Title: Towards Reliable Identification of Diffusion-based Image Manipulations
Venue: NeurIPS 2025
Accepted: yes
Keywords: ifdl

image

forgery

identification

robust

robustness

generalised

generalized

generalisation

generalization

detection

localisation

localization

tampering

inpainter

diffusion

manipulation

alteration

deepfake
Abstract: Changing facial expressions, gestures, or background details may dramatically alter the meaning conveyed by an image. 
Notably, recent advances in diffusion models greatly improve the quality of image manipulation while also opening the door to misuse. 
Identifying changes made to authentic images, thus, becomes an important task, constantly challenged by new diffusion-based editing tools.
To this end, we propose a novel approach for ReliAble iDentification of inpainted AReas (RADAR).
RADAR builds on existing foundation models and combines features from different image modalities.
It also incorporates an auxiliary contrastive loss that helps to isolate manipulated image patches.
We demonstrate these techniques to significantly improve both the accuracy of our method and its generalisation to a large number of diffusion models.
To support realistic evaluation, we further introduce BBC-PAIR, a new comprehensive benchmark, with images tampered by 28 diffusion models. 
Our experiments show that RADAR achieves excellent results, outperforming the state-of-the-art in detecting and localising image edits made by both seen and unseen diffusion models. 
Further information about our code, data and models, including separate licensing terms, will be publicly available at https://alex-costanzino.github.io/radar/.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel approach, ReliAble iDentification of inpainted AReas (RADAR), and a new comprehensive benchmark, MIBench, for Image Forgery Detection and Localisation (IFDL), particularly targeting diffusion-based image inpainting. The authors also propose a new comprehensive benchmark, MIBench, to evaluate such forgery localization tasks. To construct training and evaluation data, objects are detected using Kosmos-2, masked using Grounded SAM, and then inpainted using various diffusion-based generative models.  RADAR has two feature extractors with different semantic and geometric modalities, a fusion module, and two prediction heads. RADAR is trained using patch-level contrastive learning with tampered patches, affected patches, and original patches. Experiments show RADAR outperforms other methods and has state-of-the-art performance.\n\nSTRENGTHS AND WEAKNESSES:\n**Strength**\n1. This paper introduces a novel approach and benchmark for diffusion-based image manipulations. Releasing the model, code, and benchmark would significantly benefit the research community.\n2. This paper is well-written and well-organized. \n3. The experiments are overall comprehensive.\n\n**Weaknesses**\n1. The claim made in Lines 174–175 of Section 3.3 is not supported by the experiments. While the ablation study indicates that contrastive learning improves performance, the authors do not provide empirical evidence that training the model with data from more inpainters leads to suboptimal performance in fine-grained tasks, such as forgery localisation. \n2. [Minor] Double citation in [40] and [41].\n\nQUESTIONS:\n1. Will the author release the model, code, and benchmark?\n2. For semantic feature extraction, why do the authors choose DINOv2 instead of CLIP? CLIP could have better semantic features compared with DINOv2 because CLIP is trained with language.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes RADAR, a method for detecting and localizing image edits generated by both seen and unseen diffusion models. To support realistic evaluation, the authors introduce MIBench, a benchmark consisting of images manipulated by 28 different diffusion models.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\nThe paper addresses an important and timely problem: reliable image forgery detection and localization in the era of high-fidelity diffusion models. It introduces a benchmark (MIBench) covering a set of diffusion-based manipulations.\n\nWeaknesses:\n1. The proposed method and its effectiveness lack theoretical explanations.\n\n2. The method lacks a clear motivation for its design choices.\n\n3. The experimental validation is limited to model replacement. Cross-dataset generalization is not evaluated. Moreover, the results for generalization across open-source models are missing.\n\nQUESTIONS:\n1. The method proposed by the authors lacks a clear motivation, as well as theoretical analysis or justification to support its design.\n\n2. The pipeline appears straightforward and primarily built from existing components. The paper lacks innovation. The authors do not explain why this particular architectural combination is effective. Why does RADAR outperform other existing methods? The paper lacks theoretical explanations for this performance gap.\n\n3. Could there be potential unfairness in the selection of baseline methods? The authors have not explained how the baseline methods (e.g., TruFor, MIML) were implemented. Were they trained and tested on the same datasets? Ensuring fairness in comparison is crucial. The authors should provide detailed descriptions of the implementation details, experimental setup, and any modifications made to the training pipeline of these baseline methods.\n\n4. The generalization capability of RADAR may largely depend on the pretraining of DINOv2 and Depth Anything V2 encoders, rather than the method itself. Have the authors tested whether RADAR performs equally well with alternative encoders, such as replacing DINOv2 with CLIP? This would help verify whether the method is fundamentally effective or heavily dependent on the choice of backbone.\n\n5. The generalization evaluation is only performed on commercial models. However, it is also important to evaluate generalization across open-source models. For instance, the authors could train on a subset of open-source inpainters and test on other unseen open-source models. Furthermore, the testing images are generated using the same pipeline as the training images, with only the model varied. This may result in biased or unfair evaluation. It is recommended that the authors adopt alternative tampering strategies for generating test samples, for example, manual edits or randomized transformations, to better assess robustness.\n\nLIMITATIONS:\nPlease see the questions.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces a novel method for IDFL (Image Forgery Detection and Localisation). It integrates features extracted from 2 complementary foundational models, one to extract geometric representations and the other to extract semantic information. The method incorporates a Fusion Block that “exploits a symmetric cross-attention mechanism, based on the swapping of keys $K$ in two multi-head attention mechanisms” that process the 2 sets of extracted features, resulting in a set of fused features. The authors introduce a novel contrastive learning framework trained to differentiate between three categories of image patches: original, tampered, and affected, going beyond the traditional binary real vs. fake setup. A new comprehensive benchmark, MIBench, is proposed, consisting of local manipulations using 28 different generators. The benchmark is split into 3 groups: MIBench-ID, MIBench-LoRA (generators from MIBench-ID with LoRA applied) and MIBench-OOD. This separation creates a similar setup with the ID, Near-OOD and Far-OOD setup from distribution shift studies. The proposed method achieves state-of-the-art results on both the newly introduced benchmark and a few existing datasets, which the benchmark incorporates.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n$\\bullet$ The proposed method is genuinely novel, by introducing a three-way contrastive distinction that extends beyond standard binary approaches and utilising complementary feature extractions in the context of Image Forgery Detection and Localisation. Strong results across various data sources is also a strength.\n\n$\\bullet$ The proposed benchmark includes images manipulated by a wide range of inpainters, including commercial ones. This fills a gap in the literature and enables a more comprehensive evaluation for future models, especially for localisation purposes.\n\n$\\bullet$ The ablation studies are comprehensive and answer the main questions that pop up regarding RADAR and its performance. These studies also highlight the complementary characteristics of the two types of image encoders employed for the task of IFDL.\n\n$\\bullet$ The paper is very well written, structured and easy to follow.\n\nWeaknesses:\n\n$\\bullet$ It would be nice if some results on already established datasets and benchmarks could be visible in the main text. In particular (besides the ones you considered in MIBench-OOD, i.e. CocoGlide, SafireMS-Exper and SID-Set), the OpenSDI[1] benchmark could alleviate the concern that “benchmarks rely on a single inpainting model for image generation” (line 104), as it includes data inpainted by 5 different generators and also addresses IDFL setup. Results on this benchmark or similar ones could strengthen RADAR’s performance claims compared to previous methods.\n\nDecision:\n\nI consider this paper to be worthy of acceptance due to the method’s novelty, especially the modelling of the affected patches into the training objective and the curation of a new IFDL benchmark that consists of manipulated images by a variety of generators, including commercial ones.\n\n[1]Wang, Y., et al. (2025). OpenSDI: Spotting Diffusion-Generated Images in the Open World. arXiv preprint arXiv:2503.19653. https://arxiv.org/abs/2503.19653\n\nQUESTIONS:\nN/a\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes RADAR, a framework for detecting and localizing diffusion-based inpainting manipulations. It fuses semantic and geometric features from two pre-trained encoders using a cross-attention module, and introduces a triplet contrastive loss to enhance generalization across various inpainting models. The authors also construct MIBench, a large-scale benchmark with 150K manipulated images from 28 diffusion models. Experiments show that RADAR significantly outperforms existing methods in both detection and localization, and is robust to unseen manipulation tools.\n\nSTRENGTHS AND WEAKNESSES:\n# Strengths\n1. Innovative fusion of semantic and geometric features for enhanced tampering representation.\n2. Triplet contrastive loss improves cross-model generalization.\n3. A well-designed benchmark (MIBench) with diverse and large-scale manipulated data.\n4. Extensive experiments with strong results across multiple scenarios.\n\n# Weaknesses\n1. RADAR primarily detects tampering with the inpainting type, and its applicability to other types of editing is not explicitly discussed in the paper. If there are different forms of tampering in practice, the performance of the method may be unknown. This limits the scope of work.\n2. Although the authors conducted qualitative experiments to detect tampering, there is still a lack of experimental analysis of multiple tampering scenarios (such as multiple objects being tampered with at the same time). These are real-world but more complex inspection challenges, and it is recommended to expand to these broader application scenarios in the future.\n3. Training RADAR involves 150K images, two large frozen encoders, and a heavy fusion block with cross attention layers. The paper does not report training/inference time, making it difficult to assess practical deployability in resource constrained settings.\n\nQUESTIONS:\n1. Applicability beyond inpainting manipulations:\nSince RADAR is specifically designed for detecting inpainting-based manipulations, could the authors clarify whether the method is applicable or adaptable to other tampering types such as copy-move, splicing, or Style changes? If the method's performance deteriorates in these cases, what extensions or modifications would be needed?\nClarification here could increase the perceived generalizability.\n\n2. Handling of multi-object/multi-region tampering scenarios:\nThe paper does not explicitly analyze or report performance when multiple objects or regions are tampered with in the same image. Has the method been evaluated under such conditions? If not, what are the anticipated challenges or limitations in such cases?\nEvidence of robustness in multi-region scenarios could strengthen the assessment of real-world applicability.\n\n3. Resource cost and deployment feasibility:\nThe method uses two large frozen encoders and a cross-attention-based fusion module, but the paper lacks information on training/inference time, memory usage, and runtime efficiency. Could the authors provide details on these metrics and discuss possible optimizations for deployment in real-time or resource-constrained environments?\n\nProviding this information would improve the assessment of scalability and practical deployment.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}