Abdelrahman Shaker, Salman Khan, Hisham Cholakkal, Rao M Anwer, Eric Xing, Ming- Hsuan Yang, and Fahad S Khan. Glamm: Pixel grounding large multimodal model. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 13009-13018, 2024.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition (CVPR), 2022.
Ronald Salloum, Yuzhuo Ren, and C-C Jay Kuo. Image splicing localization using multi-task fully convolutional network (mfen). Journal of Visual Communication and Image Representation, 51: 201-209, 2018.
Victor Sanh, Albert Webson, Colin Raffel, Stephen Bach, Lintang Sutawika, Zaid Alyafeai, Antoine Chaffin, Arnaud Stiegler, Arun Raja, Manan Dey, et al. Multitask prompted training enables zero-shot task generalization. In International Conference on Learning Representations, 2022.
Rui Shao, Tianxing Wu, and Ziwei Liu. Detecting and recovering sequential deepfake manipulation. In European Conference on Computer Vision, pp. 712-728. Springer, 2022.
Carole H Sudre, Wenqi Li, Tom Vercauteren, Sebastien Ourselin, and M Jorge Cardoso. Generalised dice overlap a deep learning loss function for highly unbalanced segmentations. In Deep
Learning in Medical Image Analysis and Multimodal Learning for Clinical Decision Support: Third International Workshop. DLMIA 2017, and 7th International Workshop, ML-CDS 2017, Held in Conjunction with MICCAI 2017, Québec City, QC, Canada, September 14, Proceedings 3, pp. 240-248. Springer, 2017.
13

---

Published as a conference paper at ICLR 2025
Roman Suvorov, Elizaveta Logacheva, Anton Mashikhin, Anastasia Remizova, Arsenii Ashukha, Aleksei Silvestrov, Naejin Kong, Harshith Goka, Kiwoong Park, and Victor Lempitsky. Resolution-robust large mask inpainting with fourier convolutions. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision ( (WACV), 2022.
Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, et Qwen2-vl: Enhancing language model's 's perception of the world at any resolution. arXiv preprint arXiv: 12191, 2024.
Weihan Wang. Qingsong Lv, Wenmeng Yu, Wenyi Hong. Ji Qi, Yan Wang, Junhui Ji, Zhuoyi Yang, Lei Zhao, Xixuan Song, et al. Cogvlm: Visual expert for pretrained language models. arXiv preprint arXiv:2311 1.03079, 2023.
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoe V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 05.24424-24837, 2022.
Bihan Wen, Ye Zhu, Ramanathan Subramanian, Tian- Tian-Tsong Ng. Xuanjing Shen, and Stefan Win- kler. Coverage-a a novel database for copy-move forgery detection. In 2016 IEEE international conference on image processing (ICIP), pp. 161-165. IEEE, 2016.
Haiwei Wu, Jiantao Zhou, Jinyu Tian, and Jun Liu. Robust image forgery detection over online social network shared images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Yue Wu, Wael AbdAlmageed, and Premkumar Natarajan. Mantra-net: Manipulation tracing net- work for detection and localization of image forgeries with anomalous features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019.
Xinyu Yang and Jizhe Zhou, Research about the ability of Ilm in the tamper-detection area. arXiv preprint arXiv:2401.13504 2024.
Qichao Ying, Zhenxing Qian, Hang Zhou, Haisheng Xu, Xinpeng Zhang, and Siyi Li. From image to imuge: Immunized image generation. In Proceedings of the ACM international conference on Multimedia (MM), 2021.
Qichao Ying, Xiaoxiao Hu, Xiangyu Zhang, Zhenxing Qian, Sheng Li, and Xinpeng Zhang. Rwn: Robust watermarking network for image cropping localization. In Proceedings of the IEEE Inter- national Conference on Image Processing (ICIP), 2022.
Qichao Ying. Hang Zhou, Zhenxing Qian, Sheng Li, and Xinpeng Zhang. Learning to immunize images for tamper localization and self-recovery. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023.
Jiwen Yu, Xuanyu Zhang, Youmin Xu, and Jian Zhang. Cross: Diffuusion model makes controllable, robust and secure image steganography. Advances in Neural Information Processing Systems, 36, 2024a.
Zeqin Yu. Jiangqun Ni. Yuzhen Lin, Haoyi Deng, and Bin Li. Diffforensies: Leveraging diffusion prior to image forgery detection and localization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12765-12774, 2024b.
Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference Computer Viston (ICCV), 2023.
Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 11.1111 11964-11974, 2024a.
Xuanyu Zhang, Jiarui Meng, Runyi Li, Zhipei Xu, Yongbing Zhang, and Jian Zhang. Gs-hider: Hid- ing messages into 3d gaussian splatting. In Advances in Neural Information Processing Systems (NeurIPS). 2024b.
14

---

Published as a conference paper at ICLR 2025
Xuanyu Zhang, Youmin Xu, Runyi Li, Jiwen Yu, Weiqi Li, Zhipei Xu, and Jian Zhang. V2a-mark: Versatile deep visuol-audio watermarking for manipulation localization and copyright protection. In Proceedings of the ACM international conference Multimedia (MM), 2024c.
Yue Zhang, Ben Colman, Ali Shahriyari, and Gaurav Bharaj. Common sense reasoning for deep fake detection. arXiv preprint urXiv:2402.00/22 2024d.
Xinshan Zhu, Yongjun Qian, Xianfeng Zhao, Biao Sun, and Ya Sun. A deep learning approach to patch-based image inpainting forensics. Signal Processing: Image Communication, 67:90-99, 2018.
15

---

Published as a conference paper at ICLR 2025
A APPENDIX
A.1 LIMITATIONS AND FUTURE WORKS
One limitation of our current framework is its suboptimal performance when handling more complex types of deepfake tampering, such as identity switching and full-face generation. These types of manipulations introduce unique challenges that our model currently struggles to address effectively. To address this, future work will focus several key optimizations. First, we plan to incorporate Chain-of-Thoughee (CoT) (Wei et al. 2022) mechanism to enhance the model's reasoning abilities, enabling to detect more subtle manipulations in deepfake content. Second, we will expand our training dataset to include a broader range of deepfake samples, encompassing various tampering techniques and scenarios, improve the model's generalization. Finally, will optimize specific modules within the framework to better handle these complex tampering types, creating a more robust and adaptable detection system. These improvements are expected to significantly enhance the framework's ' performance across a wider spectrum of deepfake domains.
A.2 DATA SOURCES
We collected source data from the dataset mentioned in Section 4.1 with the details provided in Table
noted that the FaceApp and FFHQ datasets are part the DFFD (Dang et al. 2020) dataset. We follow their original configuration divide the training and validation sets. FFHQ (NVIDIA) Corporation) consists of real face images, while FaceApp (FaceApp Limited 2017) contains fake faces generated by the FaceApp (FaceApp Limited 2017) tool, which manipulates facial attributes in the images.
Regarding the construction process of the AIGC-Editing dataset, first collected 20,000 real im- ages from the COCO (Lin et al.) 2014) dataset and used the SAM (Kirillov et al., (023) tool to segment the masks of all targets. We then selected the target mask with the third-largest area in each image and applied the Stable-Diffusions Laaie-Difffusoon-naainnng redraw this section. To ensure a balance between positive and negative samples, we further extracted an additional 20,000 images from the COCO dataset, distinct from the previously selected ones.
(Lugmayr et al.) 2022) method to partially
Table 7: Summary of datasets used for training, and evaluation.
Dataset
Real
Fake
Copy-Move Splicing
Removal
DeepFake
AIGC-Edit
#Training
Fantastic Reality
16,592
19,423
19,423
CASIAv2
7,491
5,123
3,295
1,828
FFHQ
10000
FaceAPP
7,308
7,308
COCO
20,000
AIGC-Editing
20,000
20,000
#Evaluation
CASIAv1+
800
920
459
461
Columbia
180
180
Coverage
100
100
NIST
564
68
288
208
IMD2020
414
2,010
2,010
DSO
100
100
Korus
220
220
FFHQ
1,000
FaccAPP
1,000
1,000
COCO
20,000
AIGC-Editing
20,000
20,000
16

---

Published as a conference paper at ICLR 2025
A.3 MORE ABLATION EXPERIMENTS
Exploring the Introduction of an MFLM inherently possesses some error-correction capability. This because, during training, we use potentially inaccurate det as input and encourage the model to output M Thus, during testing, if Ode contains minor inaccuracies, such as incorrect descriptions of tampered locations, MFLM can correct them. To further explore the impact of incorporating an error correction mech- anism during MFLM training on localization accuracy,
Mechanism in MFLM:
We observe that our
conducted ablation study. During MFLM training, we used the ground truth Odet to constrain TCM's output correct the input O The results the Table & iindicate that correcting Ouet does not improve Mise predictions, possibly due to interference between mask and text optimization.
Table 8: Exploration on introducing error correction MFLM on localization performance.
CASIA I+
IMD2020
DeepFake
AIGC-Editing
Method
IoU
F1
IoU
F1
loU
F1
IoU
F1
Using correct O det
0.51
0.56
0.49
0.55
0.13
0.21
0.12
0.15
FakeShield
0.54
0.60
0.50
0.57
0.14
0.22
0.18
0.24
More Ablation Study LLM in the DTE-FDM: To investigate the roles of Trag. Timg- and T Tins- When training MFLM, we kept other training configurations unchanged and adjusted the inputs to: (Tess: kns, ] and ma: Trag]. The test results are shown in Table 9 is evident that using input {T ins. Ting } is slightly better than (Te. Toog J. but both are inferior to our method with the input (O det. Timg) [mmg].This indicates that using an LLM to first analyze the basis for tampering and then guiding the localization achieves better results.
Table 9: Ablation Study LLM in the DTE-FDM with different input combinations.
CASIAI+
IMD2020
DeepFake
AIGC-Editing
Method
loU
F1
loU
F1
loU
F1
loU
Fl
T Pins. T Timg
0.50
0.55
0.48
0.53
0.13
0.21
0.12
0.15
T Tinsi Taag T Tins: Trag: T img
0.49
0.54
0.47
0.52
0.12
0.19
0.12
0.14
0.51
0.55
0.48
0.54
0.13
0.2
0.11
0.14
Odet, Tim Timg (Ours)
0.54
0.60
0.50
0.57
0.14
0.22
0.18
0.24
A.4 MORE AIGC-EDITING GENERALIZATION EXPERIMENTS
To further verify the model's generalization performance in the AIGC-Editing data domain, expanded our test set by constructing 2,000 tampered images using controlnet inpainting (Zhang al. 2023) and SDXL inpainting (Podell al. 2023), which the model had not encountered before. We selected MVSS-Net, CAT-Net, and HiFi-Net, which performed well in the AIGC-Editing data domain Tables comparison methods for testing. The detection and localization test results are presented in Table TO Our method demonstrates leading performance on unseen datasets and exhibits strong generalization capabilities.
Table 10: Generalized performance comparison on ControlNet and SDXL Inpainting datasets.
ControlNet Inpainting
SDXL Inpainting
Method
ACC
Image-level Fl
loU
Pixel-level FI
ACC
Image-level Fl
loU
Pixel-level F]
MVSS-Net
0.38
0.27
0.05
0.09
0.35
0.20
0.05
0.08
CAT-Net
0.90
0.89
0.11
0.17
0.86
0.83
0.06
0.09
HiFi-Net
0.49
0.66
0.17
0.28
0.44
0.61
0.02
0.03
Ours
0.99
0.99
0.18
0.24
0.99
0.99
0.18
0.23
17

---

Published as a conference paper at ICLR 2025
A.5 ANSWER ANALYSIS
Figure 7 presents the adjective and noun word clouds for the ground truth (GT) descriptions in the MMTD-Set and the answer descriptions generated by FakeShield. It is evident that, through effective fine-tuning, FakeShield can be guided by the dataset to assess both image-level semantic plausibility (e.g., "physical law," "texture") and pixel-level tampering artifacts (e.g., "edge," " "reso- lution") to determine whether an image is real.
fical
unnat turallylyy figure's
Intorns Kiaa
spec
eflec
Tlaw
Smooe
relad Consto
body
e
ou
face
backgroe
Erro
ff
ddrrccioon per Spectic
font r resÖ
natura
bus
perspec
S
side
may right
areas..
a
tram
due mang
ceveral HoTer
auroondiigg
iseett
sharp
physica
starpess
sign
Im
lut-ion
scene
additionally
texture
aarrunn
part
aarrg
reg
portion
contant
"Suur
B Semerrao
texture
pers
LONT resolut
sky
i
around
go
tu
lecedi
difffer
unnaturaaly
a
peet
ma
1on
ent
highuight
ee
pection
part
Background
unnatura
llightll por
pasta
W
central weter
reflection
Le
sooth
hair
timan
visible
vehi
pana
left
ght
een'
wi
weiwiith thin
present
ob pect t
inioonsisten
calor
ght
ironment
scene
al easumm
Better
detail
beally
s fically
source
object
Si S
manipulation
section
dogrui
upper
differen
unnatural
ent OW
phys S
g present
righh
Hior and
iaal
Tigure
m
region
Seanless
ti
mmnnipplation
per
Mallatoon
diiden
inconsistentright environment.
consistent
(a) MM
(b) FakeShiel Generated Answer
Figure 7: The noun and verb word clouds in the MMTD-Set and the FakeShield Generated Answer. It can be seen that the high-frequency vocabulary of the two is basically the same.
A.6 PROMPTS
During the process of using GPT-4o construct the MMTD-Set, we meticulously designed distinct prompts for each category of tampered data to guide GPT-4o in focusing on specific aspects for image analysis, as illustrated Figure and Figure
A.7 EXAMPLES
Comparison of subjective results of mainstream M-LLM: As mentioned in Section 4.3 lected some M-LLM output samples, as shown in Figures T0 and
we
FakeShield output subjective samples: We selected several results from Shielhss testing PhotoShop, DeepFake, and AIGC-Editing datasets, as displayed in Figures 12 13
15
16
and 17
MMTD-Set data set example: We select some samples from the MMTD-S Set data set and display
them in Figures 18
19 and 20
18

---

Published as a conference paper at ICLR 2025
You are an A visual assistant that can help humons analyze some tampered images. Y will recetve two images, the first the tampered Image A, and second the hinary mask imsaee the lampered region value of (While) indicates tampered areo, and of (black) indicates the unkempered areal.
yourtask
bluary provided the tampered picture and tampered of the picture B:
1. Describe the lucation of the tampeting area in the diagram,
2. Desembe detbil the contents of the timpored arto, Deserbbe visible details the imsge that have been tampared with
In the answer, doa'tt dirrectly mention: the kinery mask. A Always assume that you are simply observing lampered Images
When describing Problem 1, use naturll language and grve both relative and absolute position of tompered ares, don't give an ambignous,
unclear descrtition:
(1) Relative position: Use the relative position between objects in the picture, such above the crowd, the wall, the siyy on the table,
(2) buolute positton:: tampering area is relative to position the entire image, such as side, right side, top half, bottom half, bottom comer, lower right corser. upger left comer, upper right comeer, etc
When descrtbing Problem 2, please natural language describe detail types objects, number of objects, the actions objects, pcupecties cijects the lampering area selected by the mask, but do not give ambiguous or unsleur descriptions.
descrtbing Problem consider the visible details caused tampering from perspectives, but don't give ambignous, uncleor descriition, oz something is challtage:
(1) Lighting: Please candfully oiserve the overall style, culorand detailss of the picture to determine whether theme are visual insonsistentiiss Pay special attention the consistancy light, shadows, colors, and whether there any unnatural amas marks. if there multiple objects people the picture, they should be illuminated by the same light and the shadows should be consistent. Inconsistent lighting and shadowing may suggest image cumposttng modification.
(2) and piste: Oberrve whether there some duplicate areas blocks in the image, which may evidence Jeft by the copy and paste openation.
(3) Edges Check whether there ame any unnotural pixel distributtors odges the image. Particul ar athention is puid the presenoe discontimous or inconsistett edges, and the presence of vistble shear or synthests marks.
(4) Resolution: Please check the resolution and comprestion traces the picture. Composite edited images may show unnatural pixel blur, jacgediees,, excessivee comprassio.
(5) Herspective relatonshipp Observe the perspactive and proportion mistonship in the picture Real photos should be consistent in persectivv and peoportions, and if there are unusual unnatural perspective relationships could be a sign of compositing editing, Check whether the image has ressonable change in depth field, that whether the degres of bokth bebween the foregruund backgmund, and subject confurms the attual plysiics.
(6) Shaddwes Observe whether there are mossonable reflactions and sladows in the photo. Realistic photos often produce reflections and shadows bossed the light source, while composte photos may have unnatural shadows reflections
(?) Text: the photo contains words or logos, you can check whether is clear and legibble and consistent with the surrondding environment.
Unnaturalness or incungrulit of text or logus may suggest tampering with the photograph.
Physical laws: Check whether the content of the pecture violates physical laws, such the movement trajectory the object, the posttion and shape of the reflection, etc.
(4) Prompt for PhotoSbop& tampered images
You on visual assistant that helps humans analyze image that has not been tampered with
images that not suffered lampecing, You will recetive imsage real
Now your task is to not been tampered with, and can be seen this real and trastworthy real image obtained directly from the camer,, Please focus describing some of the visiibke details that are consistent with the real scenario, and the real laws of physics, and 3. Il you were put in pile of tamppered images, and juige whether this picture has been tampened with, frum what angle would you analyze and jugge and give detailed
provided noal image that has not busn tampunsd with 1. Describe the angles from which this image can soem that he has
asked judge If masons??
In enswering the above questioss, consider the visibte details triggered lampering from thuse perspectives: (1) lighting: Plessn take close
the overall style, color and dotails of pletm determine whether any visual inconsistrecy Please pay particular attention to the consistency of lighting shadows and colors, as well as the presence of unnatural areas or marks. If there are muitipple olgects or people in the picture they should be il uminated by the same light and the shadows should be consistent. Inconsisbent lighting and shadows may suggest compositing modifiicaion.
(2) Copy and Paste: Louk fur signs of duplication ur mirrocigg in the image, which may be evidunce left by a vogy and paste operation.
(3) Edges Check for unnatual pivel distribrzion edges in the image. Pay particulor artention to the presenoo of discortimoves inconsistent odges, as well obvious traces of clipping or compositing
(4) Resolution: Please check the resolution and traces of compression in the image. Composited or edited imagres may show uncatural pixel blurring, jegpedness, or excuesivve iamprssion marks
soale relationships the picture Real photogmaphs should consistent in of perspective and peoportions. If abuornal or unnatural prespective pelationships appeat it may be sign of composiling or editing. Look for reasccable changes in depth of held in the image, 1a. whether the degree of vigneting between the foreground, bickground and subject is consistent with actual physocal laws. (6) Shulows Louk fur asssonable rellsction and shutows in the photugruph. Roal photogmphs uuully produce reflections shadlos acourtingly reflections
Perspective: Obeerve
perspective
the light sounos, (?) Text If photograph costains text or logos, check that they are legible and in keeping with their survondingss Unnatural or incongraous text or logos may suggest photo lampering.
composite photograhs may have unnabmn
Physccal laws: Check whether the content the picture violotes physical lawe, such the trjestory of the object's movement, the position shope of the reflection, and so on.
Prompt for authentic soene images
Figure 8: Prompts for GPT-4o when constructing MMTD-Set. (a) Analysis guide prompt de-
signed for PhotoShop tampered and AIGC-Editing tampered images. (b) Analysis guidance prompt designed for real scene images.
19

---

Published as a conference paper at ICLR 2025
You are anAl visual eesistent that helps lumeus anely ze some imapes of buman faces that have been lamperdd with by despfacce You will recelve two images, the first Amege
face lampered by deepfake and second linnayy image lampered arse value (whill)) indicases lampered ame and a value 0 (black) indlositos the untampered areo).
New. your task to use the binary masks provided for the ampprred regions of the deepfake tampered image A and image B: 1. describe the location the tumpered aree in the picture, describe
coctest lampered arees,
3. describes the visible details the lampered aree in the imagee
In your answer, do not refor dimettl to the binory mask A ways aesume that you are just lookinng the timpored image
W When descrihingg Problem use retural lunguage give the location of tamperd area, paying particular attention the fact that the tampered disculiiuuus, sevent larper tampered areas should be desctibed, However, do not give amiugurss and uncles descriptions Common descriptions of tumpered arses include:
Head, Face, Fonihwad, Eyes, Fyebrows, Eyelids, Byelashes Nose, Nostrils, Cheeks, Ears, Mouth, Lips, Chin.jan, Hair, Neck, Glasses, Earting Headphonnes Scipp p. Hairline, Sidehume, Tomple, Crown, Nape, Javlino, Teeth, Tongse, Gums, Moustacho, Reami, Hoodhand, Hat, Tham, Bandana, Voil, Fascinator, Hairpin,
W hen desctibing Problem use satural lenguage to describe in detail the types of objects, peoperties of objects, zumber of oljects, etc. in the tampered area selected led mask, paying special elterrica the fact that, the lamperd aree is discontinurus, give a description the tampered arees that latger stae, But do give ambiguous unclear descriptions.
peopertie
W hen describing Questions and 3, considee the visitie details caused by lampering from these perspectives, but do not give en ambiguuus, unclear descciption that is othenw ise challengingg
Symmetrical Foctal Foatums: Doggfake ginerated faces may echibit unnuturally perfoct symmatry, locking subtin asymmetry typically found in mail fares. Blur or Distortonn mund Edges: Despéako manipulation may intmdhoe or distaction around odges the face where the manipulatton has takzm plane, espocially the face has been digttally ovedlad ombo wotter body.
3. Inconsistent Lightng and Stadows: Deepfake dguztthms may stuggle socurabely metci the lighting and shadows in the original image, leading to discrepencies lighting direction intersily across the face.
Unnatural Facial Expresioons Deepfisios may produce facial expressions that appear unnatura,, exaggerated, orout sync with
the image
5. Mssmttchd Facaal Proportons; Doegrake mani gulition may result facial propottons thet.am tooonsssten: with the person's gender or ago, such as man's face
an a woman's body or vioc versa.
6. Inconsistent Skin Texture and Tone: Deepfake generated faces may exhisit uncatuna dkin texture or tane, such as everly smooth or parelated skin, that diffees
from the suncuniing areas.
Missing Inconsisieni Eye Rellections Deeplake manipulation may resull ia missing or incousistent reflections the eyes, which can provide clues about the
authenticity of the image
8. Change haintyle: le. Same deepfako algorithma only tomper with hale and may change hair oolor and hairtty lo, anadd add long hair for and and short hair for girls.
9. Iregulantess in Makmusp A pellcazton: Despfake manipulation may intrddaee maknup styles that are inconstatent with the porson's gender or carilait poor agalication quality.
Contestual tacousistracies Deepfake generated images may contain incorsistecates the overall contect the image, dothinn oc suroonddnng, that sugpest macipulation.
discrepanties in perspective,
11. Unisesonable accessories: Some deepfake aigortitmss add glasses, eentings bals, masks, etc. to the image and the edgess lighting relationships, and perspective of these accessorios may be incormet.
12. them glasses sunglasses picture, plaase poy spedial attentton whether the glasses sunglasees have boen tampered with not, the rims, frames, timples lettas, of glasses are very susoepeble imperfoctions problems.
Prompt for DeepFala tampered images
You are an artificial intelligenee visual assistant that helps humans analyze some rea face images that have not been tampered with by deepčake. You will mozive image of real face that has not been tampered with by deeplake
Now, your lask to use the provided image of reel face that has not bees tampered with by deeyfake Answen Desctite the angles from which you can see that this image hos not born tampored with by doegr and that you can see that this a real and beliesable image of mal face stright htt from the camern Foois deseribing some of the visible deballa that om concerient with a roal faoe and the mail laws of physies, and What would happen if you were plooed in pile of images that hatee been judgment and give detailed resscas?
with by desplake and aslnnd determine whether this imge has boen tamprred with which penpactive would you analyze the
W hea desccilinng parts of the human face, common descriptions include
heed, face, foreceed, eyes, ey ebrows, eyelids, eyelssiees, nose, nostrlls, cheeks, ears mouth, lips, chin, jow, haic neck, eyeglasses, eartings, headphones, scalp. hairline, sidebums, bemples, crown, back the nock, jawfiine, betth, tongue, gims, mustache bovrt, headband, hat, headdress, headscarf, vell, halrgiece, hairtrush, headhand
In answering the ahove questions, consider the visible details tragered by deeplake tumpering from the following pensectives:
1. sy symmetrical facial features Deepfake gerernted Eaces may exhibit unnstual perfect syzmetry lacking the subde any symmeettis common in real faces.
2. Blurted or distorted eiges: DeepCake processing reslt in blured distoried edges procesedd faces, especiatly when the face digitally superimposed.
on another body.
3. Inconsistent lightin and Shadows:
The Dorpfake algurthm may have difficatty sommttly y matching the lightng and shadows in the original image, mealting in diffurences es the direction or interniity of lighting across the fane.
4. Unnatura facial expresioos Deepfake may produre farial expresions that look unnatumd, escaggented, out of syne with the rest of the image.
5. Disreoportonate Focial Propuctions Despfake operations may result in facial propections that de correppcud the gender age the character. suth men
woman's body, 6. Inconsistent skis bes and looe Desplake- generated faoes may hohitt unnetaaa skin tute or tone, such as overty smooth or pizelated skin that dicTemen
verse.
from the sumounding ama.
7. Missing or incondshent tye reflections Decpfaice openatons result in mosing or inconsistent eye reflestions, which may provido clues to the realism the
0. Albered hainstyle: Some Deesfake elgocithms onl tumper with hai may change lair color haiesyle, add long bair for boys shor: bain for girls.
9. Makeup inegulatiies Deep foepery elgocillmss may introduce makeup styles that are incosiittett with an individuel's gender or age, or excilki poor makeup quality.
10 Contectual sennies Images generated by Deeptake may contain moonsiistoniiss los with the overall of the image, such diffornnces in perepartive. clothing, sumoundings suggrsting manipulation of image.
11. Unmossonable accessories Some doepfaker algutthmm add glasses, carnins, hats, marks, to an image, and the odges, lightnng relationahips, and perspoctive of these sccessodies may be incorrett.
(b) Prompt for authentic face images
Figure 9: More prompts for GPT-4o when constructing MMTD-Set. (a) Analysis guide prompt designed for DeepFake tampered images. (b) Analysis guidance prompt designed for real face images.
20

---

Published as a conference paper at ICLR 2025
Was tekeen directly fron the comeen without
Hos
with
User
artifiuia photo modificat qushriques auch as ps? Please zoom on any detoils in the image, paying special attention to the adges of the objects. copturing some unnaturdl edges and perspeciive nelot orships, some incorrect semontic ics, unnatural lighting and darknsss etc
The insye you' arovided apporr recoudats challeyityy defirtively deterrin cloder iespcctoo finn for diyns of editing invllne srelyang cloverrs such as the edycs the oijects, shades, lighting considtiocy, and perspechive, the mass, upon zeering rg in and comminin deeely dhoud lask for any umetiine edger that night nagnet the coue check
pastand soone with coed grusing ins field Hovever access original file and
CFT-40
drech light cig filly Fruce The pr drerdded image, it's notl posstlle to perfors the lesel of detsi andlyds os it would requine higher reso uf on and zoom copebillies Hovever, ehhred
lighting
of the
discrspancies that coid indicote morepulation
suppiciens any incosistenniess
image. these ure some onese could pagest image may
sonutinzee ising image eiiting
dig
(Real, x)
Upen clide inspection, the eodificatir techniuuss each as Rhetadhvy (P5) Fere ane the detu's that suppert this curcksion:
photegrope
sigiiiiontly tompered with artificial
1. Edyes and Perspechive besefionstis The edyes of the objects. such as the coes and The troes, oppear saturd. There are re abrept on suggaat ghd shent and rezkahe.
perspective reletonth
2. Encamact Serzzhica: The meee dep e hypicel poatand some with cass granns na fidld There ane no eienents that seen out of The praportisatt and reelistic. There ore no dress of the iaag that appear unictanally bright or dark which woald be indicetive of prato monepuloiias
that
behexing raturdly and envermment cuthenticc
Useaturel
Derkness The
The
and
follage diiitll yellow, There are signt of calor banding unsatural colar apturction that would dlytelatterrttnn alhuretion
beteil: colors
green
5 Beckgroand and Forszround gurdund The background and cenorcund elements bland aeam laslly The trazaition from the green field to the trees signt blending artifacte lecandemenn
ovec lolon, the oppeors There genuie photegreph sgeificont riges artif medificction The detsils, and cenrol compostion ell aupoott this conditsion.
would photo
unable prev defiritive
whethe-
precessed ssing artifiiss
photo medifical fisiiiccioo techrigues Honever, I anclyze the image any pshiethll signa maniguistion
Upen dooming in and exsmeting the edoci of the objects, there are to immed etcly opporent unnetund ecjos or perspecting live relationahip pa woald puspeat photo zeen lampered out
being The yects the image. ui Wigeediiingg separtics, the freei have conall graning in thii with barkdingg of trees, whic i conmonn and natural sease There ere eisewnts a the inage that soen sut of place on isnorncct sonasthenlly
dxtall
durkness, image suggerting that the photo was taken during day andor clar dives. There creas the that appear over ly dark bright in on unreitua way.
distrcctiion
shodow the
field well
cheolute cartointy the webble clocx 3t appeors typical und hende
inporsbble
obvious eigns homparing (Real,
field
The image oppoars o natund photooyaph of coed grozing in fiedd with trees in the backyround There and slivous signd dig mertpuletton artificaa photo matif cahion techraqust as Photeshop (75) The adges of the at jicts, inclding the cowe the treee, appear
one expect traze smooth and raturdl arthout noticssbbee ort foots unsetural lane tnLghhtnng
coseractione
"*Eoges
Perppcttvu" The edges of the and Skeckws"" The lightin oppears rahund, with shodoss cast in way that is condiiennt with the pn of the and the lime day wi. and Textur with
lindsope ane gross are istic the textaand monigulation spperent sigss rnd floutia techeiques. The imege look like stroghtforwan photogroph taken with corenna.
colors
(Real,
Whether picture torpened Description hompered The been tompered with, tompened pesitiss this quodnert
leceted lover
image
that
be gi vasing the gress.
Jucoment basss con terpened area has several whsel incomtiteenttes.
different light 2. Secondly by The edges oreand the unsuturall shorp and blend surrically with the beckgreund nnd catting
appeara
possiall and deafe nan pulator.
cow
sightly differwer from the sammonding enwiremmnn
cow aspearing
dightlly mone Slured
The perspection is thoo iff, the cow'l six and angle do not game fir wite the rust the soves, mndking it leok cun of place.
Shadena can by the caw ralt conform is the drech on of light in the rest of the image, which suggerts that the coe wes not
muyyy part
(Fake,
Figure 10: The response of mainstream pre-trained M-LLM and FakeShield to tampered pic- tures. This is sample from the CASIA1+ (Dong et al., 2013) test set, which has been tampered with by Splicing. The black animal at the bottom of the picture is pasted later. It can be seen that only FakeShield made the correct judgment and accurately described the tampered area.
21

---

Published as a conference paper at ICLR 2025
Was this photo taken directly from the comero without proceasing? Has it beer tempered with by artificial photo modificction techniques such os pet Please zoom in on any detail in the mmgee poying special attention to the edges of the objects, copturing some unnaturai edges and perspective relatienships some incorvect semontics, iss unnatural lighting and darkneas
User
The imagg appcers dig bally aftered, ed. with several rags seppetting masiouaation using phota editing softword venetund andt
The dalpei
and perspectiv not
delyhie
sigs tamperrnng
The lighting on the deiphin shonssseer wits the rest the scone, indloating may have beet incerted from a different enirsement.
The water locks ratung "yples and ref reflectioss arcund the dejainn further sugpesing midi dotion... These syne inficate image was likaly edited ieclude the delptin
(Fake, x]
Upon exominng the image dessly, there are severdl indicotors that sugesst it may have been tompered with using or artificid photo (P5):
sact
of the do dophin and the people in the photogrephh sepecially onn tokon in nutural eatting mn with water and noverant the odgee wordd lively be oofter and mone burred to "The perspectioe redsh onehupe betweon the deppin, the peasle, and the weter seen sightly off, Thee dappis oppoare be flotting in way that bueynncy
Edges Perguective Beiutiondhipe The
unaturelyy sherp and clean Te
and constetent, which setting ahere lighting condil and can vary signt seantly Thare are no wibble reflest lor or refrection lend in the water that would be expacted and
Lighting and Derkposs The lighting the wijuects
daphin the people)
natund
in real phatogrihh The water appeara the
naturdl varatiens in and shodon. diihtly
sucjects
The dalphin appears perfectly
aligned with the people, which kely ine spotonecua cancie shat.
Artifical Edges The odges The delphin and the people are very smootth and lock the ratural iireydan Ties found real photoograhis
nemove inpert heae Proteshepp The unnelunal edyes, incodiiteen lightingg perfect diigmmnt of subjects all point towar de artific modi mndiiicatioo. Fictior..
amoz is resalt closing other editing techeroues
In
shoue signs
(Fake,
I'm unoble to provice cirect cnelyas of the image's is authert city or whether it has been redifiess However, 1 can describe the contict of image
indindddss
appears
dobiis
and has sarpnised exo't ned cipneat maaiiin thei face. The dajain switising clase the person, and bath ane the fondground of the image. The water is clear and blue, susgeating a tropica or coss loation There are sivieus signs of toepering or artif dil medi fisttion visible
dalphin's body, appeer natural and wall underwater consimeent with the eniinament, and thene abwious incarnect semantica or unnallurs" eismeits that world sugpest the inage has bean alfened, If you have specific conceres about the imaye's 's outherticlly on if you looking detalled andlysis the image's & contint, happy provide mone informction.
image. edges the
dbjects, auch es persen's jucket
light and shodoed in the maag deen
(Fake,
image tompered using artifccod phctts rediitoation une, Photoshop adgne certrin ehjecte, including do phin people, unatturlly smooth incorsistonn with what would neol-kife sonsanie Thore ore unachand edges and perepactive relstioneh onchie pe that riggest tel motipuittion Addrniossly. the lighting and shodnes do not slign (Fakee
neturally. further indicrring that the image har ardergone dherafione
Descniption
The image diems unaltirned the centing ná negion where the delphen's is teod and upper bedy na sununally cgrated into the scene. Jadgment Bass: There are several factors supporting this assessmentt
Lighting The light
the delphir's a matches the nost The doene, supcoring consistent the naturdl light source the
Rakelvokk
Edgen The edges eround the dops i' head ane emooth and deteiled, blanding sell with the aurzurding water, suggneting ng image, indlcsting forspactive kelotorehhp: The mox and poetticn of the aslpten's is head seam proportionate relotive to ite bady and the sarmounding anatamment na agga of manipuiction
insertion an madif cattion
shottwing
doiphrr n'e olige
lighting shadows presect
belongs rehurdly
scens.
proportionate body, conforning phyeica proportions one, coting
bese aftered neplaced.
(Real, /)
The response of mainstream pre-trained M-LLM and FakeShield for real images. This is a sample from the IMD2020 (Novozamsky et al. 2020) test set, which is real picture. It can be seen that only FakeShield makes the correct judgment, the rest of the methods consider the image to be tampered with.
Figure 11:
22

---

Published as a conference paper at ICLR 2025
User
this picture token directly by comero?
State your conclusion give ressors,
tampered with, pleaze ourpur tampered
picture
petura
conter the siihtlly fowerde
upper half The tompared craz contone aegle ye flower with sensir anda central canolla surrunded by pathern red
wellaa sens
Lighing The lighting the flewer uses match the sursurding runding ned leaves The Fower appeors have o offfereet light sounce, Pagedfing it was rnderted from
image
odges
Floerr
soorlesdy the sur nounding leeves, indeating passie and poste menipulation
3. Recolution: yellow flower soons to be offferent reselutice compored the
apporrngg sightlly
actifoct
Shaddwr There correspardin shadows inder the yellow floee that motch lightig rest the image, which would expected the flower wis originally
Fake, O
Penspection reletiondiip The
to the parspectivv of the sumounding incues, making it look out of place.
ongle yollow fower do
contane
IoU=0.90
Prysica nut The obsence shodaa unter Frowor defice phystoal low light
produce
Provide your conclusion directly neasons If tompored, please show the mosk of the attered
Can canfirm
The picture been tarpered with fungered centraly loceteed the moxe zscupying o signlicart portion of midike groan. festunes
pengan shanding
sefting
eagysltngg Jusgmert buss:
pongain
The lighting on the perpur does not matos the rest of scone it oppaars to suggesti
diffused
The eipes anound pengur unetuurllyy sharg and not bland scorskoddy with The tatoni not. indicriing a possiile out paste
perspective
postfiuring
confern to the ssahel irrangement of room molong it oppetr out cloce not
pengur carts shodsa terani conndering
lighting
dear shocons
the must the The nendlet on around the perqun seeru differ from the rest of the mepp, siign
perguin oppasning alightly pieclated, image
Fake, O
higher
IoU=0.99
Figure 12: Dialogue examples of FakeShield when receiving PhotoShop tampered images. The first image comes from the CASIAL+ (Dong al. 2013) dataset and has been tampered with by Copy-Move. The yellow petals in the center of the picture are the parts pasted later. The second picture comes from CASIAI+ (Dong et al. 2013) dataset and has been tampered with by Splicing. The penguin in the center of the picture is the part pasted later.
23

---

Published as a conference paper at ICLR 2025
User
State conclusion tompered with, please the mosk the tompered orea.
picture tampered Description tampered area accayying largs. roughly ovd shape the middle frome
artificlly reerned cbject datartiss that obsiaues the new what would be behind it, pass dow
Fomiture..
Lightng The tampered anca has unifer color and loska the foxtune and iightig
consishency oxpected from the not of the imsee.
Edgcs odges tompered
unnoturally areeth
3. Resolution The tampered has dif ferent resslation compored to rest of the inaye, appoaning blamee and Wingggie dettil which dageett las been di diaally oltened Renepectie reletonddpp
confern the paropectiv reom, it euere fiet and lodkr the depth that weile be expached from on ochull esyect in space.
ariifolly added lighting 5. Prysical lovn the tonpared arsa doer not follow the phys cal lowe of the emorenment. it oppsara be heo-d heo-dinens dinessond sbject in thres-dimanaonn space thout any surnoundings
further
that
Pake, U
IoU=0.99 -0.97
Con condirm if this picture takkn dinectly the camers? Provide your conciusion on dlnng with neosons If tompered, please show the mork of the altered area.
Unr
1. Whitther the sicture has beet tompered with Descriation of the tangered orea:
1. The pictare has been tumpored with speai feall the continl pertion the image,
oxtending
sid. "ampered includes befand
RakeSvoald
Tudgnent busi: The tompening is evident due sevendl factors:
1. Lightieg: lighting tomponed oor does not natch rest scone. oppoard
light
highlyins
2. Erges The edges oround the tompened car unnenurdily sharp and show rigns of being cut and posted lnto the scoee
componed the auggesting was inserted feeeed from diffirent scunce diffiennt reselution.
traak leading tomsered not fully 5. Shadond The shadees call the lampered do mutch the dinect ian and quality the shadons deer ebowhere in image, indiclting that it was not originally part
Perspective enghip:
Pake, U IoU=0.98 +.8
unnotural it property oligned the road surface, loce, which def the phycical land of neal world racing sconarts.
Figure 13: More dialogue examples of FakeShield when receiving PhotoShop tampered images. The first image comes from the Columbia (Ng et al./ (209)) dataset and has been tampered with by Splicing. The elliptical area in the center of the screen is the post-processing area. The second picture comes from the IMD2020 (Novozamsky et al. 2020) dataset and has been tampered with by Movy-Move. The car on the right side of the image is copied and pasted from the first car.
24

---

Published as a conference paper at ICLR 2025
Was this imge cop funad stroight from the comern? Share your conclution and ressonss If modifications are defected, autput the tompered area meak,
Whether
1. The prchane has not been fampered with I' picture taker directly the corsena Julgneett bust:
liy the imoge appeors
suslght casting shodleed groand that align
horees.
2. The colors are saturd and thene are agna of uneatund morks or sness that would vugpast tompentg.
edgas
murcurding grars smooth contrnouu ra gre pooi distert unneturs!
The reselation acnose The perspective and scale horses nnlonnn to sursurding ding oteirmment are realetfc, depth Toldd
uniforn, thatt crass of blurnng compressio that would cditing
consiptent
expected
The chadites
reflection
observed. There na text presser to apsess for tampering.
7. Ovarall, the image acheres to the real lowd of physics and shows na signs of dightll monipuiction
Resl
detennine directly
reasons, provide any
tampered
Whether the picture has been tonpered with / prion the tampered crea) picture dinectly
crure
lampered
1. The lygning the image rppeors condistent with the light sounee steriinlly coming from the front. dightly showe the sutjects,
os insicated the shasows under chine and hettapeens throggoss
sut--f--inc pince continatus,
might gugger tomparing
subjerte
jaged
that willd rndictte compeeting morppulatios
image thene's a naturdl depit of fidld with bodker sund slightly focus compored the forugrunnd cansishent with oplics of camera lets.
The resolation
thout any blrning compression would augeest
perspective
their
shaskes phetogrss aprsppritt
light searcei, there umoturr
7.
There no toxt ar logee present oneess for consstescy, but the physical lowe oppear ba uphald, with ieprobstle trajactorins reflect one.
reega
phyeice and photogyophhy, exlinng collaction tompaned
shable racl, unaftared photograph
Figure 14: Dialogue examples of FakeShield when receiving authentic scene images. The first image comes from the CASIA++ (Dong et al. 2013) dataset. The second image comes from the IMD2020 (Novozamsky et al. 2020) dataset.
25

---

Published as a conference paper at ICLR 2025
Was this pieture taken directly by the comenc? Shate your conclusion and give reasons. If it tampered with, plazse oulput the mask of the temper add area.
temprred picture tumpered specifioally facial region, including
basis:
The tompored shows of distortion and unnaturol blending with the
surrounding fexttuee
The lighting the tompered area does motch the rest of the foce, indicsting be artificiully smoot and lack the natural lines and shodows one would expect to
manipulat
The of the mauth and chin
Pake, 2
The skin tone within the tompered area differs from the odjscent areas, sugpesting inconsishency my in skin testure.
IoU=0,82
Con you confirm if picture was takenn dinectly camera? Provide your conclusion cleng with recsons, If tempored, please show mosk the altered orea.
tampered Description
picture tampered with, specifically region the gleases tompored
temple glasses,
unnetural stroight line Jurggnnt curvature eyeglest
2. frome the glasses inregular locking the continuity
from frome.
3. lons the glosses has distorted section, which is inconsistent with the
Fake, U IoU=0.91 0191
rest the lons' appearance.
you picture tampered, please
clong with
tompered Descrigtion tompored tompered specifically the nagion image.
basis:
left Indicating possible alteration.
There lock of consistency the hair strands' direction flow, which
typical of how hair naturally folls behaves.
The tumpered
the hair rppeart urnaturally stroight,
Fake U IoU=0.79
which otypical for the natural irveguarity hair outlines.
Figure 15: Dialogue examples of FakeShield when receiving DeepFake tampered images. The three images all come from the DFFD (Dang et al.) 2020) dataset and have been tampered with by FaceAPP (FaceApp Limited 2017). The first picture has beard added to chin, the second picture has glasses added, and the third picture has some hair added to the right side of the face.
26

---

Published as a conference paper at ICLR 2025
Wes this picture taken directly by the comenc? Shate your conclusion and give noosone If it tampened with, please put the mask of the Tampered crea.
Whether the imnge been trapened aith/ldeer prion tompered creas
consishent with photograph takan directly tampered
imoge
Jacimentt basis
imase shens natural skin
varisi shadows consiatint the lighting,
that
The dietting voible in the mmgge has reslitic texture and foork: feldk alge with sahardl land physicss.
If this image were placed cauong deepfake tompened pichure es, would shund out due the consiitenccy in lighting, notur skin edges that are comman
inages.
Reol,
Con you confirm the Provide conciusion with ditered
If tampered, please show the nask
The has been tonpered with It picture of face token dircclly the canera The systux uncherged and the
pamoerice hics are consistent.
Zudymeent
strends
2. The lighting the hai uppars consition, with highlihhts ond shadess that crmespord natural disinuemnnt
testtae
near harrina canhenttc and manck expected appearance neal parszn.
despfiske tampened photograph. euth the heature and the
inperfection that chanachenssh of light with the don and heir.
you confirm this picture was token directly ly by Previde your conclusion olong recsons. tompered,
Uber
Whether the imoge hax beer tompered with/ descreprttt phreerghinn of the tompened onea: fumsered with, viable porton of mage shous natura charashenstics
irage appeare arthenti and condsnert photogophh
Zudgeent basts
scbile part of the image shows o perticn eyeglonces with realstic ref lectioono and transperency, indicating high naturd
Febchhed
o ponune visble har eatund, indiicuull
dificult
repiiate wite deepfose techsslogy without noticaatle orfffccts
edge the evegl essesse opoinst skis and hal appeers consstent with expected lighting and perspective, w Thout any
sugest dight
light reflection the anenace ony unomuual syerestry er deprnpprtionate featuree would be indicrters to leennity on outhentic image.
the image
deaphale
Real X
Figure 16:
Dialogue examples FakeShield when receiving authentic face images. The three images all come from the DFFD (Dang et al. 2020) dataset.
27

---

Published as a conference paper at ICLR 2025
User
this picture token directly comenc?
State your conclusion give ransons
tampened with, please outpot
1. Whether the pichure has beer tonsered with bescristion the tompened creal
picture seen tampenet apecifically apper abjests
image,
vibble through
2. Juckmeett bess: The tumpering erdent dae senend factors:
Lightng lyhiing objeets throagh windon room.
2. Edacs odges around the window and ebjects outisik are amntturalyy shora and de Renepective nelctinndip parspactios
with
inclcaling poss dighta
incensistnt with the room't intencer The crnaggeentt and propert one these jectt de with the espacted through sindew.
through window
that the
outrice har been artificis by othnned
Prysical man appsarance and ecement the chyects octside moen they digtclly
Fake, O IoU=0,9 97
Con confirm this picture dinectly the comeno? Provide conclusion with ressors, If tumpered, please show the mask of the aftered area.
Whather picture been tompaned Bescr praza of rpmpeed anea hampered
appeare ba dock mounted en the well Jusgment bans: The tompenin is endann due to ncceral foctora:
emtre croaer
Lightng: lightig
motch surrunding encranment. lighightt
oppears
different
oetertttnntte with the the
Edges The edges
click
unraturally smooth look the texture continulty with
Resskution: far The cleck's reselution
be difffrent from the rest
the dlick appas ring slightly biarier than the sprounding will heatune.
Perspective radomonetip. cleck perspactive does not fully aige properly
It
posttion
well
5. Shottws:: The shadowing the clack dons not correqpond with the light cource and this shodoas present in rest the image, augesting that clock wor origioolly port
Fake, O IoU=0.9 99
Pryaica land The the clock mountedd wall defy physical lovs, there is cler meats support or affochmeen volil.
Figure 17: Dialogue examples of FakeShield when receiving AIGC-Editing tampered images. The three images all come from the self-generated AIGC-Editing dataset and have been tampered with by Stable-Diffusion Daall-Diffusiionnnpaininngg (Lugmayr et al. 2022). The window in the upper left corner of the first picture has been redrawn, and the circular clock area on the left side of the second picture has been redrawn.
28

---

Published as a conference paper at ICLR 2025
Was this image captured stroight from the comera? Share conclusion and If modifications detected, output tompered
tompured picture tompored Descriptin tomponed prea: picture sporning
image. tampared
the immediately above
Judyment bosis
The tomporing exident by the unnaturally smooth transition between the mountoin topo and the locking datoiled texture that would be expacted i natural setting.
There a lock condistent lighting and shadows on the mountoins which do not motch with the rost the image, indicating that this part the image may have been inser nnd or alterest ede The edges the mountoini againet sky are unusually crisp without gradetion atnospheric haze that would normally eccur due
distence.
Additiinally, pixelattion
edges mountaine not mages.
the
foneground, suggesting
Was this image captured stroight from the comero7 Share your conclusion and reasons, If modifications detected, outpu? the tonpered
1. Whether the picturs has been tompaned with Description of the tompered The picture has bean tompered with specifiualy the ground lighthous.. The tumpared is located the right corner of the moge, agonss the horizon where the dry noets the sea.
2. Judgmest basis There are several detais that suggest tampering:
Lighting ny: The lighthouse appears to unnaturall bright compored to the survounding environment, especially givon
the sun setting and
diffused.
Edges: lightrouse
blurry
sharpress the line,
indicoting
The lighthouse
setting direction and the
Perspactive reletionssup: The socle of lighthouse relatin placement the horizon sightlly off making appear if does not quite belong there
5. Physical laws: The lighthouse's reflection the wattr does motch the angle of the sunlight the other ref reffections in the water, brooking the consistency expected pecteed in neal photo.
Was this image captured straight from the comero7 Share your conclusion output the tompered
If modifications
Whether the picture has been tompered with Description of the tompored ores: The picture has not been tampered with It picture taken directly by the comers.
Judgment besis:
Lighting The lighting the mage appears naturdl and consistent The light source scems to be coming from outside the window, costing shodows highlihtts aporopristely the window the objects placed on it. The soft diffure light suggests evercost day or shaded outtidee scenarios.
Copy
eign duplication mirroning
suggest capy
oporation,
unique
Edges:
objects, window; and folloge outside smooth and continuous,
visile signs dishortion abrupt changes that
would indicate lampering
uniferm, with aneas showing signs of blurning joggedness that would suggesi composite image. Perspective: TTee perspactive hee and scale the objects the window sill ore consistent with how they would oppear neal life. The size of the objects relative to each other and their placement gives a sonee of depth that digns with normal visuel perception.
Reselution The resolution of the image
image stroight from the camero?
your reasons, modifications
are defected, output tampered
Whether the picture hat been lompered with Description of the tampered cresi The image oppuart not to have been tumpened with souma be picture taken directly by the comcro.
Jutgment bosis:
Lighting: lighting lightinng envrorment.
consistent direction sunlight, casting
dimber's body, conforma
quality
Copy
duplication
distribution obwioss copy clipping.
Edges: edges
rock face natural with
Resolution
maintoins consistent resolution throughout, with unnotural blurring joapechess that would tomporing.
Perspective: The scole and perspactive the climber agains the rock face are nealistis, and the proportion seen ecourcite.
shodows: The shadows oost by the dliber are consistent with the light source coming from the uppen left. and there unneturdl shadows that would imply moripulatioon
Text: There visible text logos to essess consistency.
7. Physical lows: The clinber' position and squnt bahove as expected undor the force of growty, and there are violctions of physical lows.
Figure 18: MMTD-Set data samples related to PhotoShop tampering. The four images are all from the CASIAv2 data set. The first two pictures have been tampered with, but the last two pictures have not been tampered with.
29

---

Published as a conference paper at ICLR 2025
Was this image coptured stroight from the comero? Share your conclusion and reazors. If modifications are defected, output the tompered areai' mosk
Whether the been tompened with Description the tompored
The picture has been tompened with, the tompered orea on right the inse, extending vertically from the top to the botton of the frome includes the edge of bethroom wall and pertion of black pedestal fon that stunds noxt
Judement
tempered
several inconsstoncies.
right
jagedd
typical stroight
found infertor architecture.
Morcover, the podesttl fon has distorted shope, with the top port of the fon appeoring discornected and floating an without support
shadows and lighting tompored onea do not notch the nest of the image: the shodow the tompered port of lighting cerreapending diteattio resslution the tampened areo also inconssment. with
suncing emirenment
auggesting
appsoring than
the image.
These sinns indicate that the image hes bean edined."
image coptured stroight from the comero? Share your conclusion and russons. medifications are defected, output tompered area' s mask.
tompared
tompered the phone, moot
tompered
tompering leceted untompared margin vaible aroand the edges
2. Judgment bosi::
1. The comennt of the tompened crea inludee jumbled and inverted text, numbers, and symbols that not conform to typical display phone
tompered
original display, showing ononge, yellow,
3. The numbers olep aligned pasit expected for phone's interface, suggatting mamipuatiion the onigna contert. Addihionaly, there a lack continulty with the prone' expected graphical interface, which would sormally displa informatioo oor ongarize and logible narner.
Was this image coptured straight from the comero?
Share your conc conclusion and reasens, If modifications are defected, output the tompered area' s mask.
Whethne
tompered Descrigtion tompored The picture been tompered appears genuine photogroph
Judgment bosis:
The lighting the imape corsistent, with the shodows the cale and the handa indiost light cominng from the left aide, which with the returd shodow costing.
There are atwous egns of duplication nirmoning, and edges the subjects objects are natural without any discontinuttess imreg pizel distrbutiors.
quality image the
signs
ruggert
people
proportienate,
condistent, natural
fowards
back of the image.
The reflect ons and whadoas presect in the imags behave as expected under the lighting conditionn. Texct and legos viiible the background are consistient with their zurounde All content the picture ocheres to physical lows wi thouf any anomollees"
Was this image captured stroight from the camerc? Shore your conclusion and recsonn, medification are defected, output the tampared area's mask.
Whetter the picture has been tompored with Descrigtion the tampered ores: The inage appcars not to have been tampered in looks like photograph
Taleon dinectly e
support ligud
photograph:
lighting
condistont
would drfused light
direction, which
for
indeor setting There harsh shadows insraashen light
tomparing
Copy and Purte There ane ne abr espeating patterrs or mirorred sechion on that would indicate copy and paste operation hes been conducted. solad leoves fork, and other elements the image natural with no signs of horsh art-ficel edges that would suggest Resolution: The image resolution scens consistent throughout the photograph, with
Edges The edges
cutting compesit
blurring pivelation
hompering.
Perspective perspective
fork Shodows: The shodowl cost the fork and the leoves the ld are subtle mitch the lighting the scone. There umatuudd shadows that would nuggest monipuattion
what
Figure 19: MMTD-S data samples related to AIGC-Editing tampering. The four images are all from the self- self-generated AIGC-Editing dataset. The first two pictures have been tampered with, but the last two pictures have not been tampered with.
30

---

Published as a conference paper at ICLR 2025
Was this image coptured stroight from the comens?
Share conclusion ond reasons, modifications defected, the tampared area's
Whether the picture has been tompared with Description of the tampered crea. The picture hat been tompened with, specifically the hoir and ears. tompered areas include the top and sider of the head, extending to caver the full hair region cors
appeors
locks consistent
typical
would narmally
variation color and strond defin thon
2. The edges of the hair near the ferehead and hemp les too sharp and show natural hairlinz real hain usually has nore
imreglarity at the hairline.
3. There is lock of depth and natural shoding argund the esrs, wh con be expected the image was monijuletedt cars typically subtle shadows and more die contoura shope
way
physics, indiooting digital
Was this image cop suptured straight from the comenc?
Share your conclusion and reasons modifications defected, output the tompered crea's mask
Desoription
The picture hos bean tumpared with, specificsly the lower focial region including jowline and the chin, sell snall portion of the neck.
Judgmenn bass:
1. The fompened area oppears have inconsistent skin tone compored to surrounding untompered skir, indicoting pcasi mimretch
tompered coler.
edges
focial jowline
eigns being unnsturally looking typical
def textune
3. There lock natural shadowing and lighting tompered which does correspond with the lighting rreeett the rest the image."
Was this image fured stroight from the comere? Share conclusion and medifications defected, output the tompared
Whether the image hot bsen tompered with/ weth/deerrption of the tompered oress The image does not appear to have been tompered with, The visbll parts the image. inc luding hair and ears, displyy natural var and atynnetries typical of photograph ooph taken directly by camnero. shous neturd veriations hexhure or. with individut dual strands augpesting symmetry, image
Judgmant portially disploys
one typical
contour complex The netural
person. recogrize from
despfoke tumpered
lock visible digital artifects
the conclusion that
authentic
manigulsted."
Was this inage cop tured straight from the camera? Shane your conclusion and rensons modifications ane detected, output the tampared area' mask.
Whether the image has been tompened in thi description of the tompored orea The image appcors to authentic and has not beer tompered with. Vistble parts of image show natural features consistent lightin. Judgmont
sugpests single light appears body that oliges with the actural folds expacted from the febric and the pill growity, These detaile
lighting
highlights. The
have textune indicate that the image is likely real photograph and would stand authentic despfoke tumpered pictures due to the natural incorsitenncess and the coherent lighting that deeeficke images often lack."
Figure 20: MMTD-Se data samples related to DeepFake tampering. The four images are all from the DFFD (Dang al.) 2020) dataset. The first two pictures have been tampered with, but the last two pictures have not been tampered with.
31


Reviews:
[{"review_id": "OAgOViiNVY", "reviewer": "Reviewer_VXsL", "summary": "The paper designs a multimodal framework called FakeShield, which uses the power of large language models to train the model by building a Multi-Modal Tamper Description dataSet (MMTDSet), enabling it to analyze, detect, and locate image tampering. The author uses GPT-4o to generate text descriptions and convert the existing IFDL image dataset into a dataset containing accurate text descriptions.", "questions": "It is recommended that the authors further validate model generalizability as well as quantify and validate the quality of the model explanations.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. FakeShield is the first proposed multimodal large-scale image forgery detection and localization model, which can provide a more reasonable basis for judgment.\n2. By combining visual and language models, the paper's method can provide more comprehensive image analysis. The paper enhances the existing IFDL dataset through GPT-4o and constructs MMTDSet, which also makes a certain contribution to the field of forgery detection.\n3. The DTEFDM and MFLM modules proposed in the paper enable the model to flexibly handle different types of image tampering. This paper has potential value in practical applications.", "weaknesses": "1. The model proposed in the paper may require high computing resources and training time.\n2. The generalization ability of the model on new types of tampering that have not been seen yet needs further verification.  Also further work may be needed to quantify and verify the quality of the model's explanation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rRlNY0oGue", "reviewer": "Reviewer_1sC4", "summary": "The paper employs LLM to enhance existing IFDL datasets from a forgery perspective. Based on these new data, a multimodal and explainable forgery detection method (FakeShield) is proposed. FakeShield first derives text description of the possible forgery type and reasons based on the finetuned LLM, and then uses the text description to guide the output of the forgery location mask. Experimental demonstrations in forgery detection, localization, and explanation aspects demonstrate the effectiveness of the proposed method.", "questions": "- Table 2: Why do competitors CADDM and HiFi-Net only achieve an accuracy close to random guessing? It seems unreasonable that competitors perform so poorly when both the training and testing sets are sourced from FFHQ and FaceAPP. Or, maybe it is because CADDM and HiFi-Net have not been retrained? (Lines 355-357 did not explicitly mention whether these methods were retrained).\n\n- Figure 5: Why does the untrained FakeShield (epoch=0) already achieve an IoU of 0.40 on the CASIA1+ dataset? This result far surpasses the results of well-trained comparative algorithms, such as ManTraNet with 0.09 IoU and HiFi-Net with 0.13 IoU.\n\n- Why is the localization of Deepfake-type data not evaluated in the experiment? From Figures 2 and 19, Deepfake data has masks that mark the forged areas, but the experimental results on Deepfake (Figures 4, 14, and Table 4) are deliberately omitted.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "The paper generates language descriptions for some existing IFDL datasets based on GPT-4o, so as to explain the types and causes of forgeries.\n\nThe introduction of the Domain Tag Generator offers initial predictions of the domain O_det of input images, thereby avoiding conflicts in tampered data domains and precisely guiding subsequent detection/localization models towards the forgery types of interest.\n\nThe proposal of MFLM involves the alignment of textual (O_det) and image features, facilitating the joint prediction of forgery masks from a multimodal perspective.\n\nThe experiment compares the traditional forgery detection and localization with the existing IFDL methods, and also compares with the existing LLMs from the perspective of forgery interpretability.", "weaknesses": "I believe there are some critical issues in the following aspects:\n\nDataset:\n- Using GPT to generate textual descriptions for forgery regions and treating them as ground-truth (GT) lacks comparative validation. While the generation process of these textual GTs involves multiple rounds of dialogue and expert proofreading to ensure accuracy, I believe it lacks internal validation. Specifically, the mask GTs of existing datasets are (mainly) constructed based on the residual comparison between the original (authentic) images and forged ones to prevent mislabeling authentic regions as forgery. However, in creating textual GTs, this comparative process is missing, making it challenging to ensure the credibility of the textual GTs. Therefore, I suggest that GPT should simultaneously receive \"original image, forged image, and/or forgery mask\" for joint assessment, potentially enhancing the precision of the generated textual GTs.\n- Furthermore, Figure 2 depicts the dataset construction process involving \"expert proofreading\", but this procedure is not mentioned in the main text.\n\nMethodology:\n- The modules (LLM, SAM, specialized token <seg>, etc.) and loss functions (ce, bce, dice, etc.) involved in the FakeShield are largely derived from existing works. Therefore, I think its original contribution is not solid enough.\n- Given that the final predicted mask M_loc relies on the guidance of O_det, a natural concern arises: if O_det produces incorrect content (for example, it generates a completely authentic description for forgery data), could M_loc be significantly misled? Along this line, incorporating a corrective mechanism in TCM might better mitigate the aforementioned situation.\n\nExperiments:\n- **Lack of cross-validation**: Although FakeShield can provide detailed explanations for forgery  reasons, it appears to forcefully interpret all forgeries from preset perspectives. For example, in the last case of Figure 16, the inside of the clock is forged, while the external background/shadow, etc. are original (real). However, FakeShield still believes that its shadows do not conform to the light source logic. Therefore, it is necessary to add some forgeries that only contain some types to cross-validate whether FakeShield has truly learned the knowledge of different types of forgeries. For example, manipulating only the shadow part of an image while keeping other aspects such as lighting, edges, resolution, perspective relationships, and physical laws unchanged, to assess whether FakeShield can identify this specific manipulation involving only shadows without affecting the rest.\n- **Lack of stronger generalization evaluation**: Based on the data distribution summarized in Table 7, the evaluation data is not completely cross-domain for training data. Specifically, the sources and creation processes of Deepfake and AIGC data in both training and testing are highly similar (e.g., all the AIGCs are generated by SD-inpainting). Therefore, the claim in Line 382 that FakeShield generalizes well to Deepfake and AIGC tampering is overstated. It is recommended to add completely cross-database data for evaluation, such as adding data from FFIW, CelebA-DF, DFDC, etc. for Deepfake detection.\n- **Ablation experiment is not sufficient**:\n  - Line 505 only evaluates the performance of FakeShield with and without DTG. However, the more critical question is why it is decided to use three forgery domain tags instead of more detailed tags? For instance, following HiFi-Net, it is possible to subdivide Photoshop-type data into splicing, pasting, and inpainting; and subdivide AIGC data into categories like “GANs” or “Diffusion” (of course I understand that all AIGC data in MMTD-Set is produced by the SD-inpainting technique). Similarly, the issue extends to the authentic domain (as per Figure 2, defining only “Scene” and “Face” as authentic tags). Could a broader range of authentic/forgery domain tags lead to performance improvements? I think it requires more in-depth discussion.\n  - The ablation design in the paragraph at Line 515 is inadequate and should further evaluate the results when using only T_tag or T_img. Additionally, the experimentation in this section solely focuses on the CASIA1+ dataset, and there may be potential data bias.\n\nPresentation:\n- While the core focus of this paper is on \"explainable\", the main body of the experiments is still on forgery detection and localization. It may not be appropriate to put the experimental results on explanation in the appendix.\n\nIncorrect formulas/symbols:\n- Eq. (4): \\hat{\\mathbf{O}}_{det} and \\mathbf{O}_{txt} are never defined or explained. The same problem applies to \\hat{\\mathbf{T}}_{tag}.\n- The description of Line 318~322 (including Eq. (5)) is inconsistent with the previous text. Please confirm whether the model's predicted output is \\hat{\\mathbf{M}} or \\mathbf{M}.\n- Does the second case in Figure 14 show an incorrect response? The response is exactly the same as the first case.\n\nMinor Issues:\n- The symbol of Domain Tag Generator in Fig. 3 is a handwritten G, which should be consistent with the bold G used in the text (line 266).\n- The caption of Fig. 3 describes that I_ori will be input into the Tamper Comprehension Module, but this does not match the content of the picture.\n- Line 245: change \"a original\" to \"an original\"\n- Line 1292: change \"the first picture has glasses …\" to \"the second picture has glasses …\"", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GV6ux1KOmo", "reviewer": "Reviewer_aLrU", "summary": "The paper presents FakeShield, a multi-modal framework for explainable image forgery detection and localization. It uses multi-modal large language model to detect manipulations, generate tampered region masks, and provide detailed explanations based on visual artifacts and semantic inconsistencies. Utilizing carefully designed prompts, GPT-4o constructs the MMTD-Set to enhance model training. Incorporating modules like DTE-FDM and MFLM, FakeShield achieves superior performance in detection accuracy and localization across various forgery techniques compared to existing IFDL methods.", "questions": "Please refer to the weakness.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "This paper possesses several notable strengths: \n\n1.Clear motivation and remarkable innovation: This paper firstly proposes an explainable image forgery detection and localization task and innovatively designs a multi-modal large model Fakeshield, which enhances the transparency of forgery detection and effecitively pinpoints the tampered areas. \n\n2.Cross-domain generalization and satisfactory performance: The proposed FakeShield can effectively differentiate and handle various tampering domains such as PS-tampered, DeepFake, and AIGC-based editing. The detection, explaination, and localization performance outperforms most of the SOTA methods, as reported on Tab.1, 2, 3, 4. \n\n3.Dataset construction and potantial contribution: This paper uses GPT-4o to enrich existing datasets through carefully designed prompts, constructing the Multi-Modal Tamper Description dataSet (MMTD-Set). It has the potantial to serve for the IFDL community and future explorations.\n\n4.Clear organization and good writing: The writing and organization of this paper is generally good, easily comprehensible, and effectively presents its methods in Figures 1-3.", "weaknesses": "1.Unclear statement about domain tag generator: The paper does not clearly explain how the domain-tag generator works to handle different types of image tampering. It is suggested to explain the network structure, working principle and training method of domain-tag generator more clearly.\n\n2.Insufficient comparison with DeepFake detection methods: In Tab.2, the paper only compares FakeShield with two other DeepFake detection methods. This limited number of comparison models may not provide a comprehensive evaluation of FakeShield’s performance against a wider range of existing state-of-the-art methods. Please add more deepfake detection method for comparison.\n\n3.Incomplete ablation studies: In Tab.6, the authors only conducted experiments on CASIA1+ dataset for PS tampering, which may have some bias. It is suggested to verify the role of domain-tag generator on more datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)