Source-linked AI summary
Team MSU GenText-Forensics Challenge 2026 Technical Report
Kirill Koltsov, Aleksandr Gushchin, Dmitriy Vatolin, Anastasia Antsiferova
TL;DR
Document forgeries can mislead OCR-and-LLM workflows, and the challenge requires systems to detect, localize, classify, and explain multilingual manipulations. The paper combines DTD with two specialized, CoT-distilled Qwen models; the system placed third in the challenge, with ablations favoring the trained two-stage design.
Problem
The challenge asks systems to detect, localize, classify, and explain multilingual document forgeries, including visually subtle and semantically inconsistent attacks.
Source: §1 · p. 1Method
A DTD detector proposes regions for a Filterer and a Semantic Detective, two LoRA-adapted Qwen3-VL-32B models trained on traces distilled from a privileged teacher.
Source: §1 · p. 2Results
Takeaways & Limitations
The reported ablations favor reasoning supervision and decomposition, while semantic region filtering benefits from document context rather than visual inspection alone.
Source: §4 · p. 6When distinct tampered regions touch, box extraction can combine them, and the tested splitting heuristic did not improve results.
Source: Qwen Filterer · p. 3
Abstract
from arXiv · showhide
Document text forgery has evolved beyond simple pixel-level manipulation: modern attacks alter not only the appearance of a document but also its meaning, and increasingly target the OCR & LLM pipelines that consume such documents. The ACM MM 2026 GenText-Forensics challenge therefore requires systems that not only decide whether a multilingual text image is forged, but also localize the point of manipulation, identify the attack type, and produce a human-readable forensic report with supporting evidence. We present our solution, a decomposed chain-of-thought (CoT) pipeline that combines a document tampering detector (DTD) with two Qwen3-VL-32B vision-language models, each LoRA-adapted to a distinct sub-task. DTD produces tampering probability maps that are converted into numbered candidate regions; a first model (the Filterer) validates these regions and assigns a preliminary forgery type, while a second model (the Semantic Detective) merges and re-grounds the surviving regions, searches for purely semantic anomalies that are invisible to pixel-level detectors, and writes the final report. Both models are trained by distilling chain-of-thought traces from a privileged Qwen3-VL-235B teacher that has access to ground-truth masks and reports. Our approach secured third place in the ACM MM 2026 GenText-Forensics challenge. We describe the data preparation, test-time augmentation, region rendering, distillation protocol, and training configuration in detail, and report ablations over detector thresholds, prompt designs, and pipeline decompositions.
1 Introduction
The paper frames document-image forgery as a threat to automated OCR-and-LLM workflows and addresses the challenge of detecting, localizing, classifying, and explaining multilingual forgeries. Its solution combines a visual detector with two specialized language models, trained using distilled reasoning traces.
1 Introduction
- A single altered digit, clean word substitution, or redaction block can mislead downstream OCR-and-LLM processes despite leaving little visible trace.Source: §1 · p. 1
- The challenge requires multilingual forgery detection, localization, attack classification, and structured reporting across visual and semantically inconsistent attacks.It scores detection, pixel-level localization, explanation quality, and report quality.Source: §1 · p. 1
- The pipeline combines DTD region proposals with two LoRA-adapted Qwen3-VL-32B models for region validation, semantic discovery, and report generation.Both students learn from chain-of-thought traces distilled from a Qwen3-VL-235B teacher that receives ground-truth masks and reports during data generation.Source: §1 · p. 2
- The team placed third in the challenge and released code, prompt templates, and associated data.The data includes distilled training traces and test artifacts such as OCR output and DTD results.Source: §1 · p. 2
2 Method
The method uses an off-the-shelf DTD front end to propose candidate regions, then applies a threshold and connected-component processing before language-model analysis. DTD is adapted to the challenge data using overlapping image patches.
2.1 Overview
- DTD processes overlapping 512 × 512 patches and stitches their per-patch probabilities into a full-resolution tampering map.The detector searches for visual statistical deviations such as font mismatches, blurring, redaction blocks, and JPEG discontinuities.Source: §2.1 · p. 2
- Numbered connected-region boxes from the thresholded map are passed to a Qwen Filterer, which labels each region KEEP or DROP and preliminarily types kept regions.Only KEEP regions proceed to the Semantic Detective, which receives OCR word text, bounding boxes, confidence values, and document text in reading order; it merges regions, finds semantic anomalies, and writes the report.Source: §2.1 · p. 2
2.2 Visual Tampering Detection with DTD
- DTD was fine-tuned on 8,000 training images tiled into 53,751 patches, with separate images reserved for validation.Inputs were resized to 512 × 512 and trained for 20 epochs; overlapping border patches ensured complete-resolution prediction coverage.Source: §2.2 · p. 2
- Threshold 0.40 yielded mIoU = 0.5792 and mF1 = 0.6855 on the forged subset of 500 held-out test images.Localization quality declined at thresholds 0.20 and 0.90; connected components below a minimum area are discarded and light morphological opening precedes box extraction.Source: §2.2 · p. 2
Qwen Filterer
The language-model stages filter detector proposals, search for semantic inconsistencies, and produce OCR-grounded reports. Distilled traces from a privileged teacher are split to train the two specialized students.
Qwen Filterer
- Training DTD on forged and pristine documents yielded mIoU 0.5792 versus 0.4992 for forged-only training, while four-pass TTA raised final score roughly 0.04.TTA shifts patch-grid origins and combines maps by pixel-wise minimum to suppress boundary false alarms.Source: Qwen Filterer · p. 3
- Touching tampered regions can be enclosed in one box, and a geometric splitting heuristic did not improve test-split results, so it is not used in the reported configuration.Source: Qwen Filterer · p. 3
2.3 Qwen Filterer
- The Filterer sees numbered red boxes matching prompt region indices; this visual format was most effective, while clean images and heatmap overlays performed poorly.Its prompt first builds document-level context, then assigns KEEP or DROP and a preliminary type to each region; the authors attribute weak visual-classifier filtering to missing semantic context.Source: §2.3 · pp. 3–4
2.4 Qwen Semantic Detective
- The Semantic Detective merges kept regions, searches independently for semantic or logical anomalies, and grounds findings to OCR boxes before producing the report.Its inputs include the full OCR output and reading-order text, supporting token-level localization and contextual review.Source: §2.4 · p. 4
2.5 Chain-of-Thought Distillation
- During distillation, the privileged teacher receives ground-truth masks and reports, labels DTD regions as true or false positives, and identifies missed anomalies.Ground-truth coordinates are refined using tighter DTD boxes when available, then OCR boxes, otherwise the original ground-truth box; generated traces are validated against format and leakage checks.Source: §2.5 · pp. 4–5
2.6 Chain-of-Thought Training
- The teacher trace is split so the Filterer learns Stages 1–2 and the Semantic Detective learns Stages 3–4 plus the final report.Both students start from Qwen3-VL-32B-Instruct and use QLoRA with 4-bit NF4 quantization for memory reasons; the vision tower remains frozen.Source: §2.6 · p. 5
3 Experiments
The experiments compare prompt and pipeline configurations using four challenge-score components, and report the two-stage pipeline as the best overall configuration. Ablations attribute positive contributions to each of five design choices.
3.1 Evaluation protocol
- The challenge score combines detection F1, pixel-level grounding, explanation quality, and LLM-judged report quality.The grounding score averages mIoU and mF1; the report-quality score averages factuality, reasoning, and completeness ratings.Source: §3.1 · p. 5
3.2 Prompt configurations
- Direct configurations train on ground-truth reports, whereas all-in-one and two-stage configurations train on distilled reasoning traces concatenated with reports.The latter target format trains models to reason before reporting.Source: §3.2 · p. 5
- The two-stage decomposition is the final submission and attains the best overall score among the compared configurations.Table 4 compares configurations on the 100-document evaluation set; the supplied passages do not include its score values.Source: §3.2 · p. 5, Table 4 · p. 6
3.3 Ablations
- Thresholding at 0.40, four-pass test-time augmentation, pristine-document training data, language-model region filtering, and two-student reasoning decomposition each contribute positively to the final score.The ablation passage reports these contributions collectively without giving their individual effect sizes.Source: §3.3 · pp. 5–6
4 Discussion
The discussion finds that reasoning supervision, decomposition, and semantic context matter for the system’s reported performance. It also describes how data-derived forgery categories and false-positive rules shape the prompts.
Reasoning supervision and decomposition
- For the two-stage pipeline, LoRA fine-tuning raises the final score from 0.721 to 0.810 and report quality from 56.8 to 70.5; trained two-stage scores 0.810 versus 0.782 for trained all-in-one.The zero-shot all-in-one configuration scores 0.566, with SLoc = 0.22 and no usable explanation; the authors attribute the decomposition advantage to specialization and reduced cross-task error propagation.Source: §4 · p. 6
Filtering needs semantics and context
- Qwen region filtering improves localization over raw DTD regions (mIoU 0.6402 → 0.6672), while ResNet/U-Net filtering yields 0.6113.The authors argue that genuine-forgery judgments require surrounding text and document-level semantic understanding, not only local pixels.Source: §4 · p. 6
Dataset-driven prompt design
- The prompts distinguish visible visual edits, logically contradictory values, and clean word substitutions, while adding drop rules for common DTD false positives.The Semantic Detective also checks for numerical inconsistencies, impossible values, internal contradictions, semantic oxymora, domain-impossible values, and mixed scripts.Source: §4 · p. 6
5 Conclusion
Team MSU’s third-place challenge solution combines DTD with two specialized LoRA-adapted Qwen3-VL-32B models supervised by reasoning traces distilled from a Qwen3-VL-235B teacher.
5 Conclusion
- The Filterer validates and types detector regions, while the Semantic Detective merges and re-grounds them, searches for semantic anomalies, and writes the final report.The conclusion states that detector-based localization, DTD/OCR-coordinate grounding, and splitting reasoning across two specialized models each contributed to the result; code and prompts are released.Source: §5 · p. 6
Ethics and Privacy Statement
The work develops defensive methods for detecting and explaining document-image forgeries, with stated dual-use precautions and a bounded data release.
Ethics and Privacy Statement
- The release uses only challenge-provided RealText-V2 data under its research licence, and the authors report methodology rather than attack recipes.The authors note that techniques for locating and describing tampering could in principle inform an adversary about detector sensitivities.Source: Ethics and Privacy Statement · p. 6