Forgery-Aware Training Strategy

Updated 6 July 2026

Forgery-aware training strategy is a learning approach that organizes training signals around explicit forgery-specific structures like manipulation masks and progressive transitions.
It employs representation shaping by partitioning model parameters into personalized and shared branches, aligning with forgery cue distributions instead of generic binary labels.
This approach enhances detection performance across hybrid domains by using targeted augmentation, adversarial examples, and localized supervision for robust forensic analysis.

Forgery-aware training strategy denotes a family of learning and optimization procedures in which the training signal is organized around forgery-specific structure rather than generic binary classification alone. Across recent work, that structure includes hybrid-domain heterogeneity, shared versus personalized forgery cues, authenticity-centric one-class learning, manipulation masks, prompt-conditioned semantic priors, frequency and noise artifacts, progressive real-to-fake transitions, dynamic augmentation policies, and per-sample or per-domain adaptation. In practice, such strategies have been instantiated in federated face forgery detection, universal face authenticity detection, multi-face manipulation localization, weakly supervised audio forgery localization, proactive tamper localization with Segment Anything Model, agentic multimodal forensics, generalized synthetic-image detection, and deepfake cross-domain adaptation (Liu et al., 2024, Jiang et al., 11 May 2026, Miao et al., 2024, Wu et al., 3 May 2025, Song et al., 27 Nov 2025, Zhang et al., 18 Dec 2025, Liu et al., 2023).

1. Conceptual scope

A forgery-aware strategy typically begins from the observation that standard supervised pipelines learn shortcuts tied to specific generators, blending pipelines, compression patterns, or domain statistics. In face forgery detection, simple federated learning “can’t adapt to real forgery detection scenarios, where there exist different types of forgery clues” and has “poor generalization capabilities for the real hybrid-domain forgery dataset” (Liu et al., 2024). In universal face forgery detection, the central failure mode is that binary supervised detectors overfit to known forgery types while the “fake manifold” is heterogeneous and open-ended, whereas the real-face manifold is comparatively stable (Jiang et al., 11 May 2026). In generalized synthetic-image detection, the “fixed paradigm” of freezing CLIP and training only a linear head is reported to yield insufficient learning of forgery representations (Liu et al., 2023).

A compact way to organize the current landscape is to distinguish which forensic prior is made explicit during training.

Paradigm	Forgery-aware signal	Representative work
Personalized federated learning	Shared vs personalized forgery representation	FedPR (Liu et al., 2024)
One-class authenticity learning	Pseudo-forgeries and predictive uncertainty	FADNet (Jiang et al., 11 May 2026)
Unified detection-localization	Real/fake tokens and masked attention	MoNFAP (Miao et al., 2024)
Weakly supervised audio localization	Forgery-aware prompts and proposal refinement	LOCO (Wu et al., 3 May 2025)
Proactive tamper localization	Blank-canvas optimization against SAM	(Song et al., 27 Nov 2025)
Agentic multimodal forensics	Tool-use rewards aligned with forensic workflow	ForenAgent (Zhang et al., 18 Dec 2025)

Taken together, these works suggest that forgery-aware training is less a single algorithm than a design principle: training becomes forgery-aware when the model is constrained to represent manipulation structure explicitly, rather than inferring “fake” as an undifferentiated residual category.

2. Representation shaping and objective design

Several methods operationalize forgery awareness by imposing explicit structure on latent representations. In personalized federated face forgery detection, a client model is partitioned into a global feature extractor $F_f$ , a personalized head $F_p$ , and a shared head $F_s$ . Personalized Forgery Representation Learning defines a personalized branch $R_p$ using interpolated feature statistics and a shared branch $R_s$ using swapped statistics, and optimizes

$L = \alpha L_{adv} + \beta L_p + \gamma L_s$

with $\alpha=0.1$ , $\beta=1$ , and $\gamma=1$ . The personalized branch is meant to capture client-specific cues, while the shared branch, regularized toward uniform predictions by $L_{adv}$ , is pushed toward manipulation-invariant structure (Liu et al., 2024).

A different formulation appears in one-class authenticity learning. FADNet uses a ResNet-50 backbone, a 2-layer projection MLP, and an evidential head that produces $F_p$ 0, $F_p$ 1, and uncertainty

$F_p$ 2

Real faces are compacted by

$F_p$ 3

while pseudo-forgeries are driven toward low evidence and high uncertainty through $F_p$ 4. The total objective is

$F_p$ 5

and inference is purely uncertainty-based with threshold $F_p$ 6 (Jiang et al., 11 May 2026). This reformulates forgery detection as a problem of preserving the authentic manifold rather than enumerating fake classes.

Other methods encode progression or alignment more directly. In the Oriented Progressive Regularizor, real, SBI, CBI, and deepfake are assigned the attribute vectors $F_p$ 7, $F_p$ 8, $F_p$ 9, and $F_s$ 0, corresponding to blending clues, identity inconsistency, and deep generative artifacts. The attribute loss

$F_s$ 1

is combined with a transition loss and a detection loss to impose a real $F_s$ 2 blendfake $F_s$ 3 deepfake ordering in latent space (Cheng et al., 2024). In generalized synthetic-image detection, FatFormer inserts a forgery-aware adapter into CLIP, fuses image- and frequency-domain features as

$F_s$ 4

and replaces a fixed linear probe with language-guided alignment between adapted image features and “real”/“fake” prompts (Liu et al., 2023). In “Learning to mask,” a teacher ViT estimates an attention map over deep features, and a student is trained on the complement of the top-25% attention regions so that highly attended, easy-to-learn cues are suppressed during learning (Fei et al., 2022).

A plausible implication is that forgery-aware objectives succeed when they reshape the representation around invariances and transitions specific to forgery generation: authentic compactness, cross-domain shared artifacts, progressive accumulation of forged attributes, or low-attention residual cues that standard training would ignore.

3. Synthetic forgeries, adversarial examples, and curricular augmentation

A large subset of the literature makes training forgery-aware by constructing hard negative examples that imitate specific manipulation mechanisms. FADNet introduces a plug-and-play pseudo-forgery image generator with four perturbation families—frequency, spatial/structural, chromatic/textural, and compression—and randomly samples 3–5 perturbations per real image during training (Jiang et al., 11 May 2026). Document forgery localization builds FD-VIED by emulating text removal, addition, replacement, and background addition with both copy-move and DNN-based operations, specifically DeepFillv2 for inpainting and SRNet for scene text editing (Okamoto et al., 2023). Curricular Dynamic Forgery Augmentation defines $F_s$ 5, uses a policy network to select one operation per image, and schedules the fraction of pseudo-fake images by

$F_s$ 6

so that training moves monotonically from original fakes toward harder pseudo-fakes (Lin et al., 2024).

Adversarial generation is also used as a forgery-aware mechanism. In self-adversarial training for image forgery localization, each iteration performs clean training and then generates an FGSM sample

$F_s$ 7

with $F_s$ 8, followed by a second update on the adversarial image (Zhuo et al., 2021). In adversarial defense for forgery localization, an Adversarial Noise Suppression Module is first trained by Forgery-relevant Features Alignment using channel-wise KL divergence between victim-model features from original and adversarial forged images, then refined by Mask-guided Refinement with a dual-mask constraint (Peng et al., 15 Jun 2025).

Several works move augmentation into feature space. DDT uses spatial mixup that vertically mixes two same-class faces to regularize zero- and few-shot transfer (Aneja et al., 2020). “Learning to mask” performs deep feature mixup after attention-guided suppression of high-attention student features (Fei et al., 2022). ForgeryTTT trains on SynCOCO with splicing, copy-move, and removal generated from MS-COCO and then uses predicted masks at test time to build pseudo-labeled token groups for online adaptation (Liu et al., 2024).

These designs share a common premise: forged examples used during training should reflect plausible manipulations or perturbations of the forensic evidence itself. This suggests that augmentation is most effective when it is not image-generic but artifact-generic.

4. Localization, prompts, and multimodal grounding

Forgery-aware training often becomes most explicit when the learning signal is localized in space or time. In multi-face manipulation detection, MoNFAP predicts image-level logits $F_s$ 9 and a pixel-level mask $R_p$ 0 in a single token-driven framework. The Forgery-aware Unified Predictor uses one real token and one fake token, and a Forgery-Aware Transformer that combines token self-attention, vanilla cross-attention, and masked cross-attention of the form

$R_p$ 1

Its Mixture-of-Noises Module fuses four noise experts—HFConv, SRMConv, BayarConv, and CDConv—through a mixture-of-experts gating mechanism, and the total loss is

$R_p$ 2

This directly couples classification and localization through shared tokens and masked attention (Miao et al., 2024).

In weakly supervised audio temporal forgery localization, LOCO extracts frame-level semantic features with XLS-R-300M, injects utterance-level “real” or “fake” prompts through a BERT-based Prompt-enhanced Forgery Feature adapter, and fuses two streams into a temporal forgery-class activation sequence

$R_p$ 3

with $R_p$ 4. It then produces forgery proposals by thresholding at $R_p$ 5, converts those proposals into pseudo frame labels, and refines features with a supervised semantic contrastive loss in a second training stage (Wu et al., 3 May 2025).

A related grounding strategy appears in ForgeryGPT. Its Mask-Aware Forgery Extractor contains an FL-Expert and a Mask Encoder; the FL-Expert uses object-agnostic forgery prompts, a vocabulary-enhanced vision encoder, and a U-Net-shaped decoder to output a forgery localization map $R_p$ 6. Training proceeds in three stages—Image-Text Alignment Pre-training, Mask-Text Alignment Pre-training, and IFDL Task-Specific Instruction Tuning—with a combined objective

$R_p$ 7

Mask tokens are then interleaved with image and text tokens for instruction-following and explanation (Liu et al., 2024).

Taken together, these formulations indicate that forgery-aware training benefits from grounding the “fake” decision in explicit regions, frames, or token groups. A plausible implication is that localization is not merely an auxiliary output: it becomes the mechanism by which the model decides what evidence is forensic.

5. Personalization, transfer, and deployment-time adaptation

Another major line of work treats forgery awareness as a problem of adaptation under privacy, domain shift, or deployment-time uncertainty. In FedPR, each client maintains local personalized parameters $R_p$ 8 and shared parameters $R_p$ 9, and only the shared representation is aggregated on the server: $R_s$ 0 This parameter partitioning is paired with Personalized Forgery Representation Learning so that heterogeneous clients can preserve private, client-specific forgery cues while still exchanging a manipulation-invariant shared branch (Liu et al., 2024).

Deepfake cross-domain detection frames adaptation more explicitly. Forgery Guided Learning first trains DPNet on known forgeries with

$R_s$ 1

then adapts to a support set of unknown forgeries through

$R_s$ 2

and a meta-updater that generates element-wise learning rates and weight decays: $R_s$ 3 Its frequency-domain Perception Mechanism dynamically routes FFT-domain filters, while Adaptive Forgery Relationship Perception uses graph-based channel relations (Jia et al., 14 Aug 2025).

Zero- and few-shot transfer are addressed differently in DDT. A ResNet-18 encoder predicts a Gaussian latent distribution $R_s$ 4, and each class is represented by a prototype Gaussian component $R_s$ 5. Training minimizes the Wasserstein distance

$R_s$ 6

thereby aligning source and target real/fake samples to shared latent modes rather than to a task-specific linear classifier (Aneja et al., 2020).

Deployment-time optimization pushes this logic further. ForgeryTTT performs test-time training on each individual test image: a localization head predicts a mask, the predicted manipulated and authentic token groups define a self-supervised classification task, and the encoder is updated for that sample only (Liu et al., 2024). “Creating Blank Canvas Against AI-enabled Image Forgery” does not train a detector at all; instead it optimizes an image-specific perturbation $R_s$ 7 so that SAM outputs a nearly uniform confidence map on the protected image and later deviations reveal tampering. The updated adversarial objective combines mask suppression, low-frequency preservation, high-frequency disruption, and stealth terms: $R_s$ 8 with $R_s$ 9 (Song et al., 27 Nov 2025). ForenAgent adapts the same deployment perspective to multimodal LLMs by training an agent to generate and execute forensic Python tools under a dynamic reasoning loop of global perception, local focusing, iterative probing, and holistic adjudication, optimized by Cold Start and Reinforcement Fine-Tuning with task-aligned process rewards (Zhang et al., 18 Dec 2025).

These systems suggest that forgery-aware training increasingly includes how a model adapts after pretraining: per-client, per-domain, per-sample, or even per-image optimization can itself become the primary carrier of forensic prior.

6. Empirical patterns, limitations, and contested assumptions

Across settings, the empirical pattern is that explicitly structured forgery-aware training improves out-of-domain behavior. FedPR reports 88.78% accuracy and 93.52% AUC on a Forgery Source Hybrid Dataset, and its cross-validation analysis shows that a CelebDF-v2 client reaches 89.90% with FedPR versus 84.29% without FL (Liu et al., 2024). FADNet reports an average accuracy of 96.63% and an average precision of 98.83%, and on FLUX.2 achieves Acc 97.1%, AP 99.0%, and F1 97.1 while several supervised baselines collapse (Jiang et al., 11 May 2026). MoNFAP-C reaches IoU-f = 83.15 on FFIW, compared with CATNet 78.35 and HiFiNet 74.24 (Miao et al., 2024). LOCO reaches 76.85% mAP on HAD, and removing Temporal Forgery Attention, Prompt-enhanced Forgery Feature, or Progressive Refinement Strategy lowers performance to 70.03%, 74.59%, and 73.81%, respectively (Wu et al., 3 May 2025). FatFormer, trained only on 4-class ProGAN data, attains ACC $L = \alpha L_{adv} + \beta L_p + \gamma L_s$ 0=98.4% on unseen GANs and 95.0% on unseen diffusion models (Liu et al., 2023). ForenAgent improves from 79.7/79.7 Acc/F1 for a supervised MLLM baseline to 88.1/88.2 under its full training pipeline (Zhang et al., 18 Dec 2025). CDFA raises Swin’s average video-level AUC from 76.44 to 91.63 (Lin et al., 2024).

At the same time, the literature records several limitations and controversies. One controversy is whether deepfake data should be left behind when training a general detector: vanilla hybrid training produced the “1+1<2” effect, where mixing deepfake and blendfake as undifferentiated negatives underperformed blendfake-only training, and this motivated the Oriented Progressive Regularizor’s explicit real $L = \alpha L_{adv} + \beta L_p + \gamma L_s$ 1 blendfake $L = \alpha L_{adv} + \beta L_p + \gamma L_s$ 2 deepfake ordering (Cheng et al., 2024). Federated personalized detection still has a slight performance gap versus centralized training, incurs communication cost, and does not address poisoning or backdoor defenses (Liu et al., 2024). One-class authenticity learning depends on the stability of the real-face distribution and uses manually designed perturbations in PFIG (Jiang et al., 11 May 2026). Weakly supervised audio localization depends on ASR features, prompt quality, and pseudo-label fidelity, especially for long or complex forgeries (Wu et al., 3 May 2025). Proactive blank-canvas optimization may be weakened by severe post-processing or strong geometric transformations (Song et al., 27 Nov 2025). Agentic tool use improves interpretability, but its behavior depends on reward design, tool interfaces, and long-context supervision (Zhang et al., 18 Dec 2025).

A plausible synthesis is that forgery-aware training is most effective when it formalizes the structure of manipulations that standard supervision leaves implicit. The recurring mechanisms are separation of shared and idiosyncratic cues, explicit modeling of authentic versus forged manifolds, mask- or proposal-grounded supervision, and adaptive policies that respond to new domains, new attacks, or new toolchains. The open question is not whether forgery-aware training helps, but which forgery prior remains stable as generation technology changes.