ManipShield: A Unified Framework for Image Manipulation Detection, Localization and Explanation

Zitong Xu; Huiyu Duan; Xiaoyu Wang; Zhaolin Cai; Kaiwei Zhang; Xiongkuo Min; Guangtao Zhai

cs.CVNov 18, 2025

ManipShield: A Unified Framework for Image Manipulation Detection, Localization and Explanation

Authors: Zitong Xu, Huiyu Duan, Xiaoyu Wang, Zhaolin Cai, Kaiwei Zhang, Xiongkuo Min, Guangtao Zhai

Organizations: Institute of Image Communication and Network Engineering, Shanghai Jiao Tong University · University of Electronic and Science Technology of China

Abstract

With the rapid advancement of generative models, powerful image editing methods now enable diverse and highly realistic image manipulations that far surpass traditional deepfake techniques, posing new challenges for manipulation detection. Existing image manipulation detection and localization (IMDL) benchmarks suffer from limited content diversity, narrow generative-model coverage, and insufficient interpretability, which hinders the generalization and explanation capabilities of current manipulation detection methods. To address these limitations, we introduce ManipBench, a large-scale benchmark for image manipulation detection and localization focusing on AI-edited images. ManipBench contains over 450K manipulated images produced by 25 state-of-the-art image editing models across 12 manipulation categories, among which 100K images are further annotated with bounding boxes, judgment cues, and textual explanations to support interpretable detection. Building upon ManipBench, we propose ManipShield, an all-in-one model based on a Multimodal Large Language Model (MLLM) that leverages contrastive LoRA fine-tuning and task-specific decoders to achieve unified image manipulation detection, localization, and explanation. Extensive experiments on ManipBench and several public datasets demonstrate that ManipShield achieves state-of-the-art performance and exhibits strong generality to unseen manipulation models. The project is available at https://github.com/IntMeGroup/ManipShield.

Figures & tables

Figure 1: An overview of the constructed image manipulation database and the proposed image manipulation detection model, termed ManipBench and ManipShield, respectively. (a) We collect 22K real images and generate editing prompts via a multimodal large language models across 12 manipulation categories, producing 455K manipulated images using 25 editing models. (b) 100K images are further annotated with localization and explanations. (c) We propose ManipShield for detection, localization, and explanation. (d) We perform model comparisons based on ManipBench.

Databases	Image	Manipulation	Manipulation	Text-guided	Manipulated	Text-guided	Localization	Textual
Databases	Content	Categories	Methods	Editing Models	Images	Edited Images	Annotations	Explanations
IMD2020 [ 49 ]	General	3	3	✗	35,000	✗	✗	✗
DDFT [ 60 ]	Face	4	7	✗	240,336	✗	✗	✗
DF40 [ 79 ]	Face	4	40	✗	1M+	✗	✗	✗
FakeBench [ 33 ]	General	6	10	✗	3,000	✗	✗	3,000
FakeShield [ 75 ]	General	7	3	1	196,123	181,000	196,123	34,000

Table 1: An overview of image manipulation detection datasets.

Figure 2: Overview of ManipShield. We first perform contrastive LoRA fine-tuning on paired real and manipulated images to train the vision encoder. The encoder is then frozen, and the projected image features, along with an assistant prompt, are fed into the LLM. The layer discrimination selection (LDS) module identifies the most discriminative layer, whose hidden state is used by three decoders for manipulation detection, unrealistic attribute extraction, and region localization. The outputs are combined into a structured prompt to generate explicit explanations.

Figure 3: The plots of KL divergence, LDR, information entropy and saliency score across hidden states from different LLM layers.

	In-Distribution												Out-of-Distribution
Testing Subset	SD1.4		SD1.5		SD3		SDXL		FLUX		DiT		FLUX-Kontext		NanoBanana		GPT-Image		SeedDream4		Overall
Model/Metric	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$
Random Choice	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00	50.00
$\heartsuit$ HifiNet [ 16 ]	63.75	64.72	60.35	62.54	61.29	63.09	57.26	60.74	58.02	61.21	57.39	60.85	53.49	58.71	56.72	60.44	55.65	59.85	53.76	10.27	59.45	60.15
$\heartsuit$ FakeShield [ 75 ]	73.11	74.43	67.81	70.66	67.34	70.33	60.48	66.21	61.34	66.82	60.21	66.11	54.57	63.02	54.84	63.16	54.84	63.16	53.40	11.73	64.45	66.81
$\clubsuit$ Univ [ 50 ]	72.63	73.78	66.87	69.61	64.92	68.38	58.06	64.38	59.41	65.25	57.39	64.05	51.08	60.78	55.65	63.09	52.96	61.71	52.02	11.22	62.96	65.55

Table 2: Comparison results on different manipulation methods.

\spadesuit

standard CNN/Transformer baselines,

\heartsuit

image manipulation detection methods,

\clubsuit

AI-generated image detection methods,

\diamondsuit

multimodal large language models. The fine-tuned results are marked with ✻ . The best results are highlighted in red , and the second-best results are highlighted in blue .

	In-Distribution						Out-of-Distribution
Model/Subset	SD1.4	SD1.5	SD3	SDXL	FLUX	DiT	FLUX-Kontext	NanoBanana	GPT-Image	SeedDream4	Overall
$\diamondsuit$ DeepSeekVL2 (small) [ 35 ]	0.148	0.151	0.155	0.172	0.129	0.149	0.152	0.136	0.147	0.133	0.141
$\diamondsuit$ InternVL3.5 (8B) [ 69 ]	0.201	0.197	0.184	0.209	0.137	0.182	0.188	0.141	0.154	0.160	0.168
$\diamondsuit$ Qwen3-VL (8B) [ 80 ]	0.194	0.194	0.178	0.196	0.133	0.186	0.153	0.157	0.151	0.168	0.163
$\diamondsuit$ Gemini2.5-Pro [ 7 ]	0.257	0.287	0.264	0.272	0.198	0.252	0.234	0.228	0.213	0.231	0.234
$\diamondsuit$ ChatGPT-4o [ 51 ]	0.256	0.261	0.245	0.267	0.184	0.231	0.204	0.217	0.220	0.239	0.221

Table 3: Comparison results (loU

\uparrow

) of bounding box prediction.

\clubsuit

object detection methods,

\diamondsuit

multimodal large language models. The fine-tuned results are marked with ✻ . The best results are highlighted in red , and the second-best results are highlighted in blue .

Figure 4: Examples of bounding box prediction results.

	Testing Subset
Model/Subset	SD1.4	SD1.5	SD3	SDXL	FLUX	DiT	FLUX-Kontext	NanoBanana	GPT-Image	SeedDream4	Overall
LLaVA1.6 (7B) [ 36 ]	0.518	0.515	0.510	0.505	0.495	0.502	0.497	0.482	0.501	0.512	0.504
Ovis2.5 (9B) [ 42 ]	0.645	0.638	0.641	0.634	0.637	0.620	0.618	0.624	0.615	0.622	0.635
DeepSeekVL2 (small) [ 35 ]	0.512	0.508	0.506	0.471	0.477	0.482	0.482	0.478	0.455	0.464	0.484
Qwen3-VL (8B) [ 80 ]	0.718	0.720	0.706	0.722	0.713	0.709	0.697	0.702	0.721	0.715	0.714
InternVL3.5 (8B) [ 69 ]	0.685	0.672	0.682	0.653	0.659	0.662	0.672	0.661	0.653	0.676	0.665

Table 4: Comparison results (CSS

\uparrow

) of explanation capabilities. All embeddings are extracted using the InternVL3.5 [ 69 ] . The best results are highlighted in red , and the second-best results are highlighted in blue .

	Testing Subset
Model/Subset	SD1.4	SD1.5	SD3	SDXL	FLUX	DiT	FLUX-Kontext	NanoBanana	GPT-Image	SeedDream4	Overall
LLaVA1.6 (7B) [ 36 ]	28.8	26.4	25.1	28.4	26.3	27.1	25.7	26.4	26.7	26.2	26.8
Ovis2.5 (9B) [ 42 ]	39.4	38.6	42.4	38.2	41.5	38.0	40.2	38.3	39.2	38.0	39.5
DeepSeekVL2 (small) [ 35 ]	45.8	46.2	45.7	52.5	46.0	52.4	44.6	45.7	45.2	50.6	48.6
Qwen3-VL (8B) [ 80 ]	66.6	64.8	65.7	64.8	66.2	61.4	62.8	64.2	65.5	64.2	65.3
InternVL3.5 (8B) [ 69 ]	68.0	67.5	66.5	64.3	68.6	64.2	65.2	65.4	67.4	63.6	65.8

Table 5: Explanation capabilities comparison based on human evaluation.

Figure 5: Comparison of performance of different MLLMs in terms of image manipulation detection, localization, and explanation, respectively.

Backbone $\&$ Strategy					Metrics
Backbone	Decoders	LoRA(vision)	LoRA(llm)	LDS	Acc $\uparrow$	loU $\uparrow$	CSS $\uparrow$
InternVL3.5 [ 69 ]		✓	✓		90.3	0.225	0.347
InternVL3.5 [ 69 ]	✓		✓		92.6	0.714	0.852
InternVL3.5 [ 69 ]	✓	✓			85.3	0.379	0.231
InternVL3.5 [ 69 ]	✓	✓	✓		93.5	0.732	0.859
InternVL3.5 [ 69 ]	✓	✓	✓	✓	94.7	0.765	0.892

Table 6: Ablation study on the different backbones, decoders and LoRA tuning strategy.

Model	ResNet-50							ManipShield
Train/Test on	SD1.4	SD1.5	SD3	SDXL	FLUX	DiT	Proprietary	SD1.4	SD1.5	SD3	SDXL	FLUX	DiT	Proprietary
SD1.4	93.19	85.75	72.04	86.69	68.77	62.50	58.80	94.31	90.59	83.33	85.89	74.10	73.79	67.74
SD1.5	88.84	92.11	66.40	70.16	70.39	64.25	60.28	91.85	92.92	69.35	69.09	79.12	70.43	64.31
SD3	76.39	72.31	91.67	71.10	62.99	61.02	59.81	80.33	79.21	90.86	81.59	67.38	65.59	69.42
SDXL	77.24	68.28	60.22	92.47	63.98	63.31	58.87	80.51	70.88	78.49	92.47	65.50	64.92	62.70
FLUX	71.06	74.73	70.97	77.42	93.41	77.15	63.04	85.39	85.75	72.85	83.47	92.07	79.03	73.86

Table 7: Accuracy results (Acc

\uparrow

) of cross-validation on different training and testing subsets using ResNet50 [ 17 ] and our ManipShield. Proprietary subset includes images generated by FLUX-Kontext [ 28 ] , NanoBanana [ 7 ] , GPT-Image [ 52 ] and SeedDream4 [ 58 ] .

	Testing Subset
Model	SD1.4	SD1.5	SD3	SDXL	FLUX	DiT	FLUX-Kontext	NanoBanana	GPT-Image	SeedDream4	Avg
ResNet50 [ 17 ]	79.42	76.55	71.24	78.58	71.81	70.14	59.90	60.30	58.47	64.20	69.37
Swin-T [ 39 ]	78.00	79.02	71.51	77.42	69.85	70.83	58.15	62.19	58.38	63.04	68.84
MVSSNet [ 8 ]	76.15	74.34	65.19	73.70	66.05	67.18	59.59	56.90	57.30	61.29	65.77
HiFiNet [ 16 ]	84.01	76.67	74.64	79.41	75.11	69.83	65.10	61.07	58.11	64.87	70.88
CNNSpot [ 67 ]	76.40	72.25	71.33	75.16	71.28	71.82	57.84	56.50	57.89	64.34	67.48

Table 8: Accuracy (Acc

\uparrow

) on different testing subsets, averaged over models trained on different training subsets . The best results are highlighted in red , and the second-best results are highlighted in blue .

Dataset	CASIA2 [ 9 ]		IMD2020 [ 49 ]		DDFT [ 60 ]		DF40 [ 79 ]
Model/Metric	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$
MVSSNet [ 8 ]	82.53	83.06	85.25	86.24	79.46	80.26	82.71	82.54
PSCCNet [ 38 ]	89.41	87.28	80.60	82.10	85.64	86.05	86.90	87.32
HifiNet [ 16 ]	87.16	86.50	86.38	87.15	84.32	85.21	85.25	86.00
FakeShield [ 75 ]	91.65	92.11	87.43	86.25	86.29	87.05	85.65	87.10
Univ [ 50 ]	86.32	87.23	84.34	86.20	89.22	90.15	85.24	85.87

Table 9: Comparison of performance (Acc

\uparrow

) on other image manipulation datasets. The best results are highlighted in red , and the second-best results are highlighted in blue .

Figure 6: An example of the annotation interface.

Figure 7: Optimal layer variation across random trials for KL divergence, LDR, information entropy, and saliency score under different sample scales.

Testing Subset	Addition		Removal		Replacement		Color Modification		Action Change		Background
Model/Metric	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$
$\heartsuit$ HifiNet [ 16 ]	53.88	35.86	49.30	40.46	52.52	42.05	53.30	44.17	55.87	56.68	49.89	35.76
$\heartsuit$ FakeShield [ 75 ]	55.24	40.28	54.34	46.91	49.86	44.58	56.76	50.00	59.86	62.75	50.79	39.89
$\clubsuit$ Univ [ 50 ]	54.40	39.33	50.56	44.41	46.22	42.34	54.80	48.37	57.98	61.17	49.89	38.95
$\clubsuit$ AIDE [ 78 ]	57.97	42.47	56.72	48.93	54.06	47.44	58.11	51.48	62.44	64.91	56.46	43.53
$\diamondsuit$ LLama3.2-Vision (11B) [ 47 ]	51.42	36.39	48.37	41.90	42.53	39.31	54.08	46.52	55.28	58.42	48.63	36.93

Table 11: Comparison results on different manipulation category subset.

\spadesuit

standard CNN/Transformer baselines,

\heartsuit

image manipulation detection methods,

\clubsuit

AI-generated image detection methods,

\diamondsuit

multimodal large language models. The fine-tuned results are marked with ✻ . The best results are highlighted in red , and the second-best results are highlighted in blue .

	IP2P [ 4 ]		CDS [ 48 ]		MagicBrush [ 86 ]		InfEdit [ 74 ]		MAG [ 46 ]		HQEdit [ 22 ]		PnP [ 25 ]
Model	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$	Acc $\uparrow$	F1 $\uparrow$
$\diamondsuit$ LLama3.2-Vision (11B) [ 47 ]	77.42	76.54	65.32	67.99	70.16	71.17	67.47	69.37	63.98	67.16	83.87	82.04	63.98	67.16
$\diamondsuit$ LLaVA-1.6 (7B) [ 36 ]	49.73	64.52	50.54	64.89	50.54	64.89	50.81	65.01	50.27	64.76	56.72	67.86	50.27	64.76
$\diamondsuit$ MiniCPM-V2.6 (8B) [ 83 ]	68.55	72.47	50.27	62.47	58.60	66.67	55.91	65.25	59.14	66.96	73.66	75.86	62.37	68.75
$\diamondsuit$ mPLUG-Owl3 (7B) [ 84 ]	62.90	61.67	52.69	55.78	55.91	57.51	53.76	56.35	56.18	57.66	67.47	64.72	52.69	55.78
$\diamondsuit$ CogVLM (17B) [ 68 ]	59.95	33.18	59.41	32.89	59.41	32.89	56.99	31.62	58.60	32.46	59.95	33.18	58.60	32.46

Table 12: Comparison results on different manipulation method subset.

\spadesuit

standard CNN/Transformer baselines,

\heartsuit

image manipulation detection methods,

\clubsuit

AI-generated image detection methods,

\diamondsuit

multimodal large language models. The fine-tuned results are marked with ✻ . The best results are highlighted in red , and the second-best results are highlighted in blue .

ResNet50 [ 17 ]	Testing Subset
Training Subset	SD1.4	SD1.5	SD3	SDXL	FLUX	DiT	FLUX-Kontext	NanoBanana	GPT-Image	SeedDream4	Avg
SD1.4	93.19	85.75	72.04	86.69	68.77	62.50	54.57	58.06	60.48	62.10	70.42
SD1.5	88.84	92.11	66.40	70.16	70.39	64.25	58.60	59.95	58.06	64.52	69.33
SD3	76.39	72.31	91.67	71.10	62.99	61.02	60.75	56.45	58.60	63.44	67.47
SDXL	77.24	68.28	60.22	92.47	63.98	63.31	56.99	58.60	59.41	60.48	66.10
FLUX	71.06	74.73	70.97	77.42	93.41	77.15	65.05	64.78	55.91	66.40	71.69

Table 13: Accuracy results (Acc

\uparrow

) of cross-validation on different training and testing subsets.

Method	GPU Memory	MACs(G)	Trainable Params(M)	Infer Time (s)
MVSSNet [ 8 ]	4GB	106.20	85.75	0.468
AIDE [ 78 ]	9GB	325.25	180.24	0.726
FakeShield [ 75 ]	42GB	5809.82	486.43	1.530
ManipShield	23GB	2980.08	122.26	0.825

Table 14: Cost analysis.

Figure 8: Example images generated by different manipulation models in ManipBench.

Figure 9: Example images generated by different manipulation models in ManipBench.

Figure 10: Example images generated by different manipulation models in ManipBench.

Figure 11: Feature distribution of images generated by different manipulation models.

Figure 12: Feature distribution of images generated by different manipulation models and real images.

Image Forgery Detection

Image Forgery Detection studies how to identify manipulated or synthetic images and locate the visual evidence of tampering.

See all 126 papers

Impostor: An Agent-Curated Benchmark for Realistic AIGC Manipulation Localization
Jun 3, 2026Zhenliang Li, Yutao Hu, Qixiong Wang +5Image Forgery Detection Digital Image Forensics
Southeast University · Xiaohongshu Inc · Xiaohongshu Inc. +1
DailyBench: A Unified Benchmark for AI-Generated and Manipulated Images from Modern Generative Models
Jul 27, 2026Xin Jiang, Hao Tang, Junyao Gao +6Image Forgery Detection AI-Generated Image Detection
State Key Laboratory of Communication Content Cognition, People’s Daily Online · Nanyang Technological University · Tongji University +2
FRAME: Forensic Routing and Adaptive Multi-path Evidence Fusion for Image Manipulation Detection
May 12, 2026Kaixiang Zhao, Tianrun Yu, Aoxu Zhang +3Image Forgery Detection Digital Image Forensics
1Brigham Young University · 2Rutgers University

Jun 3, 2026J/K move · Enter open · S save

Impostor: An Agent-Curated Benchmark for Realistic AIGC Manipulation Localization

Zhenliang Li, Yutao Hu, Qixiong Wang, Wenpeng Du+4

Southeast University · Xiaohongshu Inc · Xiaohongshu Inc.+1

Image Forgery Detection Digital Image Forensics Image Forgery Localization AI-Generated Image Detection

Open paper AskPDF arXiv

Recent advances in generative image editing have improved the realism and controllability of localized image manipulation, raising new challenges for image manipulation detection and localization (IMDL). However, existing IMDL benchmarks still have limitations in visual realism, manipulation diversity, and generator coverage, making it difficult to reflect recent trends in image manipulation. To address these limitations, we introduce Impostor, a high-quality AI-edited image manipulation localization dataset containing 100K manipulated images. Impostor is constructed by CraftAgent, a closed-loop agent framework that integrates scene perception, editing planning, manipulation execution, quality validation, and iterative reflection to automatically generate diverse and visually realistic manipulated images. Moreover, Impostor contains images generated by seven recent AIGC models across three manipulation types and includes multiple manipulated regions, providing a more comprehensive benchmark for AIGC-based IMDL. Furthermore, we propose PhaseAware-Net (PANet), a semantic-forensic framework that introduces local phase modeling and semantic-forensic consistency learning to better localize semantically plausible yet forensically disrupted manipulated regions. Extensive experiments show that Impostor poses significant challenges to existing large vision-language models (LVLMs) and specialized IMDL methods, while PANet achieves superior performance on Impostor and multiple public benchmarks.

Abstract

Image Forgery Detection

Explore similar work

Impostor: An Agent-Curated Benchmark for Realistic AIGC Manipulation Localization

DailyBench: A Unified Benchmark for AI-Generated and Manipulated Images from Modern Generative Models

FRAME: Forensic Routing and Adaptive Multi-path Evidence Fusion for Image Manipulation Detection