Towards Reliable Identification of Diffusion-based Image Manipulations
Authors: Alex Costanzino
Woody Bayliss
Juil Sock
Marc Gorriz Blanch
Danijela Horak
Ivan Laptev
Philip Torr
Fabio Pizzati
Venue: NeurIPS 2025 poster ()
Keywords: ifdl
image
forgery
identification
robust
robustness
generalised
generalized
generalisation
generalization
detection
localisation
localization
tampering
inpainter
diffusion
manipulation
alteration
deepfake
Primary area: applications
TL;DR: A novel method to detect and localise forgeries coming from diffusion-based inpainter models.

Abstract: Changing facial expressions, gestures, or background details may dramatically alter the meaning conveyed by an image. 
Notably, recent advances in diffusion models greatly improve the quality of image manipulation while also opening the door to misuse. 
Identifying changes made to authentic images, thus, becomes an important task, constantly challenged by new diffusion-based editing tools.
To this end, we propose a novel approach for ReliAble iDentification of inpainted AReas (RADAR).
RADAR builds on existing foundation models and combines features from different image modalities.
It also incorporates an auxiliary contrastive loss that helps to isolate manipulated image patches.
We demonstrate these techniques to significantly improve both the accuracy of our method and its generalisation to a large number of diffusion models.
To support realistic evaluation, we further introduce BBC-PAIR, a new comprehensive benchmark, with images tampered by 28 diffusion models. 
Our experiments show that RADAR achieves excellent results, outperforming the state-of-the-art in detecting and localising image edits made by both seen and unseen diffusion models. 
Further information about our code, data and models, including separate licensing terms, will be publicly available at https://alex-costanzino.github.io/radar/.

Towards Reliable Identification of Diffusion-based Image Manipulations
Alex Costanzino" University of Bologna
Woody Bayliss BBC R&D
Juil Sock BBC R&D
Mare Gorriz Blanch BBC R&D
Danijela Horak BBC R&D
Ivan Laptev
Philip Torr
Fabio Pizzati MBZUAI
MBZUAI
University Oxford
Abstract
Changing facial expressions, gestures, or background details may dramatically alter the meaning conveyed by an image. Notably, recent advances in diffusion models greatly improve the quality of image manipulation while also opening the door to misuse. Identifying changes made to authentic images, thus, becomes important task, constantly challenged by new diffusion- based editing tools. To this end, we propose novel approach for ReliAble iDentification of inpainted AReas (RADAR). RADAR builds on existing foundation models and combines features from different image modalities. It also incorporates auxiliary contrastive loss that helps to isolate manipulated image patches. We demonstrate these techniques significantly improve both the accuracy of our method and its generalisation to a large number of diffusion models. To support realistic evaluation, we further introduce BBC-PAIR, new comprehensive benchmark, with images tampered by 28 diffusion models. Our experiments show that RADAR achieves excellent results, outperforming the state-of-the-ar in detecting and localising image edits made by both seen and unseen diffusion models. Further information about our code, data and models, including separate licensing terms, will be publicly available https: / /awex-lexaaaaa/ cost cosstanziio.... g github. 10/ o/radar/.
Introduction
With the advent of diffusion models [21, 15, 62, and associated user-friendly tools [38, 47, 81, 89], image editing has never been so easy and powerful. Along with an unprecedented creative potential, such capabilities also imply risks of misuse. Today, even users with minimal technical expertise can produce highly realistic image edits, raising concerns about the trustworthiness of visual media. In particular, lext-based impainting methods [7, 6] can seamlessly insert arbitrary objects into existing scenes. Such edits pose substantial societal threats: for instance, malicious actors could insert compromising elements into real picture, creating the potential for misinformation, false evidence, or reputational harm [77, 19, 34]. Moreover, removal of certain image elements may aid propaganda or help hide evidence [10]. These safety issues are addressed by approaches for Image Forgery Detection and Localisation (IFDL) [32, 45, 94, 39]. The objective of such methods is to determine whether images have been tampered by editing techniques and to localise modified regions, allowing for the identification of synthetically generated elements.
Given the growing number of image manipulation tools, generalisation of IFDL the large variety of diffusion models presents a significant challenge. Existing IFDL methods focus mostly on Photoshop- inspired image manipulation such copy-pasting visual content and have limited capabilities
This work carried out while the author research visit at the University of Oxford.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

to tackle diffusion- fefdussio--baedd tampering [39, 45, 32, 94]. We argue that a critical issue is increasingly being overlooked: as the number of available diffusion models for image editing continues grow, generalisation across different diffusion models becomes fundamental. An IFDI. model trained on tampered images produced by single diffusion model may completely fail when encountering images generated by a different model [87]. Given the high realism achieved by diffusion models and the very low barrier to their use contrary to tools such as Photoshop - we believe there is need for dedicated solutions that specifically address robust IFDL for modern diffissio-bbssed -based tampering.
Modern IFDL methods often rely on automatically generated tampered images for training [32, 39. 451. To effectively detect manipulations at test time, it is important to maximise the coverage of image editing models used during training [75]. However, this strategy alone is insufficient as many models remain private, customised, or expensive for large-scale data generation. As a consequence, generalisation to unseen models must be achieved through ad-hoc architectural design choices.
To address the above challenge, we propose RADAR (ReliAble iDentification of inpainted AReas), an IFDL method designed detect and localise diffusion-based image manipulations in real scenarios. The design of RADAR focuses on two main principles: (1) learning effectively from data generated by multiple open-source inpainters, be robust large number of models commonly used for image editing, and (2) maximising generalisation to unseen inpainters through targeted architectural choices. For achieving these goals, we propose several contributions. First, we design RADAR's s architecture leveraging pre-trained foundation models for feature extraction, capitalising on their generalisation capabilities [56]. Importantly, we enable the use of multiple foundational encoders, capturing both semantic and structural features, which are subsequently fused through a trainable Fusion Block based on cross-attention. This multi-encoder design allows for richer feature representations, improving generalisation and absolute performance. The fused features are then processed by trainable components to extract localisation maps. We then employ a large number of diffusion models during training, maximising the diversity of training data. We impose contrastive constraints on this data, explicitly aligning the feature spaces associated with different inpainters. This enhances RADAR's ability to exploit training data generated with multiple models, along with promoting generalisation.
Finally, to show the need for cross-inpainter IFDL in realistic deployment conditions, we evaluate RADAR and baselines on BBC-PAIR (BBC Paired Authentic and Inpainted References), a com- prehensive benchmark built with 28 different inpainters to reflect real-world inference behaviours. We include three evaluation scenarios in BBC-PAIR, designed to mimic inpainting practices used by users editing images, such model customisation.
Our contributions can be summarised as follows:
We develop RADAR, a new method for IFDL designed for cross- cross-inpainter robustness, leveraging multiple foundation models for feature extraction, and transformer-specine contrastive constraints explicitly designed to exploit data generated by multiple inpainters, significantly improving generalisation;
We propose a novel data generation pipeline and construct BBC-PAIR, a new benchmark for training and evaluating methods for inpainting- IFDL. BBC-PAIR includes over
150,000 generated images, 28 distinct inpainters, and three evaluation scenarios; We demonstrate state-of-the-art performances on all three BBC-PAIR scenarios, against 7 recent baselines, for both detection and localisation of tampered areas.
2
Related work
Identifying synthetic images. Many methods have been developed to identify synthetic images [20, 13, 57, 80, 28, 83, 91, 23] without abilities to localise tampered regions. Instead, IFDL methods identify both tampered images and localised regions generated by diffusion models. The problem is typically addressed as a data-driven task, although there also exist training-free free approaches [92, 66].
Some rely on the RGB modality only [63]. while many [33, 32, 94, 46, 78, 18] employ low-level multi- modal fused features from spatial and frequency domains, to raise sensitivity to splicing and copy- move across images. This requires training of ad-hoc encoders, limiting generalisation. SAFIRE [45] uses foundation models, but still focuses on a single modality. Others [39, 86, 85) propose language model-basee based approaches, limited in scale as they require human-verifie labels. RADAR instead
2

---

y/
"duck"
Grounded
I
Kosmos-2
Omask
SAM
Inpainters I
Original image
C: "A duck ducklings forest"
Tampered images
Figure I: Data generation pipeline. We first extract with Kosmos- 2 [58] set of objects in an image Torig along with a caption c. We then use Grounded SAM [65] segment one of the objects 0 (e.g. "duck"). Lastly, we use set of K text-to-image inpainters Z to generate K tampered images {Tamp) We use c as prompt to avoid the generation of objects irrelevant to the scene.
can be trained with automatically-geeenee data, and exploits multiple pre-trained foundational transformers, extracting variate sets of high-level features, ultimately benefiting performance.
Generalisation in image forensics. Diversity of data helps generalisation [71, 11,330 35]. although the effects of distributional biases remain significant even for large- scale training [3]. This justifies the combination of large-scale training and generalisation techniques. In deepfake detection, this problem has been tackled, either by increasing the number of models used for data generation [25, 57] or with pipelines based on foundation models [54, 74]. In IDFL., instead, many approaches train on data generated by a restricted set of inpainters, limiting cross- mossl generalisability [32, 39, 45, 94, 18]. While some use contrastive learning for generalisation [45, 17]. we exploit novel transformer-speciffe contrastive strategy on patch representations, designed by reasoning about different distributions emerging while editing images with diffusion models.
Evaluation of IFDI.. Benchmarks for image forensics have evolved together with the progress in
tools for image manipulation. Initial efforts focused on splicing detection, with the Columbia [37], VIPP [8]. and DSO-1 [12] datasets. The field then expanded with CASIA [24] and NIST16 [31], which incorporated diverse manipulation types including splicing, copy-move, and removal attacks, while COVERAGE [84] specifically targeted copy-mov detection through semantically challenging examples. The advent of diffusion models made necessary a new generation benchmarks [53, 32, 45, 39]: CocoGlide [32] introduced the first evaluation of diffusion-based inpainting artifacts, while only recently Safire-MS Expert [45] and SID-Set [39] addressed the broader challenges of detecting and localizing synthetic content across varying scales and model architectures. However, these benchmarks rely on a single inpainting model for image generation. Larger-scale efforts either focus on synthetic image detection only [36, 57, 87], or include a limited set of inpainters [18]. In contrast, our BBC-PAIR spans images modified by 28 inpainters from open source, closed source, to effectively assess generalisation capabilities in realistic setups.
and
3 RADAR
We aim to identify a pixel-wise map of regions inpainted by diffusion model input image We first generate training data suitable for the task with multiple inpainters, as shown in Figure (Section 3.1). As illustrated in Figure our model RADAR obtains patch features for input images using hansformer-based foundation models (Section 3.2). This allows RADAR to benefit from the generalisation capabilities of foundation models, whilst capturing image tampering cues from multiple modalities. We fuse modality-specife representations with a custom attention Fusion Block (Section 3.2). In addition, improve generalisation across inpainters, contrastive constraints during training (Section 3.3). Finally, we produce a tampering map ÿ with Localisation Head which is trained using our automatically generated dataset (Section 3.4). At inference, besides localising modified image regions y, we also aggregate pixel-wise predictions to compute a detection score, predicting whether the image has been tampered or not.
exploit ad hoc
3.1 Data generation
Similar to other works [45, 32], we design ad-hoc data generation pipeline, shown in Figure 1. We begin by sampling an image Torig ~ Donig from a dataset Dorig, which contains only genuine images. The image Torig is processed with the Kosmos-2 [58] multi-modal language model, prompted to extract list of object names present in the scene, denoted as O, {ot, oe....................... ...., o") and
3

---

RADAR
Semantic feets
Geometry feats
O
Contrantvd lourriig
FG
Geometyy encodler
model
Projection Head ?
LSCL
Q
Fusion Block DD0
1i0 F
PuoLh crocediogs
Mult--tead Atlention
Multi-iead Attension
Input
Es
Somantic
Localization Head @
y
Lioc
Fs
Potch
Multi-modal Encoder
3
Fusion Block
000 Multi-mddal
Secs: 33.344
Multi-modal
Contrastive
Figure 2: Training RADAR. We first extract, for input image x, multi-modal features Fa by using our multi-modal encoder & To implement E, we employ the pre-trained Semantic Encoder &g and Geometry Encoder &a. and fuse their extracted features with Fusion Block (on the right, in details). The Fusion Block exploits a symmetric cross-attention mechanism, based on the swapping of keys K in two multi-head attention mechanisms, For fusion, we use a patch-wise MLP. We process the resulting multi-modal features with a Localisation Head 6, mapping to tampering maps y. Using and y, we back-propagate localisation loss Li To increase generalisation across inpainters, use Projection Head to extract embeddings on which we impose contrastive loss LSCL.
caption describing the scene. For each image, we randomly sample an object name Omask O2 (e.g. "duck") from the set. The selected object name mmskk used as a prompt for Grounded SAM [65] (GS), which extracts semantic mask of the object. We define tampering mask y as the mask extracted by GS, Lee GS mmssk). Then, we consider a set K text-based inpainters I= ( .?..... }K For a given pair (Farig v). we apply each inpainter I E I to obtain a tampered image Zummp ("Erng: y, C), where e is the previously extracted caption, used as an inpainting prompt. This ensures that the inpainter generates plausible objects, increasing contextual coherence. For instance, in Figure 1, inpainting an aeroplane rather than duck would impact realism. We also randomly replace y with details in the Appendix.
seeithmmccally-geneateee mask reduce semantic biases. More
For each original image E Dorig construct a sample X' [[oorig: Zlamp' 22 Timp tamp' V/. By processing every Doni in this way, obtain dataset D U2ED.M X including original samples, the corresponding tampered images, and ground-truth masks.
3.2 Foundation models as feature extractors
Multi-modal cues. We build on the generalisation capabilities of foundational models [56] and extract image features using pre-trained visual encoders. Rather than using a single encoder, fuse representations obtained from two different models focused on semantic and geometric image understanding. Manipulations may indeed exhibit semantie inconsistencies, such incoherent tex- tures, requiring adequate semantic-rich feature extraction for identification [49]. However, tampered regions may also reveal structural inconsistencies, such violations of 3D coherence [70], making it identifiable only with a correct geometric interpretation of the scene. Importantly, these signals may point to any single artefact, but emerge only when reasoning about the scene whole.
Following this, we define two pre-trained encoders for feature extraction. First, we employ a Semantic Encoder Es. i.e. network trained to extract semantically rich features. Since self-supervised learning has been shown to promote the emergence of meaningful semantic representations [16], we adopt DINO-v2 [56] for Eg. In parallel, to capture structural cues, introduce Geometry Encoder &g- geometry-oriented oriented Here, we use Depth Anything V2 encoder [88]. which well suited to extracting geometry features thanks to its large-scale pretraining for depth estimation. This choice of modalities is also inspired by relevant works [79, 29, 93]. Notably, both encoders share the same transformer backbone, making their embedding spaces naturally compatible for fusion, yet capturing different features.
In practice, we forward an input x to both encoders, yielding Fs Es(x), Fa EG(xr). Fs and FG refer to sequences of N patch-based features extracted by the transformer encoders, so

---

Patch
Lsct.
Input batch A'
Affected
Tampered
F
Patch level projections
Zorie
Encoder
Projection Head Y
E
Zramp
2/
Jul eastrhee La the bestchi
Euffeetee
Original
1
Lacz
Batch size B
Patch embeddings
Figure 3: Contrastive learning. We identify original, tampered and affected patches. Correspond- ing feature patches are mapped by the head to embeddings, on which we impose the contrastive loss LSCL, enforcing patch features of the same distribution be clustered together. Note that aggregate 2 embeddings from multiple inpainters, promoting cross-inpainter generalisation.
Fs = n=1 Fa = (Sa)a with Sa and Js being the individual patch-level features of each encoder, shown in Figure 2.
Fusion block. For multi-modal processing, we need to combine two sets features. Inspired by previous works [76, 14], we fuse the patch-level features extracted by both encoders with symmetric cross-attention mechanism. Intuitively, this compensates for the lack information each modality by attending to relevant visual cues in the other modality. We implement this using Multi heli--Hed Attention (MH) layers, where we combine the keys of one modality with the queries Q and values V of the other, shown in Figure 2 (right):
Fs-G MHS-G (Ksss), V(Fc)) Fa-s MHc-s (Hlc-s(K(FF)). Q(Fs), (I)
The K(.), and (-) operators are implemented as multi-layer perceptrons (MLPs), separately for each modality. Then, we use another MIP fuse information about corresponding features at the patch level. The MLP processes each pair of patches separately, hence being patchwise MLP (Figure 2). We share the MLP weights across all pairs. patch feature fas in the sequence is:
I's = ʃs Js-a, S'c = Sa fc-s, SM MLP ((ll)
where [-] denotes concatenation. We up the MLP that fMr has the same dimensionality and fa. We obtain Fz by aggregating processed patches, F₂ {fas IN = E(x), abstracting our multi-modal feature extraction as E.
3.3 Patch-level contrastive learning
Contrastive distributions. As mentioned in Section 3.1, for each Torig we generate multiple {x| {alamp- x }. with different models. Training on data from multiple models helps generalising in deepfake detection [57], but experienced that naively using more inpainters for fine-grained task, such as forgery localisation, leads to suboptimal performance. To mitigate this, we use contrastive learning. Intuitively, we aim map features extracted from patches tampered by different models to unique tampered distribution, and maximise their separation from an original distribution of untampered patches. Doing so, encourage RADAR to focus common characteristics across diffusion models, helping to exploit variable data. Importantly, this also aids generalisation to unseen models.
where X D, b E [1, B). For each tampered damp the batch, we extract the indices of tampered patches, i.e. those that overlap with the inpainting mask. Likewise, we extract all patch indices from the original image as representation of original distribution. In Figure we show how we elassify patches following this definition. For clarity, define P(x) as the set of patch indices corresponding to the patch grid of image x. That is, P(x) returns all patches spatially tiled over æ, patch indices in the batch are defined as:
During each training iteration we sample a batch of samples
B K U b= A=
B
Peamp
P(a
Σ 1. 0},
Pong = U P(odnn))
(3)
VEP
6m
where E p denotes all pixel indices within patch p, and yı is the value of the mask pixel i.
5

---

Empirically, we find it beneficial to model a third category of patches, which we refer to as affected. These patches originate from lampered images but do not overlap with the inpainting mask, as we show in Figure 3 in yellow. Despite not being directly manipulated, such patches exhibit distributional shifts due the auto-encoding process latent diffusion models [68], which constitute the vast. majority of open models. Hence, we define:
P Paffected
U
b,k (( (ampp)
Σ v =03.
(4)
bm 1 Armn
Contrastive constraint for transformers. Next, aim to separate distributions of the extracted patch features using a contrastive objective. We process the same batch of samples , ......A.) x)
following the multi-moda encoding described in Sec. 3.2, projecting the extracted patch-level features into a contrastive embedding space to enable distribution-level discrimination. For each image x in the batch, where x refers to either Worig any tampered
- Traang compute its representation F2 = {x)) = {fM 1 Each patch feature fM E Fz is then forwarded to a Projection Head 7, implemented as patch-wise MLP as before, yielding projected embeddings Za that we can aggregate into a feature set Z:
Z, = - = [
Z z=
U Zm.
(5)
b=1 xEX
We write {*]EE denote the set of patch-level embeddings whose indices are in P, and collect projected features associated with the patch index sets defined earlier:
Zorig p=)
Zump- = {=)pe
Zuffected
{ pE)PEP afeees
Ideally, depicted in Figure 3, would like each set of features to be well clustered, maximising its distance from others. This will ease the identification affected patches [42]. We then enforce a super- vised contrastive loss [43], treating each group as a distinct class. Let lg E forig, tamp, affected) denote the label associated with embedding E group A;:
2. For each anchor 24 E Z, we define its anchor
A: (2g E Z 12 = 4..
and minimize the contrastive objective LSCL:
exp (2, zz)
LsCr.
Σ 21
log
(8)
A ΣyEクi
exp (2] 2%b
26 ELE
Importantly, our contrastive learning imposes separation or aggregation on patch representations, hence naturally exploiting transformer-bssed encoding.
3.4 Localising tampering
Training. We aim to estimate tampering maps from input images. For simplicity, let us consider
single training sample X {Fonig Zi ... .= 3). For each image E X, process the extracted multi-modal features F. = E(x) through Localisation Head o, implemented convolution followed by sigmoid activation, following common practices in feature probing [11, 56]. This yields tampering score map ÿ o( Fz). as shown in Figure 2. At training time, use both Torig and all Tramp, defining a supervision mask ytmin based on whether æ is tampered or not, hence Vtmin if x: o Torig, and Yrrain O otherwise. We then define the localisation loss as the sum of binary cross-entropy loss and a dice loss [73]:
(ioe
LBCE (7s Ytmin (x)) + Ldice (? Yrrin (x)))
(9)
Assuming a batched training, we can now impose our full objective:
C = LSCL +
Σ
Σ
Lioe (x, Ytrain (z)).
(10)
b= 2

---

Table 1: Quantitative comparison. We compare the three different setups of BBC-PAIR, always significantly outperforming all other baselines. As expected, we perform best on the ID set. Perfor- mance also robust the LoRA set, showing generalisation to customised models, In the presence of completely unseen inpainters (OOD), RADAR is still robust enough to outperform all competitors.
BBC-PAIR-ID
BBC-PAIR-LORA
BBC-PAIR-OOD
Method
Det.
Loc.
Det.
Loc.
Det.
Loc.
AUCT
Acct
Flf
IoUf
AUC1
Acct
F11
loUf
AUC1
Acct
F11
loU
HiFi-Net [33]
0.625
0.509
0.750
0.376
0.650
0.503
0.732
0.365
0.574
0.525
0.689
0.382
TruFor [32]
0.548
0.538
0.739
0.434
0.519
0.529
0.765
0.443
0.610
0,580
0.752
0.437
MIML [63]
0.468
0.483
0.214
0.110
0.517
0.500
0.240
0.131
0.629
0.505
0.187
0.098
AdaIFI [48]
0.533
0.498
0.762
0.383
0.540
0.532
0.763
0.412
0.606
0.554
0.791
0.447
Mesorch [94]
0.581
0.560
0.744
0.402
0.560
0.519
0.758
0.398
0.667
0.610
0.790
0.441
SAFIRE [45]
0.594
0,531
0.668
0.375
0,515
0.515
0.673
0.395
0.593
0.507
0.716
0.439
SIDA [39]
0.598
0.598
0.764
0.536
0.554
0.554
0.680
0.508
0.679
0.679
0.721
0.425
RADAR
0.945
0.931
0.832
0.600
0.901
0.773
0.810
0.521
0.805
0.709
0.785
0.450
During training, we back- propaaate the total loss C to optimise the Localisation Head ø. the Projection Head % and the Fusion Block, while keeping the multi-modal encoders frozen to preserve the mopality-specific features they encode. Notably, since our contrastive strategy operates at the patch level, a batch yields a large number of samples in each Z. This naturally benefits contrastive learning, which is known to improve with larger sets of comparisons [43].
Inference. At inference time, we discard y and use the Localisation Head e to obtain a pixel-wise tampering probability y. which we binarise to produce tampering maps. Akin to others [22, 90], we define the probability of an entire image to be tampered as the mean the top 1% highest values within y. This focuses on the most prominent forgery-related features while reducing the influence of low-confidence regions. We binarise this value with a threshold 0.5 to perform detection of tampered images.
4 Experiments
4.1 Setup
BBC-PAIR We use Section 3.1 to create the BBC-PAIR benchmark, allowing us to evaluate RADAR and baselines in three different setups. For each setup, we also include the original images Forig to evaluate performance in the absence of tampering. Note that BBC-PAIR also includes existing benchmarks.
BBC-PAIR-ID We consider 15,000/100 randomly sampled Openlmages-v7 [50] as Dorig for
train/test, and we use the data generation pipeline in Section 3.1 with 10 inpainters in I: Sta- ble Diffusion (SD) versions 1.4/1.5/2.1 [68], SD 3/3.5 [26], SDXL [62], Kandinsky 2.2 [64] and
3.1 [5], FLUX.1 [9] schnell and dev. All models are latent [68] and use Diffusers [61] inpaint- ing pipelines, with parameters reported in the Appendix. We generate 150,000/1,000 images for training/testing, processing each image in Dorig with all I e I. Training on this set, we will be in-distribution (ID) for these inpainters.
BBC-PAIR-LORA We edit the Torig in the test split of BBC-PAIR-ID with 10 LoRAs, applied to SD1.5 [68], SD3.5 [26], SDXL [62] and FLUX.1 [9], generating 500 images. We report the LoRAs in the Appendix. Since we apply LoRAs to the inpainters of the ID set, this BBC-PAIR-LORE set allows us to measure the effects of the model customisation on RADAR.
To evaluate cross- coos-inpainter generalisation, we synthesise data using completely unseen inpainters, hence having maximum distribution shift w.r.t. BBC-PAIR-ID First, we generate
BBC-PAIR-OOD
750 tampered images with 8 commercial inpainters: ClipDrop [72], Dall-E 2 [55], Adobe Firefly [1],
FLUX.1 1 Fill [pro] [27], Ideogram [40], LightX [4], Phot.Al [60], YouCam [59]. We use DIV2K (2) as
Donig to maximise differentiation with the ID set. OOD evaluation also implies testing in uncontrolled
scenarios. So, we select the existing inpainting-bane basse CocoGlide [32], MaareeSS-Eppeer [45] and
Set [39] test sets, to evaluate robustness to inpainting strategics different from ours. The union
7

---

Feris
Input
Ground-rruth
Ours
TruForr [32]
AdaIFI. [48]
Mesorch [94]
SIDA [9
Tampered
Non- Non- ter--traeeedd
Figure 4: Qualitative results. Compared the best baselines in the OOD scenario, RADAR accurately localises tampering. Baselines exhibit semantic biases, as SIDA (second row) and Mesorch (fifth row) identify full objects. Importantly, RADAR is robust false positives and does not react to non-tampered images (last two rows). This explains our superior performance in detection.
of these samples is BBC-PAIR-OON OOD. Detailed performance evaluation of all included datasets is in the Appendix. We report only the average in the main paper due space constraints.
Baselines and metrics. We exhaustively compare against the best recent open source methods: TruFor [32], HiFi-Net [33], SAFIRE [45], Mesorch [94], MIML [63], AdalFL [48] and SIDA [39]. For localisation, we employ Fl and IoU to evaluate the similarity with the ground truth mask as commonly reported [39, 32, 45, 48]. Note that localisation only evaluated on tampered images, akin to well-established practices [32, 39, 45, 94]. Consistent with recent studies [39, 32, 33, 94], we also evaluate on binary detection performances, using the area under the ROC curve (AUC) and accuracy with threshold 0.5 to evaluate the classification of images as tampered or not (Section 3.4). Since AdaIFL and MIML do not natively support forgery detection. we calculate detection score as ours, selecting the most confident values of the tampering map ÿ (Section 3.4).
Training details. We train RADAR for 120 epochs with batch-size 16, dropout (p 0.1) and NAdam optimiser [44] (1r=10-1 and decay of 10 using 4 NVIDIA A A100 80GB GPUs, optimizing the fusion block, y and & while keeping Es and &g frozen. More details are given in the Appendix.
4.2 Comparisons with baselines
Table 1 reports experimental comparison with baselines. We significantly outperform all methods in both detection and localisation. expected, we yield the highest metrics the ID set. Note that while we have advantage against baselines on ID data since our training data are generated by same inpainters- this allows us to be more robust in realistic scenarios. For the deployment of RADAR, we aim to maximise performance
impainters commonly used for image editing, such as open source models. Since open source models allow data generation with case, we argue that the best practice is to them for training. Most importantly, RADAR also shines in generalisation, yielding the best localisation on both LoRA (0.521 in IoU) and OOD sets (0.450 in IoU).
Interestingly, in detection, all baselines suffer considerably, yielding low accuracies. We attribute this to their limited robustness the distribution shift with respect their training data. The better generalisation of RADAR, instead, is reflected in highly superior detection performance, improving AUC +0.32//0.25/+0.. tables in the Appendix, including separate evaluations on each of the BBC-PAIR-ORS -OOD datasets. Since localisation performance evaluated on tampered images only - following well-established practices [39, 32, 45, 94] detection results assess robustness to false positives. This is noticeable
against the second best for I//LOR We report detailed performance

---

Accuracy
Input
Geometry fo Semantic f's
Original: 0.709
0.6
0.693
0.73
0.63
0.692
Original:
0.4
0.443
0:439
043
50
444
0.2
JPEG 80
Reslize 75
Blur Blur 10
Origiaa Affected Tampered
JPEG 70
Resizee 50
(a) Multi-modal activations
UMAP analysis
(c) Robustness perturbations
Figure 5: Properties of RADAR. In Figure (a), we analyse feature magnitude in both encoders Eg and &g. highlighting that they are roughly complementary. In Figure (b), we show with UMAP [51] that affected patches serve as separators between original and tampered, justifying our boost in performance. In Figure (c), we demonstrate robustness to common web image operations, namely JPEG compression, resizing, and Gaussian blur.
in the qualitative results in Figure 4 on the BBC-PAIR-OOF set. Not only does RADAR produce more accurate masks to identify tampered regions, but it also correctly ignores non-tampered images (last two rows), where baselines produce predictions on objects in the scene instead (as the rock). SIDA also exhibits semantic biases (second row), identifying full objects as fake (the butterfly). This makes RADAR predictions more reliable for deployment, satisfying our initial design requirements. Note that we provide more qualitative and detailed comparisons the Appendix.
4.3 Properties of RADAR
Next, investigate some emerging properties of RADAR. For our investigation, the BBC- PAIR-OOD test set to minimise the distribution bias in the observed behaviour of the network.
Multi-modality. We display Figure the normalised activations of I's and I's in Equation (2) (hence, the features before fusion), averaged over channels for tampered inputs. Each map represents the importance of the features of each modality, per pixel, and ranges from 0 (low importance) to (high importance). We notice that the spatial distribution of activations is roughly complementary across modalities. other words, shows that &g and &s tend to consider different elements for their feature extraction. This proves that our design choices, based on semantic and geometric encoders, allow us to extract meaningful features for the entirety the scene, visually showing the reasons behind RADAR's performance. Interestingly, while semantic features focus subjects (such the dogs in the first row), geometric features highlight regular structures (such as the stairs in the second row). We conjecture that this may aid in detecting different types of tampering.
Distribution analysis. We want to understand the role of affected patches in the LScL optimisation. In Figure 5b, we report UMAP [51] plot of the patch-level projection features extracted by y on EBC-PAIR-OOD We observe that affected patches separate original and tampered clusters. This highlights that the hybrid nature of the affected patch distribution, processed by the auto-encoder in latent diffusion models, while containing no generated content, naturally emerges during training as an intermediate distribution, justifying our design.
Robustness to perturbations. In Figure Sc, study RADAR performance in terms of Accuracy (detection) and loU (localisation) on BBC-PAIR-OOD with common perturbations introduced by the upload on the web, such JPEG compression (80/70 rate), resizing (75%/50%) or blurring with a Gaussian filter (variance 10/5). We highlight negligible performance drops in all tasks, further proving RADAR's robustness. We attribute this the large pre-training of Eg and &c. presumably including perturbed images as well and consequently inducing robustness to perturbations in RADAR.
4.4 Ablation studies
now present ablation studies on our contributions. Due to RADAR's training cost, for the following experiments, we train on 10% of the original BBC-PAIR-ID ID for 70 epochs.

---

Table 2: Ablation studies. We investigate fusion strategies, contrastive formulations, and the number of inpainters (K). Our setup is always the best.
BBC-PAIR-ID
BBC-PAIR-LORA
BBC-PAIR-OOD
Setup
Det.
Loc. FI
Det.
Loc.
Det.
Loc.
AUCT
Ace.t
InU
AUCT Acc.t
F1
loU'
AUCT
Acc.f
FIf
loU
Multi-modality and fusion
Es only
0.582
0.502
0.780
0.538
0.590
0.510
0.735
0.484
0.567
0.516
0.706
0.410
Eq only
0,589
0.541
0.781
0.533
0.558
0.502
0.774
0.496
0.524
0.510
0.736
0.422
Concat
0.691
0.529
0.788
0.546
0.581
0.515
0.773
0.498
0.543
0.519
0.748
0.427
Sum
0,602
0.515
0.785
0.538
0.598
0.510
0.756
0.484
0,523
0,513
0.739
0.427
Ours
0,921
0.893
0.790
0.547
0.771
0.678
0.789
0.474
0.746
0.689
0.773
0,422
Contrastive Learning
w/o CSCL
0,903
0.849
0.774
0.511
0.627
0.599
0.743
0.424
0.709
0.670
0.718
0.402
w/o Affect.
0,932
0.872
0.790
0.550
0.763
0.694
0.777
0.465
0.729
0.676
0.756
0.423
Afiect=Orig
0,922
0.856
0.783
0.538
0.727
0.651
0.771
0.447
0.741
0.688
0.758
0.428
Ours
0,921
0.893
0.790
0.547
0.771
0.678
0.789
0.474
0.746
0.689
0.773
0,422
Number of inpainters
K
K
0.896
0.793
0.804
0.485
0.692
0.582
0.766
0.406
0.720
0.623
0.809
0.425
K = 5
0.937
0.858
0.811
0.524
0.763
0.625
0.774
0.423
0.741
0.636
0.794
0.421
K = 10 (Ours)
0.921
0.893
0.790
0.547
0.771
0.678
0.789
0.474
0.746
0.689
0.773
0.422
Fusion Block. We evaluate the architecture of our multimodal encoder in Table 2 (top). We first restrict the model to single encoders (Es and &g only), and observe significant decrease in performance, highlighting the importance of complementary encoders used by RADAR. This shows that both semantic and geometric cues are fundamental for proper understanding of the scene in IFDL. We also investigate simpler fusion mechanisms, replacing the multi-head attention with simple Concat or Sum operations followed by MLP. In all cases, performance drops significantly, especially for detection (AUC 0.921 vs. 0.691 and Acc. 0.893 vs. 0.541 of the best alternative). This shows that our Fusion Block is important for extracting meaningful cues from heterogeneous foundation models.
Contrastive loss. We investigate alternative setups of our contrastive formulation in Table (middle). Removing LSCL (w/o LSCL) yields the highest drop in performance (AUC 0.932 vs. 0.921 and Ace. 0.893 vs. 0.849 in detection, F1 0.790 vs. 0.774 and IoU 0.550 0.511 in localisation), showing that only expanding I is suboptimal. We also investigate the effectiveness the affected distribution, first removing completely (w/o affected) and then mapping affected patches to the original class instead (Affect=Orig, see Section 3.3). All alternative configurations result in worse performance.
Number of inpainters. We test RADAR by reducing the number of inpainters K in I used for training. We compare training with K = {1, 10 (ours)) by randomly selecting K inpainters the full set of 10 inpainters used for the generation of BBC-PAIR-ID. We normalise the computational cost for training, and report the average over runs in Table 2 (bottom). For both detection and localisation, increasing the number of inpainters significantly boosts results (Acc. 0.893 vs. 0.793 in detection, IoU 0.547 vs. 0.485 localisation).
5 Conclusions
We introduced RADAR, a novel IFDL method designed to maximise in-distribution coverage and generalisation to unseen diffusion models. We proposed architectural contributions, fusing features extracted by multiple foundation models, and exploiting transformer-specifie contrastive constraints on extracted patch features to promote generalisation. We also introduce BBC-PAIR, for a fair assessment in the presence of open-source models, model customisation, and commercial solutions. While we significantly outperform the state-of-the-a in IFDL, we emphasise that the complexity of the problem still leaves room for improvement. We hope that our research will encourage future work in this direction to mitigate the potential high societal impact of image manipulations.
10

---

References
[1] Adobe Inc.: Adohe firefly, http:://tt::::ffll .wwpeeeelllddd..b...ooooooobeeee adobe. com (2023)
[2] Agustsson, E., Timofte, R.: Ntire 2017 challenge on single image super-resolution: Dataset and study. In: IEEE Conference on Computer Vision and Pattern Recognition Workshops (2017)
[3] Al Kader Hammoud, H.A., Das, T., Pizzati, F., Torr, P.H., Bibi, A., Ghanem, B.: On pretraining data diversity for self--upervised learning. In: European Conference on Computer Vision (2024)
[4] AndOr Communications Pvt Ltd: Lightx. https // /ww. lightxeditor com (2016)
[5] Arkhipkin, V., Vasilev, V., Filatov, A., Pavlov, I., Agafonova, J., Gerasimenko, N., Averchenkova, A., Mironova, E., Bukashkin, A., Kulikov, K., et al.: Kandinsky 3: Text-to-image synthesis for multifunctional generative framework. In: Empirical Methods in Natural Language Processing (2024)
[6] Avrahami, O., Fried, O., Lischinski, D.: Blended latent diffusion. ACM Transactions on Graphics (2023)
[7] Avrahami, O.. Lischinski, D., Fried, O.: Blended diffusion for text-driven editing of natural images. In: IEEE Conference on Computer Vision and Pattern Recognition (2022)
[8] Bianchi, T., Piva, A.: Image forgery localization via block-grained analysis of jpeg artifacts.
IEEE Transactions on Information Forensics and Security (2012)
[9] Black Forest Labs: Announcing black forest labs. https://bfl ai/announcements/
24-08 11--8800-bbF (2024)
[10] Blakemore, E.: How photos became weapon in stalin's great purge. Canal História (2019)
[11] Caron, M., Touvron, H., Misra, I., Jégou, H., Mairal, J., Bojanowski, P., Joulin, A.: Emerging properties in self-supervised vision transformers. In: International Conference on Computer Vision (2021)
[12] de Carvalho, T.J., Riess, C., Angelopoulou, E., Pedrini, H., de Rezende Rocha, A.: Exposing digital image forgeries by illumination color classification. IEEE Transactions on Information Forensics and Security (2013)
[13] Cazenavette, G., Sud, A., Leung. T., Usman, B.: Fakeinversion: Learning to detect images from unseen text-to-image models by inverting stable diffusion. In: IEEE Conference on Computer Vision and Pattern Recognition (2024)
[14] Chen, C.F.R., Fan, Q., Panda, R.: Crossvit: Cross-attention multi-scale vision transformer for image classification. In: International Conference on Computer Vision (2021)
[15] Chen, J., WU, Y., Luo, S., Xie, E., Paul, S., Luo, P., Zhao, H., Li, Z.: Pixart-6: Fast and controllable image generation with latent consistency models (2024)
[16] Chen, T., Korbblith, S., Norouzi, M., Hinton, G.: A simple framework for contrastive learning of visual representations. In: International Conference on Machine Leamingg (2020)
[17] Chen, Y., Yin, W., Luo, A., Yang, J., Wang, J.: Improving the generalization and robustness of computer-genet generated image detection based contrastive learning. International Journal of Intelligent Systems (2025)
[18] Chen, Y., Huang, X., Zhang, Q., Li, W., Zhu, M., Yan, Q., Li, S., Chen, H., Hu, H., Yang, J., et al.: Gim: A million-scale benchmark for generative image manipulation detection and localization. In: AAAI Conference on Artificial Intelligence (2025)
[19] Chesney, R., Citron, D.K.: Deep fakes: A looming challenge for privacy, democracy, and national security. California Law Review (2019)
[20] Chu, B., Xu, X., Wang, X., Zhang, Y., You, W., Zhou, L.: Fire: Robust detection of diffusion- generated images via frequency-guide reconstruction error. In: IEEE Conference on Computer Vision and Pattern Recognition (2025)

---

[21] Croitoru, F.A., Hondru, V., Ionescu, R.T., Shah, M.: Diffusion models in vision: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence (2025)
[22] Das, A.S., Pang, G., Bhuyan, M.: Adaptive Deviation Learning for Visual Anomaly Detection
with Data Contamination In: Winter Applications of Computer Vision (2025)
[23] Doloriel, C.T., Cheung, N.M.: Frequency masking for universal deepfake detection. In: IEEE International Conference on Acoustics, Speech, and Signal Processing (2024)
[24] Dong, J., Wang. W., Tan, T.: CASIA image tampering detection evaluation database. In: IEEE China Summit and International Conference on Signal and Information Processing (2013)
[25] Epstein, D.C., Jain, I., Wang, O., Zhang, R.: Online detection of ai-generated images. In: International Conference on Computer Vision (2023)
[26] Esser, P., Kulal, S., Blattmann, A., Entezari, R., Müller, J., Saini, H., Levi, Y., Lorenz, D., Sauer,
A., Boesel, F., et al.: Scaling rectified flow transformers for high-resolution image synthesis. In: International Conference on Machine Learning (2024)
[27] FLUX AI: Flux.1 fill [pro]. wttps::/ttttuutie
ai (2024)
[28] Frank, J., Eisenhofer, T., Schönherr, L., Fischer, A., Kolossa, D., Holz, T.: Leveraging frequency analysis for deep fake image recognition. In: International Conference on Machine Learning (2020)
[29] Fu, K., Fan, D.P., Ji, G.P., Zhao, Q. Shen, J., Zhu, C.: Siamese network for rgb-d salient object detection and beyond. IEEE Transactions on Pattern Analysis and Machine Intelligence (2021)
[30] GPS Media:
Dpreview. https:://w/wtt http://pwwwppw...../.t/ com/ (1998)
[31] Guan, H., Kozak, M., Robertson, E., Lee, Y., Yates, A.N., Delgado, A., Zhou, D., Kheyrkhah. T.
Smith, J., Fiscus, J.: Mfc datasets: Large-scale benchmark datasets for media forensic challenge evaluation. In: Winter Applications of Computer Vision Workshops (2019)
[32] Guillaro, F., Cozzolino, D., Sud, A., Dufour, N., Verdoliva, L.: Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization. In: IEEE Conference on Com- puter Vision and Pattern Recognition (2023)
[33] Guo, X., Liu, X., Ren, Z., Grosz, S., Masi, I., Liu, X.: Hierarchical fine-grained image forgery detection and localization. In: IEEE Conference on Computer Vision and Pattern Recognition (2023)
[34] Hancock, J.T., Bailenson, J.N.: The social impact of deepfakes. Cyberpsychology. behavior, and social networking (2021)
(35] Hendryeks, D., Basart, S., Mu, N., Kadavath, S., Wang, F., Dorundo, E., Desai, R., Zhu, T., Parajuli, S., Guo, M., et al.: The many faces of robustness: critical analysis out-of- distribution generalization. In: International Conference on Computer Vision (2021)
[36] Hong, Y., Zhang, J.: Wildfake: A large-scale challenging dataset for ai-generated images detection. In: AAAI Conference on Artificial Intelligence (2025)
[37] Hsu, Y.f., Chang, S.F.: Detecting image splicing using geometry invariants and camera char- acteristics consistency. In: IEEE International Conference on Multimedia and Expo (ICME) (2006)
[38] Huang, Y., Huang. J., Liu, Y., Yan, M., Lv, J., Liu, J., Xiong, W., Zhang, H., Cao, L., Chen, S.: Diffusion madel-based image editing: survey. IEEE Transactions on Pattern Analysis and Machine Intelligence (2025)
[39] Huang, Z., Hu, J., Li, X., He, Y., Zhao, X., Peng, B., Wu, B., Huang, X., Cheng, G.: Sida: Social media image deepfake detection, localization and explanation with large multimodal model. In: IEEE Conference Computer Vision and Pattern Recognition (2025)
[40] Ideogram Inc.: Ideogram. https: https://ideogram ai (2023)
12

---

[41] Jia, S., Huang, M., Zhou, Z., Ju, Y., Cai, J., Lyu, S.: Autosplice: A text-prompt manipulated image dataset for media forensics. In: IEEE Conference on Computer Vision and Pattern Recognition Workshops (2023)
[42] Khosla, P., Teterwak, P., Wang, C., Samna, A., Tian, Y., Isola, P., Maschinot, A., Liu, C., Krishnan, D.: Supervised contrastive learning. In: Advances on Neural Information Processing Systems (2020)
[43] Khosla, P., Teterwak, P., Wang, C., Sarna, A., Tian, Y., Isola, P., Maschinot, A., Liu, C., Krishnan, D.: Supervised contrastive learning. Advances on Neural Information Processing Systems (2020)
[44] Kingma, D.P., Ba, J.: Adam: method for stochastic optimization. In: International Conference on Learning Representations (2015)
[45]
Kwon, M.J., Lee, W., Nam, S.H., Son, M., Kim, C.: Safire: Segment any forged image region. In: AAAI Conference on Artificial Intelligence (2025)
[46] Li, S., Ma, W., Guo, J., Xu, S., Li, B., Zhang. X.: Unionformer: Unified-leamiin transformer with multi-view representation for image manipulation detection and localization, In: IEEE Conference on Computer Vision and Pattern Recognition (2024)
[47] Li, Y., Bian, Y., Ju, X., Zhang, Z., Shan, Y., Zou, Y., Xu, Q.: Brushedit: All-in-one image inpainting and editing. arXiv preprint 1131v:2412.10316 (2024)
[48] Li, Y., Cheng, F., Yu, W., Wang. G., Luo, G., Zhu, Y:: Adaifl: Adaptive image forgery localization via a dynamic and importance-aware transformer network. In: European Conference on Computer Vision (2025)
[49] Liu, H., Wang, Y., Qian, B., Wang. M., Rui, Y.: Structure matters: Tackling the semantic discrepancy diffusion models for image inpainting, In: IEEE Conference on Computer Vision and Pattern Recognition (2024)
[50] LLC, G.: Open images dataset. https:// wog.leapis.comm/ppeiiiii wwtppppi....ooppppiiipee index. html (2020)
[51] McInnes, L., Healy, J., Melville, J.: Umap: Uniform manifold approximation and projection for dimension reduction. arXiv preprint
(2018)
[52] Nichol, A., Dhariwal, P., Ramesh, A., Shyam, P. Mishkin, P., McGrew, B., Sutskever, I., Chen, M.: Glide: Towards photorealistic image generation and editing with text-guided diffusion models (2022)
[53] Novozamsky, A., Mahdian, B., Saic, S.: IMD2020: A large-scale annotated dataset tailored for detecting manipulated images, In: Winter Applications of Computer Vision (2020)
[54] Ojha, U., Li, Y., Lee, YJJ.: Towards universal fake image detectors that generalize across generative models. In: IEEE Conference on Computer Vision and Pattern Recognition (2023)
[55] OpenAl: Dall-e 2. httph:tt////ett https://opena.. wwtpcaccomaaaeeeeaoeae..c....aaa (2022)
[56] Oquab, M., Darcet, T., Moutakanni, T., Vo, H., Szafraniec, M., Khalidov, V., Fernandez, P.,
Haziza, D., Massa, F., El-Nouby, A., et al.: Dinov2: Learning robust visual features without supervision. Transactions on Machine Learning Research (2024)
[57] Park, J., Owens, A.: Community forensics: Using thousands of generators to train fake image detectors. In: IEEE Conference Computer Vision and Pattern Recognition (2025)
[58] Peng. Z., Wang, W., Dong, L., Hao, Y., Huang, S., Ma. S.. Wei, F:: Kosmos-2: Grounding multimodal large language models to the world. In: International Conference on Learning Representations (2024)
[59] Perfect Corp.:
Youcam.
makeup (2014)
13

---

[60] Phot.Al: Phot.ai. btttp::/www. phot. ai (2023)
[61] von Platen, P., Patil, S., Lozhkov, A., Cuenca, P., Lambert, N., Rasul, K., Davaadorj. M., Nair,
D., Paul, S., Berman, W., Xu, Y., Liu, S., Wolf, T.: Diffusers: State-of-the-art diffusion models. (2022)
https: httaa:///ee http:/gittttt g/gggttuub.... httm://ugginggac//tfffssss
[62] Podell, D., English, Z., Lacey, K., Blattmann, A., Dockhorn, T., Müller, J., Penna, J., Rom- bach, R.: Sdxl: Improving latent diffusion models for high-resolution image synthesis. In: International Conference Learning Representations (2024)
[63] Qu, C.,, Zhong, Y., Liu, C.,, Xu, G., Peng, D., Guo, F., Jin, L.: Towards modern image manipulation localization: A large-scale dataset and novel methods. In: IEEE Conference on Computer Vision and Pattern Recognition (2024)
[64] Razzhigaev, A., Shakhmatov, A., Maltseva, A., Arkhipkin, V., Pavlov, I., Ryabov, I., Kuts, A., Panchenko, A., Kuznetsov, A., Dimitrov, D.: Kandinsky: an improved text-to-image synthesis with image prior and latent diffusion. In: Empirical Methods in Natural Language Processing (2023)
[65] Ren, T., Liu, S., Zeng, A., Lin, J., Li, K., Cao, H., Chen, J., Huang, X., Chen, Y., Yan, F., al.: Grounded sam: Assembling open-world models for diverse visual tasks. arXiv preprint arXiv:2401. 141559 (2024)
[66] Ricker, J., Lukovnikov, D., Fischer, A.: Aeroblade: Training-fiee detection of latent diffusion images using autoencoder reconstruction error. IEEE Conference on Computer Vision and Pattern Recognition (2024)
[67] RrdreguuezOOteea, Y., Ballesteros, D.M., Renza, D.: Copy-move forgery detection (emfd) using deep learning for image and video forensics. Journal of Imaging (2021)
[68] Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models. In: IEEE Conference on Computer Vision and Pattern Recognition (2022)
[69] Saharia, C., Chan, W., Saxena, S., Li, L., Whang, J., Denton, E.L., Ghasemipour, K., Gon- tijo Lopes. R., Karagol Ayan, B., Salimans, T., Ho. Fleet, D.J., Norouzi, M.: Photorealistic text-to-image diffusion models with deep language understanding. In: Advances on Neural Information Processing Systems (2022)
[70] Sarkar, A., Mai, H., Mahapatra, A., Lazebník, S., Forsyth, D.A., Bhattad, A.: Shadows don't lie and lines can't 't bend! generative models don't know projective geometry... for now. In: IEEE Conference on Computer Vision and Pattern Recognition (2024)
[71] Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C., Wightman, R., Cherti, M., Coombes, T. Katta, A., Mullis, C., Wortsman, M., et al.: Laion-5b: An open large-scale dataset for training next generation image-text models. Advances on Neural Information Processing Systems (2022)
[72] Stability AI: Clipdrop. https: http://///p/ppppppp// co (2020)
[73] Sudre, C.H., Li, W., Vercauteren, T., Ourselin, S., Jorge Cardoso, M.: Generalised dice overlap deep learning loss function for highly unbalanced segmentations. In: The International Conference on Medical Image Computing and Computer Assisted Intervention Workshops (2017)
[74] Tan, C., Tao, R., Liu, H., Gu, G., Wu, B., Zhao, Y., Wei, Y:: C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. In: AAAI Conference on Artificial Intelligence (2025)
[75] Torralba, A., Efros, A.A.: Unbiased look dataset bias. In: IEEE Conference on Computer Vision and Pattern Recognition (2011)
[76] Tsai, Y.H.H., Bai, S., Liang, P.P., Kolter, J.Z., Morency, L.P., Salakhutdinov, R.: Multimodal transformer for unaligned multimodal language sequences. In: The Annual Meeting of the Association for Computational Linguistics (2019)
14

---

[77] Vaccari, C., Chadwick, A.: Deepfakes and disinformation: Exploring the impact of synthetic political video on deception, uncertainty, and trust in news. Social Media+ Society (2020)
[78] Wang, J., Wu, Z., Chen, J., Han, X., Shrivastava, A., Lim, S.N., Jiang, Y.G.; Objectformer for image manipulation detection and localization. In: IEEE Conference on Computer Vision and Pattern Recognition (2022)
[79] Wang, P., Shen, X., Lin, Z., Cohen, S., Price, B., Yuille, A.L.: Towards unified depth and semantic prediction from single image. In: IEEE Conference on Computer Vision and Pattern Recognition (2015)
[80] Wang, S.Y., Wang, O., Zhang, R., Owens, A., Efros, A.A.: Cnn-generated images are surpris- ingly easy spot... for now. In: IEEE Conference on Computer Vision and Pattern Recognition (2020)
[81] Wang. S., Saharia, C., Montgomery, C., Pont-Tuset, J., Noy, S., Pellegrini, S., Onoe, Y., Laszlo, S., Fleet, D.J., Soricut, R., Baldridge, J., Norouzi, M., Anderson, P., Chan, W.: Imagen editor and editbench: Advancing and evaluating text-guided image inpainting. arXiv preprint arXiv:2212.06900 (2023)
[82] Wang. Y., Huang. Z., Hong, X.: Opensdi: Spotting diffusion generitte images in the open world. In: IEEE Conference on Computer Vision and Pattern Recognition (2025)
[83] Wang, Z., Bao, J., Zhou, W., Wang, W., Hu, H., Chen, H., Li, H.: Dire for deffurion-generaated image detection. In: International Conference on Computer Vision (2023)
[84] Wen, B., Zhu, Y., Subramanian, R., Ng. T.T., Shen, X., Winkler, S.: COVERAGE A novel database for copy-move forgery detection, In: IEEE International Conference on Image Processing (2016)
[85] Wen, S., Ye, J., Feng, P., Kang, H., Wen, Z., Chen, Y., Wu, J., Wu, W., He, C., Li, W.: Spot the fake: Large multimodal model-based synthetic image detection with artifact explanation. arXiv preprint arXiv:2503. 14905 (2025)
[86] Xu, Z., Zhang. X., Li, R., Tang, Z., Huang, Q., Zhang, J.: Fakeshield: Explainable image forgery detection and localization via multi-modal large language models. In: International Conference Learning Representations (2025)
[87] Yan, S.. Li, O., Cai, J., Hao, Y., Jiang, X., Hu, Y., Xie, W.: A sanity check for ai-generated image detection. In: International Conference on Learning Representations (2025)
[88] Yang, I.,, Kang, B., Huang, 7., Zhao, Z., Xu, X., Feng. J., Zhao, H.: Depth anything v2. In: Advances on Neural Information Processing Systems (2024)
[89] Yu, T., Feng. R., Feng. R., Liu, J., Jin, X., Zeng. W., Chen, Z.: Inpaint anything: Segment anything meets image inpainting. arXiv preprint arXiv:2304.06790 (2023)
[90] Zavitanik, V., Kristan, M., Skocaj. D.: Draem a discriminatively trained reconstruction embedding for surface anomaly detection. In: International Conference on Computer Vision (2021)
[91] Zeng, Z., Liu, H., Peng. D., Jin, L., Watanabe, H.: Time step generating: A universal synthesized deepfake image detector. arXiv preprint arXiv:2411. 10016 (2024)
[92] Zhang, 7.,, Chang, M.C., Li, X.: Training-free image manipulation localization using diffusion models. In: AAAI Conference on Artificial Intelligence (2025)
[93] Zhu, S., Brazil, G., Liu, X.: The edge of depth: Explicit constraints between segmentation and depth. In: IEEE Conference on Computer Vision and Pattern Recognition (2020)
[94] Zhu, X., Ma, X., Su, L., Jiang, Z., Du, B., Wang, X., Lei, Z., Feng, W., Pun, C.M., Zhou, J.: Mesoscopic insights: Orchestrating multi-scale & hybrid architecture for image manipulation localization. In: AAAI Conference Artificial Intelligence (2025)
15

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes].
Justification: the abstract outlines both the benchmark and the method that are presented in detail in the rest of the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings. It is fine to include aspirational goals as motivation as long as is clear that these goals are attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes].
Justification: limitations of the work are mentioned in the conclusion of the paper and discussed in the appendix.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approxinations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms
and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [NA].
Justification: the paper does not include theoretical results.
16

---

Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes].
Justification: all the implementation details of the method are specified, and random seeds are fixed across all experiments. Moreover, the code will be released upon eventual acceptance with both train and evaluation scripts, along with the model's 's checkpoint.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access to hosted model (e.g., in the of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis-
sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes].
17

---

reproducible, they the code for both method and data generation will be released upon eventual acceptance. Moreover, most of the generated data will be released as well. Part of the generated data cannot be released due to licensing issues; however, since the starting data is open source and the data generation code will be released, will be possible to generate the same data as well.
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code. Please see the NeurIPS code and data submission guidelines (https: (https:/nnips.co cc/
(anlllccy) (cy for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https:
/ //nips. cc/ppccccpccccccccccccccccccc gwwdee/iee/e/eeeeo Codeeuumii
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes].
Justification: experimental details are mentioned both in the main paper and its appendix. Moreover, the code will contain the final train and test scripts employed for the main tables experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them. The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No].
Justification: not all experiments have been run multiple times since it would be too time and resource-consuming. However, the inference is deterministic and random seeds have been fixed to ensure stability in the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
18

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.: Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes].
Justification: details on the machine employed are included in the training details.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https atttps//neeurr /tt.rreurrp..peee het.oliieeehhccucdeeellleeee
Answer: [Yes].
Justification:
we reviewed the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes].
Justification: these impacts are mentioned in the abstract and introduction of the paper, and also addressed in the appendix. The main purpose the paper is to counteract malicious use of artificial intelligence, i.e., detection of manipulation visual data.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal
impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses
(e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
19

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning conrectly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional
unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes].
Justification: these implications discussed and addressed in the appendix.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes].
Justification: the creators and original owners of assets are properly credited, and license and terms of use are explicitly mentioned in the supplemental material and properly respected.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include a URL
The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information not available online, the authors are encouraged to reach out to the asset's s creators.
20

---

13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes].
Justification: the code released upon eventual acceptance will provide proper documentation with instructions run both train and evaluation scripts, along with the final model's checkpoint.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/mooel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA].
Justification: the paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA].
Justification: the paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with
human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMSs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used
21

---

only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA].
Justification: LLMs have been exclusively employed as syntax checker integrated in the text editor.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy (https: : http///ris..///oooeeeeeeeeacceee for what should or should not be described.
22

---

Appendix
In this document, we propose complementary information the main paper. First, we list all assets used in Appendix A. Then, we report details for the reinplementation in Appendix B, including also details on the construction of BBC-PAIR. provide extensive additional analysis, results, and ablations in Appendix C, while we propose final remarks and limitations in Section D.
A
Assets
A.1
Methods
For all the competitors [33, 32, 63, 48, 94, 45, 39], we employed their official implementations. In particular:
released under MIT license;
TruFor: htteec.w.rrrre//sttu....oooo//ou released under MIT license;
MIML htt.:///itte///ggtaaaooooogg/gga release under custom licensing scheme;
AdaIFI.:
released under MIT license;
Mesorch: httg:://ggttbb.cco/////ss//////s released under MIT license;
SAFIRE: http://wttpppgg....o.ooooo/////a released under CC BY-NC 4.0
license:
SIDA: httppp://g.ttuu..cm///laaaaaaaaa relesse released under custom licensing scheme.
We thank the respective authors for making their code and pre-trained model weights publicly available, and for promptly and helpfully replying to our inquiries.
A.2 Datasets
For the creation of BBC-PAIR, gathered data from the following datasets:
Openlmages-v7:
https://storage goa.ggg...ggggpp..ooooooo
http://///tooogggggggggoooa.oa/p com http:///c/.c.ooeaamm//////////ae
html, released under Apache 2.0 license;
CocoGlide: https://githuu: com/ ccm//riip-umina/rruFor release released under MIT license;
SID-Set: https:: //uggi//hhhg/ec co//datasees//saerz2/5111
released under Cre-
ative Commons Attribution 4.0 International License;
SatireMS-
https://wwet wwwgwe..ge..ccm coom/daaasets/gaee /titrasets/qii24// seriii-soure--dattee released under CC BY-NC
safire-aae safirems--eppeeeeeee
4.0 license.
Moreover, since SafireMS-Ein Expeert provided only tampered images, in order the detection performance between genuine and tampered images, we augmented the dataset with genuine images. These images come from DPREVIEW [30], the same source used create the tampered ones, creating SafireMS-Expert++ We introduced a number of images equal to the number of tampered images present in SafireMS-Expert obtaining a balanced set.
able to assess
A.3 Inpainters
To create BBC-PAIR, we employed open-source inpainters [68, 26, 62, 5, 64, 9], LoRA adaptations and commercial inpainters [72, 55, 1, 27, 40, 4, 60, 59]. In particular, for open-source inpainters, we leveraged:
Stable Diffusion 1.4: https://huggingtt http:/ggginnaaa..oooooo////////a co//Com/iii/eraalleeddffffooooo
released under CreativeML OpenRAIL-M license;
Stable Diffusion 1.5:
srable-diffusion-v ri--ee--eeellleeeee
released under CreativeMLL OII license;
Stable Diffusion
2.1:
https://huggingfatt http://ww....ccc..a.aaaa/cc co.stabilityyii
stable-diffusion 2-1 released under Creative license;
Stable Diffusion https: http://ttw...ceeeaaaaat///aaaaaa
re-
leased under Apache 2.0 license;
Stable Diffusion 3.5: https://githiie com con//Stabblityy-AI//a released under MIT
license;
23

---

Stable
Diffusion XL:
using-diffusere diffusers/sdxll released under MIT license:
Kandinsky 2.2:
http://t.....aaaaooooeee/aaaaaaa released under
Apache 2.0 license;
http:///t///gaaaaooooooo/a/aaaar released under FLUX. I-schnell:
3.1:
Apache 2.0 license;
http://///hthhooooooaaaaaaaaaaar relessd released under
Apache 2.0 license;
FLUX.I-dev: http://../..ppp......./oo//o//aa released under non- commercial license;
Then, for LoRA adaptations, we employed:
dAIversity Detailer
1.5:
https://ww..ihaeerr./////dddddd
3cce@$Sabbc444ffffffffc
dAIversity
S13.--LageePhhoorraiitt--LL.
http::/huggingffcecco
SritthivLLmodd//S333.
TTux-Deeaille--LRRA::
httpss///ngiinggace..co/ooxxx/
Flux-Detailer-Lothe
Dreamshaper SDXL-1-0: http:///////a///////////oo//////
Perfection 1.5: http:///////t///oo/oo//ooa0a0010
Perfection Flux: http://p//stttaaccoco//////////p
mux-RealismL.or: httpa////wwpp/////o////////aa/aa
ReaPhoL 1.5: http:///www..a.a......./../////a
Yamer's Realsim-v2 XL: httpa//ww..aaaaaaoooooor../////t
Lastly, for commercial inpainters, we relied on:
ClipDrop: https:://lllpddopp.c../
Dall-E 2: httpss//ppoonaal.oom/allae
Adobe httelyy.tttpe/fffeeeel...ooo com/;
FLUUX11 1 Fill hoo::
Ideogram: https://deogram.aal/
LightX: https://ow...igttapp..oom
Phot.Al:
YouCam: https::/www.phtt....
comp: ctttepp..coooossseeteee consumer/apps//yn
Each commercial inpainter has its own Terms of Service specified on their website.
B Details for reimplementation
B.1 Construction BBC-PAIR
Here, provide detailed information BBC-PAIR construction. The dataset generation process can be considered as two distinct tasks. The first task involves processing a predetermined cache of base images. These images can originate from any source. The second task involves taking the pre- pre-processed base images and generating an inpainted counterpart for each image per inpainting model.
Dataset pre-processing To begin, each image is checked for correct orientation, inpainting models typically struggle with images that are not naturally oriented. This is achieved using the open-source library https:/ htt///gtttbbb com/ternaus/
Subsequently, each image is processed using Kosmos-2 [58], a model that extracts a wide range of information. For our the image descriptions and annotations provided by Kosmos-2, These annotations include the identification and localisation of objects within the image. Each object identified by Kosmos-2 is then evaluated candidate for inclusion in the dataset. The following steps repeated for each such object:
purposes,
Segmentation:
the SAM [65] model used to generate a segmentation mask for each object. It is prompted by Kosmos-2 using the object's location and description;

---

2. Size filtering: the area of the mask is calculated as percentage of the image area. Objects with masks that are too small or too large are rejected. Specifically, any mask covering more than 83% or less than 0.23% of the image area is discarded. This filtering ensures that inpainted objects are neither minuscule nor encompass the entire image, a common issue with overgeneralised object descriptions from Kosmos-2;
3. Mask cohesion: once a mask of acceptable size found, it is analysed for the number of disconnected components. This serves as proxy for assessing the cohesiveness of the masked region. If a mask contains too many disconnected components, a dilation operation is applied-up to five times-unm the number of components is reduced to fewer than eight. Every mask undergoes at least one dilation to improve cohesiveness for inpainting. If mask passes all criteria, the following metadata is recorded:
Mask number;
Original mask;
Edited mask;
Masked object;
Masked area percentage;
Mask centroid coordinates.
In addition to object-based masks, random mask is generated for each image; this is always the last mask generated. This is achieved by randomly selecting eight points and connecting them to form a polygon. The distribution of random mask areas across the dataset is matched to that of the object masks. Each image thus yields at least one random mask and up to ten object-basee based masks. This step also generates master ISON file containing metadata for the entire dataset, which is required for the next phase.
Dataset inpainting The second phase of the process involves generating inpainted versions of the base images using one or more inpainting models listed Appendix A.3. This step can be computationally expensive and is therefore designed to be easily distributed across multiple GPUs and compute nodes. Each inpainting job receives the master ISON file and subset of the dataset to process. For each image, the model generates the associated mask, as specified the JSON.
version using the image's full description and
Due to computational constraints, only the first and last masks for each image are used during inpainting. This ensures that the random mask (always the last) is consistently processed, while the remaining object masks are retained for potential future use.
All inpainting models used are open source, locally, and rely the image's full description rather than object-specific text. Empirically, using the full image description yields better inpainting results.
To accommodate different model requirements, images are resized before processing. For models released prior to Stable Diffusion XL (SDXL), images are resized such that the longest edge 512 pixels. Models released after SDXL use resized length of 1024 pixels. This resizing enhances the inpainting performance of each model while maintaining consistency. Although inpainting at scale may introduce visual artefacts, the extensive size of the dataset is expected to statistically offset these anomalies.
Once all nodes complete processing, the inpainted images are incorporated into the master ISON file, and all data is aggregated.
B.2 Additional training details
To implement our Multi-modal Encoder, we employ DINO-v2 ViT-B/14 [56] pre-trained on a large, curated and diverse dataset of 142 million images, comprising ImageNet-22k and Depth Anything V2 VIT-B/14 [88], pre-trained on a large mixed dataset comprising millions of real-world (e.g., NYU Depth V2, KITTI, MegaDepth) and synthetic (e.g., BlendedMVS, Virtual KITTI) depth images, enhanced with self-supervised learning on unlabeled web-scale data. The proposed Fusion Block employs bidirectional cross-attention between Semantic and Geometry features. Since the two embedding spaces yield features with different magnitudes, the feature embeddings are layer- normalised before being processed by the Multi-Head Attention heads to avoid overpowering one modality. The features are then processed via two Multi- cross-attention layers, with 8 heads
25

---

Zodg
Input
Ours
TruFor [32]
AdaIFL [48]
Mesorch [94]
SIDA [39]
3
Figure 6: Qualitative results on tampered in-the-wild images. Note that SIDA produces a binary output.
each and residual connections, where each modality attends to the other. The mixed features are projected through single-layer GELU-activated MLP and lastly layer-normalised.
Machine configuration Experiments were conducted on high-performance computing server equipped with four NVIDIA A100 GPUs (80 GB each, PCIe) and 96-core CPU, with total of 866 GB of RAM. The system ran with NVIDIA Driver version 550, I 144.03 and CUDA Driver version 12.4.
C Additional analysis
C.1 In-the-wild test
We report in Fig. some qualitative samples on in-the-wild tampered images. To obtain these images, we hired graphic designer with knowledge of inpainting technologies and asked them to download some images from the internet, and modify them with any tool their choice, as long as it is generative inpainting. By doing so, we obtained 5 pairs of original/tampered images with saman--n--he-loog tampering. Please note that we not have ground truth tampering masks for this task, since many tools do not support saving them. We report original and tampered images, along with the probabilistic prediction localisation maps, in Figure 6. We notice once again how competitors tend to perform well in the presence of a strong semantic tampering (e.g.. row and row 4), while failing the presence less semantically biased tampering (e.g., row 1, row and row 3). Conversely, RADAR produces reasonable output in the presence of diverse manipulations, hence being more robust for in-the tte-wild deployment.
C.2 Impact the mask size
We propose an additional analysis on the impact of the mask size. We divide the available masks in BBC-PAIR into three sets "small", "medium", "large"- - by ranking them by number of occupied pixels and selecting the corresponding subset. We then evaluate RADAR on the three subsets, reporting results in Table 3. The results show that the detection performance is stable across all sizes. Regarding the localisation performance, on average, we perform better on small masks on BBC-PAIR-ID while we perform better on large masks on BBC-PAIR-I -AIR-LAAA A and BBC-PAIR-OOD Since there is no clear trend across the three splits, we ascribe these differences to the nature of the specific tamperings rather than their sizes.
26

---

Table 3: Impact of mask size inference time.
ID
LoRA
OOD
Setup
AUCT
Acct
FIf
loUt
AUCT
Acct
Fl1
loUt
AUCT
Acct
FIf
loUt
Small masks
0,951
0.954
0,830
0.704
0.901
0.773
0.720
0.533
0,804
0.712
0.684
0.416
Mid masks
0.951
0.953
0.788
0.665
0.902
0.772
0.599
0.427
0.804
0.706
0.564
0.378
Large masks
0.950
0.954
0.828
0.551
0.902
0.773
0.864
0.539
0.805
0.709
0.834
0.456
All masks
0.945
0.931
0.832
0.600
0.901
0.773
0.810
0.521
0.805
0.709
0.785
0.450
Table 4: RADAR's performance in low-resource environments.
Regions
AUC1
Acct
F11
IoUt
All
0.932
0.821
0.802
0.545
Single region
0.930
0.829
0.795
0.540
Multiple region
0.960
0.712
0.898
0.622
C.3 Impact of the number of forgeries
Since the SafireMSS Expert subset from MIBench-OOD specifically includes multi multi-source forgeries, analysed RADAR's performance Single Region forgeries (a single connected component in the ground truth) and Multiple Regions (more than one connected component in the ground truth), in Tab. 4. We observe that RADAR's performance remains competitive in both the presence of single regions and multiple regions inpainted. We hypothesise that this is due to the patch-level features separation promoted by our contrastive formulation.
C.4 Performance on non-inpainting datasets
Although RADAR is designed for inpainting tampering only, and trained on inpainting data, we tested its performance on datasets including non-inpainting modifications, namely COVERAGE [84], CASIA-v2 [24]. IMD2020 [53], CMFD [67], AutoSplice [41], and DSO [12]. We report results in Table 5. Our performance in localisation
impacted, which we achieve even higher Fl than in BBC-PAIR. This is due to the less refined copy-paste operations in these datasets, which, compared to inpainting ones, do not allow for a smooth blending of inserted elements, easing localisation. Importantly, this proves our point about building a dataset specifically focused on inpainting- based modifications. However, we also report lower detection performance. We believe this due to the lack of distinction between genuine, affected and tampered pixels in non-inpainting modifications, causing outliers in detection. However, since the performance in localisation satisfactory, calibration of the detection score could suffice to improve the results.
Interestingly, baselines may report higher accuracies in splicing- datasets, such TruFor (e.g. AUC/accuracy on COVERAGE 0.770/0.68 in [32]). while falling short on inpainting- based benchmarks such as BBC-PAIR (see Tables 1). We attribute this to the different features important for detection, further motivating our choice to develop an seainninng-spciffe method for IFDL.
C.5 Additional ablation studies
Detection mechanism ablation We report in Tab. 6 the results obtained by adding an additional
classification head to our framework, trained with a binary cross-entropy with image-level labels. This is inspired by alternative frameworks employing similar methodologies [32]. We yield better detection results at the expense of worse localisation results. We observe then a trade-off between the detection and localisation performance RADAR: in principle, one could train the framework either with dedicated classifier or not, based on the performance that needs to be prioritised.
Training with random and semantic masks During training RADAR, we use both semantic masks generated by Grounded SAM and random ones, as we describe in Section 3.1 of the main paper. We report Tab. the results of training RADAR either with semantic mask-only, random mask-only and mixing both random and semantic masks. We observe how the use of random masks, either
27

---

Table 5: Performance of RADAR on non-inpainting datasets.
Dataset
AUC
Acct
Fl
loU1
COVERAGE
0.523
0.535
0,879
0,448
CASIA-v2
0.505
0.505
0.903
0.452
IMD2020
0.597
0.540
0.899
0.454
CMFD
0,517
0,512
0,944
0,474
AutoSplice
0.845
0.743
0.747
0.501
DSO
0.487
0.505
0.854
0.427
Table 6:
Ablation on the use of a dedicated classification head.
ID
LoRA
0OD
Setup
AUC
Acet
Fif
loUt
|AUC
Acct
Fif
loUt
|UCC
Acct
Fif
loUt
Dedicated cls head
0.957
0.898
0.785
0.547
0.810
0.681
0.753
0.431
0.769
0.695
0,745
0,417 0.422
Ours
0.921
0.893
0.790
0.547
0.771
0.678
0.789
0.474
0.746
0.689
0.773
on their own or mixed with semantic ones, improves the performance, especially in generalisation. Indeed, we argue that the of random masks at training time aids the model in detaching the semantic bias interwoven with the task. In fact, while the forgery localisation is highly semantic, is guaranteed that the forgeries are produced with the semantics of the scene in mind, differentiating the task from semantic segmentation.
Semantic encoder ablation our implementation, we chose DINO-v2 primarily due to architec- tural and resolution compatibility with DepthAnythhin--22 which facilitates more intuitive fusion of features in our cross- cooss-ttentionn mechanism, and favourable performance compared to CLIP on self- supervised learning benchmarks requiring semantic understanding [11]. However, CLIP's language supervision may offer rich semantics as well. We conducted an experiment using CLIP (ViT-B/16) instead of DINO-v2, and found that while performance remained reasonable, shown in Tab. 8, was slightly lower compared to DINO-v2 in our setup. Importantly, the performance remained competitive with respect to the inference with Depth Depth/nything--2 only, proving the effectiveness of our novel fusion strategy, Nevertheless, CLIP remains a viable alternative, and we see potential in future exploration of multi-modal supervision within our framework.
C.6 Features and attention analysis
We report in Fig. 7 more examples of the normalised activations of fo; and f's (features before fusion), averaged over channels for tampered inputs. We once again highlight that the spatial distribution of activations is roughly complementary across modalities.
We also report the attention maps, fs + fc and fc + fs. from the Fusion Block. These attention maps are obtained by averaging the values of the attention over the keys. In particular:
fs fa. which is the mean of semantic values over geometry keys, represents which semantic features are actively using geometry features;
fG + fs. which is the mean of geometry values over semantic keys, represents which geometry features are actively using semantic features.
Also in this case, observe that the spatial distribution of attention is roughly complementary. Moreover, despite the attention being mostly concentrated in the prediction area, we observe peaks also outside, highlighting that the framework is actively using information from the background as well for the prediction.
C.7 Inference time and memory occupancy
We report in Tab. 9 the inference time per sample in ma, the memory occupancy of the forward pass in GiB and the input resolution in px for each considered method. We remind the reader that we test each method using the suggested resolution in the original papers. For each method, we compute the inference time, from when the sample is available the GPU to the computation of the localisation
28

---

Table 7: Ablation on the use of semantic and random masks at training time.
ID
LoRA
OOD
Setup
AUCT
Acct
FIf
loUt
AUCT
Acct
FIf
loUt
AUCC
Accf
FIf
IoUt
Semantic masks-only
0.965
0.884
0.805
0.519
0.791
0.609
0.764
0.405
0.785
0.656
0.796
0.417
Random masks-only
0.966
0.896
0.770
0,466
0.781
0.586
0.762
0.400
0.763
0.642
0.801
0.423
Ours
0.921
0.893
0.790
0.547
0.771
0.678
0.789
0.474
0.746
0.689
0.773
0.422
Table 8: RADAR's performance with CLIP as Semantic Encoder.
ID
LoRA
OOD
Setup
AUC1
Acc!
FIf
loUt
AUC1
Acet
FIf
loUf
AUC1
Accf
FI
loUf
CLIP+DA-v2
0,901
0.844
0,802
0.503
0.691
0.596
0.758
0.402
0.706
0.627
0.799
0.412
DINO-v2HDA-v2 (Ours)
0,921
0.893
0.790
0,547
0.771
0.678
0,789
0.474
0.746
0.689
0.773
0.422
map, after GPU warm-up, synchronising all threads before estimating the total inference time. While RADAR is slower than networks trained from scratch, other approaches based on foundation models [45] or LLMs [39] are considerably slower.
As an additional effort further reduce computational cost, we propose an experiment substituting the DINO-v2 and SepthhAnthingg-1 backbones with their smaller variants, such using VIT Small instead of VIT Base. We train this smaller model and compare it using the reduced training protocol described in Sec. 4.4 due to the training times of the full model. This substitution, whose results are depicted in, represents a good trade-off between performance and efficiency. In particular, this variant yields runtime memory footprint of 3.106 GiB and an inference time of 99.424 ms, representing 30% reduction in memory and a 57% reduction in inference time compared to the version presented in the main manuscript. Moreover, compared to baselines in Table 1, even considering the reduced training setup.
still very competitive in terms of accuracy and localisation
In conclusion, RADAR performs competitively in low-resource environments.
C.8 Additional qualitative results
We show in Fig. more qualitative results coming from the commercial inpainters of the BBC-PAIR- OOD split of our benchmark. Moreover, we show in Fig. 9 qualitative results coming from the other datasets of the BBC-PAIR-OOD split, namely CocoGlide, SafireMS Exxeettt+Ex and SiD-Set. Also, in Fig. 10 we show qualitative results coming from the BBC-PAIR-ID and OBC-PAIR-LORG splits of our benchmark.
C.9 Detailed quantitative results
We report in Tab. 11, Tab. 13, Tab. 12, Tab. 14 the full results of the evaluation performed in Tab. 1. In Tab. 14 we also show the official result reported from the competitors' papers, highlighting how they are close to our run. We also highlight that SafireMS-EEpert++ is in-domain for SAFIRE, as well as SID-Set in-domain for SIDA. Despite this advantage, we outperform them in the BBC-PAIR-OOD benchmark.
C.10 Additional results on OpenSDI
We report in Tab. 15 additional results the OpenSDI dataset [82]. Similarly BBC-PAIR, OpenSDI contains images inpainted employing different diffusion models, but these are only a subset of the one proposed in BBC-PAIR (5 vs. 28), hence, having much less coverage.
D Final remarks
D.1 Limitations
While RADAR achieves state-of-the-art performance image forgery detection and localisation, several limitations highlight avenues for future work:
29

---

Input
Ground-trut
Prediction
Semantic f3
Geometry fa Atin fs Ja Atnn Sc t Is
Figure Features and attention maps.
Table 9: Inference time vs. Memory Occupancy vs. Input resolution.
Property
Ours
HiFi-Ner [33]
TraFor [32]
MIMI. [63]
AdalFI. [48]
Mesorch [94]
SAFIRE [45]
SIDA [39)
Inference time
228. 176
53.852
79.1626
142.43
41.730
3266.566
725.787
Memory occupancy [G18]
4,404
5.708
6.187
6.312
9.218
7.611
21.500
15,572
Input resolation [px]
896 896
256 256
512 512
768 768
1021 1024
512 512
1021 1024
1024 1021
1. Performance gap: despite outperforming existing methods, our approach still exhibits non-trivial error rate, particularly in complex forgery scenarios (e.g.. unseen inpainters). This suggests significant room for improvement in generalisation and robustness;
2. Conservative localisation bias: RADAR tends to prioritise precision over recall locali- sation, resulting in fewer false positives at the cost of missed detections. While this aligns with forensic applications where false accusations carry high stakes, may limit sensitivity in scenarios requiring exhaustive forgery identification;
30

---

Table 10: RADAR's performance in low-resource environments.
ID
LoRA
OOD
Setup
AUC1
Acct
FMf
loU'
AUCT
Acct
FM
loUit
AUCT
Acct
Fif
loUt
ViT Small
0.966
0.892
0,800
0.516
0.672
0.549
0.756
0.387
0.731
0.645
0.787
0.418
ViT Base (Ours)
0.921
0.893
0.790
0.547
0.771
0.678
0.789
0.474
0.746
0.689
0.773
0.422
Table 11: Full quantitative comparison on BBC-PAIR-ID.
Stable Diffusion
Stabie Diffision
Stable Difioiion
Stable Difluiso
Difflssion
Methed
Del.
Loc.
Dzi.
Dzl.
Loc.
Det
Loc.
Det
Loc.
AUCT
Aeet
F1-
1d41
ADCC
AccT
FI1
1:U1
AUCC
Avd1
F11
1AUT
AUCT
Auet
F11
10U*
AUCT
Auet
F11
TraFor
0.877
0.707
0.431
MIML [e]]
0.511
0.485
0.221
0.114
0.550
0.485
0.11
0.108
0.884
0.505
0.222
0.114
0.419
0.685
0.214
0,110
0.477
0.455
0.110
0.167
AdaFRL [[3]
0.561
0.520
0.364
0.583
0.567
0.505
0.761
0.385
0.500
0.505
0.255
0.361
0.955
0.530
0.788
0.377
0.514
0.49
0.764
0.393
Mauondh [M]]
R667
0610
0.688
8.907
0.66
0.544
1770
0.179
0.756
0.40
0.34
0.000
0.315
0.54
8.54
0.391
0.516
0.50
0.776
0.414
0.590
0.749
0.540
0.460
RADAR
0.988
0.35
0.813
0.564
0.950
0,935
0.233
0.580
0.919
0.905
0.824
0.590
0.941
0.001
0.625
0,563
0.944
0.929
[.631
0.598
Stablo Diflassinn
Kondlasky 2.2
Kondinsky 3.1
AUCT
F1f
Acet
10th
AUC1
Auct
101.1
1BF [33]
0.668
0.510
0.726
0.364
0.700
0.510
0.765
0.389
0.634
0.505
0.745
0.373
0.630
0.505
0.770
0.365
0.607
0.515
0.357
0.319
Traher
0.55
0:330
0.779
0.45
0.499
0.314
0.473
0.118
0.99
0.419
0.464
0.51
0.77
0.472
0:318
0.51
0.413
AdaFL
0.520
0.475
0.765
0.75
0.353
0.531
0.383
Mesochh [94]
0.525
0.540
0.780
0.42)
0.57
0,545
0.759
0.415
0,550
0,500
0.73
0410
0615
0,585
0.63
0.429
0.537
0,50
0.77)
0.455
SAFIRE [65]
0.583
0.540
0.644
0.543
0.772
0.330
0641
0.378
0.550
0355
0.00
0.04
0.991
01525
8208
0412
0.67
0.50
8.62
0.364
SIDA (19)
0.550
0.550
0.775
0.561
0.35
0.735
0.773
0.365
0.565
0.78
0.53
0.355
0.20
0.614
0.300
0.50
0778
0.455
RADAR
3. Explainability; although we analyse cross-attention maps and activation patterns to interpret model decisions, the internal reasoning remains opaque. A more intuitive, human- human-aligned aligned explanation framework would improve trust and usability in critical domains like journalism or law;
4. Evaluation metrics: the IFDL field lacks standardised benchmarks and metrics, particularly for localisation granularity (e.g.. pixel-wise vs. region-wist accuracy) and real-world robustness. Community- wide efforts to establish unified evaluation protocols would better guide future research.
In future work, we aim to address these limitations by (1) exploring even more expressive architectures to reduce error rates, (2) designing adaptive loss functions balance precision and recall, (3) integrating post-hoc explainability methods (e.g., concept activation vectors), and (4) collaborating with the IFDL community to define standardized evaluation protocols.
D.2 Broader impact
The development of robust image forgery detection and localisation techniques has significant societal implications. As digital images play crucial role in journalism, legal evidence, social media, and historical documentation, the ability to reliably detect manipulated content helps combat misinformation. deepfakes, and fraudulent media. This research contributes to the broader effort of ensuring digital media integrity, fostering trust in visual information, and supporting forensic investigations.
However, the deployment of such technologies also raises ethical concerns. Malicious actors could potentially misuse forgery detection models to refine adversarial attacks, making manipulated images even harder to detect. Additionally, false positives in forgery detection could lead to unjust accusations, particularly in sensitive domains like law enforcement public discourse. To mitigate these risks, it is essential to ensure transparency in model limitations, promote responsible use, and integrate human oversight in critical decision-making processes.
Future advancements in this field should prioritise fairness, avoiding biases that may dispropor- tionately affect certain demographics or media sources. Collaborative efforts between researchers, policymakers, and industry stakeholders will be necessary to establish ethical guidelines and regula- tory frameworks for the responsible deployment of image forensics tools.
31

---

Input
Ground- truth
Ours
TruFor [32]
AdaIFL [48]
Mesorch [94]
SIDA [39]
Figure 8: Qualitative results on BBC-PAIR-OOD (closed-soure) inpainters).
By advancing the state of the art forgery detection, this work not only enhances media authenticity but also encourages further research into trustworthy multimedia systems, ultimately benefiting society at large.
D.3 Safeguards
Due to the nature of the topic, the proposed method may be vulnerable to malicious exploitation, such as adversarial attacks designed to produce even more convincing image tampering that can evade IFDL techniques. To mitigate this risk, users will be required to follow specific usage guidelines when accessing both the training data and the trained models.
Furthermore, all images in the dataset will include C2PA metadata to facilitate usage tracking. When a user accesses the dataset, C2PA metadata will automatically record the user's name and affiliated institution in the manifest, thereby promoting transparency and fair use. If the C2PA metadata is
32

---

Table 12: Full quantitative comparison on BBC-PAIR-LORA.
dAfrenity Detailer 1.5
dAtveriity L.RA
Flux Detaler-LRA
Dreonshoper SDXL-14
Method
Loc.
Ascl
HiF [:3]
0.622
0.500
0.239
0.300
0.756
0,510
0.205
0.355
0.639
0,500
0.77
0.365
0.685
0.500
0.735
0,368
0.634
0.500
0.331
0.366
TraRur [33]
0.510
0.520
0.260
0.44
0.516
0,550
0.772
0.463
0.573
0.530
0.773
0446
0.488
0.530
0.703
0.488
0,400
0.52)
0.773
0,499
MIMI [6]]
0.500
0.380
0.218
0.577
0.500
0.311
01344
0.125
0.281
0:546
0:389
0.59
0.116
Marrch [14]
0.594
0.310
0.363
0.405
0.556
0.310
0.253
0.380
0.549
0.40
0.73
0.399
0.677
0.560
0.738
0.400
0.542
0.530
0.57
0.365
SAFIRE [:5]
0.500)
0.480
0.076
0.390
0.54
0.49
0.675
0.399
0.528
0,580
0.00
0.396
0.572
0..30
0.53
0.384
0.492
0.09
0.70
0.44
SIDA
0,500
0.529
0.744
0.539
0.500
0,540
0.805
0.600
0.510
0.510
0.219
0.107
0.570
0.570
0.768
0.538
0.60
0.000
0152
0.666
Perfection 1.5
Perfection Flux
Bux Lor-Realiennorrs
ReaPaaLoRAA
1.5
Yamer's Realvin-2
XL
Methed
Dr
Eec.
Dnt
Det
Loc
Det.
1oc.
Der
Lec.
AUCC
Acdt
16411
Acd1
F11
1:111
Aod1
F11
AUC1
Ace1
F11
AUCC
Acet
F11
06622
0.500
0.602
0.370
TeaFor [3])
0.502
0.310
0.346
0.407
0.555
0.320
0.062
0.433
0.510
0.540
0.765
0.442
0.499
0.500
0.756
0.426
0.505
0.530
0.776
0.400
MINLL [63]
0.473
0.480
0.224
0.120
0,50
0.490
0.341
0.124
0.507
0.500
0.344
0.134
0.489
0..89
0.334
0.336
0.503
0.510
0.341
0.137
AdaRR, [es]
0.69
0.500
0.755
0.391
0.571
0.508
0755
0.405
0.577
0.570
0.700
0.406
0.533
0.890
0.758
0.476
0.538
0.50
0.777
0.438
0.554
0.520
0.75
0.400
0.400
SAFIRE
0.799
0.477
SIDA
0.590
0.350
0.666
0.50
0.530
0957
0.210
0.111
04100
0.500
0.980
0190
0.455
RADAR
0.913
0.711
0,808
0.516
0,592
0,255
0.855
0.511
0.852
0.743
0.003
0.506
0.852
0.758
0.50
0.317
[ 0.853
0.758
0150
0,515
Table 13: Full quantitative comparison on BBC-PAIR-Commeriin Fill [pro]
ClipDrop
Dall-E
Firefly
Method
Det.
Loc.
Der.
Loc.
Det.
Loc.
Det.
Loc.
AUC
Acc?
Fif
loU]
AUCC
Acct
F11
loU-
AUC1
Ace
Fif
loUt
AUCC
Acct
F11
LoU"
HiFi-Ne [35]
0.344
0.500
0.815
0.415
0.582
0.515
0.675
0.399
0.531
0.513
0.750
0,405
0.372
0.500
0.773
0:413
TriFor [12)
0.605
0.481
0.520
0.757
0.418
0.499
0.780
0.419
0.442
MIML [69]
0.493
0.184
0.528
0.500
0.186
0.098
0.561
AdaFL [48]
0,518
0.513
0.804
0.421
0.522
0.506
0,805
0.422
0.500
0.513
0.809
0.424
0.468
0
0.810
0.422
Mesarch [94]
0.572
0.526
0.818
0.433
0.562
0.553
0.811
0.419
0.521
0.540
0.813
0.412
0.527
0.553
0.806
0.417
SAFIRE [15]
0442
0.193
0.671
0,368
0.526
0.500
0,702
0.369
0.513
0.506
0.685
0.396
0.421
0.500
0.673
0.105
SIDA (39)
0.493
0.696
0,486
0.486
0.695
0.396
0.546
0.546
0.703
0.409
0.513
0.709
RADAR
0.430
0.685
0,586
0.800
0.420
0.642
0.555
0.806
0.420
Ideogram
LightX
PhotA1
YouCam
Method
Det.
Loc.
Det.
Loc.
Det.
Loc.
Det.
Loc.
AUC1
Acct
Fit
loU1
AUC1
Acct
F11
loU*
AUC1
Acc1
FL
loU1
AUC1
Accf
loU*
[33]
0.414
TruFor (32)
0.476
0.513
0.805
0.419
0.663
0.580
0.761
0.470
0.307
0.533
0.825
0.450
0:462
0.493
0.746
0.394
MIML [63]
0.501
0.493
0.188
0.099
0.823
0.506
0.165
0.091
0.634
0.500
0.166
0.088
0.694
0.500
0.194
0.101
AdaIFL [18]
0.483
0.493
0.804
0.413
0.580
0,573
0.787
0.413
0.491
0.506
0.809
0.422
0.452
0.660
0.803
0.412
Mesorch [94]
0,526
0.526
0.807
0.405
0.782
0.706
0.809
0.195
0.593
0.573
0.808
0.122
0.525
0.526
0.80]
0.103
SAFIRE [45]
0.506
0.647
0.428
SIDA [19]
0.493
0.493
0.714
0.418
0.553
0.553
0.695
0.404
0.546
0.546
0.711
0.15
0.486
0.4%6
RADAR
0.623
0.538
0.810
0.421
0.638
0.554
0.805
0.421
0.642
0.556
0.805
0.41
0.639
0.553
0.804
0.420
removed, a hash-based verification mechanism will be provided: users can query list of hashes to determine whether a suspicious image originated from the dataset.
Finally, while efforts have been made filter sensitive content, there is no absolute guarantee that NSFW (Not Safe For Work) images have not been generated during the inpainting process. To help mitigate this risk, all images have been analysed using the default Stability AI safety checker, both before and after inpainting. Relevant flags are included in the dataset's 's metadata, allowing users to filter out potentially inappropriate content if desired.
33

---

Table 14: Full quantitative comparison on BBC-PAIR-OOD. Official results from original paper
marked in blue.
BBSC-PAIR-Com
CocoGlide
SID-Set
SafireMS Expreeett-x
Method
Det.
Loc.
Der.
Loc.
Det.
Loc.
AUC1
IoU]
AUC1
Ace7
IoU1
AUC1
HiFi-Net [35)
0.421
0.503
0.775
0.410
0.632
0.534
0.519
0.343
0.518
0.503
0.843
0.463
0.726
0.558
0.620
0.313
Truffor [32)
0.527
0.522
0,780
0.434
0.752
0.647
0.711
0.381
0.160
0.514
0.907
0.167
0.700
0.635
0.610
0.067
0.752
0.639
0.720
N.A.
0.280
Mesorch [91]
0.576
0.563
0.426
0.727
0.640
0.704
0.374
0.567
0.525
0.920
0.488
0.797
0.711
0.498
SAPIRE [45]
0.490
0.499
0.686
0.395
0.557
0.519
0.647
0.359
0.510
0.500
0.784
0.407
0.814
0.500
0.747
0.596
N.A.
N.A
01635
V.A.
SIDA (39)
0.515
0.515
0.701
0.405
0.625
0.625
0,650
0.376
0.915
0.915
0.444
0.662
0.662
0.476
RADAR
0.649
0,422
0.654
0.670
0.932
0.796
0.861
0.453
0.932
0.802
Table 15: Full quantitative comparison on OpenSDI.
Det.
Loc.
Method
AUC1
Acct
F1f
IoUf
RADAR
0.684
0.564
0.865
0.614
SIDA
0.536
0.536
0.735
0.394
SAFIRE
0.476
0.506
0.724
0.383
Mesorch
0.549
0.526
0.826
0.434
AdalFL
0.490
0.481
0.889
0.540
MIMI.
0.590
0.529
0.091
0.046
TruFor
0.552
0.525
0.848
0.454
HiFi-Net
0.496
0.499
0.831
0.415
34

---

Input
Ground-truth
Ours
TruFor [32]
AdaIFL. [48]
Mesorch [94]
SIDA [39]
CocoGiide
SafireMS Expert
SIL 1es
Figure 9: Qualitative results on other BBC-PAIR-OOD benchmarks.
35

---

Input
Ground-truth
Ours
TruFor [32]
AdalFL [48]
Mesorch [94]
SIDA [39]
BBC BBC-PAIRS PLIR-AIR-IT ID
BBC BBC-PAIR PAIR LORA
Figure 10: Qualitative results BBC-PAIR-ID and BBC-PAIR-LORA benchmarks.
36


Reviews:
[{"review_id": "2YgDSHk3Vy", "reviewer": "Reviewer_53cS", "summary": "This paper proposes RADAR, a framework for detecting and localizing diffusion-based inpainting manipulations. It fuses semantic and geometric features from two pre-trained encoders using a cross-attention module, and introduces a triplet contrastive loss to enhance generalization across various inpainting models. The authors also construct MIBench, a large-scale benchmark with 150K manipulated images from 28 diffusion models. Experiments show that RADAR significantly outperforms existing methods in both detection and localization, and is robust to unseen manipulation tools.", "questions": "1. Applicability beyond inpainting manipulations:\nSince RADAR is specifically designed for detecting inpainting-based manipulations, could the authors clarify whether the method is applicable or adaptable to other tampering types such as copy-move, splicing, or Style changes? If the method's performance deteriorates in these cases, what extensions or modifications would be needed?\nClarification here could increase the perceived generalizability.\n\n2. Handling of multi-object/multi-region tampering scenarios:\nThe paper does not explicitly analyze or report performance when multiple objects or regions are tampered with in the same image. Has the method been evaluated under such conditions? If not, what are the anticipated challenges or limitations in such cases?\nEvidence of robustness in multi-region scenarios could strengthen the assessment of real-world applicability.\n\n3. Resource cost and deployment feasibility:\nThe method uses two large frozen encoders and a cross-attention-based fusion module, but the paper lacks information on training/inference time, memory usage, and runtime efficiency. Could the authors provide details on these metrics and discuss possible optimizations for deployment in real-time or resource-constrained environments?\n\nProviding this information would improve the assessment of scalability and practical deployment.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "# Strengths\n1. Innovative fusion of semantic and geometric features for enhanced tampering representation.\n2. Triplet contrastive loss improves cross-model generalization.\n3. A well-designed benchmark (MIBench) with diverse and large-scale manipulated data.\n4. Extensive experiments with strong results across multiple scenarios.\n\n# Weaknesses\n1. RADAR primarily detects tampering with the inpainting type, and its applicability to other types of editing is not explicitly discussed in the paper. If there are different forms of tampering in practice, the performance of the method may be unknown. This limits the scope of work.\n2. Although the authors conducted qualitative experiments to detect tampering, there is still a lack of experimental analysis of multiple tampering scenarios (such as multiple objects being tampered with at the same time). These are real-world but more complex inspection challenges, and it is recommended to expand to these broader application scenarios in the future.\n3. Training RADAR involves 150K images, two large frozen encoders, and a heavy fusion block with cross attention layers. The paper does not report training/inference time, making it difficult to assess practical deployability in resource constrained settings.", "was_revised": true, "final_justification": "Thank you for the authors' detailed responses. The authors have clarified most of my questions, and I maintain my positive rating.", "rebuttal": "We thank the reviewer for their careful and constructive feedback. We are pleased that the **innovative fusion of semantic and geometric features** for tampering representation, as well as the use of **triplet contrastive loss to improve cross-model generalisation**, were seen as strengths. We also appreciate the recognition of our **efforts in building MIBench**, a diverse and large-scale benchmark, and the value of the **extensive experiments and strong results across multiple scenarios**.\n\nRegarding the reviewer’s questions, we respond as follows:  \n\n_**(1) Applicability beyond inpainting.**_ We tested RADAR's performance on datasets including non-inpainting modifications, reporting these results in Table 4 of Section C.3 of the Appendix.\nWe observed that localisation performance is not negatively impacted, indeed, **F1 scores are even higher than those obtained on MIBench**. We ascribe this to the less refined copy-paste operations in these datasets, which, compared to inpainting, do not allow for a smooth blending of inserted elements, thereby easing localisation. However, we also report lower detection performance relative to MIBench. We conjecture that this is due to the lack of distinction between genuine, affected, and tampered pixels in non-inpainting modifications, leading to outliers in detection. Nonetheless, since localisation performance remains satisfactory, calibrating the detection score (i.e., threshold tuning of the precision-recall curve on the validation sets) may suffice to improve overall results.\nAn alternative way to tackle this would be to train the framework on non-inpainting forgeries as well, although this is out of scope for our problem formulation.  \n\n_**(2) Multi-region scenario.**_ We thank the reviewer for the interesting suggestion. Since the Safire-MS Expert subset from MIBench-OOD specifically includes multi-source forgeries, we analysed RADAR's performance on _Single Region_ forgeries (a single connected component in the ground truth) and _Multiple Regions_ (more than one connected component in the ground truth), in the table below:\n\n| Task                |    Det.   |           |    Loc.   |           |\n|:-------------------:|:---------:|:---------:|:---------:|:---------:|\n| Metric              |   AUROC   |    Acc    |     F1    |    IoU    |\n|        _All_        |   0,932   |   0,821   |   0,802   |   0,545   |\n|   _Single Region_   |   0,930   | **0,829** |   0,795   |   0,540   |\n|  _Multiple Regions_ | **0,960** |   0,712   | **0,898** | **0,622** |\n\nWe observe that **RADAR's performance remains competitive in both the presence of single regions and multiple regions inpainted**. We hypothesise that this is due to the patch-level features separation promoted by our contrastive formulation.\n\n_**(3) Efficiency and deployment.**_  Thanks for the suggestion. We did not consider low-resource deployment as a core application of RADAR, akin to all considered competitors [1,2,3,4,5,6,7]. However, we believe it is interesting to investigate this scenario, and we conducted the necessary additional tests. \nFirst, we highlight that we already report inference times and input sizes for RADAR and the considered competitors in Table 7 of Section C.3 of the Appendix. \nMoreover, we measured the memory footprint of all methods, as shown below. RADAR is the method that has the smallest memory footprint.\n\n|   Property   |  Ours | HiFi-Net | Trufor |  MIML | AdaIFL | Mesorch | SAFIRE |  SIDA  |\n|:------------:|:-----:|:--------:|:------:|:-----:|:------:|:-------:|:------:|:------:|\n| Memory [GiB] | 4,404 |   5,708  |  6,187 | 6,312 |  9,218 |  7,611  | 21,500 | 15,572 |\n\nFrom the results in Table 7 of Section C.3 and the table above, **RADAR performs competitively in low-resource environments**.\n\nAs an additional effort to further reduce the computational cost, we propose an additional experiment by substituting the DINO-v2 and DepthAnything-v2 backbones with their smaller variants, for instance, using ViT Small instead of ViT Base. We train this smaller model and compare it using the reduced training protocol described in LL325-326 due to training times of the full model. We report the results of the experiment below:\n\n| MIBench Split         |     ID    |           |           |           |    LoRA   |           |           |           |    OOD    |           |           |           |\n|:---------------------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|\n|          Task         |    Det.   |           |    Loc.   |           |    Det.   |           |    Loc.   |           |    Det.   |           |    Loc.   |           |\n|         Metric        |   AUROC   |    Acc    |     F1    |    IoU    |   AUROC   |    Acc    |     F1    |    IoU    |   AUROC   |    Acc    |     F1    |    IoU    |\n| ViT Small (optimised) | **0,966** |   0,892   | **0,800** |   0,516   |   0,672   |   0,549   |   0,756   |   0,387   |   0,731   |   0,645   | **0,787** |   0,418   |\n| ViT Base (Ours)       |   0,921   | **0,893** |   0,790   | **0,547** | **0,771** | **0,678** | **0,789** | **0,474** | **0,746** | **0,689** |   0,773   | **0,422** |\n\nThis substitution represents a good trade-off between performance and efficiency. In particular, this variant yields a runtime memory footprint of 3.106 GiB and an inference time of 99.424 ms, **representing a 30% reduction in memory and a 57% reduction in inference time** compared to the version presented in the main manuscript. Moreover, we are still very competitive in terms of accuracy and localisation compared to baselines in Table 1, even considering the reduced training setup.\n\nFinally, as concerns training times, we did make use of fairly large computational resources due to the complexity of the task. In particular, we trained our framework for 12 days on the hardware specified in Section B.2 of the Appendix.\n\n_**References:**_\n* [1] Sida: Social media image deepfake detection, localization and explanation with large multimodal model, CVPR 2025;\n* [2] Safire: Segment any forged image region, AAAI 2025;\n* [3] Mesoscopic insights: Orchestrating multi-scale & hybrid architecture for image manipulation localization, AAAI 2025;\n* [4] Adaifl: Adaptive image forgery localization via a dynamic and importance-aware transformer network, ECCV 2025;\n* [5] Towards modern image manipulation localization: A large-scale dataset and novel methods, CVPR 2024;\n* [6] Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization, CVPR 2023;\n* [7] Hierarchical fine-grained image forgery detection and localization, CVPR 2023."}, {"review_id": "Ng4m2xpSF3", "reviewer": "Reviewer_9vWL", "summary": "The paper introduces a novel method for IDFL (Image Forgery Detection and Localisation). It integrates features extracted from 2 complementary foundational models, one to extract geometric representations and the other to extract semantic information. The method incorporates a Fusion Block that “exploits a symmetric cross-attention mechanism, based on the swapping of keys $K$ in two multi-head attention mechanisms” that process the 2 sets of extracted features, resulting in a set of fused features. The authors introduce a novel contrastive learning framework trained to differentiate between three categories of image patches: original, tampered, and affected, going beyond the traditional binary real vs. fake setup. A new comprehensive benchmark, MIBench, is proposed, consisting of local manipulations using 28 different generators. The benchmark is split into 3 groups: MIBench-ID, MIBench-LoRA (generators from MIBench-ID with LoRA applied) and MIBench-OOD. This separation creates a similar setup with the ID, Near-OOD and Far-OOD setup from distribution shift studies. The proposed method achieves state-of-the-art results on both the newly introduced benchmark and a few existing datasets, which the benchmark incorporates.", "questions": "N/a", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n$\\bullet$ The proposed method is genuinely novel, by introducing a three-way contrastive distinction that extends beyond standard binary approaches and utilising complementary feature extractions in the context of Image Forgery Detection and Localisation. Strong results across various data sources is also a strength.\n\n$\\bullet$ The proposed benchmark includes images manipulated by a wide range of inpainters, including commercial ones. This fills a gap in the literature and enables a more comprehensive evaluation for future models, especially for localisation purposes.\n\n$\\bullet$ The ablation studies are comprehensive and answer the main questions that pop up regarding RADAR and its performance. These studies also highlight the complementary characteristics of the two types of image encoders employed for the task of IFDL.\n\n$\\bullet$ The paper is very well written, structured and easy to follow.\n\nWeaknesses:\n\n$\\bullet$ It would be nice if some results on already established datasets and benchmarks could be visible in the main text. In particular (besides the ones you considered in MIBench-OOD, i.e. CocoGlide, SafireMS-Exper and SID-Set), the OpenSDI[1] benchmark could alleviate the concern that “benchmarks rely on a single inpainting model for image generation” (line 104), as it includes data inpainted by 5 different generators and also addresses IDFL setup. Results on this benchmark or similar ones could strengthen RADAR’s performance claims compared to previous methods.\n\nDecision:\n\nI consider this paper to be worthy of acceptance due to the method’s novelty, especially the modelling of the affected patches into the training objective and the curation of a new IFDL benchmark that consists of manipulated images by a variety of generators, including commercial ones.\n\n[1]Wang, Y., et al. (2025). OpenSDI: Spotting Diffusion-Generated Images in the Open World. arXiv preprint arXiv:2503.19653. https://arxiv.org/abs/2503.19653", "was_revised": true, "final_justification": "The new results on OpenSDI strengthen the evaluation of the proposed method across diverse deepfake detection datasets previously proposed by the research community. This directly addresses the primary concern raised in my initial review.", "rebuttal": "We thank the reviewer for their thorough and encouraging assessment. We are pleased that the aspects of our method, such as the use of **complementary feature extractions** for image forgery detection and localisation and the **three-way contrastive distinction** beyond standard binary setups, were **recognised as strengths and deemed as genuinely novel**. We also appreciate the positive feedback on the **comprehensiveness** of the proposed MIBench benchmark, its **relevance**, and the **clarity and structure** of the manuscript. We are glad that the **ablation studies were found informative**.\n\nWe also thank the reviewer for pointing out the OpenSDI benchmark. We only became aware of its existence during its official presentation at CVPR 2025, which occurred after the submission deadline. We agree that including results on OpenSDI helps contextualise RADAR’s performance more broadly. We have since **run RADAR and the considered competitors on OpenSDI**, reporting the results below:\n\n|         |   RADAR   |           |       |           |  SIDA |       |       |       | SAFIRE |       |       |       | Mesorch |       |       |       |\n|:-------:|:---------:|:---------:|:-----:|:---------:|:-----:|:-----:|:-----:|:-----:|:------:|:-----:|:-----:|:-----:|:-------:|:-----:|:-----:|:-----:|\n|   Task  |    Det.   |           |  Loc. |           |  Det. |       |  Loc. |       |  Det.  |       |  Loc. |       |   Det.  |       |  Loc. |       |\n|  Metric |   AUROC   |     Acc   |   F1  |    IoU    | AUROC |   Acc |   F1  |  IoU  |  AUROC |   Acc |   F1  |  IoU  |  AUROC  |   Acc |   F1  |  IoU  |\n| Average | **0,684** | **0,564** | 0,865 | **0,614** | 0,536 | 0,536 | 0,735 | 0,394 |  0,476 | 0,506 | 0,724 | 0,383 |  0,549  | 0,526 | 0,826 | 0,434 |\n\n|         | AdaIFL |       |           |       |  MIML |       |       |       | Trufor |       |       |       | HiFi-Net |       |       |       |\n|:-------:|:------:|:-----:|:---------:|:-----:|:-----:|:-----:|:-----:|:-----:|:------:|:-----:|:-----:|:-----:|:--------:|:-----:|:-----:|:-----:|\n|   Task  |  Det.  |       |    Loc.   |       |  Det. |       |  Loc. |       |  Det.  |       |  Loc. |       |   Det.   |       |  Loc. |       |\n|  Metric |  AUROC |   Acc |     F1    |  IoU  | AUROC |   Acc |   F1  |  IoU  |  AUROC |   Acc |   F1  |  IoU  |   AUROC  |   Acc |   F1  |  IoU  |\n| Average |  0,490 | 0,481 | **0,889** | 0,540 | 0,590 | 0,529 | 0,091 | 0,046 |  0,552 | 0,525 | 0,848 | 0,454 |   0,496  | 0,499 | 0,831 | 0,415 |\n\nWe observe that **RADAR attains the best performance in detection** (on both AUROC and Accuracy metrics) **and localisation** (first in IoU, second in F1), proving its **strong generalisation capabilities**.\nWe will include these results in the final version of the manuscript."}, {"review_id": "1hRa4tkQ18", "reviewer": "Reviewer_qaXm", "summary": "This paper proposes RADAR, a method for detecting and localizing image edits generated by both seen and unseen diffusion models. To support realistic evaluation, the authors introduce MIBench, a benchmark consisting of images manipulated by 28 different diffusion models.", "questions": "1. The method proposed by the authors lacks a clear motivation, as well as theoretical analysis or justification to support its design.\n\n2. The pipeline appears straightforward and primarily built from existing components. The paper lacks innovation. The authors do not explain why this particular architectural combination is effective. Why does RADAR outperform other existing methods? The paper lacks theoretical explanations for this performance gap.\n\n3. Could there be potential unfairness in the selection of baseline methods? The authors have not explained how the baseline methods (e.g., TruFor, MIML) were implemented. Were they trained and tested on the same datasets? Ensuring fairness in comparison is crucial. The authors should provide detailed descriptions of the implementation details, experimental setup, and any modifications made to the training pipeline of these baseline methods.\n\n4. The generalization capability of RADAR may largely depend on the pretraining of DINOv2 and Depth Anything V2 encoders, rather than the method itself. Have the authors tested whether RADAR performs equally well with alternative encoders, such as replacing DINOv2 with CLIP? This would help verify whether the method is fundamentally effective or heavily dependent on the choice of backbone.\n\n5. The generalization evaluation is only performed on commercial models. However, it is also important to evaluate generalization across open-source models. For instance, the authors could train on a subset of open-source inpainters and test on other unseen open-source models. Furthermore, the testing images are generated using the same pipeline as the training images, with only the model varied. This may result in biased or unfair evaluation. It is recommended that the authors adopt alternative tampering strategies for generating test samples, for example, manual edits or randomized transformations, to better assess robustness.", "limitations": "Please see the questions.", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\nThe paper addresses an important and timely problem: reliable image forgery detection and localization in the era of high-fidelity diffusion models. It introduces a benchmark (MIBench) covering a set of diffusion-based manipulations.\n\nWeaknesses:\n1. The proposed method and its effectiveness lack theoretical explanations.\n\n2. The method lacks a clear motivation for its design choices.\n\n3. The experimental validation is limited to model replacement. Cross-dataset generalization is not evaluated. Moreover, the results for generalization across open-source models are missing.", "was_revised": true, "final_justification": "The authors' responses addressed some of my concerns; however, the technical novelty of the paper remains somewhat limited. As a result, I did not significantly raise the rating.", "rebuttal": "We thank the reviewer for their feedback. We are glad that the **relevance of the problem** we address was recognised, as well as the appreciation of the **introduction of MIBench as a benchmark covering a wide range of diffusion-based manipulations**. \n\nWe believe there may be misunderstandings regarding the motivations behind RADAR and our experimental design. To solve them, we address the reviewer's questions below. We hope our answers below will resolve the doubts of the reviewer.  \n\n_**(1a) Motivation.**_ We respectfully but strongly disagree. **The motivation for RADAR design choices is inherent to the challenges posed by diffusion-based forgery detection**. As we state in LL44-58, to contrast the ever-growing number of diffusion models available for tampering, we need to both learn effectively from multiple models and promote generalisation to unseen out-of-distribution ones. We mitigate both problems by proposing our three-way contrastive loss (aiding representation learning from various inpainter models) and multimodal feature extraction (promoting generalisation with multiple foundation models).  \n\n_**(1b-2a) Theoretical analysis and justification.**_ Although we agree that theoretical justifications would further strengthen our point, we highlight that this is **highly non-standard for the task**, as for many other tasks in computer vision. Indeed, image forgery detection and localisation remains highly experimental and, as a result, none of the competing baselines provide any theoretical justification for their performance. To compensate for this drawback, we proposed a comprehensive analysis section on why our method works (Section 4.3) and extensive empirical results, **as pointed out by all other reviewers**. We hope that the reviewer will reconsider their assessment of our work in light of this.  \n\n_**(2b) Novelty.**_ Our core novelty in the methodological design lies in the combination of multiple foundation models for image forgery detection and localisation, suggesting that image forgery localisation **requires more than just high-level semantics understanding and demands sensitivity to geometric inconsistencies as well**. This is motivated by the observation that diffusion-based forgeries can disrupt both modalities in distinct ways (see LL138-145). This novel intuition not only can influence further practices for identifying manipulated images, but is also enabled by non-trivial technical contributions such as our Fusion Block. Our three-way patch-wise contrastive formulation is also technically novel, and it is motivated by the unique effect that diffusion models have on images. Its effectiveness is further justified in Section 4.3 and Table 2. Importantly, please note that pEkt, 9vWL, and 53cS **all highlight the novelty and innovation of our contributions**;  \n\n_**(3) Fairness.**_ **We firmly believe that our comparison is fair**. To ensure a transparent evaluation, we extensively reported the performance of RADAR and baselines in the main paper and the appendices on all splits. In our experiments we take special care to ensure fair evaluation by following standard evaluation protocols and common practices. In particular, following [1,2,3,4,5,6,7], we do not retrain the baselines but use the available checkpoints, as we state in Appendix A.1. This practice has been established due to the high computational costs that make retraining baselines unfeasible. Instead, the standard evaluation in image forgery detection and localisation is to train the most robust model possible on a big dataset for a significant time, and compare its performance on out-of-distribution benchmarks to assess generalisation. We did this extensively with MIBench, further distinguishing also near OOD scenarios (obtained with LoRAs) and far OOD ones (composed of commercial inpainters and existing datasets);  \n\n_**(4) Replacing DINO-v2 with CLIP.**_ Thanks for the interesting idea. We replaced DINO-v2 with CLIP as suggested, and report the performance below:  \n\n|    MIBench Split   |     ID    |           |           |           |    LoRA   |           |           |           |    OOD    |           |           |           |\n|:------------------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|\n|         Task       |    Det.   |           |    Loc.   |           |    Det.   |           |    Loc.   |           |    Det.   |           |    Loc.   |           |\n|        Metric      |   AUROC   |    Acc    |     F1    |    IoU    |   AUROC   |    Acc    |     F1    |    IoU    |   AUROC   |    Acc    |     F1    |    IoU    |\n|      CLIP+DA-v2    |   0,901   |   0,844   | **0,802** |   0,503   |   0,691   |   0,596   |   0,758   |   0,402   |   0,706   |   0,627   | **0,799** |   0,412   |\n|DINO-v2+DA-v2 (Ours)| **0,921** | **0,893** |   0,790   | **0,547** | **0,771** | **0,678** | **0,789** | **0,474** | **0,746** | **0,689** |   0,773   | **0,422** |\n\nThese results indicate that our method is fundamentally effective and able to combine features coming from different encoders. Indeed, results with CLIP are still competitive, but we notice that DINOv2 is performing best, consistent with benchmark evaluations in which it is outperforming CLIP in tasks requiring semantic understanding [8].\n\n_**(5) Generalisation evaluation.**_ Please note that we included **both** commercial **and** open source inpainters in the OOD set. Indeed, MIBench-OOD is composed of both commercial models, and existing datasets with other generation pipelines (as stated in LL246-254), avoiding potential biases in the evaluation. The detailed results on the splits of MIBench-OOD (Table 12 in the Appendix) show that RADAR performs the best in both cases.  \n\nWe also made an additional effort by proposing the experiment in Figure 6 of the Appendix, using a graphic designer to modify images with manual edits. Let us also highlight the experiment we performed in 9vWL's reply, in which we tested RADAR and existing baselines on the very recent OpenSDI [9], still outperforming all. We believe that this proves our strong generalisation capabilities across models and data generation pipelines.  \n\nAs a further effort to clear the doubt, we have also performed, as suggested, an experiment where RADAR is trained on a subset of open-source inpainters and tested on others. In particular, we trained RADAR on SD1, SD1.5, SD2, SDXL, SD3, with the same protocol stated in LL325-326 and employed for Table 2 of the main paper, and tested SD3.5, Kandisky 2.2, Kandisky 3.1, Flux Schnell, and Flux Dev. We obtained the following results:\n\n|         Task        |  Det. |       |  Loc. |       |\n|:-------------------:|:-----:|:-----:|:-----:|:-----:|\n|        Metric       | AUROC |  Acc  |   F1  |  IoU  |\n|        SD3.5        | 0,891 | 0,718 | 0,790 | 0,450 |\n|        Kandisky 2.2 | 0,885 | 0,705 | 0,788 | 0,446 |\n|     Kandisky 3.1    | 0,867 | 0,687 | 0,786 | 0,439 |\n|     Flux Schnell    | 0,844 | 0,669 | 0,784 | 0,434 |\n|       Flux Dev      | 0,837 | 0,657 | 0,783 | 0,430 |\n|       Average       | 0,865 | 0,687 | 0,786 | 0,440 |\n\nThe table above shows **remarkable results compared to the baselines** shown in Table 1 of the main paper, even considering the restricted training setup, further proving the effectiveness of our generalisation-focused design choices.  \n \nAs a final consideration, let us clarify our design choice: in the design of a method for IFDL, we believe that **if open source diffusion models exist, then they should be used to generate in-distribution training data, since their inclusion in the training set could maximize the detection accuracy in case a malicious user would use them for editing images**. This is coherent with our motivation in LL39-43, which justifies why we did not consider open source models for generalisation evaluation. Contrary, generating data with commercial models leads to considerable additional costs. In any case, we agree that this additional experiment strengthens our point, and we will include the table in the Appendix. Thanks.\n\n_**References:**_\n* [1] Sida: Social media image deepfake detection, localization and explanation with large multimodal model, CVPR 2025;\n* [2] Safire: Segment any forged image region, AAAI 2025;\n* [3] Mesoscopic insights: Orchestrating multi-scale & hybrid architecture for image manipulation localization, AAAI 2025;\n* [4] Adaifl: Adaptive image forgery localization via a dynamic and importance-aware transformer network, ECCV 2025;\n* [5] Towards modern image manipulation localization: A large-scale dataset and novel methods, CVPR 2024;\n* [6] Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization, CVPR 2023;\n* [7] Hierarchical fine-grained image forgery detection and localization, CVPR 2023;\n* [8] DINOv2: Learning Robust Visual Features without Supervision, TMLR 2024;\n* [9] OpenSDI: Spotting Diffusion-Generated Images in the Open World, CVPR 2025."}, {"review_id": "jz8bNVZmgK", "reviewer": "Reviewer_pEkt", "summary": "This paper proposes a novel approach, ReliAble iDentification of inpainted AReas (RADAR), and a new comprehensive benchmark, MIBench, for Image Forgery Detection and Localisation (IFDL), particularly targeting diffusion-based image inpainting. The authors also propose a new comprehensive benchmark, MIBench, to evaluate such forgery localization tasks. To construct training and evaluation data, objects are detected using Kosmos-2, masked using Grounded SAM, and then inpainted using various diffusion-based generative models.  RADAR has two feature extractors with different semantic and geometric modalities, a fusion module, and two prediction heads. RADAR is trained using patch-level contrastive learning with tampered patches, affected patches, and original patches. Experiments show RADAR outperforms other methods and has state-of-the-art performance.", "questions": "1. Will the author release the model, code, and benchmark?\n2. For semantic feature extraction, why do the authors choose DINOv2 instead of CLIP? CLIP could have better semantic features compared with DINOv2 because CLIP is trained with language.", "limitations": "Yes.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strength**\n1. This paper introduces a novel approach and benchmark for diffusion-based image manipulations. Releasing the model, code, and benchmark would significantly benefit the research community.\n2. This paper is well-written and well-organized. \n3. The experiments are overall comprehensive.\n\n**Weaknesses**\n1. The claim made in Lines 174–175 of Section 3.3 is not supported by the experiments. While the ablation study indicates that contrastive learning improves performance, the authors do not provide empirical evidence that training the model with data from more inpainters leads to suboptimal performance in fine-grained tasks, such as forgery localisation. \n2. [Minor] Double citation in [40] and [41].", "was_revised": true, "final_justification": "The rebuttal addresses my concerns. I keep my original rating to accept the paper.", "rebuttal": "We thank the reviewer for their positive and encouraging feedback. We are glad that the **novelty of our approach** and the proposed **benchmark for diffusion-based image manipulations** were recognised as **key contributions**. We appreciate the **acknowledgement of the clarity and organisation of the paper**, as well as the **comprehensiveness of the experimental evaluation**. We also value the reviewer's note on the potential impact of releasing the model, code, and benchmark, which we are committed to sharing with the research community.  \n\nRegarding the weaknesses, we respond as follows:  \n\n_**(1) Claim.**_ We thank the reviewer for pointing this out. Our intention in LL174–175 of Section 3.3 was to highlight that, in RADAR’s case, removing the contrastive loss or using only a single encoder (as shown in Table 2) leads to reduced detection and localisation performance, despite training with a large number of inpainters. In contrast, method [2], which is trained only for detection, benefits from increased diversity of generators. We agree that the original phrasing may overgeneralise and could be misleading. We will revise this claim in the final version to better reflect our specific findings and avoid confusion;  \n\n_**(2) Typo.**_ We thank the reviewer for pointing out this typo, we will amend this in the final version.  \n\nRegarding the reviewer’s questions, we reply as follows:  \n\n_**(1) Release.**_ We confirm that **we will release the model's weights, code for training and inference, and benchmark** upon publication, as stated in line 15 of the main manuscript. We appreciate the reviewer’s interest in this aspect, and we agree that making these resources publicly available is extremely important and will significantly benefit the research community;  \n\n_**(2) Why not CLIP?**_. We thank the reviewer for this insightful question. We chose DINO-v2 primarily due to architectural and resolution compatibility with DepthAnything-v2, which facilitates a more intuitive fusion of features in our cross-attention mechanism, and favourable performance compared to CLIP on self-supervised learning benchmarks requiring semantic understanding [1].\nThat said, we agree that CLIP’s language supervision may offer rich semantics as well. Indeed, **we conducted an additional experiment** using CLIP (ViT-B/16) instead of DINO-v2, and found that while performance remained reasonable (as shown in the table below), it was slightly lower compared to DINO-v2 in our setup. Importantly, the performance remained competitive with respect to the inference with DepthAnything-v2 only (see Table 2), proving the effectiveness of our novel fusion strategy. Nevertheless, CLIP remains a viable alternative, and we see potential in future exploration of multi-modal supervision within our framework.\n\n\n|    MIBench Split   |     ID    |           |           |           |    LoRA   |           |           |           |    OOD    |           |           |           |\n|:------------------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|:---------:|\n|         Task       |    Det.   |           |    Loc.   |           |    Det.   |           |    Loc.   |           |    Det.   |           |    Loc.   |           |\n|        Metric      |   AUROC   |    Acc    |     F1    |    IoU    |   AUROC   |    Acc    |     F1    |    IoU    |   AUROC   |    Acc    |     F1    |    IoU    |\n|      CLIP+DA-v2    |   0,901   |   0,844   | **0,802** |   0,503   |   0,691   |   0,596   |   0,758   |   0,402   |   0,706   |   0,627   | **0,799** |   0,412   |\n|DINO-v2+DA-v2 (Ours)| **0,921** | **0,893** |   0,790   | **0,547** | **0,771** | **0,678** | **0,789** | **0,474** | **0,746** | **0,689** |   0,773   | **0,422** |\n\n\n_**References:**_\n* [1] DINOv2: Learning Robust Visual Features without Supervision, TMLR 2024;\n* [2] Community forensics: Using thousands of generators to train fake image detectors, CVPR 2025."}]

Author rebuttal:

Meta-review: This paper proposes RADAR, a novel framework for detecting and localizing diffusion-based inpainting manipulations. The method demonstrates strong performance and makes a valuable contribution to the field. Following the author rebuttal, the majority of the reviewers' concerns have been adequately addressed, and a consensus for acceptance has been reached. Given its sufficient contributions and the positive response to feedback, I recommend acceptance.
Decision: Accept (poster)