{"id":"365a9af7-fdb2-4e68-9afa-16795ce76b2a","arxiv_id":"2608.03008","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A frozen video forgery detector can detect AI-generated videos using only 211 selected anchor neurons and a linear classifier.","lead":"Researchers found that inside a trained video forgery detector, only a small set of neurons carries the signals that separate real videos from AI-generated ones. They built a method that finds those neurons in a frozen detector, and a simple classifier on just those neurons detects forgeries about as well as, sometimes better than, full retrained systems.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Test-set threshold selection contradicts the claimed strict separation and inflates the headline Magic numbers.","rationale":"The reader correctly noted in the rationale that τd was selected by a sweep on Magic, making the main result partly fitted. However, the reader's stated weakest assumption was the protocol mismatch of quoted baselines, which is a fairness issue for comparisons but not as threatening to the central claim as the direct test-set contamination. I focus on the internal contradiction between Figure 6 and Appendix A because it affects the most load-bearing quantitative evidence: the claim that a sparse 211-neuron readout on a frozen backbone matches or exceeds full detectors on external benchmarks. A misuse of the external benchmark for model selection means the 'external' numbers are not external in the strict sense, and the main evidence for the sparse-functional-neuron claim is weaker than presented. This is fixable by a clean protocol, so a conditional verdict remains appropriate; hence UNCHANGED relative to the reader's CONDITIONAL verdict. The random-backbone negative control and the intervention circularity are also worth addressing, but the threshold leakage is the most direct and settled concern because it can be checked against the paper's own statements.","tokens_in":18137,"tokens_out":9848,"duration_ms":115127,"concrete_test":"Run the full V-FIND pipeline with all hyperparameters (τd, LAN count, critical layers) fixed using only the internal validation split from the source distribution, with Magic Videos, MovieGen, and DVF completely untouched until final evaluation. Then recompute Tables 1, 2, and Figure 7 under that fixed configuration. If Magic mACC changes by more than ~0.5 points or the margin over same-layer random shrinks to near zero, the published performance is partly a test-set selection artifact and the claims should be reworded accordingly.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's strongest empirical support for sparse functional neurons is the external benchmark performance, but Section 4.3 (Threshold Sensitivity) and Figure 6 select τd = 1.5 by sweeping on Magic Videos, and Figure 10 similarly selects the 211-neuron budget on Magic. This directly contradicts Section 4.1's claim that 'we strictly separate neuron discovery from external evaluation' and Appendix A's assertion that 'No external benchmark is involved in layer localization, neuron discovery, threshold choice, or checkpoint selection.' Because τd determines which 211 neurons form the forensic subspace, the reported Magic results (89.37 mACC, 96.92 mAP) are not an unbiased out-of-sample evaluation: the central demonstration that a sparse readout matches or exceeds full detectors is partly a consequence of choosing the selection threshold on the test set. The same contamination affects the fixed-budget controls in Figure 7, since the LAN budget is also fixed from Magic. The issue is not merely cosmetic; the coarse-to-fine sweep in Figure 6 shows nontrivial variation (e.g., mACC ranges from 85.52 to 89.37 across thresholds), and the selected value is the peak of the Magic curve. This makes the headline comparison a selected maximum rather than a held-out number. The central qualitative finding may survive a clean re-run, but the quantitative evidence as presented is overstated.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes V-FIND, a framework that claims to uncover sparse, functionally specialized \"latent anchor neurons\" (LANs) within a frozen video forgery detector (Qwen2.5-ViT), localizing critical layers via two complementary discrepancy signals, selecting neurons via a probe-based effect-size threshold, and training only a linear classifier on the selected LAN activations. The main empirical claims are that this sparse readout achieves 89.37 mACC / 96.92 mAP on Magic Videos, 96.85 ACC / 99.31 AP on MovieGen, and 98.2 AUC on DVF, matching or exceeding full retrained detectors, and that neuron intervention experiments demonstrate functional specificity. The manuscript includes layer/neuron ablations, fixed-budget controls, cross-architecture validation, and an appendix with formal definitions and a theoretical interpretation.","tokens_in":1993,"tokens_out":2029,"duration_ms":43138,"significance":"If the central claim holds, the paper would make a useful contribution by showing that video forgery detectors contain sparse, extractable, and reusable discriminative knowledge, which challenges the uniform-distribution assumption and offers a lightweight, interpretable alternative to full-model retraining. The manuscript's strengths include cross-architecture consistency (Table 3), controlled comparisons against random and PCA baselines at a fixed budget (Figure 7), and causal intervention evidence (Figure 9), all of which are appropriate and well-conceived experimental designs. The theoretical analysis in Appendix C is explicitly framed as an explanatory approximation rather than a formal proof, which is honest. However, the headline quantitative demonstration is weakened by the selection of the key hyperparameter tau_d and the LAN budget on the Magic benchmark itself, and the baseline comparisons are quoted rather than reproduced under a matched protocol, so the magnitude of the reported gains should be treated with caution.","major_comments":[{"comment":"The claim in Sec. 4.1 and Appendix A that \"No external benchmark is involved in layer localization, neuron discovery, threshold choice, or checkpoint selection\" is contradicted by the presented evidence. Section 4.3 shows tau_d = 1.5 was selected by a coarse-to-fine sweep whose displayed values are Magic Videos mACC/mAP (Fig. 6), and Fig. 10 similarly shows the 211-neuron LAN budget as the peak of a Magic-based curve (89.37 mACC / 96.92 mAP). Since tau_d determines which neurons enter the forensic subspace, the headline Magic numbers are a selected maximum on the test set rather than an unbiased held-out evaluation. The fixed-budget controls in Fig. 7 also inherit the Magic-selected budget. I would like to see the threshold and budget selection moved to the internal validation split (or justified by a stability argument over discovery splits), with Magic numbers re-reported afterward; the current figures cannot both display the Magic evaluation curve and support a strict separation claim.","section":"Sec. 4.1, Sec. 4.3, Fig. 6, Fig. 10, Appendix A"},{"comment":"The comparison against baselines is protocol-sensitive but the protocol is only specified for V-FIND. V-FIND uses 2 FPS decoding, 8 center-aligned frames, and dynamic resolution 224–720p (Sec. 4.1), while the quoted baselines from Li et al. (2026b) have no stated preprocessing in this manuscript. If the baselines used different frame counts, resolutions, or cropping, the reported gains (e.g., +6.17 mACC over Qwen2.5-ViT on Magic, +13.8 AUC on DVF's VideoCrafter1 row in Table 2) could reflect protocol mismatch rather than the forensic subspace. Please state the exact evaluation protocol for every quoted baseline, or re-run the strongest baselines under the V-FIND protocol.","section":"Tables 1 and 2 vs. Sec. 4.1"},{"comment":"The per-sample response r_n(x_i) = |a_n(x_i)| · |w_n| and the effect size d_n are computed using probe weights w_n trained on the same discovery split that is then used to rank and select neurons. This supervised selection makes it partly guaranteed by construction that selected neurons separate real and fake in the discovery distribution; the paper's own fixed-budget and intervention controls (Figs. 7, 9) mitigate this concern but do not eliminate it. Please add an explicit analysis of selection bias, e.g., by reporting the drop in discriminative effect sizes or in readout performance when LANs are selected on discovery split A and evaluated by training the final readout on a disjoint split B, or by comparing against neurons selected by unsupervised variance or random projection at the same budget.","section":"Sec. 3.2, Eq. (12)"},{"comment":"The margin-based argument in Eqs. (30)–(31) is conditional on unverified quantities: the omitted-coordinate norm ||w*_Sbar||_2 · ||z_Sbar(x)||_2 and the reference separator f* are not measured, so the bound is not shown to hold for the actual Qwen2.5-ViT representations. The authors do label the analysis as an explanatory approximation, which is commendable, but the sentence \"the sparse projection preserves the sign of the reference decision\" is stronger than what is demonstrated. Please either soften this to a conditional statement or add a direct empirical check of the margin condition on the real representations.","section":"Appendix C, Eqs. (30)–(31)"}],"minor_comments":[{"comment":"Tau_sep and tau_shift are defined as mean + std of the layer-wise score distributions on the discovery split, but it is not stated whether this produced L* = {28, 29, 30} deterministically or how stable the intersection is across discovery splits; please report the actual threshold values and the resulting layer sets.","section":"Sec. 3.1, Eqs. (6), (8), Appendix B"},{"comment":"The PCA baseline in Fig. 7 is described only by name; please specify whether PCA was fit on the discovery split, which layers were concatenated, and the number of components (presumably 211).","section":"Sec. 4.3, Fig. 7"},{"comment":"The label \"Original LAN size / flip rate\" in Fig. 9 is ambiguous; the text reports flip rates of 6.8%, 19.7%, 1.2%, and 1.8%, so please clarify which numbers correspond to flip rates and which to logit shifts in the figure.","section":"Sec. 4.4, Fig. 9"},{"comment":"The tables state that best results are bold and second-best underlined, but no bolding or underlining appears in the provided text version; please ensure the final PDF formatting matches the stated convention.","section":"Sec. 4.2, Tables 1–2"},{"comment":"The claim that the 211 budget is a stable region is not strongly supported by the apparent non-monotonicity around the selected budget (e.g., 200 vs. 211 vs. 500); please add error bars or variance across multiple discovery/training seeds, or discuss the observed fluctuations.","section":"Appendix D, Fig. 10"},{"comment":"Several references appear to be future-dated (e.g., Li et al. 2026a, 2026b; Cao et al. 2026) and the paper is dated August 2026; please verify all citations and ensure the arXiv identifier and version are correctly stated, since this affects reproducibility.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The central scientific idea is interesting and the experimental machinery is largely appropriate, but the headline quantitative claim currently rests on a test-set-selected threshold and budget. If the authors re-run the selection protocol on the internal validation split and honestly report Magic numbers afterward, figures like Fig. 6 and Fig. 10 must be relabeled as validation-selection curves, not Magic evaluation curves. I would also encourage the editor to ensure that the baseline numbers quoted from future-dated or unreleased work are verifiable; if the baselines cannot be reproduced under the V-FIND protocol, the state-of-the-art comparison should be explicitly caveated. The paper is suitable for a vision/security venue if these issues are addressed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing to know: the paper has a real result — a frozen video forgery backbone contains a sparse set of units that separate real from generated video, and a 211-neuron linear readout is competitive with full tuned detectors. That is new and worth taking seriously. The experiments are well built: fixed-budget random-neuron controls, same-layer random substitutions, cross-architecture transfer on three backbones, and activation-swap interventions all point the same way. Those controls make the qualitative claim credible: forensic knowledge is concentrated in a small subspace.\n\nThe problem is the headline number. Section 4.3 says τd = 1.5 was chosen by a coarse-to-fine sweep, and Figure 6 plots exactly the Magic mACC/mAP with τd at the peak. Appendix A says 'No external benchmark is involved in ... threshold choice.' Those statements contradict each other. The threshold determines which 211 neurons enter the subspace, so the reported Magic numbers are a selected maximum, not a held-out evaluation. That inflates the central comparison. The 211-neuron budget is also fixed from Figure 10 on Magic, so the fixed-budget controls in Figure 7 are not fully independent either, though this is a lesser issue.\n\nSecond problem: the SOTA baseline numbers in Tables 1 and 2 are quoted from Li et al. (2026b) rather than re-run under V-FIND's protocol (2 FPS, center-aligned 8 frames, dynamic resolution). If the quoted baselines used different preprocessing, part of the reported gains could be protocol artifact. This is fixable and needs a clear statement.\n\nMy verdict: the qualitative finding is probably right — the controls support it. The quantitative evidence for 'matches or exceeds full detectors' is overstated as presented. The fix is clean: set τd and the budget on the internal validation split only, re-run the external benchmarks, and either re-run baselines under the identical protocol or clearly state the differences. This paper deserves a serious referee; it should not be desk-rejected. If the authors clean up the protocol leak, it becomes a solid contribution for the video forgery and interpretability communities.","headline":"Sparse frozen-neuron forensic subspace is a real, well-controlled finding, but the headline Magic numbers are selected on the test set and need a clean re-run.","tokens_in":18914,"tokens_out":4137,"would_cite":false,"duration_ms":40347,"reading_group":"yes","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A video forgery detector's real-versus-fake knowledge lives in a sparse set of neurons, and a frozen backbone plus a 211-neuron linear readout can match or beat full retraining.","keywords":["video forgery detection","AI-generated video detection","neuron interpretability","sparse forensic subspace","latent anchor neurons","frozen-backbone readout","layer localization","functional specificity"],"falsifier":"Zero out the 211 reported LAN activations in the frozen detector (or swap them with activations from real videos) and measure the shift in the detector's real–fake logits: the paper reports large directional shifts and label-flip rates for these neurons, so a replication that finds no larger effect than random same-budget neurons would refute the functional-specialization claim.","tokens_in":17907,"feed_emoji":"🎬","tokens_out":8785,"duration_ms":79896,"temperature":0.7,"pith_summary":"This paper argues that a video forgery detector's ability to tell real videos from AI-generated ones is not spread evenly across its many millions of parameters. Instead, that ability is concentrated in a small set of specialized neurons. The authors propose a two-stage discovery procedure, V-FIND, that first picks out the layers where real and fake videos diverge most and then scores individual neurons by how consistently their responses separate the two classes. With the detector's backbone frozen and only a linear classifier trained on the responses of 211 such \"latent anchor neurons,\" the resulting lightweight readout matches or beats much larger, fully retrained detectors on three external benchmarks. If this is right, detecting AI-generated video can become cheaper, more interpretable, and more adaptable to new generators.","feed_headline":"211 neurons spot AI video as well as full retrained detectors","feed_subtitle":"A 211-neuron readout on a frozen detector matches or beats larger retrained models on three benchmarks.","key_machinery":"The load-bearing object is the latent anchor neuron (LAN): an individual latent unit in a critical layer, scored by the product of its activation magnitude and its linear-probe weight, $r_n(x)=|a_n(x)|\\,|w_n|$, and selected when its real–fake separation effect size $d_n = |\\mu_{\\mathrm{fake}}-\\mu_{\\mathrm{real}}|/(\\sigma_{\\mathrm{pool}}+\\epsilon)$ exceeds a threshold. Layer localization precedes this using the intersection $L^* = L_{\\mathrm{sep}} \\cap L_{\\mathrm{shift}}$ of a directional-separation signal and a normalized centroid-shift signal, which narrows the search from all 32 layers to a few late layers. The selected LAN activations are concatenated into a compact forensic subspace $h_S(x) = [a_n(x)]_{n\\in S}$, and a linear classifier trained on this subspace performs the detection while the backbone stays frozen. This construction is what lets the paper attribute performance to specific internal neurons rather than to feature dimensionality.","core_discovery":"The paper's central claim is that forgery-discriminative knowledge inside a video forgery detector is localized: a sparse set of latent units, not the full representation space, carries the real-versus-fake signal. V-FIND operationalizes this by computing two layer-wise discrepancy measures (directional separation of class centroids and variance-normalized centroid shift), intersecting the layers they flag, then training a linear probe inside those layers and ranking neurons by an effect size that compares the mean response gap between real and fake videos to pooled within-class variation. Retaining the 211 neurons with the largest effect sizes in layers 28–30 of a frozen Qwen2.5-ViT detector and fitting only a linear readout yields 89.37 mean accuracy and 96.92 mean average precision on Magic Videos, 96.85 accuracy and 99.31 average precision on MovieGen, and 98.2 AUC on DVF, competitive with or better than full-model baselines quoted from prior work. Activation-swap interventions on the selected neurons move the detector's decisions far more than same-budget random neurons, which the paper takes as direct evidence that these neurons are functionally specialized for forgery detection.","pith_inferences":["A natural extension the paper leaves open: if LAN locations are stable across training runs and checkpoints, one could build a reusable neuron atlas so that new detectors inherit known forensic neurons instead of rediscovering them, but the paper explicitly notes intra-family consistency is not yet established.","The same neuron-scoring machinery could be pointed at finer questions than real-versus-fake, such as which generator produced a video; nothing in the method restricts it to binary classes.","Because the readout is linear, the detection boundary can be inspected coordinate-by-coordinate, which could support auditability requirements for AI-content detectors in deployment.","A testable extension: run V-FIND on a detector trained only on face-manipulation deepfakes and compare the localized layers to those found here; overlap would suggest a common forensic substrate across manipulation types, while disjoint layers would imply separate mechanisms."],"forward_implications":["A released detector can be adapted to a new video generator by discovering and reading out its sparse forensic neurons, without touching the backbone's weights.","Detection with 211 activations needs very little training data: performance is already strong with a few hundred discovery videos and stabilizes around 2,400 samples.","Because only a few neurons drive the decision, the detector's reasoning becomes inspectable: response maps show the neurons firing on textures, boundaries, and repeated structures in fake videos.","The discovery procedure transfers across architectures, improving mean accuracy on VINA and X-CLIP backbones by 7.6 to 14.9 points, so sparse forensic knowledge is not unique to one model family."],"supporting_citations":[{"why":"Supplies the frozen Qwen2.5-ViT detector, the Magic Videos benchmark, and the baseline results that V-FIND is compared against.","marker":"Li et al. (2026b)"},{"why":"Supplies the DVF benchmark and the MM-Det baseline used for external evaluation.","marker":"Song et al. (2024)"},{"why":"Supplies the MovieGen benchmark used to test generalization beyond the source distribution.","marker":"Polyak et al. (2024)"},{"why":"Supplies the VINA detector checkpoint and baseline used in cross-architecture validation.","marker":"Li et al. (2026a)"},{"why":"Establishes the linear-probe methodology that V-FIND uses to score individual neurons.","marker":"Alain and Bengio (2016)"},{"why":"Provides the network-dissection view that model capabilities localize to individual units, motivating neuron-level discovery.","marker":"Bau et al. (2017)"},{"why":"Supplies the circuits-and-neurons interpretability lens that frames sparse functional specialization.","marker":"Olah et al. (2020)"}],"fun_headline_variants":["211 neurons match full retrained video forgery detectors","Sparse neuron probe rivals retrained models for fake video","Forgery detector's key knowledge fits in 211 neurons","Frozen backbone, 211 neurons beat heavy retraining on fakes","Video forgery detection: 211 neurons do the heavy lifting"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central claim stands on the assumption that the neurons selected by the probe-based effect-size score genuinely carry forgery-discriminative signal and that the quoted baseline numbers were produced under the same evaluation protocol; if either fails, the reported gains could be artifacts rather than evidence of a sparse forensic subspace.","fun_headline_variants_meta":{"raw":{"variants":["211 neurons match full retrained video forgery detectors","Sparse neuron probe rivals retrained models for fake video","Forgery detector's key knowledge fits in 211 neurons","Frozen backbone, 211 neurons beat heavy retraining on fakes","Video forgery detection: 211 neurons do the heavy lifting"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000306,"raw_usage":{"total_tokens":1793,"prompt_tokens":1026,"completion_tokens":767,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":642,"completion_tokens_details":{"reasoning_tokens":683}},"tokens_in":642,"tokens_out":767,"duration_ms":8097,"temperature":1.0,"reasoning_tokens":683,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T04:16:04.903032+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Zero out the 211 reported LAN activations in the frozen detector (or swap them with activations from real videos) and measure the shift in the detector's real–fake logits: the paper reports large directional shifts and label-flip rates for these neurons, so a replication that finds no larger effect than random same-budget neurons would refute the functional-specialization claim.","supporting_citations":[],"review_version":1}