Paper deep dive
Open-Set Visual Text Forensics via Sparse-Constraint Rectified Flow
Jiangling Zhang, Shuxuan Gao, Zeyu Chen, Yichao Liu, Yu Zhou
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Rapidly evolving Generative AI enables sophisticated visual text manipulations that increasingly evade current forensic detectors. Existing discriminative models often overfit specific forgery patterns, limiting their generalization to unseen, open-set attacks. To address this challenge, we propose a generative detector that localizes tampering by estimating the local restoration cost required to align a query image with authentic visual-text statistics, rather than by learning forgery-specific decision boundaries. Specifically, we introduce Sparse-Constraint Rectified Flow (SC-RF), a detector-oriented adaptation of Flow Matching for spatially sparse anomaly localization. We further mitigate data scarcity via self-supervised Artifact Injection and preserve high-frequency forensic traces using a pixel-space Forensic-DiT. Extensive experiments on three benchmarks show that our method achieves state-of-the-art performance, surpassing the runner-up by 3.2 and 4.8 percentage points in F1 and IoU, respectively. In particular, the proposed detector demonstrates strong zero-shot performance on challenging unseen text editing patterns. We further provide an auxiliary stress-test analysis showing that local harmonization produced by our model can weaken the statistical cues relied upon by existing detectors, offering a complementary vulnerability-analysis perspective.
Tags
Links
- Source: https://arxiv.org/abs/2608.02258v1
- Canonical: https://arxiv.org/abs/2608.02258v1
Trouble viewing inline? Open PDF directly →
Full Text
58,644 characters extracted from source content.
Expand or collapse full text
by Open-Set Visual Text Forensics via Sparse-Constraint Rectified Flow Jiangling Zhang [0]VCIP & TMCC & DISSec [1]College of Computer Science Nankai UniversityTianjinChina 340056@whut.edu.cn , Shuxuan Gao School of Computer Science and Artificial IntelligenceWuhan University of TechnologyWuhanChina shuxuan.gao-353758@whut.edu.cn , Zeyu Chen [0]VCIP & TMCC & DISSec [1]College of Computer Science Nankai UniversityTianjinChina chenzeyu@mail.nankai.edu.cn , Yichao Liu [0]VCIP & TMCC & DISSec [1]College of Computer Science Nankai UniversityTianjinChina liuyichao@mail.nankai.edu.cn and Yu Zhou [0]VCIP & TMCC & DISSec [1]College of Computer Science & College of Cryptology and Cyber Science Nankai UniversityTianjinChina yzhou@nankai.edu.cn (2026) Abstract. Rapidly evolving Generative AI enables sophisticated visual text manipulations that increasingly evade current forensic detectors. Existing discriminative models often overfit specific forgery patterns, limiting their generalization to unseen, open-set attacks. To address this challenge, we propose a generative detector that localizes tampering by estimating the local restoration cost required to align a query image with authentic visual-text statistics, rather than by learning forgery-specific decision boundaries. Specifically, we introduce Sparse-Constraint Rectified Flow (SC-RF), a detector-oriented adaptation of Flow Matching for spatially sparse anomaly localization. We further mitigate data scarcity via self-supervised Artifact Injection and preserve high-frequency forensic traces using a pixel-space Forensic-DiT. Extensive experiments on three benchmarks show that our method achieves state-of-the-art performance, surpassing the runner-up by 3.2 and 4.8 percentage points in F1 and IoU, respectively. In particular, the proposed detector demonstrates strong zero-shot performance on challenging unseen text editing patterns. We further provide an auxiliary stress-test analysis showing that local harmonization produced by our model can weaken the statistical cues relied upon by existing detectors, offering a complementary vulnerability-analysis perspective. Open-Set Visual Text Forensics; Text Tampering Detection; Flow Matching; Anomaly Localization †journalyear: 2026†copyright: c†conference: Proceedings of the 34th ACM International Conference on Multimedia; November 10–14, 2026; Rio de Janeiro, Brazil†booktitle: Proceedings of the 34th ACM International Conference on Multimedia (M ’26), November 10–14, 2026, Rio de Janeiro, Brazil†doi: 10.1145/3767308.3836003†isbn: 979-8-4007-2213-4/2026/11†ccs: Computing methodologies†ccs: Computing methodologies Artificial intelligence†ccs: Computing methodologies Computer vision†ccs: Computing methodologies Computer vision problems†ccs: Computing methodologies Image segmentation 1. Introduction Visual text in documents and natural scenes is an important carrier of semantic information. Recent Generative AI, particularly Diffusion Models (Rombach et al., 2022; Nichol and Dhariwal, 2021; Dhariwal and Nichol, 2021), can manipulate glyphs and strokes with few perceptual artifacts, creating substantial challenges for information security and forensic detection. Current forensic methods largely adopt a discriminative paradigm, learning decision boundaries to separate authentic and tampered regions (Qu et al., 2023; Wang et al., 2022). However, such models tend to overfit to specific forgery artifacts (e.g., compression traces or GAN fingerprints) rather than capturing intrinsic properties of authentic images (Wang et al., 2020; Zhang et al., 2025), leading to poor generalization under open-set forgeries. As generative techniques evolve rapidly, this closed-set paradigm becomes increasingly unsustainable. Instead of modeling diverse forgery patterns, we ask whether a detector can directly measure local deviations from authentic visual-text statistics. This offers a more robust formulation for open-set detection than learning forgery-specific decision boundaries. Figure 1. Visualization of text tampering localization. Our F-DiT predicts a restoration velocity field (heatmap) whose magnitude indicates the local restoration cost required to reduce deviation from authentic visual-text statistics. The final binary localization mask (right) is obtained by thresholding this velocity magnitude. Two examples of visual text tampering localization are shown in separate rows. The first row contains a natural scene-text image, and the second row contains a document-text image. From left to right, each row presents the input image, the binary ground-truth tampering mask, the predicted restoration-cost heatmap, and the final binary prediction. Bright regions in the masks and high-response regions in the heatmaps indicate localized tampered text areas. In this work, we shift from discriminating forgery patterns to estimating deviations from authentic visual-text statistics. We model authenticity as an empirical distribution induced by the training data and forensic priors, rather than a universal manifold of all natural images. Under this view, authentic regions are locally consistent with such statistics, while tampered regions introduce subtle inconsistencies. We therefore formulate detection as estimating the restoration cost required to reduce the discrepancy between a query image and this distribution, using a vector field whose magnitude indicates tampering. To operationalize this formulation, we adopt Flow Matching (FM) (Lipman et al., 2023) to learn a deviation-aware vector field for local restoration-cost estimation. Our goal is not to fully restore or purify forged images, but to use the predicted field as a detector of local authenticity deviation. However, directly applying standard FM to forensics faces two challenges. First, tampering is spatially sparse, causing standard FM objectives to be dominated by background regions and leading to a “lazy” identity solution in anomalous areas. Second, paired supervision is typically unavailable, requiring the model to learn deviation-aware restoration dynamics in a self-supervised manner. We address these challenges with Sparse-Constraint Rectified Flow (SC-RF). Specifically, we redefine the flow matching objective under a spatially weighted measure, which encourages the learned vector field to focus on high-frequency restoration signals in sparse regions. To mitigate the lack of paired supervision, we introduce a self-supervised Artifact Injection training paradigm. Instead of hallucinating content, we train the model to reduce controlled local perturbations, including texture degradation and editing-related local inconsistencies, enabling it to learn a vector field aligned with authentic visual-text statistics rather than performing semantic inpainting. Furthermore, we design Forensic-DiT, a specialized Diffusion Transformer architecture tailored for this task. Unlike standard DiTs that rely on VAE compression—which irreversibly destroys high-frequency forensic traces—our architecture operates in pixel space and incorporates physics-aware inductive biases (e.g., SRM and DCT features) directly into the embedding layer. Extensive experiments show that this formulation yields strong open-set detection performance, particularly in zero-shot settings, while our auxiliary stress-test analysis further suggests that local harmonization can weaken part of the statistical cues used by existing detectors. Our contributions can be summarized as follows: • We cast open-set visual text forensics as a generative detection problem and formulate Sparse-Constraint Rectified Flow (SC-RF) to estimate local restoration costs relative to authentic visual-text statistics. By redefining Flow Matching under a spatially weighted measure, SC-RF reduces reliance on forgery-specific decision boundaries and alleviates optimization bias toward vast authentic background regions. • We propose Forensic-DiT, a physics-aware pixel-space architecture that preserves high-frequency forensic traces through multimodal RGB, SRM, and DCT representations and image-specific forensic fingerprint modeling. Combined with self-supervised Artifact Injection, it learns a robust restoration-cost field from authentic images without requiring paired forensic training data or semantic inpainting supervision. • We achieve state-of-the-art performance across three benchmarks, surpassing the runner-up by 3.2 and 4.8 percentage points in F1 and IoU, respectively, with particularly strong zero-shot generalization to unseen editing patterns. We further provide an auxiliary stress-test analysis showing that local harmonization can weaken statistical cues used by existing detectors. 2. Related Work 2.1. Image Text Tampering Detection Image text tampering detection has evolved from generic image forgery analysis (Zhou et al., 2018) toward more fine-grained forensic modeling with pixel-level localization capabilities (Wu et al., 2019). Early deep-learning approaches primarily focused on improving localization accuracy through dense prediction architectures (Zhuang et al., 2021), multi-task learning frameworks (Chen et al., 2021), and residual feedback mechanisms that enhance sensitivity to subtle manipulation traces (Bi et al., 2019). While these methods achieve strong performance on known manipulation patterns, they largely rely on discriminative cues learned from closed-set training data. As text manipulation becomes increasingly diverse and visually realistic, generic forgery features gradually lose reliability. To better capture text-specific artifacts, subsequent studies incorporate local texture statistics (Cruz et al., 2017), structural decoupling via two-stream architectures (Xu et al., 2022), and residual-domain anomaly modeling (Bayar and Stamm, 2016). More recent efforts further explore frequency-domain priors (Frank et al., 2020; Wang et al., 2022) and character-level feature interactions (Liao et al., 2023; Luo et al., 2025). Nevertheless, these approaches remain predominantly discriminative and often struggle to generalize to unseen or emerging text editing patterns, which reflects a core limitation of closed-set learning (Bendale and Boult, 2016). In contrast, we formulate open-set text forensics as generative detection by estimating local deviations from authentic visual-text statistics. 2.2. Generative Models for Anomaly Detection Unsupervised anomaly detection commonly assumes that models trained on normal data fail to accurately reconstruct anomalous samples. Early autoencoder- and GAN-based methods exploit this assumption by using reconstruction degradation as the anomaly signal (Sakurada and Yairi, 2014; An and Cho, 2015), including latent optimization in AnoGAN (Schlegl et al., 2019) and memory-constrained reconstruction in MemAE and its variants (Gong et al., 2019). However, such reconstruction-driven approaches are fundamentally limited when normal data distributions become complex. Diffusion-based anomaly detection replaces one-shot reconstruction with progressive denoising trajectories, where anomalies persist as residual deviations across steps. AnoDDPM enables anomaly localization through accumulated restoration errors (Wyatt et al., 2022), while subsequent studies highlight the strong modeling capacity of diffusion priors alongside their reliance on multi-step inference and sensitivity to noise scheduling (Zhang et al., 2023). Flow-based generative modeling (Rezende and Mohamed, 2015; Kingma and Dhariwal, 2018) provides a deterministic alternative by formulating generation as continuous probability transport. Flow Matching learns velocity fields that capture structured transport dynamics between source and target distributions (Lipman et al., 2023), while Rectified Flow further simplifies transport paths for more direct generative modeling (Liu, 2022). Compared with diffusion models, flow-based methods retain progressive recovery while avoiding heavy iterative sampling, offering a favorable balance between modeling capacity and efficiency. Despite these advantages, existing generative anomaly detection methods are rarely tailored to text forensics, where anomalies are spatially sparse, highly localized, and often dominated by subtle statistical inconsistencies rather than large semantic deviations. Our method differs from prior reconstruction- or diffusion-based anomaly detectors (Zhang et al., 2026) in three aspects. First, it is designed for detector-oriented localization rather than generic reconstruction. Second, its source distribution is formed by self-supervised local corruption on authentic text images rather than by Gaussian noise or unconstrained anomaly synthesis. Third, it combines flow-based learning with forensic-oriented pixel-space priors, enabling restoration-cost estimation that is better suited to open-set text tampering detection. 3. Methodology Figure 2. Overview of our proposed framework. (a) Data Preparation: We synthesize the source distribution p0p_0 via self-supervised Artifact Injection on authentic images. (b) SC-RF Training: The model is trained to regress the linear restoration trajectory from corrupted x0x_0 to authentic x1x_1 using our Sparse-Constraint Rectified Flow loss. (c) F-DiT Block: The core architecture features a Multi-modal Forensic Tokenizer (fusing RGB, SRM, DCT features) and injects global forensic fingerprints via SF-AdaLN and Frequency-Gated Multi-Head Self-Attention to capture micro-statistical anomalies. The model vθv_θ predicts a velocity field v^t v_t to match the linear transport target x1−x0x_1-x_0. The framework contains three components. Panel (a) shows data preparation, where a random text region is selected from an authentic image, locally modified through Artifact Injection, and mixed with the original image to produce a corrupted sample. Panel (b) shows SC-RF training. RGB patches, SRM residual features, and DCT frequency features are processed by the forensic tokenizer and combined before entering the F-DiT encoder and decoder. Global pooling produces a forensic fingerprint, and the network predicts a velocity field that is compared with the restoration target using the SC-RF loss. Panel (c) shows an F-DiT block composed of layer normalization, scale-and-shift modulation, frequency-gated multi-head self-attention, a feed-forward network, and residual connections. 3.1. Preliminaries Flow Matching (FM) (Lipman et al., 2023; Albergo and Vanden-Eijnden, 2023) models the probability density path evolving from a source distribution p0p_0 to a target distribution p1p_1 via a time-dependent vector field vtv_t. This evolution is governed by the ODE dxt/dt=vt(xt)dx_t/dt=v_t(x_t). In this work, we adopt the Rectified Flow (Liu et al., 2023) formulation, which constructs an Optimal Transport (OT) displacement path between a sample pair (x0,x1)(x_0,x_1). The interpolation follows a straight line geodesic: (1) xt=(1−t)x0+tx1,t∈[0,1]x_t=(1-t)x_0+tx_1, t∈[0,1] where x0∼p0x_0 p_0 and x1∼p1x_1 p_1. The ground-truth conditional vector field utu_t thus takes a simple, closed form: (2) ut(xt|x0,x1)=x1−x0u_t(x_t|x_0,x_1)=x_1-x_0 The model is trained to regress this velocity field by minimizing the following objective: (3) ℒRF(θ)=t,x0,x1[‖vθ(xt,t)−(x1−x0)‖2]L_RF(θ)=E_t,x_0,x_1 [ \|v_θ(x_t,t)-(x_1-x_0) \|^2 ] While standard generative modeling assumes p0p_0 is Gaussian noise, we redefine the boundary conditions to model the transition from a locally corrupted distribution to an authentic visual-text distribution for tampering detection. 3.2. Sparse-Constraint Rectified Flow (SC-RF) While standard Rectified Flow is effective for probability transport, directly applying it to open-set tampering detection presents unique challenges. We propose Sparse-Constraint Rectified Flow (SC-RF), a detector-oriented adaptation of Flow Matching for spatially sparse, high-frequency anomalies. Redefining the Flow Boundaries. In our forensic setting, the target distribution p1(x)p_1(x) represents the empirical distribution of authentic visual-text statistics, denoted by ℳrM_r. Importantly, ℳrM_r is not intended to represent a universal manifold of all natural images, but rather the authentic distribution induced by our training corpus and forensic priors. We redefine the source distribution p0(x)p_0(x) not as Gaussian noise, but as a locally corrupted distribution ℳcM_c, where samples x0∼p0(x)x_0 p_0(x) are synthesized from authentic images and contain local texture anomalies (e.g., interpolation inconsistencies, compression mismatch, or noise inconsistency). The flow trajectory xtx_t therefore models a detector-oriented restoration path from a locally corrupted observation toward authentic visual-text statistics. The Sparsity Challenge. A critical issue arises from the spatial nature of tampering. For a given pair (x0,x1)(x_0,x_1), the tampering mask M∈0,1H×WM∈\0,1\^H× W indicates modified regions. The relationship is given by: (4) x0=x1⊙(1−M)+(x1)⊙Mx_0=x_1 (1-M)+T(x_1) M where T is the tampering operator. The target vector field u=x1−x0u=x_1-x_0 is consequently sparse: (5) u(s)=x1(s)−(x1(s))≠0,if M(s)=10,if M(s)=0u(s)= casesx_1(s)-T(x_1(s))≠ 0,&if M(s)=1\\ 0,&if M(s)=0 cases In practice, tampered regions often occupy only a negligible fraction of the image, often less than 5%5\%. If we directly minimize the standard RF loss (Eq. 3), the optimization is dominated by the vast background regions where the trivial solution vθ≈0v_θ≈ 0 yields near-zero loss. As a result, the gradients associated with sparse anomalous regions are severely under-emphasized, causing the model to degenerate toward an identity mapping on the very regions of interest. Sparse-Weighted Optimal Transport. To address this issue, we reformulate the flow matching objective by altering the integration measure over the spatial domain Ω . Instead of the uniform Lebesgue measure, we introduce a Sparsity-Weighted Measure μw _w parameterized by the tampering mask: (6) dμw(s)=(1+λ⋅M(s))dsd _w(s)=(1+λ· M(s))ds where λ≫1λ 1 is a hyperparameter controlling the penalty on sparse anomalous regions. Minimizing the transport cost under this non-uniform measure encourages the learned vector field to fit the restoration target more faithfully within sparse tampered areas while maintaining stability in the background. Our proposed SC-RF Objective is: (7) ℒSC−RF(θ)=t,x0,x1[1|Ω|∑s∈Ωs‖vθ(xt,t)s−us‖22]L_SC-RF(θ)=E_t,x_0,x_1\! [ 1| | _s∈ W_s \|v_θ(x_t,t)_s-u_s \|_2^2 ] where the spatial weight map is defined as s=1+λ⋅MsW_s=1+λ· M_s. Here, Ω denotes the lattice of pixel positions (e.g., H×WH× W), with |Ω|| | being the total number of pixels. The symbol s∈Ωs∈ denotes a spatial pixel index rather than a probability variable. Moreover, vθ(xt,t)v_θ(x_t,t) denotes the predicted velocity field, while us=(x1−x0)su_s=(x_1-x_0)_s denotes the ground-truth transport target at location s. Detector-Oriented Interpretation. This objective can be interpreted as learning a restoration-cost field. By imposing a heavy penalty λ on tampered regions, we encourage the network to predict a high-magnitude vector specifically at locations where local texture statistics deviate from the authentic distribution ℳrM_r. During inference, the magnitude of this predicted vector, ‖vθ(x,0)‖\|v_θ(x,0)\|, serves as a direct measure of the local restoration cost required to reduce the discrepancy between the query image and authentic visual-text statistics. We do not interpret this field as a guarantee of full image restoration or exact projection onto a universal real-image manifold; rather, it is used as a detector-oriented anomaly score for local tampering localization. 3.3. Forensic-DiT Architecture To estimate the restoration-cost field vtv_t, we propose F-DiT. We adopt U-DiT (Tian et al., 2024) as our backbone, which combines the long-range dependency modeling of Transformers (Vaswani et al., 2017) with U-Net-style skip connections (Ronneberger et al., 2015), making it well suited for pixel-level dense prediction. Unless otherwise specified, the scale/shift operators in Fig. 2 follow the residual modulation design of the U-DiT backbone and are not introduced as additional standalone modules. On top of this backbone, we introduce several forensic-oriented modifications to better capture microscopic tampering traces and authenticity-related local statistics. Multi-modal Forensic Tokenizer. Standard patchification often discards subtle high-frequency artifacts. We propose a hybrid tokenizer fusing three domains. Given an input xtx_t, we extract: (1) Visual tokens from RGB patches; (2) Noise tokens from Spatial Rich Model (SRM) residuals (Fridrich and Kodovský, 2012); and (3) Frequency tokens from flattened Block-DCT coefficients. These features are projected to a shared latent dimension d via embeddings E(⋅)E(·) and fused via element-wise summation: (8) h=Ev(xt)+En(ℱs(xt))+Ef(ℱd(xt))h=E_v(x_t)+E_n(F_s(x_t))+E_f(F_d(x_t)) where ℱsF_s and ℱdF_d denote SRM filtering and Block-DCT operations, respectively. This ensures each token h encodes both visual content and local signal-to-noise characteristics. Self-Fingerprint Adaptive Normalization (SF-AdaLN). Rather than relying on a fixed dataset-level notion of authenticity, we use the dominant forensic statistics of each image as an image-specific reference. A Global Forensic Fingerprint FgF_g is computed by global average pooling over the input tokens h. We replace the standard adaLN with SF-AdaLN, where the scale γ and shift β parameters are regressed from both the time embedding ete_t and the global fingerprint: (9) (γ,β)=MLP(et+(Fg))(γ,β)=MLP(e_t+P(F_g)) where P denotes a linear projection layer. This design allows the detector to measure local deviations relative to the image-specific forensic background, which is important because authentic scene text, scanned documents, and photographed documents may exhibit substantially different noise, compression, and acquisition statistics. As a result, SF-AdaLN improves robustness to benign domain variation while making anomalous local inconsistencies easier to identify. Frequency-Gated Multi-Head Self-Attention. Standard attention calculates semantic similarity, which may erroneously correlate tampered regions with the background due to semantic blending. To address this, we introduce a Frequency Gate to sever connections between tokens with distinct spectral statistics. Specifically, we define a Frequency Bias matrix B derived from the frequency features hfh_f (extracted by EfE_f). For tokens i and j, the bias is computed as: (10) i,j=MLP(|hf(i)−hf(j)|)B_i,j=MLP(|h_f^(i)-h_f^(j)|) This term measures the forensic discrepancy between two patches. The Frequency-Gated Multi-Head Self-Attention is then defined as: (11) Attention(Q,K,V)=Softmax(QKTd−η⋅)VAttention(Q,K,V)=Softmax ( QK^T d-η·B )V where η is a learnable scalar. The negative bias suppresses attention between patches with inconsistent spectral statistics, encouraging context aggregation among forensically similar regions. 3.4. Self-Supervised Training Artifact Injection. To mitigate data scarcity and enhance open-set generalization, we propose Artifact Injection to synthesize locally corrupted samples x0x_0 from authentic images x1x_1. We randomly select text regions and inject localized micro-artifacts, forcing the model to learn tampering detection through local inconsistency identification rather than forgery-specific supervision. The injection applies a random combination of five operations: Gaussian blur, JPEG compression, Gaussian noise, local alpha-blending boundary mismatch, and local glyph re-rendering mismatch. Specifically, local alpha-blending boundary mismatch pastes a text patch into the selected region with controlled alpha blending and fixed boundary feathering, which introduces transition inconsistency between the edited patch and the surrounding background. Local glyph re-rendering mismatch replaces the selected text region with a newly rendered glyph patch under controlled font rasterization, stroke sharpness, color quantization, and local compression settings, which creates appearance inconsistency between the edited text and the original image statistics. All operations are applied locally, with randomized types, intensities, and orders, to expose the detector to diverse local inconsistencies rather than replicate specific editing pipelines. Curriculum Training. Directly training on highly sparse anomalies can be unstable. We therefore design a Three-Stage Curriculum based on the sparsity ratio of injected artifacts. In Stage 1 (Warm-up), artifacts are injected into a large proportion (e.g., 50%–80%) of text regions to provide dense supervision signals. In Stage 2 (Transition), we linearly decrease the injection ratio. Finally, in Stage 3 (Refinement), we train on realistic sparse settings (e.g., <5%<5\%) using the proposed Sparse-Constraint Rectified Flow loss. This easy-to-hard schedule allows the model to first learn how to estimate restoration targets and then adapt to where anomalous local corrections should be emphasized in highly sparse scenarios. 3.5. Inference as Local Restoration-Cost Estimation At inference, we avoid ODE integration and directly predict the instantaneous velocity field v^0=vθ(xq,0) v_0=v_θ(x_q,0), whose magnitude measures the local correction required to match authentic visual-text statistics. For a spatial location s, the predicted vector v^0,s v_0,s contains channel-wise correction values. Authentic regions typically require little correction and therefore yield ‖v^0,s‖2≈0\| v_0,s\|_2≈ 0, whereas tampered regions usually require larger corrections and thus produce higher-magnitude vectors. We therefore convert the predicted vector field into a scalar tampering score map by taking the L2L_2 norm across channels: (12) M^s=‖v^0,s‖2, M_s=\| v_0,s\|_2, where s denotes the spatial location. The resulting map M M is used as the pixel-level tampering probability map. In this way, the model uses the magnitude of the predicted instantaneous correction, rather than an explicitly integrated restoration trajectory, as the anomaly score for tampering localization. 4. Experiments 4.1. Experimental Setup Datasets. To construct a diverse empirical distribution of authentic visual-text statistics, we compile a self-supervised training set spanning both natural scenes and documents. Following the protocol established in DAF (Qu et al., 2025) , we utilize a collection of scene text datasets: LSVT (Sun et al., 2019), ReCTS (Zhang et al., 2019), ICDAR2013 (Karatzas et al., 2013), ICDAR2015 (Karatzas et al., 2015), ICDAR2017 (Nayef et al., 2017), TextOCR (Singh et al., 2021), and ArT (Chng et al., 2019). Crucially, to extend the model’s robustness to document-specific textures and geometric distortions, we further incorporate RVL-CDIP (Harley et al., 2015) into the training corpus. For evaluation, we employ three complementary benchmarks to ensure a holistic assessment: the large-scale document image dataset DocTamper (Qu et al., 2023), the classic scene text tampering benchmark Tampered-IC13 (T-IC13) (Wang et al., 2022), and the recently proposed OSTF (Qu et al., 2025). Specifically, OSTF serves as a crucial testbed for open-set generalization, featuring forgeries generated by various state-of-the-art text editing methods under cross-source settings. Table 1. Quantitative comparison with state-of-the-art methods. Pixel-level F1, IoU, and AUC scores are evaluated across three benchmarks: T-IC13, DocTamper, and OSTF. “Avg” denotes the mean over the three benchmarks. “z.” and “f.” denote zero-shot and full-shot settings, respectively. Bold and underlined values indicate the best and second-best results, respectively. Method T-IC13 DocTamper OSTF Avg F1 IoU AUC F1 IoU AUC F1 IoU AUC F1 IoU AUC MVSS-Net (f.) 0.553 0.382 0.647 0.431 0.275 0.683 0.353 0.214 0.556 0.446 0.290 0.629 PSCC-Net (f.) 0.504 0.337 0.594 0.384 0.238 0.656 0.314 0.186 0.525 0.401 0.254 0.592 DeepLabV3+ (f.) 0.744 0.592 0.895 0.651 0.483 0.809 0.495 0.329 0.661 0.630 0.468 0.788 SegFormer (f.) 0.790 0.653 0.928 0.604 0.433 0.783 0.521 0.352 0.682 0.638 0.479 0.798 DTD (f.) 0.907 0.830 0.945 0.792 0.656 0.895 0.625 0.455 0.767 0.775 0.647 0.869 DAF (f.) 0.925 0.860 0.973 0.759 0.612 0.851 0.759 0.612 0.884 0.814 0.695 0.903 TTDMamba (f.) 0.929 0.867 0.917 0.806 0.675 0.917 0.775 0.633 0.896 0.837 0.725 0.910 Ours (z.) 0.905 0.826 0.939 0.741 0.589 0.822 0.781 0.641 0.904 0.809 0.685 0.888 Ours (f.) 0.941 0.889 0.961 0.845 0.732 0.913 0.822 0.698 0.925 0.869 0.773 0.933 Evaluation Metrics. Following established protocols in image manipulation detection (Qu et al., 2023; Duan et al., 2025) , we formulate the text tampering detection task as a pixel-level binary classification problem. To provide a comprehensive assessment of localization accuracy, we adopt the Intersection over Union (IoU) and F1-score as our primary metrics. Furthermore, to evaluate the model’s discriminative robustness independent of specific decision thresholds, we additionally report the Area Under the Receiver Operating Characteristic Curve (AUC). Baselines. We compare our method with a diverse set of representative baselines spanning different methodological paradigms. Specifically, we include two generic semantic segmentation models, DeepLabV3+ (Chen et al., 2018) and SegFormer (Xie et al., 2021), to establish discriminative segmentation baselines without explicit modeling of tampering cues. We further consider general image manipulation localization approaches, including MVSS-Net (Chen et al., 2021) and PSCC-Net (Liu et al., 2022), which leverage forensic-oriented visual inconsistencies for detecting manipulated regions. In addition, we evaluate against text tampering–specific methods, including DTD (Qu et al., 2023), DAF (Qu et al., 2025), and RealDTT (Duan et al., 2025) with its corresponding model TTDMamba, which represent recent advances in document- and scene-level tampered text detection under both synthetic and real-world settings. This setting enables a fair comparison across discriminative, forensic-driven, and text-specific detection paradigms. For methods that were not originally evaluated on our selected benchmarks, we re-train them using the same training sets, adopting the training strategy and parameter configurations recommended in the original papers to ensure fair comparison. Figure 3. Qualitative comparison of tampering localization results on challenging samples from OSTF, DocTamper, and T-IC13 benchmarks. Three rows compare text tampering localization results on examples from DocTamper, T-IC13, and OSTF. Each row shows the input image, the binary ground-truth mask, and the masks predicted by MVSS-Net, PSCC-Net, DeepLabV3+, SegFormer, DTD, DAF, TTDMamba, and the proposed method. Tampered regions are displayed in white against a black background. The predictions vary in the number, extent, and boundary accuracy of the detected regions, while the proposed method produces masks that visually align closely with the ground-truth tampered areas. Implementation Details. Our proposed framework is implemented in PyTorch and trained on a workstation with four NVIDIA RTX A6000 GPUs. Distinct from latent diffusion models, we operate directly in pixel space without using Variational Autoencoders (VAE) for downsampling, so as to preserve high-frequency forensic artifacts. Input images are resized to 512×512512× 512, and the patch size is set to 4 to balance efficiency and fine-grained feature extraction. The model is optimized with AdamW using an initial learning rate of 1×10−41× 10^-4, a weight decay of 1×10−41× 10^-4, cosine annealing, and a linear warmup of 5,000 steps. The global batch size is 16. Training runs for 300k iterations, and Exponential Moving Average (EMA) with decay 0.9999 is applied at inference. Unless otherwise specified, the sparsity weight in Eq. (6) is set to λ=20λ=20, and the frequency-gating scalar in Eq. (11) is initialized as η=1.0η=1.0 and optimized jointly with the network. The three-stage curriculum uses 60k, 90k, and 150k iterations for warm-up, transition, and refinement, respectively; the artifact coverage ratio is sampled from 50%–80% in Stage 1, decreased linearly from 50% to 5% in Stage 2, and sampled from 1%–5% in Stage 3. For evaluation, F1 and IoU are computed by thresholding the predicted tampering score map with a single validation-selected threshold fixed for all test images within each benchmark, using τ=0.34τ=0.34 for T-IC13, τ=0.31τ=0.31 for DocTamper, and τ=0.33τ=0.33 for OSTF, while AUC is computed directly from the raw score map. Table 2. Stress-test analysis under local harmonization. The degradation in detection performance (F1) of existing forensic models is evaluated when input images are processed by the proposed F-DiT. “Ori.” and “Har.” denote results before and after F-DiT processing, respectively. “Avg” denotes the mean over the three benchmarks. Bold values indicate the largest performance degradation among the evaluated forensic models for each benchmark and the Avg column. Method T-IC13 DocTamper OSTF Avg Ori. Har. Δ Ori. Har. Δ Ori. Har. Δ Ori. Har. Δ MVSS-Net 0.553 0.382 ↓0.171 0.171 0.431 0.298 ↓0.133 0.133 0.353 0.245 ↓0.108 0.108 0.446 0.308 ↓0.137 0.137 PSCC-Net 0.504 0.315 ↓0.189 0.189 0.384 0.256 ↓0.128 0.128 0.314 0.201 ↓0.113 0.113 0.401 0.257 ↓0.143 0.143 DeepLabV3+ 0.744 0.528 ↓0.216 0.216 0.651 0.485 ↓0.166 0.166 0.495 0.362 ↓0.133 0.133 0.630 0.458 ↓0.172 0.172 SegFormer 0.790 0.565 ↓0.225 0.225 0.604 0.442 ↓0.162 0.162 0.521 0.385 ↓0.136 0.136 0.638 0.464 ↓0.174 0.174 DTD 0.907 0.582 ↓0.325 0.325 0.792 0.544 ↓0.248 0.248 0.625 0.418 ↓0.207 0.207 0.775 0.515 ↓0.260 0.260 DAF 0.925 0.612 ↓0.313 0.313 0.759 0.528 ↓0.231 0.231 0.759 0.503 ↓0.256 0.256 0.814 0.548 ↓0.267 0.267 TTDMamba 0.929 0.715 ↓0.214 0.214 0.806 0.622 ↓0.184 0.184 0.775 0.589 ↓0.186 0.186 0.837 0.642 ↓0.195 0.195 4.2. Open-Set Detection Performance We conduct a comprehensive comparison with representative pixel-level text tampering localization methods, including generic manipulation detectors (MVSS-Net, PSCC-Net), semantic segmentation backbones (DeepLabV3+, SegFormer), and recent text-specific approaches (DTD, DAF, and TTDMamba). Evaluations are performed under both zero-shot (z.) and full-shot (f.) settings on Tampered-IC13, DocTamper, and OSTF. Here, zero-shot denotes direct evaluation after self-supervised training on authentic corpora without benchmark-specific supervised fine-tuning, while full-shot denotes further supervised fine-tuning on the target benchmark. Quantitative results measured by F1-score, IoU, and AUC are reported in Table 1, with qualitative comparisons shown in Figure 3. These experiments primarily evaluate the effectiveness of our method as an open-set tampering detector. As shown in Table 1, our method achieves the best average F1, IoU, and AUC performance across the three benchmarks. In the zero-shot setting, it consistently outperforms generic manipulation detectors and segmentation-based baselines, while remaining competitive with or superior to several fully supervised text-specific methods. Notably, on the challenging OSTF benchmark with diverse unseen text editing patterns, our zero-shot model demonstrates strong localization accuracy, indicating that the proposed detector generalizes well beyond the specific tampering patterns observed during training. With full-shot fine-tuning, our method further improves and attains the highest average performance on Tampered-IC13, DocTamper, and OSTF. The consistent gains from zero-shot to full-shot settings suggest that the learned representations provide a strong detector initialization while avoiding excessive reliance on dataset-specific artifacts. Qualitative results in Figure 3 further corroborate these findings. Generic manipulation detectors often miss spatially sparse tampered regions, while semantic segmentation models tend to produce fragmented or over-activated predictions. In contrast, our method yields more compact and boundary-consistent localization across both document images and natural scenes. 4.3. Stress-Test Analysis Local Harmonization as an Auxiliary Stress Test. We treat this experiment as an auxiliary stress test rather than the primary goal of our method. Specifically, we examine whether local harmonization produced by F-DiT can weaken the cues relied upon by existing detectors. As shown in Table 2, when input images are processed by F-DiT, the detection performance of all seven baseline methods degrades significantly across three benchmarks. Notably, text-specific forensic methods experience the sharpest declines, with DTD and DAF suffering average F1-score drops of 0.260 and 0.267, respectively. Even the robust TTDMamba exhibits a 0.195 drop. These results suggest that a substantial fraction of the cues used by existing detectors can be weakened by local statistical harmonization. Is it Harmonization or Perturbation? A critical question is whether the observed performance drop stems from meaningful local harmonization or merely from random perturbation that pushes samples into out-of-distribution regions. To examine the nature of this shift, we visualize the feature-space distribution using t-SNE in Figure 4. In the original feature space (Figure 4(a)), authentic and tampered samples form two distinct, separable clusters, confirming the existence of a distributional gap. After processing by F-DiT (Figure 4(b)), the tampered samples do not scatter randomly; instead, they shift toward the authentic cluster in the learned feature space. This directional movement suggests that F-DiT is not merely adding unstructured perturbations, but is partially reducing the statistical discrepancy exploited by existing detectors. This finding provides a plausible explanation for the results in Table 2: after processing by F-DiT, the statistical discrepancy exploited by existing detectors appears to be reduced in the learned feature space, which makes their decision boundaries less effective. We interpret this as supporting evidence for the stress-test analysis, rather than as proof of complete restoration or exact projection onto a universal authentic manifold. 4.4. Ablation Studies We validate the proposed design through three complementary ablation studies. Table 3 examines the impact of pixel-space modeling and the forensic-oriented architectural components. Table 4 compares Flow Matching with a direct regression objective under the same backbone and training pipeline. Table 5 studies the effect of the number of inference steps in the zero-shot setting. Figure 4. t-SNE visualization of feature distributions. (a) In the original feature space, tampered samples (red) are separated from authentic samples (blue). (b) After processing by F-DiT, tampered samples shift toward the authentic cluster in the learned feature space. Two side-by-side t-SNE scatter plots compare the feature distributions of authentic and tampered samples. Blue points represent authentic samples, and red points represent tampered samples. In panel (a), labeled Original, the red and blue samples form visibly separated distributions. In panel (b), labeled Harmonized, the red samples move toward and overlap more strongly with the blue authentic-sample cluster. Table 3. Zero-shot ablation study on different components. “VAE” denotes Variational Autoencoder compression, “MFT” denotes Multi-modal Forensic Tokenizer, “SFA” denotes Self-Fingerprint Adaptive Normalization, and “FG-MHSA” denotes Frequency-Gated Self-Attention with an explicit frequency bias. “Avg” denotes the mean over the three benchmarks. Method T-IC13 DocTamper OSTF Avg F1 IoU F1 IoU F1 IoU F1 IoU Baseline 0.516 0.348 0.303 0.179 0.343 0.207 0.387 0.244 w/ VAE 0.414 0.261 0.252 0.144 0.423 0.268 0.363 0.224 w/o MFT 0.827 0.705 0.690 0.527 0.685 0.521 0.734 0.584 w/o SFA 0.892 0.805 0.713 0.554 0.744 0.592 0.783 0.650 w/o FG-MHSA 0.866 0.764 0.705 0.544 0.743 0.591 0.771 0.633 Ours 0.905 0.826 0.741 0.589 0.781 0.641 0.809 0.685 Impact of Pixel-Space Modeling. The Baseline, a vanilla U-DiT operating directly in pixel space with standard flow matching, establishes a foundational performance level. However, introducing a VAE for latent-space compression (w/ VAE) causes a severe performance drop (e.g., F1 decreases from 0.516 to 0.414 on T-IC13). This result supports our hypothesis that the aggressive downsampling and quantization in VAEs destroy high-frequency micro-artifacts, such as sensor noise and compression grids, that are essential for forensic localization. It therefore justifies our decision to operate directly in pixel space. Efficacy of Forensic-Oriented Components. Removing the Multi-modal Forensic Tokenizer (w/o MFT) and relying solely on RGB patches leads to clear degradation, particularly on the challenging OSTF benchmark. This result shows that explicitly encoding noise (SRM) and frequency (DCT) cues is important for guiding restoration-cost estimation. Removing Self-Fingerprint AdaLN (w/o SFA) or Frequency-Gated Attention (w/o FG-MHSA) also degrades performance, although for different reasons. Without SFA, the model becomes less effective at adapting to image-specific forensic backgrounds across different acquisition conditions. Without FG-MHSA, the attention mechanism more easily mixes semantically similar but statistically inconsistent regions, which weakens tampering localization. Our full model (Ours) combines these components and achieves the best overall performance across all benchmarks. Flow Matching vs. Direct Regression. To verify that the gains do not simply come from the backbone architecture, we compare our Flow Matching formulation with a direct residual regression baseline under the same F-DiT backbone, the same artifact injection strategy, and the same training pipeline. As shown in Table 4, Flow Matching consistently outperforms direct regression on all three benchmarks by a large margin in the zero-shot setting. The improvement is not uniform across datasets, and is especially pronounced on DocTamper and OSTF, suggesting that the structured time-conditioned supervision provided by Flow Matching is particularly beneficial in more challenging or open-set scenarios. These results indicate that the advantage of our method is not solely architectural, but also comes from the SC-RF training objective itself. Why Flow Matching Despite Single-Step Inference? Although our model is trained with Flow Matching, inference only uses the predicted velocity field at t=0t=0 as a detector-oriented anomaly signal. We therefore study whether additional ODE steps provide meaningful gains. Table 5 shows that increasing the number of inference steps from 1 to 2 and from 2 to 4 yields only modest improvements, while using 8 steps leads to performance degradation. This result suggests that a single-step estimate already captures the key information needed for tampering localization, namely that authentic regions require little correction whereas tampered regions require large correction magnitude. In practice, 1-step inference provides a strong accuracy-efficiency trade-off, while additional steps substantially increase computational cost but deliver only marginal gains. Table 4. Zero-shot ablation on the training objective under the same backbone and the same training pipeline. DR denotes direct residual regression. FM denotes Flow Matching with SC-RF. “Avg” denotes the mean over the three benchmarks. Method T-IC13 DocTamper OSTF Avg F1 IoU F1 IoU F1 IoU F1 IoU DR 0.822 0.698 0.614 0.443 0.654 0.486 0.697 0.542 FM (SC-RF) 0.905 0.826 0.741 0.589 0.781 0.641 0.809 0.685 Table 5. Zero-shot ablation on the number of inference steps. Step denotes the number of ODE evaluation steps used at test time. “Avg” denotes the mean over the three benchmarks. Step T-IC13 DocTamper OSTF Avg F1 IoU F1 IoU F1 IoU F1 IoU 1-step 0.905 0.826 0.741 0.589 0.781 0.641 0.809 0.685 2-step 0.910 0.835 0.748 0.597 0.788 0.650 0.815 0.694 4-step 0.913 0.840 0.752 0.603 0.791 0.654 0.819 0.699 8-step 0.901 0.820 0.736 0.582 0.775 0.633 0.804 0.678 5. Conclusion We propose a generative detector for open-set visual text forensics that localizes tampering by estimating local restoration costs relative to authentic visual-text statistics. To address sparse anomalies, we introduce Sparse-Constraint Rectified Flow and combine it with the pixel-space Forensic-DiT and self-supervised Artifact Injection to preserve high-frequency forensic traces without paired supervision. Experiments demonstrate strong generalization, particularly in zero-shot settings. Our auxiliary stress test further shows that local harmonization can weaken cues used by existing detectors. These results support restoration-cost estimation as a promising direction for open-set text tampering detection. Acknowledgements.This work is supported by the National Natural Science Foundation of China (Grant NO 62376266 and 62406318) and CAAI-Tencent Rhino-Bird Open Research Fund. References M. S. Albergo and E. Vanden-Eijnden (2023) Building normalizing flows with stochastic interpolants. In International Conference on Learning Representations (ICLR), Cited by: §3.1. J. An and S. Cho (2015) Variational autoencoder based anomaly detection using reconstruction probability. Special Lecture on IE 2 (1), p. 1–18. Cited by: §2.2. B. Bayar and M. C. Stamm (2016) A deep learning approach to universal image manipulation detection using a new convolutional layer. In Proceedings of the 4th ACM Workshop on Information Hiding and Multimedia Security (IH&MMSec), p. 5–10. Cited by: §2.1. A. Bendale and T. E. Boult (2016) Towards open set deep networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), p. 1563–1572. Cited by: §2.1. X. Bi, Y. Wei, B. Xiao, and W. Li (2019) RRU-net: the ringed residual u-net for image splicing forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, Cited by: §2.1. L. Chen, Y. Zhu, G. Papandreou, F. Schroff, and H. Adam (2018) Encoder-decoder with atrous separable convolution for semantic image segmentation. In Proceedings of the European Conference on Computer Vision (ECCV), p. 833–851. Cited by: §4.1. X. Chen, C. Dong, J. Ji, J. Cao, and X. Li (2021) Image manipulation detection by multi-view multi-scale supervision. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), p. 14165–14173. Cited by: §2.1, §4.1. C. K. Chng, E. Ding, J. Liu, D. Karatzas, C. S. Chan, L. Jin, Y. Liu, Y. Sun, C. C. Ng, C. Luo, Z. Ni, C. Fang, S. Zhang, and J. Han (2019) ICDAR2019 robust reading challenge on arbitrary-shaped text – rrc-art. In Proceedings of the International Conference on Document Analysis and Recognition (ICDAR), p. 1571–1576. Cited by: §4.1. F. Cruz, N. Sidere, M. Coustaty, V. P. D’Andecy, and J. Ogier (2017) Local binary patterns for document forgery detection. In Proceedings of the 14th IAPR International Conference on Document Analysis and Recognition (ICDAR), p. 1223–1228. Cited by: §2.1. P. Dhariwal and A. Q. Nichol (2021) Diffusion models beat gans on image synthesis. In Advances in Neural Information Processing Systems (NeurIPS), p. 8780–8794. Cited by: §1. J. Duan, H. Sun, F. Ji, K. Zhou, Z. Wang, H. Huang, and L. Jin (2025) RealDTT: towards a comprehensive real-world dataset for tampered text detection. International Journal of Computer Vision 133 (10), p. 6993–7011. Cited by: §4.1, §4.1. J. Frank, T. Eisenhofer, L. Schönherr, A. Fischer, D. Kolossa, and T. Holz (2020) Leveraging frequency analysis for deep fake image recognition. In Proceedings of the International Conference on Machine Learning (ICML), p. 3247–3258. Cited by: §2.1. J. J. Fridrich and J. Kodovský (2012) Rich models for steganalysis of digital images. IEEE Transactions on Information Forensics and Security 7 (3), p. 868–882. Cited by: §3.3. D. Gong, L. Liu, V. Le, B. Saha, M. Mansour, S. Venkatesh, and A. v. d. Hengel (2019) Memorizing normality to detect anomaly: memory-augmented deep autoencoder for unsupervised anomaly detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), p. 1705–1714. Cited by: §2.2. A. W. Harley, A. Ufkes, and K. G. Derpanis (2015) Evaluation of deep convolutional nets for document image classification and retrieval. In Proceedings of the International Conference on Document Analysis and Recognition (ICDAR), p. 991–995. Cited by: §4.1. D. Karatzas, L. Gomez-Bigorda, A. Nicolaou, S. K. Ghosh, A. D. Bagdanov, M. Iwamura, J. Matas, L. Neumann, V. R. Chandrasekhar, S. Lu, F. Shafait, S. Uchida, and E. Valveny (2015) ICDAR 2015 competition on robust reading. In Proceedings of the International Conference on Document Analysis and Recognition (ICDAR), p. 1156–1160. Cited by: §4.1. D. Karatzas, F. Shafait, S. Uchida, M. Iwamura, L. G. i Bigorda, S. R. Mestre, J. Mas, D. F. Mota, J. Almazán, and L. de las Heras (2013) ICDAR 2013 robust reading competition. In Proceedings of the International Conference on Document Analysis and Recognition (ICDAR), p. 1484–1493. Cited by: §4.1. D. P. Kingma and P. Dhariwal (2018) Glow: generative flow with invertible 1x1 convolutions. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §2.2. X. Liao, S. Chen, J. Chen, T. Wang, and X. Li (2023) CTP-net: character texture perception network for document image forgery localization. arXiv preprint arXiv:2308.02158. Cited by: §2.1. Y. Lipman, R. T. Q. Chen, H. Ben-Hamu, M. Nickel, and M. Le (2023) Flow matching for generative modeling. In International Conference on Learning Representations (ICLR), Cited by: §1, §2.2, §3.1. Q. Liu (2022) Rectified flow: a marginal preserving approach to optimal transport. arXiv preprint arXiv:2209.14577. Cited by: §2.2. X. Liu, Y. Liu, J. Chen, and X. Liu (2022) PSCC-net: progressive spatio-channel correlation network for image manipulation detection and localization. IEEE Transactions on Circuits and Systems for Video Technology 32 (11), p. 7505–7517. Cited by: §4.1. X. Liu, C. Gong, and Q. Liu (2023) Flow straight and fast: learning to generate and transfer data with rectified flow. In The Eleventh International Conference on Learning Representations (ICLR 2023), Kigali, Rwanda, May 1–5, 2023, External Links: Link Cited by: §3.1. D. Luo, Y. Liu, R. Yang, X. Liu, J. Zeng, Y. Zhou, and X. Bai (2025) Toward real text manipulation detection: new dataset and new solution. Pattern Recognition 157, p. 110828. Cited by: §2.1. N. Nayef, F. Yin, I. Bizid, H. Choi, Y. Feng, D. Karatzas, Z. Luo, U. Pal, C. Rigaud, J. Chazalon, W. Khlif, M. M. Luqman, J. Burie, C. Liu, and J. Ogier (2017) ICDAR2017 robust reading challenge on multi-lingual scene text detection and script identification – rrc-mlt. In Proceedings of the International Conference on Document Analysis and Recognition (ICDAR), p. 1454–1459. Cited by: §4.1. A. Q. Nichol and P. Dhariwal (2021) Improved denoising diffusion probabilistic models. In Proceedings of the International Conference on Machine Learning (ICML), p. 8162–8171. Cited by: §1. C. Qu, C. Liu, Y. Liu, X. Chen, D. Peng, F. Guo, and L. Jin (2023) Towards robust tampered text detection in document image: new dataset and new solution. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2023), Vancouver, BC, Canada, June 17–24, 2023, p. 5937–5946. Cited by: §1, §4.1, §4.1, §4.1. C. Qu, Y. Zhong, F. Guo, and L. Jin (2025) Revisiting tampered scene text detection in the era of generative ai. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39, p. 694–702. Cited by: §4.1, §4.1. D. Rezende and S. Mohamed (2015) Variational inference with normalizing flows. In Proceedings of the International Conference on Machine Learning (ICML), p. 1530–1538. Cited by: §2.2. R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer (2022) High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 10674–10685. Cited by: §1. O. Ronneberger, P. Fischer, and T. Brox (2015) U-net: convolutional networks for biomedical image segmentation. In Proceedings of the International Conference on Medical Image Computing and Computer-Assisted Intervention (MICCAI), p. 234–241. Cited by: §3.3. M. Sakurada and T. Yairi (2014) Anomaly detection using autoencoders with nonlinear dimensionality reduction. In Proceedings of the MLSDA Workshop, p. 4–11. Cited by: §2.2. T. Schlegl, P. Seeböck, S. M. Waldstein, and G. Langs (2019) Fast unsupervised anomaly detection with generative adversarial networks. Medical Image Analysis 54, p. 30–44. Cited by: §2.2. A. Singh, G. Pang, M. Toh, J. Huang, W. Galuba, and T. Hassner (2021) TextOCR: towards large-scale end-to-end reasoning for arbitrary-shaped scene text. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 8802–8812. Cited by: §4.1. Y. Sun, D. Karatzas, C. S. Chan, L. Jin, Z. Ni, C. K. Chng, Y. Liu, C. Luo, C. C. Ng, J. Han, E. Ding, and J. Liu (2019) ICDAR 2019 competition on large-scale street view text with partial labeling – rrc-lsvt. In Proceedings of the International Conference on Document Analysis and Recognition (ICDAR), p. 1557–1562. Cited by: §4.1. Y. Tian, Z. Tu, H. Chen, J. Hu, C. Xu, and Y. Wang (2024) U-dits: downsample tokens in u-shaped diffusion transformers. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §3.3. A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin (2017) Attention is all you need. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §3.3. S. Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros (2020) CNN-generated images are surprisingly easy to spot… for now. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 8695–8704. Cited by: §1. Y. Wang, H. Xie, M. Xing, J. Wang, S. Zhu, and Y. Zhang (2022) Detecting tampered scene text in the wild. In Computer Vision – ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23–27, 2022, Proceedings, Part XXVIII, S. Avidan, G. J. Brostow, M. Cissé, G. M. Farinella, and T. Hassner (Eds.), Lecture Notes in Computer Science, Vol. 13688, p. 215–232. Cited by: §1, §2.1, §4.1. Y. Wu, W. AbdAlmageed, and P. Natarajan (2019) ManTra-net: manipulation tracing network for detection and localization of image forgeries with anomalous features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 9543–9552. Cited by: §2.1. J. Wyatt, A. Leach, S. M. Schmon, C. G. Willcocks, and A. G. Wilson (2022) AnoDDPM: anomaly detection with denoising diffusion probabilistic models using simplex noise. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 650–656. Cited by: §2.2. E. Xie, W. Wang, Z. Yu, A. Anandkumar, J. M. Alvarez, and P. Luo (2021) SegFormer: simple and efficient design for semantic segmentation with transformers. In Advances in Neural Information Processing Systems, Vol. 34, p. 12077–12090. Cited by: §4.1. W. Xu, J. Luo, C. Zhu, W. Lu, J. Zeng, S. Shi, and C. Lin (2022) Document images forgery localization using a two-stream network. International Journal of Intelligent Systems 37 (8), p. 5272–5289. Cited by: §2.1. J. Zhang, S. Gao, B. Liu, S. Feng, J. Huang, Y. Chen, and Z. Chen (2026) Detecting AI-generated forgeries via iterative manifold deviation amplification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 35494–35503. Cited by: §2.2. J. Zhang, W. Zhu, J. Huang, and Y. Chen (2025) LAMM-ViT: AI face detection via layer-aware modulation of region-guided attention. In ECAI 2025 – 28th European Conference on Artificial Intelligence, Bologna, Italy, October 25–30, 2025, I. Lynce, N. Murano, M. Vallati, S. Villata, F. Chesani, M. Milano, A. Omicini, and M. Dastani (Eds.), Frontiers in Artificial Intelligence and Applications, Vol. 413, p. 3984–3991. External Links: Document, Link Cited by: §1. R. Zhang, M. Yang, X. Bai, B. Shi, D. Karatzas, S. Lu, C. V. Jawahar, Y. Zhou, Q. Jiang, Q. Song, N. Li, K. Zhou, L. Wang, D. Wang, and M. Liao (2019) ICDAR 2019 robust reading challenge on reading chinese text on signboard. In Proceedings of the International Conference on Document Analysis and Recognition (ICDAR), p. 1577–1581. Cited by: §4.1. X. Zhang, N. Li, J. Li, Z. Wang, and R. Huang (2023) Unsupervised surface anomaly detection with diffusion probabilistic model. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), p. 6782–6791. Cited by: §2.2. P. Zhou, X. Han, V. I. Morariu, and L. S. Davis (2018) Learning rich features for image manipulation detection. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), p. 1053–1061. Cited by: §2.1. P. Zhuang, H. Li, S. Tan, B. Li, and J. Huang (2021) Image tampering localization using a dense fully convolutional network. IEEE Transactions on Information Forensics and Security 16, p. 2986–2999. Cited by: §2.1.