DINOv3 Beats Specialized Detectors: A Simple Foundation Model Baseline for Image Forensics

Abstract: With the rapid advancement of deep generative models, realistic fake images have become increasingly accessible, yet existing localization methods rely on complex designs and still struggle to generalize across manipulation types and imaging conditions. We present a simple but strong baseline based on DINOv3 with LoRA adaptation and a lightweight convolutional decoder. Under the CAT-Net protocol, our best model improves average pixel-level F1 by 17.0 points over the previous state of the art on four standard benchmarks using only 9.1\,M trainable parameters on top of a frozen ViT-L backbone, and even our smallest variant surpasses all prior specialized methods. LoRA consistently outperforms full fine-tuning across all backbone scales. Under the data-scarce MVSS-Net protocol, LoRA reaches an average F1 of 0.774 versus 0.530 for the strongest prior method, while full fine-tuning becomes highly unstable, suggesting that pre-trained representations encode forensic information that is better preserved than overwritten. The baseline also exhibits strong robustness to Gaussian noise, JPEG re-compression, and Gaussian blur. We hope this work can serve as a reliable baseline for the research community and a practical starting point for future image-forensic applications. Code is available at https://github.com/Irennnne/DINOv3-IML.

• The paper demonstrates that a LoRA-adapted DINOv3 baseline achieves up to a 17-point F1 improvement over previous state-of-the-art detectors.
• The methodology injects LoRA modules into a frozen DINOv3 backbone, significantly reducing trainable parameters while preserving robust feature representations.
• The study highlights practical forensic implications by showing scalability with backbone size and resilience to noise, blur, and compression artifacts.

A Foundation Model Baseline for Image Forensics with DINOv3 and LoRA

Introduction

The increasing realism of fake images generated by deep generative models presents critical challenges in image manipulation detection and localization (IMDL), especially under diverse manipulation types, post-processing, and limited data. Traditional IMDL methods often employ highly specialized architectures that can be brittle and lack robust generalization. This paper proposes a streamlined baseline leveraging the self-supervised DINOv3 Vision Transformer (ViT) backbone, combined with parameter-efficient Low-Rank Adaptation (LoRA) and a minimal convolutional decoder. The study offers a systematic evaluation of adaptation strategies, backbone scaling, and the impact of data regimes, situating DINOv3+LoRA as a highly competitive and reproducible foundation for future IMDL research and applications.

Methodology

The framework utilizes a frozen DINOv3 ViT backbone, with LoRA modules injected into the QKV projections of each transformer layer, and a lightweight CNN-based segmentation head to decode dense patch tokens into pixel-level manipulation masks.

Figure 1: Architecture overview—A frozen DINOv3 ViT with LoRA-injected QKV projections outputs patch tokens, rearranged as a feature map and decoded by a lightweight head into a manipulation mask.

This design avoids task-specific engineering, emphasizing simplicity and reproducibility. Two adaptation strategies are explored: full fine-tuning (updating all ViT parameters) and LoRA (low-rank parameter updates only), with the latter significantly reducing trainable parameter count while preserving pre-trained representations crucial for forensic generalization.

Backbone capacity is varied (ViT-S, ViT-B, ViT-L), and the decoder employs three convolutional layers with batch normalization, ReLU activation, and upsampling. Supervised training uses a composite loss—the sum of a global binary cross-entropy and a heavily upweighted edge-aware BCE, reinforcing accurate boundary localization.

Experimental Evaluation

Protocols and Benchmarks

Experiments are conducted under two standardized protocols:

• CAT-Net: multi-source training (CASIA2, FantasticReality, IMD2020, TampCOCO), evaluation on CASIAv1, Columbia, NIST16, and Coverage.
• MVSS-Net: training restricted to CASIAv2 only, evaluation on CASIAv1, Columbia, NIST16, Coverage, and out-of-domain IMD2020.

All hyperparameters are shared across protocols to attribute performance differences to data regime and adaptation method.

Main Results

Under the CAT-Net protocol, all DINOv3-based models with LoRA outperform previous SOTA methods (e.g., TruFor, Mesorch, CAT-Net). The best configuration (DINOv3 ViT-L + LoRA) yields a mean F1 score increase of 17.0 points over the former SOTA, while even the smallest configuration (ViT-S + LoRA) exceeds specialized detectors. Performance scales with backbone size, and LoRA adaptation consistently surpasses full fine-tuning across model capacities.

In the data-scarce MVSS-Net regime, LoRA’s advantage is pronounced. LoRA ViT-L achieves average F1 = 0.774, compared to 0.530 for TruFor, and all LoRA models outperform prior art by wide margins. Conversely, full fine-tuning becomes unstable and yields significantly lower F1, particularly for smaller backbones. These findings highlight the importance of adapting pre-trained features efficiently rather than overwriting them, especially when data is limited.

Robustness to Perturbations

The robustness of DINOv3+LoRA is validated against Gaussian noise, Gaussian blur, and JPEG compression on CASIAv1. LoRA ViT-L maintains the highest F1 across all noise and compression levels, with minimal drop under noise (−1.7% at maximum severity) and moderate drop under JPEG recompression (−11.1% at lowest quality). Gaussian blur causes the most severe degradation (−47.2% at kernel 23), reflecting the impact of patch-based aggregation on spatial continuity and the inherent limitations of ViT spatial resolution.

Analysis

The principal findings are as follows:

• Parameter Efficiency and Generalization: LoRA achieves SOTA pixel-level F1 using 11–34x fewer trainable parameters than full fine-tuning. The LoRA constraint prevents overfitting and catastrophic forgetting, crucial for cross-domain evaluation and low-data regimes.
• Scaling Laws: Performance increases monotonically with DINOv3 backbone size. Even at the highest capacity (ViT-L), LoRA with a modest rank suffices for adaptation, with diminishing returns from increasing LoRA rank.
• Adaptation Under Scarce Supervision: Full fine-tuning is only competitive under abundant, diverse training data; its performance collapses with limited data due to overfitting and loss of general-purpose representations. LoRA remains robust, establishing it as the preferable adaptation method for IMDL on foundation models.
• Dataset-Specific Observations: Datasets with simpler, uncompressed imagery (Columbia) show strong results from all methods. Complex, compressed datasets (NIST16) remain challenging, but DINOv3-powered models still surpass previous detectors.
• Perturbation Robustness: The proposed models show high resilience to noise and compression artifacts, suggesting that DINOv3 features encode information beyond shallow statistics. Sensitivity to blur underscores the bottleneck imposed by ViT’s patch granularity.

Implications and Future Directions

This study reframes the IMDL problem, demonstrating that modern vision foundation models, minimally adapted via LoRA, can outperform complex, specialized architectures across a range of benchmarks and data regimes. The results call for revisiting baseline standards in image forensics and suggest that future gains may be achieved more by expanding and diversifying datasets than by further complexifying task-specific model design.

Practical adoption is facilitated by the framework’s simplicity, modest parameter count, and robustness to real-world image perturbations, promising effective deployment in forensic toolchains. Theoretically, the findings motivate further study into the latent forensic capacity of self-supervised representations and efficient adaptation schemes, as well as the development of larger, richer manipulation datasets to further close the realism gap.

Conclusion

By leveraging a DINOv3 ViT backbone with LoRA and a lightweight decoder, this baseline sets a new performance standard for image manipulation localization. It demonstrates that foundation model features, if adapted efficiently, capture the subtle cues underlying IMDL, surpassing dedicated architectures in accuracy, generalization, and robustness. This work establishes a reproducible, practical, and strong default for future exploration in forensic vision, and points toward data-centric and foundation-model-driven research for well-calibrated and resilient detection systems (2604.16083).