Towards a Better Characterization of Adversarial Attacks in Geospatial Imagery

Highlights

What are the main findings?

• Across 20 vision architectures, geospatial manipulation families exhibited distinct and consistent failure modes: subtle pixel-level perturbations were most often confused with authentic imagery, localized generative inpainting generalized poorly under source shift, and adversarial patch detection transferred more reliably across unseen geometries than pixel-level detection transferred across perturbation budgets.
• Strong balanced in-domain benchmark performance did not reliably translate to operational screening utility. Under external-domain transfer and low-prevalence conditions, several models produced high false-alarm burdens, while limited-label target-domain adaptation substantially improved detection and screening performance.

What is the implication of the main finding?

• Geospatial manipulation detectors should be evaluated beyond balanced in-domain accuracy, using source-shift testing, attack-variant stress tests, external-domain transfer, adaptation behavior, augmentation sensitivity, and low-prevalence false-alarm metrics that better reflect operational deployment conditions.
• Model selection should align with deployment objectives: specialized binary detectors are preferable when the manipulation family is known in advance, whereas unified multi-attack models are better suited for analyst workflows that require both manipulation screening and attribution of the likely attack family.

Abstract

Manipulated satellite imagery threatens analytic workflows, policy decisions, and trust in geospatial intelligence. Operational systems increasingly benefit from capabilities for both manipulation detection and manipulation-family attribution to support verification, triage, and downstream analysis. We present a unified benchmark for characterizing three representative manipulation families in geospatial imagery—generative manipulations, pixel-level perturbations, and adversarial patches—using a controlled, class-balanced design and 20 modern vision architectures spanning conventional, Earth-observation-pretrained, and vision-language models. Across architectures, the dominant failure boundary is between authentic imagery and subtle pixel-level perturbations, whereas generative manipulations and adversarial patches are generally more separable under matched in-domain conditions. Additional analyses reveal important generalization limitations under unseen manipulation variants and external-domain transfer, demonstrating that strong benchmark performance does not necessarily translate to reliable operational screening. The framework also enables systematic comparison of unified multi-attack and specialized detection strategies, providing insight into their relative strengths and limitations. Rather than proposing a new defense, this work provides a reproducible methodology for characterizing manipulation artifacts, model failure modes, and deployment-relevant screening behavior in geospatial imagery, with applications to analyst triage, verification workflows, and trustworthy use of satellite data.

1. Introduction

We conduct a detailed study on how modern vision models, including supervised, EO-pretrained, and vision-language architectures, characterize and distinguish multiple adversarial manipulation types in geospatial imagery. Satellite and geospatial imagery underpin critical applications in environmental monitoring, disaster response, sanctions enforcement, treaty verification, and national security. As generative AI and adversarial manipulation techniques continue to advance, these data streams have become increasingly vulnerable to falsification. Recent reporting has documented “deepfake geography” and fabricated satellite scenes that can distort situational awareness and erode trust in geospatial evidence [1,2]. Such threats impose not only analytic risk but operational cost: analysts must determine not simply whether an image is manipulated, but what kind of manipulation has occurred to support triage, attribution, and verification workflows.

At the same time, the broader adversarial ML and deepfake detection literature highlights fundamental challenges. Robust detection is closely tied to robust classification, and detectors frequently fail when confronted with unseen or adaptive attacks [3,4]. However, these findings largely arise from natural-image settings with white-box threat models. In contrast, geospatial manipulation is typically conducted under black-box or weakly adaptive conditions: adversaries lack access to detector internals, and manipulations must remain consistent with physical and spectral constraints such as lighting, shadow geometry, terrain structure, and multispectral coherence. Moreover, EO products are shaped by sensing and processing pipelines (e.g., resampling/orthorectification and compression) and wide resolution variation, so subtle perturbations can resemble acquisition artifacts rather than overt edits. Finally, overhead targets often have small footprints, making object-centric manipulations and object-centric screening particularly relevant in geospatial workflows. This structured domain motivates a different line of inquiry—not the design of new defenses, but the characterization of how diverse attack types present to modern models and where confusion arises.

Prior work in remote sensing has shown that pixel-level perturbations can reliably alter land-cover and scene-classification predictions [5], while localized adversarial patches can induce false positives or negatives in aerial object detectors [6]. Generative manipulations can introduce either fully synthetic scenes or localized synthetic edits that remain visually plausible.

Yet these attack families are typically studied in isolation, making it difficult to compare their impact on model behavior or assess whether cues learned from one manipulation transfer to another. Moreover, despite the strategic importance of geospatial imagery, surprisingly little work has systematically analyzed how diverse adversarial manipulations present to modern vision models in the geospatial domain.

In this work, we conduct a unified analysis of three representative adversarial manipulation families in satellite imagery:

• Global and local generative manipulations [7];
• Pixel-level adversarial perturbations [8,9,10]; and
• Localized adversarial patches [11,12,13].

Using a controlled, class-balanced design and a diverse set of 20 vision architectures spanning supervised, EO-pretrained, and vision-language settings, as illustrated in Figure 1, we treat attack-type identification as a four-way manipulation characterization task. Rather than proposing a new defense architecture, our goal is to determine where modern models succeed, where they confuse manipulation families, and how these behaviors change under source shift, attack-parameter shift, external-domain transfer, and deployment-relevant training choices. We examine four research questions (RQs):

• RQ1: In-domain separability. Which manipulation families are most separable or most easily confused in a controlled four-way REAL/PIXEL/PATCH/FAKE benchmark across modern vision architectures?
• RQ2: Attack-variant and source-shift generalization. Do learned manipulation cues generalize to unseen FAKE generation mechanisms, reduced or increased PIXEL perturbation budgets, and unseen PATCH geometry?
• RQ3: Unified versus specialized detection. When are unified multi-attack models preferable to specialized binary REAL/attack detectors, and how does this comparison change under in-domain testing, external-domain transfer, and limited-label target-domain adaptation?
• RQ4: Deployment sensitivity. How do practical design choices such as augmentation severity and low-prevalence triage assumptions affect manipulation screening performance?

Key findings. Across the 20-model in-domain benchmark, the dominant confusion boundary is REAL↔PIXEL: subtle pixel-level perturbations are most often confused with clean imagery, while PATCH and FAKE are generally more separable under matched in-domain conditions. However, high in-domain FAKE performance does not imply generator-robust FAKE detection. Leave-one-method-out (LOMO) experiments show that FAKE recognition is strongly source-dependent, with localized inpainting especially difficult when excluded from training. Attack-variant stress tests further show that PATCH detection transfers well to an unseen square-patch geometry, whereas PIXEL detection is highly sensitive to the saliency-seed budget: the lower-budget PIXEL setting produces substantially more PIXEL→REAL missed detections. Specialized binary detectors usually outperform unified multi-attack models on pairwise REAL/attack tasks, both in-domain and under zero-adaptation external-domain transfer, although limited-label target-domain adaptation narrows this gap. Finally, deployment-facing evaluation shows that balanced benchmark performance is not sufficient for operational screening: unadapted external-domain models produce poor low-prevalence triage behavior, while target-domain adaptation substantially reduces the false-alarm burden for several architectures.

By answering these questions, we provide insight into cross-attack separability, source-shift generalization, external-domain transfer, and deployment tradeoffs within a structured, physically grounded domain. Our findings offer practical guidance for operational screening pipelines and establish a reproducible benchmark with shared metrics and diagnostics for characterizing adversarial manipulations in geospatial imagery.

Contribution and scope. The individual attacks and architectures evaluated here are not themselves the primary novelty. Instead, the contribution is the controlled organization of multiple manipulation families into a unified geospatial characterization protocol. This benchmark is intentionally controlled rather than a complete operational threat model. The PIXEL and PATCH manipulations are not intended to exhaustively represent all realistic adversarial threats in remote sensing; instead, they provide reproducible manipulation families that isolate different visual signatures: sparse low-amplitude perturbations, localized structured patches, and global or local generative edits. This design reveals stable failure boundaries, source-shift weaknesses, unified-versus-specialized tradeoffs, and training sensitivities that are difficult to observe in isolated single-attack or binary robustness studies. The benchmark should therefore be interpreted as a diagnostic artifact characterization benchmark for geospatial manipulation screening, where analysts may need not only a manipulated/not-manipulated decision but also evidence about the likely manipulation family.

Contributions. (1) We define a controlled four-way manipulation identification task (REAL/PIXEL/PATCH/FAKE) with class balance, scene-disjoint splits, and matched-base imagery for REAL/PIXEL/PATCH to isolate manipulation artifacts from scene content. (2) We benchmark 20 modern vision architectures under a shared protocol, spanning conventional CNNs, general-purpose Transformers, EO-pretrained models, and vision-language remote-sensing models, and report cross-family confusion structure and class-wise performance. (3) We evaluate attack-variant and source-shift generalization through FAKE leave-one-method-out testing, PIXEL cross-budget testing, and PATCH unseen-style testing. (4) We compare specialized binary REAL/attack detectors against unified multi-attack models under in-domain testing, zero-adaptation external-domain transfer, and limited-label target-domain adaptation. (5) We analyze deployment-relevant training and screening choices, including augmentation severity, prevalence-adjusted precision, and false-alarm burden under low-prevalence triage.

2. Related Work

Manipulated satellite imagery (deepfakes). Early work on “deep fake geography” showed that generative models can synthesize city-scale satellite scenes that visually and statistically resemble reality, raising urgent concerns for GIS, disaster response, and security, and arguing for remote-sensing (RS)-specific forensics rather than repurposed natural-image detectors [7]. Subsequent efforts moved toward detection benchmarks and larger RS-specific forged/real corpora (e.g., diffusion-based overhead datasets with localization labels), reflecting a shift from proofs of concept to broad evaluations of detector robustness in overhead settings [14].

Pixel-level perturbations in RS. Czaja et al. were among the first in remote sensing to show that very small, often invisible pixel changes can fool classifiers on single images and across time, and they highlighted RS-specific issues such as changing viewpoints and temporal drift [15]. Follow-up RS studies introduced universal (image-agnostic) perturbations and black-box attacks tailored to RS (e.g., UAE-RS), demonstrating strong transfer across architectures and tasks (scene classification, segmentation) [5]. These observations align with foundational vision results on universal perturbations and cross-model transferability [16].

Adversarial patches in overhead imagery. Unlike small-norm perturbations, patches are localized and visible yet highly salient and transformation-robust. Physical-world patch attacks have been optimized, fabricated, and deployed on or near targets to substantially reduce aerial object-detector efficacy under altitude, pose, and illumination changes [6]. Beyond detection, recent work evaluates patch threats and proposes architecture-level defenses for aerial semantic segmentation, underscoring the need for patch-aware robustness in RS models [17,18].

Forensics and RS-specific detection surveys. A growing RS forensics literature surveys manipulation strategies (inpainting, splicing, synthesis) and corresponding detection cues, emphasizing that detectors often overfit to generator-specific artifacts and may not generalize to unseen methods which directly motivates our multi-attack evaluations and error analysis [19,20]. Larger, RS-native fake/real datasets now enable cross-generator testing protocols that mirror these concerns [14].

Unlike surveys that catalog manipulation types and forensic cues, this study provides an empirical characterization of how modern vision models distinguish multiple manipulation families under a shared remote-sensing protocol. Prior RS deepfake detection work has typically focused on REAL versus FAKE discrimination, often for a single generator or synthetic-image source. In contrast, we evaluate FAKE alongside PIXEL and PATCH manipulations and explicitly test whether FAKE cues transfer across generation mechanisms, including both global synthetic imagery and localized inpainting.

Our study also differs from prior pixel-level adversarial perturbation work in remote sensing. Existing perturbation studies primarily ask whether small pixel changes can fool classifiers, segmentation models, or other downstream RS systems. Here, we instead ask whether trained detectors can recognize such perturbations as a manipulation family and where they confuse PIXEL examples with authentic imagery. This distinction is important because a manipulation may be successful as an attack while remaining difficult to detect or characterize in a forensic screening pipeline.

Similarly, prior adversarial patch work in overhead imagery has largely emphasized attack success against aerial object detectors or segmentation models. Our goal is different: we evaluate whether localized patch artifacts are recognizable as a manipulation class and whether the learned cues transfer when patch geometry changes. This allows PATCH behavior to be compared directly against PIXEL and FAKE behavior under the same model families, metrics, and train/test controls.

Finally, while general fake-image detection studies have examined cross-generator generalization in natural-image settings, our experiments test this question specifically in geospatial imagery, where scene structure, resolution, acquisition artifacts, and local object footprints differ from ordinary photographs. This framing reveals failure modes that are difficult to observe in isolated binary evaluations, including REAL–PIXEL ambiguity, generator/source dependence within FAKE, and the different transfer behavior of localized patches versus sparse pixel-level perturbations.

Cross-attack generalization and transfer. Evidence from RS and general synthetic-image detection suggests that detectors can pick up manipulation-agnostic cues (e.g., frequency/texture inconsistencies), yet cross-manipulation generalization remains fragile without explicit training signals. Work on universal perturbations and RS black-box attacks shows transfer across models and tasks [5,16], while recent “universal fake image” detectors highlight strategies for cross-generator generalization that inform our question of whether multi-attack training helps a specific attack class [21].

Data augmentation and robustness. Augmentation is a major lever for both clean-accuracy generalization and robustness. Mixup and CutMix (mixed-sample augmentations) are linked to smoother decision boundaries and improved robustness [22,23] while AugMix targets corruption robustness [24]. Robustness studies show that augmentation choice and scheduling matter since certain compositions, especially when paired with weight averaging, can materially improve adversarial robustness [25]. RS surveys further document which geometric/photometric transforms tend to help aerial tasks, guiding our design space in the data augmentations section of this paper [26].

Operational screening and triage. Most robustness studies report balanced test accuracy or attack-specific recall under curated evaluation sets. Operational geospatial screening, however, often involves low-prevalence conditions in which manipulated imagery is rare relative to authentic imagery. In such settings, high balanced accuracy may still correspond to unacceptable false alarm rates, and precision–recall behavior becomes more informative than accuracy alone. This motivates our use of deployment-facing metrics such as manipulated-class precision, recall, AUPRC, and false alarms under simulated class-imbalance settings.

3. Materialsand Methods

Adversarial manipulation in satellite imagery spans global generative edits, sparse pixel-level perturbations, and localized patches. Because these families differ in both appearance and how modern detectors perceive them, we evaluate them in a unified, controlled framework. We study three representative cases—generative FAKE imagery, gradient-guided pixel perturbations, and learnable adversarial patches. We use a frozen Faster R-CNN as a placement oracle (box-restricted gradients; box-constrained patch centers), guiding perturbations to detector-identified objects and varying with scene content.

This section outlines each attack mechanism, its motivation, and our specific formulations. The manipulations used here are designed as controlled diagnostic probes rather than exhaustive operational threat models. PIXEL, PATCH, and FAKE isolate complementary artifact regimes: sparse low-amplitude perturbations, localized structured patches, and global or local generative synthesis. This controlled construction supports reproducible cross-family comparison, but it should not be interpreted as covering all possible real-world geospatial manipulation strategies.

For readability, we use shortened model identifiers throughout the paper.

Table 1. Model key (short ID → full name).

ID	Full Model Name
Swin-B	Swin Transformer Base (patch4-window7-224)
Swin-T	Swin Transformer Tiny (patch4-window7-224)
ViT-L/16	Vision Transformer Large (ViT-L/16, $224\times 224$)
ViT-B/16	Vision Transformer Base (ViT-B/16, $224\times 224$)
ResNet-152	ResNet-152 (Residual Network, 152 layers)
ResNet-101	ResNet-101 (Residual Network, 101 layers)
ResNet-50	ResNet-50 (Residual Network, 50 layers)
ResNet-18	ResNet-18 (Residual Network, 18 layers)
EffNetV2-S	EfficientNetV2-S (ImageNet-21k pretraining, ImageNet-1k fine-tuned)
EffNet-B5	EfficientNet-B5 (ImageNet-1k pretrained)
EffNet-B4	EfficientNet-B4 (ImageNet-1k pretrained)
EffNet-B0	EfficientNet-B0 (ImageNet-1k pretrained)
DenseNet-201	DenseNet-201 (ImageNet-1k pretrained)
DenseNet-169	DenseNet-169 (ImageNet-1k pretrained)
DenseNet-121	DenseNet-121 (ImageNet-1k pretrained)
CoAtNet-0	CoAtNet-0 (ImageNet-1k pretrained)
GeoRSCLIP-B/32	GeoRSCLIP (Vision Transformer Base, ViT-B/32)
RemoteCLIP-B/32	RemoteCLIP (Vision Transformer Base, ViT-B/32)
SatDINO-B/16	SatDINO (Vision Transformer Base, ViT-B/16)
Satlas-Swin-B	SatlasPretrain Aerial Swin-B (Single-Image, EO-pretrained)

maps each identifier to the corresponding full model name.

3.1. FAKE Class: Global and Local Generative Manipulations

The FAKE class in our study is not limited to a single GAN source. Instead, it comprises three generative manipulation types designed to capture both global and local synthetic content: (1) FAKE-StyleGAN2, consisting of globally synthesized aerial scenes from the DM-AER-DeepFake-V1 dataset; (2) FAKE-inpaint, consisting of localized diffusion-based edits applied to real satellite images; and (3) FAKE-GeoSynth, consisting of globally synthesized satellite-style imagery generated with GeoSynth. This broader construction moves the FAKE label beyond a single-source deepfake setting and allows us to evaluate whether models respond differently to fully synthetic scenes versus partially edited real scenes.

FAKE-StyleGAN2. FAKE-StyleGAN2 images are sourced from the DM-AER-DeepFake-V1 dataset [27], which was produced by training a StyleGAN2 model on aerial imagery from the AID dataset. These samples depict plausible high-level scene categories while exhibiting subtle generative signatures in texture statistics, shadowing, and object placement. In our experiments, FAKE-StyleGAN2 serves as one of the two global generative-manipulation sources. Examples of FAKE-StyleGAN2 imagery used in the benchmark are shown in Figure 2.

FAKE-inpaint. FAKE-inpaint images are generated by applying a Stable Diffusion inpainting pipeline to split-specific real images. For each source image, we first resize the image to $512\times 512$, then create a deterministic local mask composed of two to three randomly parameterized rectangular or elliptical regions. The masks are constrained to remain local, with moderate spatial extent and a capped total edited area, so that only part of the scene is regenerated rather than the full image. We then apply diffusion inpainting using a fixed prompt bank of overhead satellite-scene descriptions together with deterministic filename-based seeding for reproducibility. To reduce the possibility that the classifier detects FAKE-inpaint samples from sharp mask-boundary artifacts, the raw inpainted output is post-processed using a feathered hard-composite procedure. Specifically, the saved binary edit mask is converted into a blurred alpha matte, and the final image is formed by alpha-compositing the inpainted pixels with the original real image. This keeps pixels outside the edited region unchanged, retains the diffusion-generated content inside the mask, and smooths the transition around the edit boundary. The edited output is finally resized back to the original image resolution. Because only the masked region is regenerated, FAKE-inpaint represents a local generative manipulation rather than a fully synthetic scene. An example localized FAKE-inpaint manipulation is shown in Figure 3.

FAKE-GeoSynth. FAKE-GeoSynth images are generated with the GeoSynth text-to-image model. In our implementation, we use the plain GeoSynth generation pipeline rather than the GeoSynth-Canny control variant, meaning the output is synthesized from a satellite-scene prompt and deterministic seed rather than constrained to preserve the layout of the source image. Images are generated at $512\times 512$ resolution and then resized back to the target output size used in the experiment. Accordingly, FAKE-GeoSynth serves as a second global generative source, complementary to StyleGAN2 but distinct in model family and synthesis process. Examples of FAKE-GeoSynth imagery used in the benchmark are shown in Figure 4.

Implementation details. For FAKE-inpaint, region extents were sampled using width and height fractions between 0.18 and 0.35 of the $512\times 512$ inpainting canvas. To keep the manipulation localized, masks whose combined area exceeded 35% of the image were replaced with a smaller centered ellipse. Unless otherwise noted, we used 15 diffusion inference steps, guidance scale 7.5, strength 0.95, and fixed global seeding for reproducibility. After diffusion inpainting, each sample was reconstructed using the saved binary mask and the corresponding original image through an artifact-controlled feathered composite. In this step, the binary mask was Gaussian-blurred with an 8-pixel feather radius to form the alpha matte used for compositing.

For FAKE-GeoSynth, we used the plain GeoSynth text-to-image pipeline rather than the GeoSynth-Canny variant, so outputs were generated from prompts and deterministic seeds rather than constrained by the source-image edge structure. Images were generated at $512\times 512$, resized to the target output resolution, and produced using 15 inference steps and guidance scale 5.5. In our implementation, the generated outputs were also cropped slightly at the bottom before final saving to remove a small residual border artifact introduced during generation.

3.2. Gradient-Guided Placement of Local Pixel Perturbations

We place small, localized intensity changes at image locations deemed most influential by a modern object detector. Rather than evaluating the detector’s robustness, we use a pretrained Faster R-CNN (ResNet-50-FPN) as a saliency generator: its image-level gradients reveal high-impact pixels, and perturbations are planted at those locations. The pipeline comprises two components, one for selecting perturbation coordinates and one for applying perturbations. We adopt a gradient-based strategy akin to FGSM [28]. Gradient-driven attacks for detection have been studied by Xie et al. [29], and saliency-guided placement is conceptually related to universal perturbations [16]. Our method differs in generating localized, patch-based edits guided by detector-specific sensitivity maps.

3.2.1. Algorithm 1: Finding Perturbation Coordinates (Saliency Map)

This stage uses detector gradients to score pixel sensitivity and then selects a sparse set of seeds. Let B denote the saliency-seed budget, i.e., the number of seed coordinates selected from the sensitivity map.

• Run the pretrained Faster R-CNN on the image.
• Define a loss: mean detection confidence (or a dummy term if no detections).
• Backpropagate to obtain an image gradient.
• Aggregate absolute gradients across channels to form a sensitivity map.
• If detections exist, restrict to the union of predicted boxes, otherwise use the full map.
• Select the B highest-scoring pixels as coordinates for perturbation.

This coordinate-selection procedure is summarized in Algorithm 1.

Algorithm 1 Select Perturbation Locations
Require: Image x, detector f, saliency-seed budget B, $\epsilon$
Ensure: Coordinate set $\mathcal{P}$
1:	Run detector $f\left(x\right)$ to obtain detections
2:	Build loss: $\mathrm{mean}\left(\mathrm{scores}\right)+\lambda ·\mathrm{mean}\left(x\right)$
3:	Backpropagate to get gradient map g
4:	Sensitivity $S\leftarrow {\sum }_c\left|g_c\right|$	▹ channelwise ${\mathcal{\ell }}_1$
5:	if detections exist then
6:	Mask S to the union of bounding boxes
7:	end if
8:	$\mathcal{P}\leftarrow$ coordinates of the B largest values in S	▹ partial sort
9:	return  $\mathcal{P}$

3.2.2. Algorithm 2: Applying Perturbations (Patches Around Seeds)

Given the selected coordinates, we apply small, fixed-magnitude edits in local neighborhoods.

• Copy the clean image.
• For each $(y,x)\in \mathcal{P}$, take a $p\times p$ square patch centered at $(y,x)$.
• Add $\epsilon$ to each pixel in that patch, clipping to $[0,1]$.
• Output the perturbed image.

This perturbation-application procedure is summarized in Algorithm 2.

Algorithm 2 Apply Perturbations
Require: Image x, coordinates $\mathcal{P}$, patch size p, $\epsilon$
Ensure: Perturbed image $x^{\mathrm{adv}}$
1:	$x^{\mathrm{adv}}\leftarrow x$
2:	for each $(y,x)\in \mathcal{P}$ do
3:	Add $+\epsilon$ in the $p\times p$ patch centered at $(y,x)$
4:	Clip pixel values in $x^{\mathrm{adv}}$ to $[0,1]$
5:	end for
6:	return  $x^{\mathrm{adv}}$

3.2.3. Detector-Driven Sensitivity Map

We let $x\in {[0,1]}^{1\times 3\times H\times W}$ be an RGB image (CHW). A pretrained detector $f(·)$ produces m detections with scores $s_1,\dots ,s_m$ and boxes $b_1,\dots ,b_m$. We define

$$\mathcal{L}\left(x\right)=\underset{\mathrm{detection}\text{-}\mathrm{confidence}\mathrm{term}(0\mathrm{if}m=0)}{\underbrace{\frac{1}{m}\sum _{i=1}^m{s}_i}}+\underset{\mathrm{dummy}\mathrm{term}}{\underbrace{\lambda \mathrm{mean}\left(x\right)}},$$

(1)

with $\lambda >0$ ensuring nonzero gradient when $m=0$. (We use $\lambda =0.05$ in all experiments.) A single backward pass yields $g={\nabla }_x\mathcal{L}\left(x\right)\in {\mathbb{R}}^{1\times 3\times H\times W}$. We form a per-pixel sensitivity map by channelwise ${\mathcal{\ell }}_1$ aggregation:

$$S_{y,x}={\displaystyle \sum _{c=1}^3}\left|g_{c,y,x}\right|\in {\mathbb{R}}^{H\times W}.$$

(2)

Optional box restriction. When detections are present, we let $M\in {\{0,1\}}^{H\times W}$ be a binary mask equal to 1 inside any predicted box (else 0). We then restrict S to the union of predicted boxes:

$$S^{\prime }=S\odot M.$$

(3)

If $S^{\prime }$ is identically zero, we fall back to S.

3.2.4. Selecting Locations and Applying Local Perturbations

From $S^{\prime }$ (or S), we select the B highest-valued coordinates via partial sorting. Each selected pixel becomes the center of a $p\times p$ patch (e.g., $p=5$). We then apply an additive, constant-magnitude perturbation $\epsilon$ to all channels within each patch and clip to $[0,1]$:

$$x_{c,y,x}^{\mathrm{adv}}={\mathrm{clip}}_{[0,1]}\left(x_{c,y,x}+\epsilon \right),(y,x)\in {\mathcal{N}}_p\left(y^{*},x^{*}\right).$$

(4)

This fixed-sign update favors simplicity and reproducibility; a signed-gradient variant can substitute $\epsilon ·\mathrm{sign}\left(g\right)$ within patches.

3.2.5. Hyperparameters and Practical Notes

Saliency-seed budget (B). Controls sparsity: larger B selects more seed coordinates and distributes small changes more broadly, while smaller B produces a sparser perturbation pattern. With patch size p, an upper bound on modified pixels is $B·p^2$ (overlaps reduce the realized count). We use $B=200$.

Perturbation magnitude ($\mathit{\epsilon }$). Additive per-pixel step; larger values increase impact but also visibility. We use $\epsilon =0.05$.

Dummy weight ($\mathit{\lambda }$). Maintains nonzero gradients when $m=0$; we use $\lambda =0.05$.

Reproducibility. All experiments were run with fixed random seeds and a consistent pretrained Faster R-CNN checkpoint to ensure reproducible results.

Computation. One forward and one backward pass per image; model weights remain fixed.

3.2.6. Implementation

We use the torchvision Faster R-CNN (ResNet-50-FPN) in evaluation mode. Inputs are tensors in $[0,1]$ with gradients enabled only for the image. When detections exist, the detection-confidence term in Equation (1) dominates and yields spatially informative gradients; otherwise, the dummy term supplies a weak, uniform signal so that B locations can still be selected (with a randomized fallback if needed).

An example PIXEL manipulation generated by this procedure is shown in Figure 5.

3.3. Learnable Adversarial Patch Optimization

Overview. In addition to pixel-wise perturbations (Section 3.2), we design a learnable adversarial patch mechanism that uses the same pretrained Faster R-CNN (ResNet-50-FPN) detector to identify semantically relevant regions and iteratively optimize patch content within them. This procedure follows the gradient-based adversarial paradigm introduced by Goodfellow et al. [28] and later extended to detection and segmentation models by Xie et al. [29]. Unlike single-step saliency perturbations, here the patch pixels themselves are learned through an iterative optimization loop similar to momentum iterative FGSM (MI-FGSM) [30], with an additional total-variation (TV) regularizer for smoothness.

3.3.1. Patch Formulation

We let $x\in {[0,1]}^{1\times 3\times H\times W}$ be the input image and $f(·)$ the frozen object detector. For a set of P patch centers $\mathcal{C}={\left\{(c_y^{\left(i\right)},c_x^{\left(i\right)})\right\}}_{i=1}^P$ sampled within detected bounding boxes (or uniformly over the image if no boxes), we define circular binary masks $M_i\in {\{0,1\}}^{H\times W}$ of radius r and corresponding patch tensors $p_i\in {[0,1]}^{3\times (2r+1)\times (2r+1)}$. Each patch is stamped into the image using its mask:

$$x^{\mathrm{adv}}=(1-M_i)\odot x+M_i\odot p_i,$$

(5)

$$M_i(y,x)=\mathbf{1}\left({(y-c_y^{\left(i\right)})}^2+{(x-c_x^{\left(i\right)})}^2\le r^2\right)$$

(6)

3.3.2. Optimization Objective

For a stamped image $x^{\mathrm{adv}}$, the detector outputs m bounding boxes with confidence scores ${\left\{s_j\right\}}_{j=1}^m$. The patch optimization seeks to reduce these confidences while maintaining spatial smoothness of the patch. We therefore minimize

$$\mathcal{L}(p_1,\dots ,p_P)={\displaystyle \frac{1}{m}}{\displaystyle \sum _{j=1}^m}{s}_j+{\lambda }_{\mathrm{TV}}{\displaystyle \sum _{i=1}^P}\mathrm{TV}\left(p_i\right),$$

(7)

where $\mathrm{TV}\left(p\right)={\sum }_{u,v}\left(|p_{:,u+1,v}-p_{:,u,v}|+|p_{:,u,v+1}-p_{:,u,v}|\right)$ is the isotropic total-variation penalty and ${\lambda }_{\mathrm{TV}}$ controls its strength. The loss in (7) mirrors FGSM-style objectives [28,29] but applies to learnable patch parameters rather than per-pixel image noise.

3.3.3. Iterative Update Rule

We perform T gradient steps using momentum [30]:

$$\begin{array}{cc}\hfill g_t& \leftarrow sign\left({\nabla }_p\mathcal{L}\left(p_t\right)\right),\hfill \end{array}$$

(8)

$$\begin{array}{cc}\hfill v_t& \leftarrow \mu v_{t-1}+g_t,\hfill \end{array}$$

(9)

$$\begin{array}{cc}\hfill p_{t+1}& \leftarrow {\mathrm{clip}}_{[0,1]}\left(p_t-\alpha v_t\right),\hfill \end{array}$$

(10)

where $\alpha$ is the step size, $\mu$ the momentum coefficient (typically $0.75$), and ${\mathrm{clip}}_{[0,1]}$ ensures valid RGB intensities. Optimization continues for T iterations (e.g., $T=50$) or until detection confidences drop below a fixed threshold. The final patched image $x^{\mathrm{adv}}$ is obtained by stamping the converged patches $p_T$ via (5).

Discussion. Compared with the single-step perturbations in Section 3.2, this approach learns the patch content rather than simply adding a constant $\epsilon$ offset. The total-variation term encourages realistic texture, while circular masks localize the perturbation spatially. The method remains fully differentiable and uses the detector only for gradient information, without modifying its weights.

An example localized adversarial PATCH manipulation generated by this procedure is shown in Figure 6.

4. Experimental Setup

Task formulation. The main four-way benchmark evaluates how well vision models can (1) distinguish manipulated from unmanipulated satellite imagery and (2) identify the specific manipulation type when present. We focus on three representative attack families—pixel-level perturbations, adversarial patches, and generative edits—yielding a four-way classification problem with the following labels:

• REAL: no manipulation applied;
• PIXEL: gradient-guided pixel-level perturbations;
• PATCH: learnable adversarial patches;
• FAKE: generative manipulations, including both global synthetic imagery and localized diffusion-based inpainting edits.

Controlling for scene content. REAL, PIXEL, and PATCH variants are derived from the same underlying base image, ensuring that class differences arise from manipulation artifacts rather than land-cover or object-content cues alone. FAKE-inpaint is also derived from split-specific real base images, but only within localized masked regions that are regenerated by a diffusion inpainting model. In contrast, FAKE-StyleGAN2 and FAKE-GeoSynth are global generative samples and therefore do not maintain pixelwise correspondence with a matched real counterpart. We enforce strict train/validation/test separation for all sources to prevent cross-split leakage.

All imagery is RGB only. This restriction emphasizes learning manipulation artifacts in the visible spectrum, while avoiding potential shortcut cues that might arise from additional spectral bands (e.g., infrared or multispectral channels) that are not directly related to the manipulations under study. The datasets span a wide range of land-cover types to reduce reliance on scene semantics and encourage models to focus on manipulation signatures.

Datasets. We draw imagery from two publicly available real-image sources to balance scale and diversity. In both cases, we use controlled subsets rather than the complete source datasets, so that the final benchmark remains class-balanced and split-disjoint.

DM-AER-DeepFake-V1 [27] contains over one million GAN-generated aerial images and approximately 120,000 real images drawn from Million-AID. Pixel dimensions range from $212\times 212$ to $756\times 756$, with coverage across diverse categories (e.g., agriculture, industrial, forest, residential, harbor). In our benchmark, we use a randomly sampled subset of DM-AER real imagery as base imagery for the REAL, PIXEL, PATCH, and FAKE-inpaint classes, and a separate subset of DM-AER-generated images as the FAKE-StyleGAN2 source.

UC Merced Land Use [31] provides 21 land-use categories at $256\times 256$ resolution from the USGS National Map. We use a stratified subset sampled across all 21 UC Merced categories, selecting an equal number of images from each category for each split. This ensures that the UC Merced contribution is category-balanced rather than dominated by any single land-use type. Incorporating both DM-AER and UC Merced real imagery reduces reliance on one source distribution and increases variation in scene content, resolution, style, and compression characteristics.

The REAL, PIXEL, and PATCH classes are constructed from split-specific real-image pools. The FAKE class is assembled from three sources: localized diffusion inpainting applied to real images (FAKE-inpaint), globally synthesized StyleGAN2 imagery from DM-AER (FAKE-StyleGAN2), and globally synthesized GeoSynth imagery (FAKE-GeoSynth). This composition broadens the FAKE category beyond a single-source deepfake class by spanning both partial scene editing and full-scene synthesis.

Train/validation/test splits. Data are organized into balanced train, validation, and test splits with 21,680 images per class for training and 2710 images per class for both validation and testing. For the REAL, PIXEL, and PATCH classes, the split-specific base-image pools are unchanged across the three labels so that each clean image has matched manipulated counterparts. Specifically, the training base pool contains 20,000 DM-AER real images and 1680 UC Merced images, while the validation and test base pools each contain 2500 DM-AER real images and 210 UC Merced images. The UC Merced contribution is stratified across the 21 land-use categories, corresponding to 80 training images, 10 validation images, and 10 test images per category.

The FAKE class is internally distributed across three sources. In training, FAKE contains 10,840 FAKE-inpaint images, 5420 FAKE-StyleGAN2 images, and 5420 FAKE-GeoSynth images. In both validation and test, FAKE contains 1355 FAKE-inpaint images, 677 FAKE-StyleGAN2 images, and 678 FAKE-GeoSynth images. Within the FAKE-inpaint subset, the underlying source-image composition mirrors the split-specific real-image pools used for that subset: DM-AER contributes 10,000/1250/1250 images and UC Merced contributes 840/105/105 images across train/validation/test, respectively.

All splits are strictly scene-disjoint to prevent leakage, and all split-specific manipulations are generated only from images assigned to the corresponding split. PIXEL and PATCH are derived from matched base images, FAKE-inpaint is generated from split-specific real images using localized diffusion editing, and FAKE-StyleGAN2 and FAKE-GeoSynth are incorporated as split-specific global generative samples.

Model training and evaluation. All models are trained as four-way classifiers unless otherwise noted, using the label set REAL, PIXEL, PATCH, and FAKE. The main benchmark evaluates all 20 architectures on the same held-out in-domain test split. We report overall accuracy and per-class F1 to characterize both aggregate performance and manipulation-family-specific behavior. Confusion matrices are used to identify the dominant failure boundaries between classes.

Training and Reproducibility Details

Table 2. Training and reproducibility protocol for main-benchmark and FSC adaptation experiments.

Component	Main in-Domain Benchmark	FSC Transfer/Adaptation Experiments
Input size	RGB images resized to $224\times 224$.	RGB images resized to $224\times 224$.
Preprocessing	Bicubic resize to $224\times 224$, conversion to tensor, and ImageNet normalization with mean $[0.485,0.456,0.406]$ and standard deviation $[0.229,0.224,0.225]$.	Same deterministic preprocessing for validation, testing, and zero-adaptation evaluation.
Training augmentation	Default LightAug: random horizontal flip with probability $0.5$ and mild color jitter with brightness, contrast, and saturation set to $0.05$.	Same LightAug setting during FSC limited-label fine-tuning. No augmentation for validation, testing, or zero-adaptation evaluation.
Loss function	Cross-entropy loss for four-way REAL/PIXEL/PATCH/FAKE classification. Binary cross-entropy with logits for specialized binary REAL/attack detectors.	Cross-entropy loss for multi-attack FSC adaptation; binary cross-entropy with logits for specialized binary FSC adaptation.
Optimizer	AdamW	AdamW
Learning rate	$3\times {10}^{-5}$	$3\times {10}^{-5}$
Weight decay	$1\times {10}^{-5}$	$1\times {10}^{-5}$
Batch size	64–72, depending on GPU memory, held fixed within each architecture.	32 for limited-label fine-tuning; 64 for zero-adaptation evaluation.
Maximum epochs	30 maximum epochs.	20 maximum epochs for limited-label full fine-tuning. Zero-adaptation evaluation uses no training epochs.
Scheduler	Cosine annealing with warm restarts, using $T_0=5$, $T_{\mathrm{mult}}=2$, and ${\eta }_{min}={10}^{-6}$.	Cosine annealing with warm restarts, using $T_0=5$, $T_{\mathrm{mult}}=2$, and ${\eta }_{min}={10}^{-6}$.
Early stopping	Yes, stop if validation macro-F1 does not improve by at least ${10}^{-4}$ for 5 consecutive epochs.	Yes for FSC adaptation, stop if the validation selection metric does not improve by at least ${10}^{-4}$ for 3 consecutive epochs.
Threshold selection	Four-way models use argmax prediction. Binary detectors select the threshold on the validation split to maximize attack-class F1.	Same rule: multi-attack models use argmax or exact-family scoring; binary detectors use a validation-selected threshold maximizing attack-class F1.
Random seeds	Used a fixed primary seed of 42 across Python random, NumPy, PyTorch, CUDA operations, dataset sampling, and split construction to ensure reproducible training and evaluation.	Same seed-control protocol; use seed 42 for the primary run.
Determinism	Enable deterministic CuDNN behavior where supported and record any nondeterministic operations.	Same deterministic settings where supported.
Hardware and software	All experiments were implemented in PyTorch 2.7.0+cu126 with torchvision 0.22.0+cu126 using wheels built against CUDA 12.6. Experiments ran on Ubuntu 22.04 LTS with Python 3.13.2, NVIDIA driver 570.195.03, CUDA toolkit 12.8 runtime, and a single NVIDIA Quadro P6000 GPU with 24 GB VRAM.

summarizes the implementation settings used for the main four-way benchmark, zero-adaptation FSC evaluation, and limited-label FSC adaptation experiments. Unless otherwise noted, all models used RGB inputs resized to $224\times 224$ with ImageNet normalization. Training augmentations were applied only to training images; validation and test images used deterministic preprocessing.

Fine-tuning strategy. For the FSC limited-label adaptation experiments, each model was initialized from the corresponding in-domain checkpoint and then fully fine-tuned on the labeled FSC adaptation subset. All backbone and classification-head parameters were passed to the optimizer and updated end-to-end; no backbone layers were frozen during FSC adaptation. In contrast, the zero-adaptation FSC setting used the same in-domain checkpoints for inference only and performed no parameter updates. Multi-attack FSC adaptation optimized cross-entropy over the four classes, whereas specialized binary adaptation optimized binary cross-entropy with logits and selected the final operating threshold on the FSC validation split to maximize attack-class F1.

Binary specialist protocol. To compare unified multi-attack training against specialized pairwise detection, we train separate binary detectors for REAL/FAKE, REAL/PIXEL, and REAL/PATCH. These binary models are evaluated against the corresponding four-way multi-attack model on the same matched two-class subsets. For the multi-attack model, we report two related views depending on the experiment: collapsed REAL versus non-REAL scoring for in-domain matched-subset comparison, and exact attack-family scoring when evaluating whether the model preserves attack specificity under external transfer. Balanced accuracy (BA), attack-class F1 ($F{1}_A$), and attack-class AUPRC are reported.

External FSC dataset. For external-domain evaluation, we use a class-balanced subset derived from the FLAIR Synthetic Change dataset (FSC-180k) [32]. FSC-180k is a semantic-change-detection dataset for Earth observation generated from FLAIR very-high-resolution aerial imagery using a hybrid data-generation pipeline. The parent FSC dataset is based on aerial imagery over France and provides real aerial images together with artificially modified counterparts designed for semantic change detection, with generated semantic maps at 512 × 512 resolution, 16 semantic classes, approximately 80 billion pixels, and 0.2 m ground resolution [32]. In the original FSC formulation, the data are intended for bi-temporal semantic change detection. In this study, we do not evaluate the full FSC-180k benchmark or its native change-detection task. Instead, we repurpose FSC as an external-domain image-level manipulation-screening dataset.

We organize the FSC-derived evaluation data into the same four labels used in the main benchmark: REAL, FAKE, PIXEL, and PATCH. FSC unmodified images are mapped to REAL, and FSC artificially modified images are mapped to FAKE. PIXEL and PATCH examples are generated from FSC REAL imagery using the same manipulation-generation framework used in the in-domain benchmark. To prevent leakage across splits, the FSC-derived evaluation set was constructed to be source-image-ID disjoint: all variants derived from the same underlying FSC/FLAIR source image were assigned to the same split. Thus, FSC differs from the in-domain DM-AER/ UC Merced benchmark in source imagery, geographic domain, spatial resolution, and generative-change process, making it a useful external stress test for whether manipulation detectors transfer beyond the controlled in-domain source distribution.

External FSC transfer and limited-label adaptation. The zero-adaptation setting evaluates the original in-domain checkpoints directly on FSC without using FSC labels for training. The limited-label adaptation setting starts from the same in-domain checkpoints and fully fine-tunes each model using fixed labeled FSC adaptation budgets of 50, 200, or 1000 images per class. For the adapted experiments, we use a fixed class-balanced FSC split with seed 42 within the pre-constructed source-image-ID-disjoint data partitions. For each of the four classes, 542 images are reserved for validation and 542 images are reserved for testing; all remaining images form the adaptation pool. The multi-attack adaptation therefore uses 200, 800, or 4000 total training images for the 50, 200, and 1000 images/class settings, respectively. For each specialized binary task, the corresponding REAL/attack adaptation subset uses 100, 400, or 2000 total training images. Checkpoints are selected using the fixed FSC validation split and evaluated on the held-out FSC test split. Unless otherwise noted, the FSC zero-adaptation evaluation uses 2710 images per class, while the FSC post-adaptation evaluations use 542 held-out test images per class. These experiments are interpreted as external-domain transfer and target-domain adaptation tests, not as replacements for the in-domain benchmark.

FAKE leave-one-method-out protocol. To test whether FAKE detection generalizes beyond generator-specific artifacts, we perform leave-one-method-out (LOMO) training over the three FAKE subtypes. In each run, one FAKE subtype is excluded from the training and validation splits, while the remaining two FAKE subtypes are used together with REAL, PIXEL, and PATCH examples. The resulting model is evaluated both on a mixed-FAKE test set and on a held-out-FAKE test set containing only the excluded FAKE subtype. This protocol directly tests whether the learned FAKE representation transfers to an unseen generation mechanism.

Attack-variant stress tests. To test whether learned manipulation cues generalize beyond the exact attack parameters used during training, we conduct zero-adaptation stress tests for PIXEL and PATCH. For PIXEL, we evaluate the original four-way checkpoint on lower-budget and higher-budget saliency-seed settings, denoted $B=50$ and $B=400$. We use the term “seed budget” because each selected coordinate may be expanded into a local perturbation neighborhood during attack application. For PATCH, we evaluate an unseen square-patch style that differs from the circular patch geometry used in the main training configuration. Unless otherwise noted, these stress tests are interpreted as targeted case studies of manipulation-family generalization rather than full model-zoo benchmarks.

Augmentation study. To evaluate the effect of training-time augmentation severity, we compare light, medium, and heavy augmentation regimes. Augmentations are applied only during training; validation and test images are evaluated using the same deterministic preprocessing. The goal is to determine whether increasingly strong photometric and geometric transformations improve generalization or instead suppress the subtle local cues needed for PIXEL and PATCH detection. The exact augmentation settings are held fixed across models within each regime.

Low-prevalence triage evaluation. In addition to balanced four-way classification, we evaluate operational screening behavior under simulated low-prevalence conditions. We define a manipulated-image score as the total predicted probability assigned to the manipulated classes,

$$s_{\mathrm{manip}}=p\left(\mathrm{PIXEL}\right)+p\left(\mathrm{PATCH}\right)+p\left(\mathrm{FAKE}\right)=1-p\left(\mathrm{REAL}\right).$$

(11)

Using this score, we report precision–recall behavior, AUPRC, precision at fixed recall, and false alarms per fixed number of screened images under simulated manipulation prevalence levels. This evaluation is intended to reflect triage settings in which manipulated imagery may be rare but false positives are operationally costly.

5. Results

In this section, we report findings for the four research questions posed in Section 1. Section 5.1 evaluates in-domain four-way separability across 20 architectures. Section 5.2 evaluates source-shift and attack-variant generalization through FAKE leave-one-method-out testing, PIXEL cross-budget testing, and PATCH unseen-style testing. Section 5.3 compares unified multi-attack models against specialized binary detectors in-domain, under zero-adaptation FSC transfer, and after limited-label FSC fine-tuning with 50, 200, and 1000 images per class. Section 5.4 evaluates deployment-sensitive choices, including augmentation severity and low-prevalence triage behavior.

5.1. RQ1: In-Domain Four-Way Separability

Table 3. Overall in-domain four-way accuracy with bootstrap 95% confidence intervals. Values are point estimates with percentile bootstrap 95% CIs in brackets.

Model	Accuracy [95% CI]
Swin-B	0.9776 [0.9748, 0.9804]
EffNet-B5	0.9734 [0.9704, 0.9764]
Swin-T	0.9677 [0.9643, 0.9710]
CoAtNet-0	0.9619 [0.9583, 0.9656]
GeoRSCLIP-B/32	0.9481 [0.9438, 0.9522]
ViT-B/16	0.9460 [0.9416, 0.9502]
RemoteCLIP-B/32	0.9390 [0.9345, 0.9435]
ViT-L/16	0.9233 [0.9184, 0.9283]
DenseNet-201	0.9022 [0.8967, 0.9077]
DenseNet-169	0.8986 [0.8929, 0.9042]
Satlas-Swin-B	0.8946 [0.8889, 0.9004]
EffNetV2-S	0.8623 [0.8558, 0.8687]
ResNet-152	0.8416 [0.8346, 0.8484]
DenseNet-121	0.8245 [0.8171, 0.8318]
SatDINO-B/16	0.8147 [0.8074, 0.8220]
EffNet-B0	0.8045 [0.7970, 0.8119]
ResNet-101	0.7806 [0.7729, 0.7885]
ResNet-50	0.7589 [0.7506, 0.7671]
ResNet-18	0.7174 [0.7091, 0.7260]
EffNet-B4	0.7130 [0.7044, 0.7213]

and

Table 4. Per-class F1 scores for the in-domain four-way benchmark with bootstrap 95% confidence intervals. Values are point estimates with percentile bootstrap 95% CIs in brackets.

Model	FAKE F1 [95% CI]	PATCH F1 [95% CI]	PIXEL F1 [95% CI]	REAL F1 [95% CI]
Swin-B	0.9974 [0.9960–0.9987]	0.9952 [0.9933–0.9969]	0.9598 [0.9545–0.9651]	0.9577 [0.9522–0.9632]
EffNet-B5	0.9941 [0.9919–0.9960]	0.9961 [0.9944–0.9977]	0.9534 [0.9476–0.9591]	0.9501 [0.9440–0.9559]
Swin-T	0.9947 [0.9926–0.9965]	0.9866 [0.9834–0.9896]	0.9480 [0.9418–0.9541]	0.9413 [0.9348–0.9477]
CoAtNet-0	0.9950 [0.9931–0.9968]	0.9803 [0.9766–0.9840]	0.9420 [0.9354–0.9484]	0.9302 [0.9232–0.9374]
GeoRSCLIP-B/32	0.9835 [0.9800–0.9868]	0.9983 [0.9972–0.9993]	0.9016 [0.8928–0.9100]	0.9081 [0.9000–0.9159]
ViT-B/16	0.9917 [0.9892–0.9941]	0.9831 [0.9795–0.9865]	0.9056 [0.8969–0.9136]	0.9031 [0.8947–0.9110]
RemoteCLIP-B/32	0.9782 [0.9741–0.9820]	0.9972 [0.9957–0.9985]	0.8900 [0.8813–0.8988]	0.8906 [0.8817–0.8992]
ViT-L/16	0.9912 [0.9885–0.9936]	0.9454 [0.9391–0.9514]	0.8827 [0.8735–0.8916]	0.8735 [0.8642–0.8826]
DenseNet-201	0.9761 [0.9720–0.9801]	0.9105 [0.9024–0.9183]	0.8840 [0.8747–0.8928]	0.8403 [0.8296–0.8505]
DenseNet-169	0.9697 [0.9650–0.9742]	0.9105 [0.9025–0.9183]	0.8851 [0.8759–0.8939]	0.8286 [0.8176–0.8393]
Satlas-Swin-B	0.9863 [0.9832–0.9893]	0.8828 [0.8738–0.8916]	0.8868 [0.8779–0.8955]	0.8218 [0.8107–0.8331]
EffNetV2-S	0.9586 [0.9532–0.9640]	0.8571 [0.8472–0.8665]	0.8569 [0.8467–0.8666]	0.7740 [0.7613–0.7863]
ResNet-152	0.9482 [0.9420–0.9541]	0.8121 [0.8004–0.8234]	0.8581 [0.8476–0.8680]	0.7525 [0.7396–0.7647]
DenseNet-121	0.9408 [0.9341–0.9472]	0.8138 [0.8028–0.8243]	0.8562 [0.8457–0.8662]	0.6778 [0.6625–0.6927]
SatDINO-B/16	0.9629 [0.9577–0.9679]	0.7618 [0.7491–0.7742]	0.8114 [0.8002–0.8228]	0.7233 [0.7101–0.7364]
EffNet-B0	0.9290 [0.9219–0.9358]	0.7745 [0.7621–0.7868]	0.8196 [0.8081–0.8306]	0.6942 [0.6801–0.7080]
ResNet-101	0.9127 [0.9048–0.9206]	0.7692 [0.7575–0.7806]	0.8009 [0.7886–0.8129]	0.6324 [0.6169–0.6480]
ResNet-50	0.9193 [0.9117–0.9268]	0.7373 [0.7257–0.7490]	0.8015 [0.7894–0.8136]	0.5539 [0.5363–0.5712]
ResNet-18	0.8857 [0.8767–0.8944]	0.6929 [0.6795–0.7062]	0.7305 [0.7167–0.7442]	0.5579 [0.5415–0.5741]
EffNet-B4	0.8811 [0.8717–0.8900]	0.6523 [0.6379–0.6663]	0.7698 [0.7568–0.7822]	0.5521 [0.5354–0.5680]

report overall accuracy and per-class F1, respectively, for 20 architectures under the standard attack configuration (circular adversarial patches with radius $r=5$ pixels; pixel-level perturbations with a saliency-seed budget of $B=200$ and $ϵ=0.05$). Bootstrap 95% confidence intervals are reported in brackets to quantify uncertainty due to finite held-out test sampling.

For the follow-on generalization, binary-versus-multi, augmentation, and triage experiments, we evaluate five representative architectures rather than the full 20-model zoo to keep the experimental scope tractable. These models were selected to span complementary model families and deployment-relevant design choices: Swin-B as the strongest overall in-domain model, EffNet-B5 as the strongest convolutional model, Swin-T as a compact Transformer baseline, Satlas-Swin-B as an Earth-observation-pretrained model, and GeoRSCLIP-B/32 as a remote-sensing vision-language model. Thus, these experiments are intended to compare representative architecture categories rather than simply the top five entries in Table 3 and Table 4.

FAKE is easiest in the matched in-domain benchmark. Across most architectures, FAKE attains the highest per-class F1, indicating that generative manipulations are the most separable category under the matched in-domain benchmark. This result should be interpreted specifically as an in-distribution finding: the FAKE class in the main benchmark includes examples from the same subtype distribution used during training. As shown later in the FAKE leave-one-method-out experiment, high in-domain FAKE performance does not imply robust generalization to unseen generation mechanisms, especially localized inpainting.

PATCH remains comparatively easy and is strongest for some model families. PATCH generally yields the second highest F1 values and remains highly separable for the best performing models. In several cases, PATCH is in fact the easiest class, particularly for models that appear especially sensitive to localized structured artifacts. This suggests that adversarial patches preserve a relatively distinctive visual signature, even when their precise detectability varies by architecture.

REAL and PIXEL define the dominant confusion boundary. The weakest per-class results are concentrated in REAL and PIXEL. Across most architectures, REAL is the lowest F1 class, while PIXEL is typically the next lowest and remains very close to REAL. This pattern indicates that the dominant failure mode is not broad confusion among all classes, but rather a specific ambiguity between clean imagery and sparse pixel-level perturbations. Such perturbations are subtle, spatially sparse, and more easily mistaken for natural acquisition noise or benign low-level variation than either PATCH or FAKE manipulations.

Figure 7 visualizes these error modes. The dominant confusion frontier remains REAL ↔ PIXEL, while FAKE and PATCH are usually much better separated from the clean class and from each other under the matched in-domain setting. This answers RQ1 as follows: in-domain four-way performance is high for the strongest architectures, but the primary ambiguity lies between clean imagery and sparse pixel-level perturbations. FAKE is easiest in-distribution, while later source-shift experiments test whether that separability persists for unseen generative mechanisms. The high matched in-domain FAKE performance should not be interpreted as evidence that the models learn a semantic concept of manipulated imagery. The FAKE label is heterogeneous and includes sources with different image-formation pipelines. As a result, matched FAKE separability may partly reflect generator-specific or source-specific artifacts rather than manipulation-invariant reasoning. This possibility motivates the FAKE leave-one-method-out experiment in Section 5.2.1, which directly tests whether FAKE recognition transfers when one generation mechanism is excluded from training.

Table 5. Subtype-specific FAKE recall in the matched in-domain four-way test set for the five representative architectures. Recall is computed within each FAKE subtype as the fraction of examples predicted as FAKE. Values in brackets are 95% percentile bootstrap confidence intervals computed with 10,000 image-level resamples within each subtype. The subtype counts are 677 StyleGAN2 images, 678 GeoSynth images, and 1355 inpaint images.

Model	StyleGAN2	GeoSynth	Inpaint
Swin-B	1.0000 [1.0000, 1.0000]	1.0000 [1.0000, 1.0000]	0.9970 [0.9941, 0.9993]
EffNet-B5	1.0000 [1.0000, 1.0000]	1.0000 [1.0000, 1.0000]	0.9852 [0.9786, 0.9911]
Swin-T	1.0000 [1.0000, 1.0000]	1.0000 [1.0000, 1.0000]	0.9934 [0.9889, 0.9970]
Satlas-Swin-B	1.0000 [1.0000, 1.0000]	1.0000 [1.0000, 1.0000]	0.9712 [0.9624, 0.9801]
GeoRSCLIP-B/32	0.9970 [0.9926, 1.0000]	1.0000 [1.0000, 1.0000]	0.9786 [0.9705, 0.9860]

separates the matched in-domain FAKE recall by subtype. All five representative models detect the matched StyleGAN2 and GeoSynth examples almost perfectly, and inpaint recall also remains high when localized inpainting is included in the training distribution. This result clarifies that the severe inpainting failure observed later is not due to inpainted images being inherently undetectable in the matched benchmark. Rather, the failure appears under source-shift conditions when inpainting is excluded from training. Therefore, the aggregate in-domain FAKE performance should be interpreted as matched-source separability rather than evidence that the models have learned a generator-invariant or semantic concept of manipulation. This motivates the following source-shift analysis, which tests whether high matched-subtype FAKE recall persists when one FAKE generation mechanism is held out during training.

5.2. RQ2: Attack-Variant and Source-Shift Generalization

The main in-domain benchmark evaluates manipulation separability when training and test data share the same attack construction and FAKE subtype distribution. We next test whether those learned cues transfer when the manipulation source or attack configuration changes. We evaluate two forms of generalization: source-shift generalization for FAKE through leave-one-method-out testing, and attack-variant generalization for PIXEL and PATCH through cross-budget and unseen-style stress tests.

5.2.1. FAKE Source-Shift Generalization

To evaluate whether the models learn generator-specific artifacts or a more generalizable representation of synthetic imagery, we performed a leave-one-method-out (LOMO) FAKE generalization experiment. For each run, one FAKE subtype was excluded from the training and validation splits, while the remaining two FAKE subtypes were used for supervised training together with the REAL, PIXEL, and PATCH classes. The trained model was then evaluated on two test settings: a mixed-FAKE test set containing all FAKE subtypes, and a held-out-FAKE test set in which the FAKE class contained only the unseen FAKE subtype. The held-out FAKE subtype counts were 678 GeoSynth images, 1355 inpainting images, and 677 StyleGAN2 images.

Table 6. FAKE leave-one-method-out (LOMO) recall results with bootstrap 95% confidence intervals. Mixed R denotes FAKE recall on the mixed-FAKE test set, Held-out R denotes FAKE recall on the excluded FAKE subtype, and $\Delta$R denotes Mixed R minus Held-out R. Values are point estimates with percentile bootstrap 95% CIs in brackets.

Model	Held-Out	Mixed R [95% CI]	Held-Out R [95% CI]	$\mathbf{\Delta }$R [95% CI]
Swin-B	GeoSynth	0.849 [0.836–0.863]	0.413 [0.376–0.448]	0.436 [0.398–0.476]
Swin-B	inpaint	0.506 [0.487–0.525]	0.013 [0.007–0.018]	0.494 [0.474–0.514]
Swin-B	StyleGAN2	0.789 [0.774–0.804]	0.165 [0.137–0.194]	0.624 [0.592–0.656]
EffNet-B5	GeoSynth	0.929 [0.919–0.938]	0.732 [0.698–0.764]	0.197 [0.163–0.233]
EffNet-B5	inpaint	0.501 [0.482–0.520]	0.002 [0.000–0.005]	0.499 [0.480–0.518]
EffNet-B5	StyleGAN2	0.797 [0.781–0.811]	0.205 [0.174–0.236]	0.591 [0.557–0.625]
Swin-T	GeoSynth	0.851 [0.838–0.864]	0.419 [0.382–0.456]	0.432 [0.392–0.472]
Swin-T	inpaint	0.501 [0.482–0.520]	0.002 [0.000–0.005]	0.499 [0.480–0.517]
Swin-T	StyleGAN2	0.775 [0.759–0.790]	0.117 [0.093–0.142]	0.658 [0.628–0.686]
Satlas-Swin-B	GeoSynth	0.824 [0.809–0.838]	0.369 [0.333–0.406]	0.455 [0.416–0.495]
Satlas-Swin-B	inpaint	0.500 [0.482–0.520]	0.001 [0.000–0.002]	0.500 [0.481–0.519]
Satlas-Swin-B	StyleGAN2	0.745 [0.728–0.761]	0.046 [0.031–0.062]	0.699 [0.676–0.722]
GeoRSCLIP-B/32	GeoSynth	0.900 [0.889–0.912]	0.640 [0.603–0.676]	0.260 [0.223–0.298]
GeoRSCLIP-B/32	inpaint	0.501 [0.482–0.519]	0.001 [0.000–0.004]	0.499 [0.480–0.518]
GeoRSCLIP-B/32	StyleGAN2	0.806 [0.791–0.821]	0.279 [0.245–0.315]	0.527 [0.489–0.563]

and

Table 7. Held-out FAKE misclassification diagnostics for the LOMO experiment with bootstrap 95% confidence intervals. F→R, F→Pxl, and F→Ptc denote the fractions of held-out FAKE images classified as REAL, PIXEL, and PATCH, respectively. Mean $p_F$ denotes the mean predicted FAKE probability on held-out FAKE examples. Values are point estimates with percentile bootstrap 95% CIs in brackets.

Model	Held-Out	F→R [95% CI]	F→Pxl [95% CI]	F→Ptc [95% CI]	Mean ${\mathit{p}}_{\mathit{F}}$ [95% CI]
Swin-B	GeoSynth	0.305 [0.270–0.339]	0.052 [0.035–0.069]	0.230 [0.199–0.263]	0.412 [0.377–0.446]
Swin-B	inpaint	0.818 [0.798–0.839]	0.151 [0.131–0.170]	0.018 [0.012–0.026]	0.012 [0.008–0.017]
Swin-B	StyleGAN2	0.575 [0.536–0.612]	0.232 [0.201–0.264]	0.028 [0.016–0.041]	0.172 [0.148–0.197]
EffNet-B5	GeoSynth	0.117 [0.093–0.142]	0.062 [0.044–0.080]	0.090 [0.069–0.112]	0.716 [0.687–0.746]
EffNet-B5	inpaint	0.831 [0.811–0.851]	0.137 [0.120–0.156]	0.030 [0.021–0.039]	0.004 [0.002–0.006]
EffNet-B5	StyleGAN2	0.406 [0.369–0.443]	0.386 [0.349–0.421]	0.003 [0.000–0.007]	0.210 [0.184–0.237]
Swin-T	GeoSynth	0.345 [0.310–0.382]	0.077 [0.058–0.097]	0.159 [0.133–0.187]	0.418 [0.383–0.453]
Swin-T	inpaint	0.873 [0.855–0.891]	0.108 [0.092–0.125]	0.016 [0.010–0.024]	0.003 [0.002–0.006]
Swin-T	StyleGAN2	0.585 [0.548–0.622]	0.201 [0.171–0.232]	0.097 [0.075–0.120]	0.123 [0.102–0.145]
Satlas-Swin-B	GeoSynth	0.562 [0.524–0.600]	0.015 [0.006–0.024]	0.055 [0.038–0.072]	0.362 [0.330–0.396]
Satlas-Swin-B	inpaint	0.764 [0.741–0.786]	0.086 [0.072–0.100]	0.150 [0.131–0.169]	0.002 [0.001–0.004]
Satlas-Swin-B	StyleGAN2	0.391 [0.355–0.428]	0.126 [0.102–0.151]	0.437 [0.400–0.476]	0.046 [0.033–0.060]
GeoRSCLIP-B/32	GeoSynth	0.122 [0.099–0.147]	0.224 [0.193–0.257]	0.013 [0.006–0.022]	0.641 [0.607–0.673]
GeoRSCLIP-B/32	inpaint	0.630 [0.604–0.656]	0.345 [0.319–0.370]	0.024 [0.016–0.032]	0.002 [0.001–0.004]
GeoRSCLIP-B/32	StyleGAN2	0.214 [0.183–0.247]	0.507 [0.470–0.544]	0.000 [0.000–0.000]	0.269 [0.237–0.300]

report the main LOMO transfer results. Mixed R denotes FAKE recall on the mixed-FAKE test set, Held-out R denotes FAKE recall on the held-out-FAKE test set, and $\Delta$R denotes the drop from mixed-FAKE recall to held-out FAKE recall. F→R, F→Pxl, and F→Ptc denote the fractions of held-out FAKE images predicted as REAL, PIXEL, and PATCH, respectively, while Mean $p_F$ denotes the mean predicted probability assigned to the FAKE class for held-out FAKE examples. Bootstrap 95% confidence intervals are reported in brackets.

Confidence intervals were computed by nonparametric bootstrap resampling of the relevant held-out FAKE examples with 10,000 replicates. For $\Delta$R, the mixed-FAKE and held-out-FAKE recall estimates were bootstrapped and differenced within each replicate. The intervals quantify finite-test-sample uncertainty and do not capture variability from retraining or random initialization.

The LOMO results show that FAKE generalization is strongly dependent on the held-out generation mechanism. GeoSynth was the most transferable held-out subtype, with an average held-out FAKE recall of 0.514 across the five models. EfficientNet-B5 achieved the strongest GeoSynth transfer, with a held-out FAKE recall point estimate of 0.732 and a relatively small recall drop of 0.197. GeoRSCLIP-ViT-B/32 was the second strongest on GeoSynth, reaching 0.640 held-out recall. The bootstrap confidence intervals support the same qualitative interpretation: held-out GeoSynth transfer was substantially stronger than held-out inpainting and generally stronger than held-out StyleGAN2.

In contrast, held-out inpainting represented the most severe failure case. Across all five models, held-out inpainting recall was near zero, ranging from 0.001 to 0.013 despite mixed-FAKE recalls near 0.50 for the corresponding LOMO runs. The dominant error mode was misclassification as REAL: the average F→R rate for held-out inpainting was 0.783, and the mean predicted FAKE probability was only 0.005. This indicates that when localized generative edits were excluded from training, the models generally did not recognize unseen inpainted imagery as manipulated; instead, they treated most inpainted examples as authentic imagery.

The near-zero inpainting transfer is likely caused by the mismatch between global synthetic-image cues and localized edit cues. FAKE-StyleGAN2 and FAKE-GeoSynth alter the full image-formation process, whereas FAKE-inpaint preserves most low-level statistics of the source image and modifies only localized regions. Because the classifier receives only image-level labels and aggregates evidence globally, the local inpainting signal can be diluted, especially after resizing to the classifier input resolution. Without mask supervision, localization loss, or explicit region-level training, the model has no direct incentive to attend to the edited region. Thus, models trained without localized generative edits appear to learn source-specific global artifacts rather than a manipulation-invariant FAKE concept. This explains why inpainting examples are not merely confused with another synthetic source but are overwhelmingly mapped to REAL.

Held-out StyleGAN2 also showed weak transfer, although it was less extreme than inpainting. GeoRSCLIP-ViT-B/32 achieved the highest StyleGAN2 held-out recall at 0.279, followed by EfficientNet-B5 at 0.205 and Swin-B at 0.165. However, all models suffered large recall drops for StyleGAN2, ranging from 0.527 to 0.699. The misclassification patterns varied by architecture: some models primarily mapped unseen StyleGAN2 images to REAL, while GeoRSCLIP-ViT-B/32 mapped a large fraction to PIXEL. This suggests that unseen global GAN artifacts can be partially detected by some architectures, but the learned FAKE representation remains incomplete and can overlap with other manipulation families.

The held-out StyleGAN2 condition directly addresses the possibility that high matched FAKE performance is partly driven by source-specific DM-AER/StyleGAN2 artifacts. In this condition, StyleGAN2 examples are excluded from training and validation, so the FAKE class is learned only from GeoSynth and localized inpainting examples. Despite this, held-out StyleGAN2 recall remains low across all five representative architectures, ranging from 0.046 to 0.279. This indicates that the models do not learn a fully source-invariant FAKE representation from the other two generative sources. Conversely, the near-perfect matched StyleGAN2 recall in the in-domain benchmark should be interpreted cautiously, because it may partly reflect StyleGAN2-specific image-formation artifacts, including possible geometric deformation cues. We did not isolate geometric deformation as a standalone explanatory variable, so the present experiments cannot quantify the independent contribution of curved-line or deformation artifacts within DM-AER/StyleGAN2 images. A more direct estimate of the deformation effect would require additional annotation or controlled filtering of StyleGAN2 samples by deformation severity, which we leave for future work.

Overall, the FAKE LOMO experiment indicates that multi-source FAKE training improves coverage but does not fully solve generator-shift generalization. The strongest transfer was observed for held-out GeoSynth, while held-out inpainting exposed a major limitation: models trained only on global synthetic imagery and other FAKE sources rarely detected localized generative edits as FAKE. These findings support the need to include both global synthetic imagery and localized generative-edit examples in the FAKE training distribution when the goal is robust manipulation detection across unseen generation mechanisms.

5.2.2. PIXEL Cross-Budget and PATCH Unseen-Style Generalization

To evaluate whether the trained four-class detectors learned manipulation-family cues beyond the exact attack configuration used during training, we conducted zero-adaptation evaluations on three held-out test sets. The first two test sets vary the PIXEL saliency-seed budget, using $B=50$ and $B=400$, respectively. The third test set evaluates an unseen PATCH style by replacing the patch geometry with a square patch. In all cases, the trained checkpoint from the original four-class experiment was loaded and evaluated directly without additional fine-tuning. The PIXEL $B=50$, PIXEL $B=400$, and square-patch test sets each contained 10,840 images.

Table 8. Zero-adaptation performance on PIXEL cross-budget and PATCH unseen-style test sets with bootstrap 95% confidence intervals. Acc. denotes accuracy and Macro F1 denotes the unweighted mean F1 across REAL, PIXEL, PATCH, and FAKE. Values are point estimates with percentile bootstrap 95% CIs in brackets.

Model	$\mathit{B}=50$ Acc.	$\mathit{B}=50$ F1	$\mathit{B}=400$ Acc.	$\mathit{B}=400$ F1	Square Acc.	Square F1
EffNet-B5	0.9065 [0.9009–0.9120]	0.9043 [0.8988–0.9096]	0.9794 [0.9767–0.9820]	0.9794 [0.9767–0.9820]	0.9732 [0.9701–0.9762]	0.9732 [0.9702–0.9761]
Swin-B	0.9205 [0.9153–0.9256]	0.9191 [0.9141–0.9240]	0.9837 [0.9813–0.9861]	0.9836 [0.9812–0.9860]	0.9764 [0.9734–0.9792]	0.9764 [0.9735–0.9792]
Swin-T	0.8889 [0.8830–0.8949]	0.8848 [0.8788–0.8906]	0.9759 [0.9730–0.9788]	0.9759 [0.9729–0.9787]	0.9653 [0.9619–0.9687]	0.9653 [0.9619–0.9687]
Satlas-Swin-B	0.8131 [0.8057–0.8205]	0.8098 [0.8027–0.8168]	0.9082 [0.9028–0.9137]	0.9076 [0.9022–0.9130]	0.8945 [0.8888–0.9003]	0.8943 [0.8887–0.9000]
GeoRSCLIP-B/32	0.8886 [0.8827–0.8946]	0.8846 [0.8789–0.8904]	0.9632 [0.9596–0.9667]	0.9631 [0.9596–0.9666]	0.9481 [0.9439–0.9521]	0.9479 [0.9437–0.9519]

reports the overall accuracy and macro F1 score for each model under the three zero-adaptation evaluation settings. The PIXEL cross-budget results show that the $B=50$ setting was consistently more challenging than the $B=400$ setting. Swin-B achieved the strongest performance across the two PIXEL cross-budget evaluations, reaching 0.9205 accuracy and 0.9191 macro F1 at $B=50$, and 0.9837 accuracy and 0.9836 macro F1 at $B=400$. EfficientNet-B5 and Swin-T also generalized strongly to the $B=400$ condition, while Satlas Aerial Swin-B showed the largest decrease in overall performance under both cross-budget settings.

Because these experiments are intended to measure manipulation-family generalization,

Table 9. Target-class recall and missed-detection rate for the PIXEL cross-budget and PATCH unseen-style experiments with bootstrap 95% confidence intervals. P→R denotes the proportion of PIXEL samples classified as REAL, and Pa→R denotes the proportion of PATCH samples classified as REAL. Values are point estimates with percentile bootstrap 95% CIs in brackets.

Model	$\mathit{B}=50$ PIXEL R	$\mathit{B}=50$ P→R	$\mathit{B}=400$ PIXEL R	$\mathit{B}=400$ P→R	Square PATCH R	Square Pa→R
EffNet-B5	0.6768 [0.6591–0.6942]	0.3026 [0.2855–0.3200]	0.9683 [0.9615–0.9748]	0.0280 [0.0220–0.0345]	0.9967 [0.9944–0.9985]	0.0022 [0.0007–0.0041]
Swin-B	0.7321 [0.7152–0.7486]	0.2528 [0.2367–0.2695]	0.9849 [0.9802–0.9892]	0.0144 [0.0101–0.0190]	0.9930 [0.9897–0.9960]	0.0037 [0.0015–0.0061]
Swin-T	0.6203 [0.6018–0.6383]	0.3417 [0.3238–0.3602]	0.9683 [0.9615–0.9747]	0.0280 [0.0220–0.0344]	0.9823 [0.9771–0.9871]	0.0144 [0.0101–0.0191]
Satlas-Swin-B	0.5672 [0.5487–0.5855]	0.3439 [0.3260–0.3618]	0.9476 [0.9391–0.9559]	0.0373 [0.0303–0.0443]	0.8893 [0.8772–0.9010]	0.0738 [0.0641–0.0837]
GeoRSCLIP-B/32	0.6306 [0.6128–0.6486]	0.3218 [0.3041–0.3388]	0.9292 [0.9195–0.9385]	0.0638 [0.0549–0.0732]	1.0000 [1.0000–1.0000]	0.0000 [0.0000–0.0000]

reports the recall of the target manipulation class in each stress test condition. The target class recalls in Table 9 should be interpreted alongside the overall metrics in Table 8. Because each stress test remains a balanced four-class evaluation, a substantial drop in the stressed class can coexist with high overall accuracy if the other three classes remain highly separable. For example, in the $B=50$ PIXEL setting, missed PIXEL detections affect only one quarter of the balanced test set, so overall accuracy can remain high even when PIXEL recall drops substantially. For the PIXEL cross-budget experiments, the target metric is PIXEL recall. For the square-patch experiment, the target metric is PATCH recall. The table also reports the proportion of target-class samples misclassified as REAL, since this represents the most operationally important failure mode: a manipulated image being treated as authentic.

The PIXEL cross-budget results indicate that the saliency-seed budget strongly affected detection performance. At the lower $B=50$ seed budget, PIXEL recall ranged from 0.5672 for Satlas Aerial Swin-B to 0.7321 for Swin-B. This drop was primarily driven by missed detections in which PIXEL images were classified as REAL. For example, 34.39% of $B=50$ PIXEL samples were classified as REAL by Satlas Aerial Swin-B, 34.17% by Swin-T, 32.18% by GeoRSCLIP-B/32, 30.26% by EfficientNet-B5, and 25.28% by Swin-B. These results suggest that the $B=50$ condition represents a substantially more subtle manipulation regime, where the perturbation footprint is sometimes insufficiently salient for reliable four-way classification.

In contrast, all models improved markedly on the $B=400$ PIXEL test set. Swin-B achieved the highest PIXEL recall at 0.9849, followed by EfficientNet-B5 and Swin-T at 0.9683, Satlas Aerial Swin-B at 0.9476, and GeoRSCLIP-B/32 at 0.9292. The corresponding PIXEL→REAL rates also decreased substantially, with Swin-B showing the lowest missed-detection rate at 0.0144. This pattern indicates that the models generally retained the ability to recognize PIXEL manipulations when the perturbation budget was increased, but were less robust when the pixel-level perturbation became more sparse.

Because both PIXEL cross-budget evaluations still use the original Faster R-CNN-guided placement procedure, we performed an additional PIXEL control experiment in which perturbation locations were selected without Faster R-CNN placement guidance. This experiment directly evaluates whether the trained detectors retained PIXEL recognition when the placement oracle was removed. The no-oracle PIXEL set used the same number of PIXEL test images as the main four-way benchmark experiment.

As shown in

Table 10. Zero-adaptation performance on PIXEL images generated without Faster R-CNN placement guidance. The trained four-class checkpoints were evaluated directly on no-oracle PIXEL samples. PIXEL R denotes the proportion of no-oracle PIXEL samples classified as PIXEL. P→R denotes PIXEL samples classified as REAL, and P→Other denotes PIXEL samples classified as PATCH or FAKE. Mean $p\left(\mathrm{PIXEL}\right)$ denotes the average predicted softmax probability assigned to the PIXEL class over the no-oracle PIXEL samples. Values are point estimates with percentile bootstrap 95% CIs in brackets.

Model	PIXEL R	P→R	P→Other	Mean $\mathit{p}\left(\mathbf{PIXEL}\right)$
EffNet-B5	0.7892 [0.7732–0.8052]	0.2000 [0.1848–0.2156]	0.0108 [0.0068–0.0152]	0.7842 [0.7695–0.7987]
Swin-B	0.8616 [0.8480–0.8752]	0.1312 [0.1180–0.1444]	0.0072 [0.0040–0.0108]	0.8573 [0.8448–0.8694]
Swin-T	0.8060 [0.7904–0.8216]	0.1740 [0.1592–0.1892]	0.0200 [0.0148–0.0256]	0.8012 [0.7873–0.8151]
Satlas-Swin-B	0.7116 [0.6936–0.7292]	0.2176 [0.2016–0.2336]	0.0708 [0.0608–0.0812]	0.7028 [0.6875–0.7182]
GeoRSCLIP-B/32	0.7004 [0.6824–0.7184]	0.2796 [0.2620–0.2972]	0.0200 [0.0148–0.0256]	0.6947 [0.6788–0.7106]

, all five representative models retained substantial PIXEL recognition under the no-oracle setting, with PIXEL recall ranging from 0.7004 for GeoRSCLIP-B/32 to 0.8616 for Swin-B. This control was designed to test whether PIXEL detection transferred when the perturbation placement mechanism was changed, rather than only when perturbations were seeded using Faster R-CNN-derived locations. In other words, the experiment evaluates whether the learned PIXEL decision boundary reflected broader pixel-level manipulation evidence rather than a narrow dependence on the detector used during attack construction. The strongest result was again obtained by Swin-B, while EfficientNet-B5 and Swin-T also maintained PIXEL recall above 0.80. Performance was lower than in the original Faster-R-CNN-guided PIXEL setting, indicating that placement strategy affects detection difficulty. However, the no-oracle results show that the models did not rely exclusively on Faster-R-CNN-specific placement cues. The main failure mode remained missed detection as REAL, with PIXEL→REAL rates ranging from 0.1312 for Swin-B to 0.2796 for GeoRSCLIP-B/32.

The unseen square-patch experiment showed stronger generalization for most models. EfficientNet-B5, Swin-B, Swin-T, and GeoRSCLIP-B/32 all achieved PATCH recall above 0.98, indicating that these models recognized localized patch manipulations even when the patch shape differed from the training configuration. GeoRSCLIP-B/32 achieved perfect PATCH recall of 1.0000 with no PATCH samples classified as REAL, although its overall square-patch accuracy was lower than EfficientNet-B5 and the Swin models because of errors in other classes. Satlas Aerial Swin-B was the least robust to the square-patch style shift, with PATCH recall of 0.8893 and a PATCH→REAL rate of 0.0738.

Overall, these results show that the evaluated representative models generalized more reliably across PATCH style than across PIXEL perturbation budget. The primary weakness was the low-budget PIXEL condition, where all models showed a substantial reduction in PIXEL recall and an increased tendency to classify manipulated images as REAL. Among the evaluated models, Swin-B provided the strongest overall generalization profile, achieving the best $B=50$ and $B=400$ PIXEL recall while maintaining high square-patch PATCH recall. EfficientNet-B5 was similarly strong under the $B=400$ and square-patch settings, while GeoRSCLIP-B/32 showed particularly strong PATCH detection but weaker PIXEL cross-budget robustness. These findings suggest that localized patch artifacts transfer more readily across shape variation than subtle pixel-level perturbations transfer across perturbation magnitude.

5.3. RQ3: Unified Multi-Attack Models Versus Specialized Binary Detectors

We next ask whether a unified multi-attack model should be preferred over specialized binary REAL/attack detectors when the deployment task is pairwise detection. For each of five representative architectures (Swin-B, EffNet-B5, Swin-T, Satlas-Swin-B, and GeoRSCLIP-B/32), we compare (i) a dedicated binary detector trained for REAL/FAKE, REAL/PIXEL, or REAL/PATCH against (ii) the corresponding multi-attack model evaluated on the same matched two-class subset. We report three settings: in-domain evaluation on the original benchmark split, external FSC evaluation without adaptation, and external FSC evaluation after limited-label full fine-tuning using 50, 200, and 1000 FSC images per class.

5.3.1. Experimental Protocol

For each architecture, we train three binary detectors: REAL/FAKE, REAL/PIXEL, and REAL/PATCH. To ensure a fair comparison, the multi-attack model is evaluated on the exact same two-class subset as the corresponding binary detector. Thus, for a REAL/FAKE comparison, both models are tested only on REAL and FAKE examples; likewise for REAL/PIXEL and REAL/PATCH. For FSC experiments, we use a fixed held-out validation/test split and report zero-adaptation transfer as well as limited-label full fine-tuning with 50, 200, and 1000 images per class from the remaining FSC adaptation pool.

5.3.2. In-Domain Matched-Subset Comparison

Table 11. In-domain matched-subset comparison between specialized binary detectors and multi-attack models with paired bootstrap confidence intervals and McNemar tests. For the multi-attack model, four-way predictions are collapsed to REAL versus non-REAL after restricting the test set to the corresponding REAL/attack pair. We denote this collapsed detection view as Multi-C. $\Delta$ is computed as Multi-C minus binary. Bracketed intervals are paired bootstrap 95% CIs for $\Delta$; McNemar’s test compares paired hard-decision correctness.

Model	Pair	BA (Bin)	BA (Multi-C)	$\mathbf{\Delta }$BA [95% CI]	$\mathit{F}{1}_{\mathit{A}}$ (Bin)	$\mathit{F}{1}_{\mathit{A}}$ (Multi-C)	$\mathbf{\Delta }$$\mathit{F}{1}_{\mathit{A}}$ [95% CI]	McNemar p
Swin-B	FAKE/REAL	0.9958	0.9766	−0.0192 [−0.0233, −0.0153]	0.9958	0.9771	−0.0187 [−0.0227, −0.0148]	<0.001
	PIXEL/REAL	0.9629	0.9589	−0.0041 [−0.0088, 0.0006]	0.9625	0.9591	−0.0035 [−0.0082, 0.0012]	0.103
	PATCH/REAL	0.9956	0.9760	−0.0196 [−0.0236, −0.0157]	0.9956	0.9765	−0.0190 [−0.0230, −0.0152]	<0.001
EffNet-B5	FAKE/REAL	0.9943	0.9762	−0.0181 [−0.0222, −0.0140]	0.9943	0.9766	−0.0177 [−0.0219, −0.0136]	<0.001
	PIXEL/REAL	0.9513	0.9539	+0.0026 [−0.0038, 0.0089]	0.9516	0.9536	+0.0020 [−0.0043, 0.0083]	0.457
	PATCH/REAL	0.9956	0.9786	−0.0170 [−0.0212, −0.0129]	0.9956	0.9790	−0.0166 [−0.0207, −0.0126]	<0.001
Swin-T	FAKE/REAL	0.9954	0.9725	−0.0229 [−0.0274, −0.0185]	0.9954	0.9732	−0.0222 [−0.0267, −0.0179]	<0.001
	PIXEL/REAL	0.9421	0.9456	+0.0035 [−0.0023, 0.0093]	0.9405	0.9455	+0.0050 [−0.0008, 0.0109]	0.267
	PATCH/REAL	0.9893	0.9697	−0.0196 [−0.0242, −0.0151]	0.9893	0.9704	−0.0189 [−0.0236, −0.0145]	<0.001
Satlas-Swin-B	FAKE/REAL	0.9841	0.9002	−0.0839 [−0.0920, −0.0759]	0.9841	0.9084	−0.0757 [−0.0838, −0.0677]	<0.001
	PIXEL/REAL	0.9089	0.8662	−0.0426 [−0.0516, −0.0334]	0.9067	0.8734	−0.0334 [−0.0424, −0.0246]	<0.001
	PATCH/REAL	0.9076	0.8679	−0.0397 [−0.0486, −0.0310]	0.9080	0.8751	−0.0328 [−0.0413, −0.0246]	<0.001
GeoRSCLIP- B/32	FAKE/REAL	0.9913	0.9646	−0.0268 [−0.0318, −0.0217]	0.9913	0.9656	−0.0258 [−0.0308, −0.0208]	<0.001
	PIXEL/REAL	0.9122	0.9083	−0.0039 [−0.0113, 0.0036]	0.9114	0.9058	−0.0056 [−0.0133, 0.0020]	0.335
	PATCH/REAL	0.9991	0.9675	−0.0315 [−0.0362, −0.0269]	0.9991	0.9685	−0.0305 [−0.0352, −0.0260]	<0.001

compares specialized binary detectors against the corresponding multi-attack models on the original in-domain test set. For each attack family, evaluation was restricted to the matched REAL/attack subset. For the multi-attack models, four-way predictions were collapsed into a binary REAL versus non-REAL decision before computing balanced accuracy (BA) and attack-class F1 ($F{1}_A$). Positive $\Delta$ values indicate that multi-attack training outperformed the corresponding binary specialist.

Paired bootstrap intervals were computed by resampling the matched REAL/attack test examples with 10,000 replicates. McNemar’s test was applied to paired hard-decision correctness for the binary and collapsed multi-attack predictions.

Overall, the specialized binary detectors usually outperformed the corresponding multi-attack models on matched two-class subsets. The binary advantage was most consistent for FAKE/REAL and PATCH/REAL, where all five models had negative $\Delta$ values for both BA and $F{1}_A$, paired bootstrap confidence intervals excluded zero, and McNemar tests indicated significant paired correctness differences. PIXEL/REAL was the main exception: EffNet-B5 and Swin-T showed small positive point-estimate gains for the multi-attack model, but the paired bootstrap confidence intervals included zero and McNemar tests were not significant. Thus, we do not interpret these small PIXEL/REAL differences as clear evidence of a multi-attack advantage. The largest degradation from binary to multi-attack evaluation occurred for Satlas-Swin-B, especially on FAKE/REAL, indicating that its four-way model had substantially weaker collapsed REAL versus non-REAL separation than its binary specialists.

5.3.3. External FSC Without Adaptation

We first evaluate direct external transfer to FSC without using any FSC labels for adaptation. For each of the five representative architectures, we compare the specialized binary detector trained for a single REAL/attack discrimination task against the corresponding multi-attack model evaluated on the same two-class FSC subset. For the multi-attack model, a prediction is counted as correct only if it matches the exact attack family under evaluation; predictions assigned to another attack class are counted as errors. This exact-family scoring rule tests whether the multi-attack model preserves attack specificity under external distribution shift.

Table 12. External FSC comparison without adaptation for thresholded metrics under exact-family multi-attack scoring, with paired bootstrap confidence intervals and McNemar tests. Each binary detector and multi-attack model is evaluated on the same matched two-class FSC subset. Multi-E denotes exact-family attribution scoring for the multi-attack model: attack examples are counted as correct only when the predicted attack family matches the evaluated pair. $\Delta$ is computed as Multi-E minus binary. Bracketed intervals are paired bootstrap 95% CIs for $\Delta$; McNemar’s test compares paired hard-decision correctness.

Model	Pair	BA (Bin)	BA (Multi-E)	$\mathbf{\Delta }$BA [95% CI]	$\mathit{F}{1}_{\mathit{A}}$ (Bin)	$\mathit{F}{1}_{\mathit{A}}$ (Multi-E)	$\mathbf{\Delta }$$\mathit{F}{1}_{\mathit{A}}$ [95% CI]	McNemar p
Swin-B	FAKE/REAL	0.615	0.592	−0.0234 [−0.0308, −0.0162]	0.384	0.340	−0.0440 [−0.0613, −0.0269]	<0.001
	PIXEL/REAL	0.975	0.941	−0.0334 [−0.0397, −0.0273]	0.974	0.939	−0.0349 [−0.0415, −0.0284]	<0.001
	PATCH/REAL	0.999	0.981	−0.0181 [−0.0218, −0.0146]	0.999	0.981	−0.0179 [−0.0215, −0.0145]	<0.001
EffNet-B5	FAKE/REAL	0.637	0.522	−0.1144 [−0.1236, −0.1057]	0.447	0.107	−0.3398 [−0.3618, −0.3184]	<0.001
	PIXEL/REAL	0.979	0.922	−0.0574 [−0.0644, −0.0504]	0.979	0.916	−0.0625 [−0.0704, −0.0546]	<0.001
	PATCH/REAL	0.997	0.977	−0.0192 [−0.0234, −0.0151]	0.997	0.977	−0.0194 [−0.0238, −0.0153]	<0.001
Swin-T	FAKE/REAL	0.604	0.561	−0.0423 [−0.0496, −0.0352]	0.350	0.238	−0.1120 [−0.1316, −0.0925]	<0.001
	PIXEL/REAL	0.888	0.906	+0.0172 [0.0105, 0.0236]	0.875	0.897	+0.0223 [0.0143, 0.0303]	<0.001
	PATCH/REAL	0.992	0.985	−0.0074 [−0.0105, −0.0042]	0.992	0.985	−0.0074 [−0.0105, −0.0042]	<0.001
Satlas-Swin-B	FAKE/REAL	0.756	0.581	−0.1755 [−0.1876, −0.1629]	0.719	0.525	−0.1938 [−0.2083, −0.1794]	<0.001
	PIXEL/REAL	0.824	0.685	−0.1393 [−0.1509, −0.1279]	0.811	0.681	−0.1308 [−0.1426, −0.1194]	<0.001
	PATCH/REAL	0.763	0.654	−0.1090 [−0.1223, −0.0958]	0.757	0.638	−0.1186 [−0.1325, −0.1047]	<0.001
GeoRSCLIP- B/32	FAKE/REAL	0.560	0.530	−0.0297 [−0.0369, −0.0227]	0.235	0.155	−0.0806 [−0.1001, −0.0614]	<0.001
	PIXEL/REAL	0.831	0.829	−0.0020 [−0.0129, 0.0085]	0.810	0.800	−0.0094 [−0.0234, 0.0043]	0.734
	PATCH/REAL	1.000	0.987	−0.0131 [−0.0162, −0.0101]	1.000	0.987	−0.0129 [−0.0160, −0.0100]	<0.001

and

Table 13. External FSC comparison without adaptation for attack-class AUPRC under exact-family multi-attack scoring. Each row uses the same matched two-class FSC subset as Table 12. Multi-E denotes exact-family attribution scoring, where the multi-attack score is the predicted probability assigned to the evaluated attack family. $\Delta$ AUPRC is computed as Multi-E minus binary, with paired bootstrap 95% CIs in brackets.

Model	Pair	AUPRC (Bin)	AUPRC (Multi-E)	$\mathbf{\Delta }$AUPRC [95% CI]
Swin-B	FAKE/REAL	0.861	0.855	−0.0060 [−0.0156, 0.0039]
	PIXEL/REAL	0.999	0.993	−0.0060 [−0.0073, −0.0048]
	PATCH/REAL	1.000	1.000	−0.0001 [−0.0001, −0.0000]
EffNet-B5	FAKE/REAL	0.865	0.644	−0.2207 [−0.2347, −0.2072]
	PIXEL/REAL	0.997	0.999	+0.0013 [0.0003, 0.0021]
	PATCH/REAL	0.997	1.000	+0.0023 [0.0005, 0.0046]
Swin-T	FAKE/REAL	0.862	0.785	−0.0769 [−0.0863, −0.0672]
	PIXEL/REAL	0.978	0.990	+0.0121 [0.0099, 0.0145]
	PATCH/REAL	1.000	1.000	+0.0003 [0.0001, 0.0005]
Satlas-Swin-B	FAKE/REAL	0.855	0.815	−0.0401 [−0.0491, −0.0306]
	PIXEL/REAL	0.921	0.901	−0.0195 [−0.0249, −0.0142]
	PATCH/REAL	0.873	0.830	−0.0431 [−0.0518, −0.0354]
GeoRSCLIP- B/32	FAKE/REAL	0.763	0.750	−0.0136 [−0.0269, 0.0004]
	PIXEL/REAL	0.947	0.947	+0.0005 [−0.0052, 0.0063]
	PATCH/REAL	1.000	1.000	+0.0000 [0.0000, 0.0000]

report the zero-adaptation FSC comparison between specialized binary detectors and multi-attack models under exact-family multi-attack scoring. We denote this multi-attack view as Multi-E. In this setting, the binary detector is evaluated on a pairwise REAL-versus-attack task, whereas the multi-attack model is evaluated on a stricter attribution-aware task: an attack example is counted as correct only when the predicted class matches the specific attack family under evaluation. For example, in the REAL/PIXEL subset, a PIXEL image predicted as PATCH or FAKE is still detected as manipulated, but it is counted as an error under Multi-E because the attack family is incorrect. Therefore, the reported multi-attack-minus-binary differences in Table 12 and Table 13 reflect both detection errors and attack-family attribution errors.

For the detailed zero-adaptation tables, paired confidence intervals for BA and $F{1}_A$ were computed using 10,000 paired stratified bootstrap replicates within each matched REAL/attack subset. For AUPRC, paired bootstrap intervals used 1000 replicates. McNemar’s test was applied to paired hard-decision correctness for the binary detector and the Multi-E prediction rule. In

Table 14. Summary of zero-adaptation FSC detection and attribution scoring averaged over the 15 model–pair comparisons. Binary denotes specialized pairwise REAL/attack detection. Multi-C denotes collapsed multi-attack detection, where all non-REAL predictions are treated as manipulated. Multi-E denotes exact-family multi-attack attribution, where an attack example is counted as correct only if the predicted attack family matches the evaluated pair. $\Delta$ values are computed relative to Binary, with paired bootstrap 95% confidence intervals over the 15 model–pair units. Dashes indicate the Binary reference row, for which $\Delta$ is not applicable.

Scoring	BA	$\mathbf{\Delta }$BA [95% CI]	$\mathit{F}{1}_{\mathit{A}}$	$\mathbf{\Delta }\mathit{F}{1}_{\mathit{A}}$ [95% CI]	AUPRC	$\mathbf{\Delta }$AUPRC [95% CI]
Binary	0.828	–	0.755	–	0.928	–
Multi-C	0.800	−0.028 [−0.055, −0.002]	0.707	−0.048 [−0.099, −0.005]	0.862	−0.066 [−0.112, −0.024]
Multi−E	0.777	−0.051 [−0.081, −0.026]	0.678	−0.077 [−0.127, −0.037]	0.901	−0.027 [−0.060, −0.005]

, confidence intervals are computed over the 15 model–pair units. Overall, the specialized binary detectors generally transferred more reliably than the multi-attack models under zero-adaptation FSC evaluation. The binary advantage was clearest for FAKE/REAL, where all five representative architectures had negative $\Delta$ values for BA and $F{1}_A$, paired bootstrap confidence intervals excluded zero, and McNemar tests indicated significant paired correctness differences. The largest thresholded gap appeared for EffNet-B5 on FAKE/REAL, where $F{1}_A$ decreased from 0.447 for the binary detector to 0.107 for the multi-attack model.

For PIXEL/REAL and PATCH/REAL, the gap was smaller and more architecture-dependent. Swin-T was the main exception, showing a positive multi-attack advantage on PIXEL/REAL for both BA and $F{1}_A$, with paired bootstrap intervals above zero. In contrast, GeoRSCLIP-B/32 showed only a negligible PIXEL/REAL difference, with confidence intervals including zero and a non-significant McNemar test. AUPRC was often saturated for PIXEL and PATCH, so the rank-based differences were less discriminative than the thresholded BA and $F{1}_A$ comparisons.

Table 14 separates detection from attribution. When the multi-attack model is evaluated under collapsed detection scoring (Multi-C), the average gap relative to binary detection is smaller than under exact-family scoring for thresholded BA and $F{1}_A$. This indicates that some multi-attack errors under FSC transfer are wrong-family attribution errors rather than failures to detect manipulation at all. However, Multi-C still remains below the binary detectors on average, showing that the specialized binary models also retain an advantage for the pairwise detection task under zero-adaptation transfer. Multi-E is therefore best interpreted as the stricter attribution-aware setting, while Multi-C is the fairer comparison to binary REAL-versus-attack detection.

5.3.4. External FSC with Limited-Label Full Fine-Tuning

We next evaluate the binary-versus-multi-attack comparison under a limited-label target-domain adaptation protocol. Starting from the original in-domain checkpoints, each model is fully fine-tuned on labeled FSC examples using 50, 200, and 1000 images per class. For each adaptation budget, checkpoints are selected on a fixed FSC validation split and final performance is reported on a held-out FSC test split.

The detailed adapted-FSC results are reported by adaptation budget in numerical table order:

Table 15. External FSC performance after full fine-tuning with 50 images per class: thresholded metrics with paired bootstrap confidence intervals and McNemar tests. BA denotes balanced accuracy, $F{1}_A$ denotes attack-class F1, and $\Delta$ is computed as Multi-E minus binary, where Multi-E denotes exact-family multi-attack attribution scoring. Bracketed intervals are paired bootstrap 95% CIs for $\Delta$; McNemar’s test compares paired hard-decision correctness.

Model	Pair	BA (Bin)	BA (Multi-E)	$\mathbf{\Delta }$BA [95% CI]	$\mathit{F}{1}_{\mathit{A}}$ (Bin)	$\mathit{F}{1}_{\mathit{A}}$ (Multi-E)	$\mathbf{\Delta }$$\mathit{F}{1}_{\mathit{A}}$ [95% CI]	McNemar p
Swin-B	FAKE/REAL	0.949	0.948	−0.0009 [−0.0157, 0.0138]	0.950	0.948	−0.0022 [−0.0174, 0.0131]	1.000
	PIXEL/REAL	0.998	0.976	−0.0221 [−0.0314, −0.0138]	0.998	0.976	−0.0218 [−0.0308, −0.0136]	<0.001
	PATCH/REAL	1.000	0.980	−0.0203 [−0.0286, −0.0120]	1.000	0.980	−0.0199 [−0.0280, −0.0119]	<0.001
EffNet-B5	FAKE/REAL	0.894	0.875	−0.0185 [−0.0415, 0.0046]	0.897	0.877	−0.0199 [−0.0421, 0.0021]	0.130
	PIXEL/REAL	0.989	0.916	−0.0729 [−0.0895, −0.0563]	0.989	0.920	−0.0686 [−0.0838, −0.0533]	<0.001
	PATCH/REAL	0.998	0.916	−0.0821 [−0.0987, −0.0655]	0.998	0.920	−0.0779 [−0.0931, −0.0629]	<0.001
Swin-T	FAKE/REAL	0.922	0.943	+0.0212 [0.0028, 0.0406]	0.920	0.943	+0.0231 [0.0044, 0.0425]	0.033
	PIXEL/REAL	0.981	0.957	−0.0240 [−0.0378, −0.0101]	0.981	0.957	−0.0230 [−0.0363, −0.0095]	0.001
	PATCH/REAL	0.994	0.961	−0.0332 [−0.0452, −0.0221]	0.994	0.962	−0.0323 [−0.0433, −0.0217]	<0.001
Satlas-Swin-B	FAKE/REAL	0.824	0.718	−0.1061 [−0.1375, −0.0756]	0.830	0.744	−0.0862 [−0.1136, −0.0595]	<0.001
	PIXEL/REAL	0.809	0.646	−0.1633 [−0.1910, −0.1356]	0.798	0.656	−0.1417 [−0.1685, −0.1162]	<0.001
	PATCH/REAL	0.777	0.647	−0.1301 [−0.1614, −0.0987]	0.785	0.657	−0.1283 [−0.1585, −0.0983]	<0.001
GeoRSCLIP- B/32	FAKE/REAL	0.803	0.833	+0.0304 [0.0037, 0.0581]	0.816	0.832	+0.0158 [−0.0104, 0.0421]	0.036
	PIXEL/REAL	0.997	0.913	−0.0839 [−0.1006, −0.0673]	0.997	0.919	−0.0778 [−0.0923, −0.0632]	<0.001
	PATCH/REAL	0.999	0.919	−0.0803 [−0.0969, −0.0655]	0.999	0.925	−0.0742 [−0.0880, −0.0610]	<0.001

and

Table 16. External FSC performance after full fine-tuning with 50 images per class: attack-class AUPRC with paired bootstrap confidence intervals. $\Delta$ AUPRC is computed as Multi-E minus binary, where Multi-E uses the predicted probability assigned to the evaluated attack family; bracketed intervals are paired bootstrap 95% CIs for $\Delta$ AUPRC.

Model	Pair	AUPRC (Bin)	AUPRC (Multi-E)	$\mathbf{\Delta }$AUPRC [95% CI]
Swin-B	FAKE/REAL	0.987	0.990	+0.0029 [−0.0054, 0.0123]
	PIXEL/REAL	1.000	0.999	−0.0005 [−0.0010, −0.0001]
	PATCH/REAL	1.000	1.000	+0.0000 [−0.0001, 0.0000]
EffNet-B5	FAKE/REAL	0.960	0.954	−0.0059 [−0.0171, 0.0049]
	PIXEL/REAL	0.999	0.998	−0.0008 [−0.0025, 0.0006]
	PATCH/REAL	0.998	0.999	+0.0008 [−0.0022, 0.0058]
Swin-T	FAKE/REAL	0.980	0.987	+0.0062 [−0.0001, 0.0137]
	PIXEL/REAL	0.999	0.998	−0.0009 [−0.0031, 0.0011]
	PATCH/REAL	1.000	1.000	+0.0003 [−0.0000, 0.0009]
Satlas-Swin-B	FAKE/REAL	0.920	0.929	+0.0087 [−0.0069, 0.0254]
	PIXEL/REAL	0.918	0.909	−0.0088 [−0.0215, 0.0036]
	PATCH/REAL	0.892	0.862	−0.0306 [−0.0484, −0.0136]
GeoRSCLIP- B/32	FAKE/REAL	0.904	0.921	+0.0170 [−0.0044, 0.0384]
	PIXEL/REAL	1.000	0.998	−0.0015 [−0.0038, 0.0001]
	PATCH/REAL	1.000	1.000	+0.0000 [−0.0000, 0.0001]

report the 50 images/class thresholded-metric and AUPRC results, respectively;

Table 17. External FSC performance after full fine-tuning with 200 images per class: thresholded metrics with paired bootstrap confidence intervals and McNemar tests. BA denotes balanced accuracy, $F{1}_A$ denotes attack-class F1, and $\Delta$ is computed as Multi-E minus binary, where Multi-E denotes exact-family multi-attack attribution scoring. Bracketed intervals are paired bootstrap 95% CIs for $\Delta$; McNemar’s test compares paired hard-decision correctness.

Model	Pair	BA (Bin)	BA (Multi-E)	$\mathbf{\Delta }$BA [95% CI]	$\mathit{F}{1}_{\mathit{A}}$ (Bin)	$\mathit{F}{1}_{\mathit{A}}$ (Multi-E)	$\mathbf{\Delta }$$\mathit{F}{1}_{\mathit{A}}$ [95% CI]	McNemar p
Swin-B	FAKE/REAL	0.985	0.983	−0.0018 [−0.0101, 0.0065]	0.985	0.984	−0.0017 [−0.0100, 0.0066]	0.832
	PIXEL/REAL	0.998	0.987	−0.0111 [−0.0185, −0.0037]	0.998	0.987	−0.0109 [−0.0181, −0.0037]	0.004
	PATCH/REAL	1.000	0.986	−0.0138 [−0.0212, −0.0074]	1.000	0.986	−0.0137 [−0.0208, −0.0073]	<0.001
EffNet-B5	FAKE/REAL	0.958	0.936	−0.0212 [−0.0387, −0.0037]	0.958	0.935	−0.0230 [−0.0409, −0.0053]	0.027
	PIXEL/REAL	0.994	0.974	−0.0203 [−0.0304, −0.0101]	0.994	0.975	−0.0198 [−0.0297, −0.0099]	<0.001
	PATCH/REAL	0.996	0.971	−0.0249 [−0.0360, −0.0148]	0.996	0.972	−0.0244 [−0.0348, −0.0145]	<0.001
Swin-T	FAKE/REAL	0.962	0.981	+0.0185 [0.0074, 0.0295]	0.962	0.981	+0.0186 [0.0075, 0.0301]	0.002
	PIXEL/REAL	0.996	0.986	−0.0101 [−0.0185, −0.0028]	0.996	0.986	−0.0101 [−0.0182, −0.0027]	0.019
	PATCH/REAL	0.995	0.984	−0.0111 [−0.0194, −0.0037]	0.995	0.984	−0.0110 [−0.0192, −0.0036]	0.012
Satlas-Swin-B	FAKE/REAL	0.895	0.776	−0.1190 [−0.1467, −0.0913]	0.899	0.790	−0.1090 [−0.1344, −0.0838]	<0.001
	PIXEL/REAL	0.820	0.732	−0.0876 [−0.1153, −0.0600]	0.813	0.738	−0.0748 [−0.1022, −0.0481]	<0.001
	PATCH/REAL	0.804	0.706	−0.0978 [−0.1282, −0.0683]	0.807	0.704	−0.1025 [−0.1324, −0.0735]	<0.001
GeoRSCLIP- B/32	FAKE/REAL	0.915	0.901	−0.0138 [−0.0341, 0.0065]	0.917	0.903	−0.0141 [−0.0335, 0.0052]	0.210
	PIXEL/REAL	0.997	0.940	−0.0572 [−0.0720, −0.0434]	0.997	0.943	−0.0539 [−0.0669, −0.0413]	<0.001
	PATCH/REAL	0.998	0.941	−0.0572 [−0.0720, −0.0443]	0.998	0.944	−0.0539 [−0.0666, −0.0418]	<0.001

and

Table 18. External FSC performance after full fine-tuning with 200 images per class: attack-class AUPRC with paired bootstrap confidence intervals. $\Delta$ AUPRC is computed as Multi-E minus binary, where Multi-E uses the predicted probability assigned to the evaluated attack family; bracketed intervals are paired bootstrap 95% CIs for $\Delta$ AUPRC.

Model	Pair	AUPRC (Bin)	AUPRC (Multi-E)	$\mathbf{\Delta }$AUPRC [95% CI]
Swin-B	FAKE/REAL	0.999	0.999	+0.0000 [−0.0007, 0.0009]
	PIXEL/REAL	1.000	1.000	+0.0000 [−0.0000, 0.0000]
	PATCH/REAL	1.000	1.000	+0.0000 [0.0000, 0.0000]
EffNet-B5	FAKE/REAL	0.992	0.987	−0.0052 [−0.0103, −0.0003]
	PIXEL/REAL	1.000	1.000	+0.0000 [−0.0003, 0.0001]
	PATCH/REAL	1.000	1.000	−0.0001 [−0.0002, 0.0000]
Swin-T	FAKE/REAL	0.993	0.998	+0.0047 [0.0021, 0.0078]
	PIXEL/REAL	1.000	1.000	+0.0000 [−0.0001, 0.0001]
	PATCH/REAL	1.000	1.000	+0.0001 [0.0000, 0.0003]
Satlas-Swin-B	FAKE/REAL	0.960	0.960	+0.0004 [−0.0103, 0.0106]
	PIXEL/REAL	0.928	0.928	+0.0000 [−0.0117, 0.0114]
	PATCH/REAL	0.910	0.884	−0.0254 [−0.0425, −0.0083]
GeoRSCLIP- B/32	FAKE/REAL	0.974	0.969	−0.0048 [−0.0138, 0.0037]
	PIXEL/REAL	1.000	1.000	+0.0000 [−0.0001, 0.0000]
	PATCH/REAL	1.000	1.000	+0.0000 [−0.0000, 0.0001]

report the 200 images/class thresholded-metric and AUPRC results, respectively; and

Table 19. External FSC performance after full fine-tuning with 1000 images per class: thresholded metrics with paired bootstrap confidence intervals and McNemar tests. BA denotes balanced accuracy, $F{1}_A$ denotes attack-class F1, and $\Delta$ is computed as Multi-E minus binary, where Multi-E denotes exact-family multi-attack attribution scoring. Bracketed intervals are paired bootstrap 95% CIs for $\Delta$; McNemar’s test compares paired hard-decision correctness.

Model	Pair	BA (Bin)	BA (Multi-E)	$\mathbf{\Delta }$BA [95% CI]	$\mathit{F}{1}_{\mathit{A}}$ (Bin)	$\mathit{F}{1}_{\mathit{A}}$ (Multi-E)	$\mathbf{\Delta }$$\mathit{F}{1}_{\mathit{A}}$ [95% CI]	McNemar p
Swin-B	FAKE/REAL	0.995	0.998	+0.0028 [−0.0018, 0.0074]	0.995	0.998	+0.0028 [−0.0019, 0.0074]	0.453
	PIXEL/REAL	0.992	1.000	+0.0083 [0.0037, 0.0138]	0.992	1.000	+0.0084 [0.0037, 0.0140]	0.004
	PATCH/REAL	1.000	1.000	+0.0000 [0.0000, 0.0000]	1.000	1.000	+0.0000 [0.0000, 0.0000]	1.000
EffNet-B5	FAKE/REAL	0.985	0.980	−0.0055 [−0.0157, 0.0046]	0.985	0.980	−0.0057 [−0.0158, 0.0044]	0.377
	PIXEL/REAL	0.997	0.990	−0.0074 [−0.0148, −0.0009]	0.997	0.990	−0.0073 [−0.0144, −0.0009]	0.057
	PATCH/REAL	0.997	0.985	−0.0120 [−0.0203, −0.0046]	0.997	0.985	−0.0119 [−0.0200, −0.0046]	0.004
Swin-T	FAKE/REAL	0.989	0.987	−0.0018 [−0.0092, 0.0055]	0.989	0.987	−0.0017 [−0.0090, 0.0057]	0.804
	PIXEL/REAL	1.000	0.990	−0.0101 [−0.0166, −0.0046]	1.000	0.990	−0.0100 [−0.0163, −0.0046]	<0.001
	PATCH/REAL	0.997	0.985	−0.0120 [−0.0194, −0.0046]	0.997	0.985	−0.0119 [−0.0193, −0.0046]	0.002
Satlas-Swin-B	FAKE/REAL	0.964	0.875	−0.0895 [−0.1098, −0.0701]	0.965	0.883	−0.0816 [−0.0995, −0.0637]	<0.001
	PIXEL/REAL	0.847	0.809	−0.0378 [−0.0646, −0.0111]	0.846	0.810	−0.0357 [−0.0617, −0.0097]	0.007
	PATCH/REAL	0.814	0.815	+0.0009 [−0.0268, 0.0286]	0.827	0.817	−0.0100 [−0.0355, 0.0152]	1.000
GeoRSCLIP- B/32	FAKE/REAL	0.974	0.974	+0.0000 [−0.0111, 0.0101]	0.974	0.974	−0.0001 [−0.0109, 0.0100]	1.000
	PIXEL/REAL	0.997	0.986	−0.0111 [−0.0185, −0.0037]	0.997	0.986	−0.0109 [−0.0181, −0.0036]	0.008
	PATCH/REAL	0.996	0.985	−0.0111 [−0.0194, −0.0028]	0.996	0.985	−0.0109 [−0.0190, −0.0027]	0.012

and

Table 20. External FSC performance after full fine-tuning with 1000 images per class: attack-class AUPRC with paired bootstrap confidence intervals. $\Delta$ AUPRC is computed as Multi-E minus binary, where Multi-E uses the predicted probability assigned to the evaluated attack family; bracketed intervals are paired bootstrap 95% CIs for $\Delta$ AUPRC.

Model	Pair	AUPRC (Bin)	AUPRC (Multi-E)	$\mathbf{\Delta }$AUPRC [95% CI]
Swin-B	FAKE/REAL	1.000	1.000	+0.0000 [0.0000, 0.0001]
	PIXEL/REAL	1.000	1.000	+0.0000 [−0.0000, 0.0000]
	PATCH/REAL	1.000	1.000	+0.0000 [0.0000, 0.0000]
EffNet-B5	FAKE/REAL	0.999	0.999	−0.0006 [−0.0019, 0.0006]
	PIXEL/REAL	1.000	1.000	+0.0000 [−0.0000, 0.0000]
	PATCH/REAL	1.000	1.000	+0.0000 [−0.0001, 0.0000]
Swin-T	FAKE/REAL	1.000	1.000	+0.0000 [−0.0004, 0.0003]
	PIXEL/REAL	1.000	1.000	+0.0000 [−0.0000, 0.0000]
	PATCH/REAL	1.000	1.000	+0.0000 [−0.0000, 0.0001]
Satlas-Swin-B	FAKE/REAL	0.993	0.992	−0.0010 [−0.0040, 0.0023]
	PIXEL/REAL	0.940	0.965	+0.0252 [0.0142, 0.0358]
	PATCH/REAL	0.926	0.941	+0.0146 [0.0013, 0.0282]
GeoRSCLIP- B/32	FAKE/REAL	0.998	0.997	−0.0010 [−0.0026, 0.0005]
	PIXEL/REAL	1.000	1.000	+0.0000 [−0.0001, 0.0000]
	PATCH/REAL	1.000	1.000	+0.0000 [−0.0000, 0.0000]

report the 1000 images/class thresholded-metric and AUPRC results, respectively.

Table 21. Summary of adapted FSC detection and attribution scoring averaged over the 15 model–pair comparisons for each adaptation budget. Binary denotes specialized pairwise REAL/attack detection. Multi-C denotes collapsed multi-attack detection, where all non-REAL predictions are treated as manipulated. Multi-E denotes exact-family multi-attack attribution, where an attack example is counted as correct only if the predicted attack family matches the evaluated pair. $\Delta$ values are computed relative to binary, with paired bootstrap 95% confidence intervals over the 15 model–pair units. Dashes indicate the binary reference row, for which $\Delta$ is not applicable.

Shots/Class	Scoring	BA	$\mathbf{\Delta }$BA [95% CI]	$\mathit{F}{1}_{\mathit{A}}$	$\mathbf{\Delta }$$\mathit{F}{1}_{\mathit{A}}$ [95% CI]	AUPRC	$\mathbf{\Delta }$AUPRC [95% CI]
50	Binary	0.929	–	0.930	–	0.970	–
	Multi-C	0.889	−0.0399 [−0.0609, −0.0189]	0.896	−0.0344 [−0.0512, −0.0173]	0.958	−0.0127 [−0.0261, −0.0022]
	Multi-E	0.877	−0.0524 [−0.0806, −0.0261]	0.881	−0.0490 [−0.0740, −0.0258]	0.970	−0.0009 [−0.0064, 0.0036]
200	Binary	0.954	–	0.954	–	0.984	–
	Multi-C	0.927	−0.0268 [−0.0429, −0.0128]	0.931	−0.0237 [−0.0379, −0.0114]	0.974	−0.0096 [−0.0196, −0.0011]
	Multi-E	0.919	−0.0352 [−0.0556, −0.0171]	0.921	−0.0336 [−0.0528, −0.0165]	0.982	−0.0020 [−0.0058, 0.0004]
1000	Binary	0.970	–	0.971	–	0.990	–
	Multi-C	0.965	−0.0049 [−0.0188, 0.0063]	0.966	−0.0042 [−0.0171, 0.0068]	0.990	−0.0006 [−0.0052, 0.0030]
	Multi-E	0.957	−0.0124 [−0.0255, −0.0031]	0.958	−0.0124 [−0.0243, −0.0038]	0.993	+0.0025 [−0.0003, 0.0066]

then summarizes binary, collapsed multi-attack detection (Multi-C), and exact-family attribution (Multi-E) across the three adaptation budgets. This experiment is interpreted as a separate adapted-FSC comparison, rather than as a paired before/after comparison with the zero-adaptation FSC results in Table 12 and Table 13.

For the detailed model-level tables, paired confidence intervals for BA and $F{1}_A$ were computed using 10,000 paired stratified bootstrap replicates within each matched REAL/attack subset. For AUPRC, paired bootstrap intervals used 1000 replicates. McNemar’s test was applied to paired hard-decision correctness for the binary detector and the Multi-E prediction rule. In the summary table, confidence intervals are computed over the 15 model–pair units for each adaptation budget.

Figure 8 summarizes the limited-label adaptation trend using mean attack-class F1 across the five representative architectures. The model-level tables below provide the corresponding thresholded and rank-based results for each adaptation budget, followed by a summary separating collapsed detection from exact-family attribution. AUPRC is less discriminative after adaptation, especially for PIXEL and PATCH, because both detector formulations often rank the attack class nearly perfectly.

Table 21 separates the detection and attribution interpretations of the adapted FSC results. Multi-C provides the fairer comparison to binary REAL-versus-attack detection because all non-REAL predictions are treated as manipulated. Multi-E is stricter because it also requires the correct attack-family label. Across adaptation budgets, the binary detectors retain the strongest average thresholded BA and $F{1}_A$, but the gap narrows substantially as the FSC label budget increases. At 1000 images per class, Multi-C is nearly matched with the binary detectors, with mean differences of only −0.0049 BA and −0.0042 $F{1}_A$, and confidence intervals that include zero. Multi-E remains lower for thresholded BA and $F{1}_A$, indicating that exact attack-family attribution remains more difficult than collapsed manipulation detection. AUPRC differences are small after adaptation, showing that the adapted multi-attack models often rank manipulated examples competitively even when exact-family thresholded decisions remain harder.

Finally, these results allow us to separate three questions: (i) whether multi-attack training helps the matched pairwise task in-domain, (ii) whether any such advantage transfers to FSC without adaptation, and (iii) whether limited-label FSC fine-tuning changes the relative ranking between specialized binary detectors and multi-attack models.

In-domain matched-subset comparison. On the in-domain matched subsets, the specialized binary detectors generally provided the strongest pairwise REAL/attack performance across the five representative architectures. This indicates that training directly on a single binary decision boundary remains advantageous when the deployment distribution matches the training benchmark. The gap was most apparent for FAKE/REAL, where the multi-attack models tended to lose pairwise specificity, while PIXEL/REAL and PATCH/REAL were closer and showed occasional architecture-dependent exceptions. Overall, multi-attack training did not consistently improve in-domain pairwise detection, suggesting that the broader four-class objective trades some specialized binary discrimination for attack-family coverage.

FSC zero-adaptation transfer. Under direct transfer to FSC without adaptation, the specialized binary detectors continued to outperform the multi-attack models under exact-family scoring (Multi-E), while the collapsed Multi-C summary shows that part of this gap reflects wrong-family attribution rather than manipulation detection failure alone. Averaged over the five representative architectures and three attack pairs, binary detectors achieved higher balanced accuracy than Multi-E ($0.828$ vs. $0.777$) and higher attack-class F1 ($0.755$ vs. $0.678$), with a smaller but still favorable AUPRC advantage ($0.928$ vs. $0.901$). The largest transfer gap occurred for FAKE/REAL, where mean $F{1}_A$ dropped from $0.427$ for binary detectors to $0.273$ for Multi-E, indicating that external generative manipulations remain the most difficult family under distribution shift. PIXEL/REAL and PATCH/REAL transferred more reliably for both model types, but binary detectors still produced higher mean $F{1}_A$ than Multi-E on both pairs.

FSC limited-label full fine-tuning. Limited-label full fine-tuning substantially improved FSC performance for both specialized binary detectors and unified multi-attack models. Under exact-family scoring (Multi-E), the binary detectors retained the strongest average thresholded BA and $F{1}_A$ at all three adaptation budgets, but the gap narrowed as the FSC label budget increased. At 50 images/class, mean $F{1}_A$ was 0.930 for binary detectors and 0.881 for Multi-E. At 200 images/class, mean $F{1}_A$ was 0.954 for binary detectors and 0.921 for Multi-E. At 1000 images/class, the gap narrowed further, with mean $F{1}_A$ of 0.971 for binary detectors and 0.958 for Multi-E. The collapsed Multi-C results show that much of the remaining gap is attributable to attack-family attribution rather than manipulation detection alone: at 1000 images/class, Multi-C nearly matched the binary detectors, with mean differences of only −0.0049 BA and −0.0042 $F{1}_A$, and confidence intervals including zero. AUPRC differences were small after adaptation, indicating that the adapted multi-attack models often ranked manipulated examples competitively even when exact-family thresholded decisions remained harder.

RQ3 takeaway. Across RQ3, specialized binary detectors generally provided the strongest pairwise REAL/attack performance, especially in-domain and under zero-adaptation FSC transfer. However, the interpretation of the unified multi-attack model depends on the scoring mode. Collapsed scoring (Multi-C) evaluates the same high-level REAL-versus-manipulated decision as the binary detectors, whereas exact-family scoring (Multi-E) imposes the stricter requirement that the model also assign the correct manipulation family. Limited-label FSC fine-tuning substantially narrowed the gap. By 1000 images per class, Multi-C was nearly matched with the binary detectors for thresholded BA and $F{1}_A$, while Multi-E remained lower, showing that attribution remains harder than collapsed manipulation detection. Thus, binary detectors remain preferable when the target manipulation family is known and pairwise detection is the only objective, whereas unified multi-attack models offer a more flexible attribution-capable alternative that becomes increasingly competitive after target-domain adaptation.

5.4. RQ4: Deployment-Sensitive Training and Triage Behavior

5.4.1. Augmentation Severity

We evaluate how training-time augmentation severity affects four-class manipulation detection. This ablation is performed for the five representative architectures using three regimes: LightAug, MedAug, and HeavyAug. LightAug corresponds to the augmentation setting used in the main four-way benchmark and consists of random horizontal flipping with probability 0.5 and mild color jitter with brightness, contrast, and saturation set to 0.05. MedAug adds random vertical flipping with probability 0.5, increases brightness, contrast, and saturation jitter to 0.10, and applies Gaussian blur with probability 0.10 using kernel size 3 and $\sigma \in [0.1,0.8]$. HeavyAug further increases perturbation strength using brightness, contrast, and saturation jitter of 0.20, hue jitter of 0.05, random affine transformation with probability 0.30 using rotation $\pm {10}^{\circ }$, translation 0.05, scale range $[0.95,1.05]$, and shear 5, random perspective distortion with probability 0.20 and distortion scale 0.10, Gaussian blur with probability 0.25 using kernel size 5 and $\sigma \in [0.3,1.5]$, and additive Gaussian noise with standard deviation 0.01 after conversion to tensor. Validation and test images are not augmented.

Table 22. Augmentation severity study with bootstrap 95% confidence intervals. Accuracy, macro-F1, and per-class F1 are reported on the in-domain four-class test set. LightAug corresponds to the augmentation setting used in the main four-way benchmark. Values are point estimates with percentile bootstrap 95% CIs in brackets.

Model	Aug.	Acc. [95% CI]	Macro-F1 [95% CI]	REAL [95% CI]	PIXEL [95% CI]	PATCH [95% CI]	FAKE [95% CI]
Swin-B	LightAug	0.9776 [0.9747–0.9804]	0.9775 [0.9747–0.9802]	0.9577 [0.9521–0.9631]	0.9598 [0.9543–0.9650]	0.9952 [0.9933–0.9970]	0.9974 [0.9960–0.9987]
	MedAug	0.9772 [0.9744–0.9800]	0.9772 [0.9744–0.9799]	0.9571 [0.9515–0.9624]	0.9614 [0.9561–0.9665]	0.9937 [0.9916–0.9957]	0.9965 [0.9948–0.9980]
	HeavyAug	0.9085 [0.9031–0.9139]	0.9108 [0.9056–0.9159]	0.8474 [0.8376–0.8570]	0.8787 [0.8692–0.8883]	0.9718 [0.9671–0.9761]	0.9453 [0.9387–0.9514]
EffNet-B5	LightAug	0.9734 [0.9704–0.9765]	0.9734 [0.9704–0.9764]	0.9501 [0.9441–0.9559]	0.9534 [0.9476–0.9591]	0.9961 [0.9944–0.9978]	0.9941 [0.9920–0.9960]
	MedAug	0.9704 [0.9673–0.9735]	0.9704 [0.9672–0.9735]	0.9434 [0.9370–0.9496]	0.9466 [0.9405–0.9526]	0.9959 [0.9942–0.9976]	0.9956 [0.9937–0.9973]
	HeavyAug	0.9206 [0.9154–0.9256]	0.9219 [0.9170–0.9268]	0.8608 [0.8514–0.8699]	0.8844 [0.8750–0.8935]	0.9846 [0.9812–0.9879]	0.9578 [0.9522–0.9632]
Swin-T	LightAug	0.9677 [0.9644–0.9709]	0.9676 [0.9643–0.9709]	0.9413 [0.9349–0.9475]	0.9480 [0.9418–0.9538]	0.9866 [0.9835–0.9896]	0.9947 [0.9926–0.9965]
	MedAug	0.9659 [0.9624–0.9693]	0.9658 [0.9623–0.9691]	0.9373 [0.9304–0.9437]	0.9438 [0.9374–0.9499]	0.9877 [0.9846–0.9906]	0.9943 [0.9922–0.9963]
	HeavyAug	0.8895 [0.8837–0.8955]	0.8931 [0.8876–0.8988]	0.8157 [0.8055–0.8260]	0.8703 [0.8604–0.8802]	0.9395 [0.9327–0.9461]	0.9470 [0.9407–0.9532]
Satlas-Swin-B	LightAug	0.8946 [0.8889–0.9005]	0.8944 [0.8888–0.9002]	0.8218 [0.8106–0.8327]	0.8868 [0.8781–0.8955]	0.8828 [0.8739–0.8917]	0.9863 [0.9832–0.9894]
	MedAug	0.8936 [0.8878–0.8994]	0.8935 [0.8878–0.8991]	0.8206 [0.8095–0.8314]	0.8931 [0.8845–0.9016]	0.8758 [0.8663–0.8849]	0.9845 [0.9811–0.9876]
	HeavyAug	0.8441 [0.8373–0.8508]	0.8430 [0.8362–0.8497]	0.7426 [0.7295–0.7554]	0.8756 [0.8659–0.8851]	0.8159 [0.8045–0.8273]	0.9379 [0.9314–0.9443]
GeoRSCLIP	LightAug	0.9481 [0.9439–0.9522]	0.9479 [0.9438–0.9519]	0.9081 [0.9001–0.9159]	0.9016 [0.8932–0.9099]	0.9983 [0.9972–0.9993]	0.9835 [0.9800–0.9868]
	MedAug	0.9508 [0.9468–0.9548]	0.9507 [0.9467–0.9547]	0.9123 [0.9043–0.9200]	0.9063 [0.8979–0.9143]	0.9969 [0.9953–0.9982]	0.9875 [0.9844–0.9904]
	HeavyAug	0.8848 [0.8788–0.8907]	0.8837 [0.8778–0.8896]	0.8150 [0.8039–0.8258]	0.8098 [0.7979–0.8215]	0.9467 [0.9406–0.9526]	0.9634 [0.9582–0.9684]

reports accuracy, macro-F1, and per-class F1 with bootstrap 95% confidence intervals on the in-domain four-class test set. LightAug and MedAug are nearly tied for most models, indicating that moderate increases in augmentation strength do not substantially degrade in-domain detection. Swin-B achieves the strongest overall performance, with 0.9776 accuracy and 0.9775 macro-F1 under LightAug and 0.9772 accuracy and 0.9772 macro-F1 under MedAug. EfficientNet-B5 and Swin-T show the same pattern, with only small differences between LightAug and MedAug.

HeavyAug consistently reduces overall performance, but the degradation is class-dependent rather than a uniform collapse across all manipulation types. For example, HeavyAug reduces macro-F1 from 0.9775 to 0.9108 for Swin-B, from 0.9734 to 0.9219 for EfficientNet-B5, from 0.9676 to 0.8931 for Swin-T, from 0.8944 to 0.8430 for Satlas-Swin-B, and from 0.9479 to 0.8837 for GeoRSCLIP. The largest declines generally occur for REAL and PIXEL, while PATCH and FAKE often remain comparatively strong. This suggests that aggressive geometric, photometric, blur, and noise perturbations can reduce the separability of authentic and subtle pixel-level manipulations, even though localized patch and generative manipulation cues may remain detectable.

Overall, this experiment answers the augmentation component of RQ4: augmentation must be tuned to the scale and visual signature of the manipulation. Light and medium augmentation preserve useful invariances and maintain strong four-class performance, whereas heavy augmentation introduces enough distortion to reduce class separability, especially for authentic imagery and subtle pixel-level perturbations.

Confidence intervals were computed by nonparametric bootstrap resampling of held-out test examples with 10,000 replicates. The intervals quantify finite-test-sample uncertainty and do not capture variability from retraining or random initialization.

5.4.2. Low-Prevalence Triage Behavior

In operational screening, manipulated imagery may be rare relative to authentic imagery. Therefore, balanced four-way accuracy and per-class F1 do not fully capture deployment utility. A model can perform well on a balanced benchmark while still producing too many false alarms when deployed over large image streams. To evaluate this setting, we collapse the four-way model outputs into a binary manipulated-image triage score,

$$s_{\mathrm{manip}}=p\left(\mathrm{PIXEL}\right)+p\left(\mathrm{PATCH}\right)+p\left(\mathrm{FAKE}\right)=1-p\left(\mathrm{REAL}\right).$$

(12)

A sample is flagged as manipulated when $s_{\mathrm{manip}}$ exceeds a decision threshold. We evaluate this score under simulated manipulation prevalence levels of 1%, 5%, and 10%. For a threshold t, prevalence-adjusted precision is computed as

$${\mathrm{Precision}}_{\pi }\left(t\right)={\displaystyle \frac{\pi ·\mathrm{TPR}\left(t\right)}{\pi ·\mathrm{TPR}\left(t\right)+(1-\pi )·\mathrm{FPR}\left(t\right)}},$$

(13)

where $\pi$ is the assumed manipulation prevalence, $\mathrm{TPR}\left(t\right)$ is the manipulated-image recall, and $\mathrm{FPR}\left(t\right)$ is the false-positive rate on authentic imagery. For prevalence-adjusted AUPRC, we apply the same prevalence-adjusted precision calculation at each decision threshold and integrate the resulting precision-recall curve over recall. The expected number of false alarms per 10,000 screened images is computed as

$$(1-\pi )·\mathrm{FPR}\left(t\right)·10000.$$

(14)

Table 23. Low-prevalence triage evaluation using the collapsed manipulated-image score $s_{\mathrm{manip}}=1-p\left(\mathrm{REAL}\right)$ with bootstrap 95% confidence intervals. FSC post-adaptation rows use the checkpoints adapted with 200 labeled FSC images per class. AUPRC is prevalence-adjusted under 1% manipulation prevalence. Precision is reported at approximately 90% manipulated-image recall under simulated manipulation prevalence levels of 1%, 5%, and 10%. False alarms are reported as the expected number of false positives per 10,000 screened images under 1% manipulation prevalence. Bracketed intervals are percentile bootstrap 95% CIs.

Evaluation Setting	Model	AUPRC ($\mathit{\pi }=1\%$)	Precisionat 90% Recall ($\mathit{\pi }=1\%$)	Precisionat 90% Recall ($\mathit{\pi }=5\%$)	Precisionat 90% Recall ($\mathit{\pi }=10\%$)	False Alarmsper 10,000 ($\mathit{\pi }=1\%$)
In-domain	Swin-B	0.947 [0.933–0.960]	0.831 [0.711–0.961]	0.963	0.982	18.3 [3.7–36.5]
	EffNet-B5	0.943 [0.930–0.957]	0.860 [0.755–1.000]	0.970	0.985	14.6 [0.0–29.2]
	Swin-T	0.939 [0.929–0.949]	0.779 [0.672–0.961]	0.948	0.975	25.6 [3.7–43.8]
	Satlas-Swin-B	0.744 [0.715–0.773]	0.092 [0.079–0.105]	0.345	0.526	891.4 [767.2–1044.8]
	GeoRSCLIP-B/32	0.870 [0.844–0.895]	0.435 [0.344–0.540]	0.800	0.894	116.9 [76.7–171.7]
FSC pre-adaptation	Swin-B	0.668 [0.653–0.686]	0.027 [0.025–0.029]	0.126	0.233	3254.9 [3017.5–3455.9]
	EffNet-B5	0.589 [0.553–0.630]	0.016 [0.015–0.017]	0.079	0.153	5501.6 [5260.4–5863.3]
	Swin-T	0.614 [0.591–0.638]	0.017 [0.016–0.018]	0.084	0.162	5118.0 [4858.7–5370.2]
	Satlas-Swin-B	0.084 [0.067–0.128]	0.013 [0.012–0.013]	0.063	0.124	6977.5 [6721.8–7236.9]
	GeoRSCLIP-B/32	0.525 [0.500–0.559]	0.015 [0.014–0.016]	0.073	0.143	5943.7 [5644.0–6170.1]
FSC post-adaptation	Swin-B	0.978 [0.966–0.992]	1.000 [1.000–1.000]	1.000	1.000	0.0 † [0.0–0.0]
	EffNet-B5	0.924 [0.901–0.954]	0.711 [0.496–1.000]	0.928	0.964	36.5 [0.0–91.3]
	Swin-T	0.983 [0.977–0.991]	1.000 [1.000–1.000]	1.000	1.000	0.0 † [0.0–0.0]
	Satlas-Swin-B	0.430 [0.401–0.476]	0.020 [0.017–0.023]	0.097	0.185	4365.5 [3835.8–5059.6]
	GeoRSCLIP-B/32	0.854 [0.805–0.908]	0.291 [0.206–0.552]	0.682	0.819	219.2 [73.1–347.0]

^† Zero false positives were observed at the selected operating point. Because ordinary bootstrap resampling preserves this zero-FP observation, the false-alarm CI is degenerate; for the FSC post-adaptation rows with 542 REAL examples, the exact one-sided 95% upper bound corresponds to 54.6 false alarms per 10,000 screened images at $\pi =1\%$.

reports the main operating point at approximately 90% manipulated-image recall. The in-domain and FSC pre-adaptation evaluations use 2710 images per class, while the FSC post-adaptation evaluation uses 542 images per class. The FSC post-adaptation triage rows use the checkpoints adapted with 200 labeled FSC images per class.

Confidence intervals were computed by nonparametric bootstrap resampling of held-out test examples with 2000 replicates, with the 90% recall operating point recomputed within each bootstrap sample.

The in-domain results show that the strongest balanced-benchmark models also provide useful low-prevalence screening behavior when the test distribution matches the training benchmark. At 1% manipulation prevalence and approximately 90% manipulated-image recall, EffNet-B5 achieves the strongest in-domain triage performance, with expected precision of 0.860 and 14.6 false alarms per 10,000 screened images. Swin-B performs similarly, with expected precision of 0.831 and 18.3 false alarms per 10,000 screened images. Swin-T remains competitive but produces a higher false-alarm burden. In contrast, GeoRSCLIP-B/32 and Satlas-Swin-B show substantially weaker triage behavior, indicating that strong four-way classification performance does not necessarily imply low false-positive burden under low-prevalence screening.

External FSC transfer without adaptation is much less reliable. At 1% manipulation prevalence and approximately 90% recall, all pre-adaptation FSC models have expected precision below 0.03 and produce thousands of false alarms per 10,000 screened images. This result indicates that direct external transfer is insufficient for operational triage, even when a model retains partial ranking ability under balanced evaluation. Under domain shift, the manipulated-image score is poorly calibrated for high-recall screening and assigns high manipulation scores to many authentic images.

FSC target-domain adaptation with 200 labeled images per class substantially improves triage behavior for several architectures. Swin-B and Swin-T produce no observed false positives at the selected 90% recall operating point on the held-out FSC post-adaptation test set, yielding expected precision of 1.000 under the simulated prevalence levels. Because the post-adaptation test set contains 542 authentic images, this should be interpreted as zero false positives observed on the held-out sample rather than as evidence of a zero false-positive rate in deployment. EffNet-B5 also improves substantially after adaptation, reaching expected precision of 0.711 at 1% prevalence with 36.5 false alarms per 10,000 screened images. GeoRSCLIP-B/32 improves relative to the pre-adaptation setting but remains less suitable for low-prevalence screening, while Satlas-Swin-B continues to produce a high false-alarm burden.

Overall, the triage analysis shows that balanced benchmark performance and deployment utility are not equivalent. In-domain, the strongest models can support high-recall screening with manageable false-alarm rates. Under external FSC shift, however, unadapted models produce too many false positives for low-prevalence deployment. Target-domain adaptation is therefore important not only for improving class-wise accuracy, but also for making the manipulated-image score usable as an operational triage signal.

6. Discussion

This study is designed as a characterization benchmark rather than a new detector proposal. By controlling base imagery for REAL, PIXEL, and PATCH and evaluating multiple manipulation families under a shared protocol, we isolate where modern vision architectures rely on transferable manipulation cues and where they fail under subtle, source-shifted, externally shifted, or deployment-sensitive conditions.

In practical terms, the benchmark asks whether a model can support two related but distinct analyst tasks: first, flagging an image as potentially manipulated, and second, identifying the likely manipulation family. These objectives lead to different deployment choices. A binary detector may be preferable when a specific threat family is known in advance, because it can specialize in one REAL/attack boundary. A unified multi-attack detector is more useful when an analyst needs one triage system that also provides an attribution cue, but this added flexibility makes exact attack-family attribution harder under distribution shift.

First, the dominant in-domain confusion boundary is REAL↔PIXEL. Across the 20-model benchmark, the strongest architectures achieve high overall 4-way performance, but the weakest per-class results are concentrated in REAL and PIXEL. This indicates that the main challenge is not broad confusion among all manipulation families, but a specific ambiguity between authentic imagery and sparse, low-amplitude perturbations. This is operationally important because pixel-level attacks are precisely the cases most likely to resemble natural acquisition noise, compression artifacts, or benign sensor variation. Future systems may therefore require pixel-sensitive auxiliary heads, uncertainty-aware thresholds, or calibration procedures targeted specifically at the REAL/PIXEL boundary.

The main practical takeaways from these findings are summarized in

Table 24. Practical interpretation of the main findings.

Finding	Practical Meaning
REAL/PIXEL is the hardest boundary	Subtle perturbations can resemble normal sensor, compression, or processing noise.
FAKE works in-domain but fails under source shift	Fake-image detectors must be tested on unseen generators and localized edits, not only matched synthetic sources.
PATCH transfers better than PIXEL	Localized structured artifacts are easier to recognize across shape changes than sparse pixel changes across perturbation budgets.
Binary models outperform for known attacks	Use specialized detectors when the threat family is known in advance.
Triage depends on prevalence	Balanced accuracy is not enough for deployment; low-prevalence screening must report precision and false-alarm burden.

.

Second, in-domain FAKE separability does not imply generator-robust FAKE detection. In the main four-way benchmark, FAKE is generally the easiest class because training and test data share the same FAKE subtype distribution. However, the FAKE label is heterogeneous: StyleGAN2, GeoSynth, and inpainting differ in image-formation process, spatial extent, and artifact structure. High matched-source FAKE performance should therefore not be interpreted as evidence that the models learn a semantic concept of manipulated imagery. Instead, it may partly reflect generator-specific or source-specific artifacts. The leave-one-method-out experiment confirms this concern: held-out inpainting is especially difficult, and when localized generative edits are excluded from training, models overwhelmingly classify them as REAL. For geospatial forensics, this finding argues against treating FAKE as a single homogeneous manipulation family. Robust FAKE detection should include both global synthetic imagery and localized edit mechanisms during training and evaluation, and future systems may need mask-aware training, weak localization objectives, or patch-level evidence aggregation to avoid diluting small edited regions within otherwise authentic imagery.

Third, attack-variant generalization is asymmetric across manipulation families. The PIXEL and PATCH stress tests show that high in-domain performance can hide sensitivity to attack parameters. PATCH recognition transfers well to an unseen square-patch geometry for most models, with four of the five representative architectures achieving PATCH recall above 0.98. In contrast, PIXEL recognition is highly budget-sensitive. Under the lower $B=50$ setting, PIXEL recall falls to 0.5672–0.7321 across models, and 25.28–34.39% of PIXEL samples are misclassified as REAL. Under the higher $B=400$ setting, PIXEL recall recovers substantially for all models. This indicates that localized patch artifacts transfer more readily across shape variation than sparse pixel-level perturbations transfer across perturbation magnitude.

Fourth, specialized binary detectors remain stronger for pairwise REAL/attack decisions, while unified multi-attack models provide broader attribution capability. The binary-versus-multi comparison shows that dedicated REAL/FAKE, REAL/PIXEL, and REAL/PATCH detectors usually outperform the corresponding multi-attack models when evaluation is restricted to the same pairwise task. This pattern holds in-domain and under zero-adaptation FSC transfer, with the largest weaknesses appearing for FAKE under external distribution shift. Limited-label FSC fine-tuning with 50, 200, and 1000 images per class narrows this gap as the adaptation budget increases. At the largest adaptation budget, multi-attack models become competitive in several model-pair settings and slightly exceed binary detectors in mean AUPRC, although binary detectors retain a modest average advantage for thresholded pairwise metrics. The practical implication is that model choice should depend on the deployment objective: binary specialists are preferable when the target manipulation family is known, whereas unified models are useful when analysts need a single screening system that can also assign a likely manipulation family.

Fifth, augmentation severity primarily affects REAL/PIXEL separability rather than all manipulation classes equally. LightAug and MedAug produce nearly identical performance for most models, suggesting that moderate augmentation can preserve useful invariances without damaging manipulation cues. HeavyAug consistently reduces overall performance, but the degradation is class-dependent. The largest declines generally occur for REAL and PIXEL, while PATCH and FAKE often remain comparatively strong. This finding cautions against blindly importing aggressive augmentation recipes from standard image classification into forensic or manipulation-screening tasks, where the discriminative signal may be subtle and localized. In this benchmark, overly strong augmentation mainly reduces the separability of authentic imagery and low-budget pixel-level perturbations.

Finally, low-prevalence triage changes the operational interpretation of model performance. Balanced accuracy and per-class F1 are useful for controlled benchmarking, but they do not determine whether a detector is usable in a screening pipeline where manipulated imagery is rare. The triage experiment shows that in-domain EffNet-B5 and Swin-B can support high-recall screening with manageable false-alarm rates at 1% prevalence, producing 14.6 and 18.3 expected false alarms per 10,000 screened images, respectively. However, zero-adaptation FSC transfer is not operationally viable under the same low-prevalence condition: all pre-adaptation FSC models have expected precision below 0.03 at approximately 90% recall and produce thousands of false alarms per 10,000 screened images. FSC target-domain adaptation using 200 labeled images per class substantially improves the triage profile for several architectures. Swin-B and Swin-T produce no observed false positives at the selected operating point on the held-out FSC post-adaptation test set, while EfficientNet-B5 reaches 0.711 expected precision at 1% prevalence with 36.5 expected false alarms per 10,000 screened images. These zero-false-positive operating points should be interpreted as encouraging but sample-limited, since the post-adaptation test set contains 542 authentic images. Overall, the triage results show that target-domain adaptation is important not only for improving class-wise accuracy, but also for making the manipulated-image score usable as an operational screening signal.

Limitations. This study focuses on RGB imagery and does not evaluate multispectral, hyperspectral, or SAR modalities. The manipulation families are representative but not exhaustive; additional threats such as object insertion, object removal, splicing, cloud-based attacks, compression-aware attacks, and physically realized adversarial artifacts should be considered in future benchmarks. The PIXEL and PATCH stress tests evaluate five representative architectures rather than the full 20-model zoo. Finally, although FSC provides an external-domain test, broader evaluation across sensors, geographic regions, resolutions, and image-processing pipelines is needed before drawing conclusions about operational deployment.

Future work. Future work should extend the benchmark across additional sensors and manipulation families, evaluate calibration and uncertainty-aware triage, and explore hybrid systems that combine unified multi-attack attribution with specialized binary heads for high-risk manipulation families. Another promising direction is to develop training protocols that explicitly balance in-domain separability, source-shift generalization, low-budget perturbation sensitivity, and low-prevalence precision.

7. Conclusions

We presented a controlled benchmark for characterizing adversarial and generative manipulation families in geospatial imagery. Across 20 modern vision architectures, the main in-domain failure boundary was REAL↔PIXEL, indicating that sparse pixel-level perturbations remain difficult to distinguish from authentic imagery. FAKE and PATCH were generally more separable in the matched benchmark, but FAKE leave-one-method-out testing showed that high in-domain FAKE performance can hide severe generator-shift failures, especially for localized inpainting.

The attack-variant stress tests showed that generalization differs substantially by manipulation family. PATCH detection transferred well to an unseen square-patch style for most evaluated models, whereas PIXEL detection was strongly budget-sensitive: the lower $B=50$ setting produced many more PIXEL→REAL missed detections than the higher $B=400$ setting. The augmentation study further showed that training time transformations must be matched to the scale of the manipulation. Light and medium augmentation maintained strong performance, while heavy augmentation mainly reduced REAL/PIXEL separability.

The comparison between specialized binary detectors and unified multi-attack models showed a clear tradeoff. Binary specialists usually achieved stronger pairwise REAL/attack performance, including under external FSC transfer, while unified models provided a single attribution-capable detector that became more competitive as the FSC adaptation budget increased. The low-prevalence triage experiment showed why this distinction matters operationally: strong balanced benchmark results do not guarantee acceptable false-alarm behavior under external domain shift. Unadapted FSC models produced very low precision and thousands of expected false alarms per 10,000 screened images at 1% manipulation prevalence, whereas FSC target-domain adaptation with 200 labeled images per class substantially improved triage behavior for several architectures. Together, these findings suggest that reliable geospatial manipulation screening requires evaluation beyond balanced in-domain accuracy, including source-shift tests, attack-variant tests, external-domain transfer, adaptation behavior, augmentation sensitivity, and low-prevalence triage metrics.