Beyond Visual Forensics: Auditing Multimodal Robustness for Synthetic Medical Image Detection

Abstract: With the rapid adoption of generative AI, synthetic medical images pose growing risks, including diagnostic deception and insurance fraud. Although prior work has explored vision-LLM (VLM)-based synthetic image detection, these evaluations typically consider images in isolation. In clinical practice, however, images are interpreted alongside structured records and metadata, and VLMs are increasingly deployed under joint image-record inputs. We uncover a previously underexamined multimodal vulnerability: when given both modalities, VLMs may overweight record context in authenticity judgments, such that the same image receives different predictions solely due to changes in its accompanying text. This raises concerns about robustness in real-world deployment. To systematically characterize this effect, we reformulate synthetic medical image detection as an audit of multimodal robustness at the image-record interface and introduce a paired benchmark that holds the image fixed while swapping controlled metadata variants. Across multiple imaging modalities, we evaluate diverse open-weight and frontier API VLMs and quantify how metadata alone shifts authenticity predictions. Our benchmark provides a standardized tool for assessing and improving multimodal robustness beyond image-only settings. The code is available at https://github.com/chiuhaohao/Beyond-Visual-Forensics.

• The paper introduces Text-Induced Decision Shift (TIDS) and a paired benchmark across NIH Chest X-ray14, ISIC2019, and PediCXR to measure how record context changes authenticity judgments for unchanged images.
• Adding an explicit AI-editing provenance label reduced real-image accuracy by 61.1% on average, with some models collapsing from near-perfect performance to near-zero, while synthetic-image gains often reflected provenance reliance rather than stronger visual forensics.
• Flip analysis shows that some models rewrite visual reasoning, whereas others preserve their visual verdict but let metadata override the final decision, highlighting the need for multimodal audits and conflict-aware safeguards before clinical deployment.

Motivation and problem formulation

Synthetic medical image detection has been studied almost exclusively under image-only inputs, yet clinical and administrative workflows—report generation, insurance claims adjudication, prior authorization—increasingly route images through vision–LLMs (VLMs) that consume joint image–record inputs. The paper argues that this mismatch between evaluation protocol and deployment condition leaves a critical vulnerability unmeasured: the accompanying record can steer the authenticity verdict for an unchanged image. The authors formalize this as Text-Induced Decision Shift (TIDS): changes in a VLM's Real/Fake judgment induced solely by altering the textual context while holding the image fixed. Their central research question is how sensitive VLM authenticity judgments are to record context, and to what extent that context can override visual evidence.

The threat model is concrete. A forged image that passes detection may enable improper insurance payouts; a legitimate image wrongly flagged triggers investigations and treatment delays. Because real workflows require joint image–record decisions even when an image-only detector serves as a first-stage filter, the authors contend that multimodal behavior at the image–record interface must be evaluated directly rather than inferred from image-only benchmarks.

Benchmark design

The benchmark spans three datasets with distinct visual semantics: NIH Chest X-ray14 (grayscale anatomy where edits blend plausibly), ISIC2019 dermoscopy (rich texture where artifacts are more visible), and PediCXR, a private pediatric chest X-ray set included to mitigate concerns about test-set contamination of public benchmarks. Synthetic counterparts are produced via an LLM-guided edit–verify–refine loop: Gemini-2.5-Pro generates structured editing instructions targeting a label $y' \neq y$ sampled from label-frequency-weighted pools, Gemini-2.5-Flash-Image performs the edit, and Gemini-2.5-Pro acts as LLM-as-judge, accepting only edits confirmed for target diagnosis presence, anatomical plausibility, and realism, with up to five refinement rounds. All accepted edits undergo final clinician review.

Each image is paired with three metadata variants derived from a Base Metadata (demographics plus diagnostic labels): Source-H (Source: Hospital) and Source-AI (Source: Edited by Nano Banana (AI Editing Technique)). Four input conditions are evaluated—I-Only, I+Base, I+Source-H, I+Source-AI—under a standardized forensic prompt requiring a five-item visual checklist (texture, noise, edges, anatomical plausibility, color), a contradiction check, and a dual output: FINAL ANSWER (holistic) and VISUAL VERDICT (image-only, produced within the same generation pass). The authors are explicit that the provenance field is intentionally strong and explicit; the benchmark is therefore an upper-bound stress test rather than a simulation of naturalistic documentation variation.

Main findings

The headline result is severe. On authentic images, appending Source: AI-edited reduces accuracy by 61.1% on average across all models and datasets. Individual collapses are stark: on NIH-CXR14 Real images, MedGemma-27B falls from 97.6% (I+Base) to 0.0%, and MedGemma-4B from 100.0% to 7.6%. Frontier API models are not exempt—Gemini models degrade to near-zero TNR under I+Source-AI—though FakeVLM shows comparatively more resistance. A notable capacity finding is that scale does not consistently predict robustness: Qwen3-VL-32B collapses across all three Real-image settings while Qwen3-VL-8B remains substantially more robust, whereas for InternVL-3.5 the 14B variant outperforms 8B on two datasets.

On synthetic images, the picture inverts. Many models exhibit low I-Only accuracy on AI-edited medical images, indicating that visual detection alone is genuinely difficult for these high-quality forgeries. Base Metadata frequently fails to help or actively hurts (InternVL-3.5 on ISIC2019 Fake drops from 32.4% to 10.0% for 8B and 9.6% to 0.6% for 14B moving from I-Only to I+Base). Source-AI metadata inflates TPR, but given weak baselines the authors attribute these gains to provenance-cue reliance rather than improved artifact detection—an important interpretive caveat against reading those numbers as capability. Source-H metadata often reduces performance relative to Base (e.g., Gemini-3-Flash on PediCXR Fake: 19.0% → 12.0%), suggesting hospital-source cues increase false negatives under visual uncertainty. DetectFake-specialized VLMs (FakeVLM, FakeShield) perform poorly across medical domains, consistent with general-domain training mismatch.

Flip signature analysis

To distinguish mechanisms, the paper analyzes flip cases—images whose FINAL ANSWER moves from correct to incorrect when swapping Base for Source-Augmented metadata—using two rates computed over flips. The Verdict Split Rate measures disagreement between FINAL ANSWER and VISUAL VERDICT under the augmented condition; the Reasoning Rewrite Rate measures polarity changes in checklist items across conditions.

Three patterns emerge. First, medical VLMs show lower Verdict Split Rates on Real-image flips—their integrated decision and image-based judgment move together—whereas general and frontier API models more often flip the integrated answer while keeping VISUAL VERDICT unchanged, implying the provenance field overrides a stable visual assessment at the integration stage. Second, larger models tend toward higher Verdict Split but lower Reasoning Rewrite rates: their image-based reasoning survives the contextual perturbation even as the final answer shifts, which is arguably a more tractable failure mode for post-hoc correction. Third, on Fake images Verdict Split Rates are generally low, with cross-model variation concentrated in Reasoning Rewrite (often highest among API models); fewer eligible flips exist here simply because baseline accuracy is low, leaving fewer initially correct predictions to flip.

Limitations

The authors acknowledge several constraints. The provenance intervention uses deliberately strong, explicit field values, so reported shift magnitudes bound rather than estimate effects under naturalistic record phrasing; sensitivity to subtler variations remains open. DetectFake baselines are general-domain only, since medical detectors are typically image-only and structurally incompatible with the multimodal setting, limiting direct comparison. PediCXR contributes only 200 samples versus 500 for public sets, and invalid outputs are counted as incorrect, which couples robustness to instruction-following reliability. The flip-signature analysis relies on VISUAL VERDICT as an image-based reference within the same generation, which assumes the model's self-reported visual judgment is a faithful probe of its internal visual assessment—an assumption not independently validated. Whether alignment or retraining can close the gap without sacrificing sensitivity to genuine image–record conflicts is left unresolved.

Conclusion

This work reframes synthetic medical image detection as an audit of multimodal robustness at the image–record interface and delivers a reproducible paired benchmark demonstrating that a single metadata field can dominate VLM authenticity judgments across model families, capacities, and imaging modalities—including frontier API systems. The finding that image-only evaluations underestimate deployment risk is well supported by the magnitude and consistency of the observed shifts. The benchmark's principal open questions concern generalization to naturalistic record variation and principled handling of image–record conflict, both of which it is designed to facilitate.