IMDPrompter: Adapting SAM to Image Manipulation Detection by Cross-View Automated Prompt Learning

Questions 1:Can you provide more detailed technical information about the consistency loss formulation in CPC? It would be helpful to see visual examples of how CPC affects the prompt generation process and its impact on the final detection results.

Thank you for your constructive suggestions. We have supplemented explanations in the following two aspects:

• Technical Details of CPC: Refer to the response to Weakness 1.
• Impact of CPC on Prompt Generation and Final Detection Results: Refer to the response to Weakness 1.

Questions 2:Why were certain recent methods excluded from the comparison? Have you considered comparing with methods published in 2024 or other SAM-based approaches?

Thank you for your constructive suggestions. We have provided explanations from the following two aspects:

• Comparison with Important Recent Works from 2024: Refer to the response to Weakness 2.
• Comparison with Other Foundation Model-Based Methods: Refer to the response to Weakness .

Questions 3:How does IMDPrompter handle images from different domains in practical applications? What mechanisms could be added to make the model more adaptive to distribution shifts?

Thank you for your constructive suggestions. Refer to the response to Weakness 3.

Questions 4:Can you provide comprehensive ablation studies showing the contribution of each view and how different view combinations affect the model's performance? This should include an analysis of the computational overhead associated with each additional view.

Thank you for your constructive suggestions. We have provided explanations from the following two aspects:

• Ablation Studies on the Contribution of Each View: Refer to the response to Weakness 4.
• Computational Trade-Offs of Different View Combinations: Refer to the response to Weakness 4.

Weakness 5: The paper lacks justification for selecting SRM, Bayer, and Noiseprint as noise perspectives. There is no analysis of their specific effectiveness for different types of image manipulations, nor any comparison with other potential noise perspectives that could potentially achieve similar or better results.

• Criteria for Selecting Types of Image Processing Information: The SRM, Bayar, and Noiseprint views aim to introduce semantic-agnostic features from multiple perspectives. The definition of semantic-agnostic features is as follows: "Low-level artifacts are caused by the in-camera acquisition process, such as the sensor, the lens, the color filter array, or the JPEG quantization tables. In the Image Manipulation Detection task, semantic-agnostic features refer to features that prominently represent low-level artifact information. These features are unrelated to the semantic content of the image. For tampered and untampered regions of an image, there is a significant difference in feature distribution. Common methods for extracting such features include SRM, Bayar, DCT, and Noiseprint." Therefore, we can conclude that views which better highlight low-level artifact information, thereby exhibiting stronger differences in feature distribution between tampered and untampered regions of an image, are the views we seek.

• Reasons for Choosing SRM, Bayar, Noiseprint, and RGB as Prompt Views: The selection of semantic-agnostic features needs to meet the following criteria: (1) Each position in the noise view corresponds one-to-one with the corresponding position in the original image, and (2) the ability to prominently display low-level artifact information so that there is a stronger difference in feature distribution between tampered and untampered regions of an image. Taking these two conditions into account, we selected five semantic-agnostic views: Noiseprint, SRM, Bayar, DCT, and Wavelet. The ablation experiments under various feature combinations are shown in the table below. When each view is used individually, we found that using only the Wavelet view resulted in the worst performance on in-domain test sets, and its performance on out-of-domain test sets was only slightly better than using the RGB view alone. This indicates that the semantic-agnostic features extracted by the Wavelet view provide limited useful information for our image tampering detection task. When we sequentially introduced the Noiseprint, Bayar, and SRM views based on the RGB view, the metrics on each dataset gradually improved. However, when the DCT view was introduced, performance did not increase significantly. Further introducing the Wavelet view did not lead to performance improvements on any dataset. Considering computational overhead and detection accuracy, we selected RGB along with Noiseprint, SRM, and Bayar as our prompt views.

Weakness 4: The multi-view fusion analysis is incomplete. The paper lacks detailed ablation studies that quantify the individual contribution of each view, and there is no discussion of the computational trade-offs associated with different view combinations.

• Ablation Studies on the Contribution of Each View: Referring to the table above, we have added detailed ablation studies for different view combinations. We found that when only one view is used, using only the Noiseprint view achieves better detection quality. Additionally, when the RGB view is combined with any noise view, IMDPrompter achieves SOTA performance on most metrics. When RGB, Noiseprint, Bayar, and SRM views are used together, IMDPrompter achieves the best performance while maintaining a slight increase in computational overhead.

• Computational Trade-Offs of Different View Combinations: Referring to Table 5 in the main paper and the table above, when RGB, Noiseprint, Bayar, and SRM views are used together, IMDPrompter achieves the best performance with only a 0.5-hour increase in training time and a 9.3% increase in the number of parameters, thereby achieving optimal performance.

Com-F1 Metrics for Lighting and WEBP Compression

• Mechanisms for Handling Domain Shifts in IMDPrompter: Utilizing four mechanisms—large-scale pre-trained SAM's generalization ability, multi-view design, optimal prompt selection, and cross-view consistency constraints—we analyze each mechanism as follows:

  • Large-Scale Pre-Trained SAM’s Generalization Ability: SAM's extensive pre-training provides strong generalization across various domains, offering potential priors for image tampering detection and refining detection results. We constructed a baseline method, FCN+, which uses multi-view design but does not utilize SAM. As shown in the table below, FCN+ lacks the extensive pre-training of SAM and thus has weaker generalization to other domains. Consequently, under domain shift conditions, its detection accuracy is significantly lower than that of IMDPrompter.

    Method	100.0	90.0	80.0	70.0	60.0	50.0
    FCN+	47.2	46.3	45.3	44.4	43.5	42.7
    IMDPrompter	76.3	73.6	72.0	71.6	70.7	70.5

  • Multi-View Design: Combining information from RGB views, we constructed a baseline method IMDPrompter-single, which uses only the RGB view prompts for SAM. In domain shift scenarios, the detection accuracy of IMDPrompter-single is significantly lower than that of the multi-view IMDPrompter.

    Method	100.0	90.0	80.0	70.0	60.0	50.0
    IMDPrompter-single	66.2	64.1	62.4	61.9	60.1	71.2
    IMDPrompter	76.3	73.6	72.0	71.6	70.7	70.5

  • Optimal Prompt Selection: For different domain shifts, the most suitable prompt views vary. To select the most robust prompt for the current domain shift, we implemented an optimal prompt selection process based on minimizing segmentation loss. We found that by introducing the optimal prompt selection module, IMDPrompter achieved better adaptability to domain shifts.

  • Cross-View Prompt Consistency: For suboptimal prompts under the current domain shift, cross-view prompt consistency can be used to align them with the optimal prompts, thereby enhancing robustness to domain shifts. The optimal prompt selection module can select the prompts from multiple views that are more adaptable to the current domain shift. Through cross-view consistency constraints, all views achieve strong adaptability to the current domain shift.

    Method	100.0	90.0	80.0	70.0	60.0	50.0
    without CPC and OPS	69.7	0.0	62.4	61.9	60.1	71.2
    +OPS	71.3	67.6	65.1	64.3	63.7	64.2
    +OPS and +CPC	76.3	73.6	72.0	71.6	70.7	70.5

Weakness 3: The paper shows limited discussion of model robustness to distribution shifts and lacks experiments demonstrating how the model adapts to real-world scenarios where data distribution varies. There is no clear mechanism described for handling domain adaptation.

Thank you for your constructive suggestions. We have provided a detailed analysis from the following three aspects:

• Robustness Analysis for Gaussian Blur and JPEG Compression: Referring to Figure 5 in the main paper, we tested the performance of IMDPrompter and other methods like MVSS-Net under varying degrees of JPEG compression and Gaussian Blur. We found that IMDPrompter achieved the best performance across all settings, demonstrating strong robustness to Gaussian Blur and JPEG compression.

• Robustness Analysis for Lighting and WEBP Compression: Referring to the table below, we tested the performance of IMDPrompter and other methods like MVSS-Net under different lighting conditions and WEBP compression. We found that IMDPrompter achieved the best performance across all settings, demonstrating strong robustness to various lighting conditions and WEBP compression.

Weakness 2: The comparison baselines are relatively outdated, missing important recent work from 2024 and other foundation model-based approaches. This limits the comprehensiveness of the comparative analysis and makes it difficult to assess the method's standing against the latest advancements in the field.

Thank you for your constructive suggestions. We have supplemented explanations from the following two aspects:

• Comparison with Important Recent Works from 2024: As shown in the table below, we adopted the same combined training set as the latest 2024 method UnionFormer1 and evaluated performance on each test set. Our method achieved state-of-the-art (SOTA) performance.

  Pixel-Level F1 Experimental Analysis:

Image-Level Detection Experimental Analysis:

Pixel-Level AUC Experimental Analysis:

• Comparison with Other Foundation Model-Based Methods: Referring to Supplementary Material Table 16, we have added comparisons with foundation model-based methods such as MedSAM, MedSAM-Adapter, AutoSAM, and SAMed. IMDPrompter outperforms these methods in metrics like I-AUC, I-F1, P-F1, and Com-F1.

[1] Li, Shuaibo, et al. "UnionFormer: Unified-Learning Transformer with Multi-View Representation for Image Manipulation Detection and Localization." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.

Weakness 1: The technical details about the Cross-View Consistency Enhancement Module (CPC) implementation are insufficient. The paper does not clearly explain how different consistency loss formulations impact the results, and there is no visualization or analysis demonstrating how cross-view consistency is maintained throughout the detection process.

Thank you for your constructive suggestions. We have supplemented explanations from the following four aspects:

• Technical Details of the CPC Loss Function: Referring to lines 303 and 304 of the original paper, we selected Focal Loss as the consistency constraint loss.

  The detailed mathematical expression for Focal Loss is as follows:

$

FL(p_t) = - \alpha_t (1 - p_t)^\gamma \log(p_t)

$

Where:

• $p_t$ is defined as:

$

p_t = 
\begin{cases} 
p & \text{if the true label } y = 1, \\
1 - p & \text{if the true label } y = 0.
\end{cases}

$

Here, $ p $ is the predicted probability for the positive class ($ y=1 $).

• $\alpha_t$: A weighting factor for class imbalance ($\alpha_t \in [0, 1]$).
• $\gamma$: The focusing parameter, controlling the reduction of loss contribution for well-classified examples ($\gamma \geq 0$).

This detailed formulation makes Focal Loss highly effective for imbalanced datasets or cases where misclassified samples are more critical.

• Impact of Different CPC Implementations: As shown in the table below, we compared MSE Loss, L1 Loss, Smooth L1 Loss, and KL Divergence Loss and Focal loss. Ultimately, Focal Loss achieved the best performance; therefore, we selected Focal Loss as our consistency constraint loss function.

To further analyze how CPC affects the prompt generation process and the final detection results, we constructed a baseline method based on weighted averaging of multi-view outputs, then sequentially introduced OPS and CPC to explore how CPC influences the prompt generation process and the final detection results.

• Cosine Similarity Relative to the Optimal Prompt: After using OPS, the cosine similarity between prompts of each view and the optimal prompt did not increase significantly. This indicates that using only OPS is insufficient to align the prompts with the optimal view. However, when both OPS and CPC are used together, the cosine similarity between each view and the optimal view increases significantly (all exceeding 0.95), indicating that using both OPS and CPC effectively aligns the prompts of each view with the optimal view.

  	RGB	SRM	Bayar	Noiseprint
  Weighted Average	0.82	0.85	0.83	0.92
  OPS	0.81	0.86	0.83	0.99
  OPS+CPC	0.95	0.97	0.96	0.99

• F1 Metrics Relative to GT: Furthermore, we evaluated the F1 metrics of the prompt masks of each view against the ground truth (GT). Compared to the weighted average strategy, OPS prevents the optimal prompt from being degraded by inaccurate prompts, thereby improving the performance of final image tampering detection. At the same time, we found that when only OPS is introduced, the F1 metrics of the prompt masks for each view do not improve, indicating that using only OPS cannot achieve cross-view consistency enhancement. When both OPS and CPC are used, not only are the final image tampering detection metrics improved, but the prompt F1 of each view is also enhanced. This indicates that using both OPS and CPC achieves cross-view consistency enhancement, bringing each view closer to the optimal view.

Weakness 2. Limited Modality Discussion: While IMDPrompter has been tested on a variety of datasets for image manipulation, it would be beneficial for the authors to discuss the potential application of this approach to other domains or modalities, such as video manipulation, to establish broader applicability. You could discuss specific challenges or necessary modifications to apply IMDPrompter to video manipulation detection.

Thank you for your constructive suggestion. We provide a detailed explanation from the following two perspectives:

Experiments with Subsets of the Current Views: We found that when only a single view was used, the Noiseprint view achieved the best performance. Additionally, we observed that using the RGB view along with any semantic-agnostic view could achieve state-of-the-art (SOTA) performance across most metrics. Based on this, we concluded that for new data types, such as videos, employing a semantic-related view (e.g., RGB view) along with a semantic-agnostic view (e.g., Noiseprint view) could effectively facilitate manipulation detection.

Adapting IMDPrompter for Video Manipulation Detection: To adapt IMDPrompter to video data, which we refer to as IMDPrompter v2, we propose the following modifications for improved adaptability: a. Use SAM2[1] as the backbone model, capable of performing general video segmentation.
b. Use a semantic-related view (e.g., RGB view) and at least one noise-based view (e.g., Noiseprint) to generate prompts for SAM2[1].
c. Apply RNN, CNN, LSTM, or other similar modules to perform temporal modeling of features between adjacent frames from selected views.
d. Combine multi-view prompt information to guide SAM2[1] in video manipulation detection, while introducing CPC for cross-view consistency enhancement, OPS for optimal prompt selection, SAF for cross-view perceptual learning, and PMM to mix various types of prompts.

[1] Ravi, Nikhila, et al. "Sam 2: Segment anything in images and videos." arXiv preprint arXiv:2408.00714 (2024).

Weakness 1. Complexity and Computational Cost: IMDPrompter's architecture consists of multiple modules (OPS, CPC, CFP, PMM), each contributing to additional computational overhead. The increased complexity may impact the model's efficiency, potentially limiting real-world deployment, particularly for large-scale or time-sensitive tasks. To address this, it might be beneficial to provide a computational complexity analysis or runtime comparison with existing methods.

Thank you for your constructive suggestion. We analyzed the model's complexity from the following two perspectives:

Minimal Impact of Added Complexity Compared to the Baseline Method: We developed a baseline method for image manipulation detection called SAM-IMD, which is based on SAM and uses only the RGB view to generate prompts online via an FCN network. We then progressively added multiple views and modules such as OPS, CPC, SAF, and PMM. Since all prompt views were implemented using an FCN network based on MobileNet, we observed a 0.165 increase in I-AUC and a 22.8% increase in P-F1, with only a 0.52-hour increase in training time and a 9.72% increase in parameter count.

Lightweight SAM Architecture for a More Compact IMDPrompter*: We implemented a lightweight version of IMDPrompter* based on MobileSAM. Under similar training time and parameter conditions as Trufor, IMDPrompter* achieved notable improvements, with an increase of 0.009 in I-AUC and 25.4% in P-F1.

In summary, the significant improvement in detection accuracy achieved with a slight increase in complexity presents a favorable trade-off.

• Robustness Analysis Against a Wider Range of Tampering Styles: As detailed in the table below, we utilized the same combined training set as UnionFormer [1] and evaluated performance on each test set. These test sets included various types of image manipulation, such as copy-move (copying and moving elements from one region to another within the same image), splicing (copying elements from one image and pasting them onto another), inpainting (removing unwanted elements), and image manipulations using diffusion models. Our method demonstrated state-of-the-art (SOTA) performance, validating its effectiveness against additional tampering techniques.

Pixel-level F1 Experimental Analysis

Image-level Detection Experimental Analysis

Robustness Analysis Against Lighting and WEBP Compression: We also evaluated IMDPrompter and MVSS-Net under various lighting and WEBP compression conditions, as shown in the table below. IMDPrompter consistently achieved the best performance, demonstrating robustness across different lighting and WEBP compression scenarios.

Weakness 4. Reliance on Specific Views: The model’s reliance on SRM, Bayer, and Noiseprint views may limit its utility for detecting manipulations that do not exhibit these specific signal properties. Further exploration into the model's adaptability to new data types without these views might be necessary. You might consider discussing or demonstrating how IMDPrompter can be adapted to work with different types of views or features. Additionally, you could add an experiment using a subset of the current views to assess the model's flexibility.

Thank you for your constructive suggestion. We have provided a detailed analysis from the following two perspectives:

Experiments with Subsets of the Current Views: We found that when using only a single view, the Noiseprint view performed the best. Furthermore, when we used both the RGB view and any semantic-agnostic view, we were able to achieve state-of-the-art (SOTA) performance for most metrics. Therefore, for novel data types (such as videos), we concluded that using one semantic-related view (e.g., RGB) along with one semantic-agnostic view (e.g., Noiseprint) would be effective for manipulation detection.

Adapting IMDPrompter for New Data Types: Specifically, when adapting IMDPrompter for video manipulation detection (resulting in IMDPrompter v2), we can make the following adjustments for better adaptability:

• a. Use SAM2[1] (capable of general video segmentation) as the backbone model.
• b. Generate prompts for SAM2[1] using an RGB view and at least one noise view (e.g., Noiseprint).
• c. Utilize RRN, CNN, LSTM, or other modules to capture and represent temporal features between adjacent frames across all views..
• d. Combine multi-view prompt information to detect video manipulation (further improve cross-view consistency using CPC, select the optimal prompt with OPS, enable cross-view perceptual learning with SAF, and mix different types of prompt information using PMM).

Question 1. Real-World Deployment: Has IMDPrompter been tested in real-world scenarios where variations in lighting, compression, and manipulation styles could further challenge the model's robustness?

Robustness Analysis Against Gaussian Blur and JPEG Compression: As shown in Figure 5 of the main text, we tested the performance of IMDPrompter, MVSS-Net, and other methods under different levels of JPEG compression and Gaussian blur. We found that IMDPrompter achieved the best performance in all settings, demonstrating good robustness against both Gaussian blur and JPEG compression.

[1] Ravi, Nikhila, et al. "Sam 2: Segment anything in images and videos." arXiv preprint arXiv:2408.00714 (2024).

Weakness 3. Limited Insight into View Contributions: The current framework provides limited insight into how each view or prompt contributes to the final decision-making process. Adding visualizations or more detailed explanations of how SAM’s interpretability might translate into manipulation detection could enhance the practical value of the work. For example, you could include ablation studies demonstrating the impact of each view or visualizations of the learned prompts for different types of manipulations.

Thank you for your constructive suggestion. Below is our detailed response:

1. Ablation Studies on View Combinations: As presented in Table 5 of the main text, we conducted ablation studies on different combinations of views. Initially, when each of the four views was used individually, we found that the Noiseprint view alone resulted in the highest detection accuracy. Furthermore, when we successively added the Noiseprint, SRM, and Bayar views on top of the RGB view, there were significant improvements in detection accuracy.

2. Proportion of Times Each View Was Selected as the Optimal View: According to Table 17 in the supplementary materials, we also analyzed the proportion of times each of the four views was selected as the optimal view. We observed that the Noiseprint view was chosen most frequently, highlighting its crucial role in the detection process. In contrast, the RGB view had the lowest selection rate, suggesting that for image manipulation detection tasks, higher detection accuracy relies heavily on the inclusion of semantic-agnostic views, such as SRM, Bayar, and Noiseprint.

3. F1 Scores of Individual Prompt View Masks and the Final SAM Output Mask: As shown in the table below, we compared the F1 scores of the masks generated from individual prompt views with the final mask output by SAM. The F1 score of the SAM output was significantly higher than those of the four prompt views, which demonstrates the substantial benefit of SAM's large-scale pre-training for image manipulation detection. Moreover, the F1 score for the Noiseprint view mask was higher than those of the other three views, indicating that the Noiseprint view provided the most optimal prompt.

   RGB	SRM	Bayar	Noiseprint	SAM Output
   65.7	66.1	65.4	67.9	76.8

4. Visualization of Masks for Each Prompt View:
   In the revised version of our paper, we will include visualizations of the masks generated from each of the four prompt views for different types of manipulations.

Thank you for your comments. I modified my original rating.

Weakness 5：While the paper acknowledges that relying solely on RGB information is insufficient for cross-dataset generalization, there is limited discussion on scenarios where the proposed semantic-agnostic views might also fail, such as advanced manipulation techniques that bypass noise-based detectors.
Thank you for your suggestion. Below are some scenarios where IMDPrompter might fail:

• Manipulated medical images: IMDPrompter training datasets, such as CASIAv2 and CoCoGlide, are natural scene images. For medical images, which differ significantly in distribution, performance may degrade. Fine-tuning on medical datasets may be necessary.
• Video manipulation: Advanced video generation models, such as SORA, pose challenges as manipulation extends to video content. While this presents difficulties, SAM2[1] (Segment anything in images and videos) has extended capabilities to videos. Developing IMDPrompter v2, which is better suited for video manipulation detection, is an urgent research area.

Weakness 6：The number of abbreviations is too many, which may interrupt the reader’s understanding.
Thank you for your suggestion. We will reduce unnecessary abbreviations in the revised version.

Weakness 7：It would be better to bold the best results in Tables 3, 4, 5, and 6.
Thank you for your suggestion. We will bold the best results in Tables 3, 4, 5, and 6 in the revised version.

[1] Ravi, Nikhila, et al. "Sam 2: Segment anything in images and videos." arXiv preprint arXiv:2408.00714 (2024).

Weakness 1：The proposed method introduces several additional modules, encoders, and views, which increase the complexity of the model.

• Thank you for your constructive suggestion. We analyzed the model's complexity from the following two perspectives:

• Minimal impact of additional complexity introduced by multi-view and modules like OPS compared to the baseline method: We constructed a SAM-based baseline method for image manipulation detection named SAM-IMD (prompt views are generated online using an RGB-only FCN). Subsequently, we progressively introduced multiple views and modules such as OPS, CPC, SAF, and PMM for the baseline. Since the prompt views are implemented using MobileNet-based FCN, the additional training time was only 0.52 hours, and parameter count increased by 9.72%. This resulted in a significant improvement of 0.165 and 22.8% in I-AUC and P-F1, respectively.

  Baseline	Training Time (h)	Params (M)	Noiseprint	Bayar	SRM	OPS	CPC	SAF	PMM	I-AUC	P-F1
  SAM-IMD	12.29	316.8								0.631	39.8
  	12.43	326.6	√							0.676	45.9
  	12.55	336.4	√	√						0.713	48.1
  	12.64	346.2	√	√	√					0.731	51.7
  	12.71	346.2	√	√	√	√				0.752	52.6
  	12.72	346.2	√	√	√	√	√			0.771	55.8
  	12.79	347.1	√	√	√	√	√	√		0.784	61.4
  	12.81	347.6	√	√	√	√	√	√	√	0.796	63.6

• Lightweight SAM architecture enables a more efficient IMDPrompter*: Using MobileSAM, we developed a lightweight IMDPrompter*. Under similar training time and parameter count conditions as Trufor, IMDPrompter* achieved a significant improvement of 0.009 and 25.4% in I-AUC and P-F1, respectively.

  Model	Training Time (h)	Params (M)	I-AUC	P-F1
  ManTra-Net	13.72	1009.7	0.500	15.5
  MVSS-Net	5.16	160.0	0.731	45.2
  Trufor	4.71	90.1	0.770	19.9
  IMDPrompter*	4.76	85.8	0.779	45.3

In conclusion, the substantial improvement in detection accuracy achieved with minimal additional complexity represents a favorable trade-off.

Weakness 6：Table 2 presents numerous NaN values for Sensitivity, Specificity, and F1 scores related to TruFor. Can the authors provide the corresponding metrics?

• Thank you for your constructive suggestions. We have supplemented the missing data in Table 2 of the main text, as shown below:

Weakness 7：Can you provide more recent methods for comparison, such as UnionFormer [3]?

• Thank you for your constructive suggestions.Referring to the response to Weakness 5, we have supplemented the comparison with UnionFormer, as detailed above.

Weakness 1：Can the authors clarify why SAM is employed in image manipulation detection? The authors utilize four different views to generate masks and subsequently bounding boxes, which serve as prompts for the Mask Decoder. To the best of my knowledge, the output masks of the Mask Decoder heavily depend on the accuracy of these prompts. It is essential that the generated masks maintain sufficient accuracy. Can the authors provide accuracy metrics for both the generated masks and the final output masks from the Mask Decoder? Additionally, is SAM necessary for this process?

• Thank you for your constructive suggestions. Our detailed explanation is as follows

• Ablation Study of SAM: Referring to Table 6 in the main text, we conducted an ablation study on SAM. We constructed FCN+ (which does not use SAM but generates masks from multiple views). Our findings indicate that by combining information from multiple views, FCN+ achieves a significant performance improvement compared to FCN. However, there is still a substantial performance gap when compared to IMDPrompter. The reason for this is that SAM is pre-trained on the large-scale segmentation dataset SA-1B, which enables it to acquire generalizable prior knowledge. This prior knowledge helps IMDPrompter achieve more accurate image manipulation detection performance.

• Quality Analysis of Prompt View Masks and Final Output Masks: Furthermore, we have included the F1 scores for the masks generated from the four prompt views as well as the final output masks. The details are provided in the following table.

Weakness 2：Are the Mask Decoder and Prompt Encoder kept frozen during the training process?

• The parameters of the Mask Decoder and Prompt Encoder are trainable. (In Figure 2 of the main text, the Image Encoder is marked as having frozen parameters, while other modules are not marked as frozen. To avoid confusion, we will explicitly indicate the trainable modules in the revised version.)

Weakness 3：In the PMM module, the feature $F_{SAF}$, encoded from images, is resized to match the shape of $F_{opt}$, the output from the Prompt Encoder based on coordinates. Could the authors elaborate on the motivation for this approach? The fusion of image embeddings and coordinate embeddings appears inconsistent.

• Motivation: Referring to the original SAM paper, SAM supports two types of prompts: Dense Prompt and Sparse Prompt. For Dense Prompt, the original SAM paper models features $F_{Dense}$ by applying convolution operations on masks. We observed that $F_{Dense}$ exhibits higher activation values for target regions and lower activation values for non-target regions. Similarly, $F_{SAF}$ possesses these characteristics and provides more specific information for image manipulation detection during decoding. Therefore, we proposed PMM to fuse $F_{SAF}$ and $F_{opt}$.

• Fusion of image and coordinate embeddings: As described in the Motivation section, $F_{SAF}$ has higher activation values for target regions, offering a coarse localization of these areas. It also contains rich, specific information related to image manipulation detection, making it suitable for fusion with $F_{opt}$ to generate more accurate prompts.

First, we must clarify that for the data added during the Rebuttal process to align with the experimental settings of UnionFormer [1], we have retrained our model strictly following UnionFormer's experimental configurations for the training and validation sets.

We also appreciate your courageous attitude in questioning our work. Below is a detailed explanation addressing your concerns:

For the metrics on datasets such as Columbia, Coverage, CASIA, and NIST, the reason why the data supplemented in the Rebuttal are higher than those in Table 1 and Table 2 of the original paper is as follows: Referring to UnionFormer, the training set includes five parts:

1. CASIA v2,
2. Fantastic Reality,
3. Tampered COCO, derived from COCO 2017 datasets,
4. Tampered RAISE, constructed based on the RAISE dataset, and
5. Pristine images selected from the COCO 2017 and RAISE datasets.

This is the training set we used in the supplementary experiments during the Rebuttal process. However, in Table 1 and Table 2 of the original paper, we only used CASIA v2 as our training set (to align with the training set settings of MVSS-Net [2]; our data in Table 1 and Table 2 are consistent with MVSS-Net). Since Columbia, Coverage, CASIA, and NIST are all based on non-generative image manipulation methods, methods like Trufor and CAT-Netv2 can benefit from training sets constructed with more non-generative image manipulation data. Therefore, the metrics on these datasets supplemented in our Rebuttal are higher.

Regarding the CoCoGlide dataset, the reason why the data for methods like Trufor supplemented in the Rebuttal are similar to those in Supplementary Material Table 18 is as follows: According to the UnionFormer paper, the performance of methods like Trufor on the CoCoGlide dataset did not improve even when using a larger training set (a larger dataset composed of five parts including CASIA v2, Fantastic Reality, and Tampered RAISE). This is because CoCoGlide is a dataset constructed based on generative image manipulation methods (there is a significant domain shift compared to training sets constructed with non-generative methods), so methods like CAT-Netv2 and Trufor cannot benefit from additional non-generative image manipulation training data. However, our IMDPrompter behaves differently. On one hand, using more non-generative image manipulation training data, our IMDPrompter shows a slight decrease in pixel-level metrics such as P-F1. At the same time, it shows a slight improvement in image-level metrics such as I-AUC. This indicates that IMDPrompter has different learning behaviors compared to methods like Trufor when utilizing more non-generative image manipulation training data.

[1] Li, S., Ma, W., Guo, J., Xu, S., Li, B., & Zhang, X. (2024). UnionFormer: Unified-Learning Transformer with Multi-View Representation for Image Manipulation Detection and Localization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 12523-12533).

[2] Chen, X., Dong, C., Ji, J., Cao, J., & Li, X. (2021). Image manipulation detection by multi-view multi-scale supervision. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 14185-14193).

The first two tables, which present Pixel-level F1 analysis and Image-level detection analysis, include metrics such as Columbia, Coverage, CASIA, and NIST, that are higher than those reported in the submitted manuscript. However, the CoCoGlide metric is consistent with the value shown in Table 18 of the supplementary material. I am uncertain whether the authors re-trained the model and achieved improved performance. The above tables can not convince me.