Organizations: Institute of Image Communication and Network Engineering, Shanghai Jiao Tong University · University of Electronic and Science Technology of China
With the rapid advancement of generative models, powerful image editing methods now enable diverse and highly realistic image manipulations that far surpass traditional deepfake techniques, posing new challenges for manipulation detection. Existing image manipulation detection and localization (IMDL) benchmarks suffer from limited content diversity, narrow generative-model coverage, and insufficient interpretability, which hinders the generalization and explanation capabilities of current manipulation detection methods. To address these limitations, we introduce ManipBench, a large-scale benchmark for image manipulation detection and localization focusing on AI-edited images. ManipBench contains over 450K manipulated images produced by 25 state-of-the-art image editing models across 12 manipulation categories, among which 100K images are further annotated with bounding boxes, judgment cues, and textual explanations to support interpretable detection. Building upon ManipBench, we propose ManipShield, an all-in-one model based on a Multimodal Large Language Model (MLLM) that leverages contrastive LoRA fine-tuning and task-specific decoders to achieve unified image manipulation detection, localization, and explanation. Extensive experiments on ManipBench and several public datasets demonstrate that ManipShield achieves state-of-the-art performance and exhibits strong generality to unseen manipulation models. The project is available at https://github.com/IntMeGroup/ManipShield.
Figures & tables
Figure 1: An overview of the constructed image manipulation database and the proposed image manipulation detection model, termed ManipBench and ManipShield, respectively. (a) We collect 22K real images and generate editing prompts via a multimodal large language models across 12 manipulation categories, producing 455K manipulated images using 25 editing models. (b) 100K images are further annotated with localization and explanations. (c) We propose ManipShield for detection, localization, and explanation. (d) We perform model comparisons based on ManipBench.
Databases
Image
Manipulation
Manipulation
Text-guided
Manipulated
Text-guided
Localization
Textual
Content
Categories
Methods
Editing Models
Images
Edited Images
Annotations
Explanations
IMD2020 [ 49 ]
General
3
3
✗
35,000
✗
✗
✗
DDFT [ 60 ]
Face
4
7
✗
240,336
✗
✗
✗
DF40 [ 79 ]
Face
4
40
✗
1M+
✗
✗
✗
FakeBench [ 33 ]
General
6
10
✗
3,000
✗
✗
3,000
FakeShield [ 75 ]
General
7
3
1
196,123
181,000
196,123
34,000
Table 1: An overview of image manipulation detection datasets.
Figure 2: Overview of ManipShield. We first perform contrastive LoRA fine-tuning on paired real and manipulated images to train the vision encoder. The encoder is then frozen, and the projected image features, along with an assistant prompt, are fed into the LLM. The layer discrimination selection (LDS) module identifies the most discriminative layer, whose hidden state is used by three decoders for manipulation detection, unrealistic attribute extraction, and region localization. The outputs are combined into a structured prompt to generate explicit explanations.
Figure 3: The plots of KL divergence, LDR, information entropy and saliency score across hidden states from different LLM layers.
In-Distribution
Out-of-Distribution
Testing Subset
SD1.4
SD1.5
SD3
SDXL
FLUX
DiT
FLUX-Kontext
NanoBanana
GPT-Image
SeedDream4
Overall
Model/Metric
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Random Choice
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
50.00
♡ HifiNet [ 16 ]
63.75
64.72
60.35
62.54
61.29
63.09
57.26
60.74
58.02
61.21
57.39
60.85
53.49
58.71
56.72
60.44
55.65
59.85
53.76
10.27
59.45
60.15
♡ FakeShield [ 75 ]
73.11
74.43
67.81
70.66
67.34
70.33
60.48
66.21
61.34
66.82
60.21
66.11
54.57
63.02
54.84
63.16
54.84
63.16
53.40
11.73
64.45
66.81
♣ Univ [ 50 ]
72.63
73.78
66.87
69.61
64.92
68.38
58.06
64.38
59.41
65.25
57.39
64.05
51.08
60.78
55.65
63.09
52.96
61.71
52.02
11.22
62.96
65.55
Table 2: Comparison results on different manipulation methods. ♠ standard CNN/Transformer baselines, ♡ image manipulation detection methods, ♣ AI-generated image detection methods, ♢ multimodal large language models. The fine-tuned results are marked with ✻ . The best results are highlighted in red , and the second-best results are highlighted in blue .
In-Distribution
Out-of-Distribution
Model/Subset
SD1.4
SD1.5
SD3
SDXL
FLUX
DiT
FLUX-Kontext
NanoBanana
GPT-Image
SeedDream4
Overall
♢ DeepSeekVL2 (small) [ 35 ]
0.148
0.151
0.155
0.172
0.129
0.149
0.152
0.136
0.147
0.133
0.141
♢ InternVL3.5 (8B) [ 69 ]
0.201
0.197
0.184
0.209
0.137
0.182
0.188
0.141
0.154
0.160
0.168
♢ Qwen3-VL (8B) [ 80 ]
0.194
0.194
0.178
0.196
0.133
0.186
0.153
0.157
0.151
0.168
0.163
♢ Gemini2.5-Pro [ 7 ]
0.257
0.287
0.264
0.272
0.198
0.252
0.234
0.228
0.213
0.231
0.234
♢ ChatGPT-4o [ 51 ]
0.256
0.261
0.245
0.267
0.184
0.231
0.204
0.217
0.220
0.239
0.221
Table 3: Comparison results (loU ↑ ) of bounding box prediction. ♣ object detection methods, ♢ multimodal large language models. The fine-tuned results are marked with ✻ . The best results are highlighted in red , and the second-best results are highlighted in blue .
Figure 4: Examples of bounding box prediction results.
Testing Subset
Model/Subset
SD1.4
SD1.5
SD3
SDXL
FLUX
DiT
FLUX-Kontext
NanoBanana
GPT-Image
SeedDream4
Overall
LLaVA1.6 (7B) [ 36 ]
0.518
0.515
0.510
0.505
0.495
0.502
0.497
0.482
0.501
0.512
0.504
Ovis2.5 (9B) [ 42 ]
0.645
0.638
0.641
0.634
0.637
0.620
0.618
0.624
0.615
0.622
0.635
DeepSeekVL2 (small) [ 35 ]
0.512
0.508
0.506
0.471
0.477
0.482
0.482
0.478
0.455
0.464
0.484
Qwen3-VL (8B) [ 80 ]
0.718
0.720
0.706
0.722
0.713
0.709
0.697
0.702
0.721
0.715
0.714
InternVL3.5 (8B) [ 69 ]
0.685
0.672
0.682
0.653
0.659
0.662
0.672
0.661
0.653
0.676
0.665
Table 4: Comparison results (CSS ↑ ) of explanation capabilities. All embeddings are extracted using the InternVL3.5 [ 69 ] . The best results are highlighted in red , and the second-best results are highlighted in blue .
Testing Subset
Model/Subset
SD1.4
SD1.5
SD3
SDXL
FLUX
DiT
FLUX-Kontext
NanoBanana
GPT-Image
SeedDream4
Overall
LLaVA1.6 (7B) [ 36 ]
28.8
26.4
25.1
28.4
26.3
27.1
25.7
26.4
26.7
26.2
26.8
Ovis2.5 (9B) [ 42 ]
39.4
38.6
42.4
38.2
41.5
38.0
40.2
38.3
39.2
38.0
39.5
DeepSeekVL2 (small) [ 35 ]
45.8
46.2
45.7
52.5
46.0
52.4
44.6
45.7
45.2
50.6
48.6
Qwen3-VL (8B) [ 80 ]
66.6
64.8
65.7
64.8
66.2
61.4
62.8
64.2
65.5
64.2
65.3
InternVL3.5 (8B) [ 69 ]
68.0
67.5
66.5
64.3
68.6
64.2
65.2
65.4
67.4
63.6
65.8
Table 5: Explanation capabilities comparison based on human evaluation.
Figure 5: Comparison of performance of different MLLMs in terms of image manipulation detection, localization, and explanation, respectively.
Backbone & Strategy
Metrics
Backbone
Decoders
LoRA(vision)
LoRA(llm)
LDS
Acc ↑
loU ↑
CSS ↑
InternVL3.5 [ 69 ]
✓
✓
90.3
0.225
0.347
InternVL3.5 [ 69 ]
✓
✓
92.6
0.714
0.852
InternVL3.5 [ 69 ]
✓
✓
85.3
0.379
0.231
InternVL3.5 [ 69 ]
✓
✓
✓
93.5
0.732
0.859
InternVL3.5 [ 69 ]
✓
✓
✓
✓
94.7
0.765
0.892
Table 6: Ablation study on the different backbones, decoders and LoRA tuning strategy.
Model
ResNet-50
ManipShield
Train/Test on
SD1.4
SD1.5
SD3
SDXL
FLUX
DiT
Proprietary
SD1.4
SD1.5
SD3
SDXL
FLUX
DiT
Proprietary
SD1.4
93.19
85.75
72.04
86.69
68.77
62.50
58.80
94.31
90.59
83.33
85.89
74.10
73.79
67.74
SD1.5
88.84
92.11
66.40
70.16
70.39
64.25
60.28
91.85
92.92
69.35
69.09
79.12
70.43
64.31
SD3
76.39
72.31
91.67
71.10
62.99
61.02
59.81
80.33
79.21
90.86
81.59
67.38
65.59
69.42
SDXL
77.24
68.28
60.22
92.47
63.98
63.31
58.87
80.51
70.88
78.49
92.47
65.50
64.92
62.70
FLUX
71.06
74.73
70.97
77.42
93.41
77.15
63.04
85.39
85.75
72.85
83.47
92.07
79.03
73.86
Table 7: Accuracy results (Acc ↑ ) of cross-validation on different training and testing subsets using ResNet50 [ 17 ] and our ManipShield. Proprietary subset includes images generated by FLUX-Kontext [ 28 ] , NanoBanana [ 7 ] , GPT-Image [ 52 ] and SeedDream4 [ 58 ] .
Testing Subset
Model
SD1.4
SD1.5
SD3
SDXL
FLUX
DiT
FLUX-Kontext
NanoBanana
GPT-Image
SeedDream4
Avg
ResNet50 [ 17 ]
79.42
76.55
71.24
78.58
71.81
70.14
59.90
60.30
58.47
64.20
69.37
Swin-T [ 39 ]
78.00
79.02
71.51
77.42
69.85
70.83
58.15
62.19
58.38
63.04
68.84
MVSSNet [ 8 ]
76.15
74.34
65.19
73.70
66.05
67.18
59.59
56.90
57.30
61.29
65.77
HiFiNet [ 16 ]
84.01
76.67
74.64
79.41
75.11
69.83
65.10
61.07
58.11
64.87
70.88
CNNSpot [ 67 ]
76.40
72.25
71.33
75.16
71.28
71.82
57.84
56.50
57.89
64.34
67.48
Table 8: Accuracy (Acc ↑ ) on different testing subsets, averaged over models trained on different training subsets . The best results are highlighted in red , and the second-best results are highlighted in blue .
Dataset
CASIA2 [ 9 ]
IMD2020 [ 49 ]
DDFT [ 60 ]
DF40 [ 79 ]
Model/Metric
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
MVSSNet [ 8 ]
82.53
83.06
85.25
86.24
79.46
80.26
82.71
82.54
PSCCNet [ 38 ]
89.41
87.28
80.60
82.10
85.64
86.05
86.90
87.32
HifiNet [ 16 ]
87.16
86.50
86.38
87.15
84.32
85.21
85.25
86.00
FakeShield [ 75 ]
91.65
92.11
87.43
86.25
86.29
87.05
85.65
87.10
Univ [ 50 ]
86.32
87.23
84.34
86.20
89.22
90.15
85.24
85.87
Table 9: Comparison of performance (Acc ↑ ) on other image manipulation datasets. The best results are highlighted in red , and the second-best results are highlighted in blue .
Figure 6: An example of the annotation interface.
Figure 7: Optimal layer variation across random trials for KL divergence, LDR, information entropy, and saliency score under different sample scales.
Testing Subset
Addition
Removal
Replacement
Color Modification
Action Change
Background
Model/Metric
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
♡ HifiNet [ 16 ]
53.88
35.86
49.30
40.46
52.52
42.05
53.30
44.17
55.87
56.68
49.89
35.76
♡ FakeShield [ 75 ]
55.24
40.28
54.34
46.91
49.86
44.58
56.76
50.00
59.86
62.75
50.79
39.89
♣ Univ [ 50 ]
54.40
39.33
50.56
44.41
46.22
42.34
54.80
48.37
57.98
61.17
49.89
38.95
♣ AIDE [ 78 ]
57.97
42.47
56.72
48.93
54.06
47.44
58.11
51.48
62.44
64.91
56.46
43.53
♢ LLama3.2-Vision (11B) [ 47 ]
51.42
36.39
48.37
41.90
42.53
39.31
54.08
46.52
55.28
58.42
48.63
36.93
Table 11: Comparison results on different manipulation category subset. ♠ standard CNN/Transformer baselines, ♡ image manipulation detection methods, ♣ AI-generated image detection methods, ♢ multimodal large language models. The fine-tuned results are marked with ✻ . The best results are highlighted in red , and the second-best results are highlighted in blue .
IP2P [ 4 ]
CDS [ 48 ]
MagicBrush [ 86 ]
InfEdit [ 74 ]
MAG [ 46 ]
HQEdit [ 22 ]
PnP [ 25 ]
Model
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
Acc ↑
F1 ↑
♢ LLama3.2-Vision (11B) [ 47 ]
77.42
76.54
65.32
67.99
70.16
71.17
67.47
69.37
63.98
67.16
83.87
82.04
63.98
67.16
♢ LLaVA-1.6 (7B) [ 36 ]
49.73
64.52
50.54
64.89
50.54
64.89
50.81
65.01
50.27
64.76
56.72
67.86
50.27
64.76
♢ MiniCPM-V2.6 (8B) [ 83 ]
68.55
72.47
50.27
62.47
58.60
66.67
55.91
65.25
59.14
66.96
73.66
75.86
62.37
68.75
♢ mPLUG-Owl3 (7B) [ 84 ]
62.90
61.67
52.69
55.78
55.91
57.51
53.76
56.35
56.18
57.66
67.47
64.72
52.69
55.78
♢ CogVLM (17B) [ 68 ]
59.95
33.18
59.41
32.89
59.41
32.89
56.99
31.62
58.60
32.46
59.95
33.18
58.60
32.46
Table 12: Comparison results on different manipulation method subset. ♠ standard CNN/Transformer baselines, ♡ image manipulation detection methods, ♣ AI-generated image detection methods, ♢ multimodal large language models. The fine-tuned results are marked with ✻ . The best results are highlighted in red , and the second-best results are highlighted in blue .
ResNet50 [ 17 ]
Testing Subset
Training Subset
SD1.4
SD1.5
SD3
SDXL
FLUX
DiT
FLUX-Kontext
NanoBanana
GPT-Image
SeedDream4
Avg
SD1.4
93.19
85.75
72.04
86.69
68.77
62.50
54.57
58.06
60.48
62.10
70.42
SD1.5
88.84
92.11
66.40
70.16
70.39
64.25
58.60
59.95
58.06
64.52
69.33
SD3
76.39
72.31
91.67
71.10
62.99
61.02
60.75
56.45
58.60
63.44
67.47
SDXL
77.24
68.28
60.22
92.47
63.98
63.31
56.99
58.60
59.41
60.48
66.10
FLUX
71.06
74.73
70.97
77.42
93.41
77.15
65.05
64.78
55.91
66.40
71.69
Table 13: Accuracy results (Acc ↑ ) of cross-validation on different training and testing subsets.
Method
GPU Memory
MACs(G)
Trainable Params(M)
Infer Time (s)
MVSSNet [ 8 ]
4GB
106.20
85.75
0.468
AIDE [ 78 ]
9GB
325.25
180.24
0.726
FakeShield [ 75 ]
42GB
5809.82
486.43
1.530
ManipShield
23GB
2980.08
122.26
0.825
Table 14: Cost analysis.
Figure 8: Example images generated by different manipulation models in ManipBench.
Figure 9: Example images generated by different manipulation models in ManipBench.
Figure 10: Example images generated by different manipulation models in ManipBench.
Figure 11: Feature distribution of images generated by different manipulation models.
Figure 12: Feature distribution of images generated by different manipulation models and real images.
Recent advances in generative image editing have improved the realism and controllability of localized image manipulation, raising new challenges for image manipulation detection and localization (IMDL). However, existing IMDL benchmarks still have limitations in visual realism, manipulation diversity, and generator coverage, making it difficult to reflect recent trends in image manipulation. To address these limitations, we introduce Impostor, a high-quality AI-edited image manipulation localization dataset containing 100K manipulated images. Impostor is constructed by CraftAgent, a closed-loop agent framework that integrates scene perception, editing planning, manipulation execution, quality validation, and iterative reflection to automatically generate diverse and visually realistic manipulated images. Moreover, Impostor contains images generated by seven recent AIGC models across three manipulation types and includes multiple manipulated regions, providing a more comprehensive benchmark for AIGC-based IMDL. Furthermore, we propose PhaseAware-Net (PANet), a semantic-forensic framework that introduces local phase modeling and semantic-forensic consistency learning to better localize semantically plausible yet forensically disrupted manipulated regions. Extensive experiments show that Impostor poses significant challenges to existing large vision-language models (LVLMs) and specialized IMDL methods, while PANet achieves superior performance on Impostor and multiple public benchmarks.
Zhenliang Li, Yutao Hu, Qixiong Wang +5
Southeast University · Xiaohongshu Inc · Xiaohongshu Inc. +1
Recent advances in generative models have shifted AI-generated image detection from identifying easily distinguishable, fully synthetic images to identifying highly realistic content generated by both modern generation and manipulation pipelines. However, existing detection benchmarks are often built with outdated generative models and primarily emphasize full-image synthesis, creating a growing mismatch between benchmark data and the images encountered in real-world generation and editing scenarios. To bridge this gap, we introduce DailyBench, a high-quality unified benchmark for evaluating whether AI-generated image detectors can generalize across both modern full-image synthesis and object-level manipulation. DailyBench contains two complementary subsets: FakeBench, which includes high-quality images synthesized by recent open-source and commercial generative models, and ManipulationBench, which introduces challenging object-level edits applied to real images using advanced image-conditional models. This design makes DailyBench a realistic testbed for studying both generator-level generalization and manipulation-aware detection under subtle local edits. Experiments on DailyBench reveal substantial robustness gaps in current detectors: methods reporting 91-96% balanced accuracy on GenImage drop to 52-79% on FakeBench and 43-67% on ManipulationBench. These results show that existing detectors remain poorly generalized to realistic synthesis and manipulation, highlighting DailyBench as a rigorous testbed for developing robust and manipulation-aware AI-generated image detection methods. The project is available at https://dailybench.github.io/
Xin Jiang, Hao Tang, Junyao Gao +6
State Key Laboratory of Communication Content Cognition, People’s Daily Online · Nanyang Technological University · Tongji University +2
The proliferation of sophisticated image editing tools and generative artificial intelligence models has made verifying the authenticity of digital images increasingly challenging, with important implications for journalism, forensic analysis, and public trust. Although numerous forensic algorithms, ranging from handcrafted methods to deep learning-based detectors, have been developed for manipulation detection, individual methods often suffer from limited robustness, fragmented evidence, or weak generalization across manipulation types and image conditions. To address these limitations, we present FRAME, a method for Forensic Routing and Adaptive Multi-path Evidence fusion for image manipulation detection. FRAME organizes diverse forensic algorithms into a multi-path analysis space, adaptively selects informative forensic paths for each input image, and fuses complementary evidence to improve detection and localization performance. By moving beyond single-method analysis and fixed fusion strategies, FRAME provides a more robust and flexible approach to image forensic reasoning while preserving interpretable forensic cues from multiple evidence sources. Experimental results demonstrate the effectiveness of FRAME across diverse manipulation scenarios. Code is available at https://github.com/kzhao5/FRAME.