1 Introduction↩︎

Manipulated images no longer rely on obvious visual artifacts to deceive. Off-the-shelf generative models can seamlessly alter faces, bodies, or scenes while preserving visual realism, making human inspection increasingly unreliable [1]–[3]. As a result, automated deepfake detectors have become essential across journalism, forensics, and content moderation where detection accuracy alone is no longer sufficient [4]–[6]. When a system flags an image as manipulated, users inevitably ask why. Although many detectors now offer natural-language explanations, these often resemble plausible narratives rather than visual evidence, limiting trust and obscuring failure modes. This growing gap between confident explanations and the visual cues that truly support them underscores a key challenge: developing deepfake detection systems that not only decide correctly, but also explain their decisions in grounded, interpretable, and user-meaningful ways.

Existing benchmarks only partially address this need. Most focus primarily on binary real versus fake classification and provide little or no support for explanation generation [4], [5], [7], [8]. Even when explanations are considered, current generation models are typically trained on small or synthetic datasets that lack visual diversity and grounding, leading to explanations that are fluent but weakly tied to actual image artifacts. A core reason explanation-oriented datasets remain limited in scale [6], [9]–[11] is that scaling reasoning annotation automatically introduces substantial label noise, as naively prompting generative models to explain manipulations yields inconsistent and often hallucinated rationales. Our pipeline directly addresses this by combining edit-aware quality filtering with structured generation, producing grounded explanations at scale without sacrificing annotation fidelity. In addition, prevailing evaluation metrics largely emphasize textual similarity or classification accuracy, overlooking whether explanations correctly identify the manipulated entities or supporting visual evidence. Current benchmarks also under-emphasize robustness under realistic post-processing, distribution shift, and adversarial perturbations [12], [13].

3.0pt

User needs further compound the problem. Research in human-centered XAI shows that different users require qualitatively different explanations [19]–[23]: a technical analyst wants a precise enumeration of visual artifacts. At the same time, a non-expert moderator needs a single legible reason to act on. LayLens [24] demonstrates this in the deepfake domain specifically, showing that simplified explanations reduce cognitive load and improve user confidence. Robustness is also largely absent from evaluation: real deployments involve recompressed, blurred, or adversarially perturbed images, yet most benchmarks test on pristine data [12], [13].

We introduce XPlainVerse, a 1M image benchmark for joint deepfake detection and reasoning. XPlainVerse addresses each of the gaps as discussed above. Our contributions are as follows.

Quality-controlled fake image filtering. We introduce Edit-Check, a novel data filtering pipeline to generate reasoning data at scale. Every generated image pair passes through a multi-stage filtering pipeline that verifies the visible changes match the intended edit and discards samples with prominent off-target modifications. Further, to evaluate real-world performance, we add perturbations spanning adversarial attacks and natural corruptions like recompression, denoising, etc.

Multi-level explanations for diverse users. XPlainVerse provides complex explanations targeting technical users, which describe multiple concrete visual artifacts, and simple explanations targeting non-expert users, which communicate a single accessible reason. For real images, authenticity explanations highlight natural details that support a genuine label.

Grounded evaluation metrics for explanation quality. We introduce novel evaluation metrics, EntityScore and EvidenceScore that test whether a predicted explanation identifies the correct manipulated entity and the visual evidence supporting it. For simple explanations, separate metrics explicitly measure clarity and conciseness, operationalizing the user-oriented goals.

2 Related Work↩︎

Detection datasets and explanation benchmarks. Deepfake and synthetic-image detection have been shaped by a sequence of progressively larger benchmarks. Early datasets, including FaceForensics++ [4], DFDC [5], and DFFD [25] focused on facial manipulations, while more recent resources such as MultiFakeVerse [26] and SemiTruths [27] extend to object- and scene-level edits. These datasets are designed for classification, localization, or robustness evaluation, not for natural-language explanation supervision. A separate line of explanation-oriented benchmarks, including DD-VQA [9], FFA-VQA [10], FakeBench [11], and SIDA [6], introduces QA-style and textual explanations for manipulated images. However, these datasets are small relative to modern detection benchmarks, and their explanations skew toward technical forensic analysis rather than non-expert communication.

Detection methods and explainability. Detection methods have evolved from handcrafted frequency and artifact cues [28]–[30] to learning-based approaches using convolutional, recurrent, and transformer architectures [31]–[35]. Some recent work introduces localization supervision to identify manipulated regions [25], [36], and vision-language approaches such as SIDA [6], BusterX++ [37], and FakeShield [36] augment classifiers with textual explanations. Yet surface-level fluency does not guarantee that an explanation correctly identifies the manipulated entity or cites evidence present in the image. Further, some recent attempts have tried to evaluate deepfake reasoning through images directly[38]. Human-centered XAI research [39], [40] further argues that explanations should be tailored to user expertise, a distinction that existing forensic benchmarks rarely make. Concurrently, advances in diffusion-based image editing [1]–[3] have made manipulations harder to detect via low-level artifacts alone, reinforcing the need for edit-aware supervision and grounded natural-language explanations. As such, these gaps motivate XPlainVerse.

3 XPlainVerse Dataset↩︎

We start our data generation pipeline by first collecting publicly available real-image datasets spanning diverse real-world scenes, objects, people, activities, and social interactions, including OpenImages [41], EMOTIC [42], PIPA [43], PIC 2.0 [44], and PISC [45]. This is followed by a comprehensive data filtering and explanation generation process, as detailed in Figure 2. We use an ensemble of multiple non-overlapping LLM / VLM families during each step of data generation to avoid potential biases, with higher sampling for stronger models. Our data generation process is as follows.¹

3.1 Data Generation Pipeline↩︎

Step 1: Caption-guided edit-instruction generation. We begin by leveraging the extensive visual understanding capabilities of foundational vision–language models (VLMs) (particularly GPT-4o-mini [46]) to obtain concise, information-dense captions to describe primary and secondary subjects, appearance details, spatial layout, lighting, and object interactions without speculation. Further, GPT‑4o‑mini [46] uses these captions to produce structured edit instructions comprising 2-4 concrete, semantically targeted manipulations. The edits span person‑centric, object‑centric, geometry‑centric, and scene‑centric transformations, including attribute and emotion changes, object insertion or removal, copy‑move duplication, local planar warping, and shape deformation.

Step 2: Candidate manipulated-image construction. We pair the instructions with the corresponding real images and generate manipulated images using a diverse set of off-the-shelf image‑editing models such as FLUX.2-dev [47], HunyuanImage [48], LongCat-Image-Edit [49], Qwen-Image-Edit-2511 [3], GPT-Image-1.5 [50], Seedream-4.5 [51], Wan 2.6 [52], Nano Banana 2 [53], and Nano Banana Pro [54]. To further broaden generator coverage, we also use manipulated candidates from MultiFakeVerse [26], which includes images generated using three additional editing models: Gemini 2.0 Flash [55], GPT-Image-1 [56], and ICEdit [57]. Together, these sources yield an initial pool of approximately 609K manipulated candidates spanning twelve generation models.

Step 3: Edit-Check Pipeline. To retain only high-quality image-instruction pairs, we apply a two-stage filtering pipeline. First, given a real image \(I_{\text{real}}\) and its generated counterpart \(I_{\text{fake}}\), we randomly sample one VLM from a pool of four models (Gemini-3-Flash [58], GPT-5-mini [59], GLM-4.6V [60], and Qwen3.5-27B [61]) to extract a structured JSON object enumerating all verifiable visual differences between the two images. Each identified change is annotated with a salience score ranging from 1 to 5, along with a precise description of the changed region or entity. In the second stage, a text-only judge sampled from either DeepSeek-V3.2 [62] or GPT-OSS-120B [63] determines whether the extracted differences align with the original edit instruction. Each judge outputs a KEEP or DISCARD decision based on two criteria: whether the core edit intent is present, and whether prominent unintended changes were introduced. Samples where off-target modifications dominate are hard-discarded regardless of partial edit-intent compliance.

The filtering pipeline reduces the initial pool of approximately 609K manipulated candidates to about 265K retained clean manipulated images, corresponding to a discard rate of approximately 56.5%. This high discard rate highlights the failure rate of generators: without filtering, many explanations would be generated for images whose intended edits are absent or dominated by unintended scene changes, resulting in weakly grounded explanation supervision. Qualitative examples of accepted and discarded candidates are shown in Figure 1, with additional filtering examples in Appendix 11.

Step 4: Introducing Perturbation. To assess robustness under real‑world conditions such as post‑processing, recompression, and adversarial manipulation, each image is paired with a perturbed counterpart. Perturbations are applied cumulatively across splits, i.e., validation includes all training perturbation families, and test includes all validation perturbation families while adding harder corruptions. Training perturbations include an xTransfer-based adversarial variant [12] and standard corruptions spanning noise, blur, compression, and photometric changes. Validation additionally introduces a targeted FOA-style attack [13] and additional perturbations, while the test set further adds harder geometric and frequency-domain corruptions, including affine transformations and ringing halo effect. Across all splits, most perturbed counterparts contain a single perturbation; 10% combine two perturbations, and another 10% use heavier mixtures (ranging from 6-17 perturbation). The full perturbation list and parameter ranges are provided in Appendix 12.

Step 5: Explanation Generation For each image, we generate natural‑language explanations that justify either its manipulation (for fake images) or its authenticity (for real images), with different levels of detail depending on the explanation type.

For manipulated images, we generate two types of explanations. A complex explanation describes the visual evidence of manipulation in enough detail for technical or forensic analysis. To produce it, one model randomly sampled from a pool of four (Gemini-3-Flash [58], GPT-5-mini [59], GLM-4.6V [60], and Qwen3.5-27B [61]) receives the fake image alongside three auxiliary references: the paired real image, the edit-instruction, and the visual-difference produced during filtering. These references help the model identify informative regions and manipulation-relevant cues. The resulting explanations describe cues such as geometric inconsistencies, implausible text or boundaries, inconsistent lighting or reflections, and localized detail failures. A simple explanation is then generated for each fake image by conditioning on the corresponding complex explanation and the same image-level context. Written in plain, layman’s terms and focused on a single salient reason why the image appears manipulated, these explanations are designed to be accessible to users of diverse backgrounds.

For real images, each sample is paired with an authenticity explanation that highlights visible properties supporting its genuineness, such as natural imperfections, physically plausible interactions, or realistic material and texture details. These explanations are generated using the same four models above, with the addition of Gemini-2.5-Pro [64].

3.2 Human Annotations↩︎

To obtain a gold-standard reference, we collect human-written explanations from 12 annotators on a subset of 2,000 manipulated images. Annotators are shown each fake image together with its paired real image for context and are instructed to describe all visible cues that indicate manipulation, focusing on evidence observable in the fake image itself and using the real image only as contextual support. To assess consistency, we additionally create a small overlap set of 10 examples annotated independently by 5 annotators, and report inter-annotator agreement using EntityScore and EvidenceScore, yielding scores of 0.5 and 0.44, respectively. This overlap study provides a consistency check on whether annotators identify similar manipulation cues despite natural variation in phrasing. All annotations follow strict university IRB guidelines (see Appendix 8). These human annotations help in validating whether our automatic explanation pipeline produces outputs with similar grounding, completeness, and usefulness (Table 4) to those written by humans.

3.3 Dataset Quality Analysis and Validation↩︎

r0.52

3pt

We analyze XPlainVerse along four complementary dimensions: image fidelity and edit preservation, semantic and explanation diversity, distribution coverage, and human-validated explanation quality. These analyses are intended to verify that the benchmark is not only large but also visually realistic, semantically diverse, and suitable for grounded explanation supervision.

1. Image Fidelity and Explanation Diversity. To assess curation quality in real-fake pairs, we examine whether retained generated images more faithfully reproduce their paired real images compared to discarded candidates. We compute PSNR, SSIM, LPIPS, and CLIP-I across 20K candidate pairs (10K retained and 10K discarded), balanced across ID and OOD samples (Table 2). Retained pairs consistently exhibit higher PSNR and SSIM, lower LPIPS, and stronger CLIP-I similarity in both settings, supporting that curation successfully filters for structural and semantic fidelity. Because these metrics operate over entire images rather than localized edits, we treat them as a preservation evaluation. For clean-perturbed pairs, we compute the same metrics on 10K pairs per split. The train split remains closest to the clean images, while validation and test splits reflect progressively stronger degradation, consistent with the intended perturbations.

r0.48

3.5pt

We also evaluate explanation diversity using 3K subsets from XPlainVerse, SIDA, and FakeClue. Self-BLEU measures repetition, Distinct-2 measures lexical diversity, and entity mention rate measures the proportion of explanations that reference at least one concrete region, object, or subject (Table 3). XPlainVerse complex achieves the lowest Self-BLEU and highest Distinct-2, indicating less repetitive wording than SIDA and FakeClue. XPlainVerse simple remains more lexically diverse than both external datasets, and over 99% of explanations in both XPlainVerse types mention at least one entity.

2. Human Evaluation.² We conduct a seven-stage human evaluation covering image realism, edit correctness, explanation quality (grounding, specificity, completeness, unsupported claims), pairwise style comparisons, and readability. Figures 4 and 5 summarize the main findings.

Image and edit quality. Filtered fake images were difficult to distinguish from real photographs, with annotators labeling them Real 44.9% of the time versus Manipulated 46.1%, closely mirroring the real-image distribution (Figure 4a). Discarded generations were identified as manipulated 69.7% of the time, with lower mean realism scores (3.29 vs. 3.63), confirming the filtering pipeline removes conspicuous artifacts and off-target changes. Filtered edits also outperform discarded edits on all four fidelity criteria, with a composite score of 3.66 vs. 2.71 (Figure 4b). The largest gap appears in the edit presence (\(\approx\)​4.0 vs. 2.6), confirming that the alignment judge filters genuine failures.

Preference and Explanation quality. Preferences split clearly by use case (Figure 5 (a,b)): Simple is favored for general users (46.5% vs. 38.3% for Complex), while Complex dominates for technical users (73.9% vs. 7.5%). No single explanation style serves both audiences well, and the gap between the two is large enough that choosing one over the other would leave a significant fraction of users with a suboptimal experience, underscoring the need for user-specific explanations. Further, complex explanations achieved a composite score of 3.79/5 and were preferred over the SIDA-style baseline by 64.8% of annotators and over human-written explanations by 61.8% (Table 4), with the largest margins on specificity (+42.4%) and completeness (+37.8%). XPlainVerse Simple scored 3.94/5, with ease-of-understanding at 4.11 and memorability at 4.13 (Appendix Table 16)

5.5pt

4 Evaluation Metrics↩︎

A central contribution of XPlainVerse is an intent-aware evaluation metric for complex explanations. Standard metrics like BERTScore [65] measure semantic similarity but fail to capture whether a prediction identifies the same manipulated regions or supports them with the same visual evidence. We address this with two tailored metrics: EntityScore and EvidenceScore.

Given a predicted explanation and a reference explanation, we first use Qwen3.5-4B [61] to extract from each explanation a set of diagnostic entities and a set of evidence claims. Diagnostic entities correspond to the manipulated regions, subjects, or semantically meaningful image parts mentioned in the predicted and reference explanations. Evidence claims correspond to the concrete visual cues used to justify why the image appears fake.

We then compute coverage in two directional passes using the same Qwen3.5-4B evaluator [61]. In the first pass, Qwen3.5-4B is given the extracted entities and evidence claims from the predicted explanation, together with the full reference explanation, and judges whether each predicted item is supported by the reference text. This yields the precision-side scores: Entity-Precision and Evidence-Precision. In the second pass, it is given the extracted entities and evidence claims from the reference explanation, together with the full predicted explanation, and judges whether each reference item is supported by the prediction. This yields the recall-side scores: Entity-Recall and Evidence-Recall. We compute EntityScore and EvidenceScore as harmonic means of their corresponding precision and recall terms. Full metric definitions are provided in Appendix 15. Alongside these intent-aware metrics, we report BERTScore-F1 as a complementary measure of overall semantic similarity.

For simple explanations, the goal is to preserve the main reason while remaining accessible to non-experts. We therefore report BERTScore-F1 for semantic fidelity and the SLE simplicity score [66] for readability, where higher SLE indicates simpler explanations.

3.2pt

5 Benchmarks and Experiments↩︎

Evaluation Protocol. We evaluate three tasks: detection, complex explanation generation, and simple explanation generation, across in-domain (ID) and out-of-domain (OOD) manipulated-image subsets. We report detection as binary F1 score. Complex explanations are evaluated using EntityScore, EvidenceScore, and BERTScore-F1, while simple explanations are evaluated using BERTScore-F1 and SLE. Further details are available in Appendix 16.

Baselines. Table 5 reveals a consistent pattern across all model families. Fine-tuned models perform strongly on ID data, with LLaVA-1.6-7B reaching 96.22% F1 and BERTScore of 0.703, but this does not transfer: the same models fall to 25-42% F1 under OOD conditions, a drop of over 50 points in several cases. Increasing model size does not reliably close this gap, pointing to a fundamental limitation of supervised fine-tuning: models learn generator-specific patterns rather than reasoning grounded in visual evidence. Zero-shot models tell a complementary story. Gemini-3-Flash stands out as the most robust baseline, achieving 71.77% OOD F1 without any task-specific training, outperforming all fine-tuned models on that split. Across all settings, BERTScore remains relatively stable under distribution shift (dropping by roughly 0.05–0.06) while EntityScore and EvidenceScore degrade more sharply, revealing that models retain surface fluency but lose the ability to ground explanations in concrete manipulation evidence. Robust explainable detection requires more than fine-tuning on in-distribution data.

Additional Analysis. We do in-depth analysis to identify the reason why VLMs do not generalize to the OOD dataset. First, we train linear probes and shallow MLPs on frozen embeddings from CLIP, DINOv2, and SigLIP to understand the train-to-test accuracy drop in Table 5. Training AUC is high across all three backbones, yet drops to near chance on the generator-shifted test set. Increasing probe depth leaves test AUC essentially unchanged (Figure 6a,b), indicating that the bottleneck is not capacity but what the model has learned to rely on. Secondly, as shown in Figure 6 (c,d), we do spectral analysis over each successive generation of editing models relative to real photographs, removing the low-level shortcuts that supervised probes depend on. This reveals a core limitation of fine-tuning-based approaches: rather than learning manipulation-relevant semantics, models latch onto generator-specific artifacts that do not transfer. When these artifacts disappear, performance degrades sharply. Detecting modern manipulations requires reasoning about content, such as implausible lighting, inconsistent geometry, or misplaced boundaries. This motivates methods grounded in explicit visual evidence rather than model-specific statistical regularities.

6 Conclusion↩︎

We introduced XPlainVerse, a million-scale benchmark for explainable deepfake detection, containing 470K real and 530K manipulated images from twelve generators with 1.53M natural-language explanations in two styles: technical explanations for expert analysis and simple explanations for non-technical users. Our edit-aware filtering pipeline removes low-quality generations, and human evaluation confirms that the retained images and explanations are more reliable. In our experiments, zero-shot models perform poorly, while fine-tuned models generalize weakly to held-out generators. EntityScore and EvidenceScore further make grounded explanation quality measurable, revealing failures that surface-level semantic metrics can miss when models produce fluent but visually ungrounded explanations. Spectral analysis reveals that recent generators have largely eliminated the low-level artifacts earlier detectors relied on, making grounded manipulation evidence such as inconsistent geometry, misplaced objects, implausible details, a more stable signal. XPlainVerse aims to support future models that can detect and explain deepfakes in a grounded, user-appropriate way.

Ethics Statement. All human annotation and evaluation were conducted under institutional IRB approval, with voluntary participation and fair compensation. Real images come from publicly licensed sources, and generated images passed NSFW and semantic filtering before inclusion. The dataset is distributed under a strict research-only license requiring agreement to the XPlainVerse EULA that limits usage to non-commercial, academic research. Full details are in Appendix 8.

Limitations and Future Directions. XPlainVerse has several limitations. It focuses exclusively on still images, leaving temporal artifacts and audio-visual inconsistencies unaddressed. The annotator pool is relatively small and geographically concentrated, which may introduce cultural biases into reference explanations. Reliance on a fixed set of VLMs and commercial APIs also raises reproducibility concerns, and NSFW filtering cannot guarantee the complete removal of distressing content. Future work should extend the benchmark to video and audio-visual deepfakes, diversify annotator populations, and develop dedicated protocols for evaluating edit-instruction compliance. Models that explicitly localize visual evidence, rather than exploiting generator-specific artifacts, are also encouraged. As generative technology evolves, periodic benchmark updates will be essential to keep XPlainVerse meaningful.

7 Appendix Roadmap↩︎

This appendix collects the details needed to understand and reproduce XPlainVerse without interrupting the main paper. We keep the construction details first, then the evaluation protocol, and place the full prompts at the end for readability.

6pt

8 Ethics Statement↩︎

This section documents the ethical practices followed during the construction of XPlainVerse, covering data sourcing, human participation, compensation, IRB oversight, dual-use risk, and release policy. Both the human annotation study and the user evaluation described below were conducted under the same institutional review board approval shared across the affiliated institutions, consistent with the widely used synthetic media datasets, like FaceForensics[4] and DeepfakeJudge[38].

Real-image data. The real subset draws from five publicly available datasets: OpenImages V7, EMOTIC, PIPA, PIC 2.0, and PISC. Each source is used in accordance with its published research license, and all five are cited in the main paper. No images were scraped from sources without a public data release. We did not collect any new photographs of individuals.

Synthetic and edited image data. Manipulated images were generated using commercial image-editing APIs, including Gemini, GPT-Image-1 and GPT-Image-1.5, SeedDream, Flux-Dev, HunyuanImage, LongCat, Wan, Nano Banana, and Qwen-Edit, solely for academic research. Additional manipulated candidates came from MultiFakeVerse, which was also produced for research under a compatible license. All candidate images passed through three filtering stages before inclusion: a semantic filter on the generation prompt to remove fantasy and non-photorealistic content, an automated NSFW classifier, and manual spot-checks by the authors. The filtering pipeline described in Section 3 and Appendix 11 removes candidates where the intended edit is absent or the image is dominated by unintended changes; this step also incidentally removes many artifacts that could make images distressing or inappropriate for annotation. No generated image depicting identifiable private individuals was retained.

Human annotation for gold-reference explanations. Twelve annotators wrote explanations for 2,000 manipulated images. All annotators were adults recruited through academic networks and affiliated with university research groups. Before independent work began, each annotator reviewed written task instructions and worked through example images with the research team to calibrate judgment and establish consistent standards. Annotators were assigned non-overlapping subsets and compensated at rates commensurate with local academic norms. No personally identifying information was collected. Participation was voluntary, and annotators could withdraw at any point without consequence. All materials were screened to exclude NSFW or distressing content before annotation began. Inter-annotator agreement was measured on a shared overlap set of ten images annotated independently by five annotators, and is reported in Appendix 15.

Human evaluation study. Ten adult participants took part in the seven-stage human evaluation described in Appendix 14. Participants were recruited from research groups at the authors’ institutions. Before participating, each person received a written statement explaining the study’s purpose and procedures, with worked examples of each annotation task, and gave informed consent through a study form. Presentation order was randomized, and examples were balanced across sources and generators. No personally identifying data were recorded, and all responses were anonymized before analysis. Participants were compensated for their time. All study materials were reviewed and cleared for NSFW and distressing content before use.

IRB approval. All human participation described above, including both annotation phases and the user evaluation, was conducted under institutional review board approval shared across the affiliated institutions. Participation was voluntary throughout. No special populations were recruited, and no participant was placed at foreseeable risk of harm. All annotators and study participants were paid before the study design was finalized, and rates did not depend on the labels or judgments they produced.

Data and model release. XPlainVerse benchmark assets, including metadata, split files, prompts, generated explanations, human annotations, perturbation metadata, and evaluation protocols, are released under XPlainVerse End User License Agreement (EULA). The EULA permits use only for academic, non-commercial and not-for-profit research. Redistribution, public hosting, mirroring, sublicensing, commercial use, and release of arbitrary dataset images or derived dataset variants are prohibited without prior written approval. Third-party source datasets, images, generated images governed by provider terms, model checkpoints, and software remain subject to their original licenses or provider terms. Where redistribution or relicensing of a third-party asset is not permitted, we release compatible metadata, identifiers, annotations, or XPlainVerse-specific derived components rather than relicensing the original asset.

Dual-use risk and mitigations. XPlainVerse has potential dual-use risks, since examples of difficult manipulations and detector failures could inform attempts to create harder-to-detect synthetic media. We mitigate this through controlled access: the dataset is distributed under a strict research-only EULA for non-commercial academic use, with redistribution, public hosting, commercial use, and harmful or deceptive applications prohibited. The real images come from existing public or research datasets, and the manipulated images are produced using off-the-shelf editing systems; we do not release generation model weights, service credentials, or tools intended to create stronger forgeries. We release XPlainVerse as a defensive benchmark for training, evaluating, and explaining deepfake detectors, and believe its primary benefit is to support trustworthy detection research.

Limitations. XPlainVerse covers still images only; video manipulation is outside its scope. The annotation pool of twelve people and ten evaluators is geographically and institutionally concentrated, which may introduce cultural or stylistic biases in the human-reference explanations. The explanation generation pipeline relies on a small set of commercial VLMs; any systematic tendencies in those models, such as preferences for certain types of cues or certain phrasings, may carry over into the silver-standard explanations. The NSFW filters and manual checks reduce but do not eliminate the possibility that distressing content could appear in the data.

9 Dataset Assembly and Split Details↩︎

9.0.0.1 Real-Image Distribution

The real-image subset of XPlainVerse contains 470,000 images from five source corpora. Table 7 reports the final real data split.

4pt

9.0.0.2 Fake-Image Distribution

The fake-image subset contains 530,000 retained images generated across twelve contemporary image-generation and image-editing models. Table 8 gives the final retained counts by split. Candidate and discard counts are recomputed from the visual-difference and judge records described in Appendix 11; the released benchmark includes only retained fake samples unless otherwise noted for analysis.

4pt

9.0.0.3 Final Split Composition and ID/OOD Assignment

Table 9 shows the final data-split across the train, validation, and test sets. Training and validation are used for model development. The test split emphasizes held-out or newer generator families and is used as the primary OOD evaluation.

3pt

10 Edit Instruction Qualitative Examples↩︎

Table 10 gives representative edit-instruction examples used for data generation in XPlainVerse.

5pt

11 Quality Filtering↩︎

This section documents how the multi-stage filtering pipeline behaves across generators, edit types, and failure modes. It also includes qualitative examples of retained and discarded candidates.

11.0.0.1 Filtering Decision Rules

Filtering is applied to each generated candidate using two structured records: a visual-difference record and an alignment-judge record. The visual-difference extractor compares the paired original and edited images and lists only visible, localized before/after differences. The alignment judge then compares the requested edit instruction against the difference record and returns a final score, a match score, an unrelated-change penalty, and a discrete verdict.

A candidate is retained when the generated image visibly realizes the requested edit and the difference JSON provides localized evidence that can support an explanation. Candidates are rejected when the target edit is missing, dominated by off-target scene rewrites, affected by severe low-level artifacts, or too ambiguous for reliable explanation supervision.

4pt

11.0.0.2 Failure Categories for Discarded Candidates

Table 11 lists the main reasons a generated candidate can be rejected during filtering.

11.0.0.3 Filtering records.

Each generated candidate is audited with the same two records: a visual-difference JSON comparing the paired original and edited images, and an edit-alignment judge JSON comparing the requested edit against the extracted differences. The judge returns KEEP, BORDERLINE, or DISCARD, along with match and off-target-change scores. Final split counts are computed after this unified filtering pass and split assignment.

11.0.0.4 Visual-Difference Examples

Figure 7 shows two visual-difference records tied to visible evidence.

11.0.0.5 Judge Examples

Figure 8 shows KEEP and DISCARD decisions.

12 Perturbation Suite↩︎

This section summarizes the perturbations applied to XPlainVerse. Corruptions are sampled with deterministic per-split schedules, and adversarial stress tests include FOA-style and xTransfer attacks. The validation set builds upon the training perturbation set, and the test set further expands the validation and training set with additional adversarial attacks and corruption methods. Table 12 groups the perturbations by the kind of image change they introduce, while Table 13 groups perturbations by train, validation, and test split. Table [tab:app95perturbation95params] gives representative parameter ranges of each perturbation family for reproducibility. Figure 9 shows three pairs of clean images with their perturbed versions under different perturbation settings.

4pt

5pt

12.0.0.1 Mixture Protocol

For each image, the perturbation sampler uses one of three schedules: single, pair, or chunk. A single schedule samples one operation from the split-specific allowed set. A pair schedule samples two random operations from the allowed set. A chunk schedule samples a larger set without replacement from all operations allowed for the split. The default schedule probabilities are 85/10/5 for train, 75/15/10 for validation, and 70/20/10 for test, with chunk sizes increasing from 6-8 to 8-12 to 13-17 operations, as specified in Table 13. This design makes the perturbation distribution cumulative while increasing severity at validation and test time.

13 Explanation Data Details and Qualitative Examples↩︎

This section illustrates the explanation supervision provided in XPlainVerse. It includes complex explanations and simple explanations for fake images, and authenticity explanations for real images.

13.0.0.1 Explanation Types and Acceptance Criteria

Table 14 summarizes the explanation targets used in the dataset.

4pt

Qualitative Examples for Reasoning Figure 10 provides fake-image explanation examples while Figure 11 shows real-image explanation examples in XPlainVerse.

14 Human Annotation and Evaluation↩︎

The main paper reports aggregate human-evaluation findings. This appendix section discusses the human annotation and user study in detail.

14.0.0.1 Human Reference Annotation Protocol

For the gold-reference subset, annotators write image-grounded explanations for manipulated images. Each task is presented as a paired-image comparison: the original image and the edited image are shown together. Annotators are asked to describe visible evidence in the edited image and avoid claims that are not visible. The final release includes only aggregate annotator metadata and non-identifying examples. The gold-reference annotation pool contains 12 annotators.

14.0.0.2 Seven-Stage Human Evaluation Protocol

Table 15 records the tasks used in the human evaluation.

4pt

3.5pt

14.0.0.3 Participant-Facing Instructions and Interface

We reproduce below the participant-facing instructions used in the gold-reference annotation task and the human-evaluation study. The study was administered through a form-based interface. All participants gave informed consent before beginning the task. Compensation rates were determined before the study began, were at or above the applicable local minimum-wage equivalent, and did not depend on the labels, ratings, or judgments participants produced.

14.0.0.4 Gold-reference annotation instructions.

Annotators were shown the original image and the edited image side by side. The instruction text was:

You will be shown an original image and an edited image. Your task is to write an explanation describing why the edited image appears manipulated. Focus only on visible evidence in the edited image. You may use the original image for context, but your explanation should refer to cues that can be observed in the edited image itself. Mention concrete regions, objects, people, boundaries, textures, lighting, geometry, or other visible artifacts. Do not speculate about hidden causes, model names, or metadata. If multiple cues are visible, describe all important ones clearly.

14.0.0.5 Human-evaluation instructions.

Participants in the human-evaluation study received the following general instruction:

You will evaluate images and explanations produced for a deepfake-detection benchmark. Some images are real and some are manipulated. Please answer based only on what is visible in the image and the explanation shown to you. There are no trick questions. Use your best judgment, and select “not sure” or a middle score when the evidence is unclear. Do not include any personally identifying information in your responses.

14.0.0.6 Stage-specific instructions.

For image realism, participants judged whether each image appeared real, manipulated, or uncertain, and rated visual realism on a 1–5 scale. For edit quality, participants compared the original and edited images and rated whether the intended edit was present, visually realistic, and free of unrelated off-target changes. For explanation quality, participants rated grounding, specificity, completeness, convincingness, and unsupported claims. For pairwise comparisons, participants chose which explanation was better or selected tie. For readability, participants rated ease of understanding, memorability, cognitive load, and liking. For audience usefulness, participants judged which explanation was more useful for ordinary users and for technical analysts.

15 Metric Implementation Details↩︎

This section describes the implementation details for the automatic metrics used to evaluate XPlainVerse explanations. For complex explanations, we evaluate whether a generated explanation identifies the same manipulated regions and supports them with the same visual evidence as the reference. We therefore compute two intent-aware metrics: EntityScore, which measures coverage of diagnostic image entities, and EvidenceScore, which measures coverage of concrete visual evidence claims. Both metrics use an offline Qwen3.5-4B evaluator for structured extraction and semantic coverage judging. We additionally report BERTScore-F1 as a complementary measure of full-sentence semantic similarity. For simple explanations, we report BERTScore-F1 for semantic fidelity and a normalized SLE score for simplicity.

15.0.0.1 Entity and evidence extraction.

Given a predicted explanation \(y^{p}\) and a reference explanation \(y^{r}\), we first convert each free-form explanation into a structured set of diagnostic entities and evidence claims. This extraction is performed independently for the prediction and reference using the same offline Qwen3.5-4B evaluator.

A diagnostic entity is an image region, subject, object, text element, body part, clothing item, background component, or other semantically meaningful visual element that is explicitly used as evidence in the explanation. Entities are not extracted merely because they are mentioned; they must be connected to the explanation’s real/fake judgment. For example, “the sign text,” “the cyclist’s hands,” “the metal support bars,” or “the reflection in the window” may be diagnostic entities if the explanation uses them as evidence. In contrast, generic mentions such as “the image,” “the scene,” or contextual objects that are not tied to a visual cue are excluded.

An evidence claim is a compact, checkable visual observation about a diagnostic entity. Evidence claims describe what is visually suspicious or authenticity-supporting about the entity, such as distorted lettering, inconsistent boundaries, unnatural texture, impossible geometry, mismatched lighting, or physically plausible interaction. Claims are linked to their corresponding entities whenever possible. The extractor is instructed to prefer coarse, meaningful entities over overly fine-grained fragments, to avoid unstated visual inferences, and to exclude generic conclusions such as “this image is fake” unless they are grounded in a specific visual observation.

The expected extraction output is valid JSON:

---

Entity and evidence extraction output schema

{
  "diagnostic_entities": [
    {"entity_id": "E1", "name": "..."}
  ],
  "evidence_claims": [
    {"claim_id": "C1", "entity_id": "E1", "claim": "..."}
  ]
}

---

We denote the extracted entity sets from the prediction and reference as \(\mathcal{E}^{p}\) and \(\mathcal{E}^{r}\), respectively. Similarly, we denote the extracted evidence-claim sets as \(\mathcal{V}^{p}\) and \(\mathcal{V}^{r}\). We use \(\mathcal{V}\) rather than \(\mathcal{F}\) to emphasize that these are visual evidence claims rather than general factual statements.

15.0.0.2 Bidirectional semantic coverage.

After extraction, we compute semantic coverage in two directions. The first direction measures precision: whether the diagnostic entities and evidence claims mentioned by the prediction are supported by the reference explanation. The second direction measures recall: whether the diagnostic entities and evidence claims in the reference explanation are recovered by the prediction.

For precision-side coverage, we run one Qwen3.5-4B evaluator pass using the extracted JSON of the predicted explanation and the full reference explanation. The extracted prediction JSON contains the predicted diagnostic entities \(\mathcal{E}^{p}\) and predicted evidence claims \(\mathcal{V}^{p}\), with evidence claims linked to their corresponding entities. Given this full predicted structure and the reference explanation \(y^{r}\), the evaluator judges which predicted entities and evidence claims are semantically supported by the reference. This yields entity and evidence precision, measuring whether the prediction introduces reference-supported diagnostic content rather than hallucinated regions or unsupported visual cues.

For recall-side coverage, we run a second Qwen3.5-4B evaluator pass in the reverse direction, using the extracted JSON of the reference explanation and the full predicted explanation. The extracted reference JSON contains the reference diagnostic entities \(\mathcal{E}^{r}\) and reference evidence claims \(\mathcal{V}^{r}\), again with evidence claims linked to their corresponding entities. Given this full reference structure and the predicted explanation \(y^{p}\), the evaluator judges which reference entities and evidence claims are semantically recovered by the prediction. This yields entity and evidence recall, measuring whether the prediction captures the diagnostic regions and visual evidence present in the reference.

Formally, let \[\mathcal{G}^{p} = (\mathcal{E}^{p}, \mathcal{V}^{p}) \qquad \text{and} \qquad \mathcal{G}^{r} = (\mathcal{E}^{r}, \mathcal{V}^{r})\] denote the extracted JSON structures for the predicted and reference explanations, respectively. Here, \(\mathcal{E}\) denotes the set of diagnostic entities and \(\mathcal{V}\) denotes the set of entity-linked evidence claims. Let \(\mathrm{cover}(z \mid \mathcal{G}, y)\) be an indicator function that returns \(1\) if source item \(z\), interpreted within the full extracted structure \(\mathcal{G}\), is judged to be semantically supported by target explanation \(y\), and \(0\) otherwise.

Entity precision and recall are computed as \[\begin{align} \mathrm{EntityPrecision} &= \frac{1}{|\mathcal{E}^{p}|} \sum_{e \in \mathcal{E}^{p}} \mathrm{cover}(e \mid \mathcal{G}^{p}, y^{r}), \tag{1} \\ \mathrm{EntityRecall} &= \frac{1}{|\mathcal{E}^{r}|} \sum_{e \in \mathcal{E}^{r}} \mathrm{cover}(e \mid \mathcal{G}^{r}, y^{p}). \tag{2} \end{align}\]

Evidence precision and recall are computed analogously: \[\begin{align} \mathrm{EvidencePrecision} &= \frac{1}{|\mathcal{V}^{p}|} \sum_{v \in \mathcal{V}^{p}} \mathrm{cover}(v \mid \mathcal{G}^{p}, y^{r}), \tag{3} \\ \mathrm{EvidenceRecall} &= \frac{1}{|\mathcal{V}^{r}|} \sum_{v \in \mathcal{V}^{r}} \mathrm{cover}(v \mid \mathcal{G}^{r}, y^{p}). \tag{4} \end{align}\]

The matching is wording-invariant but evidence-sensitive. For entities, exact lexical overlap is not required: for example, “the CITY PARK letters” and “the large white sign text” may be counted as the same entity if they refer to the same visible region. However, overly broad entities are not accepted when they fail to localize the diagnostic region. For evidence claims, coverage is stricter: the target explanation must express the same visual observation, not merely mention the same object. Thus, a prediction may receive entity credit for identifying the correct region while still receiving low evidence credit if it gives the wrong or incomplete visual reason.

We compute EntityScore and EvidenceScore as harmonic means of their corresponding precision and recall terms: \[\begin{align} \mathrm{EntityScore} &= \frac{ 2 \cdot \mathrm{EntityPrecision} \cdot \mathrm{EntityRecall} }{ \mathrm{EntityPrecision} + \mathrm{EntityRecall} }, \tag{5} \\ \mathrm{EvidenceScore} &= \frac{ 2 \cdot \mathrm{EvidencePrecision} \cdot \mathrm{EvidenceRecall} }{ \mathrm{EvidencePrecision} + \mathrm{EvidenceRecall} }. \tag{6} \end{align}\]

If both precision and recall are zero, the corresponding harmonic-mean score is set to zero.

EntityScore captures whether the explanation identifies the correct manipulated or authenticity-relevant regions, while EvidenceScore captures whether it gives the correct visual reasons.

15.0.0.3 Metric extraction example.

Table 17 gives a compact example of entity and evidence extraction followed by semantic coverage judging.

4pt

15.0.0.4 Coverage-judging edge cases.

Table 18 summarizes how we handle common edge cases during automatic coverage judging.

4pt

15.0.0.5 BERTScore and simple-explanation scoring.

For both complex and simple explanations, we compute BERTScore-F1 between the full generated explanation and the corresponding reference explanation. BERTScore captures overall semantic similarity, but it does not explicitly test whether the explanation identifies the same manipulated entity or cites the same visual evidence. We therefore treat BERTScore as complementary to EntityScore and EvidenceScore rather than as a replacement.

For simple explanations, we additionally compute the SLE simplicity score [66]. Since raw SLE values can fall outside a convenient reporting range, we clip the raw score to \([-1,4]\) and normalize it to \([0,1]\): \[\begin{align} \mathrm{SLE}_{\mathrm{clip}} &= \min\left(4,\max\left(-1,\mathrm{SLE}_{\mathrm{raw}}\right)\right), \tag{7} \\ \mathrm{SLE}_{\mathrm{norm}} &= \frac{\mathrm{SLE}_{\mathrm{clip}}+1}{5}. \tag{8} \end{align}\] Higher normalized SLE indicates simpler and more accessible language. We report normalized SLE for simple explanations so that the score is directly comparable across models and remains bounded between 0 and 1.

15.0.0.6 Automatic metric configuration.

Table 19 summarizes the automatic evaluators used for scoring.

4pt

16 Baseline and Training Details↩︎

16.0.0.1 Evaluation protocol.

All baselines follow the same detection-and-explanation protocol. For each input image, the model receives a single image and is prompted to output a binary prediction, either real or fake, together with a natural-language explanation. We evaluate two explanation tracks separately. The complex track asks for detailed forensic reasoning, while the simple track asks for short, jargon-free explanations. Both tracks are evaluated on the same image lists, but use separate prompts tailored to the requested explanation style.

We evaluate on both in-distribution (ID) and out-of-distribution (OOD) test sets. ID fake images are sampled from generator families represented during training, while OOD fake images are sampled from held-out generators introduced only at evaluation time. Each evaluation set contains 18,500 images, consisting of 10,000 fake images and 8,500 real images. The same ID and OOD splits are used for both explanation tracks, ensuring that detection and explanation metrics are computed on aligned examples.

16.0.0.2 Prompt templates.

Both zero-shot and fine-tuned baselines use the same task instruction and output schema, with separate prompts for the complex and simple explanation tracks. For the complex track, we use:

Detect whether the image is real or fake and provide reasoning for it.
Respond in the following format:
<reasoning>your reasoning here</reasoning>
<answer>real or fake</answer>

For the simple track, we use:

Detect whether the image is real or fake and provide reasoning for it in simple, easy-to-understand, jargon-free language.
Respond in the following format:
<reasoning>your reasoning here</reasoning>
<answer>real or fake</answer>

16.0.0.3 Zero-shot protocol.

Zero-shot baselines are evaluated directly using the prompt templates above. The text inside <reasoning> is used for explanation evaluation, while the label inside <answer> is used for detection evaluation.

16.0.0.4 Fine-tuning setup.

For fine-tuned baselines, we use a balanced 50% subset of the training split, sampled evenly across real and fake images. We construct separate JSONL training files for the complex and simple explanation tracks using the same prompt templates and output schema as in zero-shot evaluation. The two files use the same sample identifiers and image paths, but differ in the target explanation style. Each track is fine-tuned independently so that the model is optimized for the corresponding explanation format.

4pt

16.0.0.5 Scoring.

For each run, we parse the predicted label from the <answer> field and the explanation from the <reasoning> field. Detection is evaluated using the predicted real/fake label, while explanation metrics are computed separately for the complex and simple tracks using the corresponding generated explanation.

16.0.0.6 Compute accounting.

GPU-hours are computed as the number of GPUs multiplied by the wall-clock runtime. The values in Table 20 report approximate compute for the final runs used in the paper and exclude small debugging runs. Dataset construction also required caption generation, edit-instruction generation, candidate image generation, filtering, explanation generation, and perturbation generation. For closed-source API models used during dataset construction and evaluation, provider-side compute is not observable; we therefore report processed-example counts/API requests in the project code and dataset documentation rather than provider-side GPU-hours.

17 Prompt Templates and Model Inputs↩︎

This final section records the prompts used for captioning, edit-instruction generation, instruction-difficulty rating, visual-difference extraction, alignment judging, explanation generation, and metric judging. We place the prompt text at the end so that the main appendix reads continuously.

5pt

17.1 Caption Generation Prompt↩︎

17.2 Edit-Instruction Generation Prompt↩︎

17.3 Instruction Difficulty Rating Prompt↩︎

17.4 Visual-Difference Extraction Prompt↩︎

17.5 Edit-Instruction Alignment Judge Prompt↩︎

17.6 Complex Fake-Explanation Prompt↩︎

17.7 Simple Fake-Explanation Prompt↩︎

17.8 Real-Image Authenticity Prompt↩︎

17.9 Metric Extraction and Coverage Prompts↩︎

References↩︎

---

1. Full prompts for all data filtering and generation steps are provided in Appendix 17.↩︎

2. Details about the user study and ethics are available in Appendices 14 and 8↩︎