The rapid spread of face forgeries on the Web challenges the credibility of visual content. In practical Web environments, manipulated media originate from evolving generation pipelines and undergo diverse processing during dissemination, making reliable authenticity assessment under unseen manipulations and visual changes a critical challenge. We observe that a standard LoRA-adapted CLIP detector exhibits uneven patch-level decision dependence, concen trating a disproportionate share of class-specific relevance on a small fraction of visual patches. To improve robustness to variations in such highly dependent evidence, we propose EviStress, a two-stage framework for generalizable face forgery detection with textual explanations. In the first stage, Evidence-Targeted Patch Perturbation (ETPP) estimates patch dependence from global, relational, and semantic cues and assigns positively correlated perturbation probabilities, explicitly stress-testing highly dependent visual evidence during training. We further introduce Discriminative Variation Preservation (DVP), which constrains the residual between clean and perturbed representations to retain authenticity discriminative information. In the second stage, Intrinsic Evidence Instruction Tuning (IEIT) transfers the adapted CLIP encoder into LLaVA as its vision tower and performs parameter-efficient multimodal instruction tuning, enabling authenticity prediction and textual explanation directly from the learned forgery-sensitive representation without an external detector. Experiments demonstrate improved cross-dataset and cross-method generalization and corruption robustness, with the multimodal model providing authenticity predictions and human-readable explanations.
Figures & tables
Figure 1. Motivation and evidence stress in EviStress. (a) LoRA-adapted CLIP concentrates patch-level relevance: top 10% patches account for 43.1% of total relevance vs. 10.2% under uniform allocation. (b) The EviStress visual detector shows smaller probability drops under evaluated JPEG compression, resizing, and combined transformations. (c) Evidence stress is that training preferentially applies Gaussian perturbations to highly dependent patch tokens. Three panels show patch-level relevance concentration in a LoRA baseline, robustness under Web-style transformations, and the evidence-targeted patch perturbation mechanism.
Figure 2. Overview of the EviStress framework. In Stage 1, Evidence-Targeted Patch Perturbation (ETPP) estimates patch dependence and stress-tests highly dependent visual evidence, while Discriminative Variation Preservation (DVP) preserves authenticity-discriminative information in the induced variation. In Stage 2, the adapted visual encoder is integrated into a multimodal large language model for joint authenticity prediction and textual explanation. A woman and a girl in white dresses sit in an open car.
Figure 3. Multi-cue patch dependence estimation in ETPP. Patch dependence, derived from global, relational, and semantic cues, determines tokens’ perturbation probability. This figure illustrates the approach to patch dependence estimation.
Method
Venue
CDF
DFD
DFDC
Avg.
RECCE ( Cao et al., 2022 ) †
CVPR’22
73.2
81.2
71.3
75.2
SBI ( Shiohara and Yamasaki, 2022 ) †
CVPR’22
81.3
77.4
–
–
DCL ( Sun et al., 2022 )
AAAI’22
82.3
91.7
76.7
83.6
UCF ( Yan et al., 2023a ) †
ICCV’23
75.3
80.7
71.9
76.0
CFM ( Luo et al., 2023 )
TIFS’24
82.8
91.5
–
–
LSDA ( Yan et al., 2024a )
CVPR’24
83.0
88.0
73.6
81.5
Table 1. Frame-level cross-dataset AUC (%) on CDF, DFD, and DFDC. The symbols † indicates that results are taken from ( Cui et al., 2025 ) . The best results are highlighted in bold.
Method
Venue
CDF
DFD
DFDC
Avg.
IID ( Huang et al., 2023 ) †
CVPR’23
83.8
93.9
70.0
82.6
UCF ( Yan et al., 2023a ) †
ICCV’23
83.7
86.7
74.2
81.5
CFM ( Luo et al., 2023 )
TIFS’24
89.7
95.2
–
–
LSDA ( Yan et al., 2024a ) †
CVPR’24
87.5
88.1
77.0
84.2
CDFA ( Lin et al., 2024 ) †
ECCV’24
93.8
95.4
83.0
90.7
ProDet ( Cheng et al., 2024 )
NeurIPS’24
92.5
–
77.0
–
Table 2. Video-level cross-dataset AUC (%) on CDF, DFD, and DFDC. The symbol † indicates that results are taken from ( Wang et al., 2026 ) . The best results are highlighted in bold.
Method
Venue
UniFace
E4S
FaceDancer
FSGAN
InSwap
SimSwap
Avg.
RECCE ( Cao et al., 2022 )
CVPR’22
84.2
65.2
78.3
88.4
79.5
73.0
78.1
SBI ( Shiohara and Yamasaki, 2022 )
CVPR’22
64.4
69.0
44.7
87.9
63.3
56.8
64.4
CORE ( Ni et al., 2022 )
CVPRW’22
81.7
63.4
71.7
91.1
79.4
69.3
76.1
IID ( Huang et al., 2023 )
CVPR’23
79.5
71.0
79.0
86.4
74.4
64.0
75.7
UCF ( Yan et al., 2023a )
ICCV’23
78.7
69.2
80.0
88.1
76.8
64.9
76.3
LSDA ( Yan et al., 2024a )
CVPR’24
85.4
68.4
75.9
83.2
81.0
72.7
77.8
Table 3. Frame-level cross-method AUC (%) on the six-subset DF40. The best results are highlighted in bold. All experimental results are taken from the original paper and ( Lai et al., 2026 ) .
Method
LLaVA-1.5-7B
Qwen2.5-VL-7B
InternVL2.5-8B
Average
ACC
Human Rank ↓
Corr.
All
Corr.
All
Corr.
All
Corr.
All
LLaVA-1.5-7B
1.677
1.212
3.698
1.716
4.032
1.945
3.136
1.624
0.313
3.1313
Qwen2.5-VL-7B
2.996
1.572
3.996
1.811
4.661
2.114
3.885
1.832
0.305
2.5291
InternVL2.5-8B
2.228
1.379
2.924
1.531
3.355
1.727
2.836
1.546
0.313
2.5992
EviStress (Ours)
3.505
2.751
3.939
2.479
4.573
3.520
4.006
2.917
0.710
1.7404
Table 4. Automatic and human evaluation of explanation quality. “Corr.” denotes the average MLLM-judge score over correctly classified samples, while “All” assigns a score of 1 to incorrect predictions following VERITAS ( Tan et al., 2025 ) . Human Rank is obtained from a blinded ranking study on 100 samples drawn from the fixed 1K evaluation pool, where lower is better.
Figure 4. Fake image from the CDF dataset. All models use the same prompt text. This image contains the original forged image and the detection explanations for that image provided by different models.
Gaussian Noise
Block-wise
Color Contrast
Color Saturation
JPEG Compression
Average
Dataset
Model
Clean
AUC
Δ
AUC
Δ
AUC
Δ
AUC
Δ
AUC
Δ
AUC
Δ
CDF
LoRA
88.44
64.32
24.12
84.02
4.42
88.83
-0.39
82.43
6.01
78.07
10.37
79.53
8.91
ETPP+DVP
91.35
70.63
20.72
89.11
2.24
91.50
-0.15
86.40
4.95
82.04
9.31
83.94
7.41
DFD
LoRA
94.08
66.81
27.27
91.05
3.03
92.44
1.64
91.52
2.56
79.91
14.18
84.35
9.74
ETPP+DVP
93.67
67.63
26.04
91.08
2.59
91.82
1.85
91.44
2.23
80.04
13.63
84.40
9.27
DFDC
LoRA
84.75
65.90
18.85
80.21
4.54
82.51
2.24
80.33
4.42
77.21
7.54
77.23
7.52
Table 5. Robustness evaluation on CDF, DFD, and DFDC. For each corruption, AUC (%) is averaged over five severity levels, and Δ AUC denotes the drop from clean AUC ( AUCclean−AUCcorr ). Avg. averages over the five corruption types. Best results within each dataset are highlighted in bold.
Strategy
CDF
DFDC
DF40
Avg.
LoRA
88.44
84.75
95.32
89.50
Prob=0.5
90.75
84.91
95.74
90.47
Negative
89.15
85.10
95.19
89.81
w/o Ldvp
91.00
85.40
95.67
90.69
Positive
91.35
85.11
96.02
90.83
Table 6. Ablation on the correlation between patch dependence and perturbation probability. All results are reported in frame-level AUC (%). The best and second-best results are highlighted in bold and underlined, respectively.
Evidence Cue
Dataset
G
R
S
CDF
DFDC
DF40
Avg.
✓
×
×
90.98
85.07
95.91
90.65
×
✓
×
91.12
85.21
95.92
90.75
×
×
✓
91.20
85.09
95.97
90.75
✓
✓
×
91.09
85.08
95.94
90.70
✓
×
✓
91.24
85.11
95.94
90.76
Table 7. Ablation study of the three evidence cues. The experimental setup is consistent with Table 6 .
K
CDF
DFDC
DF40
Avg.
1
91.35
85.11
96.02
90.83
2
91.04
85.10
95.91
90.68
3
90.96
84.94
95.83
90.58
4
90.86
84.51
95.91
90.43
8
90.83
84.51
95.86
90.40
10
90.72
84.54
95.92
90.39
Table 8. Effect of perturbation depth. The experimental setup is consistent with Table 6 .
σ
CDF
DFDC
DF40
Avg.
0.02
89.64
84.88
95.55
90.02
0.03
91.22
85.09
95.97
90.76
0.04
91.35
85.11
96.02
90.83
0.05
91.23
85.19
95.94
90.79
0.06
86.65
82.11
91.86
86.87
0.10
90.70
84.81
95.89
90.47
Table 9. Sensitivity to the standard deviation σ of the multiplicative Gaussian perturbation. The experimental setup is consistent with Table 6 .
Figure 5. Grad-CAM visualization of LoRA and EviStress on representative unseen samples. EviStress exhibits visibly different response patterns across multiple facial regions compared with the more localized responses of LoRA. Original face images and their Grad-CAM visualizations produced by standard LoRA and EviStress.
Detecting face forgeries using CLIP has recently emerged as a promising and increasingly popular research direction. Owing to its rich visual knowledge acquired through large-scale pretraining, most existing methods typically rely on the visual encoder of CLIP, while paying limited attention to the text modality. Given the instructive nature of the text modality, we posit that it can be leveraged to instruct Deepfake detection with meticulous design. Accordingly, we shift the focus from the visual modality to the text modality and propose a new Separable Prompt Learning strategy (SePL) that enables CLIP to serve as an effective face forgery detector. The core idea of SePL is to disentangle forgery-specific and forgery-irrelevant information in images via two types of prompt learning, with the former enhancing detection. To achieve this disentangle, we describe a cross-modality alignment strategy and a set of dedicated objectives. Extensive experiments demonstrate that, with this simple adaptation, our method achieves competitive and even superior performance compared to other methods under both cross-dataset and cross-method evaluation, highlighting its strong generalizability. The codes have been released at https://github.com/OUC-YER/SePL-DeepfakeDetection
Enrui Yang, Yuezun Li
School of Computer Science and Technology, Ocean University of China, Qingdao, China
The rapid increase of deepfakes has raised significant concerns due to their spread on social media. Traditional multi-face forgery detectors crop and verify each face independently, ignoring background context and inter-face relationships, which often yields suboptimal performance. To overcome these limitations, we leverage instruction-based Large Vision-Language Models (LVLMs), which can interpret entire images and follow complex textual instructions. We propose a simple yet effective single-stage multi-face forgery detector, called IMFD (Instruction-based Multi-face Forgery Detector), which is trained end-to-end to jointly localize faces and predict per-face forgery labels. Rather than treating face box prediction only as a joint objective, IMFD explicitly integrates predicted face bounding boxes into the instruction as visual cues that enhance instruction grounding and forgery detection. To support the training and evaluation of IMFD, we convert existing multi-face forgery datasets into an instruction-based format. Experimental results and analyses show that IMFD improves multi-face forgery detection by integrating face bounding boxes into the instruction, and consistently outperforms various state-of-the-art methods.
Dasom Choi, Sangjun Moon, Hyeongchan Im +5
Chungnam National University · Institute of Science Tokyo · Nara Institute of Science and Technology (NAIST)
Explainable face forgery detection requires not only correct judgments but also forensic evidence supported by the input image. However, training cues are typically derived from the forgery generation pipeline. Since images available to the model are of limited quality and resolution, it is difficult to observe the fine-grained traces these cues refer to. Training methods that further supply such cues as privileged supervision exacerbate the problem, as the student is taught to articulate evidence it cannot perceive. The student consequently resorts to templated or over-generalized expressions, giving rise to the correct-answer, wrong-evidence (CAWE) failure. We propose a dual supportability audit that filters privileged cues before distillation. Each candidate cue must be predictable from the remaining privileged context and causally tied to high-attribution visual regions in the current image. Only cues satisfying both conditions receive substantial distillation weight, preventing unsupported details from leaking into the student. Experiments across eight benchmarks show that our method maintains or improves detection accuracy while significantly raising explanation faithfulness compared to existing paradigms.
Binjia Zhou, Dawei Luo, Shuai Chen +7
School of Software Technology, Zhejiang University · Ant Group · College of Computer Science and Technology, Zhejiang University +1