What Has Long Been Divided Shall Unite: Unified Fake Image Detection Unified FID

Take a guess: which forgery method was used to create the chat screenshot below?

A little tricky to choose, isn't it? ;)

Your answer determines which fake-image detection model you need to use. Existing research on passive image forensics is essentially divided into several independent tracks. These include, but are not limited to, AIGC detection (whole-image generation), detection of partial tampering in natural images, tampering detection in (pure) document images, and Deepfake detection (face forgery)^[1]. Moreover, models across these tracks are not interchangeable: an image tampering detector cannot detect tampered document images, a Deepfake detector is ineffective on faces in AIGC images, and so on^[1]. Of course, applying a Deepfake detector to an AIGC image yields results little better than a random guess, offering no useful guidance.

1The Emergence of a Paradox

In practice, then, checking the authenticity of this chat screenshot leads us into a "Preset Paradox":

A user must first identify the image's forgery method to choose the right forensic model and obtain a result. But if the user can already tell how the image was forged, why would they need a forensic model at all?

The solution to this paradox is equally straightforward:

Build a Unified Fake Image Detection model, or Unified FID for short: a model that can detect images forged by any method without presupposing how they were forged. In practice, the user would then need only to submit an image to a single Unified FID detector to obtain the result.

2Division and Unification in Passive Image Forensics

Before we go further into Unified FID, there is a question we need to address: why did passive image forensics, or content safety, develop into at least four completely independent tracks? Did researchers never consider how these methods would be used in practice?

Such is the way of the world: what has long been divided must unite, and what has long been united must divide.

Just as practical needs inevitably push detection methods toward unification, developing independent detectors for different forgery methods was itself an inevitable stage in the technology's evolution.

The evolution of content safety, passive forensics, and fake-image detection follows a shift in the boundaries between forgery methods: once clear, they are now blurred. Put more simply, this is a convergence effect brought about by rapidly advancing large models. Forgery methods are becoming black boxes and converging on the same pattern: having a large model do the work.

2.1Division: When the Boundaries of Forgery Methods Were Clear

Turn the clock back just a year or two, and different kinds of forged content generally called for different forgery methods. For face forgery, for example, anything other than Deepfake, including manual Photoshop editing, usually looked fake at a glance. There was no need for a detector; the human eye could tell. Document images, by contrast, had to be edited character by character in Photoshop, with the font, size, color, and other details kept consistent. Simply using a generative model would fail to produce even the basic character shapes correctly.

The requirements at the time were therefore clear. Each type of image had a relatively fixed set of forgery methods, and a dedicated detector could be both effective, thanks to its specialization, and inexpensive. Research gradually developed four independent tracks around those methods. There was some overlap: inpainting in image tampering, for example, also involved direct generation by an AI model. But the tracks remained largely separate, each with its own training data, model designs, evaluation data, and evaluation methods. And this caused no difficulty whatsoever in practical use.

2.2Unification: Large Models Have Erased the Boundaries Between Forgery Methods

With the arrival of models that unify generation and understanding, such as GPT-Image-2, alongside a growing array of harness tools, large models have made a qualitative leap in their ability to forge images directly to user specifications. Take our observations of Hong Kong's insurance industry: most high-quality fake images used for insurance fraud today, those difficult to distinguish with the naked eye, are produced directly by large models. Examples include forged medical certificates, falsified claim amounts, and fake insurance records. This used to be manual Photoshop work, which was costly to learn, time-consuming to perform, and unsuitable for some scenarios. Now large models do it directly, and do it remarkably well. As a result, fake images exhibit four characteristic traits: low barriers to entry, high volume, high customizability, and strong deceptive power.

Large-model capabilities now largely span, or blur, the boundaries that once separated forgery methods. Whatever an image contains, you can simply have a large model do the work.

3The B/P Definition of Unified Fake Image Detection

3.1Is Unified FID Just AIGC Detection?

If everything is now forged by large models, does that mean Unified FID is simply an AIGC detector?

The answer is no:

Large models' forgery capabilities come mainly from harness tools rather than simple diffusion generation. Drawing on their understanding capabilities, they continually check whether the image content fully meets the user's requirements during generation. Through the harness layer, they autonomously invoke tools to correct that content: subject extraction, redrawing, Deepfake face swapping, and more. Many large models use a wide range of tools to refine an image this way. Codex, for example, often takes several minutes to generate a single image precisely because it repeatedly invokes tools to constrain the generation process.

By contrast, many existing AIGC detection benchmarks focus on whole images generated by a large model in a single pass. This entails two restrictions. First, whole-image generation excludes subsequent or local tampering by a large model on a real image. Recent work^[2] has also confirmed that existing AIGC detectors are poor at identifying local forgeries. Second, single-pass generation excludes further editing or reworking of an image generated by model A, whether done manually or by another large model B. It also excludes corrections that model A makes to its own image through harness tools.

For a long time to come, the internet will also remain a mixed environment: many images will be forged by large models, while many others will be forged manually or by small models. One reason is the large stock of fake images accumulated before the large-model era. Another is that, despite their growing capabilities, large models still cannot fully replace manual tampering or methods based on specialized models. For example, in images in scientific papers, especially in medicine and materials science, even faint fluorescence, electrophoresis, or other reaction results at specific image locations carry strong and unambiguous scientific meaning. For a long time to come, large models will struggle to understand these images precisely and accurately constrain their generated outputs. In practice, forging them will still require manual copy-move, splicing, and similar methods: the manual copying and pasting, splicing, and other techniques studied in image tampering detection. Of course, we want Unified FID to work on forged scientific images. After all, such samples are scarce and difficult to annotate, while the forgeries themselves cause extremely serious harm. A model that detects only AIGC images, or even one that handles only images forged by large models, therefore cannot realize Unified FID. (Recent tests show that GPT-Astra's computer-use capability lets it accurately operate Photoshop to edit images. In the future, the traces in images produced by large models may thus resemble those of manual Photoshop edits more closely than those of purely AIGC images.)

So what exactly is the Unified FID task? Here is its B/P definition:

3.2B: Binary Classification

First, in terms of the task paradigm (B: Binary Classification):

Unified FID is a binary image-classification task: it takes an image as input and returns its corresponding 0/1 class label.

In other words, it follows the paradigm f(x) = y, x = image, y = 0/1.

Within this paradigm:

A standard training dataset consists of (image, label) / (x, y) pairs. That is:

1. The model receives only the image and directly predicts its corresponding 0/1 (real/fake) label.

2. The training data cannot contain additional annotations about the image's forgery method or similar details.

3. It is entirely reasonable and feasible, however, to use self-supervised, semi-supervised, or unsupervised methods to obtain additional information, such as the forgery method, to improve classification accuracy.

4. Using a pretrained large model to obtain other relevant information is also reasonable and feasible, provided that the image alone is supplied as input in both training and testing. Prompt engineering, post-training, and similar methods can use the base model to extract further information from the image without changing the task paradigm. This amounts to strengthening the function f(·) so that it can extract more information from x.

3.3P: Polymath

Second, in terms of model performance (P: Polymath):

Unified FID requires a single generalist model to outperform multiple specialist models at once. More precisely, the unified model must outperform as many SOTA specialist models as possible in their respective subfields. Typical examples are the four discussed above: Deepfake, AIGC, image tampering, and document-image tampering. Only such a model would have real value in practice. This is particularly relevant to the distinctive demands of China's vast content platforms, including platform governance, fraud prevention and risk control, and monitoring of public opinion.

During moderation and blocking, fraud detection, and evidence collection relating to public opinion, the model encounters hundreds of millions of images whose origins and forgery methods cannot be assumed in advance. Only by exceeding the specialists' accuracy can Unified FID be especially effective in these settings.

With this definition in place, Unified FID seems to admit many simple, direct solutions. Perhaps we could just choose a base model and fine-tune or post-train it on pooled datasets.

4A Research Blueprint for Unified Fake Image Detection

So what makes Unified FID difficult? Let us lay out the research blueprint and examine it point by point.

Broadly, the technical approaches to Unified FID fall into three routes:

the monolithic small-model route, the large-model route, and the collaborative large- and small-model route

4.1The Monolithic Small-Model Route

This is the route we have studied most deeply. It starts from a compelling intuition: all subfields of passive image forensics learn the same thing, artifacts, or the traces that forgery methods leave in an image. If they are all learning something shared, and each subfield already has so many effective small specialist models, could we simply align and pool the datasets, harmonize the training setups, greatly expand the data, select the strongest small model, and train it on a Unified FID dataset?

The idea is both intuitive and worthwhile. Selecting the strongest monolithic small model can yield many insights that will help us build a large base model specifically for Unified FID in the future.

Our ForensicHub tests, however, show that essentially no subfield's SOTA model meets the P requirement. Even after pooling all subfields' data and harmonizing their training setups, no single subfield model is strong enough to beat all the others. Put simply, even when a model from subfield A is trained on data from subfield B, it still cannot beat B's original model. Across extensive experiments, feeding data from all four subfields, A, B, C, and D, into a model from A actually caused a marked performance drop, especially on A itself. We first observed this in ForensicHub and later called it domain negative transfer in SICA: mixing in training data from other domains generally leads to a noticeable decline in performance.

But wait. The idea felt right to begin with, didn't it? Was our intuition wrong?

To find out, we explored the problem through extensive experiments in SICA:

First, we performed linear probing on the feature spaces of subfield models trained on the pooled datasets. All these models showed clear problems with feature-matrix rank: measured by singular value decomposition (SVD), the feature matrices exhibited low effective rank, meaning that the learned representations were highly redundant and lacked sufficient representational capacity. This indicated that the models had learned few useful artifact features.

Second, we examined their gradients during training on the pooled data and found clear gradient conflict. Data from different subfields exhibit significant negative gradient alignment (i.e., gradient updates in opposing directions), so that joint optimization frequently produces mutually canceling updates. This raises the difficulty of optimization (training does not truly converge) and pushes the model toward a compromise solution.

Finally, we examined the handcrafted features that are both effective and widely used in each subfield. They are not merely different; they do not even transfer between subfields. The rPPG-based facial physiological features used in Deepfake detection, for instance, do not transfer to natural-image or document-image tampering. This indicates that artifacts in different subfields do indeed have distinctive properties.

Taken together, these three findings lead us to a conclusion:

The Ji-Zhe Phenomenon creates a compatibility problem among heterogeneous features. In particular, trying to accommodate a vast range of heterogeneous artifact representations in the extremely limited feature space of a monolithic small model can all too easily trigger feature-space collapse. The model ends up learning mainly the representations shared across subfields, while abandoning the distinctive artifact representations of each one. What remains is an averaged, degraded representation: artifact features collapse to a trivial solution and lose the discriminative power needed to work across different tampering methods. Put simply, the model tries to construct the most shared, unified representation it can within a feature space that is far from ample. That representation must compromise among the artifacts. It works a little for all of them, but particularly well for none. Useful, but not very.

Personally, I think this will be a major focus of future Unified FID research.

4.2The Large-Model Route

This is where we are currently investing the most effort, for several reasons:

First, large models' strong OOD generalization is key to addressing the long-standing generalization challenge in passive forensics.

Large models also have a larger feature space. If its manifold is appropriately constrained, artifact features can be assigned to orthogonal or completely disjoint subspaces. This can effectively reconcile the tension between unified and distinctive feature representations, address the Ji-Zhe Phenomenon, and prevent feature-space collapse.

Large models also have strong reasoning, user-intent understanding, and agent-invocation capabilities. These give them considerable practical value for revising, explaining, and auditing detection results, as well as working with external tools. For example, after assessing an image, a large model could automatically explain the result, invoke an external forensic tool or agent to audit whether the explanation is correct, and revise its judgment accordingly. That would form an agent-based model harness loop for checking and refining the model's judgment.

Our deployed DeFakerOne large model follows this approach^[4].

Yet although the enormous parameter space, obtained at considerable training cost, can effectively resolve feature collapse, Unified FID large models still face two scientific problems: one during training and the other during inference. Our technical report discusses the reasoning behind them, so I will not repeat that process here.

This capability degradation, or model collapse, has extremely serious consequences. The model essentially loses its ability to generalize to OOD data, explain detection results automatically, revise them in light of user context, and dispatch agents to audit them. Put more simply, it can no longer talk or understand user instructions. It can only classify images mechanically as real or fake, completely defeating our original purpose in using a large model.

We are still investigating the mechanism behind this model collapse during post-training. The problem is unlikely to be confined to forensics: similar issues should emerge in many specialized domains as training data accumulate. This is a valuable and difficult research direction, and everyone is welcome to join the discussion.

Accelerating inference is therefore another central challenge for Unified FID's large-model route. Pruning, quantization, and hardware acceleration, especially with domestically produced Chinese hardware, are all promising research directions.

4.3The Collaborative Large- and Small-Model Route

This is the most direct and straightforward route. Every subfield already has SOTA models, so why not let a large model perform a single round of routing and orchestration, aggregate the small models' detection results, and make the final judgment? That is the MoE-inspired idea. Beyond our group, many strong teams have taken this route, including those of Professor Jian Zhang at Peking University^[5], Professor Baoyuan Wu at The Chinese University of Hong Kong, Shenzhen^[6], Professor Hongtao Xie at the University of Science and Technology of China^[7], Professor Bin Li at Shenzhen University^[8], and Professor Jiwei Zhang at Beijing University of Posts and Telecommunications. Their work is well worth following. I will not retrace here how the scientific questions along this route were derived and distilled.

Overall, this is currently the fastest-moving route and the quickest to yield results. Two scientific questions call for further study:

In fact, many existing algorithms used in MoE and agent architectures, including Top-K activation, sparse load balancing, and dynamic routing, already address these three questions in essence: which experts are available, which to select, and which to trust. However, these algorithms typically bundle candidate-set construction, expert selection, and result adjudication into a single process. This tight coupling makes the sources of performance gains difficult to identify, while their adaptability across tasks remains to be established. Building on advances in these algorithms, future research could progressively decouple the three stages along the research questions outlined above, using separate mechanisms for candidate-set construction, expert selection, and result adjudication to achieve globally optimal synergistic gains.

The coordinated evolution of large and small models has received relatively little research attention so far, but this issue will quickly gain prominence as agents continue to advance. Evaluating and characterizing agent capabilities, together with dynamically adjusting agent orchestration strategies, will become central research questions. Test-time training (TTT) and test-time adaptation (TTA) can enable models to autonomously adapt to newly emerging experts or agents during inference. Building on these approaches, continual learning and recursive self-improvement (RSI) will be important avenues for addressing this class of problems. RSI, in particular, can enable agents themselves to continually inform the system of “what this agent can do now.” An agent generates its own tasks, evaluates its own results, and uses those evaluations to update orchestration strategies and tool-use policies, forming an iterative feedback loop that keeps pace with the continued expansion of expert capabilities without external annotations.

5Closing Thoughts

We have now outlined the background and definition of Unified FID, its three technical routes, the scientific questions each raises, and some possible solutions. This is both a brief summary of our group's key research over the past 1-2 years and an opening account of the Unified FID problem. In a follow-up post, I will look more closely at the feasibility and promise of specific technical approaches.

One final point needs emphasis. I do not see Unified FID as a replacement for existing specialist models; I see them as successive stages of a workflow. This matters especially in fields with stringent compliance requirements, such as judicial forensics and media authentication. Specialist models usually incorporate strong domain-specific prior knowledge. The ideal future workflow will use Unified FID for fast, accurate initial screening, followed by specialist models for evidence auditing: a form of explainable forensics.

Recent emails about this topic are why my first blog post has grown so long. It answers almost every question in the more than 30 emails I have received so far. There may still be omissions and mistakes, so please feel free to contact me with corrections.

Many researchers overseas are also interested in Unified FID, so this post is now available in both languages. You can also read the Chinese original.

Last but not least,

Last updated: October 16, 2026