MAD-Guard: Controlled Study of Autoregressive Generation versus Direct Decision Interfaces for Closed Multimodal Forensic Tasks

Hao Chen

cs.CVSep 27, 2026

MAD-Guard: Controlled Study of Autoregressive Generation versus Direct Decision Interfaces for Closed Multimodal Forensic Tasks

Authors: Hao Chen

Organizations: School of Cyber Security, Guangdong Polytechnic Normal University, Guangzhou, China

Abstract

When should multimodal foundation models generate tokens, and when should they directly output a decision? We present MAD-Guard, a controlled study of output-decision interfaces for closed multimodal forensic tasks. Once a multimodal representation is computed, is autoregressive generation necessary for closed forensic decisions with high input complexity but low output entropy? Under a matched Qwen3-VL-8B backbone, 2,400 FakeClue training samples, and LoRA budget ( $r=16, α=32$ ) on Huawei Ascend 910C NPUs, we evaluate a progression of decision interfaces (AR-SFT [generate] $\to$ Logit Slice $\to$ Binary Direct Head $\to$ +choice $\to$ +act $\to$ CLM-Head) and decompose latency into backbone representation (53.12 ms), 151,643-way vocabulary projection (+85.04 ms $\to$ 138.16 ms), and decoding (+248.26 ms $\to$ 386.42 ms). Under 1-to-1 binary supervision ( $\mathcal{L}_{\mathrm{BCE}}$ ), a Binary Direct Head cuts latency by $2.60\times$ - $7.27\times$ (53.12 ms) and lowers calibration error by $1.88\times$ (ECE = 0.0450 vs. 0.0845), with a -1.80% accuracy trade-off (93.10% vs. 94.90%; 0.9795 vs. 0.9871 ROC-AUC) from forfeiting token priors. Gains above AR-SFT arise either from multi-task attribution and uncertainty gating (+choice+act: 96.44% accuracy, 0.9940 ROC-AUC, 0.0187 ECE at 53.71 ms) or from a disaggregated contrastive head (CLM-Head: 96.55% binary and 96.44% multi-task accuracy, 0.0166 ECE, 98.79% 7-class attribution at 54.42 ms) retaining semantic priors without token decoding. Across 5,000 out-of-sample images from five benchmarks, our framework excels on synthetic, camouflage, and document forgeries (96.44% GenImage, 97.73% Chameleon, 91.84% Doc) while showing a clear boundary on compressed face manipulation (FF++ ROC-AUC = 0.5913).

Figures & tables

Fig. 1: Single-image inference latency versus accuracy on GenImage (NeurIPS 2023) under matched Qwen3-VL-8B conditions on Huawei Ascend 910C: 1-to-1 Binary Direct Head Only (53.12 ms, 93.10%, 0.0450 ECE) and multi-task MAD-Guard (+choice+act, 53.71 ms, 96.44%, 0.0187 ECE) vs. Supervised AR-SFT (138.16 ms logit slice / 386.42 ms generate() , 94.90%, 0.0845 ECE).

Study / Framework	Forensic Perception	Forensic Reasoning	Direct Decision Study	Calibration (ECE)	Latency Decomp.
M2F2-Det [ 25 ] / PRPO [ 26 ]	Vision-Lang. Adapter	Paragraph / Policy Gen.	Hybrid Head + Gen.	No	No
Deep-VRM [ 27 ] ( arXiv’26 )	Residual Signal Inj.	Generative CoT / Text	No (AR Decoding)	No	No
ARA [ 24 ] ( arXiv’26 )	Anchor-Reg. DINOv3	No (Vision-Only)	Frozen Linear Anchor	No	No
FakeVLM-R1 [ 28 ] / VIGIL [ 29 ] ( arXiv’26 )	MLLM Visual Encoder	GRPO / Part-Grounded CoT	No (Multi-Token CoT)	No	No
ForeAgent [ 30 ] / EFR [ 31 ] ( arXiv’26 )	Multi-Modal Grounding	Iterative Agent / Evidence	No (Multi-Turn AR)	No	No
MAD-Guard (Ours)	Matched Qwen3-VL	Prompt Conditioning	Controlled 6-Step Prog.	Yes ( $1.88\text{--}5.09\times$ )	Yes (3-Tax Split)

TABLE I: Positioning of MAD-Guard Relative to Recent Multimodal Forensic Paradigms and Preprints.

Fig. 2: Overall pipeline of MAD-Guard for controlled output-decision evaluation: (a) Multimodal forensic input combining query image $I$ (dynamic resolution capping $\leq 512^{2}$ ) and forensic instruction prompt $T$ ; (b) Matched causal multimodal backbone (Qwen3-VL-8B) with LoRA adapters ( $r=16,\alpha=32$ ), gradient checkpointing, and terminal token pooling; (c) Direct decision interfaces comparing primary scalar authenticity scoring ( noul_head ), auxiliary 7-class attribution ( choice_head ) and uncertainty-gated action ( act_head ), and a CLM-inspired disaggregated contrastive decision head ( CLM-Head ) against autoregressive generation on Huawei Ascend 910C.

Decision Interface (Ascend 910C)	Supervision Protocol	Acc.	ROC-AUC	ECE ∗	Backbone+Proj.	Decode Tax	Total Latency
Zero-Shot Constrained AR ( $1$ – $4$ tok)	None (Pretrained Base)	63.09%	0.8511	0.1824	138.12 ms	114.22 ms	252.34 ms
Supervised AR-SFT ( generate , $K=1$ )	Binary Token CE	94.90%	0.9871	0.0845	138.16 ms	248.26 ms	386.42 ms
Supervised AR-SFT (Direct Logit Slice)	Binary Token CE	94.90%	0.9871	0.0845	138.16 ms	0.00 ms	138.16 ms
Binary Direct Head Only ( noul_head )	Binary BCE Only (1-to-1 Match)	93.10%	0.9795	0.0450	53.12 ms	0.00 ms	53.12 ms
Direct Head + Attribution ( +choice_head )	BCE + 7-Class CE	95.20%	0.9892	0.0280	53.45 ms	0.00 ms	53.45 ms
MAD-Guard Full ( +choice +act , Ours)	BCE + Choice + Act CE	96.44%	0.9940	0.0187	53.71 ms	0.00 ms	53.71 ms

TABLE II: Controlled Progression of Output-Decision Interfaces under Identical Qwen3-VL-8B Backbone, Data (

N=2{,}400

), LoRA Budget (

r=16,\alpha=32

), and Ascend 910C Hardware on GenImage (

N=1{,}940

Method	Paradigm	Acc.	ROC-AUC	Latency	Hardware / Source
CNNDetection [ 36 ]	ResNet-50 (CVPR’20)	74.20%	0.8130	45.0 ms	V100 GPU / Reported
UnivFD [ 21 ]	Frozen CLIP (CVPR’23)	86.20%	0.9240	58.0 ms	A100 GPU / Reported
DIRE [ 14 ]	Diffusion Inv. (ICCV’23)	88.40%	0.9410	1,450 ms	A100 GPU / Reported
NPR [ 12 ]	Upsampling (CVPR’24)	91.50%	0.9580	52.0 ms	A100 GPU / Reported
DRCT [ 15 ]	Contrastive (ICLR’24)	93.20%	0.9710	82.0 ms	A100 GPU / Reported
D 3 [ 23 ]	Discrepancy (CVPR’25)	94.60%	0.9820	65.0 ms	A100 GPU / Reported

TABLE III: Cross-Method Comparison on GenImage (NeurIPS 2023) with Explicit Hardware & Source Attribution.

Benchmark	Model / Decision Inference Protocol	Sample Count ( $N_{\text{real}}/N_{\text{fake}}$ )	Accuracy	Precision	Recall	F1-Score	ROC-AUC	Mean Latency
GenImage [ 6 ]	Qwen3-VL-8B (Zero-Shot Constrained AR, 1–4 tokens)	1,940 (1024 / 916)	63.09%	93.10%	23.58%	37.63%	0.8511	252.34 ms
GenImage [ 6 ]	MAD-Guard (Direct-Head Inference, Ours)	1,940 (1024 / 916)	96.44%	94.35%	98.36%	96.31%	0.9940	52.84 ms
Chameleon [ 37 ]	Qwen3-VL-8B (Zero-Shot Constrained AR, 1–4 tokens)	441 (0 / 441)	53.97%	– †	53.97%	– †	– †	485.85 ms
Chameleon [ 37 ]	MAD-Guard (Direct-Head Inference, Ours)	441 (0 / 441)	97.73%	– †	97.73%	– †	– †	51.12 ms
Doc	Qwen3-VL-8B (Zero-Shot Constrained AR, 1–4 tokens)	576 (116 / 460)	69.27%	99.30%	61.96%	76.31%	0.9835	1,041.45 ms
Doc	MAD-Guard (Direct-Head Inference, Ours)	576 (116 / 460)	91.84%	98.14%	91.52%	94.71%	0.9746	54.30 ms

TABLE IV: Cross-Benchmark Evaluation across 5,000 Out-of-Sample Images on Huawei Ascend 910C.

Model / Input Configuration	Nominal Acc	Balanced Acc	FPR	FNR	ROC-AUC
Xception [ 4 ] (ICCV’19)	89.30%	88.75%	9.40%	13.10%	0.9220
F3-Net [ 5 ] (ECCV’20)	90.43%	89.90%	8.20%	12.00%	0.9330
AltFreezing [ 17 ] (CVPR’23)	93.40%	92.80%	6.20%	7.80%	0.9650
UCF [ 16 ] (ICCV’23)	94.10%	93.50%	5.80%	7.10%	0.9710
M2F2-Det [ 25 ] (CVPR’25)	92.80%	92.10%	7.10%	8.50%	0.9590
LLaVA-1.5-7B (Zero-Shot) [ 3 ]	42.30%	51.10%	53.81%	43.99%	0.5120

TABLE V: Capability Boundary Analysis on FaceForensics++ (c23,

N=1{,}168

: 236 Real, 932 Fake).

Fig. 3: Empirical capability dichotomy across five forensic domains (plotting default $\theta=0.50$ nominal accuracy). MAD-Guard excels on modern diffusion, camouflage, and document tampering, whereas specialized CNNs dominate compressed FF++ video face swaps.

Perturbation Operation	CNNDetect [ 36 ]	DIRE [ 14 ]	AR-SFT	MAD-Guard (Ours)
Uncompressed Baseline	74.20%	88.40%	94.90%	96.44%
JPEG Compression ( $\text{QF}=90$ )	66.85% ( $\downarrow 7.35$ )	84.10% ( $\downarrow 4.30$ )	93.52% ( $\downarrow 1.38$ )	95.82% ( $\downarrow 0.62$ )
JPEG Compression ( $\text{QF}=80$ )	59.40% ( $\downarrow 14.80$ )	80.35% ( $\downarrow 8.05$ )	91.80% ( $\downarrow 3.10$ )	94.18% ( $\downarrow 2.26$ )
JPEG Compression ( $\text{QF}=70$ )	53.15% ( $\downarrow 21.05$ )	75.80% ( $\downarrow 12.60$ )	89.45% ( $\downarrow 5.45$ )	91.75% ( $\downarrow 4.69$ )
JPEG Compression ( $\text{QF}=50$ )	48.70% ( $\downarrow 25.50$ )	71.20% ( $\downarrow 17.20$ )	84.60% ( $\downarrow 10.30$ )	87.32% ( $\downarrow 9.12$ )
Scale Up (+20%)	70.30% ( $\downarrow 3.90$ )	86.90% ( $\downarrow 1.50$ )	94.20% ( $\downarrow 0.70$ )	95.88% ( $\downarrow 0.56$ )

TABLE VI: Robustness Evaluation under Common Post-Processing Operations on GenImage (

N=1{,}940

(a) Gateway SLA & Serving Efficiency Comparison
Metric / System Property	AR (Explain)	AR (Label)	DIRE	Spec. CNN	MAD-Guard (Ours)
Mean Latency / P95	$8.5\sim 18$ s / $>20$ s	378.1 / 642.5 ms	1450 / 1820 ms	$30\sim 60$ / $\sim 70$ ms	53.71 / 58.12 ms
Throughput (Single-Card)	$<0.1$ QPS	$\sim 2.64$ QPS	$\sim 0.69$ QPS	$\sim 20$ QPS	18.62 / 45.87 ‡ QPS
Output Structure	Free Text	Discrete Token	Scalar Error	Discrete Class	Calibrated Prob.+Action
Calibration Error (ECE)	Undefined	0.3693	$\sim 0.082$	$\sim 0.065$	0.0166–0.0187
GenImage Acc. / SLO	71.20% / Viol.	63.09% / Viol.	88.40% / Viol.	74.20% / Sat.	96.44–96.55% / Sat.

TABLE VII: Production Serving Efficiency and Data Scaling Behavior on Huawei Ascend 910C.

Explore similar work

LaP-Forensics: Latent-Pixel Consistency Guided Multimodal Reasoning for Deepfake Detection
Jul 28, 2026Can Wang, Yuhao Wang, Yushe Cao +2Deepfake Detection Digital Forensics
The Hong Kong Polytechnic University · University College London · Tsinghua University +2
FORGE: Forensic Reasoning with Grounded Evidence
Mar 20, 2025Rohit Kundu, Shan Jia, Vishal Mohanty +2Deepfake Detection Digital Forensics
University of California, Riverside · Google LLC
ModalFidelity: Routing Modalities for Deepfake Detection on a Budget
Sep 29, 2026Oguzhan Baser, Kaan Kale, Sriram Vishwanath +1Deepfake Detection Digital Forensics
The University of Texas at Austin, Austin, TX, USA · Georgia Institute of Technology, Atlanta, GA, USA

Jul 28, 2026, cs.CVJ/K move · Enter open · S save

LaP-Forensics: Latent-Pixel Consistency Guided Multimodal Reasoning for Deepfake Detection

Can Wang, Yuhao Wang, Yushe Cao, Canran Xiao+1

The Hong Kong Polytechnic University · University College London · Tsinghua University+2

Deepfake Detection Digital Forensics Generative Models Multimodal Reasoning Red-Green-Blue

Open paper AskPDF arXiv

Recent generative models can produce images with few obvious visual artifacts, weakening detectors and explanations that rely only on surface appearance. We present LaP-Forensics, a multimodal framework that augments RGB semantics with reconstruction-based forensic evidence. A frozen Stable Diffusion DDIM inversion-reconstruction model provides a fixed reconstruction reference, and its residual map measures local compatibility with that reference. Independent projectors encode the RGB image and residual map before a structured Where-What-Why model predicts a textual analysis and an artifact mask.Supervised fine-tuning is followed by Group Relative Policy Optimization (GRPO), whose reward combines mask overlap with output-structure and evidence-reference terms. These text-side terms encourage the model to refer to the consistency map but do not constitute a verifier of free-form textual truth. A separate image-level head fuses RGB and DDIM-residual class features. Experiments show cross-generator detection on UniversalFakeDetect and competitive artifact localization on the official SynthScars benchmark. Controlled cue-construction, inversion-horizon, component, reward-term, and counterfactual analyses support the utility of the residual stream under the evaluated settings, while free-form textual faithfulness and reliability under post-processing remain open limitations.

Abstract

Explore similar work

LaP-Forensics: Latent-Pixel Consistency Guided Multimodal Reasoning for Deepfake Detection

FORGE: Forensic Reasoning with Grounded Evidence

ModalFidelity: Routing Modalities for Deepfake Detection on a Budget