Generative AI has made text-guided inpainting a powerful image editing tool, but at the same time a growing challenge for media forensics. Existing benchmarks, including our text-guided inpainting forgery (TGIF) dataset, show that image forgery localization (IFL) methods can localize manipulations in spliced images but struggle not in fully regenerated (FR) images, while synthetic image detection (SID) methods can detect fully regenerated images but cannot perform localization. With new generative inpainting models emerging and the open problem of localization in FR images remaining, updated datasets and benchmarks are needed. We introduce TGIF2, an extended version of TGIF, that captures recent advances in text-guided inpainting and enables a deeper analysis of forensic robustness. TGIF2 augments the original dataset with edits generated by FLUX.1 models, as well as with random non-semantic masks. Using the TGIF2 dataset, we conduct a forensic evaluation spanning IFL and SID, including fine-tuning IFL methods on FR images and generative super-resolution attacks. Our experiments show that both IFL and SID methods degrade on FLUX.1 manipulations, highlighting limited generalization. Additionally, while fine-tuning improves localization on FR images, evaluation with random non-semantic masks reveals object bias. Furthermore, generative super-resolution significantly weakens forensic traces, demonstrating that common image enhancement operations can undermine current forensic pipelines. In summary, TGIF2 provides an updated dataset and benchmark, which enables new insights into the challenges posed by modern inpainting and AI-based image enhancements. TGIF2 is available at https://github.com/IDLabMedia/tgif-dataset.
Figures & tables
Figure 1: Examples of the two ways of inpainting. An (a) authentic image can be inpainted in a (b) selected region as mask, with skis as prompt. In the GenAI-based inpainting process (here using SDXL), (c) the full image is regenerated during editing. To minimize artifacts, (d) only the region corresponding to the mask can be spliced into the authentic image. (e) and (f) provide zoomed-in versions to more clearly show the differences between the original or spliced pixels, on the one hand, and the regenerated pixels outside of the masked area, on the other. Subtle differences due to the regenerative process can be observed in the teeth, sunglasses, beard, etc.
Table 1: Overview of datasets with generative inpainted images. SP = spliced, FR = fully regenerated.
Figure 2: Side-by-side comparison of (a) a real image of a cat with (b) the mask used for inpainting, and (c)-(h) 6 inpainted versions using 6 different inpainting models used in TGIF2, respectively. Note that other masks can be used as well (see Fig. 3 ).
Figure 3: The (a)-(c) three types of masks used and (d)-(f) three corresponding inpainted examples, respectively. All inpainted images used Fig. 2a as input image.
Inpainting Model
Semantic
Random
SP
FR
SP
FR
SD2
✓*
✓*
✓
✓
SDXL
-
✓*
-
✓
Adobe Firefly (PS)
✓*
-
-
-
FLUX.1 [schnell]
✓
✓
✓
✓
FLUX.1 [dev]
✓
✓
✓
✓
Table 2: Overview of TGIF2 dataset subsets grouped by inpainting model. Columns indicate whether spliced (SP), fully regenerated (FR), and Semantic or Random mask variants are included.
IFL Method
SD2
PS
FLUX.1
Average
[schnell]
[dev]
Fill [dev]
Sem
Rand
Sem
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
All
PSCC-Net Liu et al. (2022)
0.15
0.17
0.39
0.03
0.09
0.02
0.05
0.08
0.21
0.13
0.13
0.13
SPAN Hu et al. (2020)
0.00
0.00
0.00
0.00
0.00
0.0
0.00
0.00
0.01
0.00
0.00
0.00
ImageForensicsOSN Wu et al. (2022)
0.23
0.09
0.36
0.31
0.11
0.23
0.08
0.12
0.10
0.25
0.09
0.18
MVSS-Net++ Dong et al. (2022)
0.07
0.03
0.08
0.15
0.06
0.11
0.03
0.09
0.09
0.10
0.05
0.08
Table 3: Evaluation of image forgery localization methods on the spliced (SP) subsets of our TGIF2 dataset, for both the semantic (Sem) and random (Rand) versions (F1 score). F1 scores above 0.7 are highlighted in bold.
IFL Method
SD2
SDXL
FLUX.1
Average
[schnell]
[dev]
Fill [dev]
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
All
PSCC-Net Liu et al. (2022)
0.05
0.04
0.05
0.09
0.02
0.02
0.02
0.02
0.03
0.05
0.03
0.04
0.04
SPAN Hu et al. (2020)
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
ImageForensicsOSN Wu et al. (2022)
0.20
0.09
0.18
0.09
0.30
0.08
0.23
0.07
0.09
0.05
0.20
0.08
0.13
MVSS-Net++ Dong et al. (2022)
0.06
0.03
0.09
0.05
0.15
0.03
0.12
0.03
0.07
0.04
0.10
0.04
0.07
Table 4: Evaluation of image forgery localization methods on the fully regenerated (FR) subsets of our TGIF2 dataset, for both the semantic (sem) and random (rand) versions (F1 score). The last rows show the IFL methods fine-tuned on the FR subsets. F1 scores above 0.7 are highlighted in bold.
IFL Method
Fine-tune set
SD2
SDXL
FLUX.1
Average
[schnell]
[dev]
Fill [dev]
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
All
TruFor
All
Sem+Rand
0.49
0.39
0.68
0.83
0.87
0.94
0.82
0.88
0.76
0.85
0.72
0.78
0.75
Sem
0.50
0.23
0.61
0.62
0.80
0.62
0.69
0.46
0.65
0.59
0.55
0.76
0.65
Rand
0.31
0.40
0.50
0.80
0.69
0.92
0.62
0.85
0.63
0.82
0.55
0.76
0.58
SD2
Sem
0.49
0.22
0.29
0.17
0.40
0.16
0.31
0.08
0.21
0.10
0.34
0.14
0.24
Table 5: Evaluation of individually fine-tuned image forgery localization methods on the fully regenerated (FR) subsets of our TGIF2 dataset, for both the semantic (Sem) and random (Rand) versions (F1 score). F1 scores above 0.7 are highlighted in a bold font. We notice that in-domain (i.e., same generative method) performance is relatively good, but generalization to out-of-domain (i.e., different generative method) performance is bad. Interestingly, when fine-tuning on only Sem masks, the evaluation on Rand subsets is lower than the corresponding Sem subsets, suggesting a potentially introduced bias towards semantics.
Figure 4: An example of a fully regenerated inpainted image with SD2, using a bounding box of the tennis racket as mask (a, SD2 Sem), or a random mask in the image (d, SD2 Rand), along with the corresponding ground-truth masks (b, e) and the fine-tuned TruFor detection results (c, f). The fine-tuned TruFor was trained on the SD2-FR-Sem training set. The inpainted tennis racket in the SD2-FR-Sem test image is detected relatively well by the fine-tuned model. However, the inpainted random box of the SD2-FR-Rand subset is not detected; instead, the tennis racket is wrongly detected – suggesting that the fine-tuned model is be biased towards semantics or salient objects. Note that the inpainted random box, in fact, made notable changes to the sign in the background, and hence should be detectable by a better detection model.
Metric Class
Metric
SD2
PS
SDXL
FLUX.1
[schnell]
[dev]
Fill [dev]
Aesthetic Quality
NIMA mean ↑
5.05
5.16
4.88
5.16
5.28
5.21
GIQA ↑
-399
-373
-423
-383
-371
-424
Image-Text Matching
ITM ↑
0.28
0.32
0.26
0.31
0.30
0.25
cos ↑
0.37
0.38
0.34
0.38
0.38
0.36
Preservation Fidelity (FR only)
PSNR ↑
27.1
N/A
18.1
32.5
32.5
28.5
Table 6: Average generative quality per (semantic) subset. In addition, the average detection performance is given as well (same as in Table 4 ). For each metric, we highlight the best performing subset in a bold font, and the worst performing subset in an italic font.
IFL Method
Version
Subsets
Aesthetic Quality
ITM
Preservation Fidelity
NIMA
GIQA
ITM
cos
PSNR
SSIM
LPIPS
TruFor
original
SP
0.36
0.42
-0.31
0.07
N/A
N/A
N/A
MMFusion
original
SP
0.30
0.39
-0.29
0.11
N/A
N/A
N/A
TruFor
fine-tuned
FR
0.28
0.34
-0.03
0.23
0.24
0.28
-0.32
MMFusion
fine-tuned
FR
0.28
0.35
-0.02
0.24
0.24
0.28
-0.32
Table 7: Spearman’s correlation and corresponding p-value between the IFL performance (F1 score), on the one hand, and the generative quality metrics, on the other. All correlation values are relatively low, with p-values equal to 0.000.
SID Method
Trained on
SD2
SDXL
FLUX.1
Average
[schnell]
[dev]
Fill [dev]
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
All
CNNDetect Wang et al. (2020)
ProGAN
0.57
0.48
0.61
0.62
0.50
0.47
0.49
0.50
0.62
0.62
0.56
0.54
0.55
Dire Wang et al. (2023b)
ADM
0.49
0.52
0.62
0.64
0.49
0.54
0.48
0.52
0.48
0.49
0.51
0.54
0.53
FreqDetect Frank et al. (2020)
GANs
0.50
0.42
0.40
0.41
0.39
0.36
0.37
0.38
0.39
0.34
0.41
0.38
0.40
Fusing Ju et al. (2022)
ProGAN
0.55
0.48
0.47
0.47
0.55
0.53
0.55
0.56
0.62
0.62
0.55
0.53
0.54
Table 8: Evaluation of synthetic image detection methods on the semantic subsets of our TGIF2 Dataset (AUC Score). AUC scores above 0.8 are highlighted in a bold font.
IFL Method
Original
Super-resolution method
Cubic interpolation
Real-ESRGAN
x2
x4
x2
x4
CAT-Net Kwon et al. (2022)
0.87
0.76 -0.11
0.73 -0.14
0.06 -0.81
0.07 -0.80
TruFor Guillaro et al. (2023)
0.78
0.76 -0.02
0.76 -0.02
0.21 -0.57
0.22 -0.56
MMFusion Triaridis and Mezaris (2024)
0.69
0.65 -0.04
0.64 -0.05
0.18 -0.51
0.51 -0.51
Table 9: Evaluation of super-resolution attack on image forgery localization methods on spliced images of our TGIF2 Dataset, alongside a cubic interpolation attack as baseline (F1 score, along with the Δ F1 Score).
SID Method
Trained on
Original
Super-resolution method
Cubic interpolation
Real-ESRGAN
x2
x4
x2
x4
DIMD Corvi et al. (2023)
LDM
0.88
0.87 –0.01
0.87 –0.01
0.75 –0.13
0.80 –0.08
UnivFD Ojha et al. (2023)
ProGAN
0.70
0.70 +0.00
0.69 –0.01
0.68 –0.02
0.68 –0.02
GramNet Liu et al. (2020)
GANs
0.76
0.76 +0.00
0.75 –0.01
0.50 –0.26
0.50 –0.26
LGrad Tan et al. (2023)
ProGAN
0.85
0.85 +0.00
0.84 –0.01
0.49 –0.36
0.48 –0.37
Table 10: Evaluation of super-resolution attack on synthetic image detection methods on fully regenerated images in our TGIF2 dataset, alongside a cubic interpolation attack as baseline (AUC Score, along with the Δ AUC score).
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
IFL Method
SD2
PS
FLUX.1
Average
[schnell]
[dev]
Fill [dev]
Sem
Rand
Sem
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
All
PSCC-Net Liu et al. (2022)
0.12
0.13
0.31
0.02
0.06
0.01
0.03
0.06
0.17
0.10
0.10
0.10
SPAN Hu et al. (2020)
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.01
0.00
0.00
0.00
ImageForensicsOSN Wu et al. (2022)
0.16
0.05
0.25
0.22
0.07
0.16
0.04
0.08
0.07
0.18
0.06
0.12
MVSS-Net++ Dong et al. (2022)
0.05
0.02
0.05
0.11
0.04
0.08
0.02
0.06
0.07
0.07
0.04
0.06
Appendix
Table 11: Evaluation of image forgery localization methods on the spliced (SP) subsets of our TGIF2 dataset, for both the semantic (sem) and random (rand) versions ( IoU ). IoU values above 0.6 are highlighted in a bold font. Just as in Table 3 , some IFL methods (i.e., CAT-Net, TruFor & MMFusion) perform well on SP subsets.
IFL Method
SD2
SDXL
FLUX.1
Average
[schnell]
[dev]
Fill [dev]
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
All
PSCC-Net Liu et al. (2022)
0.03
0.02
0.03
0.05
0.01
0.01
0.01
0.01
0.02
0.03
0.02
0.03
0.02
SPAN Hu et al. (2020)
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
ImageForensicsOSN Wu et al. (2022)
0.14
0.05
0.12
0.05
0.22
0.05
0.16
0.04
0.06
0.03
0.14
0.04
0.09
MVSS-Net++ Dong et al. (2022)
0.04
0.02
0.06
0.03
0.11
0.02
0.09
0.02
0.05
0.03
0.07
0.02
0.05
Appendix
Table 12: Evaluation of image forgery localization methods on the fully regenerated (FR) subsets of our TGIF2 dataset, for both the semantic (sem) and random (rand) versions ( IoU ). The last rows show the IFL methods fine-tuned on All FR Sem subsets. Just as in Table 4 , the performance is low for all original IFL methods on FR subsets, while it is significantly higher for the fine-tuned variants.
IFL Method
Fine-tune set
SD2
SDXL
FLUX.1
Average
[schnell]
[dev]
Fill [dev]
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
Sem
Rand
All
TruFor
All
Sem+Rand
0.37
0.28
0.58
0.75
0.80
0.90
0.74
0.82
0.67
0.78
0.63
0.71
0.67
Sem
0.21
0.29
0.41
0.71
0.60
0.87
0.53
0.78
0.53
0.74
0.55
0.41
0.48
Rand
0.38
0.15
0.50
0.52
0.71
0.52
0.59
0.37
0.55
0.50
0.46
0.68
0.57
SD2
Sem
0.38
0.14
0.20
0.11
0.29
0.11
0.22
0.05
0.15
0.06
0.25
0.09
0.17
Appendix
Table 13: Evaluation of individually fine-tuned image forgery localization methods on the fully regenerated (FR) subsets of our TGIF2 dataset, for both the semantic (sem) and random (rand) versions ( IoU ). IoU values above 0.6 are highlighted in a bold font. Just as in Table 5 , we notice good in-domain performance but bad out-of-domain generalization, as well as a potential bias towards semantics.
AI-assisted image editing threatens trust in financial, legal, and identity records. The GenText-Forensics Challenge at ACM MM 2026 addresses this by requiring structured forensic reports, in which integrating detection, pixel-level localization, and natural language explanation for multilingual text-centric forgery images. We present SEED, a modular system with three components. First, a similarity-guided pipeline augments training with diverse synthetic forgeries. Second, a single ViT, built on DINOv3 with LoRA adaptation, jointly performs detection and pixel-level localization while preserving pre-trained priors with minimal trainable parameters. Third, an evolving harness takes the detector's predictions and generates a complete forensic report via an MLLM, iteratively improved through a proposer-evaluator loop optimizing report quality. SEED ranked 3rd in the GenText-Forensics Challenge. Code and data are available at https://github.com/KahimWong/GenText-Forensics-3rd-Place.
Kahim Wong, Kemou Li, Yiming Chen +2
State Key Laboratory of Internet of Things for Smart City, Department of Computer and Information Science, University of Macau · School of Information and Software Engineering, University of Electronic Science and Technology of China
As AI-assisted image editing becomes increasingly prevalent, Text-Centric Image Forgery Localization (TFL) is essential for protecting trust in financial and legal records. However, we observe that existing TFL detectors predominantly rely on Full-Parameter Fine-Tuning (FPFT) and fail to generalize to unseen forgery types because FPFT can induce low-rank feature collapse and overfit training artifacts. Meanwhile, prior detectors capture diverse forgery traces with a single unified representation, making subtle traces entangled and difficult to learn. To address these challenges, we propose RiSE, a Residual Subspace Expert model that preserves pre-trained priors by freezing principal SVD components and adapting only the residual subspaces with a ViT-only segmentor to avoid feature collapse. RiSE introduces forgery-aware residual experts, where each expert is trained independently on a training subset with a particular forgery type, and we show that cross-domain localization performance improves consistently as more experts are added. At inference, we introduce Latent Perturbation Confidence (LPC), which selects the most confident expert by analytically computing the latent-perturbed output. LPC enables efficient confidence estimation with a single forward pass, avoiding repeated forward passes on perturbed samples and improving expert selection. By training on synthetic forgery data, RiSE with 1 expert outperforms prior methods on real-world forgery images by 20.4% while reducing training steps by 10 times. Scaling the number of experts to 9 yields a 35.8% gain. RiSE remains effective with DCT feature, even when the majority of the parameters is frozen with RGB-only pretraining. Code: https://github.com/KahimWong/RiSE.
Kahim Wong, Kemou Li, Yiming Chen +2
State Key Laboratory of Internet of Things for Smart City, University of Macau · School of Information and Software Engineering, University of Electronic Science and Technology of China
Diffusion-based inpainting models modify only a localized part of an image, while many AI-image detectors rely on global artifacts and do not localize. These artifacts vary across generators, limiting detector transfer under distribution shifts. Recent work shows that restoring the authentic pixels outside the inpainted region removes these cues and can degrade pretrained detectors. To address this, we present FUSED, a unified framework for the joint detection and localization of AI-generated inpainting. FUSED combines low-level forensic cues with high-level semantic features using a sparsely-gated Mixture-of-Experts architecture, enabling the model to adaptively prioritize the most relevant signal for each token. For each input, FUSED predicts both an image-level manipulation score and a pixel-level mask of the inpainted area. On the OpenSDID cross-generator benchmark, FUSED achieves the best average detection and localization, with the largest gains on unseen generators. The same model transfers directly to the held-out AutoSplice and CocoGlide benchmarks, more than doubling localization performance. Evaluating each held-out benchmark with and without the global generator artifact further shows that all evaluated methods, ours included, partly read the artifact as evidence of manipulation, and FUSED remains the strongest under both conditions. Code and pretrained models are available at https://github.com/AntonNuzhdin/FUSED.
Anton Nuzhdin, Marcel Worring, Ivona Najdenkoska
Informatics Institute, University of Amsterdam Amsterdam, The Netherlands