The rapid democratization of prompt-based AI image editing has recently exacerbated the risks associated with malicious content fabrication and misinformation. However, forgery localization methods targeting these emerging editing techniques remain significantly under-explored. To bridge this gap, we first introduce a fully automated mask annotating framework that leverages keypoint alignment and semantic space similarity to generate precise ground-truth masks for edited regions. Based on this framework, we construct PromptForge-350k, a large-scale forgery localization dataset covering four state-of-the-art prompt-based AI image editing models, thereby mitigating the data scarcity in this domain. Furthermore, we propose ICL-Net, an effective forgery localization network featuring a triple-stream backbone and intra-image contrastive learning. This design enables the model to capture highly robust and generalizable forensic features. Extensive experiments demonstrate that our method achieves an IoU of 62.5% on PromptForge-350k, outperforming SOTA methods by 5.1%. Additionally, it exhibits strong robustness against common degradations with an IoU drop of less than 1%, and shows promising generalization capabilities on unseen editing models, achieving an average IoU of 41.5%.
Figures & tables
Figure 1: Overview of our work: (1) A fully automated mask annotating framework targeting prompt-based AI image editing. (2) PromptForge-350k, a comprehensive forgery localization dataset. (3) ICL-Net, an effective forgery localization network.
Figure 2: Pipeline of Pixel-Level Alignment: The process involves keypoint extraction and matching, followed by affine matrix estimation. Finally, we apply a coordinate transformation, and the black borders are cropped out.
Figure 3: Pipeline of Semantic-Based Mask Annotation. We first utilize DINO v3 to extract semantic features, followed by calculating the pixel-wise feature similarity. Finally, the similarity map is binarized to output the edited region mask.
Figure 4: Statistics of the proposed dataset. Left: Distribution of editing task categories. Right: Time consumption breakdown of each operation during the dataset construction process.
Figure 5: Architecture of the proposed forgery localization network, ICL-Net. The network features three parallel backbones and is optimized via intra-image contrastive loss and segmentation loss.
Metric
Method
Subset of PromptForge-350K
Nano.
BAGEL
Kontext
Step1x
Average
F1
MVSS-Net
31.81
44.19
54.26
52.61
45.72
TruFor
45.30
54.58
70.26
61.50
58.61
FOCAL
5 9.28
55.49
8 1.11
71.09
6 6.74
Mesorch
50.18
53.18
74.91
66.12
61.10
NFA-ViT
54.84
6 1.76
77.19
7 2.30
66.52
Table 1: Performance comparison between ICL-Net and SOTA methods. Our method achieves the best performance on all four subsets. The best and second-best results are highlighted in bold and underlined, respectively.
Figure 6: Subjective evaluation results of ICL-Net. The third row highlights the predicted forged regions in red, the ground-truth edited regions in green, and the overlap between predictions and ground truth in yellow.
Perturbation
Factor
F1
IoU
Precision
Recall
ICL-Net (baseline)
None
75.20
62.45
76.94
74.13
ICL-Net w/ JPEG Compression
90
74.83
61.92
74.74
75.68
80
74.45
61.37
74.89
74.60
70
73.49
60.23
75.26
72.29
60
72.24
58.82
75.73
69.58
ICL-Net w/ Random Crop
10%
76.82
64.17
77.48
76.60
Table 2: Robustness analysis. We evaluate ICL-Net under varying degrees of JPEG compression and random cropping.
Subset
Setting
F1
IoU
Precision
Recall
In-domain
65.75
51.43
69.27
63.50
Nano-Banana
Out-of-domain
31.07
18.95
35.25
29.49
In-domain
70.15
55.18
73.77
67.30
BAGEL
Out-of-domain
51.07
36.39
64.67
43.63
In-domain
84.26
74.23
83.27
85.71
Kontext
Out-of-domain
68.44
53.53
75.10
63.93
Table 3: Cross-model generalization performance. We exclude one subset from the training set and evaluate the network’s ability to generalize to unseen editing methods.
Operation
F1
IoU
Precision
Recall
ICL-Net (baseline)
75.20
62.45
76.94
74.13
ICL-Net w/o contrastive loss
59.63
45.07
60.45
59.55
ICL-Net w/o noise backbone
73.21
59.84
71.57
75.43
ICL-Net w/o frozen backbone
70.44
56.95
75.61
66.81
Table 4: Ablation study: removing the contrastive loss, noise backbone, or the frozen backbone each leads to a noticeable drop in localization performance.
Recent advancements in generative AI have led to image editing models capable of producing realistic forgeries that evade traditional image forgery localization methods, as these approaches depend on physical noise absent in synthetic data. To address this challenge, we theoretically demonstrate that the diffusion process inherently suppresses local high-frequency variance, creating a statistical energy gap that is distinguishable from the natural entropy of optical imaging. Guided by this insight, we propose FLAME, a unified framework that utilizes a LAD map to capture these intrinsic anomalies, coupled with a parameter-efficient adapter for SAM to achieve precise, pixel-level forgery localization. Furthermore, to bridge the lag between forensic benchmarks and evolving generative models, we introduce EditStream, an automated pipeline for continuous, instruction-based training data synthesis. Extensive experiments demonstrate that FLAME establishes a new state-of-the-art, significantly outperforming previous methods on AI-generated forgery datasets while effectively generalizing to unseen generative architectures. Our code is available at https://github.com/phoenixnir/FLAME.
Image forgery localization remains challenging due to diverse manipulation techniques and distribution shifts. Existing forgery localization models achieve high accuracy on benchmarks but often struggle with cross-domain generalization and robustness. In this paper, we propose SARIF (Segment Anything for Robust Image Forensics), a framework that leverages the Segment Anything Model (SAM), which has a promptable architecture and strong generalization ability. SARIF introduces a feedback-guided mask decoder and a dual-encoder design that extracts forgery-specific information to capture forensic traces while exploiting the SAM architecture. To localize manipulated regions, we design a block-wise prompting mechanism that derives forgery-specific cues from residual features between an adapted encoder and its frozen counterpart. These features are fused with the previous mask prompt to drive a feedback-based mask refinement process, enabling automatic forgery segmentation without manual input. Extensive experiments on standard forgery-localization benchmarks show that SARIF achieves strong average cross-dataset performance and robustness to common image corruptions.
Dong-Hyun Moon, Ju-Hyeon Nam, Sang-Chul Lee
Department of Electrical and Computer Engineering, Inha University, 100 Inha-ro, Michuhol-gu, Incheon, 22212, Republic of Korea
The proliferation of highly realistic AI-generated images poses critical challenges for digital forensics, demanding precise pixel-level localization of manipulated regions. Existing methods predominantly learn discriminative patterns of specific forgeries and often struggle with novel manipulations as editing techniques continue to evolve. We propose the Iterative Forgery Amplifier Network (IFA-Net), which shifts from learning "what is fake" to modeling "what is real". Grounded in the principle that all manipulations deviate from the natural image manifold, IFA-Net leverages a frozen Masked Autoencoder (MAE) pretrained on real images as a universal realness prior. Our framework operates through a two-stage closed-loop process: an initial Dual-Stream Segmentation Network (DSSN) fuses the original image with MAE reconstruction residuals for coarse localization, followed by a Task-Adaptive Prior Injection (TAPI) module that converts this coarse prediction into guiding prompts to steer the MAE decoder and amplify reconstruction failures in suspicious regions for precise refinement. Extensive experiments on four diffusion-based inpainting benchmarks show that IFA-Net achieves an average improvement of 6.5% in IoU and 8.1% in F1-score over the second-best method, while demonstrating strong generalization to traditional manipulation types.