Paper deep dive
MedForge: Interpretable Medical Deepfake Detection via Forgery-aware Reasoning
Zhihui Chen, Kai He, Qingyuan Lei, Bin Pu, Jian Zhang, Yuling Xu, Mengling Feng
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 97%
Last extracted: 3/22/2026, 6:06:30 AM
Summary
MedForge is a pre-hoc, evidence-grounded medical forgery detection framework that addresses the limitations of black-box classifiers and post-hoc MLLM explainers. It introduces MedForge-90K, a large-scale benchmark of 90,000 medical images with expert-guided reasoning annotations, and MedForge-Reasoner, an MLLM-based detector trained via a two-stage pipeline (SFT and Forgery-aware GSPO) to perform localize-then-analyze reasoning, significantly reducing hallucinations and improving detection accuracy.
Entities (5)
Relation Signals (3)
MedForge → includes → MedForge-90K
confidence 100% · We introduce MedForge-90K, a large-scale benchmark... Building on it, MedForge-Reasoner...
MedForge-90K → usedby → MedForge-Reasoner
confidence 98% · Building on it [MedForge-90K], MedForge-Reasoner performs localize-then-analyze reasoning
MedForge-Reasoner → trainedwith → Forgery-aware GSPO
confidence 95% · MedForge-Reasoner... is further aligned with Forgery-aware GSPO to strengthen grounding
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Text-guided image editors can now manipulate authentic medical scans with high fidelity, enabling lesion implantation/removal that threatens clinical trust and safety. Existing defenses are inadequate for healthcare. Medical detectors are largely black-box, while MLLM-based explainers are typically post-hoc, lack medical expertise, and may hallucinate evidence on ambiguous cases. We present MedForge, a data-and-method solution for pre-hoc, evidence-grounded medical forgery detection. We introduce MedForge-90K, a large-scale benchmark of realistic lesion edits across 19 pathologies with expert-guided reasoning supervision via doctor inspection guidelines and gold edit locations. Building on it, MedForge-Reasoner performs localize-then-analyze reasoning, predicting suspicious regions before producing a verdict, and is further aligned with Forgery-aware GSPO to strengthen grounding and reduce hallucinations. Experiments demonstrate state-of-the-art detection accuracy and trustworthy, expert-aligned explanations.
Tags
Links
- Source: https://arxiv.org/abs/2603.18577v1
- Canonical: https://arxiv.org/abs/2603.18577v1
Trouble viewing inline? Open PDF directly →
Full Text
82,870 characters extracted from source content.
Expand or collapse full text
MedForge: Interpretable Medical Deepfake Detection via Forgery-aware Reasoning Zhihui Chen 1 , Kai He 1 , Qingyuan Lei 2 , Bin Pu 3 , Jian Zhang 4 , Yuling Xu 5 , Mengling Feng 1 * 1 Saw Swee Hock School of Public Health, NUS 2 CUHK 3 Hunan University 4 XJTU 5 Guangdong Provincial People’s Hospital zhihui.chen@u.nus.edu, kai_he, ephfm@nus.edu.sg qingyuan.lei@link.cuhk.edu.hk, pubin@hnu.edu.cn zhangjian062422@stu.xjtu.edu.cn, xuyuling@gdph.org.cn Abstract Text-guided image editors can now manipulate authentic medical scans with high fidelity, en- abling lesion implantation/removal that threat- ens clinical trust and safety. Existing defenses are inadequate for healthcare. Medical detec- tors are largely black-box, while MLLM-based explainers are typically post-hoc, lack medical expertise, and may hallucinate evidence on am- biguous cases. We present MedForge, a data- and-method solution for pre-hoc, evidence- grounded medical forgery detection. We intro- duce MedForge-90K, a large-scale benchmark of realistic lesion edits across 19 pathologies with expert-guided reasoning supervision via doctor inspection guidelines and gold edit lo- cations. Building on it, MedForge-Reasoner performs localize-then-analyze reasoning, pre- dicting suspicious regions before producing a verdict, and is further aligned with Forgery- aware GSPO to strengthen grounding and re- duce hallucinations. Experiments demonstrate state-of-the-art detection accuracy and trustwor- thy, expert-aligned explanations. 1 1 Introduction Recent advances in text-guided image editing have made it feasible to tamper with authentic med- ical scans with high fidelity.Editors such as Nano-Banana (Comanici et al., 2025) and GPT- Image (Hurst et al., 2024) can implant or remove subtle lesions while largely preserving anatomical structure and acquisition-style cues (Huang et al., 2025a; Alsaheel et al., 2023). Such manipulations are not merely hypothetical. They can distort clin- ical records for insurance fraud, malpractice dis- putes, or biased treatment/triage, and may even mislead trained experts (Amiri et al., 2024). This * Corresponding author 1 Code and data are released athttps://anonymous. 4open.science/r/MedForge-Reasoner-anonymize-2295 Specialized Vision Models Manipulated Brain MRI Scan Tumor Implant Prob = 85% ~ Fake MLLM Explainable Detectors The image is real, featuring a real human head with a skull cap and a small dark spot on the surface of the skull. False Judgement ❌ The skull cap is slightly larger than the head, indicating a possible anatomical context. The dark spot on the skull is of interest .... Visual Hallucination ❌ Post-hoc Justification ❌ <think> This is an axial T2-weighted brain MRI showing a large ... mass in the right frontal lobe . I have identified the Suspect Deepfake Area at: "deepfake"x1="291" y1="243" x2="445" y2="413" Mass Effect Absence: no corresponding compression of the adjacent tissue and no shift of the midline structures ... Lack of Host Reaction: unnaturally sharp border with no surrounding edema ... " "Sticker" Artifact:impression that the lesion was artificially "pasted" The complete absence of expected secondary effects is biologically implausible</think> Therefore,this image is a deepfake. Pre-hoc Reasoning ✅ Visually-grounded Analysis ✅ Medical Principles & Rationale ✅ MedForge-Reasoner Binary Decison ❌ Human Verifiability ❌ CNN Real SIDA-13B Figure 1: Framework comparison. Left: special- ized vision detectors (e.g., CNNs) output only a bi- nary decision, offering no clinically verifiable evi- dence. Right-bottom: post-hoc MLLM explainers (e.g., SIDA (Huang et al., 2025b)) may produce plausible- sounding but ungrounded rationales, including halluci- nated visual details. Right-top: MedForge-Reasoner performs pre-hoc localized reasoning by first identifying suspicious regions (blue) and then generating medically coherent, visually verifiable rationales grounded in the image evidence. creates an urgent need for medical forgery detec- tion that is reliable under clinically realistic edits. However, existing defenses fall short of clini- cal requirements. Medical deepfake detectors (Li et al., 2025; Albahli and Nawaz, 2024) are of- ten black-box classifiers that provide little inter- pretable evidence, limiting trust and accountability. General-domain “explainable” detectors (Huang et al., 2025b; Zhou et al., 2025) leverage Multi- modal Large Language Models (MLLMs), but typ- ically in a post-hoc manner and without medical expertise, despite the fact that clinically useful ra- tionales must be medically coherent and visually verifiable. As shown in Figure 1, under unfamiliar or ambiguous cases, their explanations may regress to generic templates or hallucinated evidence, yield- ing plausible-sounding but non-verifiable ratio- nales. In other words, post-hoc rationalization does arXiv:2603.18577v1 [cs.AI] 19 Mar 2026 not guarantee evidence-based reasoning, which is precisely the requirement for clinical adoption. We argue that medical forgery detection should be formulated as pre-hoc reasoning grounded in localized evidence. Concretely, a system should first identify suspicious manipulated regions (e.g., bounding boxes) and only then reason toward a ver- dict. This “localize-then-analyze” constraint makes explanations inspectable and suppresses template reuse and hallucination by anchoring reasoning to verifiable pixels. More broadly, we treat localiza- tion as a first-class constraint for explanation faith- fulness, turning grounding from an afterthought into an explicit objective. To enable this paradigm,we introduce MedForge-90K, a large-scale benchmark of le- sion implant/removal on authentic images across 19 pathologies, generated by 10 SOTA MMDiT/LDM- based editing models (Huang et al., 2025a). Cru- cially, MedForge-90K provides expert-guided su- pervision for grounded explanations: we combine doctor-defined inspection guidelines with gold ma- nipulation locations, and use them to produce med- ically aligned rationales that are explicitly tied to the edited regions. Building on this resource, we propose MedForge-Reasoner, an MLLM-based detector trained with an explicit localization-then- analysis objective to reason before deciding. We further align grounding and explanation quality via a two-stage strategy (SFT cold-start + Forgery- aware GSPO) that directly rewards correct local- ization and evidence-grounded reasoning. Exper- iments show that enforcing such grounding im- proves explanation quality and reduces hallucina- tions, measured with an MLLM-as-judge protocol. The main contributions are as follows: •We introduce MedForge-90K, the first large- scale medical forgery benchmark of high- quality lesion manipulations with granular ex- plainable annotations, addressing data scarcity in medical deepfake detection. • We propose MedForge-Reasoner, a novel MLLM-based detector that integrates detec- tion with grounded CoT reasoning, and em- ploys a forgery-aware GSPO to anchor reason- ing to visual forgery evidence. •Extensive experiments show that Forgery- aware GSPO aligns the detector with factual visual evidence in forgery reasoning, improv- ing detection accuracy by 7.65% while sig- nificantly reducing hallucinations by 16.2% compared to strong baselines. 2 Related Work Medical Deepfake Benchmarks. Most prior work on medical image generation targets data aug- mentation and class balancing rather than simu- lating adversarial forgery scenarios. Early stud- ies (Guo et al., 2025; Motamed et al., 2021) used VAEs/GANs to synthesize CT/MRI scans, which do not reflect the modern threat of editing authen- tic patient records. While MedForensics (Li et al., 2025) takes a step toward forgery detection, ex- isting benchmarks remain limited in two aspects. (i) Threat mismatch: real-world medical deepfakes often involve targeted tampering of authentic scans (e.g., lesion implant/removal) to enable insurance fraud or misdiagnosis (Stroebel et al., 2023; Hsu et al., 2025), rather than generating scans from scratch. (i) Supervision gap: they typically pro- vide only labels and lack localized edit evidence and expert-aligned reasoning signals required for clinically verifiable explanations. MedForge-90K addresses these gaps by benchmarking high-fidelity lesion edits on authentic images using modern text- guided editors and by providing guideline- and location-grounded reasoning supervision. Interpretable Deepfake Detection. Standard medical forgery detectors are predominantly black- box binary classifiers (Li et al., 2025; Tan et al., 2024), offering limited evidence to support clinical trust. Recent general-domain approaches (Huang et al., 2025b; Zhou et al., 2025; Xu et al., 2025) incorporate MLLMs to generate textual explana- tions, yet they are often post-hoc: a separate mod- ule makes the decision and the MLLM rational- izes it afterwards, which can decouple explanations from the actual evidence. Moreover, MLLMs are prone to visual hallucination (Huang et al., 2024), especially on unfamiliar or ambiguous cases, where they may repeat generic templates or describe non- existent artifacts. Although pre-hoc reasoning has been explored in AIGC detection (Tan et al., 2025; Gao et al., 2025), these methods are not designed for subtle medical lesion forgeries and typically lack (i) medical-domain constraints and (i) explicit localization-grounding objectives to enforce pixel- verifiable rationales. In contrast, our approach uni- fies detection and reasoning in a pre-hoc manner and explicitly enforces localization-grounded rea- soning through Forgery-aware GSPO. Crucially, Source: Real Medical Images 30K+ High Quality Medical Images (MIMIC, ODIR, MultiEYE, Yale-Brain etc.), 20 Lesion Types Medical Forgery Generation Fundus Photography (Diabetes, AMD, Hypertension, Normal etc) Brain-MRI (Meningioma, Metastases, Pituitary-adenoma, Normal etc) Chest X-Ray (Pleural Effusion, Lung Opacity, Fracture, Cardiomegaly) Chest X-Ray (Consolidation, Pneumonia, Pneumothorax, Normal etc ) Auto-regresive MMDiT GPT-Image-1, Nanao-Banana, Qwen- Image-edit, Seedream-4, Step1x-edit Latent Diffusion Models FLUX.1, Stable Diffusion 3.5 Medium / Large, SD-inpainting, SD-xl-inpainting Forgery Production Reaosning Annotation Expert Forgery Guidelines Reasoning Structure: <think> Okay, let's see. I am starting to analyze whether this image is a deepfake: <description> x </description>. <|object_ref_start|>\"deepfake\"<|object_ref_end|> <|box_start|> x1="", y1="", x2="", y2="" <|box_end|>. <evidence> x </evidence>. <conclusion> x </conclusion>. </think> This image is a deepfake. / This image is real" -------------------------------------------------------------------------------- Expert Forgery Detection Rationale ✅ Pixel Level Forgery Localization ✅ Visually-grounded Reasoning ✅ Real & Forged Image Pair Pixel-wise Difference ~ Cross Vector Analysis General Principles Mortality-specific Principles Visually Grounded Reasoning Image Physics & Texture Anatomical Structure Pathological Logic Success of Editing Image Fidelity Anatomical Correctness Forgery Writer (Gemini-2.5-Pro) Forgery Editor (Nano-Banana) Diagnoser (Gemini-3-Pro) Refinement Feedback Forged Lesion (Implant / Removal) Forgrey Instructions Iterative Writer-Editor-Diagnoser Refinement Figure 2: Overview of the MedForge-90K construction pipeline. The framework proceeds in three stages: medical image collection across three modalities, forgery generation via a Writer-Editor-Diagnoser loop, and human expert-guided annotation utilizing expert guidelines to generate hierarchical diagnostic reasoning. GSPO makes localization-grounding an optimiza- tion objective, coupling the verdict with inspectable regions and curbing hallucinated rationales. 3 MedForge-90K Dataset We introduce MedForge-90K (Figure 2), the first large-scale medical forgery benchmark with de- tailed forgery and reasoning annotations. For the source image, we evenly select 30K high quality medical images in Chest X-Ray, Brain MRI, Fun- dus Photography from 5 public datasets, MIMIC (Johnson et al., 2016), ODIR (Li et al., 2020), Mul- tiEYE (Wang et al., 2024), Yale-Brain (Chadha et al., 2025) and Brain-MRI (Nickparvar, 2021). These medical images are classified into 19 types of pathologies and 1 normal status according to their original labels. Forgery manipulations includ- ing lesion implant and removal take place within each modality. In summary, MedForge includes: (i) Real Images (30K) spanning major 2D modalities with 19 lesion types plus healthy scans; (i) Lesion Implant (30K) healthy scans with implanted le- sions, evenly distributed across 10 forgery models; and (i) Lesion Removal (30K) diseased scans with removed lesions, evenly distributed across 10 forgery models. 3.1 Forgery Pipeline We employ 10 state-of-the-art text-guided medi- cal image editing models based on MMDiT/LDM paradigms, including Nano-Banana (Comanici et al., 2025), GPT-Image (Hurst et al., 2024), Qwen- Image-Edit (Wu et al., 2025), SeedDream 4.0 (See- dream et al., 2025), Stable Diffusion 3.5 (Esser et al., 2024), and Stable Diffusion Inpainting (Stac- chio, 2023). Text prompts are a critical compo- nent of editing, as they specify the medical con- text and transformation intent. To obtain realistic and anatomically plausible manipulations, we in- troduce a writer–editor–diagnoser refinement loop. Specifically, a writer drafts an initial prompt, the editor generates an edited image, and a diagnoser evaluates whether the result achieves the desired condition while remaining anatomically consistent. If the edit is unsatisfactory, the diagnoser provides targeted feedback and the writer revises the prompt; the loop iterates until success or a maximum num- ber of rounds, after which the sample is discarded. In practice, the writer and diagnoser are imple- mented with Gemini 2.5/3 Pro, while Nano-Banana serves as the editor during prompt refinement. The refined prompts are applied to all editing models to construct forgeries. For diffusion-based editors requiring inpainting masks, we use Nano-Banana’s localized forgery regions as mask inputs. 3.2 Human Expert-guided Reasoning Annotation We aim to annotate forged images with accurate and professional rationales. To achieve this, we engaged medical experts to formulate a compre- hensive detection guideline. As shown in the “Ex- pert Forgery Guidelines” in Figure 2, this guideline is structured into two pillars: General Principles (universal biomedical principles) and Modality- Specific Principles (specific constraints for MRI, Fundus, and CXR). During annotation, the guide- lines are injected into the MLLM’s prompt. By explicitly grounding the model on these criteria, we enforce a hierarchical reasoning mechanism on medical forgeries across three levels: 1. Image Physics & Texture: Following the Gen- eral Principles, the model detects low-level anoma- lies such as inconsistent noise distribution, inpaint- ing traces, and unnatural boundaries. 2. Anatomical Structure: Based on the Modality- Specific Criteria, the model verifies morphological correctness, such as vascular continuity in fundus photography or gyral symmetry in brain MRI. 3. Pathological Logic: Integrating the core phi- losophy of “Biological Interconnectivity” from the guidelines, the model validates high-level plausibil- ity, rejecting lesions that lack necessary secondary effects (e.g., mass effect, edema) or violate chrono- logical disease evolution. The above human expert-guided protocol steers the generated rationales toward clinically meaning- ful diagnostic reasoning. Following recent prac- tice (Zhou et al., 2025; Huang et al., 2025b), we use an MLLM (Gemini 2.5 Pro) to automate anno- tation. To reduce visual hallucinations and enforce the medical principles described above, we adopt a forgery-grounded annotation strategy. Concretely, we apply Change Vector Analysis (CVA) (Malila, 1980) to compute a per-pixel change magnitude, |Iforged− Ireal|. We then threshold high-response regions to obtain a manipulation mask, which is finally converted into bounding-box (bbox) coordi- nates as Eq. 1. M bbox : <box x 1 ,y 1 ,x 2 ,y 2 />(1) These modified regions serve as the key visual com- ponents of forgery signs. To generate high-quality annotations, we integrate these CVA-derived coor- dinates with the hierarchical expert guidelines to construct a visually-grounded reasoning prompt. This unified prompting strategy explicitly directs the MLLM to anchor its analysis on the provided bounding boxes (or the absence). Guided by the three-tiered criteria (Physics, Anatomy, Pathology), the model scrutinizes the designated regions to ex- pose specific artifacts in forged samples, or val- idates the preservation of biological logic in real samples. As illustrated in the “Reasoning Structure” of Figure 2, the output is enforced into a structured chain-of-thought format consisting of description, evidence, and conclusion. This ensures that the reasoning is derived from professional medical ra- tionale and grounded with visual evidence. 4 Methodology In this section, we present the MedForge-Reasoner framework. We first formulate the task of inter- pretable medical forgery detection. Then, we de- tail our two-stage training pipeline: the reasoning cold-start via Supervised Fine-tuning (SFT) and the Forgery-aware Group Sequence Policy Opti- mization (GSPO), designed to align the model with factual visual evidence. 4.1 Task Formulation Existing MLLMs often suffer from visual hallu- cination (Huang et al., 2024), where the model fabricates details which are not present in the im- age. In forgery detection, this leads to ungrounded reasoning. To address this, we define the detection task as a unified sequence generation problem that enforces grounding before reasoning. Specifically, given a medical imagex, the model is trained to generate a sequence S structured as: S = [ ˆ M bbox , <reasoning>, ˆy],(2) where ˆ M bbox represents the coordinates of the ma- nipulated region (or a special token for authentic images), followed by the textual reasoning chain, and finally the detection decisionˆy. By enforc- ing the prediction of forgery location at the very beginning, we force the model to attend to visual anomalies before hallucinating textual descriptions. 4.2 Stage 1: Reasoning Cold Start To equip the MLLM with fundamental medical knowledge and the proposed reasoning format, we perform SFT training. As illustrated in Figure 3, the SFT data is derived from the MedForge-90K, in- corporating expert-guided reasonings and ground- truth bounding boxes. We employ LoRA to efficiently fine-tune the model parametersθon the datasetD = (x,y). The optimization objective is the standard auto- regressive loss: L SFT =−E (x,y)∼D T P t=1 logP θ (y t |x,y <t ),(3) wherexis the input image and user query,yde- notes the target output sequence including reason- ing and final answer, withtas index of generated token. This stage allows the model to internalize the format requirements and basic forgery patterns. Stage 1: Reasoning Cold Start (SFT) Input Data: MedForge-90K SFT Format [<box>, <reasoning>, <label>] <think> <description> ... </description>. <|box_start|> ... <|box_end|> <evidence> ... </evidence>. Based on these findings, I conclude that: <conclusion> ... </conclusion>. </think> This image is fake. <think> <description> ... </description>. <evidence> ... </evidence>. Based on these findings, I conclude that: <conclusion> ... </conclusion>. </think> This image is real. Base MLLM (Qwen3-VL-8B) LoRA Cold-started Reasoner Tag: Fake bbox: x1 y1 x2 y1 Is this image deepfake or real ? Visual Hallucination ❌ ✅ Correct Failed Reasoning ❌ Stage 2: Forgery-aware GSPO (Optimization) Group Sampling (Online Policy) ⛶ Forgery Grounding Reward Coverage Check (Visual Evidence) Reasoning Reward ✔ Key Tokens: think, desc, evid, conc ✔ Correct Classification Forgery-aware Reward Mechanism Forged Forged Policy Update (GSPO Loss) SFT Loss Real ⚠ Failed Detection Group 2 [<box low coverage>] <reasoning> (correct format) <label> Fake Group 1 [<box high coverage>] <reasoning> (correct format) <label> Fake Group 4 [<box incorrect>] <reasoning> (incorrect format) <label> Incorrect Group 3 [<box high coverage>] <reasoning> (incorrect format) <label> Fake Figure 3: MedForge-Reasoner Two-stage Training. SFT for cold-starting the reasoning format, followed by Forgery-aware GSPO. The GSPO stage introduced a reward function balancing visual grounding coverage and reasoning structure compliance to ensure the model localize correct forgery region before reasoning. 4.3 Stage 2: Forgery-aware GSPO Although SFT establishes basic capabilities, stan- dard cross-entropy loss is insufficient to penalize subtle hallucinations or enforce strict alignment with visual evidence. To further align the detec- tor, we introduce Forgery-aware Group Sequence Policy Optimization (GSPO). GSPO applies importance sampling at the se- quence level, which provides stable updates for rea- soning tasks. Given a forgery inputx, we sample a group ofGoutputsy 1 ,y 2 ,...,y G from the cur- rent policyπ θ . The objective function maximizes the expected reward of these generations: L GSPO (θ) =−E x∼D, y i G i=1 ∼π θ old (·|x) " 1 G G X i=1 min s i (θ) ˆ A i , clip s i (θ), 1− ε, 1 + ε ˆ A i # , (4) wheres i (θ)is the importance ratio between new and old policies, and ˆ A i is the advantage: ˆ A i = R(x,y i )−mean(R(x,y j ) G j=1 ) std(R(x,y j ) G j=1 ) .(5) Crucially, to enforce sequence-level stability, we define the importance ratios i (θ)based on the ge- ometric mean of the likelihood ratio over the se- quence length|y i |: s i (θ) = exp 1 |y i | P |y i | t=1 log π θ (y i,t |x,y i,<t ) π θ old (y i,t |x,y i,<t ) .(6) Then, our reward functionR(x,y i )is composed of two parts to penalize visual hallucination and incorrect analysis in forgery detection as follow. 1. Forgery Grounding Reward (R bbox ). Un- like standard object detection tasks that demand precise boundary regression, our goal is to ensure the MLLM’s reasoning is grounded in the correct anomaly region. Therefore, instead of strict Inter- section over Union (IoU), we adopt a Mask Cover- ageCto measure the rate of ground truth forgery area captured by the model’s prediction: C = |M bbox ∩ ˆ M bbox | |M bbox | ,(7) To enhance training stability, we map the cover- age metricCinto a reward signal using a shaped sigmoid function. This design serves two purposes: (a) it suppresses noise from low-overlap predictions and (b) saturates for high-quality overlaps, thereby prioritizing the robust localization of forgeries over pixel-perfect alignment. The bounding box reward is formulated as: R bbox = 1 1 + e −k(C−τ) ,(8) wherekandτare hyperparameters controlling the reward sensitivity and threshold. 2. Reasoning Rewards. To ensure the model follows a logical reasoning path and arrives at an ac- curate conclusion, we decompose the task-related reward into two components: the formatting reward (R form ) and the classification reward (R clas ). R form incentivizes the model to adhere to the mandated Chain-of-Thought (CoT) structure (De- scription→ Analysis→ Conclusion): R form = X k∈K w k I(k ∈ y),(9) whereydenotes the generated text sequence, and K = “description”, “analysis”, “conclusion” represents the set of mandatory structural keywords. The indicator functionI(·)assigns a weightw k for each keyword present in the sequence, penalizing structural deviations. R clas evaluates the correctness of detection: R clas = w d I(ˆy = y gt )(10) whereˆyis the predicted label parsed from the gen- erated sequence,y gt is the ground truth, andw d is the weighting factor for prediction accuracy. The total reward is then formulated asR = R bbox + R form + R clas . This multi-faceted reward strategy explicitly incentivizes the model to “look” at the correct region before “reasoning” and “con- cluding”, thereby minimizing visual hallucinations and improving reasoning quality. 5 Experiments In this section, we conduct comprehensive empir- ical evaluations to validate MedForge-Reasoner’s detection performance, generalizability and reason- ing quality. Then, we perform ablation studies to verify the efficacy of our proposed contributions. 5.1 Experimental Setup SOTA Baselines. We benchmark our method against SOTA interpretable deepfake detectors, AIGC-Holmes (Zhou et al., 2025), SIDA (Huang et al., 2025b), FakeVLM (Wen et al., 2025). We also assess four SOTA generic MLLMs including Qwen3-VL-Flash (30B), Qwen3-VL-Plus (235B) (Bai et al., 2025) and Gemini 3 Flash, Gemini 3 Pro (Google DeepMind, 2025). Evaluation Metrics. Forgery Detection perfor- mance is evaluated via Accuracy and F1 and pre- sented in “Real”, “Forgery Implant” and “Forgery Removal”. To assess reasoning quality and visual hallucinations, we introduce MLLM-as-Judge met- ric using SOTA MLLMs. The judge scores gen- erated reasonings on a scale of 0-100% based on three criteria: (1) Logical Correctness: Whether the judgement is derived from the visual evidence. (2) Visual Hallucination: Whether the analysis matches the ground truth anomalies (e.g., matching the bbox) or fabricates. (3) Medical Profession- alism: Whether the terminology aligns with the expert guidelines. Detailed metric definitions are shown in Appendix B.3. Implementation Details.We utilize the con- structed MedForge-90K dataset for experiments. We randomly split the data into SFT, GSPO train- ing, and testing sets with a ratio of 5:1:3. Specif- ically, 50K samples are used for SFT cold-start, 10K for GSPO training, and 30K for testing. To ensure balanced evaluation, each split maintains a 1:1:1 ratio of Real, Lesion Implant, and Lesion Removal images. Additional training details re- garding model and baseline are elaborated in Ap- pendix B. 5.2 Main Results We report the main detection results in Table 1. To assess performance under both in-domain and out-of-distribution (OOD) conditions, we consider three following evaluation settings (corresponding to the table columns). (a) In-Domain: The detector is trained and tested on the full dataset, covering all forgery types and generator models. (b) Cross-Model: To test robustness to unseen generators, we exclude four advanced models from training, Nano-Banana, GPT-Image, Stable Diffu- sion 3.5 Medium, and XL-Inpainting, while evalu- ating on the default test set. (c) Cross-Forgery: To evaluate generalization to unseen manipulations, the training set excludes lesion implant samples (for both OOD cases, the test data follows the default setting). Targeting the generic MLLM baselines which are not trainable, we simulate the above settings by In Context Learning (ICL) (Dong et al., 2024). Specifically, we rely on ICL prompts to introduce different level of forgery detection knowledge to the MLLMs. Three levels of ICL prompts are cus- tomized to match the In-Domain, Cross-Forgery and Cross-Model setting. The In-Domain ICL pro- vides detection clues for all manipulation types. The Cross-Forgery ICL covers only Lesion Re- moval Forgeries, and the Cross-Model ICL ex- cludes unseen forgery models. See details in Ap- pendix B.1. As illustrated in Table 1, MedForge-Reasoner achieves SOTA performance across all settings. For In-Domain setting, our method achieves near- perfect detection, outperforming the strongest spe- cialized detector (SIDA-13B) by over 7.65% in average accuracy. Notably, MedForge-Reasoner demonstrates significant robustness in OOD sce- narios. While specialized detectors and generic MLLMs suffer noticeable performance degrada- tion when facing unseen forgeries or models, our method maintains a substantial lead, surpassing the best-performing baselines by 8.2% in Cross- Forgery and 10.0% in Cross-Model settings. This suggests that by explicitly training the model Methods RealForgery: ImplantForgery: RemoveAverage In-Domain Cross-Forgery Cross-ModelIn-Domain Cross-Forgery Cross-ModelIn-Domain Cross-Forgery Cross-ModelIn-Domain Cross-Forgery Cross-Model Accuracy Specialized Detectors SIDA-7B77.56 (↑10.27) 73.14 (↑8.03) 73.42 (↑8.93) 79.83 (↑4.49) 76.18 (↑0.94) 76.57 (↑1.77) 82.31 (↑17.26) 77.92 (↑11.43) 75.68 (↑9.98) 79.90 (↑10.67) 75.75 (↑6.80) 75.22 (↑6.89) SIDA-13B89.37 (↑22.08) 85.68 (↑20.57) 84.25 (↑19.76) 91.52 (↑16.18) 87.24 (↑12.00) 85.86 (↑11.06) 93.84 (↑28.79) 90.17 (↑23.68) 86.53 (↑20.83) 91.58 (↑22.35) 87.70 (↑18.75) 85.55 (↑17.22) FakeVLM86.48 (↑19.19) 81.86 (↑16.75) 76.94 (↑12.45) 88.93 (↑13.59) 83.57 (↑8.33) 79.82 (↑5.02) 91.27 (↑26.22) 86.35 (↑19.86) 82.51 (↑16.81) 88.89 (↑19.66) 83.93 (↑14.98) 79.76 (↑11.43) AIGC-Holmes90.24 (↑22.95) 86.53 (↑21.42) 84.37 (↑19.88) 88.12 (↑12.78) 84.46 (↑9.22) 80.91 (↑6.11) 90.58 (↑25.53) 90.64 (↑24.15) 87.23 (↑21.53) 89.65 (↑20.42) 87.21 (↑18.26) 84.17 (↑15.84) Generic MLLMs Qwen3VL-Flash57.60 (↓9.69) 55.50 (↓9.61) 54.90 (↓9.59) 47.83 (↓27.51) 50.47 (↓24.77) 50.93 (↓23.87) 54.17 (↓10.88) 54.17 (↓12.32) 54.61 (↓11.09) 53.20 (↓16.03) 53.38 (↓15.57) 53.48 (↓14.85) Qwen3VL-Plus 54.14 (↓13.15) 54.28 (↓10.83) 55.10 (↓9.39) 57.42 (↓17.92) 55.78 (↓19.46) 56.03 (↓18.77) 55.80 (↓9.25) 55.86 (↓10.63) 56.10 (↓9.60) 55.79 (↓13.44) 55.31 (↓13.64) 55.74 (↓12.59) Gemini3-Flash71.26 (↑3.97) 73.39 (↑8.28) 72.57 (↑8.08) 57.33 (↓18.01) 62.46 (↓12.78) 60.14 (↓14.66) 57.14 (↓7.91) 62.27 (↓4.22) 60.34 (↓5.36) 61.91 (↓7.32) 66.04 (↓2.91) 64.35 (↓3.98) Gemini3-Pro67.29 65.11 64.4975.34 75.24 74.8065.05 66.49 65.7069.23 68.95 68.33 MedForge-Reasoner99.24 (↑31.95) 95.24 (↑30.13) 92.86 (↑28.37) 99.24 (↑23.90) 93.39 (↑18.15) 94.86 (↑20.06) 99.21 (↑34.16) 99.15 (↑32.66) 94.09 (↑28.39) 99.23 (↑30.00) 95.93 (↑26.98) 93.94 (↑25.61) F1 Score Specialized Detectors SIDA-7B76.84 (↑15.02) 72.47 (↑9.83) 67.73 (↑5.51) 86.47 (↑12.25) 74.06 (↑2.53) 69.85 (↓1.17) 81.64 (↑22.17) 77.28 (↑19.66) 72.94 (↑16.75) 81.65 (↑16.48) 74.60 (↑10.67) 70.17 (↑7.03) SIDA-13B88.69 (↑26.87) 84.95 (↑22.31) 80.58 (↑18.36) 90.86 (↑16.64) 86.57 (↑15.04) 83.17 (↑12.15) 93.18 (↑33.71) 89.46 (↑31.84) 85.87 (↑29.68) 90.91 (↑25.74) 86.99 (↑23.06) 83.21 (↑20.07) FakeVLM85.73 (↑23.91) 81.18 (↑18.54) 76.29 (↑14.07) 88.27 (↑14.05) 82.86 (↑11.33) 79.16 (↑8.14) 90.58 (↑31.11) 85.67 (↑28.05) 81.84 (↑25.65) 88.19 (↑23.02) 83.24 (↑19.31) 79.10 (↑15.96) AIGC-Holmes88.57 (↑26.75) 85.84 (↑23.20) 86.68 (↑24.46) 90.46 (↑16.24) 88.73 (↑17.20) 84.25 (↑13.23) 89.82 (↑30.35) 85.97 (↑28.35) 83.58 (↑27.39) 89.62 (↑24.45) 86.85 (↑22.92) 84.84 (↑21.70) Generic MLLMs Qwen3VL-Flash32.48 (↓29.34) 38.62 (↓24.02) 40.26 (↓21.96) 55.08 (↓19.14) 53.70 (↓17.83) 52.69 (↓18.33) 63.13 (↑3.66) 59.51 (↑1.89) 58.78 (↑2.59) 50.23 (↓14.94) 50.61 (↓13.32) 50.58 (↓12.56) Qwen3VL-Plus47.73 (↓14.09) 46.36 (↓16.28) 46.18 (↓16.04) 54.70 (↓19.52) 53.91 (↓17.62) 54.99 (↓16.03) 52.42 (↓7.05) 54.26 (↓3.36) 55.32 (↓0.87) 51.62 (↓13.55) 51.51 (↓12.42) 52.16 (↓10.98) Gemini3-Flash24.42 (↓37.40) 41.14 (↓21.50) 34.78 (↓27.44) 70.22 (↓4.00) 72.05 (↑0.52) 71.11 (↑0.09) 70.07 (↑10.60) 71.91 (↑14.29) 71.34 (↑15.15) 54.90 (↓10.27) 61.70 (↓2.23) 59.08 (↓4.06) Gemini3-Pro61.82 62.64 62.2274.22 71.53 71.0259.47 57.62 56.1965.17 63.93 63.14 MedForge-Reasoner98.86 (↑37.04) 93.29 (↑30.65) 92.07 (↑29.85) 98.86 (↑24.64) 92.97 (↑21.44) 94.63 (↑23.61) 99.21 (↑39.74) 99.14 (↑41.52) 93.76 (↑37.57) 98.98 (↑33.81) 95.13 (↑31.20) 93.49 (↑30.35) Table 1: Main Experiment - Forgery detection on MedForge-90K dataset. Methods are benchmarked against the Gemini 3 Pro, with arrows indicating performance differences (↑/↓) relative to it. Bold indicates the best result, and underlinedenotes the second-best. MLLM-as-Judge Gemini 3 Pro (%)Qwen3-VL-Plus (%) LCVH MP Avg.LCVH MP Avg. SIDA-7B34.6 27.9 54.3 38.971.3 53.4 78.5 67.7 SIDA-13B40.2 32.6 61.6 44.875.6 57.7 82.1 71.8 FakeVLM48.0 53.0 45.0 48.750.0 55.0 48.0 51.0 AIGC-Holmes55.0 60.0 58.0 57.758.0 62.0 57.0 59.0 Qwen3-VL-Flash68.2 57.3 85.9 70.587.6 73.9 91.0 84.2 Qwen3-VL-Plus69.7 59.1 84.1 71.091.9 81.1 95.9 89.6 Gemini 3 Flash71.2 59.0 85.0 71.787.4 73.7 91.3 84.1 Gemini 3 Pro75.7 66.4 86.6 76.291.9 81.1 95.9 89.6 Proposed (w/o GSPO)71.666.283.173.691.177.794.287.7 Proposed (w/ GSPO)71.167.483.273.993.379.997.590.2 Table 2: Evaluation of reasoning quality via MLLM- as-Judge. We report Logical Correctness (LC), Visual Hallucination (VH), Medical Professionalism (MP), and their Average score in percentage (%). Gray rows high- light the contribution of Forgery-aware GSPO. to ground its reasoning in visual anomalies (via GSPO), MedForge-Reasoner learns generic traces of tampering (e.g., edge inconsistencies, noise arti- facts) rather than overfitting to specific lesion pat- terns or generator fingerprints. Such generalizabil- ity guarantees MedForge-Reasoner to be applicable in real-world forgery defense. 5.3 Reasoning Quality MedForge-Reasoner provides a visually grounded reasoning for detection judgements.Figure 4 shows a comparison of reasoning outcomes of MedForge-Reasoner and SOTA baselines where MedForge-Reasoner achieves a clear advantage in providing hallucination-free and professional forgery explanations. We further quantitatively evaluate the quality of forgery explanations of all baselines in Table 2. To ensure a fair comparison, we randomly select 100 forgery samples where all models provide correct detections in the In-Domain setting. The evaluation reveals that, in terms of reason- ing quality, MedForge-Reasoner outperforms the best forgery detectors (AIGC-Holmes) by 16.2% and 31.2% in terms of Gemini and Qwen judge. By incorporating the proposed GSPO, our model achieves a leading average Judge Score of 90.2% under Qwen3-VL-Plus and a competitive 73.9% under Gemini 3 Pro, outperforming the strongest baseline in the former case. Notably, the GSPO module provides a substantial boost to reasoning quality, increasing the average score by up to 2.5 percentage points compared to the version without GSPO. MedForge-Reasoner demonstrates superior performance in Logical Correctness and Medical Professionalism, while achieving a significant re- duction in Visual Hallucination, with scores reach- ing 79.9% and 67.4% under the two judges respec- tively. This confirms that Forgery-aware GSPO effectively enforces visually grounded reasoning, ensuring the textual output is grounded in visual reality and aligns with medical expertise. SettingAcc (%) F1 (%) IoU Judge Score (A) Contribution of Reasoning Components Binary Classification99.4299.31-- w/o Reasoning99.3199.100.30- w/o Bbox Grounding99.3198.97-53.9 Proposed99.2398.980.3190.2 (B) Efficacy of Optimization Strategies SFT Cold-Start Only98.2098.400.3087.4 GSPO w/o R bbox 99.0198.840.2989.6 GSPO w/o R form 99.1398.980.3090.1 Proposed99.2398.980.3190.2 (C) Scalability across MLLM Backbones InternVL3.5-8B96.9297.660.3285.8 Qwen2.5-VL-7B93.1794.690.3380.4 MimoVL-7B92.2693.910.3279,1 Qwen3-VL-8B (Ours)99.2398.980.3190.2 Table 3: Ablation studies on model components, opti- mization strategies, and backbone architectures. 5.4 Ablation Studies In this section, we conduct extensive ablation stud- ies to validate the effectiveness of the proposed architecture and training strategies. To quantify the precision of forgery localization, we additionally re- port the Intersection over Union (IoU) between the predicted and ground-truth bounding boxes. The ablation studies consist of three parts: Part (A) decomposes the model’s response components to assess the necessity of localization and textual ra- tionale; Part (B) isolates the benefits of the specific GSPO training objectives; and Part (C) tests the scalability and robustness of our method across different model architectures. Note that the reason- ing quality is evaluated using the Qwen3-VL-Plus judge as described in Section 5.3. Impact of Response Components. As shown in Table 3 the non-explainable output Binary Classification and w/o Reasoning have the high- est detection performance, suggesting that the forgery bounding boxes and textual rationales might slightly interfere with the model’s pure decision performance. However, as discussed, black box classification is insufficient for clinical reliability and trustworthy judgment. Crucially, while the w/o Bbox Grounding setting achieves marginally higher accuracy (+0.08%) than the pro- posed method, its Judge Score collapses to 53.9%. This discrepancy reveals that without explicit spa- tial supervision, the model tends to "hallucinate" justifications, correctly classifying images but for incorrect or non-verifiable reasons. The Proposed method achieves the highest Judge Score and IoU with small accuracy trade-off (<0.2%), showing that MedForge-Reasoner successfully formulates a black-box detection task into interpretable reason- ing grounded with factual visual evidence. Efficacy of GSPO Optimization. Part B disen- tangles the contributions of our training objectives. Although the SFT Cold-Start establishes a strong baseline with 98.20% accuracy, it lags in reasoning quality. Incorporating the proposed GSPO signif- icantly boosts performance. Specifically, remov- ing the spatial reward (GSPO w/oR bbox ) results in a 0.02 decrease in IoU, verifying thatR bbox is essential for forgery localization. Similarly, remov- ing the format reward (GSPO w/oR form ) leads to a slight degradation in accuracy (99.13% vs 99.23%), affecting the logical coherence of the output. The full GSPO framework achieves the best balance, yielding the highest Judge Score of 90.2 and Accu- racy of 99.23%. Scalability across MLLM Backbones. In Part C, we assess the robustness of our method across different architectures.While InternVL3.5-8B shows competitive performance (96.92% Acc), our Qwen3-VL-8B based model outperforms it by over 2.3%. Interestingly, although Qwen2.5-VL-7B achieves the highest raw IoU (0.33), its reasoning capability is significantly weaker, evidenced by a low Judge Score of 80.4% and Accuracy of 93.17%. Our proposed method, leveraging the Qwen3-VL backbone, successfully bridges this gap, offering the optimal trade-off between geometric precision and semantic reasoning. 6 Conclusion In this work, we presented a framework to safe- guard the trustworthiness of medical imaging against the evolving threat of advanced deepfakes. We established MedForge-90K, the first large- scale medical forgery benchmark with high-fidelity lesion manipulations granularly annotated with expert-guided reasoning. Addressing the limi- tations of black-box detectors and hallucination- prone MLLMs, we proposed MedForge-Reasoner, a novel detector capable of pre-hoc reasoning. By introducing the Forgery-aware GSPO, we success- fully aligned the model’s textual outputs with fac- tual visual evidence, explicitly enforcing the de- tector to localize anomalies before reasoning. Ex- tensive experiments demonstrate that our approach not only achieves state-of-the-art detection perfor- mance across unseen forgeries and architectures but also provides clinically rigorous, hallucination- free explanations. We hope this work bridges the gap between AI-driven forgery detection and clini- cal interpretability, offering a trustworthy solution for high-stakes healthcare environments. 7 Limitations We discuss two main limitations of our work. First, MedForge-90K currently focuses on three common 2D imaging modalities: chest X-ray, brain MRI, and fundus photography. Although our framework is not modality-specific in principle, extending the benchmark to additional modalities (e.g., CT and ultrasound) and their corresponding forgery pat- terns would improve coverage of real-world clinical settings. Second, our reasoning and explanations are generated in English, consistent with most prior work. This choice limits the usability of MedForge- Reasoner in non-English clinical environments. A natural direction for future work is to support multi- lingual explanations, enabling broader deployment across global healthcare contexts. Third, while MedForge-Reasoner is designed as a trustworthy medical deepfake detector, it could potentially be misused for malicious purposes, such as improving forgery techniques to evade detection. It is there- fore necessary to enforce responsible usage for our released models. References Saleh Albahli and Marriam Nawaz. 2024. Mednet: Medical deepfakes detection using an improved deep learning approach. Multimedia Tools and Applica- tions, 83(16):48357–48375. Alaa Alsaheel, Reem Alhassoun, Reema Alrashed, Noura Almatrafi, Noura Almallouhi, and Saleh Al- bahli. 2023. Deep fakes in healthcare: How deep learning can help to detect forgeries. Computers, Materials Continua, 76:2461–2482. Ehsan Amiri, Ahmad Mosallanejad, and Amir Sheikhah- madi. 2024. The optimal model for copy-move forgery detection in medical images. Journal of Med- ical Signals Sensors, 14(2):5. Shuai Bai, Yuxuan Cai, Ruizhe Chen, et al. 2025.Qwen3-vl technical report.Preprint, arXiv:2511.21631. Saahil Chadha, David Weiss, Anastasia Janas, Divya Ra- makrishnan, Thomas Hager, Klara Osenberg, Klara Willms, Joshua Zhu, Veronica Chiang, Spyridon Bakas, et al. 2025. An 11,000-study open-access dataset of longitudinal magnetic resonance images of brain metastases. arXiv preprint arXiv:2506.14021. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Mar- cel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al. 2025. Gemini 2.5: Pushing the frontier with ad- vanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv preprint arXiv:2507.06261. Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Jingyuan Ma, Rui Li, Heming Xia, Jingjing Xu, Zhiyong Wu, Baobao Chang, et al. 2024. A survey on in-context learning. In Proceedings of the 2024 conference on empirical methods in natural language processing, pages 1107–1128. Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Do- minik Lorenz, Axel Sauer, Frederic Boesel, et al. 2024. Scaling rectified flow transformers for high- resolution image synthesis. In Forty-first interna- tional conference on machine learning. Yueying Gao, Dongliang Chang, Bingyao Yu, Hao- tian Qin, Lei Chen, Kongming Liang, and Zhanyu Ma. 2025. Fakereasoning: Towards generalizable forgery detection and reasoning. arXiv preprint arXiv:2503.21210. Google DeepMind. 2025. Gemini 3 Pro Model. urlhttps://deepmind.google/models/gemini/pro/. Accessed on 26 December 2025. Pengfei Guo, Can Zhao, Dong Yang, Ziyue Xu, Vish- wesh Nath, Yucheng Tang, Benjamin Simon, Mason Belue, Stephanie Harmon, Baris Turkbey, et al. 2025. Maisi: Medical ai for synthetic imaging. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 4430–4441. IEEE. Chia-Chi Hsu, Min-Yan Tsai, and Chia-Mu Yu. 2025. Securing healthcare data integrity: Deepfake detec- tion using autonomous ai approaches. IEEE journal of biomedical and health informatics. Wen Huang, Hongbin Liu, Minxin Guo, and Neil Gong. 2024. Visual hallucinations of multi-modal large language models. In Findings of the Association for Computational Linguistics: ACL 2024, pages 9614– 9631. Yi Huang, Jiancheng Huang, Yifan Liu, Mingfu Yan, Jiaxi Lv, Jianzhuang Liu, Wei Xiong, He Zhang, Liangliang Cao, and Shifeng Chen. 2025a. Diffu- sion model-based image editing: A survey. IEEE Transactions on Pattern Analysis and Machine Intel- ligence. Zhenglin Huang, Jinwei Hu, Xiangtai Li, Yiwei He, Xingyu Zhao, Bei Peng, Baoyuan Wu, Xiaowei Huang, and Guangliang Cheng. 2025b. Sida: Social media image deepfake detection, localization and ex- planation with large multimodal model. In Proceed- ings of the Computer Vision and Pattern Recognition Conference, pages 28831–28841. Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os- trow, Akila Welihinda, Alan Hayes, Alec Radford, et al. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276. Alistair EW Johnson, Tom J Pollard, Lu Shen, Li-wei H Lehman, Mengling Feng, Mohammad Ghassemi, Benjamin Moody, Peter Szolovits, Leo Anthony Celi, and Roger G Mark. 2016. Mimic-i, a freely accessi- ble critical care database. Scientific data, 3(1):1–9. Black Forest Labs, Stephen Batifol, Andreas Blattmann, Frederic Boesel, Saksham Consul, Cyril Diagne, Tim Dockhorn, Jack English, Zion English, Patrick Esser, Sumith Kulal, Kyle Lacey, Yam Levi, Cheng Li, Dominik Lorenz, Jonas Müller, Dustin Podell, Robin Rombach, Harry Saini, Axel Sauer, and Luke Smith. 2025. Flux.1 kontext: Flow matching for in- context image generation and editing in latent space. Preprint, arXiv:2506.15742. Ning Li, Tao Li, Chunyu Hu, Kai Wang, and Hong Kang. 2020. A benchmark of ocular disease intelligent recognition: One shot for multi-disease detection. In International symposium on benchmarking, measur- ing and optimization, pages 177–193. Springer. Shuaibo Li, Zhaohu Xing, Hongqiu Wang, Pengfei Hao, Xingyu Li, Zekai Liu, and Lei Zhu. 2025. To- ward medical deepfake detection: A comprehensive dataset and novel method. In International Confer- ence on Medical Image Computing and Computer- Assisted Intervention, pages 626–637. Springer. William A Malila. 1980. Change vector analysis: An approach for detecting forest changes with landsat. In LARS symposia, page 385. Saman Motamed, Patrik Rogalla, and Farzad Khalvati. 2021. Data augmentation using generative adversar- ial networks (gans) for gan-based detection of pneu- monia and covid-19 in chest x-ray images. Informat- ics in medicine unlocked, 27:100779. Msoud Nickparvar. 2021. Brain tumor mri dataset. Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. 2023. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952. Team Seedream, Yunpeng Chen, Yu Gao, Lixue Gong, Meng Guo, Qiushan Guo, Zhiyao Guo, Xiaoxia Hou, Weilin Huang, Yixuan Huang, et al. 2025. Seedream 4.0: Toward next-generation multimodal image gen- eration. arXiv preprint arXiv:2509.20427. Lorenzo Stacchio. 2023. Train stable diffusion for in- painting. Laura Stroebel, Mark Llewellyn, Tricia Hartley, Tsui Shan Ip, and Mohiuddin Ahmed. 2023. A sys- tematic literature review on the effectiveness of deep- fake detection techniques. Journal of Cyber Security Technology, 7(2):83–113. Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. 2024. Rethinking the up-sampling operations in cnn-based generative network for generalizable deepfake detection. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 28130–28139. Hao Tan, Jun Lan, Zichang Tan, Ajian Liu, Chuan- biao Song, Senyuan Shi, Huijia Zhu, Weiqiang Wang, Jun Wan, and Zhen Lei. 2025. Veritas: Generaliz- able deepfake detection via pattern-aware reasoning. arXiv preprint arXiv:2508.21048. Lehan Wang, Chongchong Qi, Chubin Ou, Lin An, Mei Jin, Xiangbin Kong, and Xiaomeng Li. 2024. Multi- eye: Dataset and benchmark for oct-enhanced retinal disease recognition from fundus images. IEEE Trans- actions on Medical Imaging. Siwei Wen, Junyan Ye, Peilin Feng, Hengrui Kang, Zichen Wen, Yize Chen, Jiang Wu, Wenjun Wu, Conghui He, and Weijia Li. 2025. Spot the fake: Large multimodal model-based synthetic image de- tection with artifact explanation. arXiv preprint arXiv:2503.14905. Chenfei Wu, Jiahao Li, Jingren Zhou, Junyang Lin, Kaiyuan Gao, Kun Yan, Sheng-ming Yin, Shuai Bai, Xiao Xu, Yilei Chen, et al. 2025. Qwen-image tech- nical report. arXiv preprint arXiv:2508.02324. Zhipei Xu, Xuanyu Zhang, Runyi Li, Zecheng Tang, Qing Huang, and Jian Zhang. 2025. Fakeshield: Ex- plainable image forgery detection and localization via multi-modal large language models. In International Conference on Learning Representations. Ziyin Zhou, Yunpeng Luo, Yuanchen Wu, Ke Sun, Jiayi Ji, Ke Yan, Shouhong Ding, Xiaoshuai Sun, Yun- sheng Wu, and Rongrong Ji. 2025. Aigi-holmes: Towards explainable and generalizable ai-generated image detection via multimodal large language mod- els. arXiv preprint arXiv:2507.02664. AMedForge-90K Implementation Details To construct high-fidelity and anatomically plausi- ble medical forgeries, we implemented a rigorous pipeline involving automated prompt engineering and diverse image generation models. This section details the specific implementations of the prompt generation, the iterative refinement loop, and the generator models used. A.1 Data Collection To ensure the authenticity of the source material and the clinical relevance of the forgeries, we cu- rated a diverse collection of 30,000 high-resolution medical images from public benchmarks. As de- tailed below, our collection spans three distinct imaging modalities, covering a total of 19 specific pathologies and their corresponding healthy con- trols. Chest X-Ray (CXR) We sourced frontal-view radiographs from the MIMIC-CXR dataset (John- son et al., 2016). To facilitate precise lesion re- moval and implantation, we specifically filtered for scans annotated with exactly one positive pathol- ogy. The subset includes 11 distinct thoracic con- ditions: Atelectasis, Cardiomegaly, Consolidation, Pulmonary Edema, Enlarged Cardiomediastinum, Rib Fracture, Lung Lesion, Lung Opacity, Pleural Effusion, Pneumonia, and Pneumothorax. Healthy control images were selected from the No Finding category. Brain MRI Magnetic Resonance Imaging data was sourced from the Brain Tumor Classification dataset (Nickparvar, 2021) and Yale-Brain (Chadha et al., 2025). We focused on contrast-enhanced MRI scans, organizing them into 3 specific tumor typologies: Glioma, Meningioma, and Pituitary Tumor. A corresponding set of healthy brain scans was collected under the Healthy Control (No Tu- mor) category to serve as the baseline for tumor implantation tasks. Fundus Photography Retinal images were col- lected from the ODIR-5K (Ocular Disease Intel- ligent Recognition) dataset (Li et al., 2020) and MultiEYE (Wang et al., 2024). We categorized the data into 5 major ocular pathologies based on the diagnostic labels: Age-related Macular Degen- eration (AMD), Diabetic Retinopathy, Glaucoma, Hypertensive Retinopathy, and Pathological My- opia. The Normal category was used for healthy reference images. Preprocessing To ensure compatibility with high-fidelity diffusion models, all raw images un- derwent a standardization pipeline. Images were resized and padded to a uniform resolution of 1024 × 1024pixels, strictly preserving the orig- inal aspect ratio to maintain anatomical integrity before being fed into the forgery generation loop. A.2 Forgery Prompt Generation To guide the image editing models in performing precise lesion manipulation, we utilize a Large Lan- guage Model (Gemini 2.5 Pro) acting as the Writer. The goal is to translate medical tasks (e.g., “Im- plant Pleural Effusion” or “Remove Brain Tumor”) into natural language instructions understandable by text-guided image editing models. The generation process adheres to three critical constraints to ensure the output is realistic and un- detectable as a deepfake: 1. Fidelity Preservation: The prompt must ex- plicitly instruct the editor to preserve origi- nal image noise, grain texture, and contrast, avoiding alterations to device artifacts or an- notations. 2.Negative Rules: We enforce strict negative constraints, forbidding the addition of text, labels, or unnatural sharp boundaries. 3. Minimal Change Principle (Counterfactual Minimality): The prompt emphasizes modi- fying only the pixels necessary for the pathol- ogy, leaving the background and surrounding anatomy untouched. For Lesion Implant, the system instruction pro- vided to the Writer is: Lesion Implant Prompt Generation “You are a medical image editing expert. Generate a clear, concise prompt to edit a normal [Modality] image to show [Disease]. [...] Critical Constraints - Fidelity Preservation: Preserve original image noise, grain texture, and contrast. Do not alter device arti- facts... Critical Constraints - Minimal Change Princi- ple: Only modify areas directly related to [Disease]. Keep all other anatomical structures unchanged... Add a clear warning: do not edit any element other than adding the disease feature. Keep everything else in the image exactly the same.” For Lesion Removal, the instruction shifts to de- scribing the removal of specific anomalies without leaving inpainting traces: Lesion Removal Prompt Generation “Generate a clear, concise prompt to edit a [Modality] image showing [Disease] to make it appear normal (healthy). [...] The prompt should not include any medical-related terms... and only describe the direct modifications in the simplest way (e.g., ’delete the white rounded shape’). The prompt should focus on locating the lesion and describing the boundary... and not specify the replacement content.” A.3 Forgery Prompt Refinement Initial prompts often fail to produce medically ac- curate or visually seamless results. To address this, we implement a Writer-Editor-Diagnoser feedback loop. The Verification Loop (Diagnoser) In each it- eration, the Editor generates a candidate image. A Diagnoser (Gemini 2.5 Pro) then performs a pixel-level side-by-side comparison between the original and the forged image to ensure the pathol- ogy is added/removed correctly without affecting the background. The specific instruction used for this verification is: Forgery Verification Instruction “You are a medical image verification expert. You are given two images: 1. Original image ... 2. Edited image ... Your task is to verify the editing quality by comparing the two images side-by-side. Critical Verification - Minimal Change Principle: Compare the original and edited images carefully. The editing should only modify the disease-related regions. Check: - Are non-disease areas (background, other anatomical structures, imaging artifacts) iden- tical? - Does the edited version preserve the exact same imaging characteristics (noise, grain, contrast)? Check these aspects: 1. Has disease: Does the edited image show signs of [Disease]? 2. Structure reason- able: Are the anatomical structures reasonable and correct? 3. Looks realistic: Does the edited image look like a real medical image? 4. Minimal changes preserved: Are changes limited only to disease areas? Return your evaluation in this JSON format: "qual- ified": true/false, "reason": "..." ” The Prompt Refinement (Writer) If the ver- ification fails (e.g., due to artifacts or incorrect anatomy), the execution history and failure reasons are fed back to the Writer. The Writer is then prompted to analyze the previous failures and gen- erate an improved prompt. The instruction for this refinement step is: Forgery Prompt Refinement Instruction “You are a medical image editing expert. Multiple previous editing attempts have failed. You need to analyze ALL previous attempts and generate a BET- TER prompt. History of all previous attempts: [History Log] Looking at the ORIGINAL image and analyzing the patterns of failures above, generate an IMPROVED editing prompt. ANALYSIS REQUIREMENTS: 1. Identify common issues across multiple attempts 2. Learn from what didn’t work in previous rounds 3. Avoid repeating the same mistakes [...] (Standard constraints on Fidelity Preservation and Minimal Change Principle are repeated here) Return ONLY the editing prompt in English, no ex- planations.” This loop repeats for up to 5 rounds. Only im- ages that pass the strict verification criteria (“quali- fied”: true) are included in the final MedForge-90K dataset. A.4 Forgery Generation Once the prompts are refined and validated, we employ a diverse ensemble of 10 state-of-the-art image editing and generation models to construct the final MedForge-90K dataset. Using a wide range of architectures prevents the detector from overfitting to specific generator artifacts (e.g., spe- cific noise patterns of a single diffusion model).The models utilized are categorized as follows: Diffusion-based Inpainting ModelsThese mod- els require a mask (derived from the Nano-Banana coordinates) and the refined text prompt to regener- ate specific regions. •Stable Diffusion Inpainting (SD-v1.5): A baseline latent diffusion model specialized for mask-based editing (Stacchio, 2023). • Stable Diffusion XL (SDXL) Inpainting 0.1: A larger scale model (2.6B parameters) ca- pable of generating higher resolution details and better texture matching in medical scans (Podell et al., 2023). Advanced Diffusion-based Image Editing Mod- elsThese models perform instruction-based edit- ing without needing explicit masks, relying on the refined prompts to localize and modify content. • FLUX.1-dev: A 12B parameter rectified flow transformer model. It is chosen for its supe- rior prompt adherence and ability to generate high-frequency details (noise/grain) crucial for medical realism (Labs et al., 2025). •Stable Diffusion 3.5 Large: The latest Multi- modal Diffusion Transformer (MMDiT) from Stability AI, offering state-of-the-art concep- tual understanding of complex prompts (Esser et al., 2024). • Stable Diffusion 3.5 Medium: A distilled ver- sion of SD3.5, providing a variation in genera- tion artifacts to test detector robustness against model compression traces (Esser et al., 2024). Proprietary & Large-Scale MMDiT Image Edit- ing ModelsWe also utilize closed-source or spe- cialized APIs to capture the distribution of com- mercial deepfake tools. •GPT-Image: Accessed via OpenAI API. Known for high semantic understanding, used primarily for complex lesion removal tasks where context reasoning is required (Hurst et al., 2024). •Gemini-2.5-Flash-Image (Nano-Banana): Accessed via Google GenAI API. Utilized for its strong instruction-following capabilities in medical contexts (Comanici et al., 2025). •Qwen-Image-Edit: Based on the Qwen- Image architecture, this model integrates vi- sual understanding with generation, allowing for precise editing based on visual cues (Wu et al., 2025). It stands out as the best open- sourced image editors currently, making it a necessity to be evaluated on medical forgery detection. •Seeddream 4.0: A high-performance multi- modal image generation model designed for high-consistency semantic editing, minimiz- ing changes to the background (Seedream et al., 2025). Seedream 4.0 is pretrained on billions of text-image pairs spanning diverse taxonomies and knowledge-centric concepts, making it suitable for high quality medical forgeries. This ensemble ensures that MedForge-90K cov- ers the spectrum from open-source latent diffu- sion models to proprietary transformer-based gen- erators, representing a comprehensive threat land- scape. A.5 Reasoning Annotation To equip MedForge-90K with granular and clin- ically grounded explanations, we developed an automated annotation pipeline utilizing advanced MLLMs (Gemini 2.5 Pro). Unlike standard cap- tioning tasks, our pipeline employs a Hierarchical Guideline-Driven Reasoning strategy. This mech- anism enforces the model to scrutinize images not merely through visual perception, but through a three-tiered cognitive framework derived directly from our expert guidelines (detailed in Section A.6): •Level 1: Image Physics & Texture. Detect- ing low-level anomalies such as "sticker" arti- facts, unnatural noise distribution, or inpaint- ing smudges that violate the physical proper- ties of medical imaging. • Level 2: Anatomical Structure. Verifying morphological correctness, such as the conti- nuity of vascular networks in fundus photog- raphy or the symmetry of gyri in brain MRI. •Level 3: Pathological Logic. Checking high- level biological interconnectivity to ensure lesions exhibit necessary secondary effects (e.g., mass effect, edema, chronological pro- gression) rather than appearing in biological isolation. Annotation for Authentic Images For real im- ages, the pipeline shifts to validating Biologi- cal Consistency. The prompt directs the MLLM to confirm the *satisfaction* of the hierarchical logic—verifying that noise patterns are stochastic, anatomy is continuous, and pathological signs fol- low a natural progression. This ensures the detector learns the logic of authenticity, distinct from the features of forgery. Annotation for Forged Images For images in the Lesion Implant and Removal categories, the annotation is spatially grounded using the ground- truth manipulation mask to trigger this hierarchical analysis: 1.Bbox Extraction: We extract bounding box coordinatesb = [x 1 ,y 1 ,x 2 ,y 2 ]from the bi- nary manipulation mask. 2.Hierarchical Prompting: We construct a prompt that explicitly informs the MLLM of the forgery location. Crucially, we inject the specific Expert Forgery Guidelines into the prompt context. The model is instructed to analyze image area withinbspecifically for violations across the three logic levels defined above. Hierarchical Forgery Reasoning Prompt Template System: This is a medical deepfake image. The bounding box[y min ,x min ,y max ,x max ]indicates the location of the deepfake region. Task: Analyze why this image is a deepfake by systematically ap- plying the Medical Deepfake Detection Guidelines provided below. Requirements: 1. Location: Out- put the coordinates in<box>format. 2. Description: Briefly describe the image modality and features. 3. Key Explanation: Identify anomalies following the hierarchical logic: - Physics: Are there noise/texture artifacts or sharp boundaries? - Anatomy: Are struc- tures morphologically incorrect? - Pathology: Are biological secondary signs missing (e.g., lack of mass effect)? 4. Conclusion: Definitive statement of forgery. Context: [Injected Modality-Specific Guide- lines from Section A.6] A.6 Medical Deepfake Detection Guidelines To ensure the reasoning annotations described above align with clinical expertise, we formulated a comprehensive set of detection criteria. These guidelines serve as the "ground truth logic" injected into the annotation prompts. A.6.1 General Principles This section applies to all medical imaging modali- ties, focusing on the failure of AI forgery to repli- cate "Biological Interconnectivity" and "Physical Consistency". Biological Plausibility & Secondary Effects •Mass Effect Absence: Real lesions are phys- ical objects that displace tissue. Reject if a space-occupying lesion exists without corre- sponding compression, displacement, or mid- line shift. •Lack of Host Reaction: The body reacts to pathology. Reject if an aggressive lesion ap- pears "isolated" with a sharp boundary and no surrounding edema or infiltration. •Chronological Inconsistency: Diseases fol- low a timeline. Reject if late-stage features appear without precursor signs (e.g., neovas- cularization without ischemia). Image Physics & Texture Consistency • The "Sticker" Artifact: Reject if the lesion- background interface is unnaturally sharp, lacking the gradual transition zone of biologi- cal tissues. •Noise Distribution Analysis: Reject if the noise pattern (grain) within the lesion is sig- nificantly smoother or different in texture com- pared to the surrounding unaffected tissue. •Inpainting Artifacts: In removal cases, look for "smudging," blurring, or repetitive cloning patterns that disrupt natural stochastic texture. A.6.2 Modality-Specific Principles These criteria address the specific anatomical and structural logic required for each imaging type. Brain MRI • Anatomical Logic: Sulci adjacent to a mass should be effaced. The ventricular system must be symmetrical unless physically dis- placed. Large unilateral masses must cause a contralateral midline shift. •Signal Intensity: Peritumoral edema must follow correct signal intensity (e.g., Hyper- intense on T2/FLAIR). Lesions must match specific signatures (e.g., Meningiomas require a "Dural Tail"). •Multi-Sequence Consistency: Lesion appear- ance must logically translate across sequences (e.g., fluid is bright on T2, dark on T1). Fundus Photography •Vascular Logic: Vessels must taper gradually from the optic disc to the periphery without discontinuities. The Artery/Vein (A/V) ratio must be consistent. •Lesion Distribution: Diabetic lesions usually spare the extreme periphery initially. Drusen must be concentrated in the Macula. Macular exudates should form a "Star" pattern due to Henle’s fiber layer. • Global Physics: The image must exhibit nat- ural vignetting (posterior pole brighter than periphery). Chest X-Ray (CXR) •3D Projection Logic: Lung markings must correctly overlap with ribs/heart. Skeletal structures (rib count, clavicle shape) must be anatomically correct. •Density Gradient: Adherence to the density ladder (Air<Fat<Bone). Vascular markings should be more prominent in lower zones due to gravity. •Secondary Signs: Atelectasis must show vol- ume loss (elevated diaphragm). Cardiomegaly should manifest with pulmonary congestion. B Experiment Settings B.1 Baselines: Generic MLLM To evaluate the zero-shot and in-context reasoning capabilities of state-of-the-art models in medical deepfake detection, we employ four representative Multi-modal Large Language Models (MLLMs). These include the Qwen3-VL series and the Gem- ini 3 series, known for SOTA image understanding and reasoning abilities. B.1.1 Model Settings All models are accessed via their respective official APIs to ensure reproducibility. The specific models and their configurations are as follows: •Qwen3-VL-Flash & Qwen3-VL-Plus: Ac- cessed via requesting Qwen API. •Gemini 3 Flash & Gemini 3 Pro: Accessed via the Google Generative AI (GenAI) SDK. For all API calls, we set thetemperatureto0.1to minimize stochasticity and encourage determinis- tic, logical outputs. The maximal output tokens is set to1024to accommodate the detailed judgement explanations. B.1.2 In Context Learning Prompts We design three distinct levels of In-Context Learn- ing (ICL) prompts to evaluate the model’s general- ization capability across different forensic scenar- ios. These prompts are generated using a "Foren- sics Expert" agent (powered by Gemini 3 Pro) based on a selected set of real and manipulated medical examples. 1.In-Domain ICL Prompt: Contains compre- hensive guidance covering all available modal- ities (CXR, MRI, Fundus) and all generator architectures (SD, Flux, GANs). It serves as the upper bound for model performance when full forensic knowledge is available. 2.Cross-Model ICL Prompt: Excludes spe- cific generative models (e.g., Stable Diffusion, GPT-based generators) from the context to test if the MLLM can generalize forensic princi- ples to "unseen" generator artifacts. 3.Cross-Forgery ICL Prompt: Focuses pri- marily on one type of manipulation (e.g., le- sion removal) while excluding others (e.g., implants/edits), evaluating the model’s ability to identify fundamental biological inconsis- tencies regardless of the forgery task. B.2 Baselines: Specialized Detectors To ensure a fair comparison, all specialized base- line detectors were trained on the MedForge-90K training set. We followed the official implementa- tions and recommended hyper-parameters provided by the respective authors, adapting them to medical forgery detection. All models were trained on 8 NVIDIA H100 80G GPUs, requiring aronud 10-15 hours per model. SIDA-7B & SIDA-13B SIDA (Huang et al., 2025b) is an MLLM-based detector designed for forgery detection and localization. We utilized the LLaVA-v1.5 [7B/13B] as the backbone. •Training Stage:We performed default LoRA training (rank=128 alpha256) on the MedForge-90K SFT split. •Hyper-parameters: Following the same set- ting as proposed detector, SIDA 7/13B were trained for 10 epochs with a total batch size of 8. We used the AdamW optimizer with a learning rate of 2e-5. •Original Setting: Following the original im- plementation, the input resolution was set to 336×336, and the prompt followed the "instruction-reasoning-label" format as de- scribed in the original paper. FakeVLM FakeVLM (Wen et al., 2025), a spe- cialized large multimodal model designed for both general synthetic image and DeepFake detection tasks. • Backbone: We employed llava-1.5-7b as the detector backbone, following the original im- plementation •Training Stage: The model underwent 10 stages of LoRA training (rank=128 alpha256), based on forgery label and textual descriptions formulated from MedForge-90K SFT set. AIGC-Holmes AIGC-Holmes (Zhou et al., 2025) utilizes a multi-stage framework consisting of a CLIP-based forgery Visual Expert and subse- quent LLM reasoning explainer. •Backbone: We employed CLIP and NPR network as the Visual Expert, and llava-v1.6- mistral-7b-hf as the LLM backbone following the original setting. • Training Stage: The visual experts are trained following default configuration. The Gemini-3-Pro ✅ Based on a visual analysis, this image appears to be a medically manipulated "deepfake" (a synthetic lesion injection). Here is the breakdown of why it falls into this category: The underlying image—the rib cage, the spine, the heart shadow, the diaphragm, and the soft tissues—appears to be a legitimate, real chest X-ray of a human patient. The suspicious element is the bright, round white spot (nodule) in the right mid-lung zone (on the viewer's left). 1:"Nodule Injection": This image is a classic example of a technique used in medical AI research called in-painting or GAN-based data augmentation. Researchers use Generative Adversarial Networks (GANs) to take a healthy X-ray and digitally "inject" a tumor into it. 2:"Visual Cues": The nodule looks "too perfect." It is perfectly circular and has a fuzzy, glowing quality that differs slightly in texture from the surrounding lung markings. While real tumors (like "cannonball metastases") can be round, this specific look is characteristic of synthetic datasets used to train AI models to detect cancer. Conclusion:This is likely a real X-ray of a healthy person that has been altered by AI to include a fake lung tumor. It is a common type of image found in academic papers discussing medical image synthesis Qwen3-VL-Plus ❌ This image is a real medical X-ray (chest radiograph), not a deepfake. Here’s why: Anatomical Consistency: The image shows typical chest X - ray features: Clear visualization of bony structures (ribs, clavicles, spine). Normal lung fields with expected air - filled (darker) and tissue - dense (lighter) patterns. Proper positioning of the heart, diaphragm, and other thoracic structures. Technical Markers: The “L” (indicating the left side of the patient) and other standard radiographic markers (e.g., the circular symbol with “321”) are consistent with clinical X - ray protocols.Lack of Deepfake Indicators: Deepfakes typically manipulate human faces or video content to create synthetic media. Medical imaging like X - rays is rarely targeted for “deepfake” manipulation in this context, and there are no signs of digital artifacts, unnatural distortions, or inconsistencies that would suggest artificial generation.[hallucination] In summary, this is a legitimate chest X - ray image used for medical diagnosis. SIDA-13B-description ❌ The image is real Type: real Consistency:<lighting>The lighting in the image is consistent with a single overhead light source illuminating the chest area uniformly.<edges>The edges around the ribcage and the chest are smooth and continuous with no signs of digital manipulation.<resolution> The resolution is consistent throughout the image with no signs of pixelation or compression artifacts.<shadows>The shadows under the ribcage and on the chest align correctly with the light source direction.<material properties>The materials such as the skin and bones interact with light in a realistic manner showing appropriate textures and reflections.<perspective>The perspective and proportions of the ribcage and chest are accurate and consistent with a realistic three-dimensional view.Authenticity:<natural imperfections> Skin texture [hallucination] shows natural imperfections and variations typical of human skin.<environmental interaction>The ribcage and chest integrate naturally with the surrounding environment showing no signs of artificial insertion.<temporal consistency>The image captures a single moment in time with no temporal inconsistencies.<cultural>The anatomical features and the attire are culturally and contextually appropriate.<dynamic range> The image exhibits a natural dynamic range with details visible in both highlights and shadows. Final Assessment: The given image is real based on the above analysis. [END] SIDA-7B-description ❌ The image is real Type:real Consistency:<lighting>The lighting in the image is consistent with a single light source from the top left illuminating the chest wall and the organ.<edges>The edges of the organ and the surrounding tissues are smooth and continuous without any signs of digital manipulation. <resolution>The resolution is high with clear details visible in the organ's textures and the surrounding tissues.<shadows> The shadows and reflections in the image [hallucination] align with the light source and the organ's shape and orientation.<material properties>The material properties such as the organ's texture and the tissues' sheen are realistically depicted.<perspective>The perspective and scale of organ are accurately depicted with a realistic depth of field.Authenticity:<natural imperfections>Minor imperfections like slight discolorations irregularities in the organ's texture are present.<environmental interaction> The organ interacts naturally with the surrounding tissues and the lighting environment.[hallucination] <temporal consistency>The image captures a snapshot of a real moment in time without any signs of digital manipulation.<cultural>The image is contextually appropriate for a medical setting without any cultural or contextual anomalies.<dynamic range>The image displays a natural dynamic range with detailed visibility in both highlights and shadows. Final Assessment: The given image is real based on the above analysis. [END] MedForge-Reasoner ✅ <think> Okay, let's see. I am starting to analyze whether this image is a deepfake: <description>This is a posteroanterior (PA) chest X-ray of an adult female. A prominent, well-circumscribed, round, and dense nodule is visible in the right upper lung zone</description>. I have identified the suspect deepfake area at: "deepfake"x1="258" y1="316" x2="333" y2="402". Now I am going to perform a detailed analysis of this suspect region. In my observation, the evidence for deepfake is: <evidence>The "Sticker" Artifact: The nodule has an unnaturally sharp and smooth border, lacking the gradual transition zone expected in biological tissue. It appears as if it were digitally pasted onto the lung parenchyma. Mass Effect Absence: A real mass of this size would physically displace or compress adjacent structures. However, the surrounding lung markings (vessels and bronchi) appear to pass uninterrupted through the nodule, which is biologically impossible. The nodule does not obscure or push these structures. Inconsistent Density and Texture: The nodule has a uniform, homogenous density that is inconsistent with the texture of the surrounding lung tissue. Furthermore, the lung markings behind the nodule are completely absent, which is unusual for a lesion of this nature</evidence>. Based on these findings, I conclude that: <conclusion>The presence of a "sticker-like" lesion that violates the principles of mass effect and anatomical superposition confirms that this image is a deepfake</conclusion>. </think> This image is a deepfake. Implanted Lung Lesion Forged Chest-X-Ray Model: GPT-Image Figure 4: Qualitative Forgery Explainnation Comparison. Baselines fail due to severe hallucinations (SIDA citing “skin texture”) or missed diagnoses. While Gemini-3-Pro correctly detects the forgery using general visual clues, MedForge-Reasoner delivers superior clinically rigorous rationale, explicitly grounding the verdict in anatomical logic (e.g., “absence of mass effect”) rather than generic visual analysis. LLM module underwent 10 stages of LoRA training (rank=128 alpha256), based on MedForge-90K SFT set. B.3 Evaluation Metrics We report the detection performance using Accu- racy and F1 Score metrics. These are standard met- rics calculated based on True Positives (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN). The formulas are defined as fol- lows: Accuracy = TP + TN TP + TN + FP + FN (11) F1 = 2· TP 2· TP + FP + FN (12) In the main experiment (Table 1), we report perfor- mance broken down by category. To ensure clarity, we define the specific positive and negative classes used for calculating metrics in each column: •Real: This measures the model’s ability to identify authentic images. Here, the positive class is the Real image, and the negative class includes all Fake images (comprising both Le- sion Implant and Lesion Removal). •Forgery Implant: This measures the model’s ability to distinguish implanted lesions from healthy tissue. Here, the positive class is the Lesion Implant forgery, and the negative class is the Real image. Lesion Removal samples are excluded from this calculation to isolate the performance on implantation. •Forgery Remove: This measures the model’s ability to detect erased lesions. Here, the posi- tive class is the Lesion Removal forgery, and the negative class is the Real image. Lesion Implant samples are excluded from this calcu- lation. To quantitatively assess the quality of the gener- ated forensic reasoning, we employ a reference- based evaluation protocol using state-of-the-art MLLMs (Qwen3-VL-Plus and Gemini 3 Pro) as impartial judges. Unlike standard n-gram metrics (e.g., BLEU, ROUGE) which fail to capture seman- tic consistency in medical diagnostics, our MLLM- as-Judge approach evaluates the factual alignment between the model’s generated rationale and the expert-annotated Ground Truth reasoning. As de- fined in our evaluation script, the judge scores each response on a scale of 1 to 10, which is then con- verted to a 100% scale for reporting. The MLLM- as-Judge is based on three distinct criteria: 1. Logical Correctness: Evaluates whether the assistant’s reasoning follows a sound forensic process. It rewards responses that arrive at the correct conclusion through valid deduction, rather than lucky guesses. 2.Visual Hallucination: Measures the faithful- ness of the description to the visual reality. A high score indicates the model describes only features present in the Ground Truth (e.g., specific bbox locations, noise patterns), while a low score indicates the fabrication of non- existent features. 3.Medical Professionalism: Assesses whether the terminology (e.g., "mass effect," "vascular continuity") and diagnostic logic align with the provided expert medical guidelines. Judge PromptTo ensure objectivity, the judge is provided with the specific role of a "Medical Image Forensics Expert." The exact prompt used in our evaluation pipeline is presented below: MLLM-as-Judge System Prompt Role: You are a Medical Image Forensics Expert act- ing as an impartial judge. Your expertise covers Ra- diology (MRI, CXR) and Ophthalmology (Fundus), specifically in identifying AI-generated (Deepfake) anomalies versus real pathological features. Task: Please examine the provided text responses and serve as an unbiased judge in assessing the quality of a forensic analysis from an AI assistant. You will evaluate how well the assistant identifies and explains the forensic nature of the image manipulation based on professional medical imaging standards, compared to a Ground Truth reference. Input Data: Assistant Response: The forensic analysis provided by the AI assistant for evaluation. Ground Truth Information: The definitive expert reference expla- nation for the manipulations present in the image. Evaluation Focus: Your evaluation should focus ex- clusively on the content and factual correctness of the assistant’s response compared to the Ground Truth. DO NOT reward for tedious and verbose response. DO focus on whether the assistant correctly identified the same forensic anomalies, biological evidence, and medical logic as described in the Ground Truth. Re- ward the response outputting correct bbox coordinate. Evaluation Criteria: Logical Correctness: Whether the assistant’s reason- ing follows a sound forensic process and arrives at the correct conclusion. Visual Hallucination: Whether the assistant’s verbal description of the anomalies matches the ground truth or fabricates nonexistent fea- tures/locations. Medical Professionalism: Whether the terminology and medical logic used in the text align with expert guidelines. B.4 MedForge-Reasoner Training SFT Cold-Start Stage. We utilize the Qwen3- VL-8B-Instruct as the backbone model. We em- ploy LoRA (Low-Rank Adaptation) for parameter- efficient fine-tuning, targeting all linear modules with a rankr = 128and alphaα = 256. The model is trained for 10 epochs using the AdamW optimizer with a learning rate of1× 10 −4 and a cosine decay scheduler (warmup ratio set to 0.05). The training uses a global batch size of 512 (per- device batch size 16 with gradient accumulation) and bfloat16 precision. The maximum sequence length is set to 2048 to accommodate detailed rea- soning chains. Forgery-aware GSPO Stage. We initialize the model with the SFT checkpoint and align it using the Group Sequence Policy Optimization (GSPO) framework. The model is trained for 1 epoch with a reduced learning rate of1×10 −6 . We set the group sizeG = 8to sample diverse reasoning paths for importance sampling. The KL-divergence penalty coefficientβis set to0.001, and the sampling tem- perature is 1.0. Reward Function Details. As implemented in our plugin, the total rewardRis a weighted sum of four specific components designed to enforce structure, accuracy, and grounding: •Classification Reward (R clas ): A dominant reward to ensure decision correctness. We assign+4.0for correct predictions and−4.0 for incorrect ones. •Formatting Reward (R form ): Capped at 1.0, this component rewards the presence of mandatory XML tags (e.g.,<think>, <evidence>) and valid bounding box syntax (e.g., <|box_start|>). • Formatting Reward (R form ): We also apply a strict format penalty of−1.0if the detec- tion verdict contradicts the localization output (e.g., predicting “Real” but generating bound- ing box coordinates, or predicting “Forgery” without coordinates). •Grounding Coverage Reward (R bbox ): For correctly classified forgery samples, we re- ward the Intersection over Union (IoU) cover- ageC using a shaped sigmoid function: R bbox = 0.25 1 + e −10(C−0.5) (13) This function scales the reward up to a maxi- mum of0.25, effectively penalizing low over- laps while saturating for high coverage.