{"id":"4e6b709a-b2a9-402b-ba86-9ca04c2b603e","arxiv_id":"2608.12876","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Adversarial training between a diffusion image editor and a reasoning MLLM produces an AI-image detector that improves across rounds on three external benchmarks.","lead":"SPARED trains an AI-image detector by having a diffusion editor create harder fake versions of real photos, while a reasoning model learns to catch them with explanations. The result is a detector that improves with each adversarial round and generalizes to unseen image generators.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The shortcut-proof claim rests on the unverified assumption that PaCo-gated edits differ from their sources only in the instructed editing trace; a consistent output-side artifact would let the defender win by a shortcut.","rationale":"The reader's weakest assumption identifies the PaCo gate and the paired-source construction as the load-bearing premise, and my reading agrees. The full text claims the loop is shortcut-proof because every fake is paired with its own real source and the attacker is credited only when PaCo confirms a faithful edit. However, Eq. (3)'s threshold of r_PaCo >= 0.7 verifies semantic adherence to the instruction, not the absence of systematic output-pipeline artifacts. The unpaired ablation is often cited as evidence that pairing matters, but it confounds pairing with source-distribution change, so it does not rule out a consistent non-editing side effect. The external zero-shot results are real evidence and could be explained either by genuine generalization of editing-trace detection or by a low-level cue common to diffusion outputs; without a low-level probe, the two explanations are not separable. I therefore keep the reader's CONDITIONAL verdict rather than moving to REJECT: the concern is concrete and testable, but the existing ablations and the cross-generator transfer provide partial support for the mechanism. The proposed logistic-regression probe on training-pair deltas would settle whether the PaCo/paired design actually closes the shortcut channel. I do not raise concerns about author conduct, and the paper's self-reported limitation on per-family difficulty control is real but secondary to the central claim.","tokens_in":13856,"tokens_out":8680,"duration_ms":96066,"concrete_test":"Sample 500 pairs from each adversarial training pool (Iter2 and Iter3). For each (x_src, x_edit), compute low-level deltas: mean brightness, global contrast, saturation, per-channel gamma, estimated JPEG quality, output resolution, and high-frequency energy. Fit a logistic-regression classifier on these deltas alone to predict the real/fake label of the pair, with held-out evaluation. If held-out accuracy is substantially above chance (e.g., 80% or higher), a non-editing side channel exists and the defender had access to it, directly falsifying the 'only systematic difference' premise. As a calibration control, run the same probe on pairs where x_edit is obtained by a known per-pixel transformation (e.g., brightness-only or gamma-only edit) to establish the floor accuracy that a pure low-level cue can produce.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that the loop escalates genuine detection capability depends on lock 3: every fake in the training pool differs from its real source only through the instructed edit. The PaCo gate in Eq. (3) scores semantic instruction-following; it does not constrain output-side low-level statistics. A diffusion editing pipeline can impose a reproducible side channel across all x_edit outputs, such as a fixed output resolution, a VAE reconstruction signature, JPEG re-encoding, brightness/gamma/saturation shifts, or sharpening. If such a channel exists, a defender trained on paired data can separate classes with that cue alone, and the reported benchmark gains would reflect transfer of the shortcut rather than explanation-grounded detection. The external benchmarks mitigate but do not eliminate this risk: a side channel shared among modern diffusion outputs (e.g., VAE or upsampler artifacts) would transfer to the fully synthetic fakes in Holmes-Set and AnomReason, matching the observed zero-shot gains without requiring semantic reasoning. The unpaired ablation in Table 3 does not settle the question, because replacing each paired real with a disjoint-source real changes the source distribution as well as the pairing, adding a provenance confound of its own; the observed drop is consistent with either explanation. The load-bearing assumption that the editing trace is the only systematic difference is therefore not yet established, and with it the paper's 'shortcut-proof by design' claim stands or falls.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces SPARED, an alternating attacker-defender reinforcement-learning loop for explainable AI-generated-image (AIGI) detection. A diffusion image editor (Qwen-Image-Edit LoRA, trained with DiffusionNFT) edits real photographs into paired fakes and is rewarded only when the edit passes a PaCo instruction-fidelity gate and fools a frozen defender; a Qwen3.5-9B reasoning MLLM is trained with verdict-only GRPO on the regenerated pools. The authors claim three 'shortcut-proof' locks: a verdict-only defender reward, a gated attacker reward, and strict pairing of each fake with its own real source. They report monotonic improvements across iterative rounds on three external benchmarks (DeepfakeJudge-Detect, AnomReason-Deepfake, and Holmes-Set), including zero-shot transfer on the latter two, and matched-budget ablations that separate static-pool, fresh-source, ungated, and unpaired training conditions.","tokens_in":14128,"tokens_out":7311,"duration_ms":74945,"significance":"If the shortcut-proof design is established, this is a valuable contribution: it addresses the dataset-bias shortcut at the data-construction level via paired editing rather than post-hoc alignment, and it provides a clean demonstration that explanation quality can rise as a side effect of accuracy-only RL. The ablation design is a real strength: the static-pool, fresh-source, ungated, and unpaired controls directly test several alternative explanations for the gains, and the authors honestly report a per-generator regression (Janus). However, the central claim that the loop escalates genuine detection capability rests on the assertion that PaCo-gated edits differ from their sources only by the instructed editing trace, and this premise is not yet verified. The missing variance estimates and the deferred technical appendix also prevent the experimental claims from being fully audited.","major_comments":[{"comment":"The claim that paired editing leaves 'the only systematic difference' between real and fake training images is asserted, not established. PaCo scores instruction-following; it does not constrain output-side low-level statistics. A diffusion editing pipeline can impose a reproducible side channel across all x_edit outputs—for example, a VAE decoding signature, fixed output resolution, resampling/JPEG re-encoding, brightness/gamma shifts, or sharpening. If such a channel exists, a defender trained on paired data can separate the two classes with that cue alone, and the reported benchmark gains would reflect transfer of the shortcut rather than explanation-grounded detection. The unpaired ablation in Table 3 does not settle this: replacing each fake's paired real with a disjoint-source real changes both the pairing and the source distribution, adding a provenance confound. Please add a direct test: train a simple probe classifier on low-level statistics of paired source/edit images (e.g., frequency spectra, color histograms, compression residuals, VAE reconstruction error) and report whether it can separate them; also include a null-edit/identity control to confirm that the PaCo gate rejects unedited images. This is load-bearing for the paper's 'shortcut-proof by design' claim.","section":"Data Construction and Training Schedule; Eq. (3)"},{"comment":"No error bars, seeds, or repeated runs are reported for any training stage. Both the GRPO defender and the DiffusionNFT attacker are stochastic RL procedures, and several key comparisons in Table 3 are small (e.g., 73.7 vs 73.6 on DFJ-Detect; 0.4998 vs 0.4990 CSemAP-Full). The monotonicity and matched-budget claims need variance estimates; at minimum, report three seeds per condition with the range or standard deviation, and state whether the reported models are the best or the average checkpoint.","section":"Tables 1-3 and Ablation Study"},{"comment":"The manuscript repeatedly defers to a 'technical appendix' and 'supplementary material' for corpus sizes, hyperparameters, filtering and screening thresholds, the per-generator Holmes-Set table, the GenShield comparison, and the UniGenDet Holmes-Set number (99.2). None of this material is included in the submission. Without it, the matched-budget ablations and the training configuration cannot be audited, and the paper is not reproducible. The appendix should be part of the submission, or the missing numbers should be moved into the main text.","section":"Experimental Setup and Conclusion"},{"comment":"The statement that 'the explanation is never rewarded' is inaccurate as written. The LoRA-SFT initialization trains directly on real/fake reasoning pairs from DeepfakeJudge, so the explanation text is supervised before the GRPO phase; only the later RL phase restricts reward to verdict correctness. This matters for the templated-rationale argument, because SFT on a fixed explanation corpus could itself imprint template rationales. Please rephrase to 'never rewarded in the RL phase' and discuss what the SFT phase contributes to the CSemAP gains observed in Table 2.","section":"Reasoning Defender, Eq. (1)"},{"comment":"The PaCo gate threshold (0.7) and the number of adversarial rounds are free hyperparameters, and no sensitivity analysis is reported. The monotonicity result is specific to these choices: a higher threshold could gate out all adversarial examples, while a lower threshold could admit degenerate edits. Please report a small sweep over the gate threshold, and show what happens when the loop is stopped earlier or extended beyond Iter3.","section":"Eq. (3) and Data Construction and Training Schedule"}],"minor_comments":[{"comment":"The caption states that the final round's AP stays above 92 on every Holmes-Set family, but the per-generator values are only in the missing appendix; key values should be moved into the main text or an accessible supplementary file.","section":"Figure 3 and per-generator table"},{"comment":"The model name 'Qwen-Image-Edit-2511' appears in the Method, while the introduction and the DeepfakeJudge-Detect description refer to 'Qwen-Edit'. Please align the naming and verify the intended model identifier.","section":"Method and Introduction"},{"comment":"The phrase 'the explanation is never rewarded' should be qualified as 'never rewarded in the RL phase' to avoid a direct contradiction with the supervised SFT initialization described in the Method section.","section":"Abstract and Conclusion"},{"comment":"The statement that all three benchmarks show monotonic improvement is slightly overstated for DeepfakeJudge-Detect, since the SFT initialization uses that suite's designated training corpus and the benchmark is therefore not fully zero-shot; the Experimental Setup acknowledges this, but the abstract and conclusion should as well.","section":"Experimental Setup"},{"comment":"There are several PDF-extraction spacing errors in the text (e.g., 'templatedrationales', 'trainedwithaccuracy-basedGRPO'). Please ensure the final version is typeset correctly.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The paper has a strong empirical core and a well-designed set of ablations, but the two load-bearing issues—the unverified lock-3 assumption and the absence of variance estimates—need to be addressed before publication. I would encourage the editor to require the technical appendix as part of the revision and to ask the authors to add the low-level shortcut probe described in Major Comment 1."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"I've read SPARED end to end. The core move is real: replace the fixed forgery corpus with an adversarial loop where a diffusion editor forges paired fakes under an instruction-fidelity gate and a reasoning MLLM learns with a verdict-only reward. That combination is new to this domain, and the paper gives it a fair test. The ablations are the strongest part. The static-pool control, the fresh-source control, and the unpaired-pool control each isolate a specific channel, and the monotonic round-by-round gains on three external benchmarks are genuinely supportive. I also respect that the conclusion admits the Janus regression and proposes a graded-difficulty fix; that is the kind of honesty a reviewer can build on. The emergent explanation quality, with CSemAP never rewarded during training, is an interesting side result rather than a claimed headline, which I find credible. The soft spots are proportionate but real. First, there are no error bars, no seeds, and no released code, data, or technical appendix. For a system with this many interacting parts, that is a serious reproducibility gap, and it should be a standard request in review. Second, the load-bearing assumption that paired edits leave only the editing trace as the systematic difference is not fully verified. The PaCo gate checks semantic instruction following, not low-level output statistics. If the editing pipeline imposes a consistent side channel—a VAE artifact, a fixed output resolution, a JPEG signature—the defender could in principle exploit it, and that shortcut could transfer to synthetic images from other diffusion models. The external benchmarks mitigate this risk because they use different generators, but they do not eliminate it. The unpaired ablation does not settle the question, since it changes the source distribution as well as the pairing. I don't think this sinks the paper. The evidence is strong enough to accept the loop's capability-escalation claim, but the 'shortcut-proof by design' language oversells what is currently proven. It is a well-designed defense that raises the cost of shortcuts, not a mathematical guarantee. Who should read it: anyone working on detector generalization, MLLM reasoning, or self-play in vision. It deserves a serious referee. I would send it to review, and my recommendation would be conditional on releasing the technical appendix and at least one training run with seeds. If the authors add those, I expect this to be a useful and cited paper.","headline":"SPARED is a solid, honestly written adversarial-training paper for explainable deepfake detection whose main weaknesses are unshipped artifacts and a shortcut-risk that is reduced but not mathematically closed.","tokens_in":704,"tokens_out":745,"would_cite":true,"duration_ms":30971,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A detector trained by an adversarial editor that forges paired fakes from real photos improves monotonically and beats models 26 times larger.","keywords":["AI-generated image detection","adversarial reinforcement learning","diffusion image editing","deepfake detection","multimodal LLM reasoning","explainable forensics","dataset bias","GRPO"],"falsifier":"Train the same loop on a paired pool in which every fake is also systematically recompressed or brightness-shifted by a fixed amount while still passing the fidelity gate, then test the resulting detector on unedited real images with the same recompression or brightness shift. If accuracy on those shifted real images rises as much as it does on genuine edits, the loop is exploiting the side effect rather than the editing trace; if it does not, the paired-source assumption is doing the claimed work.","tokens_in":13670,"feed_emoji":"🔍","tokens_out":6686,"duration_ms":65623,"temperature":0.7,"pith_summary":"The paper introduces SPARED, an adversarial reinforcement-learning loop in which one model edits real photographs into fake counterparts and a second, reasoning-based model is trained to catch them. The central claim is that this paired editing setup removes the usual dataset-bias shortcut—real and fake images differing by provenance rather than by generation trace—while the alternation keeps forcing the detector to face newly generated hard cases. The authors report monotonic improvement across three external benchmarks, with a 9-billion-parameter detector surpassing much larger closed and open models on judge-style detection and semantic-anomaly reasoning, and explanations improving even though only verdict accuracy is rewarded.","feed_headline":"A 9B detector beats 26x-larger models after adversarial training","feed_subtitle":"Each round, an image editor forges harder faithful fakes, and the detector retrains on them, lifting accuracy monotonically.","key_machinery":"The load-bearing object is a three-channel adversarial loop. The attacker is a diffusion image editor trained with an RL objective; its reward is $r_A = r_{\\mathrm{det}}$ if an instruction-following gate (PaCo) scores the edit at or above 0.7, and 0 otherwise, so a rollout must both obey the edit instruction and fool the current frozen defender to earn credit. The defender is a multimodal large language model fine-tuned with GRPO under the reward $\\mathbf{1}[\\hat{y}=y]$, which never scores the explanation text. The data channel pairs every edited fake with its own real source image, filtered for deduplication and perceptual-hash leakage against evaluation benchmarks. The definition of the PaCo gate is doing the anti-collapse work: without it, an attacker rewarded only for fooling drifts toward tiny edits, and the resulting pool teaches the defender to call realistic images fake.","core_discovery":"SPARED claims that a detector can be made both generalizing and explainable without any reward for explanation quality, provided the training loop is shortcut-proof on all three channels: the defender's reward credits only the final real/fake verdict, the attacker's reward is gated on instruction-faithful edits so it cannot win by not editing, and every fake is paired with its own real source so provenance cannot substitute for the editing trace. Under this loop, each attacker round forges a harder pool aimed at the current defender's blind spots, and each defender round is trained on that pool with GRPO. The paper reports that accuracy improves monotonically from SFT through three adversarial iterations on DeepfakeJudge-Detect, AnomReason-Deepfake, and Holmes-Set; the final 9B model surpasses every non-reasoning MLLM evaluated and every reasoning model up to 30B on the first, trailing only a reasoning model 26 times larger, and reaches 92.8 mean accuracy zero-shot on ten unseen generator families. Explanations rise in semantic quality as a side effect of verdict-only training, and ablations show that removing the gate, unpairing the reals, or replacing the evolving attacker with static or fresh data all substantially reduce the gain.","pith_inferences":["Beyond the paper's benchmarks, the same paired-edit loop could be applied to other forensics tasks—document forgery, audio deepfakes, or tampered video—wherever a faithful edit can be generated alongside its pristine source.","The reported Janus regression suggests the binary fooling reward has no per-family difficulty control; a graded or calibrated reward could allow the loop to allocate difficulty without sacrificing one generator family while improving the mean.","If the efficiency result is taken seriously, it implies parameter count is not the binding constraint for detection; the binding constraint is the difficulty distribution of the training data, which the attacker controls.","A direct testable consequence is that replaying the loop with a weaker attacker should lower the ceiling: comparing two checkpoints of the same attacker with different edit diversity would isolate how much detector gain is attributable to pool diversity versus pool difficulty."],"forward_implications":["A detector trained this way should keep improving as generators change, because each round's attacker regenerates the pool against the current decision boundary rather than against a fixed corpus.","The verdict-only reward suggests that explanations can be treated as byproducts of accuracy; systems that want trustworthy rationales may not need explanation-specific supervision.","The ablations imply that static training, longer training, and even fresh data cannot substitute for an evolving attacker, so future detectors should budget compute for online adversarial regeneration.","The zero-shot transfer from locally edited photos to fully synthetic images from unseen generator families indicates that edit-faithful hard negatives teach features that are shared across synthesis pipelines."],"supporting_citations":[{"why":"Supplies DeepfakeJudge-Detect, the primary judge-style benchmark, and the judge-training corpus used for the defender's SFT initialization.","marker":"(Kuckreja et al. 2026)"},{"why":"Provides the PaCo instruction-following gate that gates the attacker's reward in Eq. 3.","marker":"(Ping et al. 2025)"},{"why":"Provides GRPO, the defender's verdict-only policy-gradient optimizer.","marker":"(Shao et al. 2024)"},{"why":"Provides DiffusionNFT, the online diffusion RL algorithm used to train the attacker.","marker":"(Zheng et al. 2025)"},{"why":"Documents the dataset-bias and provenance shortcut that the paired-source construction is designed to close.","marker":"(Guillaro et al. 2025)"},{"why":"Contributes AnomReason-Deepfake, the zero-shot semantic-anomaly benchmark used to score both verdict and explanation.","marker":"(Tan et al. 2025)"},{"why":"Contributes Holmes-Set, the ten-generator fully synthetic transfer benchmark.","marker":"(Zhou et al. 2025)"}],"fun_headline_variants":["9B detector beats 30B models via adversarial edits","Shortcut-proof loop makes 9B detector beat 30B models","Reasoning emerges without reward in adversarial detector","Small reasoning detector beats big models after adversarial loop","9B detector with reasoning beats up to 30B models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole design rests on the gate correctly identifying when an edit is faithful, and on the paired-source construction leaving the editing trace as the only systematic difference between real and fake training images; if the editing model introduces a consistent side effect such as a global brightness shift or compression signature, the defender can learn that shortcut and the reported gains would transfer that shortcut rather than true detection ability.","fun_headline_variants_meta":{"raw":{"variants":["9B detector beats 30B models via adversarial edits","Shortcut-proof loop makes 9B detector beat 30B models","Reasoning emerges without reward in adversarial detector","Small reasoning detector beats big models after adversarial loop","9B detector with reasoning beats up to 30B models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.002027,"raw_usage":{"total_tokens":7938,"prompt_tokens":1022,"completion_tokens":6916,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":638,"completion_tokens_details":{"reasoning_tokens":6836}},"tokens_in":638,"tokens_out":6916,"duration_ms":41743,"temperature":1.0,"reasoning_tokens":6836,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:28:07.020141+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same loop on a paired pool in which every fake is also systematically recompressed or brightness-shifted by a fixed amount while still passing the fidelity gate, then test the resulting detector on unedited real images with the same recompression or brightness shift. If accuracy on those shifted real images rises as much as it does on genuine edits, the loop is exploiting the side effect rather than the editing trace; if it does not, the paired-source assumption is doing the claimed work.","supporting_citations":[{"cited_title":"2025 IEEE/CVF International Conference on Computer Vision (ICCV) , pages =","cited_arxiv_id":null,"evidence_quote":"Contributes Holmes-Set, the ten-generator fully synthetic transfer benchmark."}],"review_version":1}