{"id":"ccf2095b-7923-4776-8db0-75227f18df43","arxiv_id":"2608.02258","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A flow-matching model that scores tampering by local restoration cost, trained with sparse weighting and artifact injection, outperforms prior text forgery detectors on three benchmarks.","lead":"This paper proposes a tampering detector that locates edited text in images by estimating how much 'repair' each pixel needs to look authentic, using a flow-based generative model trained on self-injected artifacts. It reports state-of-the-art localization on three benchmarks and strong zero-shot detection of unseen text-editing patterns.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Zero-shot generalization rests on an untested assumption that Artifact Injection's five corruption types span real text-editing traces; no evidence rules out real tampering outside that span.","rationale":"I agree with the reader's weakest_assumption. The artifact-injection span is the linchpin of the open-set/zero-shot claim. The full-shot SOTA (Table 1) is less affected because fine-tuning provides real supervision; the distinctive contribution is the zero-shot performance, and that rests entirely on the synthetic corruption distribution being representative of real edits. The paper offers no positive evidence for this representativeness. A benchmark-contamination issue (ICDAR2013 in the training set for T-IC13) is real but affects only one of three zero-shot benchmarks; the artifact-injection concern affects all three. Hence I consider the reader's chosen assumption the single most load-bearing. A leave-one-out ablation would directly test whether the model learns a general 'local deviation' signal or memorizes the five corruption families. If the model already generalizes to held-out artifact types, the concern is resolved; if not, the zero-shot claims need to be qualified. The reader's CONDITIONAL verdict is appropriate pending this check.","tokens_in":15196,"tokens_out":10234,"duration_ms":88491,"concrete_test":"Run a leave-one-out artifact ablation: retrain SC-RF with one of the five Artifact Injection operations (e.g., Gaussian blur) excluded from the corruption set, then evaluate zero-shot on (i) images corrupted only with the held-out operation and (ii) the OSTF benchmark. If F1/IoU drops by more than 0.10 relative to the full model on either set, the model is not computing a generic restoration cost but is specialized to the training artifact family, and the open-set claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.4 trains SC-RF solely on five locally injected corruption types—Gaussian blur, JPEG, Gaussian noise, alpha-blending mismatch, and glyph re-rendering mismatch—with target velocity x1-x0 (Eq. 7). At inference, the anomaly score is the L2 norm of v_theta(xq,0) (Eq. 12). The abstract and Section 4.2 claim 'strong zero-shot performance on challenging unseen text editing patterns,' with OSTF as the main evidence (Table 1: 0.781 F1 zero-shot vs. 0.775 for full-shot TTDMamba). This conclusion holds only if real text-editing traces fall within the span of the five injected artifacts. No experiment in the paper tests that span: there is no evaluation on tampering produced by pipelines outside the five operations, no comparison to a variant trained with a broader corruption set, and no paired real-tampering supervision during self-supervised training. The paper itself limits M_r (Section 3.2) to 'the authentic distribution induced by our training corpus and forensic priors,' so the detector's notion of authenticity is tied to the training data. If a real edit (e.g., diffusion-based inpainting or seamless copy-move) introduces statistics not represented by blur/JPEG/noise/blending/glyph operations, the learned restoration-cost field may not fire, and the zero-shot claim collapses. The auxiliary harmonization stress-test (Section 4.3) does not mitigate this; it concerns how F-DiT can weaken existing detectors, not whether its own detector generalizes.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SC-RF, a flow-matching-based detector for open-set visual text tampering. The method trains a pixel-space Forensic-DiT to regress the residual between a locally corrupted image and its authentic counterpart, using a spatially weighted rectified-flow objective (Eq. 7). At inference, the L2 norm of the predicted velocity at t=0 is used as a pixel-level tampering score. Training is self-supervised via Artifact Injection, which applies five local corruption types to authentic scene-text and document images. Experiments on T-IC13, DocTamper, and OSTF report state-of-the-art F1/IoU/AUC, including zero-shot results on OSTF, and an auxiliary stress test shows that F-DiT harmonization can degrade existing detectors.","tokens_in":16843,"tokens_out":8430,"duration_ms":554351,"significance":"The restoration-cost formulation is a timely and interesting alternative to discriminative forgery detectors, and the paper is generally clear. The objective in Eq. (7) is correctly specified as a weighted L2 regression, and the ablations (Tables 3 and 4) provide evidence for the pixel-space and forensic-tokenizer design choices. The inclusion of AUC as a threshold-free metric is a strength. However, the central zero-shot claim and the headline F1/IoU gains depend on a benchmark-contamination issue, an untested span assumption about the artifact-injection corruption set, and per-benchmark threshold selection. These need to be addressed before the results can be taken at face value.","major_comments":[{"comment":"The training corpus includes ICDAR2013 [17], while the evaluation benchmark T-IC13 [39] is a tampered version of ICDAR2013 images. Unless the original ICDAR2013 test images were explicitly excluded from training, the 'zero-shot' T-IC13 numbers (Table 1, F1=0.905) are not zero-shot: the model has seen the pristine counterparts of the test images. This is load-bearing for the abstract's zero-shot claim. Please report the overlap, re-train without ICDAR2013 (or at least without the T-IC13 source images), and update the averages and conclusions accordingly.","section":"Section 4.1 (Datasets)"},{"comment":"The detector is trained exclusively on five locally injected corruptions (Gaussian blur, JPEG, Gaussian noise, alpha-blending boundary mismatch, glyph re-rendering mismatch). The strong zero-shot claim on 'unseen text editing patterns' assumes that real tampering traces lie within the span of these five operations. No experiment tests this span: there is no evaluation on editing pipelines outside the five, no training variant with a broader corruption set, and no paired real-tampering supervision. Please add an evaluation on editing pipelines not represented in the five operations (e.g., diffusion-based inpainting, copy-move, or seamless editing), or a controlled experiment varying the corruption set, to substantiate the generalization claim.","section":"Section 3.4 / Section 4.2"},{"comment":"F1 and IoU are computed using per-benchmark thresholds selected on each benchmark's validation set (τ=0.34 for T-IC13, τ=0.31 for DocTamper, τ=0.33 for OSTF). This makes the reported zero-shot F1/IoU dependent on benchmark-specific labels, and the headline 3.2/4.8 percentage-point gains are not threshold-free. While AUC is reported and is threshold-independent, the abstract and Section 4.2 emphasize F1/IoU. Please report threshold-robustness (e.g., precision-recall/AUC curves) and clarify how the baseline thresholds were selected, so that the comparison is consistent.","section":"Section 4.1 (Implementation Details) / Table 1"}],"minor_comments":[{"comment":"The DAF row appears to have a formatting issue: '0.8600.9730.759' and the DocTamper and OSTF F1/IoU values are listed as identical (0.759/0.612). Please verify the numbers and fix the spacing.","section":"Table 1"},{"comment":"The 3.2 and 4.8 percentage-point gains in F1 and IoU refer to the full-shot average in Table 1, not the zero-shot setting. Please state this explicitly to avoid ambiguity.","section":"Abstract / Section 4.2"},{"comment":"The definition of 'zero-shot' should mention that validation-selected thresholds are used per benchmark. As written, 'without benchmark-specific supervised fine-tuning' is misleading because the thresholds do use benchmark validation labels.","section":"Section 4.1"},{"comment":"The stress-test analysis would be stronger with quantitative feature-space statistics (e.g., distances between cluster means or a nearest-neighbor measure) in addition to the t-SNE visualization. The 'directional movement' claim is currently qualitative.","section":"Section 4.3"},{"comment":"T-IC13 should be defined at first use (e.g., 'Tampered-IC13, a benchmark derived from ICDAR2013'). Minor typographical errors in equations and table formatting should also be corrected.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The most serious issue is the likely overlap between the ICDAR2013 training images and the T-IC13 evaluation benchmark. If confirmed, the zero-shot T-IC13 results are inflated and the paper's abstract overstates the zero-shot claim. I would like to see a re-evaluation with the overlapping source images excluded before considering acceptance. The paper does not state whether code or trained models will be released; given the reproducibility implications of the threshold-selection and data-preparation choices, a release would be valuable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This is a well-executed, mostly convincing paper on open-set text tampering localization, but the zero-shot generalization claim is softer than the abstract suggests. The core idea - learn a velocity field that restores locally corrupted text regions, then use its magnitude at t=0 as an anomaly score - is sensible, and the sparse-constraint reweighting is a simple fix for a real problem: standard flow matching ignores sparse anomalies. The Forensic-DiT with SRM and DCT tokenization and the pixel-space design are reasonable engineering choices, and the ablations show each component contributes. The comparison against direct residual regression under the same backbone is a clean experiment; it gives the method credit for the objective, not just the architecture. I also appreciate that the authors are explicit that their authentic distribution is tied to the training corpus, not a universal manifold. That is honest. The soft spots are mostly around the zero-shot evaluation. First, the Artifact Injection uses five corruption types: blur, JPEG, noise, alpha-blending mismatch, and glyph re-rendering. The OSTF benchmark is supposed to show generalization to unseen text editing patterns, but there is no analysis of what those editing pipelines actually produce, or whether they fall within the span of those five operations. If real tampering involves diffusion-based inpainting or seamless copy-move, the detector may simply not have learned to fire on those statistics. The paper does not test that, so the strong zero-shot performance is really strong performance on a benchmark whose edits happen to resemble the injected artifacts. That is a testable claim, and it should be tested. Second, the F1/IoU thresholds are selected per benchmark on the validation set, which is standard practice but means the headline numbers are partly fitted to each evaluation set. Minor, but worth stating. Third, the training corpus includes ICDAR2013, from which T-IC13 is derived; the authors follow the DAF protocol, so this is not a hidden leak, but it does weaken the T-IC13 zero-shot result as a true held-out test. I would call this a moderate concern, not a fatal one. The math is sound - the objective is a weighted L2 regression with a correct target - and the citation pattern is fine. The paper deserves a serious referee. I would suggest the authors be asked to either broaden the artifact injection set or explicitly measure the spectral/residual overlap between the injected corruptions and the edits in OSTF, and to report threshold-free PR curves or error bars on the zero-shot numbers. As it stands, it is a good paper with a slightly overreaching conclusion. Send it to peer review.","headline":"Solid flow-matching approach to text tampering localization with good ablations, but the zero-shot claim is ahead of the evidence: the detector is trained on five hand-picked artifact types, and nothing shows that real text-edits stay inside that span.","tokens_in":754,"tokens_out":816,"would_cite":true,"duration_ms":29022,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Text tampering can be localized by measuring, per pixel, how much a learned flow would need to move that patch to restore authentic text statistics — no forgery-specific training needed.","keywords":["Open-set visual text forensics","Text tampering detection","Flow matching","Sparse anomaly localization","Self-supervised artifact injection","Pixel-space diffusion transformer","Restoration cost","Zero-shot generalization"],"falsifier":"Run the zero-shot model on text tampered by a newly deployed editor whose artifacts deliberately fall outside the injection span (e.g., sub-pixel warping, GAN-painting without blending mismatch, or compression-aware editing that exactly matches the background noise). If the F1 score drops to chance levels on such edits while staying high on in-span edits, the open-set generalization claim fails for that artifact class. A complementary test: apply the model to authentic images with benign local variation like glossy highlights or shadows, and check whether the restoration field also fires on th","tokens_in":15081,"feed_emoji":"🔍","tokens_out":5556,"duration_ms":48559,"temperature":0.7,"pith_summary":"The paper tries to establish that open-set text forgery detection is better cast as measuring local deviation from authentic visual-text statistics than as classifying known forgery patterns. To do this, it trains a generative model — Sparse-Constraint Rectified Flow — to predict the velocity field that would restore a locally corrupted image to an authentic one; the magnitude of that velocity at each pixel, evaluated at time zero, becomes the tampering score. Because tampering is spatially sparse, the flow objective is reweighted by the tampering mask so the learned field concentrates on anomalous regions instead of collapsing to an identity map on the background. Training pairs come from a self-supervised artifact-injection scheme applied to authentic text images, and the architecture operates in pixel space to preserve high-frequency forensic traces. The authors report the highest F1 and IoU among compared methods on three benchmarks, with particular strength in zero-shot transfer to unseen editing patterns.","feed_headline":"Restoration-cost detector tops text forgery benchmarks","feed_subtitle":"Pixel-wise tampering score generalizes to unseen edits with no forgery-specific supervision.","key_machinery":"Sparse-Constraint Rectified Flow (SC-RF) — a spatially weighted flow-matching objective that regresses a velocity field along the straight-line transport from a locally corrupted image to its authentic counterpart. The spatial weight map 1 + λ·M_s reweights the loss toward tampered pixels, preventing the 'lazy identity' solution that standard flow matching produces on sparse anomalies. The detector uses the magnitude of the predicted velocity at t=0 as the tampering score, and the architecture estimating it, Forensic-DiT, operates in pixel space (no VAE compression) while fusing RGB, SRM noise residuals, and block-DCT frequency tokens; it also injects an image-specific forensic fingerprint v","core_discovery":"The central discovery is that a detector-oriented flow-matching objective can turn the generative task of restoring corrupted text into a pixel-level anomaly score. The paper redefines the source and target distributions of rectified flow: instead of Gaussian noise, the source is a locally corrupted version of an authentic image, and the target is the authentic image itself. The learned conditional velocity field is sparse — nonzero only where the image was corrupted — so SC-RF reweights the regression loss by the tampering mask, with weight W_s = 1 + λ·M_s. At inference, no ODE integration is needed: the L2 norm of the predicted velocity at t=0 is the local restoration cost, and this score","pith_inferences":["The synthetic-to-real boundary is the natural failure horizon: if future text editors produce traces outside the artifact-injection span (e.g., sub-pixel warping, GAN painting without blending mismatch, noise-matched inpainting), the restoration-cost field should be expected to miss them — a testable prediction that follows from the training setup rather than a claim made in the paper.","Because the detector never conditions on text semantics, the same restoration-cost formulation is a plausible transfer to other sparse tampering domains such as faces, objects, or document layout, which the paper does not evaluate.","The partial harmonization result suggests the learned velocity direction encodes an interpretable axis pointing from tampered to authentic; aligning that axis with specific artifact classes (blur vs. noise vs. compression) could yield explainable detections."],"forward_implications":["Zero-shot localization generalizes across editing pipelines because the detector never sees specific forgery signatures during training.","One-step inference suffices at test time, so the method is practical: no ODE integration is required beyond predicting the velocity field at t=0.","The training paradigm needs only authentic images plus synthetic artifact injection, so it can extend to new domains without collecting tampered examples.","The stress-test result implies the same architecture can serve as an adversarial audit tool: local harmonization weakens the cues that existing forensic detectors rely on."],"fun_headline_variants":["Flow score localizes text tampering without attack labels","Restoration cost exposes unseen text edits","Pixel-wise flow score detects text forgeries zero-shot","Sparse flow beats text forgery benchmarks"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The detector is trained only on synthetic artifacts — blur, JPEG compression, noise, alpha-blending mismatch, and glyph re-rendering — and the method assumes these injections produce restoration residuals representative of real, unseen text edits; if a real editor leaves traces outside this span, the learned field will not fire.","fun_headline_variants_meta":{"raw":{"variants":["Flow score localizes text tampering without attack labels","Restoration cost exposes unseen text edits","Pixel-wise flow score detects text forgeries zero-shot","Sparse flow beats text forgery benchmarks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000272,"raw_usage":{"total_tokens":1460,"prompt_tokens":729,"completion_tokens":731,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":473,"completion_tokens_details":{"reasoning_tokens":673}},"tokens_in":473,"tokens_out":731,"duration_ms":7647,"temperature":1.0,"reasoning_tokens":673,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T10:26:15.947096+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the zero-shot model on text tampered by a newly deployed editor whose artifacts deliberately fall outside the injection span (e.g., sub-pixel warping, GAN-painting without blending mismatch, or compression-aware editing that exactly matches the background noise). If the F1 score drops to chance levels on such edits while staying high on in-span edits, the open-set generalization claim fails for that artifact class. A complementary test: apply the model to authentic images with benign local variation like glossy highlights or shadows, and check whether the restoration field also fires on th","supporting_citations":[],"review_version":1}