Paper deep dive
SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data
Yicheng Bao, Xiahui Guo, Xuhong Wang, Xin Tan
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/14/2026, 5:25:36 AM
Summary
The paper introduces SPARED, an adversarial reinforcement learning framework for detecting AI-generated images that provides justifiable verdicts. It employs a heterogeneous attacker-defender loop where a diffusion-based image editor (attacker) creates hard negative samples by editing real photographs, and a reasoning Multimodal Large Language Model (defender) learns to detect these fakes and provide free-form reasoning. The framework closes dataset bias shortcuts by ensuring paired real/fake images share provenance and by gating the attacker's reward on instruction fidelity, forcing the detector to generalize rather than memorize static artifacts.
Entities (11)
Relation Signals (9)
SPARED → evaluateson → DeepfakeJudge-Detect
confidence 95% · We evaluate SPARED on three externally curated benchmarks: DeepfakeJudge-Detect
SPARED → evaluateson → Holmes-Set
confidence 95% · Holmes-Set (59), fully synthetic images from ten generator families
SPARED → evaluateson → AnomReason-Deepfake
confidence 95% · AnomReason-Deepfake (44), which scores both the verdict and the semantic quality
SPARED → uses → Qwen3.5-9B
confidence 95% · Our defender is a reasoning MLLM built on a Qwen3.5-9B backbone
SPARED → uses → Qwen-Image-Edit-2511
confidence 92% · Our attacker is an RL-optimized image-editing model, a Qwen-Image-Edit-2511 LoRA
SPARED → optimizeswith → DiffusionNFT
confidence 90% · trained with DiffusionNFT (58)
SPARED → optimizeswith → GRPO
confidence 90% · trained with accuracy-based GRPO (41)
SPARED → uses → PaCo
confidence 88% · instruction-following gate (PaCo) (36)
SPARED → outperforms →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Detecting AI-generated images is only half the task: a deployed detector must also justify its verdict, yet existing detectors inherit three failure modes from their training data: real and fake images collected from different sources invite provenance shortcuts, supervised explanation corpora teach templated rationales, and a static forgery corpus leaves the decision boundary standing still while generators keep moving. We introduce \methodname{}, an adversarial reinforcement learning framework that pits two heterogeneous models against each other. A diffusion image editor learns to edit real photographs into fake counterparts of those same photographs that fool the current detector, while a reasoning MLLM learns to expose them with a verdict grounded in free-form reasoning. Both rewards are shortcut-proof by design: the attacker is credited only when its edit is faithfully executed, and the defender only when its verdict is correct. As the two models alternate, each round's attacker regenerates a harder training pool aimed at the current detector's blind spots, so the detector must generalize rather than memorize any fixed artifact distribution. Although the explanation is never rewarded, its quality rises round over round as a side effect of accuracy-only training. A detector trained within this loop improves monotonically across rounds on each of three external benchmarks.
Tags
Links
- Source: https://arxiv.org/abs/2608.12876v1
- Canonical: https://arxiv.org/abs/2608.12876v1
Trouble viewing inline? Open PDF directly →
Full Text
48,283 characters extracted from source content.
Expand or collapse full text
SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data Yicheng Bao Xiahui Guo Xuhong Wang Xin Tan Abstract Detecting AI-generated images is only half the task: a deployed detector must also justify its verdict, yet existing detectors inherit three failure modes from their training data: real and fake images collected from different sources invite provenance shortcuts, supervised explanation corpora teach templated rationales, and a static forgery corpus leaves the decision boundary standing still while generators keep moving. We introduce SPARED, an adversarial reinforcement learning framework that pits two heterogeneous models against each other. A diffusion image editor learns to edit real photographs into fake counterparts of those same photographs that fool the current detector, while a reasoning MLLM learns to expose them with a verdict grounded in free-form reasoning. Both rewards are shortcut-proof by design: the attacker is credited only when its edit is faithfully executed, and the defender only when its verdict is correct. As the two models alternate, each round’s attacker regenerates a harder training pool aimed at the current detector’s blind spots, so the detector must generalize rather than memorize any fixed artifact distribution. Although the explanation is never rewarded, its quality rises round over round as a side effect of accuracy-only training. A detector trained within this loop improves monotonically across rounds on each of three external benchmarks. Introduction Figure 1: (a) A detector trained once on a static corpus is a stationary target for generators that keep moving. (b) SPARED instead trains an image-editing attacker against a reasoning detector in alternation: each round, the attacker forges harder paired fakes and the retrained detector becomes a stronger judge. (c) The same 9B backbone, trained in this loop, improves round over round on three external benchmarks; the SFT dip trades accuracy for the reasoning output format, which the adversarial rounds more than recover. Generalizable, explainable AI-generated image (AIGI) detection takes a single image (a real camera photograph, a fully AI-generated image, or a locally AI-edited photograph) and outputs a real/fake verdict together with a natural-language account of which regions or cues make the image look synthetic. This judge-style formulation, exemplified by recent MLLM-as-a-judge deepfake benchmarks (25) and explainable forensics models (59; 21), matters for three reasons. First, moderation must both flag a fabricated image and justify the flag: an unexplained label is easy to dismiss, and a wrong flag on a realistic photo can itself trigger misinformation. Second, deployed detectors meet fakes from an open, growing population of generators (35; 19), so what decides practical value is generalization beyond a fixed forgery distribution, not accuracy on it. Third, public detectors can be targeted by successful white- and black-box evasion attacks (12), so a detector that cannot keep improving after deployment is already obsolete. This problem is hard because three generations of detectors have already failed it, for different reasons. Traditional signal-, frequency-, and pixel-level detectors (14; 46; 43) identify upsampling fingerprints, spectral artifacts, or neighboring-pixel irregularities left by a specific family of generator architectures. They can perform well in-distribution but degrade sharply when the fingerprint changes: spectral artifacts differ substantially across generative models, hindering generalization to unseen generators (23). Recent generators such as FLUX (5) and Stable Diffusion 3.5 (13; 42) further broaden the synthesis pipelines these detectors must cover. Robust detection therefore also needs semantic evidence: physically implausible geometry, broken object counts, and commonsense violations that require world knowledge rather than pixel-level pattern matching to notice (44; 24). To capture this semantic residue, a second line of work fine-tunes large pretrained models (CLIP-based detectors (39; 30) or MLLMs) on labeled real/fake data, but it fails along an orthogonal axis. Debiasing efforts (16; 40; 7) and the sanity-check literature (54) have identified a dominant source of inflated generalization numbers. When real and fake images in a training set differ in resolution, JPEG quality, or semantic content (because they were sourced independently rather than paired), the detector learns to key on this dataset-level style gap instead of the generation trace itself. Its accuracy then collapses on any semantically aligned, unbiased test set. The result is a field where reported generalization gains are hard to disentangle from residual dataset bias. A third, more recent line reframes detection as MLLM reasoning to inherit world knowledge and produce genuine explanations (59; 44; 20; 27; 22), but two further failure modes emerge here. Supervised fine-tuning on a fixed explanation corpus tends to produce templated, causally shallow rationales rather than an understanding that transfers to unseen artifacts (59); and because the training corpus, however well debiased, is still static, the resulting detector is a stationary target: a fixed decision boundary that the next generator release can be tuned against. The fakes inside a static dataset are also, by construction, only as hard as the detector that existed when the dataset was built. Single-model self-evolution attempts such as ForeAgent (52) revise their own reasoning traces on this same fixed data and inherit the same ceiling: no external adversary manufactures new hard cases. The same structural failure, a static corpus permanently behind an adaptive adversary, has already been addressed with attacker-defender training loops in LLM safety (11; 50; 29) and reasoning (18), and in face-forgery detection with synthesizers that adapt their forgeries to the current detector (6; 28; 9). That literature also records the loop’s own characteristic failure mode: an adversary rewarded only for winning drifts toward degenerate wins (trivial or off-distribution attacks) unless its reward forces genuine engagement. We bring this paradigm into visual forgery detection as SPARED (Shortcut-Proof Adversarial Reasoning over Edited Data; Figure 1), with a generative image editor as the adversary rather than a policy over a fixed pool of forgery operations. We find that it also closes the dataset-bias shortcut diagnosed above, as a side effect of how its training data is constructed. Our defender is a reasoning MLLM built on a Qwen3.5-9B backbone (38) and trained with accuracy-based GRPO (41) to output a free-form reasoning trace followed by an explicit verdict. Because the verdict is the only signal rewarded, explanations cannot score by reproducing templates and improve only insofar as they lead to correct verdicts. This answers the templated-rationale failure above. Our attacker is an RL-optimized image-editing model, a Qwen-Image-Edit-2511 LoRA (51) trained with DiffusionNFT (58), and it does not synthesize fakes from scratch: it edits real source photographs into their fake counterparts. Because every fake is produced from its own real source image, the two share near-identical content, composition, and resolution, and the only systematic difference left for the defender to learn from is the residual editing trace itself. This closes the content/format shortcut identified above (16) by construction, rather than by post-hoc alignment. Figure 2: Overview of SPARED: one adversarial round, read left to right. Attacker training: from one source photograph and its edit instruction the attacker samples a group of candidate edits, and the gated reward credits a rollout only when the instruction was faithfully executed and the result fools the frozen defender, so fooling without editing earns nothing (lock 2). Pool regeneration: the trained attacker re-edits a fixed set of real photographs into pairs whose two halves differ only by the edit (lock 3); the pair shown is an actual training pair. Defender training: both halves of a pair are supervised, and among the sampled responses only verdict correctness is rewarded, so explanations cannot be gamed (lock 1). The retrained defender’s frozen snapshot becomes the judge for round t+1t+1. Closing the dataset-bias shortcut this way only works if the attacker keeps editing in earnest, so the second half of our design is the reward that keeps it honest. The attacker is trained with a gated reward: it is credited only when an instruction-following gate (PaCo) (36) confirms the edit was faithfully executed and the resulting pair defeats the current defender. The game therefore cannot be won by skipping the edit or degenerating into off-manifold noise. This gate is the vision-domain analogue of the anti-collapse mechanisms other self-play systems require (11; 50; 18). The result is an automatically escalating curriculum of instruction-faithful hard negatives, aimed at the current defender’s blind spot, that no fixed dataset can provide. The two models are also architecturally heterogeneous, a diffusion editor in continuous pixel space against an autoregressive MLLM over discrete tokens, and share no parameters. This is a stronger form of the decoupling that MAGIC (50) shows avoids the gradient conflict of shared-parameter self-play, and it contrasts with the closest unified systems in this domain, which couple generation and detection (57) or correction and detection (53) inside one backbone. Trained on this self-generated data beyond a lightweight SFT initialization, SPARED improves monotonically over three adversarial iterations across three external benchmarks, two of them fully zero-shot (Tables 1 and 2, Figure 3). On judge-style detection (25) and semantic-anomaly reasoning (44) it surpasses every baseline we evaluate, with the single exception of a reasoning model 26 times its size on the former, and its explanation quality rises together with accuracy although the explanation is never rewarded. It also transfers to the ten unseen generator families of Holmes-Set (59), whose fully synthetic images are unlike the locally edited photographs it trains on. Our contributions are: • A decoupled attacker–defender reinforcement-learning loop for visual forgery detection whose adversary is a generative image editor rather than a policy over a fixed pool of forgery operations, showing that editing real images into semantically aligned fakes closes this field’s dataset-bias shortcut at the training-data level, rather than through post-hoc alignment. • A heterogeneous, continuous-pixel-space adversary (a PaCo-gated, RL-trained diffusion image editor) paired with a decoupled reasoning-MLLM defender, extending the anti-collapse mechanisms of prior self-play systems to the vision domain. • Empirical evidence that adversarially regenerated edited data alone induces monotonic generalization across three external benchmarks (two of them zero-shot) spanning judge-style detection, semantic-anomaly reasoning, and ten unseen image generators, together with an explicit account of where this signal regresses. Method Overview Our pipeline instantiates the attacker-defender loop introduced in the Introduction (Figure 2) as two independently parameterized models trained in alternation: a reasoning defender (πD _D) that maps an image to a verdict and an explanation, and an image-editing attacker (πA _A) that maps a real photograph and an edit instruction to a synthetic counterpart of that same photograph. Round t trains πA _A against a frozen snapshot of πD(t) _D^(t) to produce a new pool of hard-negative edited images, and the next round trains πD _D on that same pool; the two models never share parameters or a training objective, only this exchanged data and reward signal. Every design decision below follows a single principle: in an adversarial training loop, any reward or data channel that can be satisfied by a shortcut will be, so the loop escalates genuine capability only if every channel connecting the two models is shortcut-proof. The loop has exactly three such channels, each admitting one of the failure modes diagnosed in the Introduction, and each subsection below closes one: the defender’s reward credits only the final verdict, so explanations cannot be gamed independently of detection (Reasoning Defender); the attacker’s reward is gated on instruction fidelity, so fooling without genuinely editing earns nothing (PaCo-Gated Diffusion Attacker); and every fake is paired with its own real source under strict deduplication, so provenance cannot substitute for the editing trace (Data Construction and Training Schedule). With all three channels closed, escalation can occur only through capability: the data gets harder only if the attacker genuinely improves, and the defender gains only by defeating data constructed to defeat it. Reasoning Defender On the defender’s channel, the shortcut is the explanation itself: a detector supervised to reproduce fixed explanation text can satisfy its objective by imitating the phrasing of its training rationales, without ever locating the causal evidence behind a verdict. We therefore leave the defender’s reasoning trace free-form and optimize only the final verdict, so that any reasoning strategy the model discovers is retained solely because it correlates with getting the label right. The defender is built on a Qwen3.5-9B multimodal backbone (38). Given an image x, it generates a response containing an open-ended <reasoning>…</reasoning> span followed by <answer>y y</answer>, where y^∈real,fake y∈\real,fake\. We first LoRA-tune (17) the base model on real/fake reasoning pairs from the judge-training corpus released with DeepfakeJudge (25), disjoint from its evaluation split, to teach the tag format and elementary artifact vocabulary, then merge the adapter and continue with full-parameter GRPO (41). The corpus size and the adapter and optimization hyperparameters are listed in the technical appendix. For each training image x with ground-truth label y, we sample a group of G responses and assign rD(x,y)=[y^=y],r_D(x,y)=1[ y=y], (1) crediting nothing for an unparsable answer or a wrong label; GRPO normalizes rDr_D within the group to form the policy-gradient advantage, with no separate reward term for format, length, or reasoning content. Because rDr_D never rewards the reasoning span directly, reasoning is reinforced only through the correct verdicts it leads to: explanation quality becomes an emergent side effect of accuracy rather than an independent target that can be gamed on its own. PaCo-Gated Diffusion Attacker On the attacker’s channel, the shortcut is fooling without editing: were πA _A rewarded purely for defeating πD _D, the optimum would be degenerate, since leaving the image essentially unedited and pushing it off the manifold of plausible photographs both fool a detector without producing a meaningful hard negative. Closing this shortcut means making a faithfully executed edit a precondition for any fooling credit. πA _A is a LoRA adapter (17) on Qwen-Image-Edit-2511 (51), trained online with DiffusionNFT (58). Given a real source photograph xsrcx_src and an edit instruction c, both drawn from a mixed single-turn editing corpus (ImgEdit, pico-banana-400k, MagicBrush) (55; 37; 56), πA _A produces an edited image xedit=πA(xsrc,c)x_edit= _A(x_src,c), paired with its own source as (xsrc,real)(x_src,real) and (xedit,fake)(x_edit,fake). Every rollout is scored by two frozen judges: an instruction-following scorer rPaCo(xsrc,c,xedit)∈[0,1]r_PaCo(x_src,c,x_edit)∈[0,1] (36), and the current defender snapshot πD(t) _D^(t), queried on both images in the pair to produce a reversed detection reward rdet=[¬(πD(t)(xsrc)=real∧πD(t)(xedit)=fake)],r_det=1 [ ( _D^(t)(x_src)=real\, \, _D^(t)(x_edit)=fake) ], (2) i.e., the attacker earns nothing when the defender gets the whole pair right. The reward is pair-level: the attacker is also credited when the defender misjudges the untouched source, which steers the regenerated pool toward the defender’s real-side errors as well as its fake-side ones. The final reward gates the second on the first: rA=rdetif rPaCo≥0.7,0otherwise,r_A= casesr_det&if r_PaCo≥ 0.7,\\ 0&otherwise, cases (3) optimized with DiffusionNFT. The gate makes rdet=1r_det=1 a necessary but not sufficient condition for reward: an edit that fools πD(t) _D^(t) by ignoring the instruction still scores zero, so only rollouts that are simultaneously instruction-faithful and adversarial to the defender’s current boundary receive positive reward. Because πD(t) _D^(t) is refreshed every round, the region of image space that satisfies both constraints moves with the defender, so each round’s data pool arrives at a difficulty level calibrated to the model it will retrain. Data Construction and Training Schedule The third channel is the training pool itself. Its shortcut, separating reals from fakes by provenance rather than by editing trace, is a property of how the pool is assembled rather than of either model, so it must be closed at the data-construction stage. Every fake in every round must come from editing a real image that is also present as that pair’s real label, and no source image may leak into the images used to build our evaluation benchmarks. Both the real sources and the edit instructions come from the mixed single-turn editing corpus introduced above. A fixed source set is randomly sampled from this corpus once, deduplicated, and screened by perceptual-hash matching against every benchmark used in our subsequent evaluation, so that no training source leaks into any reported result. Each round’s pool then re-edits this same source set with the current attacker; corpus filtering rules and screening thresholds are given in the technical appendix. The resulting schedule alternates the two models over five rounds. Starting from the LoRA-SFT checkpoint merged into a full model, the first defender GRPO round (Iter1) trains on a pool edited by the base image-editing model. Each attacker round (A1, A2) then trains πA _A against a frozen snapshot of the preceding defender, and the next defender round (Iter2, Iter3) continues GRPO from the previous defender checkpoint on a pool regenerated by the newly trained attacker; Iter3 is the defender reported as SPARED throughout this paper. Alternating rather than jointly optimizing the two models keeps each optimization well-posed: πA _A needs a judge that is stationary within an RL run, and πD _D needs a pool that does not shift mid-run. Experiments Model Real Acc Real F1 Fake Acc Fake F1 Overall Acc Overall F1 Open InternVL3.5-1B-HF (47) 47.8 63.0 47.8 11.4 47.8 37.2 Qwen3-VL-2B-Instruct (3) 49.8 44.7 49.8 54.0 49.8 49.4 Qwen3-VL-8B-Instruct (3) 50.4 23.7 50.4 63.2 50.4 43.5 Google-Gemma-12B (15) 57.7 57.4 49.4 54.0 53.6 55.7 Microsoft-Phi-4-Instruct (2) 61.0 60.8 54.4 58.2 57.7 59.5 InternVL3.5-GPT-OSS-20B-A4B (47) 55.6 67.6 55.6 29.2 55.6 48.4 Qwen3-VL-30B (3) 94.6 74.5 41.0 56.0 67.8 65.3 Qwen3-VL-235B (3) 93.5 78.6 55.4 68.4 74.5 73.5 Closed Gemini-2.5-Flash (10) 96.6 73.7 34.5 50.0 65.6 61.9 ChatGPT-4o-mini (31) 95.8 70.2 22.7 35.8 59.3 53.0 Reasoning Qwen3-VL-8B-Thinking (3) 67.1 67.1 78.7 69.9 72.9 68.5 Qwen3-VL-30B-Thinking (3) 67.4 66.0 87.6 72.9 77.5 69.5 Qwen3-VL-235B-Thinking (3) 75.0 76.6 90.3 79.8 82.7 78.2 Deepfake-Specialized SIDA-13B-Description (21) 67.6 57.0 27.9 34.5 47.8 45.8 Qwen2.5-VL-Gen-Buster++ (48) 49.9 40.0 49.9 66.5 49.9 53.3 UniGenDet (57) 0.0 0.0 99.9 66.6 50.0 33.3 Ours Qwen3.5-9B (38) 65.7 68.7 65.0 72.1 65.4 70.4 Qwen3.5-9B-LoRA-SFT (38; 17) 57.1 65.4 82.0 73.0 69.6 69.2 Qwen3.5-9B-Iter1 (38) 59.3 68.2 84.9 75.3 72.1 71.8 Qwen3.5-9B-Iter2 (38) 66.4 73.5 85.5 78.1 76.0 75.8 Qwen3.5-9B-Iter3 (38) 70.2 77.4 88.8 81.2 79.5 79.3 Table 1: Comparison of SOTA open-source, closed-source, reasoning, and deepfake models on the DeepfakeJudge-Detect dataset (25). Invalid or unparsable answers are counted as incorrect; Real Acc and Fake Acc are per-class recall, and Overall F1 is the macro average of real and fake F1. Red bold and blue underline mark the best and second-best overall scores; the shaded row is our final model. Model Acc CSemAP-Phe CSemAP-Rea CSemAP-Full Open LLaVA-OV-7B (26) 66.26 0.1235 0.1124 0.1141 Phi-3.5-Vision (1) 41.33 0.0685 0.0602 0.0616 InternVL2.5-8B (8) 63.61 0.1165 0.1085 0.1089 InternVL3-8B (60) 62.84 0.2949 0.2394 0.2559 InternVL3-9B (60) 64.04 0.2293 0.1987 0.2081 Qwen2-VL-7B (45) 67.21 0.1710 0.1421 0.1496 Qwen2.5-VL-7B (4) 65.41 0.1295 0.1085 0.1155 Qwen2.5-VL-72B (4) 77.60 0.2626 0.2337 0.2453 Closed Gemini-2.5-Pro (10) 85.65 0.2631 0.2192 0.2382 GPT-o3 (34) 85.60 0.3189 0.2690 0.2898 GPT-5 (33) 75.22 0.1790 0.1535 0.1658 GPT-4o (32) 87.76 0.3750 0.3487 0.3612 Deepfake-Specialized AnomReasonor-7B (44) 82.61 0.3684 0.3574 0.3613 UniGenDet (57) 88.59 0.4729 0.3965 0.4234 Ours Qwen3.5-9B (38) 84.05 0.3268 0.2896 0.3063 Qwen3.5-9B-LoRA-SFT (38; 17) 77.83 0.5029 0.4794 0.4792 Qwen3.5-9B-Iter1 (38) 85.72 0.5164 0.4909 0.4927 Qwen3.5-9B-Iter2 (38) 87.58 0.5349 0.5065 0.5103 Qwen3.5-9B-Iter3 (38) 92.18 0.5468 0.5167 0.5207 Table 2: Deepfake detection with explanation scoring on AnomReason-Deepfake (44). Acc measures binary deepfake classification, while CSemAP reports classification-aware semantic quality for phenomenon (Phe), reasoning (Rea), and full matching. Red bold and blue underline mark the best and second-best values per column; the shaded row is our final model. Experimental Setup We evaluate SPARED on three externally curated benchmarks: DeepfakeJudge-Detect (25), a judge-style benchmark whose fake pool combines text-to-image generations with locally edited real photographs; AnomReason-Deepfake (44), which scores both the verdict and the semantic quality of the accompanying explanation through classification-aware semantic AP (CSemAP); and Holmes-Set (59), fully synthetic images from ten generator families that never appear in our training data. We anchor the evaluation on the first two, which are recent, far from saturated, and hard for different reasons: DeepfakeJudge-Detect draws its fakes from leaderboard-frontier commercial editors (Nano-Banana, SeedDream, Flux-Kontext, Qwen-Edit), while AnomReason-Deepfake screens its pool (Midjourney, SD3.5, FLUX) for photorealism and scores the explanation alongside the verdict. Holmes-Set is the mature fully-synthetic task and serves as an out-of-genre transfer probe. Baseline pools are benchmark-specific: each table compares against the strongest available systems of each kind, while UniGenDet and every SPARED stage appear in all three as a common reference. AnomReason-Deepfake and Holmes-Set are fully zero-shot; for DeepfakeJudge-Detect, only the SFT initialization uses the suite’s designated training corpus. GenShield, which has no public release, appears only in the Holmes-Set comparison. Training configurations are listed in the technical appendix. Main Results Judge-style detection (Table 1). Every adversarial round improves every aggregate metric on the primary benchmark: overall accuracy rises 69.6 → 72.1 → 76.0 → 79.5 from SFT through Iter3, with real recall (57.1 → 70.2) and fake recall (82.0 → 88.8) climbing together rather than trading off. At 9B parameters, the final model surpasses every non-reasoning MLLM we evaluate, including Qwen3-VL-235B (74.5), and every reasoning model up to 30B (77.5), trailing only Qwen3-VL-235B-Thinking (82.7), a model 26× its size. The per-class columns show where this margin comes from: strong closed models answer “real” almost unconditionally (96.6/95.8 real recall against 34.5/22.7 fake recall), while the synthetic-image specialist UniGenDet defaults the other way and answers “fake” on essentially every image (0.0/99.9); the same classification head reaches 99.2 on Holmes-Set (supplementary material), so its collapse here measures distribution shift, not a weak detector. Most open baselines sit near chance on one or both classes. SPARED and the 26×-larger 235B-Thinking are the only two models holding both recalls above 70. The fake pool also splits by construction into a text-to-image and a locally edited subset. The generated subset is near saturation even for the base model (95.3, and 98.3 after training). The gain concentrates in the edited subset, where a small edit leaves most of the image real: accuracy rises from 44.8 to 82.5 (Figure 3c), matching a training pool built from such edits. Figure 3: (a, b) Per-generator accuracy and AP on Holmes-Set across training stages, with axes ordered by final-round accuracy: each adversarial round expands the accuracy polygon, and the final round’s AP stays above 92 on every family. (c) DeepfakeJudge-Detect accuracy on the two fake subsets: the gain concentrates in the locally edited subset. Verdict with reasoning (Table 2). On AnomReason-Deepfake, SPARED reaches 92.18 accuracy zero-shot, above every closed model we compare against (GPT-4o: 87.76), 3.6 points above the strongest baseline, UniGenDet (88.59), and 9.6 points above AnomReasonor (82.61), although the latter is fine-tuned on this benchmark’s training data. Explanation quality moves the same way: CSemAP-Full reaches 0.5207, a 23% relative improvement over the strongest baseline score (0.4234). SFT trades accuracy for the reasoning format (84.05 → 77.83 Acc, but 0.3063 → 0.4792 CSemAP); the subsequent GRPO rounds (41), whose reward never scores the explanation, then lift both metrics simultaneously and monotonically (85.72/0.4927 → 87.58/0.5103 → 92.18/0.5207). This is the behavior the Method predicts: once explanations can be reinforced only through the verdicts they lead to, explanation quality rises as a side effect of detection accuracy. Generalization to unseen generators (Figure 3a; per-generator table in the supplementary material). Holmes-Set is the hardest transfer: the adversarial rounds train exclusively on locally edited photographs, yet must classify fully synthetic images from ten unseen generator families. Mean accuracy rises monotonically from 53.0 (base) through 65.7 (SFT) and 84.5 (Iter1) to 92.8 (Iter3) with zero in-domain data, within 2.8 points of AIGI-Holmes (95.6); Figure 3a shows the expansion per generator. Adding in-domain detection data to Iter3, a mix of the FakeClue corpus (49) and the benchmark’s own training set (Iter3+Holmes), reaches 97.2 mean accuracy and 99.9 mean AP, the best AP in the table, closing most of the distance to the strongest specialists, GenShield (98.8) and UniGenDet (99.2). The data alone does not explain this: the same mix given to the SFT model without adversarial rounds (SFT+Holmes) reaches 89.5, behind even the zero-shot Iter3. In-domain data compounds the adversarial rounds rather than substituting for them. This task is also close to saturation, with five detectors above 95, while the two anchored benchmarks still separate models sharply; UniGenDet reaches 99.2 here yet collapses on DeepfakeJudge-Detect, and SPARED holds both regimes (79.5 there, 92.8 zero-shot here). Where the signal regresses. The ten-generator breakdown also locates the sharpest regression in the adversarial training signal: Janus accuracy drops from 86.5 (Iter2) to 73.1 (Iter3), even as every other family’s accuracy improves and the mean rises from 90.2 to 92.8. This is not a loss of capacity: with in-domain data added, Janus recovers to 84.3 (Iter3+Holmes). Rather, the hard 0/1 fooling reward has no per-family difficulty control, so the family closest to the region the harder pool no longer exercises can regress even as the mean improves. Figure 4: Qualitative cases. (a) A mechanical violation: the base model judges the image real and explicitly reports no impossible geometry, while SPARED identifies the air gap separating the adjustment worm from the rack teeth and explains why the mechanism could not move the jaw. (b) A temporal violation: the base model accepts a 1930s Shanghai street scene as a genuine historical photograph, while SPARED finds the modern touchscreen smartphone in the woman’s hand and rejects the image as anachronistic. (c) An information-visualization violation: the base model reads the classroom’s water-cycle poster as a standard educational print, while SPARED locates the “evaporation” arrow pointing downward from cloud to ocean and states that the real process runs the other way. Qualitative Analysis Figure 4 shows the trained detector on three generated images the base model accepts as real: a wrench whose adjustment worm cannot reach the rack teeth it is supposed to drive, a 1930s street scene holding a modern smartphone, and a classroom poster whose “evaporation” arrow points down into the ocean. Between them they instantiate the semantic-anomaly classes the Introduction argued remain detectable once low-level artifacts disappear: implausible geometry, and violations that take historical or scientific world knowledge to notice. In each case the verdict comes with evidence the reader can check against the image, the behavior the verdict-only reward was designed to elicit. Ablation Study DFJ-Detect AnomReason-DF Variant Acc F1 Acc CSemAP Iter1 (shared starting point) 72.1 71.8 85.72 0.4927 + static-pool GRPO (4.7×4.7× budget) 74.3 74.3 88.00 0.4998 + fresh-source GRPO, frozen attacker (7.1×7.1× budget) 73.7 73.6 86.84 0.4990 + one adversarial round, no PaCo gate 66.7 63.8 81.12 0.4991 + one adversarial round, unpaired reals 73.2 73.0 85.18 0.5005 + one adversarial round (Iter2) 76.0 75.8 87.58 0.5103 + adversarial rounds (Iter2 → Iter3) 79.5 79.3 92.18 0.5207 Table 3: Ablation on DeepfakeJudge-Detect (DFJ-Detect) and AnomReason-Deepfake (AnomReason-DF), all variants starting from the same Iter1 model: continued GRPO on the frozen round-one pool (static), on fresh-source pools regenerated by the frozen base editor (no attacker training), one adversarial round with the attacker’s instruction-fidelity gate removed, one round on an unpaired pool (each fake’s paired real replaced by a real from disjoint sources), one gated round (Iter2), and the full schedule (Iter2 → Iter3). Red bold marks the best value per column. Adversarial rounds vs. continued static training (Table 3). If the adversarial rounds merely re-label the benefit of training longer, then freezing the loop after the first round and simply continuing GRPO on the same base-edited pool should match the full schedule. Table 3 shows it does not: the static branch captures only 2.2 of the 7.4 points that the adversarial branch adds on DeepfakeJudge-Detect, and trails on every metric. The trajectory is stronger evidence than the endpoint: the static run peaks early, then declines; real recall collapses from the 60s into the 40s, consistent with a boundary drifting toward “fake”, and explanation quality plateaus (CSemAP-Full never exceeds 0.5120). No static checkpoint approaches Iter3 on detection and explanation jointly, whereas the adversarial rounds lift both monotonically. A second control rules out fresh data alone: regenerating the pool each round from freshly sampled sources with the frozen base editor, from the same Iter1 model, peaks at 73.7 on the primary benchmark and oscillates below that thereafter, despite consuming more total budget than the entire schedule. More optimization does not close the gap, and neither does fresher data; the gains require an attacker that keeps learning to fool the current defender. Gating the attacker’s reward (Table 3). We repeat the first attacker round with the gate removed, rewarding fooling alone. At matched budget its behavior drifts as the Method predicts: it passes the instruction-fidelity check 9.6 points less often, its median edit magnitude shrinks by 27%, and it fools the frozen defender slightly more, winning more while editing less. Training a defender round on this pool turns drift into damage: instead of reproducing Iter2’s gain, the round falls below its starting point (66.7 vs. Iter1’s 72.1 on DeepfakeJudge-Detect; 81.12 vs. 85.72 on AnomReason-Deepfake). The failure is diagnostic: real recall collapses to 38.2 while fake recall inflates to 95.1, consistent with a pool whose barely-edited “fakes” teach the defender that realistic-looking images are fake, which is exactly what the gate exists to prevent. Unpairing the training pool (Table 3). The last lock is the pairing itself. If the pairing were cosmetic, replacing the reals with photographs from disjoint sources (same fakes, same budget) should not matter. Instead, most of the round’s benefit disappears: the unpaired round gains 1.1 points on DeepfakeJudge-Detect where the paired round (Iter2) gains 3.9, and on AnomReason-Deepfake it lands below even its starting point (85.18 vs. Iter1’s 85.72, against Iter2’s 87.58). Part of the training signal is spent on provenance cues that do not transfer, the dataset-bias shortcut the pairing exists to close. Conclusion We presented SPARED, a decoupled attacker–defender reinforcement-learning loop for reasoning-based AI-generated image detection: a diffusion image editor forges paired fakes under an instruction-fidelity gate, and a reasoning MLLM learns to expose them under a verdict-only reward. Once every channel connecting the two models is shortcut-proof, adversarial pressure converts into capability: the detector improves monotonically across rounds and transfers to three external benchmarks, two of them zero-shot, and neither longer training, fresher data, nor in-domain data substitutes for an evolving attacker. Its main limitation is the hard 0/1 fooling reward: without per-family difficulty control, an isolated per-generator regression persists even as the means rise. A graded difficulty signal is the natural next step. References Abdin et al. (2024) M. Abdin, S. A. Jacobs, A. A. Awan, et al. Phi-3 technical report: a highly capable language model locally on your phone. External Links: 2404.14219, Document, Link Cited by: Table 2. Abdin et al. (2024) M. Abdin et al. Phi-4 technical report. External Links: 2412.08905, Document, Link Cited by: Table 1. Bai et al. (2025a) S. Bai, Y. Cai, R. Chen, K. Chen, X. Chen, Z. Cheng, L. Deng, W. Ding, et al. Qwen3-VL Technical Report. External Links: 2511.21631, Link Cited by: Table 1, Table 1, Table 1, Table 1, Table 1, Table 1, Table 1. Bai et al. (2025b) S. Bai, K. Chen, X. Liu, et al. Qwen2.5-VL technical report. External Links: 2502.13923, Document, Link Cited by: Table 2, Table 2. Black Forest Labs (2024) Black Forest Labs FLUX.1 [dev]. Note: Hugging Face model card External Links: Link Cited by: Introduction. Chen et al. (2022) L. Chen, Y. Zhang, Y. Song, L. Liu, and J. Wang Self-Supervised Learning of Adversarial Example: Towards Good Generalizations for Deepfake Detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 18710–18719. External Links: Link Cited by: Introduction. Chen et al. (2025) R. Chen, J. Xi, Z. Yan, K. Zhang, S. Wu, J. Xie, X. Chen, L. Xu, et al. Dual Data Alignment Makes AI-Generated Image Detector Easier Generalizable. In Advances in Neural Information Processing Systems, External Links: 2505.14359, Link Cited by: Introduction. Chen et al. (2024) Z. Chen, W. Wang, Y. Cao, et al. Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling. External Links: 2412.05271, Document, Link Cited by: Table 2. Chou et al. (2026) Y. Chou, T. Yu, W. Huang, Y. Zhang, T. Dai, and S. Xia Improving Deepfake Detection with Reinforcement Learning-Based Adaptive Data Augmentation. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40, p. 3381–3389. External Links: Document, Link Cited by: Introduction. Comanici et al. (2025) G. Comanici, E. Bieber, M. Schaekermann, et al. Gemini 2.5: pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. External Links: 2507.06261, Document, Link Cited by: Table 1, Table 2. Dai et al. (2025) M. Dai, S. Liu, Z. Zhao, J. Gao, H. Sun, and X. Li Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security. p. 11414–11423. External Links: Document Cited by: Introduction, Introduction. Diao et al. (2024) Y. Diao, N. Zhai, C. Miao, Z. Yu, X. Wei, X. Yang, and M. Wang Vulnerabilities in AI-Generated Image Detection: The Challenge of Adversarial Attacks. External Links: 2407.20836, Link Cited by: Introduction. Esser et al. (2024) P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, et al. Scaling Rectified Flow Transformers for High-Resolution Image Synthesis. In International Conference on Machine Learning, External Links: Link Cited by: Introduction. Frank et al. (2020) J. Frank, T. Eisenhofer, L. Schönherr, A. Fischer, D. Kolossa, and T. Holz Leveraging Frequency Analysis for Deep Fake Image Recognition. International Conference on Machine Learning. Cited by: Introduction. Gemma Team et al. (2025) Gemma Team et al. Gemma 3 technical report. External Links: 2503.19786, Document, Link Cited by: Table 1. Guillaro et al. (2025) F. Guillaro, G. Zingarini, B. Usman, A. Sud, D. Cozzolino, and L. Verdoliva A Bias-Free Training Paradigm for More General AI-generated Image Detection. p. 18685–18694. External Links: Document Cited by: Introduction, Introduction. Hu et al. (2022) E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, and W. Chen LoRA: low-rank adaptation of large language models. In International Conference on Learning Representations, External Links: Link Cited by: Reasoning Defender, PaCo-Gated Diffusion Attacker, Table 1, Table 2. Huang et al. (2025a) C. Huang, W. Yu, X. Wang, H. Zhang, Z. Li, R. Li, J. Huang, H. Mi, et al. R-Zero: Self-Evolving Reasoning LLM from Zero Data. arXiv.org. Cited by: Introduction, Introduction. Huang et al. (2026) O. Huang, M. Lin, J. Tan, X. Du, Y. Qiu, J. Zheng, X. Kong, Y. Jiang, et al. MIRAGE: Towards AI-Generated Image Detection in the Wild. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40, p. 5076–5084. External Links: Document, Link Cited by: Introduction. Huang et al. (2025b) T. Huang, W. Lin, K. Hua, W. Cheng, J. Yamagishi, and J. Chen ThinkFake: Reasoning in Multimodal Large Language Models for AI-Generated Image Detection. External Links: 2509.19841, Document, Link Cited by: Introduction. Huang et al. (2025c) Z. Huang, J. Hu, X. Li, Y. He, X. Zhao, B. Peng, B. Wu, X. Huang, et al. SIDA: Social Media Image Deepfake Detection, Localization and Explanation with Large Multimodal Model. p. 28831–28841. External Links: Document Cited by: Introduction, Table 1. Ji et al. (2026) Y. Ji, Y. Hong, Q. Fan, J. Lan, H. Zhu, W. Wang, L. Zhang, and J. Zhang FakeXplain: AI-Generated Image Detection via Human-Aligned Grounded Reasoning. In International Conference on Learning Representations, External Links: Link Cited by: Introduction. Karageorgiou et al. (2025) D. Karageorgiou, S. Papadopoulos, I. Kompatsiaris, and E. Gavves Any-Resolution AI-Generated Image Detection by Spectral Learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 18706–18717. External Links: Link Cited by: Introduction. Kim et al. (2026) J. Kim, S. Kim, S. Lee, S. Jung, J. M. Rehg, and H. Choi When Eyes Betray AI: Social Gaze Consistency as a Semantic Cue for AI-Generated Image Detection. External Links: 2605.27348, Document, Link Cited by: Introduction. Kuckreja et al. (2026) K. Kuckreja, P. Gupta, M. H. Khan, and A. Dhall Pixels Don’t Lie (But Your Detector Might): Bootstrapping MLLM-as-a-Judge for Trustworthy Deepfake Detection and Reasoning Supervision. Cited by: Introduction, Introduction, Reasoning Defender, Experimental Setup, Table 1. Li et al. (2024) B. Li et al. LLaVA-OneVision: easy visual task transfer. External Links: 2408.03326, Document, Link Cited by: Table 2. Li et al. (2025) T. Li, Z. Huang, H. Wen, Y. He, S. Lyu, B. Wu, and G. Cheng RAIDX: A Retrieval-Augmented Generation and GRPO Reinforcement Learning Framework for Explainable Deepfake Detection. In Proceedings of the 33rd ACM International Conference on Multimedia, External Links: Document, Link Cited by: Introduction. Lin et al. (2024) Y. Lin, W. Song, B. Li, Y. Li, J. Ni, H. Chen, and Q. Li Fake It till You Make It: Curricular Dynamic Forgery Augmentations towards General Deepfake Detection. In European Conference on Computer Vision, External Links: 2409.14444, Link Cited by: Introduction. Liu et al. (2025) M. Liu, L. Jiang, Y. Liang, S. S. Du, Y. Choi, T. Althoff, and N. Jaques Chasing Moving Targets with Online Self-Play Reinforcement Learning for Safer Language Models. arXiv.org. Cited by: Introduction. Ojha et al. (2023) U. Ojha, Y. Li, and Y. J. Lee Towards Universal Fake Image Detectors that Generalize Across Generative Models. p. 24480–24489. External Links: Document Cited by: Introduction. OpenAI (2024a) OpenAI GPT-4o mini: advancing cost-efficient intelligence. Note: OpenAI release blog External Links: Link Cited by: Table 1. OpenAI (2024b) OpenAI GPT-4o system card. External Links: Link Cited by: Table 2. OpenAI (2025a) OpenAI Introducing GPT-5. External Links: Link Cited by: Table 2. OpenAI (2025b) OpenAI OpenAI o3 and o4-mini system card. External Links: Link Cited by: Table 2. Park and Owens (2025) J. Park and A. Owens Community Forensics: Using Thousands of Generators to Train Fake Image Detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 8245–8257. External Links: Link Cited by: Introduction. Ping et al. (2025) B. Ping, C. Jia, M. Luo, C. Xia, X. Shen, Z. Dang, and H. Qian PaCo-RL: Advancing Reinforcement Learning for Consistent Image Generation with Pairwise Reward Modeling. External Links: 2512.04784, Link Cited by: Introduction, PaCo-Gated Diffusion Attacker. Qian et al. (2025) Y. Qian, E. Bocek-Rivele, L. Song, J. Tong, Y. Yang, J. Lu, W. Hu, and Z. Gan Pico-Banana-400K: a large-scale dataset for text-guided image editing. External Links: 2510.19808, Link Cited by: PaCo-Gated Diffusion Attacker. Qwen Team (2026) Qwen Team Qwen3.5: towards native multimodal agents. External Links: Link Cited by: Introduction, Reasoning Defender, Table 1, Table 1, Table 1, Table 1, Table 1, Table 2, Table 2, Table 2, Table 2, Table 2. Radford et al. (2021) A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, et al. Learning Transferable Visual Models From Natural Language Supervision. In Proceedings of the 38th International Conference on Machine Learning, M. Meila and T. Zhang (Eds.), Proceedings of Machine Learning Research, Vol. 139, p. 8748–8763. External Links: Link Cited by: Introduction. Rajan et al. (2025) A. S. Rajan, U. Ojha, J. Schloesser, and Y. J. Lee Aligned Datasets Improve Detection of Latent Diffusion-Generated Images. In International Conference on Learning Representations, External Links: Link Cited by: Introduction. Shao et al. (2024) Z. Shao, P. Wang, Q. Zhu, R. Xu, J. Song, X. Bi, H. Zhang, M. Zhang, et al. DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models. arXiv preprint arXiv:2402.03300. Cited by: Introduction, Reasoning Defender, Verdict with reasoning (Table ).. Stability AI (2024) Stability AI Stable Diffusion 3.5 Large. Note: Hugging Face model card External Links: Link Cited by: Introduction. Tan et al. (2023) C. Tan, H. Liu, Y. Zhao, S. Wei, G. Gu, P. Liu, and Y. Wei Rethinking the Up-Sampling Operations in CNN-based Generative Network for Generalizable Deepfake Detection. arXiv.org. Cited by: Introduction. Tan et al. (2025) C. Tan, X. Ming, J. Wang, R. Tao, B. Li, Y. Wei, Y. Zhao, and Y. Lu Semantic Visual Anomaly Detection and Reasoning in AI-Generated Images. arXiv.org. Cited by: Introduction, Introduction, Introduction, Experimental Setup, Table 2, Table 2. Wang et al. (2024) P. Wang, S. Bai, S. Tan, et al. Qwen2-VL: enhancing vision-language model’s perception of the world at any resolution. External Links: 2409.12191, Document, Link Cited by: Table 2. Wang et al. (2020) S. Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros CNN-Generated Images Are Surprisingly Easy to Spot… for Now. p. 8692–8701. External Links: Document Cited by: Introduction. Wang et al. (2025) W. Wang, Z. Gao, L. Gu, et al. InternVL3.5: advancing open-source multimodal models in versatility, reasoning, and efficiency. External Links: 2508.18265, Document, Link Cited by: Table 1, Table 1. Wen et al. (2025a) H. Wen, T. Li, Z. Huang, Y. He, and G. Cheng BusterX++: towards unified cross-modal ai-generated content detection and explanation with MLLM. External Links: 2507.14632, Document, Link Cited by: Table 1. Wen et al. (2025b) S. Wen, J. Ye, P. Feng, H. Kang, Z. Wen, Y. Chen, J. Wu, W. Wu, et al. Spot the Fake: Large Multimodal Model-Based Synthetic Image Detection with Artifact Explanation. arXiv.org. Cited by: Generalization to unseen generators (Figure a; per-generator table in the supplementary material).. Wen et al. (2026) X. Wen, Z. He, H. Qi, Z. Wan, Z. Ma, Y. Wen, T. Zheng, X. Xu, et al. MAGIC: A Co-Evolving Attacker-Defender Adversarial Game for Robust LLM Safety. arXiv.org. Cited by: Introduction, Introduction, Introduction. Wu et al. (2025) C. Wu, J. Li, J. Zhou, J. Lin, K. Gao, K. Yan, S. Yin, S. Bai, et al. Qwen-Image Technical Report. External Links: 2508.02324, Link Cited by: Introduction, PaCo-Gated Diffusion Attacker. Wu et al. (2026) Y. Wu, K. Yan, Y. Liu, J. Zhou, F. Huang, R. Zhang, Z. Zhao, and F. Wu Perception, Verdict, and Evolution: Hindsight-Driven Self-Refining Forensics Agent for AI-Generated Image Detection. Cited by: Introduction. Xu et al. (2026) Z. Xu, X. Zhang, Y. Xu, Q. Huang, S. Chen, T. Yao, S. Ding, and J. Zhang GenShield: Unified Detection and Artifact Correction for AI-Generated Images. Cited by: Introduction. Yan et al. (2024) S. Yan, O. Li, J. Cai, Y. Hao, X. Jiang, Y. Hu, and W. Xie A Sanity Check for AI-generated Image Detection. International Conference on Learning Representations. Cited by: Introduction. Ye et al. (2025) Y. Ye, X. He, Z. Li, B. Lin, S. Yuan, Z. Yan, B. Hou, and L. Yuan ImgEdit: a unified image editing dataset and benchmark. External Links: 2505.20275, Link Cited by: PaCo-Gated Diffusion Attacker. Zhang et al. (2023) K. Zhang, L. Mo, W. Chen, H. Sun, and Y. Su MagicBrush: a manually annotated dataset for instruction-guided image editing. In Advances in Neural Information Processing Systems, External Links: Link Cited by: PaCo-Gated Diffusion Attacker. Zhang et al. (2026) Y. Zhang, W. Zheng, Y. Li, B. Yu, Y. Zheng, L. Chen, J. Lu, and J. Zhou UniGenDet: A Unified Generative-Discriminative Framework for Co-Evolutionary Image Generation and Generated Image Detection. Cited by: Introduction, Table 1, Table 2. Zheng et al. (2025) K. Zheng, H. Chen, H. Ye, H. Wang, Q. Zhang, K. Jiang, H. Su, S. Ermon, et al. DiffusionNFT: Online Diffusion Reinforcement with Forward Process. arXiv preprint arXiv:2509.16117. Cited by: Introduction, PaCo-Gated Diffusion Attacker. Zhou et al. (2025) Z. Zhou, Y. Luo, Y. Wu, K. Sun, J. Ji, K. Yan, S. Ding, X. Sun, et al. Aigi-Holmes: Towards Explainable and Generalizable AI-Generated Image Detection via Multimodal Large Language Models. p. 18746–18758. External Links: Document Cited by: Introduction, Introduction, Introduction, Experimental Setup. Zhu et al. (2025) J. Zhu, W. Wang, Z. Chen, et al. InternVL3: exploring advanced training and test-time recipes for open-source multimodal models. External Links: 2504.10479, Document, Link Cited by: Table 2, Table 2.