MAD-Guard: Controlled Study of Autoregressive Generation versus Direct Decision Interfaces for Closed Multimodal Forensic Tasks

Hao Chen

cs.CVSep 27, 2026

MAD-Guard: Controlled Study of Autoregressive Generation versus Direct Decision Interfaces for Closed Multimodal Forensic Tasks

Authors: Hao Chen

Organizations: School of Cyber Security, Guangdong Polytechnic Normal University, Guangzhou, China

Abstract

When should multimodal foundation models generate tokens, and when should they directly output a decision? We present MAD-Guard, a controlled study of output-decision interfaces for closed multimodal forensic tasks. Once a multimodal representation is computed, is autoregressive generation necessary for closed forensic decisions with high input complexity but low output entropy? Under a matched Qwen3-VL-8B backbone, 2,400 FakeClue training samples, and LoRA budget ( $r=16, α=32$ ) on Huawei Ascend 910C NPUs, we evaluate a progression of decision interfaces (AR-SFT [generate] $\to$ Logit Slice $\to$ Binary Direct Head $\to$ +choice $\to$ +act $\to$ CLM-Head) and decompose latency into backbone representation (53.12 ms), 151,643-way vocabulary projection (+85.04 ms $\to$ 138.16 ms), and decoding (+248.26 ms $\to$ 386.42 ms). Under 1-to-1 binary supervision ( $\mathcal{L}_{\mathrm{BCE}}$ ), a Binary Direct Head cuts latency by $2.60\times$ - $7.27\times$ (53.12 ms) and lowers calibration error by $1.88\times$ (ECE = 0.0450 vs. 0.0845), with a -1.80% accuracy trade-off (93.10% vs. 94.90%; 0.9795 vs. 0.9871 ROC-AUC) from forfeiting token priors. Gains above AR-SFT arise either from multi-task attribution and uncertainty gating (+choice+act: 96.44% accuracy, 0.9940 ROC-AUC, 0.0187 ECE at 53.71 ms) or from a disaggregated contrastive head (CLM-Head: 96.55% binary and 96.44% multi-task accuracy, 0.0166 ECE, 98.79% 7-class attribution at 54.42 ms) retaining semantic priors without token decoding. Across 5,000 out-of-sample images from five benchmarks, our framework excels on synthetic, camouflage, and document forgeries (96.44% GenImage, 97.73% Chameleon, 91.84% Doc) while showing a clear boundary on compressed face manipulation (FF++ ROC-AUC = 0.5913).

Figures & tables

Fig. 1: Single-image inference latency versus accuracy on GenImage (NeurIPS 2023) under matched Qwen3-VL-8B conditions on Huawei Ascend 910C: 1-to-1 Binary Direct Head Only (53.12 ms, 93.10%, 0.0450 ECE) and multi-task MAD-Guard (+choice+act, 53.71 ms, 96.44%, 0.0187 ECE) vs. Supervised AR-SFT (138.16 ms logit slice / 386.42 ms generate() , 94.90%, 0.0845 ECE).

Study / Framework	Forensic Perception	Forensic Reasoning	Direct Decision Study	Calibration (ECE)	Latency Decomp.
M2F2-Det [ 25 ] / PRPO [ 26 ]	Vision-Lang. Adapter	Paragraph / Policy Gen.	Hybrid Head + Gen.	No	No
Deep-VRM [ 27 ] ( arXiv’26 )	Residual Signal Inj.	Generative CoT / Text	No (AR Decoding)	No	No
ARA [ 24 ] ( arXiv’26 )	Anchor-Reg. DINOv3	No (Vision-Only)	Frozen Linear Anchor	No	No
FakeVLM-R1 [ 28 ] / VIGIL [ 29 ] ( arXiv’26 )	MLLM Visual Encoder	GRPO / Part-Grounded CoT	No (Multi-Token CoT)	No	No
ForeAgent [ 30 ] / EFR [ 31 ] ( arXiv’26 )	Multi-Modal Grounding	Iterative Agent / Evidence	No (Multi-Turn AR)	No	No
MAD-Guard (Ours)	Matched Qwen3-VL	Prompt Conditioning	Controlled 6-Step Prog.	Yes ( $1.88\text{--}5.09\times$ )	Yes (3-Tax Split)

TABLE I: Positioning of MAD-Guard Relative to Recent Multimodal Forensic Paradigms and Preprints.

Fig. 2: Overall pipeline of MAD-Guard for controlled output-decision evaluation: (a) Multimodal forensic input combining query image $I$ (dynamic resolution capping $\leq 512^{2}$ ) and forensic instruction prompt $T$ ; (b) Matched causal multimodal backbone (Qwen3-VL-8B) with LoRA adapters ( $r=16,\alpha=32$ ), gradient checkpointing, and terminal token pooling; (c) Direct decision interfaces comparing primary scalar authenticity scoring ( noul_head ), auxiliary 7-class attribution ( choice_head ) and uncertainty-gated action ( act_head ), and a CLM-inspired disaggregated contrastive decision head ( CLM-Head ) against autoregressive generation on Huawei Ascend 910C.

Decision Interface (Ascend 910C)	Supervision Protocol	Acc.	ROC-AUC	ECE ∗	Backbone+Proj.	Decode Tax	Total Latency
Zero-Shot Constrained AR ( $1$ – $4$ tok)	None (Pretrained Base)	63.09%	0.8511	0.1824	138.12 ms	114.22 ms	252.34 ms
Supervised AR-SFT ( generate , $K=1$ )	Binary Token CE	94.90%	0.9871	0.0845	138.16 ms	248.26 ms	386.42 ms
Supervised AR-SFT (Direct Logit Slice)	Binary Token CE	94.90%	0.9871	0.0845	138.16 ms	0.00 ms	138.16 ms
Binary Direct Head Only ( noul_head )	Binary BCE Only (1-to-1 Match)	93.10%	0.9795	0.0450	53.12 ms	0.00 ms	53.12 ms
Direct Head + Attribution ( +choice_head )	BCE + 7-Class CE	95.20%	0.9892	0.0280	53.45 ms	0.00 ms	53.45 ms
MAD-Guard Full ( +choice +act , Ours)	BCE + Choice + Act CE	96.44%	0.9940	0.0187	53.71 ms	0.00 ms	53.71 ms

TABLE II: Controlled Progression of Output-Decision Interfaces under Identical Qwen3-VL-8B Backbone, Data (

N=2{,}400

), LoRA Budget (

r=16,\alpha=32

), and Ascend 910C Hardware on GenImage (

N=1{,}940

Method	Paradigm	Acc.	ROC-AUC	Latency	Hardware / Source
CNNDetection [ 36 ]	ResNet-50 (CVPR’20)	74.20%	0.8130	45.0 ms	V100 GPU / Reported
UnivFD [ 21 ]	Frozen CLIP (CVPR’23)	86.20%	0.9240	58.0 ms	A100 GPU / Reported
DIRE [ 14 ]	Diffusion Inv. (ICCV’23)	88.40%	0.9410	1,450 ms	A100 GPU / Reported
NPR [ 12 ]	Upsampling (CVPR’24)	91.50%	0.9580	52.0 ms	A100 GPU / Reported
DRCT [ 15 ]	Contrastive (ICLR’24)	93.20%	0.9710	82.0 ms	A100 GPU / Reported
D 3 [ 23 ]	Discrepancy (CVPR’25)	94.60%	0.9820	65.0 ms	A100 GPU / Reported

TABLE III: Cross-Method Comparison on GenImage (NeurIPS 2023) with Explicit Hardware & Source Attribution.

Benchmark	Model / Decision Inference Protocol	Sample Count ( $N_{\text{real}}/N_{\text{fake}}$ )	Accuracy	Precision	Recall	F1-Score	ROC-AUC	Mean Latency
GenImage [ 6 ]	Qwen3-VL-8B (Zero-Shot Constrained AR, 1–4 tokens)	1,940 (1024 / 916)	63.09%	93.10%	23.58%	37.63%	0.8511	252.34 ms
GenImage [ 6 ]	MAD-Guard (Direct-Head Inference, Ours)	1,940 (1024 / 916)	96.44%	94.35%	98.36%	96.31%	0.9940	52.84 ms
Chameleon [ 37 ]	Qwen3-VL-8B (Zero-Shot Constrained AR, 1–4 tokens)	441 (0 / 441)	53.97%	– †	53.97%	– †	– †	485.85 ms
Chameleon [ 37 ]	MAD-Guard (Direct-Head Inference, Ours)	441 (0 / 441)	97.73%	– †	97.73%	– †	– †	51.12 ms
Doc	Qwen3-VL-8B (Zero-Shot Constrained AR, 1–4 tokens)	576 (116 / 460)	69.27%	99.30%	61.96%	76.31%	0.9835	1,041.45 ms
Doc	MAD-Guard (Direct-Head Inference, Ours)	576 (116 / 460)	91.84%	98.14%	91.52%	94.71%	0.9746	54.30 ms

TABLE IV: Cross-Benchmark Evaluation across 5,000 Out-of-Sample Images on Huawei Ascend 910C.

Model / Input Configuration	Nominal Acc	Balanced Acc	FPR	FNR	ROC-AUC
Xception [ 4 ] (ICCV’19)	89.30%	88.75%	9.40%	13.10%	0.9220
F3-Net [ 5 ] (ECCV’20)	90.43%	89.90%	8.20%	12.00%	0.9330
AltFreezing [ 17 ] (CVPR’23)	93.40%	92.80%	6.20%	7.80%	0.9650
UCF [ 16 ] (ICCV’23)	94.10%	93.50%	5.80%	7.10%	0.9710
M2F2-Det [ 25 ] (CVPR’25)	92.80%	92.10%	7.10%	8.50%	0.9590
LLaVA-1.5-7B (Zero-Shot) [ 3 ]	42.30%	51.10%	53.81%	43.99%	0.5120

TABLE V: Capability Boundary Analysis on FaceForensics++ (c23,

N=1{,}168

: 236 Real, 932 Fake).

Fig. 3: Empirical capability dichotomy across five forensic domains (plotting default $\theta=0.50$ nominal accuracy). MAD-Guard excels on modern diffusion, camouflage, and document tampering, whereas specialized CNNs dominate compressed FF++ video face swaps.

Perturbation Operation	CNNDetect [ 36 ]	DIRE [ 14 ]	AR-SFT	MAD-Guard (Ours)
Uncompressed Baseline	74.20%	88.40%	94.90%	96.44%
JPEG Compression ( $\text{QF}=90$ )	66.85% ( $\downarrow 7.35$ )	84.10% ( $\downarrow 4.30$ )	93.52% ( $\downarrow 1.38$ )	95.82% ( $\downarrow 0.62$ )
JPEG Compression ( $\text{QF}=80$ )	59.40% ( $\downarrow 14.80$ )	80.35% ( $\downarrow 8.05$ )	91.80% ( $\downarrow 3.10$ )	94.18% ( $\downarrow 2.26$ )
JPEG Compression ( $\text{QF}=70$ )	53.15% ( $\downarrow 21.05$ )	75.80% ( $\downarrow 12.60$ )	89.45% ( $\downarrow 5.45$ )	91.75% ( $\downarrow 4.69$ )
JPEG Compression ( $\text{QF}=50$ )	48.70% ( $\downarrow 25.50$ )	71.20% ( $\downarrow 17.20$ )	84.60% ( $\downarrow 10.30$ )	87.32% ( $\downarrow 9.12$ )
Scale Up (+20%)	70.30% ( $\downarrow 3.90$ )	86.90% ( $\downarrow 1.50$ )	94.20% ( $\downarrow 0.70$ )	95.88% ( $\downarrow 0.56$ )

TABLE VI: Robustness Evaluation under Common Post-Processing Operations on GenImage (

N=1{,}940

(a) Gateway SLA & Serving Efficiency Comparison
Metric / System Property	AR (Explain)	AR (Label)	DIRE	Spec. CNN	MAD-Guard (Ours)
Mean Latency / P95	$8.5\sim 18$ s / $>20$ s	378.1 / 642.5 ms	1450 / 1820 ms	$30\sim 60$ / $\sim 70$ ms	53.71 / 58.12 ms
Throughput (Single-Card)	$<0.1$ QPS	$\sim 2.64$ QPS	$\sim 0.69$ QPS	$\sim 20$ QPS	18.62 / 45.87 ‡ QPS
Output Structure	Free Text	Discrete Token	Scalar Error	Discrete Class	Calibrated Prob.+Action
Calibration Error (ECE)	Undefined	0.3693	$\sim 0.082$	$\sim 0.065$	0.0166–0.0187
GenImage Acc. / SLO	71.20% / Viol.	63.09% / Viol.	88.40% / Viol.	74.20% / Sat.	96.44–96.55% / Sat.

TABLE VII: Production Serving Efficiency and Data Scaling Behavior on Huawei Ascend 910C.

Explore similar work

Jul 28, 2026cs.CV

LaP-Forensics: Latent-Pixel Consistency Guided Multimodal Reasoning for Deepfake Detection

Recent generative models can produce images with few obvious visual artifacts, weakening detectors and explanations that rely only on surface appearance. We present LaP-Forensics, a multimodal framework that augments RGB semantics with reconstruction-based forensic evidence. A frozen Stable Diffusion DDIM inversion-reconstruction model provides a fixed reconstruction reference, and its residual map measures local compatibility with that reference. Independent projectors encode the RGB image and residual map before a structured Where-What-Why model predicts a textual analysis and an artifact mask.Supervised fine-tuning is followed by Group Relative Policy Optimization (GRPO), whose reward combines mask overlap with output-structure and evidence-reference terms. These text-side terms encourage the model to refer to the consistency map but do not constitute a verifier of free-form textual truth. A separate image-level head fuses RGB and DDIM-residual class features. Experiments show cross-generator detection on UniversalFakeDetect and competitive artifact localization on the official SynthScars benchmark. Controlled cue-construction, inversion-horizon, component, reward-term, and counterfactual analyses support the utility of the residual stream under the evaluated settings, while free-form textual faithfulness and reliability under post-processing remain open limitations.

Can Wang, Yuhao Wang, Yushe Cao +2

The Hong Kong Polytechnic University · University College London · Tsinghua University +2

Deepfake Detection Digital Forensics Generative Models Multimodal Reasoning Red-Green-Blue

Ask PDF

Mar 20, 2025cs.CV

FORGE: Forensic Reasoning with Grounded Evidence

Forensic deepfake analysis demands more than binary classification: investigators need region-grounded natural language explanations they can verify against the image. Multimodal large language models (MLLMs) are a natural fit, but pretrained MLLMs fail systematically, producing globally coherent text that misses the small localized cues defining manipulations. We argue this is an inductive bias problem rather than a capacity issue: the image-text contrastive objective training MLLM visual encoders optimizes for whole-image semantic summaries, not patch-level forensic detail. The same mismatch explains why prior deepfake reasoning methods target either face manipulation or fully AI-generated content, never both. We propose FORGE, which addresses the mismatch by routing a second visual stream into the language model from a Vision-Only Model (VOM) trained on dense patch prediction rather than image-text alignment. The MLLM's native encoder and the VOM operate on a shared patch grid, which lets us interleave their tokens with preserved spatial correspondence; we show this beats naive concatenation. A two-stage adapter training protocol (generic image-caption alignment, then joint task-specific optimization) prevents the localized stream from overfitting to training-domain manipulations. Across face-manipulated and fully synthetic content, FORGE produces region-referential explanations answering fine-grained attribute queries ("Does the eyes/nose/mouth look real or fake?") and substantially outperforms in-domain baselines on cross-domain evaluations; region-specific evaluation and human studies confirm explanation faithfulness.

Rohit Kundu, Shan Jia, Vishal Mohanty +2

University of California, Riverside · Google LLC

Deepfake Detection Digital Forensics Multimodal Contrastive Learning Forge Evidence-Grounded Questions

Ask PDF

Sep 29, 2026cs.CR

ModalFidelity: Routing Modalities for Deepfake Detection on a Budget

Deepfakes no longer need to fake a whole video. Generators that read the transcript now alter only the few seconds in which a video's meaning turns, so a forgery hides in a small, unknown fraction of the video. Yet detectors still read every one-second window of both the audio and image streams, spending nearly all of their compute where nothing was altered. We observe that deciding where to look is far cheaper than looking. We present ModalFidelity, a lightweight router that previews each window and decides, before any forensic detector runs, which stream is worth reading, under a hard compute budget it can never exceed. On AV-Deepfake1M, reading at most a fifth of the windows, it is more accurate than gating after the detectors at 15.9x less compute, and retains over 96% of the accuracy of an oracle that knows where every forgery lies.

Oguzhan Baser, Kaan Kale, Sriram Vishwanath +1

The University of Texas at Austin, Austin, TX, USA · Georgia Institute of Technology, Atlanta, GA, USA

Deepfake Detection Digital Forensics Ai-Generated Video Detection Unsupervised Detection Fidelity Complementary Modalities+2

Ask PDF