Detective SAM:  Adaptive AI-Image Forgery Localization
Authors: Gert Lek
Nicolas van Schaik
Chaoyi Zhu
Pin-Yu Chen
Robert Birke
Lydia Y. Chen
Venue: ICLR 2026 Poster (2026)
Keywords: Image Forgery Localization
Diffusion Models
Dataset Creation
Generative Models
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: We propose a new method for diffusion-era image forgery localization that adapts SAM2 with perturbation-driven heatmap prompts and automatically constructs diffusion-edit datasets.

Abstract: Image forgery localization in the generative AI era poses new challenges, as modern editing pipelines produce photorealistic, semantically coherent manipulations that evade conventional detectors while model capabilities evolve rapidly.
In response, we develop Detective SAM, a framework built on SAM2, a foundation model for image segmentation, that integrates perturbation-driven forensic clues with lightweight feature adapters and a mask adapter to convert forensic clues into forgery masks via automatic prompting.
Moreover, to keep up with the rapidly evolving capabilities of diffusion models, we introduce AutoEditForge: an automated diffusion edit generation pipeline spanning four edit types. This supplies high-quality data to maintain localization accuracy under newly released editors and enables continual fine-tuning for Detective SAM.
Across seven benchmark datasets and seven baselines, Detective SAM delivers stable out-of-distribution performance, averaging 36.99 IoU / 44.19 F1, a 33.67% relative IoU gain over the best baseline. Further, we show that state-of-the-art edits cause localization systems to collapse.
With 500 AutoEditForge samples, Detective SAM quickly adapts and restores performance, enabling practical, low-friction updates as editing models improve.
The pretrained weights, AutoEditForge, and evaluation script are available at https://github.com/Gertlek/DetectiveSAM

Published as a conference paper at ICLR 2026
DETECTIVE SAM: ADAPTIVE AI-IMAGE FORGERY LOCALIZATION
Gert Lek' Nicolas Van Schaik? Chaoyi Zhu Pin-Yu Chen' Robert Birke* Lydia Y. Chen 1.2
'University of Neuchâtel
Delff University of Technology 4 *University of Turin
'IBM Research
gert .ett.lekunnneeco
ABSTRACT
Image forgery localization in the generative Al era poses new challenges, as mod- ern editing pipelines produce photorealistic, semantically coherent manipulations that evade conventional detectors while model capabilities evolve rapidly. In re- sponse, we develop Detective SAM, framework built on SAM2, foundation model for image segmentation that integrates perturbation-drive with lightweight feature adapters and a mask adapter to convert forensic clues into forgery masks via automatic prompting. Moreover, to keep up with the rapidly evolving capabilities of diffusion models, introduce AutoEditForge: mated diffusion edit generation pipeline spanning four edit types. This supplies high-quality data maintain localization accuracy under newly released editors and enables up-to-date periodic fine-tuning for Detect i ve SAM, Across four benchmark datasets and seven baselines, Detective SAM delivers stable out-of- distribution performance, averaging 34.68 IoU 42.03 F1, 38.94% % relative IoU gain over the best baseline. Further, we show that rate-of-the--a art edits cause lo- calization systems to collapse. With 500 AutoEditForge samples, Detect ittiiv ve SAM quickly adapts and restores performance, enabling practical, low-friction up- dates as editing models improve. The pretrained weights, AutoEditForge, and evaluation script are available at (he GitHub repository
forensic clues
auto-
INTRODUCTION
Deep learning has democratized photorealistic image generation. Synthetic images from modern models are often indistinguishable (Ramesh et al. 202T) to the human eye. Targeted edits can change identities, alter evidence, and mislead viewers even when the rest of an image authentic (Kadha et al.. 2025). As virtual environment floods with such content, there is urgent need to identify where an image has been altered. Image forgery localization (IFL) can be challenging in the context of modern local editing, where small, realistic insertions and removals frequently evade human perception. Figure [ displays such an edit from NanoBanana (Gemini 2.5 Flash Comanici al. 2025)) and the predictions.
Legacy IFL targeted splicing and copy-move operations (won et al. 2021 Using forensic clues, which are signals leveraged for edit detection and localization, they detect cross-image merges and within-image duplicates. Powerful modern generators, including diffusion models like DALL-E, render legacy clues and methods outdated (Ramesh al.) 2022] Zhang et al. 2024). By design, legacy IFL relies on camera or compression artifacts, which modern generator edits lack because their artifacts are from the generative process (K (own al. 2021 Guillaro et al., 2023). New dif- fusion datasets reveal significant localization drops (Nguyen et al. 2024 Zhang et al. (024); rapid progress in generative models creates a moving target that requires up-to-date data and training.
This paradigm shift, brought by diffusion models, initiated surge in research on stronger foren- sic clues. Part of this surge shows empirical success with training- freee (Ricker et al.) 2024; Tsai et al. 2024a; He al. 2024) and zero-shot (Cozzolino et al. 2024) methods that rely explicit perturbation artifacts in the embedding space of foundation models. Image foundation models learn
embeddings through large-scale selffsuppervsioo (Dosovitskiy al. 2021 Oquab et al.
2024). Such

---

Published as a conference paper at ICLR 2026
embeddings reveal distribution shifts in diffusion outputs under perturbations such Gaussian noise or blur, providing a strong forensic clue for diffusion edits. The recently released Segment Anything
Original
Tamperci
GT Mark
Detectine SAM
Fakehhisid
TruFur
SAFIRE
Mosech
Change
Figure I: For a NanoBanana sample: original image, tampered image, Ground-Truth (GT) mask, Detective SAM (ours) and baseline mask predictions, limited to models that produced output, for all models see Appendix B.I
SAM2 Ravi et al. (2024)) serves a domain-speciie foun- dation model for image segmentation, using strong, large-scale pretrained encoder. Downstream task performance of SAM has been outstanding (Chen et al. 2024), with applications to shadow & camouflage detection (Jie & Zhang 2023 Meeran al.) 2024) and IFL. In IFL, SAM is redirected from object to forged-region segmentation. Applications of SAM to IFL are still emerging: current methods (Kwon et al. 2024 Zhang al. 2025) tend to emphasize legacy forgery methods and
Model (SAM Kirillov al. (2023).
neglect more diffusion specifcc clues.
Three persistent problems hinder current IFL systems: 1) Current approaches typically avoid using forensic clues that characterize modern edits, failing to leverage the prior information embedded in foundation models. Model architectures should support efficient integration of fresh edited data as appears, adapting efficiently and avoiding catastrophic forgetting; and, 3) systems must stay effective on recent strong editors, but our experiments show consistent drops on newly released models, indicating a need for continually refreshed training and evaluation data.
In response, we propose Detective SAM, practical framework for modern IFL that addresses these challenges. Building on the insight that the large-scale pretrained SAM2 encoder can de- tect shifts in the embedding distribution, Detective SAM converts this perturbation-driver forensic clue into an automatic heatmap prompt for SAM2, addressing 1). Through lightweight feature adapters (Chen et al., 2024). SAM2's decoder is retargeted from object segmentation forgery lo- calization. The backbone of SAM2 remains frozen, and only our modules are trained, mitigating forgetting and enabling efficient, lightweight fine-ture tuning with replay as new editors appear, attending to 2). Figure summarizes the architecture and SAM2 interactions.
Finally, we directly operationalize challenge 3) via AutoEditForgee, ensuring that training and eval- uation data remain current. AutoEditForge is automated pipeline that produces human- like lo- cal generative edits of real images with pixel-accurate masks across Replace, Remove, Add, and Change Partially edit methods. It is symbiotic with Detect ive SAM: AutoEditForge supplies fresh edited-real image pairs that enable both evaluation and rapid adaptation. Our contributions to IFI. generative edits as follows:
1. Detective SAM architecture We extend SAM2 for the image forgery localization task with (i) perturbation-driven feature embeddings as a forensic signal, (ii) lightweight adapters that spe- cialize the SAM2 decoder for forged-region segmentation, and (iii) a learnable prompt module that maps the embeddings to a heatmap prompt guiding SAM2 localize forgeries automatically. Detective SAM for fine-tuning & evaluation AutoEditForge, an automated pipeline for Partially), keeps data current
instruction-based local edits Cccplacc/Remove/Addd/ee editors evolve and enables up-to-date periodic fine-tuning and evaluation. Coupled with Detective SAM 's adapters, designed for efficient fine-tuning, this yields quick recovery of metrics like loU/F1 on new editors while preserving prior performance.
3. Comprehensive evaluation Detective SAM is benchmarked on eight datasets across seven base- lines, delivering strong and stable Out-Of-Dii Df-tistribttiin (OOD) results, yielding 38.94% gain in average OOD loU relative to the best baseline. We demonstrate that localizers collapse on recent diffusion edits, necessitating constant fine-tuning.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
Image forgery localization. IFL concerns itself with the task of not only detecting if parts of an image are manipulated, but also pinpointing them pixel-wise. An effective signal or "forensic clue" is required to locate image forgery. These clues/artifacts can include reconstruction error (Vesmin et al. 2024), JPEG compression artifacts (Kwon et al. (02I), explicit noise artifacts (Zhul et al. 2024a), implicit noise artifacts (Zhang et al. 2025). Implicit noise artifacts trained networks that extract specific artifacts from images, such as Noiseprint (Cozzolino & Verdoliva, 2018 Guillaro al. 2023). In contrast, explicit noise artifacts process features from perturbations
without retraining.
Recent work has shown explicit noise artifacts in the embedding space of foundation models. RIGID (He et al. (024) and BLUR (T'ai et al. (0224) show that is possible to detect synthetic diffusion model images using the DINOv2 (Oquab et al., 2024) image foundation model training free manner by detecting subtle embedding distribution shifts. The empirical results show that explicit artifacts appear promising for diffusion model forgery localization/detection. Traditional localiza- tion models typically use implicit noise artifacts for copy-move and splicing forgeries, (Kwon et al.) 2021 [iu et al. [022] Guillaro et al. 2023). These methods work well under traditional forgeries, as implicit noise artifacts can effectively capture the compression/camera artifacts of the forged source image. new branch of IFL using
(MLLMs) arose with models such as SIDA (Huang et al. 2025) and FakeShield (Xu et al. (025). These methods lever- age the text-to-image nature of diffusion model edits to localize forgery and provide explanations.
SAM in IFL. Adaptations of SAM for IFL have attracted considerable interest (Kwon et al. [024]
Lai et al,, 2023) Zhang et al. 2025). These methods seek to distinguish manipulated regions from genuine content by training SAM segment forged areas in contrast the conventional object segmentation task. For example, SAM is adapted for deepfake localization (Lai et al.,
2023) with
a reconstruction-error signal or used in multi-source forgery partitioning (Kwon et al.,
2024 with
large-scale contrastive pretraining and fixed 16x point grid. However, diffusion based tam- pering often manifests itself in subtle artifacts and highly irregular regions. Therefore, we require learnable prompts that dynamically adjust to the unpredictable patterns of diffusion-basse forgeries. IMDPrompter (Zhang et al. 2025) achieves this with a learnable heatmap and box prompts employ- ing various filters/views as the signal. This technique neither uses an explicit perturbation-driven signal nor builds upon the strong SAM adaptation results from Chen et al. (2024). Therefore, they retrain SAM2's 's mask decoder. Chen al. (2024) demonstrate robust downstream performance in camouflage, shadow and medical image segmentation via lightweight feature adapter fine-tuning. Other approaches use SAM's segmentation capabilities without learnable prompts (Su al. 2024).
Diffusion dataset generation. IFL dataset generation has evolved from manual mask and edit prompting (Jia et al. 2023)), to using crowd-workers (Zhang et al. 2024), and, present, fully- automatic dataset creation (Huang et al. 2025) eu et. 20.02 These fully-automatic pipelines are limited in diverse editing operations like Replace, Remove, Add, and Change Partially, and typically do not employ the most recent diffusion models. Appendix C compares representative pipelines.
DETECTIVE SAM
We consider the task of image forgery localization, where given an RGB image I E 3 with three channels, height H and width W, we aim to predict binary mask B E {0, 1 with Bi = 1 if pixel j) has been edited/tampered, and 0 otherwise. This work strictly focuses on edits generated by diffusion-based image-editing pipelines. diffusion model processes an instruction to generate local edits of a source image, as in Figure [ Keeping the area around the edit unchanged involves overwriting the latents within the mask injecting noise only inside the masked area (Wul
et al.
2025 Lugmayr et al. 2022).
3.1
OVERVIEW
Detective SAM augments SAM2 Ravi et al. 2024) with perturbation-driven feature stream and lightweight adapters while keeping the backbone frozen. Feature adapters fine-tune SAM2's decoder, and the mask adapter prompts the decoder. This aligns both the decoder and its input with
3

---

Published as a conference paper at ICLR 2026
the forgery localization task. The architecture involves: 1 creating perturbed embedded features; 2 correcting the original feature with the perturbed ones using Feature Adapters; and 3 all features are then used to create a forensic heatmap prompt with the Mask Adapter, with the respective steps We next describe the process in more detail, for overview of notations,
visualized in Figure 2
see Appendix A
Forensic Porturbations
M
Mlei rull
Preeztt Treader
Prompting Module
HIERA Imagee Truoder
Delta Correction
{Fs)
B
Figure 2: Flow chart of the steps in Detective SAM with our learnable modules and pipelines in white and SAM2's * frozen modules in gray, With input image I, perturbed images I';, heatmap prompt M, adapted features {F,) } and binary forgery mask B. See Appendix B.2 for flowchart of the original SAM2 components.
3.2 MODEL. ARCHITECTURE
We build on SAM2 Ravi et 2024), promptable image/video segmenter featuring HIERA image encoder (Ryali et al. 2023) producing embeddings at three spatial scales, prompt encoder for points, boxes, or heatmaps, and a mask decoder that inputs prompts and multi-scale features. The SAM2 backbone (HIERA encoder, prompt encoder, mask decoder) remains frozen. SAM2 was chosen as the backbone because it has a powerful encoder and a promptable decoder that can be adapted due to the joint encoder-decoder training.
Our lightweight adapters are trained jointly, yielding: (i) Three feature adapters (for all three HI- ERA scales), which input the perturbed image embeddings as forensic clue and perform AF, correction output the adapted features { : and, (ii) A mask adapter, which consists of an auto- matic prompting network, producing heatmap M for the decoder. The feature adapters are single convolutional layers, and the mask adapter contains a transformer that operates in downscaled embedding space, keeping the model's parameter count modest: with layer width 64, the feature adapters use 81k parameters and the mask adapter 887k parameters. This implics that the model can be trained in two hours on an NVIDIA H100 GPU. Training and inference efficiency are critical for platform
deployment. IFL systems deployed rately in environments with limited resources. The rapid advancement of diffusion models requires frequent fine-tuning, necessitating training efficiency.
the consumer side need to localize accu-
Inputs and encoding. As first step, we construct the forensic feature embeddings for our adapter modules. Given an input image I. we create N perturbed images Iς Perturb; (Z: 6) using simple image-space operators Perturb;
1, ..., N (e.g., Gaussian blur, Gaussian noise, and JPEG compression) with perturbation parameters 0. Diffusion models show embedding shifts under such perturbations (He et al., 2024 Tsai et al. 2024b). Detective SAM leverages these as forensic clues in the form of localization prior generative artifacts.
Both I and I are encoded by the frozen SAM2 HIERA encoder (Ryali et al. 2023 to produce embeddings {F? FT':) at hierarchical scales (S {32, 64, 128}) at (H, W) (512, 512) res- pad using SAM2's frozen
olution. To match the image format expected by SAM2's decoder, no-memory (image) embedding, at s = 32: and use SAM2's frozen convolutional processing layer F, = ConvSAM( X,) for s E {64, 128). For brevity, without loss of generality, we restrict ourselves to single perturbation yielding six feature embeddings {FI, F across scales.
Feature adapters (delta correction). Next we correct the basic feature embeddings {FT) using the forensic perturbed embeddings (F.²) that the decoder focuses forgery localization rather
4

---

Published as a conference paper at ICLR 2026
than generie object segmentation. We achieve this with lightweight feature adapters {AAg} that input the concatenated basic and perturbed { {FT, FT'1 to produce residual delta correction. The AF, corrections used to adapt the unperturbed features via residual connection to produce features;
F. F. AA.
AP. A. (LP,2
which are injected into SAM2's decoder, following the architecture of Chen et al. (2024). The feature adapters single-layer 1 convolutional networks and specialize the frozen SAM2 decoder to the downstream IFL task with minimal overhead. We provide examples of the learned feature corrections through saliency map in the Appendix B.4
Mask adapter (automatic prompting). With the decoder specialized to the IFL task, replace SAM2's manual user prompt by introducing a mask adapter that uses the forensic clue to generate an automatic heatmap prompt M for the decoder. Possibilities for such a prompt are either point, a bounding box, or a heatmap. We use a heatmap because it reflects the spatial structure of the forensic signal. contrast, point- or box-based prompts largely disregard this information. The mask adapter maps all features into a heatmap prompt M suitable for SAM's decoder. It ingests all features {FT, FT F&) and first bilinearly upsamples them common fine grid max S. We then perform ccoss-scale, cross-stream convolutional fusion to obtain a unified feature tensor Fruse E [dxxxx Such fusion is spatially consistent as in HRNet (Wang et al. 2020), and lightweight due to shallow cross-scale mixing.
To enforce global consistency, we
lightweight transformer coarse resolution; its self- attention aggregates context across patch tokens and suppresses spatially inconsistent forgery esti- mates, see the Appendix B.3 for visual examples. Taking input Fiuse. the transformer operates downsampled, patchified representation to produce low-resolution coarse logits Leearse and an un- certainty logit map E & Where the downsampling factor treated as a hyperrpaameetr. Both are upsampled back to the common grid s, yielding Leoarse E IR 8x& and U E R
Restoration of fine boundaries requires merging high-level context with local detail; we do this by mixing context through linear spatial gating, as in (Chen et al. 2016). We produce refined logits Trrefine & from Fruse via a 2-layer convolutional network. Finally, we apply spatial gate g E 00, 1] _| to linearly blend refined and coarse predictions into the decoder mask:
M g Lrefine + (1-g) Lenarse-
The gate g is 1 x 1 convolution layer followed by sigmoid with input [Teomaree U] that down- weights refinement where the coarse mask is confident (or uncertain), stopping over-sharpening in unedited regions while allowing detailed corrections where needed.
Mask decoder Before decoding, we bilinearly upsample the heatmap prompt M and adapted features [F, to 256 for finer mask generation and input them to the frozen SAM2 mask decoder to obtain forgery logits M 256x256. We choose 256x256 because it is close to the minimum image resolution in our data, which helps avoid extreme extrapolation artifacts in the final binary mask. Finally, following SAM2 precisely, we bilinearly upsample M the image resolution and convert to probability map via a sigmoid operation: (MM. The final forgery binary mask is B = (M) 2 2.
Loss function
Training the mask and feature adapters follows SAM2's objectives (Chen et al., 2024). combining focal loss (Lin al. 2018). Dice loss and loU loss. Dice loss maximizes the overlap between the predicted and ground-truth masks by penalizing their normalized differences. Focal loss further addresses the class imbalance in IFL. The loU loss trains SAM2's ss IoU prediction head via an L1 loss on the forgery mask IoU, All losses take the ground truth and the model's pre- dicted masks as inputs. The predicted mask is computed using only the tampered image. Formally, final objective is
L = LDice + Atocal 2 + Alo LIOU-
The focusing parameter 7 0 down-weights well-classified examples. The balance factor [0, re-weights positive vs negative examples to counteract class imbalance. We borrow Afocal = 20, AtaU from the SAM2 paper (Ravi et al.) 2024) and sweep over (a,7).
5

---

Published as a conference paper at ICLR 2026
3.3 AUTCEDITFORGE. FUELING DETECTIVE SAM BY AUTOMATING AI-DRIVEN EDITS
To address the critical shortage of up-to-date, high-quality testing and fine-tuning data for forgery localization models, we introduce outiEaFooorge a novel automated infrastructure for up-to- date periodic IFL robustness. This fully automated pipeline generates realistic image edits with pixel-accurate segmentation masks. Unlike existing synthetic datasets constrained by either labor- intensive manual annotation that limit scale or automated approaches that compromise realism through simplistic inpainting with limited edit variety (Kwon et (0024) Aut www.EEiiFoFooooooooo tFrog lever- ages state-of-the-an (SOTA) diffusion models to mimic the diversity of human-like edits, enabling continual evaluation and fine-tuning. Aut oftiiEiiFF F. Forge implements two-pass architecture that separates lightweight analysis from computationally intensive editing operations, enabling efficient processing of large-scale image batches.
First pass: analysis and decision making. The first pass performs comprehensive scene analysis to identify editing opportunities. Florence-2 (Xiao et al. 2023) conducts dense image captioning and object detection with bounding box extraction. An LLM (Gemma 3 12B-it (Team et al. 2025 then
analyzes the detected objects and scene context to determine the most appropriate editing strategies for each image. The system selects from four editing methods:
Replace: Substitutes existing objects with semantically similar alternatives while maintaining
scene coherence. For example, replacing a golden retriever with a Labrador, or a red apple with a green pear, preserving logical consistency while introducing variation.
Remove: Eliminates objects from the scene. For instance, removing newspaper from a person reading on park bench, filling the area utilizing contextual understanding.
Add: Introduces new objects in suitable locations based on spatial and semantic analysis. Ex- amples include adding birds to sky regions or pienic baskets to grass areas, respecting scene perspective and environmental coherence.
Change Partially: Alters object attributes while preserving the object's identity and overall structure. This enables transformations such as material changes (wooden to metal chair), texture modifications (plain to brick wall), or style updates (modern to vintage car design).
Second pass: segmentation and inpainting. The second pass executes the specific editing oper- ations determined in the first pass. SAM2 (Ravi et al., 2024) generates precise pixel-level segmen- tation masks using bounding box coordinates from Florence-2's object detection. iitructtio-bbase diffusion image editing models then perform the actual image editing operations based on the se- lected strategy and target target regions. The pipeline includes several post-processing techniques to ensure robustness: hole filling for mask continuity, disconnected component analysis for fragmented ob- jects, size-based filtering remove spurious detections, and morphological operations for mask refinement. For implementation details and prompting examples, see Appendix D
Detective SAM and Aut AutEEdiFoorge istic, instruction-guider edits from the latest generative editing models. Detective SAM ingests this stream via adapter fine-tuning, which aligns the frozen SAM2 decoder and its prompts to the current distribution of editing techniques. The result is a practical lifelong learning loop: evaluate on fresh edits, surface errors, fine-tune adapters, and redeploy, all while keeping the backbone fixed and maintaining robustness across evolving editors and instructions.
AutoEdi t Forge supplies steady stream of real-
4 EXPERIMENTS
Training specification. Detective SAM is trained on 10k samples of SIDA (Huang et al. 2025) and all 8807 train samples of MagicBrush (Zhang et al. 2024). We OOD test on CoCoG LIDEE UltraEdit (Zhao et al. 2024), AutoSplice (Tia et al. 2023). NanoBanana (Comanici et al.) 2025) NanoBanana is generated with AutoEditForge. All datasets are diffusion-edited: full details in Ap- pendix G Detective SAMSOI is fine-tuned on 500 samples of FLUUX-Bench (Labs et al. 2025 and OWEN-Bench (Wu et al. 2025) (1000 total, created with AutoEdit Therefore, CoCoGLIDE, AutoSplice and NanoBanana six values, where the values depend on the noise type. Other hyperparameters are tuned over a grid in the Appendix H
always entirely OOD. The noise intensity is tuned over range of

---

Published as a conference paper at ICLR 2026
Testing setup. Our results are divided into three regimes: (1) In-Distribution (ID): Test on the out- of sa-see test set of our training set. (2) Out-Of--Distriution (OOD): Test on completely unseen test sets for a fair comparison to basclines. (3) Fine-tuned: The pretrained Detective SAM is fine- tuned on 500 samples of the respective datasets to evaluate adaptation efficiency. Fine-tuning. Fine-tuning of Detective SAM is performed with the concept of direct replay (Zhou et al.) (024). We mix 20% of the original MagicBrush & SIDA training data with our new FutoEditForge samples mitigate catastrophic forgetting. The loss function remains unchanged, and validation is done on the relative validation mix of replay and fine-tune data.
Evaluation Metrics. Performance is evaluated with pixel-level mean Intersection over Union (loU) and mean Fl score. IoU measures the overlap between the ground truth forged mask and B, and F1 score serves as harmonic mean between pixel-Ievel precision and recall. See also Appendix F.
Detective SAM's forgery localization performance is evaluated against comprehensive list of recent baseline models: SAFIRE (Kwon et al.) 2024), Mesorch (Zhu et al., 2024b), TruFor (Guillaro al. 2023), AdalFL (Li et al. 2025). ) PSCC-Net (Liu et al. 2022) and the MLLM lo- calizers SIDA-7B (Huang et al. 2025) and FakeShield (Xu et al. 2025). The total parameter count and computation per inference differ significantly. SIDA has 7B parameters, FakeShield has 23B, and SAFIRE uses 256 parallel SAM inferences for each sample. All inference is done on a single NVIDIA H100 GPU; Appendix F6 for the throughput of each model. Performance is judged purely on OOD scores for a fair comparison.
Baselines.
4.1 RESULTS
We present our results in two parts. First, we showcase Detective SAM's and the baselines' perfor- mance on OOD data. Second, we showcase the results on our harder AutoEditForge state-of-the-ar datasets to highlight performance collapse and Detective SAM's efficient fine-tuning.
Comparison with state-of-the-art (SOTA) methods. Table compares the baseline against De- tective SAM's performance. On the four OOD datasets (CoCoGLIDE,, UltraEdit, AutoSplice, NanoBanana), Detective SAM significantly outperforms the baselines. We notice strong results of several baselines on particular datasets; e.g., SAFIRE scores an Fl score of 46.38 on CoCoGLIDE, but the performance significantly degrades on all other datasets. Hence, we also present the average IoU and Fl across the four OOD datasets. Table D shows that TruFor is the strongest average base- line. All models suffer significant performance drop NanoBanana, model dataset. Only two rows in Table are II), while the rest are OOD, which reflects the intended operating regime, being more diagnostic of real-world reliability.
most recent diffusion
We underscore Detective SAM's generalization performance. Whereas most models have unstable scores over datasets, Detective SAM has similar in- and out-of-distribution scores and has the highest OOD scores (loU= = 34.68 and Fl = 42.03). Note that TruFor and SAFIRE report an alternative F1 score calculation; for more information on comparability, see Appendix E.2
Table 1: Six-benchmark evaluation. Legend: ID OOD All baselines are run inference- only with appropriate preprocessing. The last column contains the average scores for CoCoGLIDE, AutoSplice, and NanoBanana (OOD for all models).
MagicBrush F1
SIDA
CoCoGLIDE IoU
Ultraldit IoU
AutoSplice loU
NanoBanana IoU 1
Avg OOD
Model
IoU
1
F1
F1
F1
SAFIRE
2024
21.02
27.04
21.35
27.43
42.22
46.38
18.41
24.00
18.71
24.53
11.39
15.25
22.68
27.54
Mesorch
20246
16.18
37
13.19
20.29
36.45
44.50
5.45
7.51
27.53
38.77
10.22
13.85
19.91
26.15
TraFor
2025
26.41
34.55
20.08
28.35
37.76
45.82
16.15
22.35
43.34
58.87
2.59
3.19
24.96
32.55
AdalF1
2025
12.18
20.99
12.77
18.98
20.90
26.58
7.73
11.23
11.23
33.73
8.70
11.95
12.14
20.87
SIDA
2025
22.94
26.57
39.12
52.87
13.24
15.53
3.29
4.45
39.31
48.28
0.09
0.02
13.98
17.07
FakeS
2025
8.81
12.08
11.66
13.77
13.72
14.99
12.98
18.32
23.75
29.53
9.57
10.75
15.01
18.40
PSCC-Net
2022
9.80
2.50
37.60
10.06
15.43
42.43
12.73
13.26
27.18
Detective
SAM
46.48
57.55
54.55
65.29
44.74
$1.50
27.74
35.54
46.90
60.30
19.34
20.77
34.68
42.03
Visual results. Figure 3
showcases the mask predictions for each baseline and Detective SAM.
We observe inconsistent results over the datasets, with multiple models detecting SOTA images as authentic (black mask) while correctly localizing legacy (AutoSplice, CoCoGLIDE) samples. We provide several low loU Detective SAM failure cases for each dataset in the Appendix F.5
AutoSplice shares the same editing model MagicBrush, see Appendix
7

---

Published as a conference paper at ICLR 2026
Gooudda
P
Figure Overview of qualitative results across all models and datasets. Each row corresponds to dataset sample and each column to the original and tampered images, the ground-truth mask, and each model's predicted mask. For SIDA, the original and tampered are equal, since (original, tampered) pairs are not provided in the test set.
Model collapse and fine-tuning, We investigate the performance on SOTA AutoEditForge datasets and analyze Detective SAM's lightweight fine-tuning. Table P shows the scores for our created SOTA datasets: FLUX-Bench, QWEN-Bench and NanoBanana. Focusing on all models, we notice an all-round performance drop. SAFIRE outperforms on QWEN-Bench, with Detective SAM showing stable results across all SOTA datasets
Although outperformance on prevailing benchmarks is often taken as evidence generalization in IFL, the results demonstrate that such gains do not carry over to SOTA diffusion-based edits, as none of the evaluated detectors generalize effectively and all exhibit substantial degradation. This emphasizes the need for periodic adaptation future-proyd proof systems, e.g., periodic fine-tuning, as increasingly more capable models are released.
As SAM2's backbone weights are frozen, and our adapters are lightweight, Detective SAM lends itself to efficient fineinuning. We fine-tune Detective SAM on 500 samples both FLUX-Benee -Bechh and QWEN- -Bnnhh (not NanoBanana),
create Detective SAMSOTA shown in the final row of 2 Fine-tuning restores Detective SAM's capabilities on both FLUX-Bende and QWEN- Bench datasets, with loU of 43.08 and 41 1444, respectively. Consider that these datasets are Detective SOMSOTA, and therefore cannot be compared to basclines' results directly in Table 2 Detective SAMSOTA's average OOD performance improves to an IoU of 35.57 and Fl of 45.62. This can be attributed to significantly increased performance on NanoBanana due to the exposure to the more recent FLUX and QWEN data. Full scores are the Appendix F.3.
ID for
FakeShield Xu et al. 2025) underperforms on diffusion edits, consistent with its reported AIGC results. However, they report strong results on traditional copy-move and splicing forgery. SIDA's (Huang al. 2025 low score is due to the seaecttthe--lccaiii pipeline misidentifying tampered images as authentic.
8

---

Published as a conference paper at ICLR 2026
Table 2: FLUX-Bench, QWEN-Bench, and NanoBanana results for all baselines, Detective SAM and the fine-tuned Detective SAMSOTA, Legend: ID Detective SAM (ID); others are OOD.
OODD
Gray rows were used to fune-tune
QWEN-Bench
NanoBanana
Model
IoU f
FI f
IoU f
F1 f
IoU f
Fl f
SAFIRE
2024
19.03
22.53
21.72
26.87
11.39
15.25
Mesorch
2024b
10.59
14.35
10.04
15.26
10.22
13.85
TruFor 2023
19.34
22.67
19.42
22.76
2.59
3.19
AdaIFI.
2025
6.62
9.21
6.62
8.40
8.70
11.95
SIDA [2025
0.89
0.99
0.82
0.95
0.09
0.02
FakeShield 2025
8.57
9.51
9.77
11.04
9.57
10.75
PSCC-Net [2022
12.65
14.83
13.46
15.28
12.73
13.26
Detective SÄM
18.70
21.28
20.41
22.29
19.34
20.77
Detective SOTA
43.08
52.52
41.44
51.49
27.00
36.21
Finally, fine-tune Detective SAMSOTA on different amounts of samples, with and without play. In the Appendix [F3.44 Figure 13a we observe an initial drop in OOD performance due to overfitting on the limited number of samples. As the number of samples increases, the ID and OOD performance is retained while increasing the fine-tuned scores. The importance of replay is evident from the ID performance drop and lower OOD scores Figure 13b
Impact of edit method. Appendix F.4 reports average IoU by edit method. The largest gap is between Replace and Remove: on QWEN QWEN-Bench. 22.95 vs 10.58, 116.92% difference; on FLUX- Bench, 17.61 vs 9.31, an 89.15% difference. This suggests that SOTA datasets require editing methods that are more diverse than just inpainting: otherwise, methods such as removal will not be detected in-the-wild.
Impact of external perturbations. Appendix F.2 shows the effect of pre-processing the images with increasing perturbations for Gaussian Blur, Gaussian Noise, and JPEG compression. Upon analysing the figures, we observe that Detective SAM is relatively robust to Gaussian Blur and Noise. These are the types of perturbations that are used as forensic clues. This suggests that external noise added to the input affects both streams similarly, and the difference between them remains informative. In terms of robustness to JPEG compression, Detective SAM is line with the baselines.
4.2 ABLATION STUDIES
All ablations are run on our training set of SIDA and MagicBrush and their validation splits with SAM2 frozen and identical training/tuning protocol.
Impact of perturbation type. Table shows that the perturbation type has a significant impact on the localization performance. We notice that Gaussian blur performs well, and that a combination of Gaussian noise and blur performs marginally better. This is in line with MINDER (Tsai et al.) 2024b), which combines both types for improved image forgery localization performance. How- adding JPEG further improves performance, demonstrating the practical strength of explicit perturbation signals. This paper uses Gaussian Blur and Noise to align with prior findings.
Mask adapter design. Analyzing Table 3b our more intricate architecture (downscaled trans- former, uncertainty, and spatial gating, see Section 3.2) improves validation performance com- pared to a straightforward convolutional network. Feature adapters drive the largest gains by enabling forensic embeddings to exploit SAM2's decoder image-prior for forgery localization. Impact mask decoder. We train Detective SAM using the heatmap from the mask adapter di- rectly for localization without SAM2's decoder. Displayed in the final of Table (3b The significant performance drop without the mask decoder indicates a substantial benefit from uti- lizing the information contained in SAM2's decoder training.

---

Published as a conference paper at ICLR 2026
Impact of noise intensity. The noise intensity for perturbation is chosen the value with the highest validation performance over a range of six values. The best performing intensities for Gaussian noise & blur combination is plotted in the Appendix F.I]
Table 3: Detective SAM ablation study using the validation performance on SIDA and MagicBrush.
(a) Perturbation ablation
(b) Architectural ablation
Perturbation
loU f
F1
Configuration
loU f
Fl
JPEG Noise Blur
52.58
63.08
Detective SAM
50.52
61.42
Noise + Blur
50.52
61.42
Simple convolution
44.48
54.99
JPEG Blur
48.66
59.08
w/o Feature adapters
14.29
20.21
Gaussian
48.17
$7.78
Without decoder
36.41
47.81
JPEG Noise
46.56
56.95
indentation implies cumulative ablation.
Noise
43.44
52.60
JPEG None
42.56
51.02
36.22
44.75
5 CONCLUSION
Detective SAM advances diffusion-based forgery localization, reaching mean out-of- distribution IoU of 34.68, representing 38.94 increase across out-of-distribution baselines and over four test-sets. It has been demonstrated that IFL. systems exhibit superior performance in the forensic signals that incorporate robust segmenta-
presence of strong, explicit perturbation-bast tion backbone. Furthermore, the efficacy of up-to-date periodic fine-tuning has been established as a prerequisite for the advent of novel diffusion editors, a process that AutoEditForge facilitates.
Limitations. Our reliance on perturbation-ddrien cues makes performance sensitive both the specific cues and the strength of the perturbation. Further research should investigate adaptive per- turbations and increasing the number of perturbations, as validation performance seems increase with the number of perturbations. Classical copy-move and splicing forgeries do not contain the same Lufffusion-ensitiiii artifacts; thus, different signals and broader training are required and should be investigated. A ready-to-deplyy model should use training fully synthetic and authentic im- ages to mitigate false positives/negatives.
By articulating these steps, we aim to advance the IFL field further to keep pace with the evolving generative editing tools.
Reproducibility Statement. To ensure the reproducibility of our research, we open-source the code for AutoEditForge, Detective SAM training, and the pretrained weights at the anonymized SAM 9057/ The NanoBanana, QWEN-Bench, and --UX-Bench datasets will be released upon acceptance. The model is trainable on a single NVIDIA H100 GPU. Other datasets in this paper (MagicBrush Zhang et al. (2024), SIDA Huang et al. (2025), AutoSplice Jia et al. (2023), CoCoGLIDE) and baselines (SAFIRE K won et al. (2024), Mesorch Zhu al. (2024b), TruFor Guillaro al. (2023), AdalFI al. (2025), FakeShield Xu et al. (2025), BSSCCNNttiee et al. (2022) are publicly available.
repository https: /anonymunno 4 4open. Daaler.cee//Detecttc
Ethics Statement. Detective SAM is designed for the forensic localization of diffusion- based edits support provenance research and platform integrity, and its outputs should be treated proba- bilistic evidence, subject to human oversight. The system is dual-use; adversaries may exploit failure modes, or misinterpretations may harm stakcholders. Therefore, we recommend per-model valida- thop review. We train and evaluate on public datasets and
tion with AutoEditforge and edits from AutoEditForge; no new personal data is collected, and we will honor take-down requests. On Al usage, Large Language Models were used for writing assistance and code completion; all ideas and analyses are our own.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Yochai Blau, Roey Mechrez, Radu Timofte, Tomer Michaeli, and Lihi Zelnik-Manor. The 2018 pirm challenge on perceptual image super-resolution, 2019. URL https://arxtn
/oos/189..0 07517
Liang-Chieh Chen, Yi Yang, Jiang Wang, Wei Xu, and Alan L. Yuille. Attention to scale: Scale-aware semantic image segmentation, 2016. URL
03339
Tianrun Chen, Ankang Lu, Lanyun Zhu, Chaotao Ding, Chunan Yu, Deyi Ji, Zejian Li, Lingyun Sun, Papa Mao, and Ying Zang. Sam2-adapter: Evaluating & adapting segment anything 2 in downstream tasks: Camouflage, shadow, medical image segmentation, and more, 2024. URL
https://erxiv.orge
04579
Wei-Lin Chiang, Lianmin Zheng, Ying Sheng. Anastasios Nikolas Angelopoulos, Tianle Li, Dacheng Li, Hao Zhang, Banghua Zhu, Michael Jordan, Joseph E. Gonzalez, and Ion Sto- ica. Chatbot arena: open platform for evaluating Ilms by human preference, 2024. URL
https::/arxtt org/ abs / 2403. 04132
Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inder- jit Dhillon, Marcel Blistein, and Ori Ram. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities, 2025. URL
lattps://axxa.
wttp//////////a///ooeo/a 0ttp://....///aas225..0...6 2626.
Alex Costanzino, Woody Bayliss, Juil Sock, Mare Gorriz Blanch, Danijela Horak, Ivan Laptev, Philip Torr, and Fabio Pizzati. Towards reliable identification of diffusion- based image manipu- lations, 2025. URL BBRLLhhtt://aaata //attpss///xiivvvi/ org/ abs 2506.05466.
Davide Cozzolino and Luisa Verdoliva. Noiseprint: cnn-based camera model fingerprint, 2018. URL httppss//axxii.oor///aaaa/
08396
Davide Cozzolino, Giovanni Poggi, Matthias Nießner, and Luisa Verdoliva. Zero-shot detection of ai-generated images, 2024. URL https::/arxiv.oott http://ab//249995550
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image worth 16x 16 words: Transformers for image recognition at scale, 2021. URL URL (ttttttttas/xttttt org abs 221000000222 11929
Fabrizio Guillaro, Davide Cozzolino, Avneesh Sud, Nicholas Dufour, and Luisa Verdoliva. Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization, 2023. URL
https:/ arxiv. org/ abs///b///// 2212.222222 10957
Zhiyuan He, Pin- Yu Chen, and Tsung-Yi Ho. Rigid: training-free and model-agnostic framework for robust ai-generated image detection, 2024. URL fttp:::/aaxxv..or/////sss
20112
Zhenglin Huang, Jinwei Hu, Xiangtai Li, Yiwei He, Xingyu Zhao, Bei Peng, Baoyuan Wu, Xiaowei Huang, and Guangliang Cheng. Sida: Social media image deepfake detection, localization and explanation with large multimodal model, 2025. URL hattpss:/aaxxvv.orgg// / httt:::/aaraiv.oorg/bb//22222
04292
Shan Jia, Mingzhen Huang, Zhou Zhou, Yan Ju, Jialing Cai, and Siwei Lyu. Autosplice: A text- prompt manipulated image dataset for media forensics, 2023, URL https://arxiv.orr abs/2304 06870
Leiping Jie and Hui Zhang. Adaptershadow: A Adapting segment anything model for shadow detec- tion, 2023, URL http://s//aaii..oo////ssse 0381
Vijaya Kumar Kadha, Sambit Bakshi, and Santos Kumar Das. Unravelling digital forgeries: A sys- tematic survey image manipulation detection and localization. ACM Comput. Surv., April 2025. ISSN 0360-0300. doi: 10.1145/3731243. URL |atps::/ oooooooogg11..11...33 274

---

Published as a conference paper at ICLR 2026
Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C. Berg, Wan- Yen Lo, Piotr Dollár, and Ross Girshick. Segment anything, 2023. URL https://arxiv. org/ httpg//bb/23300 02643
Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper Uijlings. Ivan Krasin, Jordi Pont-Tuset. Shahab Kamali, Stefan Popov, Mattco Malloci, Alexander Kolesnikov, Tom Duerig, and Vittorio Ferrari. The open images dataset v4: Unified image classification, object detection, and visual relationship detection at scale. IJCV, 2020.
Myung-Joon Kwon, In-Jae Yu, Seung-Hun Nam, and Heung-Kyu Lee. Cat-net: Compres- sion artifact tracing network for detection and localization of image splicing. In 2021 IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 375-384, 2021. doi: 10.1 10.1109/AACV4663.22201oo 1.0042.
Myung-Joon Kwon, Wonjun Lee, Scung- Hun Nam, Minji Son, and Changick Kim. Safire: Segment any forged image region, 2024. URL https: arxiv.xiiiiv...i org.
Black Forest Labs, Stephen Batifol, Andreas Blattmann, Frederic Boesel, Saksham Consul, Cyril Diagne, Tim Dockhorn, Jack English, Zion English, Patrick Esser, Sumith Kulal, Kyle Lacey, Yam Levi, Cheng Li, Dominik Lorenz, Jonas Müller, Dustin Podell, Robin Rombach, Harry Saini, Axel Sauer, and Luke Smith. Flux.1 kontext: Flow matching for context image generation and editing in latent space, 2025. URL httpp: www.woor//aooo abs wwt.aaa//2255... 15742
Yingxin Lai, Zhiming Luo, and Zitong Yu. Detect any deepfakes: Segment anything meets face forgery detection and localization, 2023.
Yuxi Li, Fuyuan Cheng, Wangho Yu, Guangshuo Wang, Guibo Luo, and Yuesheng Zhu. Adaifi: Adaptive image forgery localization via dynamic and importance-aware transformer network. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol (eds.), Computer Vision - ECCV 2024, Cham, 2025. Springer Nature Switzerland.
Tsung- Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zitnick, and Piotr Dollár. Microsoft coco: Common objects in context, 2015. URL
145..4005.00 0312
Tsung- Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár. Focal loss for dense object detection, 2018. URL
02002
Fuxiao Liu, Yinghan Wang, Tianlu Wang, and Vicente Ordonez. Visual news: Benchmark and chal- lenges in news image captioning, 2021. URL
Xiaohong Liu, Yaojie Liu, Jun Chen, and Xiaoming Liu. Psce-net: Progressive spatio-channel
correlation network for image manipulation detection and localization, 2022. URL https:
//axxiv.orq/abs//1000. 10596
Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Repaint: Inpainting using denoising diffusion probabilistic models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 11461-11471, 2022.
Muhammad Nawfal Meeran, Gokul Adethya and Bhanu Pratyush Mantha. Sam-pm: Enhancing video camouflaged object detection using spatio-temporal attention, 2024. URL https::/
arxiv. otg/ abs wtw.:///.../....... 05802
Anish Mittal, Anush K. Moorthy, and Alan C. Bovik. No-reference image quality assessment in the spatial domain. IEEE Transactions on Image Processing, 21(12):4695 2012. doi: 10. 10.1109/TT.2012222244400
Anish Mittal, Rajiv Soundararajan, and Alan C. Bovik. Making "completely blind" image qual- ity analyzer. IEEE Signal Processing Letters, 20(3):209-22 212, 2013. doi: 10.1 SP.2 2227726.
12

---

Published as a conference paper at ICLR 2026
Quang Nguyen, Truong Vu, Trong-Tung Nguyen, Yuxin Wen, Preston K Robinette, Taylor T John- son, Tom Goldstein, Anh Tran, and Khoi Nguyen. Editscout: Locating forged regions from diffusion-based edited images with multimodal 1lm, 2024. httttttt//axattt www. /bs/
2412.03800
Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models, 2022. htttps://axxi..xxxtte
abspg//bb//2212. 10741
Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy Vo, Mare Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, Mahmoud Assran, Nico- las Ballas, Wojciech Galuba, Russell Howes, Yao Huang, Shang-War Wen Li, Ishan Misra, Michael Rabbat, Vasu Sharma, Gabriel Synnaeve, Hu Xu, Hervé Jegou, Julien Mairal, Patrick Labatut, Ar- mand Joulin, and Piotr Bojanowski. Dinov2: Learning robust visual features without supervision, 2024. URL /tRLatttee//zxxx..oz///aa///////
07193
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alee Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation, 2021. URL httts:://aaxi...../// abs/ 22022 12092
2092
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents, 2022. URL https://arxiv.. ort.xbbsoorggbss///oo
Nikhila Ravi, Valentin Gabeur, Yuan- Hu, Ronghang Hu, Chaitanya Ryali, Tengyu Ma, Haitham Khedr, Roman Rädle, Chloe Rolland, Laura Gustafson, Eric Mintun, Junting Pan, Kalyan Va- sudev Alwala, Nicolas Carion, Chao-Yusl Wu, Ross Girshick, Piotr Dollár, and Christoph Fe- ichtenhofer. Sam Segment anything in images and videos, 2024. URL https:://axxxv
org/abs/ 2408 00714
Jonas Ricker, Denis Lukovnikov, and Asja Fischer. Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error, 2024. URL [RL[ittpps://axiv.oxr abs/ /ass/241..om 17879
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models, 2022. URL https:://arxi..
Abs/2212.10752
Chaitanya Ryali, Yuan-Ting Hu, Daniel Bolya, Chen Wei, Haoqi Fan, Po- Yao Huang, Vaibhav Aggarwal, Arkabandhu Chowdhury, Omid Poursaeed, Judy Hoffman, Jitendra Malik, Yanghao Li, and Christoph Feichtenhofer. Hiera: hierarchical vision transformer without the bells-and- whistles, 2023. /tRh:t/s:: //arxiv...vi/////aa//ai org/ abs 2306. 00989
Yang Su, Shunquan Tan, and Jiwu Huang. A novel universal image forensics localization model based on image noise and segment anything model. In Proceedings of the 2024 ACM Workshop Information Hiding and Multimedia Security, pp. 149-158, New York, NY, USA, 2024. Asso- ciation for Computing Machimery. ISBN 9798400706370. doi: 011144/3668864336556663 URL 36596399996999
hittps://dee www.oorg//10.... 1ttp://..11113553611
Zhihao Sun, Haipeng Fang, Xinying Zhao, Danding Wang, and Juan Cao. Rethinking image editing detection in the era of generative ai revolution, 2023, URL https://arxiv.orgg
2311. 17953
Gemma Team, Aishwarya Kamath, and Johan Ferret et al. Gemma technical report, 2025. URL https://arxivv org/
19786
Chung-Ting Tsai, Ching-Yun Yun Ko, I-Hsin Chung, Yu-Chiang Frank Wang, and Pin- Chen. Un- derstanding and improving training-free free ae-generated image detections with vision foundation models, 2024a. utt httphtttss//aaiiii http://aavvvvv/av www.:oggg//.........oo...o... 2/t.///11...1111111....111111111
Chung-Ting Tsai, Ching Yun Ko, I-Hsin Chung, Yu-Chiang Frank Wang, and Pin- Yu Chen. Un- derstanding and improving training- frining-frre ai ai-generated image detections with vision foundation models, 2024b. URL htttps::/arrw..oor///baat
www.o/orrg/////..eeo 19117
13

---

Published as a conference paper at ICLR 2026
Dmitry Vesnin, Dmitry Levshun, and Andrey Chechulin. Detecting autoencoder is enough catch ldm generated images, 2024. htttttt//////...oorott abs
Jingdong Wang, Ke Sun, Tianheng Cheng, Borui Jiang, Chaorui Deng, Yang Zhao, Dong Liu, Yadong Mu, Mingkui Tan, Xinggang Wang, Wenyu Liu, and Bin Xiao. Deep high-resolution rep- resentation learning for visual recognition, 2020. URL http://///xxww..r///bboo/o/
07919
Chenfei Wu, Jiahao Li, Jingren Zhou, Junyang Lin, Kaiyuan Gao, Kun Yan, Sheng ming Yin, Shuai Bai, Xiao Xu, Yilei Chen, Yuxiang Chen, Zecheng Tang, Zekai Zhang, Zhengyi Wang, An Yang, Bowen Yu, Chen Cheng, Dayiheng Liu, Deqing Li, Hang Zhang, Hao Meng. Hu Wei, Jingyuan Ni, Kai Chen, Kuan Cao, Liang Peng, Lin Qu, Minggang Wu, Peng Wang. Shuting Yu, Tingkun Wen, Wensen Feng, Xiaoxiao Xu, Yi Wang, Yichang Zhang, Yonggiang Zhu, Yujia Wu, Yuxuan Cai, and Zenan Liu. Qwen-image technical report, 2025. (tttttsss: htl.hhtts:///artt pttttp:://arxi..org////
2508 02324
Bin Xiao, Haiping Wu, Weijian Xu, Xiyang Dai, Houdong Hu, Yumao Lu, Michael Zeng, Ce Liu, and Lu Yuan. Florence-2: Advancing a unified representation for variety of vision tasks, 2023.
URL wttpthttss///xiii.e. org/ abs/ 231 311 1..11.1111... 06242
Zhipei Xu, Xuanyu Zhang, Runyi Li, Zecheng Tang, Qing Huang, and Jian Zhang. Fakeshield: Explainable image forgery detection and localization via multi-modal large language models, 2025. URL/ttts:: http://///w.w....///aaaa///
24700.22661
Kai Zhang, Lingbo Mo, Wenhu Chen, Huan Sun, and Yu Su. Magicbrush: A manually annotated dataset for instruction-guided image editing, 2024. URL
10012
Quan Zhang, Yuxin Qi, Xi Tang, Jinwei Fang. Xi Lin, Ke Zhang, and Chun Yuan. Imdprompter: Adapting sam to image manipulation detection by cross-view automated prompt learning, 2025.
URL /tttts:///axtttaa
org/ htap//bb//20002 02454
Haozhe Zhao, Xiaojian Ma. Liang Chen, Shuzheng Si, Rujie Wu, Kaikai An, Peiyu Yu, Minjia Zhang, Qing Li, and Baobao Chang. Ultraedit: iastruction-based fine-grained image editing scale, 2024. [tLlhttts://arae
crq/ abs//ab////// 2407. 05282]
Da-Wes Zhou, Qi-Wei Wang, Zhi-Hong Qi, Han-Jia Ye, De-Chuan Zhan, and Ziwei Liu. Class- incremental learning: A survey, IEEE Transactions on Pattern Analysis and Machine Intelligence, (6(12):9851-9873 December 2024. ISSN 1939-3539. doi: 10. 10//0pamm22224432233333 URL
http://áx http://xx..oo..r//.oo.oo/. www/oo.gg/oo. 1wT.::..1111PPPAAA 2024 3429383,
doi.
Jiaying Zhu, Dong Li, Xueyang Fu, Gang Yang. Jie Huang, Aiping Liu, and Zheng-Jun Zha. Learn- ing discriminative noise guidance for image forgery detection and localization, 2024a. URL
https://dbi.org/100 609 aaai wtw.ii.vvi...2888
Xuekang Zhu, Xiaochen Ma, Lei Su, Zhuohang Jiang, Bo Du, Xiwen Wang, Zeyu Lei, Wentao Feng, Chi-Man Pun, and Jizhe Zhou. Mesoscopic insights: Orchestrating multi-scale & hybrid architecture for image manipulation localization, 2024b. URL https:://rxxi org/abs/ 2412. 13753
14

---

Published as a conference paper at ICLR 2026
A
NOTATION
Table 4: Notation used in Detective SAM and Aut
Symbol
Meaning
Type or shape
I
RGB source image
R3x
H, w
Image height and width
N
B
Binary forgery mask Number of perturbations Image perturbation operator with params 0
{0. H)
N
N
(e)turb,(;0))
Function
0
Perturbation parameters
Hyperparameters @3x
I
Perturbed image
S
Set of HIERA scales
{32, 64, 128) Rcxxx
X,
HIERA embedding scale
ConvSAM(-)
Frozen SAM2 conv processing
X, H F3 N
C
Channels of HIERA embedding at scale
F.
Processed SAM2 feature at scale Feature of at scale
RCx8xx
pz
RCxxxx
F.
Feature i ''th perturbed image at scale RC, xaxa
Ag
Feature adapter scale (1x1 1 conv) Residual correction from feature adapter Adapted feature FT + AF,
[FZ. F
+ AF,
AF,
RCxxax
F.
RC, x8xx
Finest grid resolution used by mask adapter Cross-scale fused feature tensor
max
Fluse
Rdxax&
d
Channel dimension of Fruss
N
M
Heatmap prompt logits for decoder Coarse logits from transformer block Uncertainty logit map
Rax
Leoarse
Rixs
U
R
Lrefine
Refined logits from conv block Spatial gate
R
[0, 1|
9.
M
Decoder logits output resolution
RH* XW
a())
Elementwise sigmoid
(0, 1) mapping
Mocal: ALoU
Loss weights
Rg0
a.
Focal loss parameters
a E [0, 7 2
LDier
Dice loss
Scalar
Focal loss
Scalar
LIOU
IoU L1 regression loss for SAM2 head
Scalar
B VISUALIZATIONS
B.I NANOBANANA INTRODUCTION VISUALIZATION,
Original Tampered
Detective
SAFIRE
Mesorch
ThuFor
AdaIFL
PakeShield
PSCC-Net
Figure 4: Source, tampered & ground-truth, mask prediction results for all baselines and Detective SAMSOTA for NanoBanana example.
15

---

Published as a conference paper at ICLR 2026
B.2 SAM2 ARCHITECTURE.
Point Box
Envoder
Heatmap
SAM2
Decoder
[No-] Memory Embocking
Image Encoder
Figure 5: Original SAM2 architectural interactions for the components in Figure 2 image-only version of the architecture presented in the SAM2 paper (Ravi et al. 2024
This is an
B.3 COARSE AND FINE MASK ADAPTER LOGITS.
-24
Saurce
Rdnedd
Lower
Lyn
15
STOP WARe
WAY
WAY
-2a
Source
Lewerr
Lidh
16o
Boonng
-34
Edited
-06
Figure 6: Examples showing mask adapter outputs on four MagicBrush training samples. For each sample we show the coarse logits Leoarse- the refined logits Lrefine. and the final binary mask B. Heatmaps are logits before sigmoid; B is obtained by thresholding a (MM) at
16

---

Published as a conference paper at ICLR 2026
B.4 A CORRECTION FEATURES
Digra
Tappaed
Prod Overley
(a) Delta correction saliency results for MagicBrush.
Drggnal
Tampored
Delai
Deta
Defia
And Oarlyy
E
STOP
STOP
(b) Delta correction saliency results for CoCoGLIDE.
Figure 7: Delta correction saliency visualizations across MagicBrush and CoCoGLIDE for four samples, averaged over the embedding dimension and bilinearly upsampled to 512 X 512.
17

---

Published as a conference paper at ICLR 2026
C DATA GENERATION COMPARISON
Comparison of diffusion- based image editing data generation approaches, public availabil- ity reflects the state as of Sep 24, 2025.
Table 5:
Dataset
Methods Used
Model Type
Public
RADAR Costanzino et GRE Sun el al. 2223
2025
replace
text-conditioned inpainting
add; remove; replace
lext-conditioned inpainting text-conditioned inpainting
SAFIRE Kwon al.
2024
replace; remove
SID-Set Huang at
2025
change partially; replace add; change partially; remove; replace DDataset announced but not yet publicly released.
text-conditioned inpainting
AutoBditFooze
instruction-basee editing
Model type distinction The datasets in Table 5 employ two fundamentally different editing ap- proaches. Teext-oondiiooee inpainting (used by RADAR, GRE, SAFIRE, and SID-Set) requires complete textual descriptions of desired content in masked regions, treating them as areas to be entirely regenerated. This often results in visible boundaries and loss of contextual details like con- sistent lighting and perspective. In contrast, our Aut oEtooEiitit outoEditForo torgge uses instruction- based editing models, which can interpret natural language commands (e.g. "replace the dog with a cat") to per- form targeted modifications while preserving scene coherence. Although instruction- -baiod models can operate without masks, Nutoodiitorgg employs segmentation masks to ensure precise spa- tial control, combining semantic understanding with spatial precision for context-aware edits that maintain the original scene's s lighting, perspective, and style.
RADAR Costanzino et al. (2225) employs systematic pipeline that uses Kosmos-2 for scene anal- ysis and object detection, followed by Grounded SAM for segmentation of selected objects. The system focuses replacement operations, using the original scene caption an inpainting prompt across 10 different text-to- text-to-image diffusion models to generate semantically coherent substitutions (e.g., replacing duck with another bird). Unlike RADAR which focuses solely on object placement using scene-level captions, AutoEd tForge employs L..M-guided decision making to support diverse editing operations (add, remove, replace, change partially) with context-aware prompting.
GRE Sun et al. (023) employs a comprehensive multi-stage pipeline that leverages large mod- els across different modalities, including SAM for region selection. BLIP2 for scene understand- ing, and ChatGPT for generating logical editing ideas ensure semantically coherent edits. The system performs three types of operations (add, remove, replace) using diverse editing methods spanning GAN-hased (MAT, LaMa), diffusion-based (Stable Diffusion, ControlNet, PaintByFx- ample), and black-box approaches (Photoshop with generative AI). Built on 228,650 images from real-world sources focusing on daily snapshots and news visuals, the dataset's s simulated pipeline ensures logical consistency while maintaining scalability, though the dataset remains private despite its significant scale. In contrast to GRE's Aut AEdoEditt t Forge employs two-pass architecture with Florence-2 and Gemma 3 12B-it for more efficient processing, extends editing capabilities with a novel 'Change Partially' operation, and sup- ports SOTA image editing models such as Qwen-Imaae-Fii Wu et al. (2025).
pipeline for text-to-i to-image inpainting,
SAFIRE-AUTO Kwon et al. (2024) generates a large-scale pretraining dataset of approximately 123,000 images by leveraging SAM'S automatic mask generation to partition authentic images from DPReview into semantic regions, then randomly selecting and unioning adjacent regions to cre- ate manipulation masks. The pipeline applies four forgery types: copy-move, splicing, generative reconstruction using text-to-image models, and Al-based inpainting removal, with various post- processing techniques including resizing, blurring, noise addition, and color adjustments. Unlike AutoEditForse rge's 's intelligent two-pass approach that uses Florence-2 and L.M analysis to make contextually-awar editing decisions based on scene understanding. SAFIRE-AUTO employs sim- pler automated method that randomly selects and unions adjacent semantic regions without consid- cring the semantic appropriateness of the edits.
SID-Set Huang et al. (0255) constructs social media-focused dataset of 300,000 images through a four-stage pipeline: extracting objects from captions using GPT-4o, generating masks with Language-SAre SAM, establishing replacement dictionaries for objects/attributes, and producing tam- pered images via Latent Diffusion. The system supports both object replacement (swapping entire objects like cat- cat->dog) and attribute modification (changing properties like "happy dog"). In contrast
18

---

Published as a conference paper at ICLR 2026
to AutoBditForoo which employs Florence-2 for object detection and LLM for dynamic editing strategy selection across four manipulation types, SID-Set utilizes pipeline with GPT-4o for caption- based object extraction and predefined replacement dictionaries, focusing specifically object replacement and attribute modification for social media contexts.
D AUTOEDITFORGE
Image selection and filtering. The images selected from Open-Imager V7 Kuznetsova et al. 2020) based on four complexity criteria to ensure meaningful forgery detection challenges: (1) containing 2 3 objects with bounding boxes covering 2 2% of the image area, (2) representing 2 distinct object classes, (3) no single object dominating more than 60% of the frame, and (4) at least non-person object present. This filtering strategy ensures that the generated forgeries involve realistic multi-object scenes rather than trivial single-object manipulations.
Quality control mechanisms
AutoEditForge implements several quality control mechanisms that are tracked during the generation process.
Multi-metric duplicate detection: Four complementary metrics (blob analysis, MAE, pHash, and SSIM) used validate meaningful inpainting changes and automatically reject failed images without retrying.
2. Mask validation pipeline: All masks undergo format validation, size matching, and area constraint checks, ensuring only high-quality masks proceed to inpainting.
3. Error tracker: Categorizes failures across 11 distinct error types.
We compose a table analyzing the error logs of FLUX-Bench and QWEN-Bench, totaling 6.000 samples. In total, 9,446 images were generated, with 3.443 failures, giving a failure rate of 36.45%. Each editing method has 25% of the images due our class balancing. The failures are distributed as follows:
Table 6: AutoEditForge Failure Categories.
Failure mode
Count
% of errors
Inpainting produced no result
1730
50%
Florence mask coverage validity
1506
44%
Florence captioning failed
187
5%
LLM object selection failure
17
0.5%
SAM segmentation mask failure
0.03%
Fallback mask file creation errors
0.03%
LLM edit method decision failures
0.03%
Class balancing mechanism. To ensure balanced representation across editing methods. we im- plemented dynamic class-balancing mechanism during generation. For each image, the LLM first analyzes the scene and selects the two most suitable editing methods from Replace, Remove, Add, Change Partially based on semantic and spatial constraints. The system then applies further class balancing by selecting the method that has been used less frequently between these two candidates, preventing any single manipulation type from dominating the dataset. This strategy resulted in an approximately uniform distribution with each method applied to ~25% of the images, ensuring comprehensive coverage of forgery types for robust detector training. The final dataset comprises manipulated images with corresponding pixel-level ground truth masks, representing diverse editing operations across complex real-world scenes.
19

---

Published as a conference paper at ICLR 2026
D.1
AUTOEDITFORGE EXAMPLE.
AutoEditForge Pipeline Example
Input Scene Analysis
LLM-tdd Decision Making
Image-Editing Application
Gemma 3
System Prompt
"change partesly" Prompt: "change the chees black drees
You are anotyzing an imago with the
caption: Your taak is idendlly
appropriate imae
Original image
ectinng mothods based on the scene
description wiimwiing the two
SAM-2 Prectse Segmentation [dress)
Description:
System Prompt 2:
A woman and man are sinpling on They both halking microphones
analycing image with
capton: I.I. The following objects
have been dedected the
woman's ls wecring long black dress. Behind playing There large
(otjects (ir]]
1. Soloct ONE object from the lnst
screen behind them.
Outputs:
Object:
dress a long black dress with shimmering star pattems
Florence-2 2 Detected Objects and
[a woman, microphones, dross, man, pants, shit, diuma, a large screen]
Chosen Methods: (replace, change, paristly
change per Saily (clasa balancinal
Output image
Figure 8: High-level overview of the AutoEditForge pipeline, illustrating the workflow from input image to edited output. Implementation details, including system prompts and source code, are available in our GitHub repository.
Further, provide three qualitative examples of the three created datasets (FLUX-BENCH, QWEN-BENCH, NanoBanana):
Tarpweed
Sparce
Taepweed
Figure 9: Qualitative comparison of three source and tampered AutoEditForge edits across FLUX- Bench, SWEN-Bench and NanoBanana.
20

---

Published as a conference paper at ICLR 2026
D.2 DATASET CREATION TIME.
Table 7: End-to-end AutoEditForge generation effort. "LLM secs/img" includes edit method selection and prompt formation. "Editor secs/img" includes diffusion steps. NanoBanana edits are done via Gemini 2.5 Flash API. Comanici al. 2025
Dataset
Images
LLM secs/img
Editor secs/img
FLUX-Bende Bench
3,000
35
41
QWEN-
3.000
36
59
NanoBanana
445
35
D.3 PERCEPTUAL QUALITY COMPARISON.
We compare the output quality of FutoEditForge using BRISQUE Mittal et al. (2012). NIQE al. (2013). and PI [lau al. (2019), commonly used no-reference image quality metrics for assessing perceptual differences between source and tampered images. All three aim to quantify visible degradation without relying on pristine reference image. The metries are non-reference, since reference metrics measure similarity, which directly biased by the mask size. As can
text
Tegurd
Figure 10: Source vs tampered image quality metrics for datasets with matching (source, tampered) pairs: BRISQUE, NIQE, and PI across models.
be seen in Figure 10 the differences between the source and tampered images are small for the
AutoEditForge datasets (FLUX, QWEN, and NanoBanana) and CoCoGLIDE, but noticeable for Magicbrush and AutoSplice. This confirms that AutoEditForge shows no significant degradation in quality with respect to the source images.
D.4
E EVALUATION
E. EVALUATION METRICS.
Fl is a monotone transform of loU (F1 24 thus Fl > IoU. Because the nonlinearity is applied prior to averaging, mean F1 is not recoverable from mean IoU and is more tolerant of partial overlaps and small objects. Benchmarks exhibit substantial FI-IoU discrepancies, indicative of under-prediction under uncertainty (Fig. 3
21

---

Published as a conference paper at ICLR 2026
E.2 FI SCORE COMPARABILITY.
We compute the score F1 2TP+EN+FP' whereas TruFor and SAFIRE use FI max 2TP4FN=FPM 2FN=TP+TN which is equal or larger. Their definition is suited for image splicing (two authentic images combined), while our definition reflects diffusion edits with clear separation of authentic and forged regions. For comparability, we report alternative F1 scores in Table
2TP
2PN
Table 8: Alternative F1 scores using the definition max
2TP
2PN
PTPENNEPS 2FN4TP4TN
MagicBrush
SIDA
CoCoGLIDE
AutoSplice
NanoBanana
FLUX-BENCH
QWEN-BENCH
Model
FI
FL
SAFIRE
2024
39.25
40.14
59.63
54,88
30.87
36,00
44.28
Mesorch
20224
35.54
35.28
56.51
63.62
33.90
28.62
30.78
TraFor
2025
43.69
40.52
49.81
65.60
24.45
37.38
38.47
AdaIFL
2025
30.64
33.95
44.54
56,80
30.64
25.22
27.95
2025
22.20
22.74
FakeShicid
2025
26.81
33.00
41.78
59.24
31.03
27.13
30.94
22.67
27.91
Detective SAM
$9.83
66.53
60.22
67.60
37.12
34.40
39.37
F ADDITIONAL RESULTS
F.1 NOISE INTENSITY.
tou
53.4
60
43.4
41.5
40
38a
Score
30
0
Intensity
Figure 11: IoU and Fl for Gaussian noise and blur varying intensity levels. Exact perturbation parameters for each intensity are in Table I7 Scores are averaged over the validation splits of the ID datasets (MagicBrush and SIDA).
22

---

Published as a conference paper at ICLR 2026
F.2
ROBUSTNESS STUDY.
(a) Relative IoU change over Gaussian Blur, Gaussian Noise, and JPEG compression.
Coursiio Blar
Gounsion Notee
PEG Compression
3.50
0.0
(b) loU degradation for Gaussian Blur, Gaussian Noise, and JPEG compression.
Figure 12: Detective SAM and baselines IoU performance under increasing perturbation intensities. Only the top 5 models by IoU are shown.
F.3 FINE-TUNING
F.3.1 FINE-TUNING SCORES.
Table 9: bix-benchmark evaluation of the fine-tuned Detective SAMSOTA, MagicBrush and SIDA in-distribution (ID). CoCoGLIDE, AutoSplice, NanoBanana, and their form the out-of- distribution (OOD) evaluation. Bold indicates the best per column. All values are percentages; higher better.
Model
IoU 1
MagicBrush
F1
1oU1
SIDA
F1
1oU 1
CoCoGLIDE
F1
1oU 1
Ultraddtt
F1
IoU 1
AutoSplice
F1
loU 1
NanoBanana
F1 1 IoU
Avg 0OD
Fl
Detective SOTA
45.03
57.24
51.35
60.74
45,37
55.62
25.49
33.84
44.42
$7.02
27.00
36.21
35.57
45.67
F.3.2 INCREMENTAL FINE-TUNING
To further support the claim of periodic fine-tuning with Detective SAM, fine-tune Detective SAM incrementally: first on 500 FLUX-Bes -Bench samples, then on 500 QWEN-Bendh samples, and vice versa.
Table 10: Evaluate the impact of incrementally fine-tuning the IoU on the FLUX-Bench and QWEN- Bench, and vice versa. '_,' denotes sequential tuning. The columns refer to the fine-tuning data used; both FLUX and QWEN refer the use of 500 samples from the dataset. The rows refer the dataset used to calculate the loU.
Dataset
Detective SAM
FLUX
QWEN
FLUX - QWEN
QWEN + FLUX
FLUX
18.70
41.09
29.60
41.43
43.34
QWEN Average OOD
20.41
32.26
42.43
43.20
42.58
34.68
35.90
34.47
37.68
36.95
Examining Table 10, the first sequential update slightly reduces OOD performance, which is then restored when the following dataset is introduced. The similarity between the sequential results and
Includes CoCoGLIDE, UhraFdit,, AutoSplice and NanoBanana.
23

---

Published as a conference paper at ICLR 2026
those of Detective SAM in Table indicates that adaptation remains effective beyond single update step. We will clarify the meaning "continual" the introduction.
F.3.3 UNBALANCED SAMPLES FINE-TUNING
We fine-tune Detective SAM with unbalanced samples and measure IoU performance. This en- ables evaluation in an unbalanced setting, where one diffusion model is overrepresented during fine-tuning.
Table 11: Evaluation of unbalanced fine-tuning. The columns denote the fine-tuning data used. Only IoU results are shown. The last column is taken directly from Table for reference.
Dataset
QWEN 1500, FLUX 500
FLUX 1500, QWEN 500
FLUX 500, QWEN 500
FLUX
42.16
44.30
43.08
QWEN
44.94
39.68
41.44
NanoBanana
26.65
25.80
27.00
Magichrush
44, 14
45.51
45.03
SIDA
50.46
49.72
51.35
CoCoGLIDE
44.95
42.57
45.37
AutoSplice
43.30
44.31
44.42
Unbalanced fine-tuning improves performance on the overrepresented dataset but leads to greater forgetting of the underrepresented dataset. This is likely due mismatch between the diversity of the fine-tuning samples and the replay samples. Therefore, if future editors produce dispro- portionate number of new edits, replay must either increase or subsample to maintain stability. The default setting for periodic adaptation remains 500 samples per editor with 20% replay rate. This supported by the results shown in Appendix F33.4
F.3.4
REPLAY VS. INCREASING NUMBER OF SAMPLES.
640
6.00
20
200
(a) IoU vs. samples with 20% replay.
(b) IoU vs. samples without replay.
Figure 13: Detective SAM fine-tuning with and without replay and increasing number of samples. The IoU average scores are shown for the ID, OOD, and fine-tuned (FT) models. Note: OOD includes CoCoGLIDE, AutoSplice and NanoBanana.
F.4 EDIT METHODS.
Table 12: Average IoU across all evaluated models, grouped by edit operation for FLUX-Bendh and QWEN-Bench. We report the mean over models.
Dataset
Change Partially
Replace
Remove
Add
OWEN-Bence FLUX-Bend
17.84
22.95 17.61
10.58 9.31
11.95 13.27
17.42
F.5 DETECTIVE SAM FAILURE MODES.
Several low IoU Detective SAM localization failures are depicted in Figure 14
24

---

Published as a conference paper at ICLR 2026
Tampered
Groundi
Detective
InD 143
MegicBrush
SIDA
Autosplice
Cocoglide
FLUX
NanoBenans
Figure 14: Detective SAM low IoU samples per dataset
F.6 MODEL THROUGHPUT COMPARISON.
To quantify the inference efficiency difference across IFL systems, we measure throughput on 512 CoCoGLIDE samples with batch size of and no parallelization on an NVIDIA H100. The results are shown in the table below.
Table 13: Throughput and inference time comparison CoCoGLIDE (512 samples, batch size 1, no parallel processing).
Metric
SAFIRE
Mesorch
AdaIFL
TruFor
SIDA
FakeShield
PSCC-Net Detective SAM
Images per second Total inference time
0.35
37.10
9.54
22.61
2.50
2.67
77.70
29.04
1475.04
13.80
53.66
22.64
204.50
191.54
17.63
Average OOD loU
24.11
24.73
27.90
17.43
17.55
15.68
26.99
34.68
From the above table, MLLM-baseed systems require several minutes for processing a few hundred samples, while SAFIRE requires roughly half an hour. This hinders deployment at scale. Detective
25

---

Published as a conference paper at ICLR 2026
SAM achieves higher OOD performance while remaining efficient enough for large-batch screening and adaptive updates, making it suitable for practical deployment in real-time applications.
G DATASETS
Datasets We train Detective SAM on MagicBrush (Zhang et al. 2024) and a subset of SIDA (Huang
et al. 2025), containing edits using DALL-E (Ramesh et al., 2022) and Latent Diffusion Model (Rombach et al., 2022). We perform out-of-distribution testing on CoCoGLIDE, UltraEdit (Zhao ct al. 2024), AutoSplice (Jia et al. 2023), and NanoBanana Comanici al. (2025). NanoBanana is dataset created with Autge:itForge we also create datasets with FLUX Kontext (Labs et al,
2025) and
(Wu et al. (025)) to evaluate SOTA performance.
Note that MagicBrush and AutoSplice share the same editing model but differ significantly in how they create datasets. For example, the instruction, data source, editing types, and mask sizes differ. See below for all datasets and mask size details. This is in line with the OOD definition in Section 4
The editing modes for each dataset are stated Table 14
Dataset
Editing Model
MagicBrush
DALL-E 2
SIDA
Latent Diffusion Model
AutoSplice
DALL-E 2
UltraEdit
SDXI.-Turbo
CoCoGLIDE
GLIDE
NanoBanana
Gemini 2.5 Flash
FLUX-Benchs
FLUX Kontext
OWEN-Bench
QWEN-Image-Fait
Table 14: Overview of the editing models used for each dataset.
Next, we describe the datasets in more detail.
MagicBrush This dataset contains liffusion-based edits produced with DALL-E Ramesh et al. (2022); Zhang et al. (2024) using human annotation. It includes multiple edit rounds per image, and we compute binary masks the union of forged pixels over rounds, giving 8.807 samples. We use the official validation and test split for testing, giving 528 validation samples and 1.053 test samples
SIDA This corpus comprises 100.000 edits created with Latent Diffusion Model Huang et al. (2025) Rombach al. (2022). our experiments, we use 10.000 tampered samples of SIDA for training. 528 for validation and the full tampered test set for testing.
AutoSplice This dataset includes 3.621 DALL-E based edits Jia et al. 2023). ). We treat as an
out-of-distribution set and allocate all 3.621 images to testing. AutoSplice shares the same editing model as MagicBrush. The two datasets differ in the following aspects:
1. Instruction:
Magicbrush contains action-oriented instructions from human crowd workers, whereas AutoSplice has descriptive captions, generated by modifying the image caption.
2. Data source: Magicbrush uses images from MS COCO Lin et al. (2015) and AutoSplice uses Visual News et al. (2021).
3. Edit types: Magicbrush contains semantic changes and AutoSplice contains mainly insertions and replacements.
4. Edit sizes:
84% of Magicbrush edit masks cover less than 25% of the image, whereas 68% of AutoSplice masks occupy more than 25% (Table [5).
CoCoGLIDE This small evaluation set contains 512 GLIDE based edits Nichol et al. (2022). We use 512 samples for distrii-itiiitooon testing.
UltraEdit This dataset serves additional OOD benchmark utilizing the SDXL-Turbo model. We use the region-based based (local edited) subset, it contains 100.000 samples with pixel-level ground truth masks, from which take 10.000 random subset.
26

---

Published as a conference paper at ICLR 2026
NanoBanana We construct this dataset with AutoEditForge using Gemini 2.5 Flash Comanici al. (2025), which is not open weight and does not accept a mask input. NanoBanana generates its own internal mask during the editing process. We curate 200 images from 445 candidates and compute masks by thresholding the pixel difference between the source and edited images, selecting only the images that apply local-only edit. All 200 samples are for diftiiiiitittoionn testing.
FLUX-Bench We construct this benchmark with AutoEditForge using the open weight FLUX Kon-
text editor [abss al. (2025). We generate 3.000 edited samples, fine-tune on 500, validate on 250, and test on 1.750. The editor is a recent state-of-the-art model that ranks highly on public leaderboards Chiang et (2024).
QWEN-Bench We construct this benchmark with AutoEditForge using the open weight QWEN- Image-Edit model Wu al. (2025). We generate 3,000 edited samples and fine-tune on 500, validate on 250, and test on 1.750. The editor is a recent state-of-the-as model that ranks highly on public leaderboards Chiang et al. (2024).
G.1 DATASET MASK SIZES
Table 15: Distribution of mask sizes (small medium large) in each dataset. Small refers to [0.5%], medium to 15%, 25%], and large 25% mask coverage. Percentages are rounded to integers; the last row shows the range across datasets.
Dataset
Small (%)
Medium (%)
Large (%)
MagicBrush
35
49
16
SIDA
32
47
CoCoGLIDE
20
45
36
UltraEdit
16
37
48
AutoSplice
5
27
68
NanoBanana
26
58
16
ELUX-Bench
35
53
12
QWEN-Bench
33
48
19
27

---

Published as a conference paper at ICLR 2026
H HYPERPARAMETERS
Table 16: Detective SAM hyperparameters, the highest validation performance set used for the results, and the swept over range.
Hyperparameter
Optimal
Sweep Range
Learning rate
0.001
{0.01, 0.001, 0.0001, 0.00001}
Focal o
0.6
(0.5, 0.55, 0.75, 0.80}
Focal 7
1.0
{1.0, 1.25, 1.75, 2.05 {0.0001, 0,00001, 0.03
Adam weight decay
0.0001
Noise intensity
0.75
{0.25, 0.50, .... 1.25, 1.50
Perturbation type
Blur & Noise
Blur, Noise, JPEG, None, Blur & Noise
Layer width
64
64, 128, 256
Transformer downscaling
16 x
4, 8. 16
Transformer layers Dropout rate
1, 1.2.3]
0.15
0.0, 0.1, 0.15, 0.2, 0.25, 0.5
Batch size
4
2, 4, 8
Table 17:
Perturbation parameters as function of noise intensity. Each intensity level controls
the strength of three perturbations: Gaussian blur with standard deviation T JPEG compression with the specified quality factor (lower is stronger compression), and additive Gaussian noise with standard deviation noise-
Intensity
Oblu
JPEG Quality
Onoise
0.25
0.25
80
0.05
0.50
0.50
0.10
0.75
0.75
52
0.15
1.00
1.00
0.20
1.25
1.25
24
0.25
1.50
1,50
10
0.30
28


Reviews:
[{"review_id": "Nt2Rdwic1k", "reviewer": "Reviewer_sKpy", "summary": "The paper proposes Detective SAM, a framework for image forgery localization that adapts the Segment Anything Model 2 (SAM2) to detect and precisely mark regions of AI-generated edits. Instead of retraining SAM2, the authors freeze its backbone and attach small trainable “feature” and “mask” adapters that use differences between an image and its perturbed versions (blurred, noised, or compressed) as forensic clues indicating manipulation. These perturbation responses are converted into an automatic heatmap prompt guiding SAM2 to segment the tampered areas. To keep pace with rapidly changing diffusion-based editors, they also introduce AutoEditForge, an automated pipeline that continually produces realistic, labeled image edits (Replace, Remove, Add, Change Partially) for fine-tuning and evaluation. Together, these components aim to build an adaptive, lightweight, and continually updatable system that localizes forgeries across diverse generative-model edits more reliably than prior detectors.", "questions": "Your method is described as a general framework for image forgery localization, yet the core signal it relies on is perturbation-induced embedding instability (Section 3.1–3.2). This assumes that forged regions respond differently to Gaussian noise, blur, or compression compared to authentic ones. However, not all forgeries—e.g., copy-move, GAN inpainting, or carefully composited human edits—necessarily exhibit such perturbation sensitivity. Could you clarify whether Detective SAM is actually detecting forgery semantics or merely perturbation sensitivity, and how the method would generalize to forgery types that do not produce perturbation-based cues?\n\nThis question matters because, the authors blur the distinction between “detecting forgeries” (a semantic problem) and “detecting perturbation-sensitive regions” (a statistical proxy). The two overlap for diffusion artifacts but diverge for other forgery classes. Hence, the approach is domain-specific rather than general, despite the paper’s repeated framing as a “comprehensive framework for modern IFL.”", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1- The integration of perturbation-driven forensic signals with SAM2 is technically neat and explained with adequate mathematical detail.\n\n2- Results across seven datasets demonstrate stable performance under moderate domain shift, which is rare among IFL systems.", "weaknesses": "1- In Abstract & Sec. 3.3, the system is framed as a continual, lifelong learning pipeline that updates smoothly as new editors appear. But in Sec. 4.1–4.2, the experiments are all offline fine-tuning on small fixed batches (500 samples), without any demonstration of online or streaming adaptation. The “continual” claim is thus aspirational rather than empirically validated.\n\n2- In Abstract & Intro, Detective SAM supposedly handles arbitrary new diffusion editors “without retraining.” but in Sec. 4 in the Training specification, the model is trained and tested only on diffusion-edited datasets (SIDA, MagicBrush, AutoSplice, CoCoGLIDE, NanoBanana) and fails sharply on unseen SOTA editors until retrained. The paper’s own results contradict the “no-retraining” implication.\n\n3-  In Sec. 3.2, they emphasize lightweight adapters—81 k + 887 k parameters—trained in “two hours on an H100.” but in Sec. 4 Baselines, inference comparisons are made against massive MLLMs but all are run on a single H100 GPU, ignoring throughput, preprocessing (multiple perturbations per image), and repeated SAM2 encodings. The real computational cost per sample is much higher than implied; “lightweight” refers only to trainable weights, not runtime.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "c4Nj2Hlexj", "reviewer": "Reviewer_De2b", "summary": "This paper presents Detective SAM, a framework that localizes AI forgeries by detecting feature shifts in a perturbed image using a frozen SAM2 model. It is paired with AutoEditForge, an automated pipeline that generates up-to-date training data. This dual approach allows the model to significantly outperform existing methods and rapidly adapt to counter new, state-of-the-art image editors.", "questions": "1. The discussion around Tab 3(a) feels insufficient. Could the authors provide more intuition as to why the combination of Gaussian Noise and Blur emerges as the optimal pairing? Given the paper's claim that  the perturbation type has a significant impact on\nthe localization performance, it would be beneficial to see experiments with a more diverse set of perturbation types to fully substantiate this argument.\n\n2. How would the proposed method perform in a classic forgery scenario where an image is first subtly edited (not visible to the naked eye) and then globally post-processed with transformations like Gaussian noise to mask the tampering artifacts? Is the model robust enough to distinguish its own diagnostic perturbations from pre-existing, confounding noise in the image?\n\n3. Could you clarify the evaluation protocol regarding the results in Table 1? The fine-tuned Detective SAM_{SOTA} is presented in Table 2 as the final version of the model, yet it is not benchmarked against the initial baselines in Table 1.\n\n4. What quality control mechanisms are in place to ensure the usability of images generated by AUTOEDITFORGE? Could you provide statistics on the pipeline's reliability, such as the approximate proportion of automatically generated samples that require manual intervention or are discarded? Furthermore, what are the common failure modes of this generation process?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper's primary strength is its methodological design, which leverages the powerful SAM2 foundation model for the task of forgery localization. Rather than designing a new architecture, the authors integrate a perturbation-driven forensic clue using lightweight feature adapters and an automatic mask adapter.  This design is effectively paired with the AutoEditForge pipeline for automated data generation. The adaptable model and data pipeline present a structured approach to the challenge of evolving forgery techniques.", "weaknesses": "1. While this work performs very well, it appears more like a system-level optimization from an engineering perspective, particularly the AUTOEDITFORGE component. I do not object to leveraging the capabilities of existing models to improve a specific task, but the authors' overall framework seems more like an integration of existing work. For instance, numerous studies have explored perturbations at both the image and feature levels, and the concept of feature adapters is also well-established. I would like the authors to discuss the scientific contribution of this paper.\n\n2. The method is tightly coupled with the promptable architecture of SAM2. While this is a clever design choice, it raises critical concerns about the generality of the proposed paradigm. It is unclear whether this 'perturb-adapt-prompt' approach can be successfully transferred to other prompt-based segmentation models, or if its success is inextricably linked to the specific properties of SAM2's decoder. The paper would be strengthened by a discussion on the conditions required for this transferability, or an explanation of why it might be limited to this specific model family.\n\n3. Using image perturbations to distinguish manipulated regions is a proven and effective method. However, when external noise is added to an edited image, it is unclear whether this approach can maintain its consistent generalization performance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZsG2Tin04V", "reviewer": "Reviewer_EVaR", "summary": "This paper proposes Detective SAM, a lightweight and adaptive framework for localizing forgeries in diffusion-edited images. Rather than relying on differences between clean and edited images, the method utilizes perturbation-induced embedding shifts extracted from a single edited image. These perturbation-based forensic signals are injected into a frozen SAM2 backbone using two lightweight modules: feature adapters that refine the decoder inputs, and a mask adapter that generates an automatic heatmap prompt to guide forgery segmentation. To maintain robustness against evolving editing techniques, the authors further introduce AutoEditForge, an automated pipeline that generates diverse and realistic diffusion-based forgeries for continual fine-tuning. Evaluations across seven datasets and seven baselines show that Detective SAM achieves strong out-of-distribution performance while enabling rapid adaptation to new editing models with minimal computational overhead.", "questions": "1. It would be helpful if the authors could clarify how the adapter design explicitly mitigates forgetting, especially considering that fine-tuning uses only 500 images from recent diffusion models. If future models generate substantially more new edits, would Detective SAM still maintain localization accuracy on prior model generations? A brief discussion or empirical analysis around Lines 81–83 could strengthen this point.\n2. Could the authors clarify their OOD definition in this context? Specifically, when two different image inputs are processed by the same diffusion model (e.g., DALL-E), how is it justified to treat them as distinct distributions?\n3. Including visualization, ablation, or interpretability results showing what the delta corrections capture--such as which regions or features are being adjusted--would make the role of this component clearer. A short qualitative example could effectively illustrate its necessity and benefit.\n4. The authors could further clarify in what deployment scenarios the efficiency aspect is critical. For instance, is the method intended for frequent online updates or resource‑limited forensic systems? Discussing the practical motivation would help contextualize the design choice.\n5. It would strengthen the paper if the authors could include either a quantitative assessment (e.g., perceptual quality metrics or human evaluation) or a qualitative justification for the realism and diversity of AutoEditForge outputs. This would better support the claim that the generated data effectively represents real‑world forgery scenarios.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The paper clearly identifies the limitations of existing forgery localization methods when applied to diffusion-edited images, and effectively addresses both the performance degradation and the challenge of adapting to continuously emerging editing models.\n2. The proposed approach fully leverages the segmentation capabilities of SAM2 by introducing lightweight adapter modules that can be efficiently trained and reliably guide localization across a variety of recent diffusion-based editing pipelines.\n3. Extensive experiments against seven competitive baselines across seven diverse datasets provide strong empirical evidence of the robustness and generalization performance of Detective SAM.", "weaknesses": "1. While the authors emphasize the importance of continual fine-tuning using AutoEditForge (Table 2) and set catastrophic forgetting as one of persistent problems in current IFL systems, it remains unclear whether the proposed adapter modules are genuinely resilient to catastrophic forgetting. The current evidence does not directly show whether older edit distributions remain preserved when new diffusion models are introduced.\n2. The paper consistently refers to unseen datasets as “out-of-distribution” (OOD). However, the training set MagicBrush and the test set AutoSplice share the same editing model, DALL-E. Given that the diffusion models are trained to estimate training image distributions, the distinction between in-distribution and OOD becomes ambiguous.\n3. The feature adapters are described as learning residual delta corrections between clean and perturbed embeddings, yet the paper provides limited analysis to verify what these corrections represent or how they contribute to performance improvements.\n4. The manuscript repeatedly emphasizes the lightweight and efficient nature of Detective SAM. While this is valuable, the motivation for efficiency as a primary design goal is not entirely clear, given that forgery localization typically prioritizes accuracy over speed.\n5. Although AutoEditForge is central to continual adaptation, the paper does not quantitatively evaluate the realism or consistency of its generated edits.\n\nNote: Weaknesses 1-5 correspond directly to Questions 1-5.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8IDb4pEJEd", "reviewer": "Reviewer_miFc", "summary": "This paper presents Detective SAM, a model for localizing AI-generated image forgeries. The proposed framework builds on top of SAM2 by incorporating perturbation-driven signals to fine-tune two auxiliary modules, i.e., a mask adapter and a feature adapter, while keeping the backbone frozen. In addition to forgery localization, the authors introduce an automated pipeline that integrates instruction-based local editing methods, allowing them to evaluate the generalization ability of Detective SAM with respect to various editing techniques.", "questions": "Please see the Weaknesses for details.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-structured, and the presentation is clear and easy to follow.\n\n2. The task of forgery localization is relevant to current research in trustworthy AI.\n\n3. Leveraging a large foundation model like SAM2 for general-purpose forgery detection is a well-motivated and promising direction.\n\n4. The experiments support the performance claims well. In particular, the integration of local editing methods into the evaluation pipeline adds an interesting perspective on the model’s generalization.", "weaknesses": "While I do not find any major flaws, I have a few questions and suggestions for improvement:\n\n1. Perturbation design: According to Section 3.2, each image is associated with N perturbed variants (e.g., Gaussian blur, Gaussian noise, JPEG compression). Table 3(a) suggests that localization performance improves with the number of perturbations, but it is unclear whether this improvement saturates. Could the authors explore a wider range of perturbations and analyze how increasing N continues to affect performance?\n\n2. Failure case analysis: It would be helpful to include more examples of failure cases, particularly for fine-grained or challenging forgery categories. A qualitative and/or quantitative discussion of current model limitations would enhance the reader’s understanding of where Detective SAM might still fall short.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)