EviStress: Evidence Stress Learning for Generalizable Face Forgery Detection with Textual Explanations

Jiuyao Jing; Xuanyu Yi; Yu Zheng; Chunlei Peng

cs.CVOct 12, 2026

EviStress: Evidence Stress Learning for Generalizable Face Forgery Detection with Textual Explanations

Authors: Jiuyao Jing, Xuanyu Yi, Yu Zheng, Chunlei Peng

Organizations: School of Cyber Engineering, Xidian University, Xi’an, China

Abstract

The rapid spread of face forgeries on the Web challenges the credibility of visual content. In practical Web environments, manipulated media originate from evolving generation pipelines and undergo diverse processing during dissemination, making reliable authenticity assessment under unseen manipulations and visual changes a critical challenge. We observe that a standard LoRA-adapted CLIP detector exhibits uneven patch-level decision dependence, concen trating a disproportionate share of class-specific relevance on a small fraction of visual patches. To improve robustness to variations in such highly dependent evidence, we propose EviStress, a two-stage framework for generalizable face forgery detection with textual explanations. In the first stage, Evidence-Targeted Patch Perturbation (ETPP) estimates patch dependence from global, relational, and semantic cues and assigns positively correlated perturbation probabilities, explicitly stress-testing highly dependent visual evidence during training. We further introduce Discriminative Variation Preservation (DVP), which constrains the residual between clean and perturbed representations to retain authenticity discriminative information. In the second stage, Intrinsic Evidence Instruction Tuning (IEIT) transfers the adapted CLIP encoder into LLaVA as its vision tower and performs parameter-efficient multimodal instruction tuning, enabling authenticity prediction and textual explanation directly from the learned forgery-sensitive representation without an external detector. Experiments demonstrate improved cross-dataset and cross-method generalization and corruption robustness, with the multimodal model providing authenticity predictions and human-readable explanations.

Figures & tables

Figure 1. Motivation and evidence stress in EviStress. (a) LoRA-adapted CLIP concentrates patch-level relevance: top 10% patches account for 43.1% of total relevance vs. 10.2% under uniform allocation. (b) The EviStress visual detector shows smaller probability drops under evaluated JPEG compression, resizing, and combined transformations. (c) Evidence stress is that training preferentially applies Gaussian perturbations to highly dependent patch tokens. Three panels show patch-level relevance concentration in a LoRA baseline, robustness under Web-style transformations, and the evidence-targeted patch perturbation mechanism.

Figure 2. Overview of the EviStress framework. In Stage 1, Evidence-Targeted Patch Perturbation (ETPP) estimates patch dependence and stress-tests highly dependent visual evidence, while Discriminative Variation Preservation (DVP) preserves authenticity-discriminative information in the induced variation. In Stage 2, the adapted visual encoder is integrated into a multimodal large language model for joint authenticity prediction and textual explanation. A woman and a girl in white dresses sit in an open car.

Figure 3. Multi-cue patch dependence estimation in ETPP. Patch dependence, derived from global, relational, and semantic cues, determines tokens’ perturbation probability. This figure illustrates the approach to patch dependence estimation.

Method	Venue	CDF	DFD	DFDC	Avg.
RECCE ( Cao et al., 2022 ) †	CVPR’22	73.2	81.2	71.3	75.2
SBI ( Shiohara and Yamasaki, 2022 ) †	CVPR’22	81.3	77.4	–	–
DCL ( Sun et al., 2022 )	AAAI’22	82.3	91.7	76.7	83.6
UCF ( Yan et al., 2023a ) †	ICCV’23	75.3	80.7	71.9	76.0
CFM ( Luo et al., 2023 )	TIFS’24	82.8	91.5	–	–
LSDA ( Yan et al., 2024a )	CVPR’24	83.0	88.0	73.6	81.5

Table 1. Frame-level cross-dataset AUC (%) on CDF, DFD, and DFDC. The symbols † indicates that results are taken from ( Cui et al., 2025 ) . The best results are highlighted in bold.

Method	Venue	CDF	DFD	DFDC	Avg.
IID ( Huang et al., 2023 ) †	CVPR’23	83.8	93.9	70.0	82.6
UCF ( Yan et al., 2023a ) †	ICCV’23	83.7	86.7	74.2	81.5
CFM ( Luo et al., 2023 )	TIFS’24	89.7	95.2	–	–
LSDA ( Yan et al., 2024a ) †	CVPR’24	87.5	88.1	77.0	84.2
CDFA ( Lin et al., 2024 ) †	ECCV’24	93.8	95.4	83.0	90.7
ProDet ( Cheng et al., 2024 )	NeurIPS’24	92.5	–	77.0	–

Table 2. Video-level cross-dataset AUC (%) on CDF, DFD, and DFDC. The symbol † indicates that results are taken from ( Wang et al., 2026 ) . The best results are highlighted in bold.

Method	Venue	UniFace	E4S	FaceDancer	FSGAN	InSwap	SimSwap	Avg.
RECCE ( Cao et al., 2022 )	CVPR’22	84.2	65.2	78.3	88.4	79.5	73.0	78.1
SBI ( Shiohara and Yamasaki, 2022 )	CVPR’22	64.4	69.0	44.7	87.9	63.3	56.8	64.4
CORE ( Ni et al., 2022 )	CVPRW’22	81.7	63.4	71.7	91.1	79.4	69.3	76.1
IID ( Huang et al., 2023 )	CVPR’23	79.5	71.0	79.0	86.4	74.4	64.0	75.7
UCF ( Yan et al., 2023a )	ICCV’23	78.7	69.2	80.0	88.1	76.8	64.9	76.3
LSDA ( Yan et al., 2024a )	CVPR’24	85.4	68.4	75.9	83.2	81.0	72.7	77.8

Table 3. Frame-level cross-method AUC (%) on the six-subset DF40. The best results are highlighted in bold. All experimental results are taken from the original paper and ( Lai et al., 2026 ) .

Method	LLaVA-1.5-7B		Qwen2.5-VL-7B		InternVL2.5-8B		Average		ACC	Human Rank $\downarrow$
Method	Corr.	All	Corr.	All	Corr.	All	Corr.	All	ACC	Human Rank $\downarrow$
LLaVA-1.5-7B	1.677	1.212	3.698	1.716	4.032	1.945	3.136	1.624	0.313	3.1313
Qwen2.5-VL-7B	2.996	1.572	3.996	1.811	4.661	2.114	3.885	1.832	0.305	2.5291
InternVL2.5-8B	2.228	1.379	2.924	1.531	3.355	1.727	2.836	1.546	0.313	2.5992
EviStress (Ours)	3.505	2.751	3.939	2.479	4.573	3.520	4.006	2.917	0.710	1.7404

Table 4. Automatic and human evaluation of explanation quality. “Corr.” denotes the average MLLM-judge score over correctly classified samples, while “All” assigns a score of 1 to incorrect predictions following VERITAS ( Tan et al., 2025 ) . Human Rank is obtained from a blinded ranking study on 100 samples drawn from the fixed 1K evaluation pool, where lower is better.

Figure 4. Fake image from the CDF dataset. All models use the same prompt text. This image contains the original forged image and the detection explanations for that image provided by different models.

CDF	LoRA	88.44	64.32	24.12	84.02	4.42	88.83	-0.39	82.43	6.01	78.07	10.37	79.53	8.91
			Gaussian Noise		Block-wise		Color Contrast		Color Saturation		JPEG Compression		Average
Dataset	Model	Clean	AUC	$\Delta$	AUC	$\Delta$	AUC	$\Delta$	AUC	$\Delta$	AUC	$\Delta$	AUC	$\Delta$
CDF	ETPP+DVP	91.35	70.63	20.72	89.11	2.24	91.50	-0.15	86.40	4.95	82.04	9.31	83.94	7.41
DFD	LoRA	94.08	66.81	27.27	91.05	3.03	92.44	1.64	91.52	2.56	79.91	14.18	84.35	9.74
DFD	ETPP+DVP	93.67	67.63	26.04	91.08	2.59	91.82	1.85	91.44	2.23	80.04	13.63	84.40	9.27
DFDC	LoRA	84.75	65.90	18.85	80.21	4.54	82.51	2.24	80.33	4.42	77.21	7.54	77.23	7.52

Table 5. Robustness evaluation on CDF, DFD, and DFDC. For each corruption, AUC (%) is averaged over five severity levels, and

\Delta

AUC denotes the drop from clean AUC (

\mathrm{AUC}_{clean}-\mathrm{AUC}_{corr}

). Avg. averages over the five corruption types. Best results within each dataset are highlighted in bold.

Strategy	CDF	DFDC	DF40	Avg.
LoRA	88.44	84.75	95.32	89.50
$Prob=0.5$	90.75	84.91	95.74	90.47
Negative	89.15	85.10	95.19	89.81
w/o $L_{dvp}$	91.00	85.40	95.67	90.69
Positive	91.35	85.11	96.02	90.83

Table 6. Ablation on the correlation between patch dependence and perturbation probability. All results are reported in frame-level AUC (%). The best and second-best results are highlighted in bold and underlined, respectively.

Evidence Cue			Dataset
G	R	S	CDF	DFDC	DF40	Avg.
$\checkmark$	$\times$	$\times$	90.98	85.07	95.91	90.65
$\times$	$\checkmark$	$\times$	91.12	85.21	95.92	90.75
$\times$	$\times$	$\checkmark$	91.20	85.09	95.97	90.75
$\checkmark$	$\checkmark$	$\times$	91.09	85.08	95.94	90.70
$\checkmark$	$\times$	$\checkmark$	91.24	85.11	95.94	90.76

Table 7. Ablation study of the three evidence cues. The experimental setup is consistent with Table 6 .

$K$	CDF	DFDC	DF40	Avg.
1	91.35	85.11	96.02	90.83
2	91.04	85.10	95.91	90.68
3	90.96	84.94	95.83	90.58
4	90.86	84.51	95.91	90.43
8	90.83	84.51	95.86	90.40
10	90.72	84.54	95.92	90.39

Table 8. Effect of perturbation depth. The experimental setup is consistent with Table 6 .

$\sigma$	CDF	DFDC	DF40	Avg.
0.02	89.64	84.88	95.55	90.02
0.03	91.22	85.09	95.97	90.76
0.04	91.35	85.11	96.02	90.83
0.05	91.23	85.19	95.94	90.79
0.06	86.65	82.11	91.86	86.87
0.10	90.70	84.81	95.89	90.47

Table 9. Sensitivity to the standard deviation

\sigma

of the multiplicative Gaussian perturbation. The experimental setup is consistent with Table 6 .

Figure 5. Grad-CAM visualization of LoRA and EviStress on representative unseen samples. EviStress exhibits visibly different response patterns across multiple facial regions compared with the more localized responses of LoRA. Original face images and their Grad-CAM visualizations produced by standard LoRA and EviStress.

Explore similar work

Generalizable Face Forgery Detection via Separable Prompt Learning
Apr 19, 2026Enrui Yang, Yuezun LiPrompt Learning Image Forgery Detection
School of Computer Science and Technology, Ocean University of China, Qingdao, China
IMFD: End-to-end Multi-Face Forgery Detection through Instruction-based Large Vision-Language Models
Sep 17, 2026Dasom Choi, Sangjun Moon, Hyeongchan Im +5Image Forgery Detection Large Vision-Language Models
Chungnam National University · Institute of Science Tokyo · Nara Institute of Science and Technology (NAIST)
Not Every Cue Is Evidence: Cue Supportability for Forensic Distillation in Face Forgery Detection
Oct 12, 2026Binjia Zhou, Dawei Luo, Shuai Chen +7Explainable Deepfake Detection Deepfake Detection
School of Software Technology, Zhejiang University · Ant Group · College of Computer Science and Technology, Zhejiang University +1

Apr 19, 2026J/K move · Enter open · S save

Generalizable Face Forgery Detection via Separable Prompt Learning

Enrui Yang, Yuezun Li

School of Computer Science and Technology, Ocean University of China, Qingdao, China

Prompt Learning Image Forgery Detection Deepfake Detection

Open paper AskPDF arXiv

Detecting face forgeries using CLIP has recently emerged as a promising and increasingly popular research direction. Owing to its rich visual knowledge acquired through large-scale pretraining, most existing methods typically rely on the visual encoder of CLIP, while paying limited attention to the text modality. Given the instructive nature of the text modality, we posit that it can be leveraged to instruct Deepfake detection with meticulous design. Accordingly, we shift the focus from the visual modality to the text modality and propose a new Separable Prompt Learning strategy (SePL) that enables CLIP to serve as an effective face forgery detector. The core idea of SePL is to disentangle forgery-specific and forgery-irrelevant information in images via two types of prompt learning, with the former enhancing detection. To achieve this disentangle, we describe a cross-modality alignment strategy and a set of dedicated objectives. Extensive experiments demonstrate that, with this simple adaptation, our method achieves competitive and even superior performance compared to other methods under both cross-dataset and cross-method evaluation, highlighting its strong generalizability. The codes have been released at https://github.com/OUC-YER/SePL-DeepfakeDetection

Abstract

Explore similar work

Generalizable Face Forgery Detection via Separable Prompt Learning

IMFD: End-to-end Multi-Face Forgery Detection through Instruction-based Large Vision-Language Models

Not Every Cue Is Evidence: Cue Supportability for Forensic Distillation in Face Forgery Detection