PaperlayerView exact revision on arXiv

Source-linked AI summary

Venus-DefakerOne2: A Vision-Forensics Foundation Model with Broader Coverage

Chenfan Qu, Yachao Liang, Mingqi Fang, Jiangwei Xie, Zhenming Wang, Baoyue Zhang, Changjiang Jiang, Zheng Chang, Fanli Jin, Xuekang Zhu, Kaiwen Feng, Junchi Li, Weihong Zhang, Haoyue Wang, Chenfeng Zhang, Yinan Xia, Fangming Cui, Dong Fan, Jingjing Liu, Tianyi Zhang, Luobin Chen, Ji-Zhe Zhou, Sheng Li, Wei Wang, Bin Li, Ran He, Xinpeng Zhang, Linna Zhou, Jian Liu, Weiqiang Wang

arXiv:2610.37918v1cs.CV

TL;DR

Visual forgery spans digital and physical forms across images and videos, yet a full-domain foundation-model baseline remains absent. Venus-DefakerOne2 is presented as a unified model for this coverage, with higher predecessor-comparison averages across image and video benchmark domains.

  • Problem

    A full-domain vision-forensics foundation-model baseline remains absent, while conventional methods are often specialized and struggle with cross-domain distributions.

    Source: §8.2.3 · p. 53

  • Method

    Venus-DefakerOne2 is a unified model trained on about 50M samples to learn shared forgery features across content types, forgery forms, and media types.

    Source: §1 · p. 5, §6 · p. 42

  • Results

    90.9 vs 80.4 for DefakerOne on five image-domain averages, and 95.7 vs 57.6 on three video-domain averages.

    Source: §5.5 · p. 29

  • Takeaways & Limitations

    The model bridges fields that have studied digital image forensics, face anti-spoofing, document fraud, and video forensics separately.

    Source: §6 · p. 42

    The model can still fail, including on samples whose anomalies are obvious to human examiners.

    Source: §10 · p. 55

Abstract

from arXiv · show

Real-world forgery is inherently heterogeneous: it manifests not only as digital manipulation but also as physical spoofing, and is carried not only by images but also by videos. Despite substantial progress, a unified anti-forgery foundation model covering such a broad threat spectrum remains absent. In this paper, we present Venus-DefakerOne2, which substantially extends the forensic capability boundary along both the forgery-form and media-type dimensions. Trained on tens of millions of open-source and in-house samples, it incorporates two key designs. Tide-Style-Tuning alternates LoRA and full-parameter fine-tuning to balance computational efficiency, generalization, and hard-sample fitting while mitigating catastrophic forgetting. Entropy-based Test Adaptation determines the optimal prediction modality by analyzing prediction entropy. Venus-DefakerOne2 achieves new state-of-the-art performance across a comprehensive suite of benchmarks, including DeepFake faces (96.7%), AI-generated images (93.3%), tampered documents (87.6%), manipulated natural images (89.6%), physical spoofs (93.1%), and AI-generated videos (96.0%). It significantly outperforms both specialized expert models and its predecessor, DefakerOne, establishing itself as a powerful and versatile foundation model for binary-decision forensic tasks.

1 Introduction

Venus-DefakerOne2 targets a fragmented field in which forgery spans digital and physical forms and images and videos. It combines alternating tuning with sample-adaptive video modality selection and reports broad benchmark gains.

1 Introduction

  • Existing detectors often target a single scenario and generalize poorly, while digital-image-only DefakerOne leaves physical forgeries and video outside its scope.The paper frames a unified model covering digital and physical forgery across images and videos as still lacking.Source: §1 · p. 4
  • The training challenge combines a roughly 50M-sample corpus with prohibitive full-parameter training costs and samples ranging from easy to difficult.A static regime may waste capacity on easy samples or suffer catastrophic forgetting of the base model’s general priors.Source: §1 · p. 4
  • Video evidence may be temporal or frame-local, so Modality Synergism trains both representations and selects the lower-entropy prediction at inference.The approach routes each sample without additional training or a learned routing module.Source: §1 · p. 5
  • Tide-Style Tuning alternates low-cost LoRA adaptation, full-parameter fitting, and a final LoRA phase to balance generalization and hard-sample fitting.The initial LoRA phase leverages pretrained priors while mitigating catastrophic forgetting; the final phase regularizes against overfitting to easy samples.Source: §1 · p. 5
  • The model is presented as learning shared fundamental vision-forgery features across content types, forgery forms, and media types.The motivation is that forged visual media can threaten information security and social trust.Source: §1 · pp. 4–5
  • RRVBench addresses aging video-forensics benchmarks with fake videos from 7 recent closed-source and 4 recent open-source generators.Its content focuses on real-world rumor scenarios and aims to minimize the application gap.Source: §1 · p. 5
  • 90.9 vs 80.4 on image-domain averages and 95.7 vs 57.6 on video-domain averages; it ranks first across eight domains and leads 40/53 detection and 11/14 localization benchmarks.The averages compare DefakerOne2 with its predecessor DefakerOne.Source: §1 · p. 5

2 Method

The method combines global image/video authenticity judgments with pixel-level localization, then addresses large-scale training and video modality choice through alternating fine-tuning and entropy-based routing.

2.1 Model Architecture

  • A multimodal model makes image/video-level authenticity judgments, while an auxiliary encoder and mask decoder produce calibrated pixel-level localization and a final decision.The localization mask is integrated with the global probability to yield the final image/video-level decision.Source: §2.1 · pp. 6–7
  • The probability-conditioned cutoff lowers to 0.25 for a confident forgery judgment and rises to 0.75 for an authentic judgment, while bounded calibration lets strong pixel evidence disagree.At p=0.5, the cutoff remains 0.5; the log-odds bias is bounded within approximately −1.099 to +1.099.Source: §2.1 · p. 7

2.2 Tide-Style Tuning

  • Tide-Style Tuning alternates a low-cost LoRA warm-up, full-parameter fitting, and a final LoRA phase for hard or newly collected samples.Noise increases from light to medium to heavy across the phases; the final phase is the model used as the final model.Source: §2.2 · pp. 8–9

2.3 Modality Synergism

  • Joint modality training presents each video as both a native clip and an Ada-FPS frame sequence, applying separate losses to the shared network.Still-image training samples use only the image-modality loss.Source: §2.3 · p. 9
  • Ada-FPS adjusts sampling rates by video source to mitigate source-quantity imbalance and caps the rate at 10 FPS to avoid redundant frames.The default sampling rate is 1 FPS.Source: §2.3 · p. 10
  • At inference, entropy-based test adaptation selects the lower-entropy prediction from the video and frame-image pathways for each sample.The procedure discards the first and last 10% of video duration and evaluates the middle 80%; it requires no additional training or learned routing module.Source: §2.3 · p. 10, Figure 4 · p. 10

3 Training Data Construction

The training corpus combines public, synthesized, and manually curated data across nine forensic domains. Its synthesis pipelines use source-matched prompts and model failure cases to build diverse, targeted examples.

3.1 Overall

  • The 50M-sample corpus draws on public datasets, engine-synthesized data, and manually curated in-the-wild attacks across nine forensic domains.The domains include AI-generated images and videos, DeepFake faces, tampered documents, forged natural images, and face and document anti-spoofing in images and videos.Source: §3.1 · p. 11

3.2 Self-Synthesized Data

  • Creative Proposer++ extends prompt generation from images to videos by deriving detailed descriptions from real media and using them to synthesize realistic counterfeits.The paper states that matching real and fake counterparts semantically directs detectors toward forgery evidence and that source-derived prompts provide diverse content.Source: §3.2 · pp. 11–12
  • The agent-based pipeline analyzes model failures, synthesizes targeted samples for missing or difficult forgery patterns, and adds them to the pool for retraining.The cycle is intended to support continued adaptation to evolving forgery methods.Source: §3.2 · p. 12

3.3.1 AI-Generated Images; 3.3.2 DeepFake Images

  • AI-generated image training uses approximately 16M samples, while DeepFake image training uses roughly 24.4M samples.The AI-generated image set includes public, extracted video-frame, and privately curated samples; the DeepFake set combines public instances with curated private samples.Source: §3.3.1 · p. 12, §3.3.2 · p. 12

3.3.3 Tampered Document Images; 3.3.4 Forged Natural Images

  • Tampered-document training contains around 3.3M samples, and natural-image manipulation training contains about 3.7M samples.The document data include private real-world samples; natural-image synthesis covers operations including splicing, copy-move, object removal, and inpainting, with pixel-level masks.Source: §3.3.3 · p. 13, §3.3.4 · p. 13

3.3.5 Face Anti-Spoofing Images; 3.3.6 Face Anti-Spoofing Videos; 3.3.7 Document Anti-Spoofing Images; 3.3.8 Document Anti-Spoofing Videos

  • Anti-spoofing data cover face presentation attacks in images and videos and document presentation attacks in images and videos.The cited training sets contain approximately 1.3M face-attack images, around 2K face-attack videos, roughly 0.1M document-attack images, and approximately 2K document-attack video sequences.Source: §3.3.5 · p. 13, §3.3.6 · p. 13, §3.3.7 · p. 13

3.3.9 AI-Generated Videos

  • AI-generated video training contains approximately 1.3M samples, combining 0.6M public samples with 0.7M privately curated sequences.The public sources include video-forensics datasets and the training split of GenBuster.Source: §3.3.9 · p. 13

4 Realistic Rumor Video Benchmark (RRVBench)

RRVBench is a benchmark for detecting generated videos in high-impact rumor scenarios. It uses semantic matching and a per-generator balanced-accuracy protocol to evaluate a broad set of contemporary video generators.

4 Realistic Rumor Video Benchmark (RRVBench)

  • RRVBench contains 1,319 authentic videos and 11,000 synthetic videos from 11 modern generative architectures, spanning closed- and open-source engines.The synthetic set comprises 2,500 closed-source-engine videos and 8,500 open-source-engine videos.Source: §4 · p. 14
  • Semantic descriptions from authentic source videos condition generation, matching real and synthetic content to reduce semantic disparity as a benchmark confound.The descriptions are extracted with Qwen3.5-32B and used as prompts for target video generators.Source: §4 · p. 14
  • The benchmark targets military, political, civil-unrest, and public-health rumor domains and reports macro-averaged balanced accuracy across 11 generator subsets.Each generator subset is paired with the complete 1,319-video authentic set, and balanced accuracy is calculated independently for each generator.Source: §4 · p. 14

5 Experiments and Analyses

DefakerOne2 is evaluated across image-forgery domains, with strong results on DeepFake, AI-generated images, tampered documents, and manipulated natural images. The section also reports implementation details and directs physical-spoof results to the video-level evaluation.

5.1 Implementation Details

  • LoRA tuning is used in the first and third training stages, with full-parameter tuning in the second; the three stages use about 15M, 40M, and 40M samples.The listed dataset splits are mutually disjoint across stages, while all other datasets are shared across stages.Source: §5.1 · p. 16

5.2 Image-level Detection Comparison

  • The image-level comparison spans non-MLLM and MLLM detectors, with paired tables for each domain and consolidated per-domain averages in Table 19.Both competitor families use the same test splits and protocol.Source: §5.2 · p. 16

5.2.1 DeepFake Detection

  • DefakerOne2 achieves 96.7% overall average AUC on DeepFake detection, outperforming DefakerOne by 0.9%, Effort by 8.5% as strongest non-MLLM baseline, and Ivy-xDetector by 22.7% as best forensic MLLM.Source: §5.2.1 · p. 17

5.2.2 AI-Generated Image Detection

  • 93.3% average accuracy: DefakerOne2 leads all nine AI-generated-image benchmarks, exceeding DefakerOne by 5.8% and Ivy-xDetector by 13.4%.Across the nine suites, its scores span 79.0–99.9, while baseline rankings vary across generators.Source: §5.2.2 · pp. 18–19, Table 3 · p. 18, Table 4 · p. 18

5.2.3 Tampered Document Detection

  • 87.6% average accuracy: DefakerOne2 leads five of nine document benchmarks and exceeds DefakerOne by 6.2% and DTD by 28.5%.DTD is trained specifically for this task; the passage attributes the margin to the breadth of evidence aggregated.Source: §5.2.3 · pp. 19–20, Table 5 · p. 19, Table 6 · p. 19

5.2.4 Manipulated Natural Image Detection

  • 89.6% mean AUC: DefakerOne2 improves on DefakerOne by 2.9% and TruFor by 18.1% across manipulated natural-image benchmarks.On ManipulationBench, it averages 71.7 balanced accuracy in the pre-trained setting, ahead of RPOBE at 70.8.Source: §5.2.4 · pp. 20–21, Table 7 · p. 20, Table 8 · p. 20

5.2.5 Physical Face and Document Image Forgery Detection

  • Physical face and document spoofing results are consolidated with digital video-forgery suites in Section 5.3.1 rather than tabulated separately here.The cited physical benchmarks overlap with the video-level evaluation, where clips are processed as decomposed frames.Source: §5.2.5 · p. 21

5.3 Video-level Detection Comparison

DefakerOne2 is compared with physical anti-spoofing, video-forensics, and image-forensics models across classic physical and digital video benchmarks and two synthetic-video evaluations. It leads broadly, while the results also describe benchmark-specific exceptions and baseline variability.

5.3 Video-level Detection Comparison

  • The video comparison includes physical and video-forensics models alongside still-image forensic detectors; models unable to process video directly are evaluated on decomposed frames.The eight classic benchmarks span physical spoofing and digital video forgery.Source: §5.3 · p. 23, §5.3.1 · p. 23

5.3.1 Comparison on Classic Physical and Digital Forgery Benchmarks

  • 96.0% average accuracy: DefakerOne2 leads on seven of eight classic physical and digital forgery benchmarks, improving over DefakerOne by 33.3 points.Its only accuracy exception is CASIA-FASD, where FLIP scores 98.5 versus 90.3; its average HTER is 5.0 versus 29.4 for DefakerOne.Source: §5.3.1 · pp. 23–24
  • DefakerOne2’s average accuracy and balanced accuracy stay within one point on seven of eight classic benchmarks; competitors’ mean discrepancies range from 3.1 to 15.1 points.The passage identifies CASIA-FASD as its single exception, with a 9.2-point discrepancy.Source: §5.3.1 · p. 24

5.3.2 Comparison on RABench

  • On RA-Bench, DefakerOne2 achieves 99.3 average AUC, exceeding ForgeLens by 38.2 points and DeCoF by 38.4 points across nine generators.Its AUC spans 98.4–99.9, and its balanced accuracy spans 95.3–96.5; the supplied passages describe the generators as unseen during training.Source: §5.3.2 · pp. 24–25, Table 14 · p. 25, Table 15 · p. 25
  • On RA-Bench, DefakerOne2 exceeds Gemini-3.1-Pro by 32.9 points, Skyra-RL by 41.4 points, and DefakerOne by 47.0 points in zero-shot balanced accuracy.The passage reports that its AUC and balanced-accuracy rankings agree.Source: §5.3.2 · pp. 24–25

5.3.3 Comparison on RRVBench

  • On RRVBench, DefakerOne2 exceeds DefakerOne by 43.0 points and DRCT by 33.2% across 11 sub-benchmarks, with scores spanning 88.0–96.6.Its weakest score, on SeeDance 2.5, exceeds every competitor’s strongest entry.Source: Table 16 · p. 26, Table 17 · p. 26, §5.3.3 · p. 27

5.4 Pixel-level Localization Comparison

The localization evaluation compares pixel-level tamper masks with specialized document and natural-image detectors. DefakerOne2 performs strongly across both domains, with a reported exception on one document benchmark.

5.4 Pixel-level Localization Comparison

  • On document localization, DefakerOne2 scores 61.7 on DanceText and 56.5 on RTM, exceeding DTD by 52.7 and 39.3 points, respectively.The passage identifies these as suites that break the scanned-document assumption; Table 18’s upper block reports document benchmarks.Source: §5.4 · p. 27, Table 18 · p. 28
  • Table 18 reports binary pixel-level F1, with document benchmarks in the upper block and natural-image benchmarks in the lower block.The evaluated suites include receipts, contracts, IDs, and scene text, as well as natural-image manipulation datasets.Source: §5.4 · p. 27, Table 18 · p. 28
  • On natural-image localization, DefakerOne2 scores 65.6 on CocoGlide versus APSC-Net’s 35.5, and 67.4 on AutoSplice versus TruFor’s 39.3.It improves the document average over DefakerOne by 5.8 points but concedes 2.6 points on RTM; it never loses a natural-image benchmark to an external competitor.Source: §5.4 · p. 28, Table 18 · p. 28

5.5 Comparison Summary

DefakerOne2 leads every evaluated domain, with strong average performance across image and video benchmarks. The ablations report gains from staged fine-tuning and entropy-based modality routing, alongside stable decoding results and robustness on distorted images.

5.5 Comparison Summary

  • 90.9 on images and 95.7 on videos are DefakerOne2’s averages, versus 80.4 and 57.6 for DefakerOne; it leads all eight domain rows.Its weakest row, physical image forgery, scores 87.2—19.6 points above the strongest external entry. Version 2 raises physical image forgery from 50.7 to 87.2 and RRVBench from 52.3 to 95.3; external models’ rankings rotate across domains.Source: §5.5 · pp. 28–29, Table 19 · p. 29

5.6.1 Ablation on Fine-tuning Approach

  • 90.9 / 95.7 are the final image/video scores after Tide-Style Tuning’s hard-sample ebb, the best results in every ablation-table column.The hard-sample ebb improves on All-LoRA by 3.6 image points and 2.1 video points; the preceding full-parameter stage also surpasses both static baselines on both modalities.Source: §5.6.1 · pp. 30–31, Table 20 · p. 30

5.6.2 Ablation on Modality Synergism

  • 95.9 average accuracy for entropy-routed predictions exceeds the frame pathway’s 91.6 and video pathway’s 93.5 across ten benchmarks.The stronger fixed pathway differs by benchmark, and routing exceeds both fixed pathways on SCVD, GenBuster OOD, CASIA-FASD, and GenBuster++; its average selection ratio is 50.0%/50.0%.Source: §5.6.2 · pp. 31–32

5.6.3 Ablation on Decoding Hyper-parameters

  • Across decoding temperatures from 0.0 to 1.0, image accuracy stays within 90.9–91.0% and video scores within 95.5–95.7%.Across seeds 42, 1024, and 4096, image accuracy is 90.8–91.0% and video accuracy 95.6–95.7%.Source: §5.6.3 · pp. 32–33, Table 22 · p. 33

5.6.4 Robustness evaluation

  • On MFFI-Distorted, DefakerOne2 maintains AUC above 90, while DefakerOne drops from 96.1 to 76.4.The subset applies varied distortions, including blur, noise, color distortion, geometric deformation, compression, and adversarial perturbations; the training pipeline did not specifically mimic its official distortions.Source: §5.6.4 · p. 33, Table 23 · p. 33

5.7 Ablation Study for Forgery Localization Task

The localization ablations show that a forensic auxiliary encoder supplies most of the gains, while a parameter-free calibration loop adds a smaller improvement by using the global judgment to recover weak local responses.

5.7 Ablation Study for Forgery Localization Task

  • The ablation compares a vision-encoder baseline, ConvNeXt-Large and DINOMAC auxiliary encoders, then adds the calibration loop to the DINOMAC setting.Table 24 reports pixel-level forgery localization under binary F1, with document and natural-image benchmark blocks.Source: §5.7 · p. 33, Table 24 · p. 34

5.7.1 Ablation on Anomaly Magnifier

  • DINOMAC raises pixel-level F1 from 59.8 to 77.7 across 14 benchmarks, with gains concentrated in low-level traces such as inconsistent blur and boundary discontinuity.The paper reports an average gain over baseline of 20.8 points on documents and 14.0 points on natural images.Source: §5.7.1 · pp. 34–35
  • The ConvNeXt-Large Anomaly Magnifier raises document average from 58.3 to 73.0 but lowers natural-image average from 61.9 to 56.7, whereas DINOMAC improves both domains.The analysis attributes ConvNeXt's mixed effect to semantic-saliency features, while DINOMAC's forensic tuning improves low-level trace detection.Source: §5.7.1 · pp. 34–35

5.7.2 Ablation on MLLM Calibration

  • Calibration improves document average from 79.1 to 79.5 and natural average from 75.9 to 78.1, chiefly recovering subtle or diffuse manipulations that the pixel branch under-segments.Its dynamic threshold acts as a recall-oriented prior on hard samples, with no added trainable parameters.Source: §5.7.2 · p. 35
  • Pixel-level F1 rises from 59.8 in the baseline to 77.7 with the DINOMAC Anomaly Magnifier, while calibration adds a further +1.2 points across all 14 benchmarks.The combined ablations attribute the bulk of improvement to the auxiliary encoder and describe calibration as parameter-free.Source: §5.7.1 · p. 34, §5.7.2 · p. 35

5.8 t-SNE visualization and Analyses

The projected representation groups samples chiefly by forensic domain and provenance rather than by real-versus-fake status. Accuracy varies with cluster membership, while content-diverse flags are spread across multiple regions.

5.8 t-SNE visualization and Analyses

  • The five t-SNE manifolds organize by forensic domain, not authenticity: real and fake samples intermix, with no globally separable Real/Fake direction in the last-layer representation.Figure 7 plots 2,396 randomly sampled test inputs; marker shapes encode forensic flags and colors encode ground truth and prediction correctness.Source: §5.8 · pp. 36, 40, Figure 7 · p. 36
  • Deepfake samples all fall in C1, while 56.0% of document samples concentrate there at 94.1% accuracy; document leakage into C0 coincides with 63.6% accuracy.The analysis associates these concentrations with face-centric and document-specific appearance priors.Source: §5.8 · pp. 37–38
  • C2 is best read as a video-provenance cluster: it contains 82.5% of framespoof, 98.2% of videospoof and 87.6% of videoaigc samples.Framespoof and videospoof share a source corpus and acquisition chain, while videoaigc also carries video-pipeline statistics.Source: Table 25 · p. 37, §5.8 · p. 38
  • The most dispersed flags are aigc and nat: aigc spans all five clusters, while natural images have no strong attractor and are spread across C2–C4 beyond C1.The paper relates this pattern to content diversity and the lack of a shared appearance prior.Source: §5.8 · p. 38
  • The per-flag views show compact regions for flags with strong appearance or provenance priors, while aigc, nat and doc occupy multiple disjoint islands.Real/fake and correct/wrong markers remain intermixed within panels.Source: §5.8 · p. 38, Figure 8 · p. 39
  • Cluster membership tracks per-flag accuracy: document samples in C0 reach 63.6% accuracy versus 94.1% in their dominant C1 cluster, a 30.5-point gap.The analysis interprets foreign-cluster placement as representation-level mis-routing rather than simply lack of input evidence.Source: Table 25 · p. 37, §5.8 · pp. 38–39
  • C0 and C3 have the highest dominant-flag shares and accuracies, but the purity–accuracy relation is a trend rather than a strict ordering.The reported rank correlation is ρ=+0.80 across five clusters; small cluster sizes and alternative purity measures qualify the comparisons.Source: Table 25 · p. 37, §5.8 · p. 39
  • The authors propose cluster-aware metric learning and an explicit authenticity margin as future objectives to reduce mis-routing and make domain and authenticity more readable.These are proposed remedies, not evaluated results.Source: §5.8 · p. 40

5.9 Evaluation on In-house Data

Under a controlled comparison using identical in-house training data and a common FPR=0.001 operating point, DefakerOne2 leads the tested models across the in-house datasets, including the hardest split.

5.9 Evaluation on In-house Data

  • 96.36 is DefakerOne2's average on the three commonly reported splits, ahead of DINO-MAC-0.3B by 3.97 points.The reported lead grows on Data2 and Data4 relative to Data1.Source: §5.9 · pp. 40–41
  • 82.41 is DefakerOne2's result on the hardest split, Data4, 2.55 points above DINO-MAC-0.3B.DefakerOne2 retains 86.1% of its Data1 score, the highest reported relative retention among the compared models.Source: §5.9 · pp. 40–41
  • DefakerOne2 ranks first on all four in-house test sets and both averages, sweeping every head-to-head column under the controlled comparison.The comparison uses identical in-house training data and a common FPR=0.001 operating point; the reported average gain over DeFakerOne is 9.24 points.Source: §5.9 · pp. 40–41, Table 26 · p. 41

6 Conclusion

Venus-DefakerOne2 unifies digital and physical forgery detection across images and videos, using a large heterogeneous corpus and training and inference designs for that scope. The paper reports state-of-the-art performance across 53 detection and 14 localization benchmarks.

6 Conclusion

  • Venus-DefakerOne2 is presented as a unified model for the full digital/physical by image/video forgery matrix, trained on about 50M samples from public, self-constructed and manually annotated online-attack data.The authors frame this as bridging communities that had studied digital image forensics, face anti-spoofing, document fraud detection and video forensics separately.Source: §6 · p. 42
  • Tide-Style Tuning alternates LoRA adaptation, full-parameter fine-tuning and LoRA regularization to address training cost and uneven sample difficulty.The conclusion describes the three-phase regime as balancing efficiency, generalization and fitting capacity.Source: §6 · p. 42
  • Modality Synergism trains on video and frame modalities with independent losses, then uses entropy-based test adaptation to route inference to the more certain modality.The paper also reports RRVBench, a realistic rumor-video benchmark, and state-of-the-art results across 53 detection and 14 localization benchmarks.Source: §6 · p. 42

7 Future Work

Future work targets scalable, continually updated forensic data pipelines and agentic, evidence-driven investigations that balance outcome-level and process-level supervision.

Scalable Foundation Forensics and Continual Data Engineering

  • The planned data direction is high-throughput pipelines for diverse, representative benchmarks, paired with continual learning for emerging synthesis techniques and unseen artifacts.The authors report diminishing returns from simply scaling raw, homogeneous data.Source: §7 · p. 42

Agentic Forensics and Hybrid Knowledge Injection

  • The authors envision multimodal agents using verifiable forensic tools and ground-truth cues to support explainable, multi-step investigations.This direction seeks to balance outcome-level supervision, limited by label scarcity and interpretability, with process-level supervision, limited by manual prompt engineering and domain-specific heuristics.Source: §7 · p. 42

8 Related Works

The related-work review surveys increasingly diverse datasets and specialized forensic methods, noting that fragmented data and task-specific models limit unified visual-forensics foundation models. It also identifies a gap between narrow vision detectors and MLLMs whose objectives can drift from forensic verification and localization, motivating a broader full-domain baseline.

8.1.1 DeepFake Detection

  • DeepFake datasets progress from fixed, low-fidelity manipulations toward high-fidelity, diverse, and in-the-wild benchmarks, while newer collections test scale, multi-face, and varied forgery techniques.FaceForensics++ establishes evaluation across four manipulation types and compression levels; Celeb-DF tests high-fidelity fakes, DFDC simulates diverse real scenes, and WildDeepFake offers in-the-wild videos. DF40 covers 40 techniques, ScaleDF addresses facial scale, and MFFI multi-face scenarios.Source: §8.1.1 · p. 43, §8.1 · p. 43

8.1.2 AI-Generated Image Detection

  • AI-generated image benchmarks have shifted from GAN-specific collections to cross-model, diffusion, commercial, hard-case, and hybrid-forgery evaluation.GenImage pairs real ImageNet samples with images from eight generators; other datasets test commercial outputs, inversion-generated hard negatives, prompt and style reliability, and hybrid artifacts.Source: §8.1.2 · p. 44

8.1.3 Tampered Document Image Detection; 8.1.4 Manipulated Natural Image Detection

  • Document-tampering datasets span pixel-level localization, realistic generative text edits, real-world scans, and reasoning about textual coherence; natural-image benchmarks progress from splicing and copy-move to generative local edits.MIML contains over 120,000 professionally edited forgeries with pixel-level annotations, while newer natural-image suites test diffusion editing and generalization to AI-edited social-media imagery.Source: §8.1.3 · pp. 44–45, §8.1.4 · pp. 45–46

8.1.5 Face Anti-Spoofing; 8.1.6 Document Anti-Spoofing

  • Face anti-spoofing datasets expand from controlled print and replay attacks toward mobile, multimodal, in-the-wild, and unified physical-digital evaluation; document anti-spoofing benchmarks test print and screen recapture across devices and conditions.UniAttackData combines physical and digital face attacks, while document datasets progress from liveness videos and heterogeneous recapture pipelines to screen-recapture artifacts.Source: §8.1.5 · pp. 46–47, §8.1.6 · p. 48

8.1.7 AI-Generated Video Detection

  • AI-generated video benchmarks now span million-scale and multimodal collections, unseen-generator robustness, explainability, physical plausibility, factuality, and socially grounded detection.GenVideo pairs millions of real and generated videos and evaluates unseen generators and degradation robustness; RABench anchors evaluation in real-world crisis events.Source: §8.1.7 · pp. 48–49

8.1.8 Summary

  • Despite progress across subfields, dataset scale, real-to-fake ratios, supervision, and evaluation remain fragmented; DefakerOne2 unifies tens of millions of samples across major forensic domains.Omni-IML Qu et al. (2026b) and ForensicHub Du et al. (2026b) explored cross-domain benchmarking but remain limited in scale, sources, and coverage; DefakerOne2 also analyzes cross-domain complementarity, transferability, and gradient interference.Source: §8.1.8 · p. 49

8.2 Methods; 8.2.1 Vision Forensic Models

  • Traditional vision-forensics methods remain domain-specific, using specialized architectures and artifact cues for DeepFakes, synthetic images, document tampering, and natural-image localization.Examples include spectral or blending cues for DeepFakes, transferable or forgery-aware representations for generated images, spatial-frequency features for documents, and image-level decisions with pixel-level masks for natural-image manipulation.Source: §8.2 · p. 49, §8.2.1 · pp. 50–51

8.2.1 Vision Forensic Models

  • Anti-spoofing methods explore source-free adaptation, continual updating, language-aligned and multimodal learning for face attacks, alongside synthetic attack generation for document authentication.Document methods also synthesize unseen presentation attacks to complement real recaptures.Source: §8.2.1 · p. 51
  • Document-recapture detectors disentangle moiré and chromatic artifacts from natural texture or inject distortion maps and spectral representations to improve robustness across capture conditions.The review describes methods for separating moiré artifacts, modeling screen-recapture distortion, and augmenting moiré spectral components.Source: §8.2.1 · p. 52
  • Vision-forensic models remain constrained by narrow tasks and specialized artifacts, while video detectors address temporal coherence through flow, frame consistency, dynamics, motion trajectories, or detail propagation.The review characterizes domain-specific models as relying on specialized formats, handcrafted priors, and isolated outputs.Source: §8.2.1 · p. 52

8.2.2 MLLMs for FIDL

  • MLLMs provide human-readable explanations, while later methods combine language reasoning with perception, segmentation, or localization and extend visual reasoning to video forensics.FakeShield integrates segmentation with language reasoning; BusterX frames generated-video detection as visual reasoning, while Skyra localizes spatio-temporal anomalies.Source: §8.2.2 · pp. 52–53

8.2.3 Summary

  • DefakerOne2 broadens DefakerOne’s narrower scope and establishes a direct full-domain vision-forensics baseline using a Qwen3.5 + DINOMAC backbone.The paper says multi-domain data composition experiments investigate how heterogeneous forensic data can support unified detection, localization, and generalization.Source: §8.2.3 · p. 53
  • MLLM forensic methods can prioritize reasoning or descriptive interpretation over authenticity verification and localization, while Omni-IML and ForensicHub illustrate both the promise and challenges of unification.The review says this objective drift can limit their use of image-level labels and pixel-level masks as stable full-domain baselines.Source: §8.2.3 · p. 53

10 Limitations

The authors describe DefakerOne2 as an initial unified model that can still fail, and identify limits in its training data and segmentation module.

10 Limitations

  • DefakerOne2 can fail even on anomalies obvious to human observers, though targeted training data with similar characteristics may reduce such failures.The paper calls it a starting point rather than a finished model that performs perfectly in every case.Source: §10 · p. 55
  • To mitigate white-box attacks against the deployed online model, training uses only a small subset of outdated in-house data.Source: §10 · p. 55
  • The segmentation module was trained only on regionally tampered samples, excluding authentic and fully generated samples.When segmentation and classification disagree, classification should take precedence; masks are intended to highlight cues in samples already suspected of being forged.Source: §10 · p. 55

11 Domestic GPU/Accelerator Adaptation

The paper reports migration of Qwen3.5 models to Huawei Ascend for end-to-end training, alongside faster training performance in the stated business scenario.

11 Domestic GPU/Accelerator Adaptation

  • The Qwen3.5 dense and MoE series were migrated and deeply adapted to Huawei Ascend for end-to-end training, including data processing, backpropagation, parameter updates, and checkpoint recovery.A layered precision-alignment mechanism compared intermediate tensors, logits, gradients, loss curves, and downstream performance to maintain convergence and business accuracy consistent with the baseline environment.Source: §11 · p. 55
  • 13.4% less overall training time was measured in a 20-epoch test on Huawei Ascend accelerators (A3).Source: §11 · p. 55
  • Huawei Ascend accelerators (A3) delivered an average 11% improvement in single-step training performance versus the original Pingtouge-series baseline.The same training configuration yielded an approximately 12%–13% end-to-end training speed improvement.Source: §11 · p. 55
Loading 2610.37918v1…