PaperlayerView exact revision on arXiv

Source-linked AI summary

MedForge-RSI: Medical Deepfake Detection via Recursive Self-Improvement

Zhihui Chen, Mengling Feng

arXiv:2609.36549v1eess.IV

TL;DR

Medical deepfake detectors can perform poorly on authentic scans and under deployment shift, while conventional retraining requires substantial supervision and expert guidance. MedForge-RSI adapts a deployed detector’s surrounding knowledge stores while keeping its weights frozen and admitting changes through independent validation. Across four test sets, accuracy rises from 75.0% to 84.4%, and the paper reports gains on a held-out 4,000-image evaluation.

  • Problem

    A deployed detector misclassifies 40% of authentic scans, reaches 77% accuracy on an unseen generator family and 59% under transmission distortion, while conventional retraining requires extensive supervision and expert-authored guidance.

    Source: §1 · p. 1

  • Method

    MedForge-RSI lets a frozen detector analyze verified errors and propose changes to persistent experience and tool stores, retaining changes through an independent-validation acceptance test.

    Source: §1 · p. 2, §3.1 · p. 5

  • Results

    75.0% to 84.4% four-test-set average accuracy, with final-evaluation clean accuracy rising from 76.5% to 87.9%.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The study identifies acceptance testing as a larger contributor than reflection quality and reports that gains in real-image recall, unseen-generator transfer, and distortion robustness accompany a rebalancing of fake-image recall.

    Source: §1 · p. 2, §7 · p. 10

    Results use one 8B detector and one benchmark family, and deployment requires a verified label source; the recommended four-mechanism combination was still running at submission time.

    Source: §7 · p. 10

Abstract

from arXiv · show

Text-guided image editors can generate high-fidelity medical deepfakes, challenging the reliability of clinical imagery. Although reasoning-based detectors perform strongly in distribution, they degrade substantially under deployment shift. MedForge-Reasoner, an 8B vision-language model trained with supervised fine-tuning and reinforcement learning, achieves 99.2% accuracy on its target distribution, yet misclassifies 40% of authentic scans, reaches only 77% accuracy on unseen generators, and falls to 59% under transmission distortion. Adapting such models through conventional retraining is costly, requiring large-scale supervision and expert-designed guidelines. We introduce MedForge-RSI, a recursive self-improvement framework that enables a deployed detector to adapt while keeping its model weights frozen. Over 20 rounds, the detector analyzes verified errors, accumulates reusable experience, and autonomously develops image-analysis tools, while an independent acceptance test retains only validated improvements. Across 49 registered configurations, MedForge-RSI increases average accuracy over four test sets from 75.0% to 84.4%. On a held-out 4,000-image evaluation, it improves clean accuracy from 76.5% to 87.9% and transmission-distorted accuracy from 59.0% to 70.5%, with the largest gains in authentic-image recall. Controlled analysis across all 49 trajectories identifies which self-improvement mechanisms replicate across seeds, shows acceptance testing to be the largest individual contributor, and reveals a taxonomy of failed adaptations. We release the complete trajectories, including all rejected and rolled-back changes.

1 Introduction

Medical deepfakes threaten clinical decisions, while the deployed detector has asymmetric errors and weak performance under distribution shift. MedForge-RSI adapts its surrounding knowledge stores without changing model weights, using verified errors and acceptance tests; the reported evaluations show improved accuracy.

1 Introduction

  • Text-guided editors can implant tumors or erase lesions, while deepfakes that pass visual inspection can compromise diagnosis, treatment, or insurance decisions.The frozen detector’s real-image recall is 60%, compared with 99% fake-image recall; accuracy also falls to 77% on an unseen generator family and 59% under transmission distortion.Source: §1 · p. 1
  • The setting combines safety-critical perception, persistent experience retention, and tool creation under a safety architecture for admitting changes.The paper identifies this combination as unexplored and notes that medical self-evolution had targeted clinical reasoning and treatment workflows rather than perception.Source: §1 · p. 2
  • MedForge-RSI investigates whether a deployed detector can improve at deployment while its model weights remain frozen.The approach responds to the cost of retraining, which requires 50,000 supervised images, reinforcement learning, and medically authored guidelines, repeated for each hospital, scanner, and new editor.Source: §1 · pp. 1–2
  • 75.0% to 84.4% four-test-set average accuracy, with final-evaluation clean accuracy rising from 76.5% to 87.9%.The study also reports unseen-generator accuracy rising from 77% to 89.5% and real-image recall from 60% to 80%, or 91% with case-based memory.Source: §1 · p. 2
  • The study registers 49 configurations to identify mechanisms that replicate across seeds, mechanisms that fail, and four measured failure modes with safeguards.The authors release complete trajectories, including rejected and rolled-back changes.Source: §1 · p. 2

2 Related Work

Prior work studies static medical forgery detectors, deployment-time self-improvement in other domains, and self-evolution for clinical workflows. MedForge-RSI combines persistent experience and tool creation for safety-critical medical perception under independent-validation acceptance testing.

Medical deepfake detection

  • Medical forgery detectors and multimodal explanation systems are static after training, while medical self-evolution has focused on clinical reasoning and treatment workflows rather than perception.MedForge-RSI uses MedForge as a frozen base and studies deployment-time adaptation without retraining.Source: §2 · p. 3

Recursive self-improvement at deployment

  • Prior deployment-time systems improve a single program or workflow, whereas MedForge-RSI improves two parallel stores under independent-validation acceptance testing.VideoHarness-RSI’s per-video contexts do not persist as memory across questions; MedForge-RSI’s stores are experience memory and tools.Source: §2 · pp. 3–4

Experience memory and program search

  • Experience-memory systems retain trajectories or strategies, but MedForge-RSI individually admits or retires entries using acceptance tests and usage statistics.Its tool-creation channel judges tools by calibrated readings and acceptance testing rather than textual output.Source: §2 · p. 4

Training-time self-improvement

  • Training-time self-improvement updates model weights and requires training infrastructure, while MedForge-RSI exploits cheap ground-truth-grounded feedback without training.The related work frames this feedback as a resource available to the deployment-time approach.Source: §2 · p. 4

Surveys, verification, and safety

  • Prior surveys and audits identify self-confirming loops and reward hacking; MedForge-RSI uses protected evaluation components and reports measured failure instances.The system occupies the deployment-time, human-on-the-loop category while keeping validation data, scoring code, and model weights fixed.Source: §2 · p. 4

3 MedForge-RSI: Self-Improvement with Acceptance Testing

MedForge-RSI keeps the detector’s weights and evaluation components fixed while allowing bounded changes to experience memory, tools, and directives. Verified-error proposals pass replay and validation checks before entering the production state.

3.1 Problem Formulation

  • A frozen detector predicts from retrieved experience entries, tool readings, and a directive, while fixed scoring code parses its verdicts.The loop treats memory, toolbox, and directive as explicit system state that may be modified under defined rules.Source: §3.1 · p. 4
  • Each round uses a fresh batch of 40 labeled images; proposed state changes are accepted only when the test approves, and otherwise the state remains unchanged.The validation split is disjoint from test sets, which are used only for scoring and never for acceptance, reflection, or early stopping.Source: §3.1 · pp. 4–5

3.2 Two Knowledge Stores

  • Experience entries record imaging context, visual cue, and caution; usage statistics and test performance govern retirement, with at most five entries rendered per query.A focus-rotation schedule varies diagnostic themes and supplies the reflector’s directive history.Source: §3.2 · p. 5
  • The toolbox supports model-managed tool creation and revision, while calibration translates raw readings into directional evidence or NO SIGNAL.Tools return measurements rather than verdicts; calibration compares readings with historical fake- and real-image distributions and is reported as the study’s most reliable positive mechanism.Source: §3.2 · p. 5

3.3 Reflection: Who Writes the Proposals

  • Reflection diagnoses misclassified images and proposes changes; variants include external, ensemble, and two-sided reflection, while case-based memory retrieves verified error cases.Case-based memory stores up to 30 archived cases and avoids generation risk by using verified precedents.Source: §3.3 · p. 5

3.4 Acceptance Testing and Protected Components

  • Proposals must pass replay and independent validation checks, with a health check and rollback mechanisms addressing acceptance-test failures and harmful changes.Replay requires a non-negative net change in correct predictions; validation rejects a proposal that lowers the correct count by more than one image.Source: §3.4 · p. 6
  • Weights, the official prompt, scoring and parsing code, learning schedule, and evaluation sets are protected; directives may be frozen, rewritten, or patched as testable rules.Patched rules are individually tested and retractable, with at most six active rules.Source: §3.4 · p. 6

4 Experimental Setup

The evaluation studies 49 registered configurations over fixed learning streams, using four test sets and a held-out final evaluation. The protocol includes clean and distorted images, and the authors flag resample-set contamination as a qualification on absolute scores.

Experimental setup

  • Each run uses 20 rounds of fresh, balanced 40-image batches, with light distortions applied to half of each batch from round 2 onward.Batches draw from the 60,000-image training portion and do not overlap test sets.Source: §4 · p. 6
  • Four 200-image test sets assess the main distribution, a resample, an unseen generator, and transmission distortions; the final evaluation contains 2,000 clean and 2,000 distorted images.The final evaluation is drawn from the held-out split and verified to have zero overlap with training images.Source: §4 · pp. 6–7
  • The resample set includes 145 of 200 images from the training pool, inflating its absolute scores; relative comparisons and other sets are unaffected.The authors treat the final evaluation as the definitive measurement.Source: §4 · p. 6
  • The study reports accuracy, real-image recall, and fake-image recall, with the four-set average as the primary deployment metric.The final evaluation has an approximately ±1.6-point confidence interval, compared with roughly ±5 points for a 200-image set.Source: §4 · p. 7
  • The 49 registered configurations are single-switch comparisons across four preregistered batches; the study uses no training compute and costs less than one base-detector SFT run.Each configuration differs from its named base by exactly the listed switch.Source: §4 · p. 7

5 Results

Deployment-time changes improve the frozen detector beyond its training-time benchmark, but gains vary by condition and trajectory. The results identify acceptance testing as a major contributor and show that some intuitive safeguards reduce final accuracy.

5.2 Where the Improvements Occur

  • Real-image recall rises from 60% to 77–80% for calibration, 80% for ensemble reflection, and 91% for case-based memory, while unseen-generator accuracy rises from 77.0% to 88.0–89.5%.Distorted images remain the lowest-accuracy condition, although case-based memory yields the largest single-set gain over control at +12.5 points.Source: §5.2 · p. 7

5.3 Learning Curves Peak Early and Often Decline

  • Across 18 learning configurations, final states average 3.0 points below their best round; five lose at least 4.5 points, and four finish at or below control.Configurations usually peak within ten rounds; calibrated configurations sustain their plateau, while single-perspective reflection declines and uncalibrated external experience oscillates.Source: §5.3 · pp. 7–8

5.1 Training-Time versus Deployment-Time Improvement

  • 84.4% is the best-configuration accuracy, a 9.4-point gain without parameter updates; ensemble reflection raises clean accuracy from 76.5% to 87.9% and distorted accuracy from 59.0% to 70.5%.The deployment-oriented frozen checkpoint averages 75.0%, compared with 99.2% on MedForge’s own benchmark.Source: §5.1 · p. 7, Table 1 · p. 8

5.3 Learning Curves Peak Early and Often Decline

  • An operating-point reversal can hide behind 83.0% accuracy: one configuration ends at 94% real-image recall but only 72% fake-image recall, which per-item checks miss.A disabled acceptance test also cost an identical configuration 17.5 points in final accuracy, falling from 87.0% to 69.5%.Source: §5.3 · p. 8

5.4 Effective and Ineffective Mechanisms

  • Calibration of tool readings adds 6.5 points, while freezing directive rewrites removes oscillation; accuracy-drop rollback then costs 4.5 points after admission is trustworthy.Tournament selection, balanced per-class admission, counterfactual reflection, and second-opinion arbitration also reduce final accuracy; the admission budget performs worst at −24.0.Source: §5.4 · p. 8
  • The strongest configurations combine mechanisms that interpret readings, diversify proposals, and filter admission; case-based memory ranks highest in the freeze-base panel.Differences in that panel are attenuated because its single freeze-base run does not replicate across seeds.Source: §5.4 · p. 8

6 Analysis

Analysis finds that self-written tools often contribute to accuracy, but their reliability and apparent gains require scrutiny. Replication and failure analyses show how trajectories can regress, reverse operating points, or pass proposals after verifier failure.

6.1 Effect of Self-Written Tools

  • Ten of eleven measured configurations lose accuracy when their self-written tools are disabled, by 4.3 points on average and up to 10.0, often through lower real-image recall.Across the study, 139 tool proposals yielded 104 admissions and 82 distinct tools; content audits found many tools with unparsable or misleading outputs.Source: §6.1 · p. 9

6.2 Seed Replication Distinguishes Mechanisms from Random Variation

  • Ensemble reflection averages 84.0 across two seeds, a 4.5-point improvement over control; calibration+freeze averages 79.3 across three seeds and is statistically indistinguishable from control.The authors report principal results on ensemble reflection, the only configuration replicated across seeds, and mark other configurations as single-seed where appropriate.Source: §6.2 · p. 9

6.3 A Failure Taxonomy for Deployment-Time Self-Improvement

  • Learning gains commonly decline after 4–10 rounds as learnable errors are exhausted and proposals repeat or add noise; proposal diversity and stale-entry retirement are reported countermeasures.One early run repeated the same experience entry across eight consecutive directive versions.Source: §6.3 · p. 9
  • Seven individually safe changes admitted in one batch reversed recall to 94% real and 72% fake; later validation lost discrimination, prompting verifier-health and batch-interaction checks.The batch-interaction check produced zero false rejections across 40 rounds of checks.Source: §6.3 · p. 9
  • A five-character scorer bug made both acceptance-test arms tie, allowing every proposal through for a batch and reducing the identical configuration’s final accuracy by 17.5 points.The main evaluation pipeline used different code and continued to report unaffected scores.Source: §6.3 · p. 10
  • The study’s six design guidelines are traceable to measured comparisons, and the verifier is identified as part of a self-improving system’s attack surface.The authors call for external checking, redundancy, and auditably simple verification.Source: §6.3 · p. 10

7 Discussion and Conclusion

MedForge-RSI improves deployment-time detection with frozen weights, while its remaining failures and evidence requirements define the scope of the result. The registered configurations provide the basis for comparing individual mechanisms and combinations.

7 Discussion and Conclusion

  • Real-image recall, unseen-generator transfer, and transmission robustness improve, while fake-image recall falls from 99% to the high 80s and low 90s.The authors attribute these error components to missing evidence and miscalibrated thresholds, and distinguish self-improvement from gradient updates that establish base perceptual ability.Source: §7 · p. 10
  • The evidence is bounded to one 8B detector and one benchmark family, and deployment requires a source of verified labels.The resample set is contaminated; the four-set averages therefore rely on the other three sets and final evaluation, while the recommended combination was still running at submission.Source: §7 · p. 10
  • 75.0% to 84.4% across four test sets and 11 points on the final evaluation: a frozen detector improves under deployment-time self-refinement.The conclusion conditions improvement on independent-validation acceptance, calibrated tool readings, restricted write access, and seed replication.Source: §7 · p. 10
  • Operating-point reversals, silent verifier failures, and single-run variability remain, with safeguards and released artifacts enabling their remeasurement.The paper characterizes the work as bounded self-refinement against a fixed evaluator, not modification of the improvement mechanisms.Source: §7 · pp. 10–11

A Registered Configuration Registry

  • Table 2 registers 49 configurations and reports their final main-set accuracy and class recalls after 20 rounds.The registry identifies mechanism variants, seed runs, and the recommended combination; some configurations were still completing at submission.Source: A Registered Configuration Registry · p. 13

B Harness Implementation Details

The harness keeps the detector’s verdict parsing outside its write access and constrains proposed changes through tool sandboxing, calibrated readings, and acceptance checks. Reflection prompts generate structured adaptations, while validation data are kept separate from reported test sets.

B Harness Implementation Details

  • The fixed conclusion line is parsed by scoring code outside the loop’s write access, and the 20-round configurations take 2–7 hours depending on calibration.The harness documents a default for ambiguous verdicts and runs the detector with the MedForge-Reasoner system prompt.Source: B Harness Implementation Details · pp. 13, 15
  • Tools run as constrained single-file programs, face four sandbox probes, and must return numeric readings; historical labeled-image distributions calibrate readings or mark them NO SIGNAL.The detector may repair, retire, or re-enable its own tools, while experience entries record context, visual cue, caution, field statistics, and status.Source: B Harness Implementation Details · p. 14
  • Each proposal is tested by replay on 40 learning images and validation on 100 pool images; a verifier-health check can disregard a round’s test outcome.If the health check fails, proposals instead require sandbox acceptance and field-statistics-based retirement; the batch-level check can restore the round-start state after a large class-recall drop.Source: B Harness Implementation Details · pp. 14–15
  • The eight-configuration and 47-completed-configuration figures show round-by-round accuracy and recall trajectories and final real-versus-fake recall, respectively.The latter colors configurations by accuracy and identifies operating-point reversals as trading one recall against the other.Source: Figure 4 · p. 15, Figure 5 · p. 17

D Reflection Prompt Structure

  • Reflection first diagnoses verified errors and tool readings, then emits strict JSON proposals; ensemble reflection merges non-conflicting proposals from three independent sessions.Two-sided reflection requires proposals to name their target error direction and evidence that the opposite direction will not be harmed; measurement and audit seats can propose tools or retirements.Source: B Harness Implementation Details · p. 15, D Reflection Prompt Structure · pp. 17–18

E Validation-Set Construction

  • The 200-image validation pool is disjoint from the fixed test set and used only for admission decisions, with fake images balanced across ten generators.Fixed test scores are for reporting only; the pool’s real images use the same three modalities as the test set.Source: E Validation-Set Construction · pp. 18–19, Table 5 · p. 19

F Data Composition and Degradation Protocol

The evaluation uses stratified image sets, but the resample set was later found to overlap the detector’s SFT training data. Learning and transmission degradations serve distinct roles in the study.

F Data Composition and Degradation Protocol

  • 145 of 200 resample images came from the detector’s SFT training pool, inflating absolute scores equally across configurations; the main, unseen-generator, distorted, and final sets are unaffected.The authors treat the final evaluation as the definitive measurement.Source: F Data Composition and Degradation… · p. 19
  • The fixed main test set has 200 images, balanced between fake and real; fakes span ten generators, while real images span chest radiograph, brain MRI, and fundus.Fake images include 58 removal-type edits and 42 other edits; the unseen-generator and resample sets use disjoint generators and resampled real images, respectively.Source: F Data Composition and Degradation… · p. 19, Table 6 · p. 19
  • Learning degradations approximate propagation loss on the learning stream, whereas transmission degradations emulate resharing, print-and-scan, screen capture, and recompression for distorted evaluation.Degraded inputs are deterministic and byte-identical across configurations.Source: Table 7 · p. 19, F Data Composition and Degradation… · p. 19

G Complete Per-Variant Four-Set Results

The per-configuration results compare final accuracy across four test sets, while seed replication tests whether selected gains persist when only the learning stream changes. Ensemble replication holds, but calibration+freeze does not.

H Seed Replication

  • Ensemble replication held at mean 84.0, a 4.5-point gain over the 79.5 control; calibration+freeze did not replicate (mean 79.3).Only the learning stream was re-sampled; the fixed test set, validation pool, and harness settings remained byte-identical.Source: H Seed Replication · p. 19

G Complete Per-Variant Four-Set Results

  • Table 8 reports final-state four-set accuracy for configurations with complete evaluations, alongside main-set peak and Tail-5 statistics.The remaining 27 completed configurations are single-run; their four-set evaluations follow the same protocol.Source: G Complete Per-Variant Four-Set Results · p. 19, Table 8 · p. 20

H Seed Replication

  • Two-sided reflection led on resample and unseen-generator sets (88.0, 89.5), while case-based memory led under distortion (77.0).Ensemble and two-sided reflection also improved monotonically from main to resample to unseen-generator.Source: Figure 7 · p. 20

I Complete Self-Tool Ablation

The section reports an enabled-versus-disabled comparison for configurations whose self-written tools were measured.

I Complete Self-Tool Ablation

  • Table 12 compares final-state results with self-written tools enabled versus disabled for each measured configuration.The passage identifies the comparison’s scope but does not report its outcomes.Source: I Complete Self-Tool Ablation · p. 20

J Tool Content Audit

The audit examines tool implementations and their measured effects, alongside illustrative experience entries, study costs, reproducibility details, design guidance, and additional analyses. It documents both tool-content problems and safeguards proposed for deployment-time self-improvement.

J Tool Content Audit

  • Among 82 distinct tool implementations admitted across the study, 61% emitted output without a directionally parseable label, while 26% returned hardcoded numbers unrelated to computation.The post-audit contract required measurements without verdict labels, numeric output, and a discrimination pre-check on labeled contrast pairs; tool identity, not topic, was the unit of admission.Source: J Tool Content Audit · pp. 20–21
  • Ten of 11 measured configurations lost accuracy when their self-written tools were disabled, with a mean +4.3-point tool-enabled difference and a maximum of +10.0.In the admission-budget configuration, two tools left accuracy unchanged as real-image recall rose by 2 and fake-image recall fell by 2.Source: Table 12 · p. 21

K Qualitative Artifacts

  • Experience entries encode imaging context, visual cues, and cautions; examples include retiring a diaphragm cue that caused false forgery flags and retaining other entries on probation.The illustrated tool mechanism compares verdict-distribution counts on error cases with correctly judged cases, and the calibration layer supplies directional interpretation of measurements.Source: K Qualitative Artifacts · pp. 21–22

L Cost Accounting

  • Added mechanisms impose less than 10% relative overhead on standard configurations, while calibration-injection variants reach up to 22 minutes per round on final-evaluation-sized batches.The self-improvement phase uses 39,200 labeled learning images—fewer than the base detector’s 50,000-image SFT set—and performs no gradient updates.Source: L Cost Accounting · p. 22, Table 13 · p. 22

M Reproducibility

  • The release includes the harness, registry, per-round predictions, acceptance-test logs, final experience libraries and toolboxes, and the verifier-fault archive.Test membership is fixed by seed and hash-committed; the final evaluation was drawn from the official held-out split with zero-overlap assertions against training images.Source: M Reproducibility · p. 22

N Use of Large Language Models

  • The frozen detector performs reflection, tool writing, and repair in self-reflection configurations; an external API model appears in only three of 49 configurations.That model receives learning-stream error digests, does not score fixed test sets or render acceptance verdicts, and never sees final evaluation sets.Source: N Use of Large Language Models · pp. 22–23

O Design Guidelines and Evidence

  • The guidelines recommend independent validation before admission, calibrated tool readings, bounded and retractable write access, diverse proposals, recovery safeguards, and seed replication.They report that free-form global-policy rewrites oscillated or drifted, while second-opinion arbitration and self-consistency voting reduced accuracy.Source: O Design Guidelines and Evidence · p. 23

P Additional Analyses

  • A second-opinion tool had −19 points of counterfactual value on validation yet was re-proposed by 34 configurations and admitted in 16; validation-scored greedy enable/disable search was the effective remedy.Replay gains moved opposite to the tool’s true effect at detection time.Source: P Additional Analyses · p. 23

Q Failure Narratives

The failure narratives describe an interaction-induced operating-point reversal and a separate silent verifier bug. The latter invalidated admission decisions during affected runs, although reported scoreboard scores remained correct.

Q Failure Narratives

  • Seven individually accepted changes jointly reversed the operating point: real-image recall rose to 94–100% while fake-image recall fell to 53–72%, persisting for ten rounds.Later validation scores were near zero in both arms, making the no-distortion condition vacuously satisfied; health and interaction checks were designed to detect this pattern.Source: Q Failure Narratives · p. 23
  • A swapped-argument bug made the acceptance helper compare missing fields as equal, so every proposal passed while the main scoreboard remained unaffected.The contradiction was confirmed through offline diagnostics and manual re-implementation, and affected runs were archived as an acceptance-off ablation.Source: Q Failure Narratives · pp. 23–24

Related papers

Loading 2609.36549v1…