Multi-Agent Forensic Reasoning for Generalizable Deepfake Video Detection

AI summary

Overview

Research area: Computer Vision — deepfake video detection, multimodal large language models (MLLMs), multi-agent reasoning systems, and benchmark dataset construction.

Technical level: Advanced. The paper assumes familiarity with MLLM fine-tuning, supervised fine-tuning (SFT), group relative policy optimization (GRPO), LoRA, and out-of-distribution evaluation protocols.

Scope: The paper introduces a 100,000-video deepfake benchmark with fine-grained textual forensic annotations and a four-expert-plus-judge multi-agent MLLM framework that detects unseen AI-generated videos better than small vision detectors, general-purpose MLLMs, and forensics-tuned MLLMs.

What This Paper Is About

Conventional deepfake detectors are small vision models trained on binary real-or-fake labels, which encourages them to memorize shortcuts tied to specific datasets or generators, so their performance degrades on newly released synthesis methods. Existing benchmarks compound this by covering only limited numbers of generators and generally providing no textual evidence for their labels, and single multimodal large language models asked directly for a verdict tend to overemphasize one salient visual cue or produce explanations that contradict their own predictions. The authors' goal is to build a benchmark with rich, dimension-specific forensic supervision and a detection system that reasons over multiple independent forensic perspectives rather than making one holistic judgment.

Key Contributions

1. FaceVid-Forensics-100K dataset. A large-scale deepfake video benchmark of 100,000 face-centric videos spanning 33 synthesis methods across face swapping (FS), face reenactment (FR), and entire-face synthesis (EFS, covering text-to-video, image-to-video, text-and-image-to-video, and video-to-video generation), including recent generators such as Seedance 2.0. It contains 21,075 real and 78,925 fake videos.

2. Fine-grained textual forensic supervision. Unlike prior benchmarks that supply only binary labels, every video carries dimension-specific visual observations across texture, lighting, motion, and physics, plus a verdict-consistent forensic explanation. These are generated automatically by a pipeline in which five annotator MLLMs (GPT-4o, Gemini 3.5-Flash, Qwen2.5-VL, Skyra, VideoVeritas) produce independent reports and DeepSeek-V4 Pro aggregates them and resolves conflicts under ground-truth guidance.

3. A multi-agent forensic reasoning framework. Four specialized observation agents independently examine texture, lighting, motion, and physics; a judge agent reconciles their reports and optionally the sampled video frames to emit a final real-or-fake verdict with an explanation. All agents are instantiated with small open-source MLLMs (Qwen2.5-VL-7B).

4. A two-stage training pipeline. Supervised fine-tuning of the observation agents on dimension-specific labels, followed by SFT of the judge agent on concatenated observations, then GRPO to refine the judge's decision policy while the observation agents stay frozen.

Main Findings

• Best overall out-of-domain performance. On the OOD test set (5,716 real and 1,920 fake videos from 20 held-out generators), the full framework reaches 69.87% accuracy, 81.82% recall, and 53.28% F1. The text-only judge variant reaches 67.41% accuracy, 65.00% recall, and 51.01% F1, ranking second.

• It beats much larger closed-source models. The strongest single-model baseline in the main comparison is Gemini-2.5-Pro at 63.78% accuracy, 75.29% recall, and 47.45% F1; the framework improves F1 by 5.83 percentage points over it. GPT-4o reaches 37.55% F1, Gemini-3.5-Flash 46.22% F1, Skyra 38.30% F1, and VideoVeritas 43.22% F1.

• Small vision models lead in-domain but generalize worse. On the in-domain test set, TFCU reaches 98.66% accuracy and 99.46% F1, while the best version of the framework reaches 87.34% accuracy and 96.35% F1 without video and 84.31% accuracy and 96.19% F1 with video. Among MLLM-based methods, the framework is the strongest in-domain.

• Each forensic perspective contributes distinct evidence. Combining all four observation agents yields the best F1 under both judge configurations (47.53 without video, 50.49 with video). Individually, lighting is strongest without video (45.13 F1) and texture is strongest with video (50.39 F1); motion is weakest (40.54 and 47.20 F1).

• Both training stages matter. The training-free system scores 33.53 F1 without video; SFT of only the observation agents raises it to 40.46, SFT of only the judge to 40.87, joint SFT to 47.53, and adding GRPO to 51.01. With video, the sequence runs 30.07, 40.48, 48.39, 50.49, and 53.28 F1.

• Giving the judge direct video access helps, but only jointly with training. After training, adding frames raises F1 from 51.01 to 53.28; in the training-free setting, adding frames lowers F1 from 33.53 to 30.07 (and lowers accuracy from 45.06 to 42.29).

• Multi-agent decomposition beats other prompting strategies. In a training-free comparison using frozen MLLMs, single-model prediction, chain-of-thought, and three multi-turn dialogue variants (5 turns: 4 observation turns plus a final decision turn) all trail the framework. With Qwen2.5-VL-7B, the best baseline is single-model prediction at 13.24 F1 versus 33.53 F1 for the framework without video; with InternVL3.5-8B, multi-turn reaches 25.85 F1 versus 30.52 F1 with video.

• Gains hold at the per-generator level. After GRPO, macro-average accuracy across the 20 held-out generators is 68.73% without video and 69.47% with video, respectively first and second among all evaluated methods. With video, the framework exceeds TALL++ by 5.25 points and Skyra by 4.24 points on macro average, and ranks first or second on 11 of the 20 held-out generators.

• Dataset construction scaled down deliberately. From 1,158,585 valid face-centric videos (30,240 real, 1,128,345 fake, 436.56 hours total), real videos were deduplicated by YouTube ID to 21,075, and dominating fake generators were reduced using AltFreezing scores to favor harder samples (ModelScope 235,007→11,958; Pika 75,471→15,163; Text2Video-Zero 435,210→10,432; VideoCrafter2 376,471→32,690), giving 78,925 fake videos. The final splits contain approximately 68,906 training, 23,458 in-domain test, and 7,636 OOD videos.

Methodology in Plain English

The authors first assembled a large video pool from existing forgery benchmarks (AIGVDBench, GenVidBench, ViF-Bench, FaceForensics++) and from videos crawled from the internet, including output from recent models such as Seedance 2.0. A face detection pipeline filtered the pool frame by frame, and pruning steps removed duplicate real videos and over-represented fake generators, favoring samples that an existing detector (AltFreezing) found hard to classify.

To create textual supervision without manual annotation, five MLLMs of different types each watched every video and wrote observations about texture, lighting, motion, and physics, plus their own verdict and rationale. A separate text-only model, DeepSeek-V4 Pro, then merged the five sets of observations dimension by dimension, using the ground-truth label to settle contradictions and filter noise, and produced a single explanation consistent with the correct verdict. Keeping the aggregator purely textual and separate from the visual annotators was an explicit design choice to avoid inheriting their visual biases.

The detection system copies this division of labor. Four agents each see the same sampled frames but receive a different prompt: one inspects skin detail and blending boundaries, one checks illumination and shadows, one tracks temporal instability, and one judges anatomical and geometric plausibility. None of them predicts real or fake. A judge agent receives their four written reports — optionally along with the frames themselves — and weighs supporting and conflicting evidence to produce the final verdict and a short explanation.

Training happens in two stages. First, each observation agent is fine-tuned on the merged dimension-specific labels for its own perspective. Second, the judge is fine-tuned on the concatenated reports produced by the now-trained observers. Finally, GRPO samples a group of candidate judge responses per input, rewards those that predict the right label, normalizes the rewards within the group into relative advantages, and updates the judge with a clipped objective plus a KL penalty against the frozen SFT policy.

All agents use Qwen2.5-VL-7B as the base model, trained with ms-swift, LoRA, and AdamW for one epoch, at a learning rate of 1e-4 for SFT and 5e-6 for GRPO, with eight sampled responses per prompt for GRPO. Evaluation uses accuracy, F1, and recall on a generator-disjoint OOD split, with thinking mode disabled for models that offer it.

Why This Matters

Impact on research. The paper shifts deepfake detection from opaque binary classification toward evidence-grounded, multi-perspective reasoning, and it argues that supervision quality — dimension-specific observations and verdict-consistent explanations — matters as much as model scale. Its result that a framework built entirely from small open-source MLLMs outperforms GPT and Gemini models on the reported benchmark challenges the assumption that detection capability scales with model size alone. The generator-disjoint split, with 20 fully held-out generators, also provides a stricter generalization test than benchmarks that report only in-domain numbers.

Real-world applications:

• Platform content moderation: triaging suspected synthetic media while producing an auditable explanation for each decision.
• Journalism and newsroom verification: supporting fact-checkers who need documented reasons, not just a score, before publishing or retracting footage.
• Legal and law-enforcement forensics: recording which visual evidence (texture, lighting, motion, physics) supported an authenticity judgment in a chain-of-custody context.
• Identity and financial security: screening synthetic video used in remote identity verification or video-based fraud.

Industry relevance. Three of the authors' affiliations are Beijing Jiaotong University, Tsinghua University, and Ant Group, indicating interest from both academia and industry. The framework's reliance on 7B open-source models, and its report-before-verdict structure, map directly onto production moderation pipelines that need throughput, explainability, and auditability rather than a single black-box score.

Future Directions

• Closing the in-domain gap. Small vision models reach 99.46% F1 in-domain versus 96.35% F1 for the best framework variant, so combining specialized vision detectors with the agent framework is an open question.
• Making video access reliably useful. Adding frames to the judge helps after training (+2.27 F1) but hurts in the training-free setting (-3.46 F1), so how best to condition the judge on pixels remains unresolved.
• Scaling and agent-composition studies. The paper defers analysis of alternative MLLM combinations for the observation and judge agents to Appendix D and the effect of model parameter scale to Appendix E, leaving the sensitivity of the design to model choice and size open.
• Tracking an evolving generator landscape. The dataset already excludes 20 generators from training to test generalization, and new synthesis methods such as Seedance 2.0 continue to appear; sustaining benchmark coverage and detection robustness against future generators is an ongoing requirement.

Target Audience

Researchers and engineers working on media forensics, AI-generated content detection, and multimodal LLM reasoning; dataset and benchmark builders interested in automated, multi-model annotation pipelines; and practitioners in content moderation, trust and safety, and digital verification who need detection systems that justify their verdicts. Readers without background in MLLM fine-tuning or reinforcement learning will find the dataset and framework descriptions accessible, but the training pipeline and evaluation sections require intermediate-to-advanced familiarity.

Authors’ abstract

The malicious use of generative artificial intelligence to create highly realistic deepfake videos raises serious ethical concerns and poses substantial challenges to AI safety. However, existing deepfake video benchmarks provide limited coverage of recent synthesis methods and generally lack reliable fine-grained textual annotations. Meanwhile, conventional detectors and multimodal large language models (MLLMs), whether operating as a single model or relying on a single analytical perspective, often fail to capture subtle forgery artifacts, limiting their generalization to emerging AI-generated methods. To address these limitations, we introduce FaceVid-Forensics-100K, a large-scale deepfake video dataset comprising 100,000 videos and spanning 33 synthesis methods across face swapping, face reenactment, and entire-face synthesis, including recent generators such as Seedance 2.0. The dataset provides fine-grained textual annotations of visual observations and verdict-consistent forensic explanations, automatically synthesized through a multi-model aggregation and conflict-resolution pipeline powered by advanced MLLMs. Building on this benchmark, we propose a multi-agent forensic reasoning framework that employs four specialized domain-expert agents to independently analyze forgery cues from four perspectives: texture, lighting, motion, and physics. A judge agent then reconciles their reports to produce a final prediction together with an explanation. Extensive evaluations on out-of-domain test sets show that, despite being composed entirely of small open-source MLLMs, our framework outperforms all methods including closed-source GPT and Gemini models and ranks first across all reported metrics on this benchmark. The project page is available at https://xavierjiezou.github.io/ARGUS/.