We thank the reviewer for their feedback. We are glad that the relevance of the problem we address was recognised, as well as the appreciation of the introduction of MIBench as a benchmark covering a wide range of diffusion-based manipulations.

We believe there may be misunderstandings regarding the motivations behind RADAR and our experimental design. To solve them, we address the reviewer's questions below. We hope our answers below will resolve the doubts of the reviewer.

(1a) Motivation. We respectfully but strongly disagree. The motivation for RADAR design choices is inherent to the challenges posed by diffusion-based forgery detection. As we state in LL44-58, to contrast the ever-growing number of diffusion models available for tampering, we need to both learn effectively from multiple models and promote generalisation to unseen out-of-distribution ones. We mitigate both problems by proposing our three-way contrastive loss (aiding representation learning from various inpainter models) and multimodal feature extraction (promoting generalisation with multiple foundation models).

(1b-2a) Theoretical analysis and justification. Although we agree that theoretical justifications would further strengthen our point, we highlight that this is highly non-standard for the task, as for many other tasks in computer vision. Indeed, image forgery detection and localisation remains highly experimental and, as a result, none of the competing baselines provide any theoretical justification for their performance. To compensate for this drawback, we proposed a comprehensive analysis section on why our method works (Section 4.3) and extensive empirical results, as pointed out by all other reviewers. We hope that the reviewer will reconsider their assessment of our work in light of this.

(2b) Novelty. Our core novelty in the methodological design lies in the combination of multiple foundation models for image forgery detection and localisation, suggesting that image forgery localisation requires more than just high-level semantics understanding and demands sensitivity to geometric inconsistencies as well. This is motivated by the observation that diffusion-based forgeries can disrupt both modalities in distinct ways (see LL138-145). This novel intuition not only can influence further practices for identifying manipulated images, but is also enabled by non-trivial technical contributions such as our Fusion Block. Our three-way patch-wise contrastive formulation is also technically novel, and it is motivated by the unique effect that diffusion models have on images. Its effectiveness is further justified in Section 4.3 and Table 2. Importantly, please note that pEkt, 9vWL, and 53cS all highlight the novelty and innovation of our contributions;

(3) Fairness. We firmly believe that our comparison is fair. To ensure a transparent evaluation, we extensively reported the performance of RADAR and baselines in the main paper and the appendices on all splits. In our experiments we take special care to ensure fair evaluation by following standard evaluation protocols and common practices. In particular, following [1,2,3,4,5,6,7], we do not retrain the baselines but use the available checkpoints, as we state in Appendix A.1. This practice has been established due to the high computational costs that make retraining baselines unfeasible. Instead, the standard evaluation in image forgery detection and localisation is to train the most robust model possible on a big dataset for a significant time, and compare its performance on out-of-distribution benchmarks to assess generalisation. We did this extensively with MIBench, further distinguishing also near OOD scenarios (obtained with LoRAs) and far OOD ones (composed of commercial inpainters and existing datasets);

(4) Replacing DINO-v2 with CLIP. Thanks for the interesting idea. We replaced DINO-v2 with CLIP as suggested, and report the performance below:

These results indicate that our method is fundamentally effective and able to combine features coming from different encoders. Indeed, results with CLIP are still competitive, but we notice that DINOv2 is performing best, consistent with benchmark evaluations in which it is outperforming CLIP in tasks requiring semantic understanding [8].

(5) Generalisation evaluation. Please note that we included both commercial and open source inpainters in the OOD set. Indeed, MIBench-OOD is composed of both commercial models, and existing datasets with other generation pipelines (as stated in LL246-254), avoiding potential biases in the evaluation. The detailed results on the splits of MIBench-OOD (Table 12 in the Appendix) show that RADAR performs the best in both cases.

We also made an additional effort by proposing the experiment in Figure 6 of the Appendix, using a graphic designer to modify images with manual edits. Let us also highlight the experiment we performed in 9vWL's reply, in which we tested RADAR and existing baselines on the very recent OpenSDI [9], still outperforming all. We believe that this proves our strong generalisation capabilities across models and data generation pipelines.

As a further effort to clear the doubt, we have also performed, as suggested, an experiment where RADAR is trained on a subset of open-source inpainters and tested on others. In particular, we trained RADAR on SD1, SD1.5, SD2, SDXL, SD3, with the same protocol stated in LL325-326 and employed for Table 2 of the main paper, and tested SD3.5, Kandisky 2.2, Kandisky 3.1, Flux Schnell, and Flux Dev. We obtained the following results:

The table above shows remarkable results compared to the baselines shown in Table 1 of the main paper, even considering the restricted training setup, further proving the effectiveness of our generalisation-focused design choices.

As a final consideration, let us clarify our design choice: in the design of a method for IFDL, we believe that if open source diffusion models exist, then they should be used to generate in-distribution training data, since their inclusion in the training set could maximize the detection accuracy in case a malicious user would use them for editing images. This is coherent with our motivation in LL39-43, which justifies why we did not consider open source models for generalisation evaluation. Contrary, generating data with commercial models leads to considerable additional costs. In any case, we agree that this additional experiment strengthens our point, and we will include the table in the Appendix. Thanks.

References:

• [1] Sida: Social media image deepfake detection, localization and explanation with large multimodal model, CVPR 2025;
• [2] Safire: Segment any forged image region, AAAI 2025;
• [3] Mesoscopic insights: Orchestrating multi-scale & hybrid architecture for image manipulation localization, AAAI 2025;
• [4] Adaifl: Adaptive image forgery localization via a dynamic and importance-aware transformer network, ECCV 2025;
• [5] Towards modern image manipulation localization: A large-scale dataset and novel methods, CVPR 2024;
• [6] Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization, CVPR 2023;
• [7] Hierarchical fine-grained image forgery detection and localization, CVPR 2023;
• [8] DINOv2: Learning Robust Visual Features without Supervision, TMLR 2024;
• [9] OpenSDI: Spotting Diffusion-Generated Images in the Open World, CVPR 2025.

Thank you for the authors' responses. Several of my concerns have been addressed. However, the authors assert that the core novelty in the methodological design lies in the combination of multiple foundation models for image forgery detection and localisation. This appears to be more of an innovation in application rather than a methodological breakthrough. Based on the provided responses, I will adjust my rating accordingly.

We thank the reviewer for their positive and encouraging feedback. We are glad that the novelty of our approach and the proposed benchmark for diffusion-based image manipulations were recognised as key contributions. We appreciate the acknowledgement of the clarity and organisation of the paper, as well as the comprehensiveness of the experimental evaluation. We also value the reviewer's note on the potential impact of releasing the model, code, and benchmark, which we are committed to sharing with the research community.

Regarding the weaknesses, we respond as follows:

(1) Claim. We thank the reviewer for pointing this out. Our intention in LL174–175 of Section 3.3 was to highlight that, in RADAR’s case, removing the contrastive loss or using only a single encoder (as shown in Table 2) leads to reduced detection and localisation performance, despite training with a large number of inpainters. In contrast, method [2], which is trained only for detection, benefits from increased diversity of generators. We agree that the original phrasing may overgeneralise and could be misleading. We will revise this claim in the final version to better reflect our specific findings and avoid confusion;

(2) Typo. We thank the reviewer for pointing out this typo, we will amend this in the final version.

Regarding the reviewer’s questions, we reply as follows:

(1) Release. We confirm that we will release the model's weights, code for training and inference, and benchmark upon publication, as stated in line 15 of the main manuscript. We appreciate the reviewer’s interest in this aspect, and we agree that making these resources publicly available is extremely important and will significantly benefit the research community;

(2) Why not CLIP?. We thank the reviewer for this insightful question. We chose DINO-v2 primarily due to architectural and resolution compatibility with DepthAnything-v2, which facilitates a more intuitive fusion of features in our cross-attention mechanism, and favourable performance compared to CLIP on self-supervised learning benchmarks requiring semantic understanding [1]. That said, we agree that CLIP’s language supervision may offer rich semantics as well. Indeed, we conducted an additional experiment using CLIP (ViT-B/16) instead of DINO-v2, and found that while performance remained reasonable (as shown in the table below), it was slightly lower compared to DINO-v2 in our setup. Importantly, the performance remained competitive with respect to the inference with DepthAnything-v2 only (see Table 2), proving the effectiveness of our novel fusion strategy. Nevertheless, CLIP remains a viable alternative, and we see potential in future exploration of multi-modal supervision within our framework.

References:

• [1] DINOv2: Learning Robust Visual Features without Supervision, TMLR 2024;
• [2] Community forensics: Using thousands of generators to train fake image detectors, CVPR 2025.

We thank the reviewer for their thorough and encouraging assessment. We are pleased that the aspects of our method, such as the use of complementary feature extractions for image forgery detection and localisation and the three-way contrastive distinction beyond standard binary setups, were recognised as strengths and deemed as genuinely novel. We also appreciate the positive feedback on the comprehensiveness of the proposed MIBench benchmark, its relevance, and the clarity and structure of the manuscript. We are glad that the ablation studies were found informative.

We also thank the reviewer for pointing out the OpenSDI benchmark. We only became aware of its existence during its official presentation at CVPR 2025, which occurred after the submission deadline. We agree that including results on OpenSDI helps contextualise RADAR’s performance more broadly. We have since run RADAR and the considered competitors on OpenSDI, reporting the results below:

We observe that RADAR attains the best performance in detection (on both AUROC and Accuracy metrics) and localisation (first in IoU, second in F1), proving its strong generalisation capabilities. We will include these results in the final version of the manuscript.

We thank the reviewer for their careful and constructive feedback. We are pleased that the innovative fusion of semantic and geometric features for tampering representation, as well as the use of triplet contrastive loss to improve cross-model generalisation, were seen as strengths. We also appreciate the recognition of our efforts in building MIBench, a diverse and large-scale benchmark, and the value of the extensive experiments and strong results across multiple scenarios.

Regarding the reviewer’s questions, we respond as follows:

(1) Applicability beyond inpainting. We tested RADAR's performance on datasets including non-inpainting modifications, reporting these results in Table 4 of Section C.3 of the Appendix. We observed that localisation performance is not negatively impacted, indeed, F1 scores are even higher than those obtained on MIBench. We ascribe this to the less refined copy-paste operations in these datasets, which, compared to inpainting, do not allow for a smooth blending of inserted elements, thereby easing localisation. However, we also report lower detection performance relative to MIBench. We conjecture that this is due to the lack of distinction between genuine, affected, and tampered pixels in non-inpainting modifications, leading to outliers in detection. Nonetheless, since localisation performance remains satisfactory, calibrating the detection score (i.e., threshold tuning of the precision-recall curve on the validation sets) may suffice to improve overall results. An alternative way to tackle this would be to train the framework on non-inpainting forgeries as well, although this is out of scope for our problem formulation.

(2) Multi-region scenario. We thank the reviewer for the interesting suggestion. Since the Safire-MS Expert subset from MIBench-OOD specifically includes multi-source forgeries, we analysed RADAR's performance on Single Region forgeries (a single connected component in the ground truth) and Multiple Regions (more than one connected component in the ground truth), in the table below:

We observe that RADAR's performance remains competitive in both the presence of single regions and multiple regions inpainted. We hypothesise that this is due to the patch-level features separation promoted by our contrastive formulation.

(3) Efficiency and deployment. Thanks for the suggestion. We did not consider low-resource deployment as a core application of RADAR, akin to all considered competitors [1,2,3,4,5,6,7]. However, we believe it is interesting to investigate this scenario, and we conducted the necessary additional tests. First, we highlight that we already report inference times and input sizes for RADAR and the considered competitors in Table 7 of Section C.3 of the Appendix. Moreover, we measured the memory footprint of all methods, as shown below. RADAR is the method that has the smallest memory footprint.

From the results in Table 7 of Section C.3 and the table above, RADAR performs competitively in low-resource environments.

As an additional effort to further reduce the computational cost, we propose an additional experiment by substituting the DINO-v2 and DepthAnything-v2 backbones with their smaller variants, for instance, using ViT Small instead of ViT Base. We train this smaller model and compare it using the reduced training protocol described in LL325-326 due to training times of the full model. We report the results of the experiment below:

This substitution represents a good trade-off between performance and efficiency. In particular, this variant yields a runtime memory footprint of 3.106 GiB and an inference time of 99.424 ms, representing a 30% reduction in memory and a 57% reduction in inference time compared to the version presented in the main manuscript. Moreover, we are still very competitive in terms of accuracy and localisation compared to baselines in Table 1, even considering the reduced training setup.

Finally, as concerns training times, we did make use of fairly large computational resources due to the complexity of the task. In particular, we trained our framework for 12 days on the hardware specified in Section B.2 of the Appendix.

References:

• [1] Sida: Social media image deepfake detection, localization and explanation with large multimodal model, CVPR 2025;
• [2] Safire: Segment any forged image region, AAAI 2025;
• [3] Mesoscopic insights: Orchestrating multi-scale & hybrid architecture for image manipulation localization, AAAI 2025;
• [4] Adaifl: Adaptive image forgery localization via a dynamic and importance-aware transformer network, ECCV 2025;
• [5] Towards modern image manipulation localization: A large-scale dataset and novel methods, CVPR 2024;
• [6] Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization, CVPR 2023;
• [7] Hierarchical fine-grained image forgery detection and localization, CVPR 2023.