Not Every Cue Is Evidence: Cue Supportability for Forensic Distillation in Face Forgery Detection
Authors: Binjia Zhou, Dawei Luo, Shuai Chen, Feng Xu, Haoyuan Li, Jia wen Seow, Jiachi Wang, Jie Lei, +2 more
Organizations: School of Software Technology, Zhejiang University · Ant Group · College of Computer Science and Technology, Zhejiang University · College of Computer Science and Technology, Zhejiang University of Technology
Explainable face forgery detection requires not only correct judgments but also forensic evidence supported by the input image. However, training cues are typically derived from the forgery generation pipeline. Since images available to the model are of limited quality and resolution, it is difficult to observe the fine-grained traces these cues refer to. Training methods that further supply such cues as privileged supervision exacerbate the problem, as the student is taught to articulate evidence it cannot perceive. The student consequently resorts to templated or over-generalized expressions, giving rise to the correct-answer, wrong-evidence (CAWE) failure. We propose a dual supportability audit that filters privileged cues before distillation. Each candidate cue must be predictable from the remaining privileged context and causally tied to high-attribution visual regions in the current image. Only cues satisfying both conditions receive substantial distillation weight, preventing unsupported details from leaking into the student. Experiments across eight benchmarks show that our method maintains or improves detection accuracy while significantly raising explanation faithfulness compared to existing paradigms.
Figures & tables
Figure 1: Comparison of Answer Accuracy, Cue Precision, and CAWE on FF++ across training paradigms and our ablation variants.
Figure 2: Comparison between conventional FFD supervision and our method. Conventional approaches train models with privileged cues that cannot be observed from the image, leading to template-like evidence. Our supportability audit filters unsupported cues, enabling image-specific faithful explanations.
Figure 3: Overview of our framework. The transfer utility (TU) module (top) masks each candidate cue and measures the likelihood drop, down-weighting cues trivially copied from the annotation. The visual sensitivity (VS) module (bottom) perturbs high-attribution image regions and checks whether cue likelihood is sensitive to visual content. Cues that fail either check receive near-zero weight in the distillation loss.
Figure 4: CAWE on FF++ across training paradigms; higher means more unfaithful explanations. Most existing methods see CAWE rise with training, while ours consistently reduces it.
FF++
Celeb-DF v2
DFDC
WildDF
Category
Method
ACC
AUC
EER ↓
CAWE ↓
ACC
AUC
EER ↓
CAWE ↓
ACC
AUC
EER ↓
CAWE ↓
ACC
AUC
EER ↓
CAWE ↓
Traditional
Xception
95.73
96.30
9.52
–
90.34
89.75
15.20
–
79.32
81.58
24.50
–
75.26
80.89
26.80
–
SBI
97.80
99.64
2.40
–
92.45
93.18
11.60
–
82.50
87.30
19.80
–
78.40
84.50
22.50
–
Forensics Adapter
98.35
99.71
1.82
–
94.20
95.80
9.40
–
85.10
90.20
16.50
–
80.60
87.30
19.80
–
Explainable
FFAA
94.80
96.50
8.75
62.8
88.50
90.20
16.80
68.4
76.30
80.50
26.20
65.2
72.40
78.60
28.50
71.6
VLFFD
97.20
99.23
3.85
56.3
93.80
95.40
10.20
60.1
83.60
88.50
18.40
62.4
79.50
85.80
21.30
65.8
Table 1: Main results on four benchmarks. Color intensity indicates SOTA ranking. The Gain row reports improvements over the strongest baseline (reductions for EER and CAWE); a negative value indicates underperformance. CAWE is reported only for methods that generate forensic evidence. Our method achieves competitive detection accuracy while substantially reducing CAWE over all explainable baselines.
DeeperForensics
Celeb-DF v2
ForgeryNet
Celeb-DF++
Method
Tok. ↓
Inf. ↓
ACC
CAWE ↓
Tok. ↓
Inf. ↓
ACC
CAWE ↓
Tok. ↓
Inf. ↓
ACC
CAWE ↓
Tok. ↓
Inf. ↓
ACC
CAWE ↓
Standard SFT
6.8M
842
89.45
74.2
4.2M
856
91.20
71.6
12.4M
810
74.80
79.8
5.6M
838
90.65
73.5
Self-Correction SFT
15.2M
1,104
90.80
76.5
9.4M
1,126
92.60
73.4
27.8M
1,068
76.20
81.4
12.5M
1,092
91.85
75.8
LLaVA-CoT
32.1M
1,158
92.30
66.8
19.8M
1,182
94.80
64.2
58.6M
1,120
80.40
74.5
26.4M
1,146
94.10
67.6
Standard GRPO
89.4M
1,318
93.80
70.4
55.2M
1,346
95.60
68.2
163.2M
1,274
82.40
75.8
73.6M
1,302
95.20
72.6
DAPO
114.7M
1,280
94.10
71.8
70.8M
1,304
95.30
69.4
209.4M
1,238
81.90
78.2
94.4M
1,266
94.80
73.0
Table 2: Comparison across paradigms on four benchmarks. Tok. denotes student-side training tokens (rollouts and student forward passes) drawn from each benchmark’s training split; teacher and audit passes, which roughly double our per-step cost, are excluded. Inf. denotes average inference tokens per sample. Ours achieves the highest accuracy and lowest CAWE across datasets with fewer student-side tokens than all other distillation and RL alternatives and shorter responses. Shading follows Table 1 ; fewer tokens are better.
Figure 5: Qualitative comparison on two forged samples; purple text lists the annotated artifacts. Existing methods either predict the wrong answer or produce template-like evidence unrelated to the specific image. Our method generates precise, image-specific forensic cues that are visually grounded and support the decision.
Figure 6: Human-judged support ratio (%) of forensic cues on six benchmarks (150 image-cue pairs per cue source and benchmark). Error bars: 95% bootstrap CIs.
Figure 7: Ablation results on FF++, Celeb-DF v2, DFDC, and overall average. (a) Core component ablation. (b) Training paradigm comparison. (c) Distillation target variants. (d) Perturbation operator choices. (e) Attribution top- k sensitivity. (f) Answer accuracy under component removal.
Percentile wc
# Cues
VLM Sup. ↑
Human Sup. ↑
0 – 15%
150
10.0
14.7
15 – 30%
150
24.0
28.7
30 – 45%
150
36.7
42.0
45 – 60%
150
50.7
54.7
60 – 75%
150
64.0
68.0
75 – 90%
150
76.7
78.7
Table 3: Supportability score validation on FF++ (1,000 cues). Higher wc bins yield monotonically higher VLM and human support rates (%).
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Information
Teacher
Student
Image I
✓
✓
Task prompt q
✓
✓
GT label y
✓
✗
Forgery type o
✓
✗
Manipulation region r
✓
✗
Target cue c
Base: ✓ / Masked: ✗
✗
Appendix
Table 4: Information accessibility for teacher and student.
Acc
Prec.
Rec.
F1
κ
CAWE Eval.
87.4
91.0
89.5
90.2
0.72
Appendix
Table 5: Reliability of the CAWE evaluator against human majority vote on 3,600 image-cue pairs. Metrics (%) are macro-averaged over six benchmarks; κ is Cohen’s kappa.
Method
FF++
Celeb-DF v2
DFDC
WildDF
Average
Orig.
1-Cue
Orig.
1-Cue
Orig.
1-Cue
Orig.
1-Cue
Orig.
1-Cue
FFAA
62.8
49.8
68.4
54.2
65.2
51.7
71.6
57.4
67.0
53.3
VLFFD
56.3
44.7
60.1
48.2
62.4
49.5
65.8
52.6
61.2
48.8
Identity-Aware VLM
53.6
41.8
55.4
43.1
61.7
48.7
59.2
46.0
57.5
44.9
RLSBI
58.1
45.9
63.8
50.7
62.0
49.3
68.4
54.6
63.1
50.1
SIDA
54.5
43.0
58.6
46.8
63.8
50.2
61.0
48.0
59.5
47.0
Appendix
Table 6: CAWE (%) under the original evaluation and the one-cue control. “1-Cue” retains one uniformly sampled cue per correctly classified sample and averages results over five random seeds.
Table 8: Per-dataset image resolution and visual-support ratio. “Vis. Sup.” denotes the percentage, over all annotated cues on the sampled images, of cues whose visual evidence is identifiable by human inspection. #Sampled is the number of randomly sampled test images inspected.
Method
Teacher
Params
ACC
CAWE
Qwen2.5-VL family Bai et al. (2025b)
Standard OPD
Qwen2.5-VL-3B
3B
95.40
61.4
Standard OPD
Qwen2.5-VL-7B
7B
96.20
59.3
Qwen3-VL family Bai et al. (2025a)
Standard OPD
Qwen3-VL-8B
8B
96.50
58.6
Standard OPD
Qwen3-VL-32B
32B
97.30
54.9
Appendix
Table 9: Effect of teacher identity and scale on FF++ (student: Qwen3-VL-8B; same protocol as Table 1 ).
Figure 8: Visualization on a real image (Case 1). × : wrong prediction; ✓× : correct prediction with unfaithful evidence; ✓ : correct prediction with faithful evidence.
Figure 9: Visualization on a forged image (Case 2). Symbols follow Fig. 8 .
Figure 10: Before vs. after supportability-aware training. Left: explanations before training; right: explanations after training. × : wrong prediction; ✓× : correct prediction with unfaithful evidence; ✓ : correct prediction with faithful evidence.
DeeperForensics
Celeb-DF v2
ForgeryNet
Celeb-DF++
DF40
Category
Method
ACC
AUC
ACC
AUC
ACC
AUC
ACC
AUC
ACC
AUC
Traditional
EfficientNet Tan and Le (2019)
88.60
92.40
90.80
93.20
70.40
76.80
89.60
91.80
72.50
78.40
Face X-ray Li et al. (2020a)
90.40
93.80
92.60
94.50
72.80
78.60
91.80
93.20
74.20
80.60
F3Net Qian et al. (2020)
91.20
94.60
93.40
95.80
74.50
80.40
92.60
94.50
75.80
82.40
MAT Zhao et al. (2021)
91.80
95.10
93.80
96.20
75.20
81.60
93.00
94.80
76.40
83.20
SPSL Liu et al. (2021)
90.80
94.20
93.20
95.60
73.80
79.80
92.40
94.20
75.20
81.80
Appendix
Table 10: Extended comparison on five benchmarks with methods not included in Table 1 . All models are trained on the combined multi-dataset split, following the same protocol as Table 1 .
Category
Method
CAWE ↓ (Avg.)
Δ vs. Ours
Explainable
RAIDx Li et al. (2025)
58.6
+27.4
So-Fake Huang et al. (2025b)
56.4
+25.2
REVEAL Praharaj et al. (2025)
52.8
+21.6
FP-DAPO Zhu et al. ()
48.6
+17.4
GE-AIGC Guo et al. (2026)
46.8
+15.6
Ours
31.2
–
Appendix
Table 11: Average CAWE across the five benchmarks for explainable methods. Δ denotes the gap relative to our method.
Cat.
Method
Params
Out Tok.
Latency (s)
Thru. (samples/s)
Traditional
Xception
23M
–
0.008
125.0
SBI
23M
–
0.012
83.3
Forensics Adapter
151M
–
0.015
66.7
Explainable
FFAA
8B
286
3.82
0.26
VLFFD
8B
245
3.28
0.30
Identity-Aware VLM
8B
312
4.16
0.24
Appendix
Table 12: Inference efficiency comparison on FF++. Params: model parameters. Out Tok.: average output tokens. Latency: seconds per sample. Thru.: throughput (samples/second). Traditional methods do not generate text.
Method
Vis. Enc. (s)
Text Gen. (s)
Total (s)
Gen. Ratio
FFAA
0.42
3.40
3.82
89.0%
VLFFD
0.42
2.86
3.28
87.2%
EDD
0.42
2.56
2.98
85.9%
PATE-Forensics
0.42
3.82
4.24
90.1%
FakeShield
0.48
5.38
5.86
91.8%
Ours
0.42
1.66
2.08
79.8%
Appendix
Table 13: Inference time breakdown. Vis. Enc.: visual encoding time. Text Gen.: autoregressive text generation time. Gen. Ratio: fraction of total time spent on text generation.
Current face video forgery detectors use wide or dual-stream backbones. We show that a single, lightweight fusion of two handcrafted cues can achieve higher accuracy with a much smaller model. Based on the Xception baseline model (21.9 million parameters), we build two detectors: LFWS, which adds a 1x1 convolution to combine a low-frequency Wavelet-Denoised Feature (WDF) with a phase-spectrum channel derived from Spatial-Phase Shallow Learning (SPSL), and LFWL, which merges WDF with Local Binary Patterns (LBP) in the same way. This extra module adds only 292 parameters, keeping the total at 21.9 million, smaller than F3Net (22.5 million) and less than half the size of SRM (55.3 million). Even with this minimal overhead, the fused models increase the average area under the curve (AUC) from 74.8% to 78.6% on FaceForensics++ and from 70.5% to 74.9% on DFDC-Preview, gains of 3.8% and 4.4% over the Xception baseline. They also consistently outperform F3Net, SRM, and SPSL in eight public benchmarks, without extra data or test-time augmentation. These results show that carefully paired, handcrafted features, combined through the lightweight fusion block, can provide competitive robustness at a significantly lower cost than comparable frequency-based detectors. Our findings suggest a need to reevaluate scale-driven design choices in face video forgery detection.
Advances in generative AI have made image falsification highly realistic, demanding trustworthy authentication systems. Existing forensic detectors can target certain forgery types but lack interpretability, while vision-language models (VLMs) provide explanations but cannot exploit forensic traces for reliable detection. We propose Forensic Knowledge Graphs (FKGs), a unified framework that integrates forensic evidence extraction, structured reasoning, and human-interpretable explanation. Our FKG structure encodes forensic traces along with their causal dependencies and links to scene content. To generate accurate FKGs, we introduce a novel forensic authentication network and an Iterative Context Refinement strategy that guides VLMs to produce faithful, grounded explanations. We also present FKG-50K, a dataset of 50,000 realistic forgeries with ground-truth FKGs. Experiments demonstrate that FKG outperforms both forensic detectors and VLMs in detection, forgery identification and localization, and forensic justification.
The rapid spread of face forgeries on the Web challenges the credibility of visual content. In practical Web environments, manipulated media originate from evolving generation pipelines and undergo diverse processing during dissemination, making reliable authenticity assessment under unseen manipulations and visual changes a critical challenge. We observe that a standard LoRA-adapted CLIP detector exhibits uneven patch-level decision dependence, concen trating a disproportionate share of class-specific relevance on a small fraction of visual patches. To improve robustness to variations in such highly dependent evidence, we propose EviStress, a two-stage framework for generalizable face forgery detection with textual explanations. In the first stage, Evidence-Targeted Patch Perturbation (ETPP) estimates patch dependence from global, relational, and semantic cues and assigns positively correlated perturbation probabilities, explicitly stress-testing highly dependent visual evidence during training. We further introduce Discriminative Variation Preservation (DVP), which constrains the residual between clean and perturbed representations to retain authenticity discriminative information. In the second stage, Intrinsic Evidence Instruction Tuning (IEIT) transfers the adapted CLIP encoder into LLaVA as its vision tower and performs parameter-efficient multimodal instruction tuning, enabling authenticity prediction and textual explanation directly from the learned forgery-sensitive representation without an external detector. Experiments demonstrate improved cross-dataset and cross-method generalization and corruption robustness, with the multimodal model providing authenticity predictions and human-readable explanations.
Jiuyao Jing, Xuanyu Yi, Yu Zheng +1
School of Cyber Engineering, Xidian University, Xi’an, China