Multi-Scale Image Tampering Localization and Cross-Modal Evidence Consistency Verification for Judicial Digital Forensics

2.1 Overall framework overview

The structure-semantic collaborative evidence reasoning framework proposed in this paper integrates tampering localization and cross-modal verification into a unified closed-loop optimization system, rather than treating them as sequentially executed independent procedures.

Figure 1 provides an overview of the unified framework for structure-semantic collaborative evidence reasoning.

image003.png

Figure 1. Overview of the unified framework for structure-semantic collaborative evidence reasoning

Let the input judicial evidence image be $I \in \mathrm{R}^{3 \times H \times W}$, the associated case description text be $T$ (containing $L$ tokens), and the metadata be $M$. The goal of the framework is to output a triple evidentiary result: a pixel-wise tampering probability mask $\widehat{Y} \in[0,1]^{H \times W}$, a confidence heatmap $C \in[0,1]^{H \times W}$, and a cross-modal consistency score $\rho \in [0,1]$. To achieve this goal, the framework constructs a complete forward path from visual encoding to semantic alignment and finally to uncertainty decoding. Its core design principle is to enable visual representations and semantic logic to mutually constrain each other through iterative interaction.

In the visual encoding stage, image $I$ is decomposed via a 2D discrete wavelet transform into a low-frequency approximation component and three high-frequency detail components. After channel dimension upscaling on each frequency band, the features are fed into $K=4$ scales of DSPUs. By extending deformable convolution, this unit learns spatial offsets, scale modulation factors, and amplitude gating for each sampling point, allowing the receptive field to adaptively adjust according to the scale characteristics of tampered regions. Subsequently, a CSFA module computes a non-rigid offset field to accurately warp high-level semantic features onto the spatial grid of low-level features. After bidirectional propagation (top-down and bottom-up), the visual evidence tensor $V \in \mathrm{R}^{C_v \times H \times W}$ is output, where $C_v=256$. In the semantic encoding branch, the text $T$ is mapped to a token sequence $\left(T \in \mathrm{R}^{L \times C_t}, C_t=512\right)$ via a frozen CLIP text encoder. The metadata $M$ is projected into a structured vector $M \in \mathrm{R}^{C_m}$ via a multi-layer perceptron and concatenated with $T$ along the sequence dimension to form a comprehensive semantic anchor $S \in \mathrm{R}^{(L+1) \times C_t}$.

The key to achieving a visual-semantic bidirectional closed loop lies in the evidence mutual-feedback gating module. This module computes the gating matrices from vision to semantics and from semantics to vision, respectively:

$G_{v \rightarrow s}=\sigma\left(\operatorname{Conv}_{1 \times 1}(V) \otimes S^{\top}\right), G_{s \rightarrow v}=\sigma\left(S \otimes\right.$ Flatten $\left.(V)^{\top}\right)$   (1)

where, $\sigma$ is the Sigmoid function, $\otimes$ denotes batch matrix multiplication, and $\operatorname{Conv}_{1 \times 1}$ compresses the channels of the visual tensor to match the semantic space dimension. $G_{v \rightarrow s} \in \mathrm{R}^{H W \times(L+1)}$ maps salient visual regions to the semantic space to enhance the response of relevant textual features, while $G_{s \rightarrow v} \in \mathrm{R}^{(L+1) \times H W}$ utilizes textual logic constraints to generate a spatial attention mask that suppresses visual noise. The fused feature tensor $F_{\text {fus}}$ is obtained via a residual connection:

$F_{\text {fus}}=V \oplus U p$ Sample $\left(G_{s \rightarrow v} \odot S_{\text {proj}}\right)$   (2)

where, $S_{\text {proj}} \in \mathrm{R}^{C_v \times H \times W}$ is the result of projecting semantic features into the visual space, ⊙ denotes element-wise weighting, and $\oplus$ denotes additive fusion. This design ensures that during backpropagation, the visual feature extractor not only receives gradients from the segmentation loss but also receives constraints from the contrastive loss via a GRL. The forward propagation remains an identity mapping, while during backpropagation, the gradient is multiplied by $-\lambda_{g r l}$, forcing the visual encoder to discard responses irrelevant to the textual logic. The fused feature $F_{\text {fus}}$ is fed into a decoder equipped with Bayesian convolutional layers. Through multiple Monte Carlo stochastic forward passes, the mean and variance of the tampering probability are output, which are then used to generate the aforementioned triple evidentiary outputs, providing actionable trustworthiness grounds for subsequent judicial evidence examination.

2.2 Dynamic frequency-spatial multi-scale collaborative perception mechanism

Traces of image tampering exhibit distinct distribution characteristics in the spatial and frequency domains: splicing operations often leave semantic inconsistencies in low-frequency approximation components, while copy-move or inpainting retouching exposes textural anomalies in high-frequency detail components. Single-scale spatial cues struggle to simultaneously cover large-scale structural dissonance and minute edge discontinuities; thus, multi-scale frequency-spatial joint perception becomes an intrinsic requirement for tampering localization. However, simply upsampling and adding multi-scale feature maps suffers from significant drawbacks: on one hand, geometric misalignment exists between different scale features, and direct fusion introduces artifacts and blurs tampering boundaries; on the other hand, shallow high-resolution features are rich in spatial details but lack semantic selectivity, while deep low-resolution features encode semantic information but lose spatial precision. The effective fusion of their complementary information necessitates a dynamic mechanism capable of simultaneously coordinating receptive fields, spatial positions, and feature magnitudes. To this end, this paper constructs a collaborative perception pipeline comprising three progressive components: frequency domain decomposition and initialization, DSPUs, and a CSFA module. Figure 2 illustrates the network structure of the dynamic frequency-spatial multi-scale collaborative perception mechanism.

image027.png

Figure 2. Network structure of the dynamic frequency-spatial multi-scale collaborative perception mechanism

The input image is decomposed via a 2D discrete wavelet transform into a lowfrequency approximation component $F_{L L}$ and three high-frequency detail components $F_{L H}, F_{H L}$, and $F_{H H}$, where the high-frequency components correspond to edge and texture information in the horizontal, vertical, and diagonal directions, respectively. Compared to direct downsampling in RGB space, frequency domain decomposition offers the advantage of separating image content from noise textures into different subbands, enabling the subsequent network to specifically learn tampering artifact patterns on different frequency bands. After applying independent convolutional layers for channel upscaling on each frequency band, an initial multi-scale feature group $\left\{X^0, X^1, X^2, X^3\right\}$ is constructed, corresponding to the original scale, half scale, quarter scale, and one-eighth scale, respectively. The rationale for maintaining four progressive scales is that the relative size span of tampered objects within an image is vast: largearea spliced objects require a large-scale receptive field to capture their semantic inconsistency, while fine inpainting boundaries often manifest only as weak phase anomalies in the high-frequency sub-bands at the one-eighth scale.

DSPU extends the modeling capability of deformable convolution. Standard deformable convolution learns spatial offsets $\Delta p_k$ for each sampling point to adapt the convolution kernel shape to target geometric variations, but the contribution weight of each sampling point is fixed and cannot be dynamically adjusted based on local scale features of the tampering. This unit additionally introduces two learnable factors: a scale modulation factor $\Delta m_k \in(0,1)$ and an amplitude gate $\Delta a_k \in(0,2)$. For the feature map $X^s$ at the $s$-th scale, the convolution response at output position $p$ is defined as:

$Y^s(p)=\sum_{k=1}^K w_k \cdot X^s\left(p+p_k+\Delta p_k\right) \cdot \Delta m_k \cdot \Delta a_k$   (3)

where, $K$ is the total number of convolution kernel sampling points, $w_k$ is the fixed convolution weight, and $p_k$ is the preset offset of the $k$-th sampling point. The offset $\Delta p_k$, modulation factor $\Delta m_k$, and amplitude gate $\Delta a_k$ are all dynamically regressed by a lightweight sub-network $\Phi$ from the channel concatenation of the current scale feature $X^s$ and the upsampled feature $U\left(X^{s+1}\right)$ from the adjacent scale. The physical interpretation of this design is clear: large-area splicing tampering requires a larger receptive field, in which case the sub-network tends to output larger $\Delta p_k$ and an amplitude gate greater than 1 to enhance the response; conversely, minute textural tampering requires a narrow receptive field and high-frequency suppression, corresponding to smaller offsets and amplitude modulation less than 1. It is worth noting that $\Delta m_k$ and $\Delta a_k$ are decoupled during training; the former controls the effective contribution range of the sampling point, while the latter adjusts the overall scaling of the feature magnitude. Together, they enable the convolution kernel to adaptively adjust its geometric structure and response intensity according to the spatial scale characteristics of the tampered region.

The CSFA module aims to resolve the geometric misalignment between feature maps of different scales. Directly upsampling high-level features and adding them to low-level features blurs tampering boundaries due to spatial misalignment. Particularly when tampered regions have irregular shapes, artifacts introduced by simple addition severely impact boundary localization accuracy. This module introduces a non-rigid alignment field, predicting a 2D offset vector $\delta(p) \in \mathrm{R}^2$ for each target position $p$ on the current layer feature map, allowing the high-level semantic feature $F^{l+1}$ to be precisely warped onto the spatial grid of the low-level feature $F^l$. The offset is implicitly learned by maximizing local cross-correlation, and the forward warping operation employs a differentiable bilinear sampling mechanism:

$F_{\text {warp}}^{l+1}(p)=\sum_{q \in N(p+\delta(p))} F^{l+1}(q) \cdot \max \left(0,1-\left|p_x+\delta_x(p)-q_x\right|\right) \cdot \max \left(0,1-\left|p_y+\delta_y(p)-q_y\right|\right)$    (4)

where, $N(p+\delta(p))$ denotes the neighborhood grid centered at the offset position, $q_x$ and $q_y$ are the spatial coordinates of the sampling points within the neighborhood. This equation essentially performs linear interpolation based on the sub-pixel distance between the offset position and the neighborhood grid points, allowing gradients to be backpropagated through $\delta(p)$ to the offset prediction sub-network, thereby enabling end-to-end learning. After feature alignment, a gated fusion strategy is adopted to update the current layer representation:

$F_{\text {align}}^l=\operatorname{Conv}\left(\left[F^l, F_{\text {warp}}^{l+1}\right]\right) \odot \sigma\left(\operatorname{Conv}_{\text {gate}}\left(\left[F^l, F_{\text {warp}}^{l+1}\right]\right)\right)$   (5)

where, [ , ] denotes channel concatenation, $\sigma$ is the Sigmoid function, $Conv_{gate}$ outputs a spatial gating mask with a single channel, and ⊙ denotes element-wise multiplication. This gating mechanism allows the network to adaptively determine the fusion intensity at each spatial position based on alignment quality: the gating value approaches 1 where alignment is reliable, and approaches 0 where alignment is unreliable.

After completing two iterations each of top-down and bottom-up bidirectional propagation, the features across the four scales gradually converge to a shared spatial coordinate system through the alignment and fusion processes. The final output visual evidence tensor $V \in \mathrm{R}^{C_v \times H \times W}$ encodes a multi-scale joint representation of both low-frequency semantic consistency and high-frequency textural anomalies along the channel dimension, providing an information-complete visual foundation for subsequent cross-modal semantic alignment and uncertainty decoding.

2.3 Cross-modal evidence consistency verification module

A tampering localization mask can only answer where an image has been modified, whereas the core requirement in judicial forensics lies in determining whether the tampered content is compatible with the factual case description. The key challenge in this cross-modal verification task is the alignment gap between the representation spaces of visual localization results and textual semantic descriptions: visual features encode pixel-level texture and structural information, while textual features encode abstract concepts and relational descriptions. Their alignment requires not only spatial correspondence at the perceptual level but also logical matching at the semantic level. To this end, this paper constructs a cross-modal verification module indexed by visual anchors, comprising three collaborative components: declarative-evidence joint attention, hierarchical tampering contrastive learning, and gradient reversal closed-loop feedback. This design aims to mutually constrain visual representations and semantic logic within a unified latent space, ultimately outputting a quantifiable evidence consistency score. Figure 3 illustrates the principle of the cross-modal evidence consistency verification module.

image056.png

Figure 3. Schematic diagram of the cross-modal evidence consistency verification module

The core design of the declarative-evidence joint attention mechanism lies in utilizing the spatial prior mask provided by intermediate layers of the tampering localization head to guide the focusing process of textual features within the visual space. Let the intermediate activation map from the visual segmentation head be thresholded into a binary mask and then smoothed via Gaussian blur to generate the spatial prior mask $M_{g e o} \in[0,1]^{H \times W}$. This mask reflects the model's current pixel-wise confidence regarding whether a specific location belongs to a tampered region. During cross-modal attention computation, this mask is injected as an additive bias into the dot-product similarity between the query and key:

$Attn_{\text {cross}}=\operatorname{Softmax}\left(\frac{Q \cdot T^{\top}}{\sqrt{d}}+\log \left(M_{\text {geo}}+\epsilon\right)\right)$   (6)

where, $Q \in \mathrm{R}^{H W \times d}$ is the query matrix obtained by linearly projecting the visual features, $T \in \mathrm{R}^{L \times d}$ is the key matrix obtained by linearly projecting the textual token sequence, $d$ is the dimension of the attention head, and $\epsilon=10^{-8}$ is a constant to prevent the logarithm from approaching negative infinity. The additive bias term $\log \left(M_{\text {geo}}+\epsilon\right)$ transforms the spatial prior into a multiplicative modulation of the attention weights: when a location is classified as a high-suspicion region, the bias term approaches 0, and the attention weight is primarily driven by visual-semantic similarity; when a location is classified as a low-suspicion region, the bias term approaches negative infinity, and the corresponding attention weight is forcibly suppressed. This design enables the text encoder to focus its limited computational resources on semantic descriptions related to tampered regions, rather than distributing them uniformly across all spatial positions of the entire image.

Hierarchical tampering contrastive learning establishes multi-level semantic alignment constraints ranging from the global scene to local objects, addressing the need for evidence consistency discrimination at different granularities. The global level uses the matching of complete image features with the full case description as a basic constraint to ensure overall semantic consistency. The local level utilizes dependency parsing to extract noun phrases describing the modified object from the case description, forming positive sample pairs with the pooled features of the corresponding tampered regions in the visual branch. In cross-level hard negative mining, the tampered region feature of one sample within the same batch and the irrelevant description of another sample constitute a strong negative pair. The dynamic hard example mining loss for the latter is defined as:

$L_{\text {hard}}=-\frac{1}{B} \sum_{i=1}^B \log \frac{\exp \left(\operatorname{sim}\left(v_i^{\text {tam}}, t_i^{\text {desc}}\right) / \tau\right)}{\exp \left(\operatorname{sim}\left(v_i^{\text {tam}}, t_i^{\text {desc}}\right) / \tau\right)+\sum_{j \in H_i} \exp \left(\operatorname{sim}\left(v_i^{\text {tam}}, t_j^{\text {desc}}\right) / \tau\right)}$   (7)

where, $B$ is the batch size, $v_i^{\text {tam}} \in \mathrm{R}^{C_v}$ is the global feature of the tampered region of the $i$-th sample after adaptive pooling, $t_i^{\text {desc}} \in \mathrm{R}^{C_t}$ is the feature of the phrase corresponding to the tampered object in the case description after encoding by the text encoder, sim( , ) denotes cosine similarity, and $\tau$ is a temperature hyperparameter. $H_i$ is the set of indices for negative samples whose feature similarity to sample $i$ ranks in the top $K_{\text {hard}}$. This dynamic screening strategy forces the model to not only distinguish explicitly different sample pairs but also focus on hard samples with ambiguous semantic boundaries, thereby learning more discriminative cross-modal alignment representations.

GRL acts as a bidirectional information gate between the visual encoder and the semantic encoder, serving as the core hub for achieving closed-loop optimization between localization and verification. During forward propagation, the GRL performs an identity mapping, allowing semantic and visual features to interact seamlessly in attention computations. During backpropagation, however, it multiplies the gradient of the contrastive loss $L_{\text {contra}}$ with respect to the semantic branch parameter $\theta_{\text {sem}}$ by a negative coefficient before passing it to the visual branch parameter $\theta_{\text {vis}}$, specifically:

$\frac{\partial L_{\text {contra}}}{\partial \theta_{\text {vis}}}=-\lambda_{\text {grl}} \cdot \frac{\partial L_{\text {contra}}}{\partial \theta_{\text {sem}}}, \lambda_{\text {grl}}(t)=\min \left(0.1,0.1 \cdot t / T_{\text {warmup}}\right)$   (8)

where, $\lambda_{g r l}$ is the reversal strength coefficient, which linearly increases from 0 to 0.1 during the warmup phase and then remains constant. This gradient reversal operation subjects the visual feature extractor to adversarial constraints from the semantic branch: if the visual features contain spurious responses irrelevant to the case description, the gradient generated by the cross-modal contrastive loss in the semantic branch, after reversal, will act in the direction of increasing the response intensity in the visual branch, thereby increasing the total loss. This forces the visual encoder to gradually discard feature responses unrelated to the textual logic. Together, these three components form a co-evolution mechanism where localization serves verification and verification feeds back to localization, allowing tampering localization and cross-modal verification to mutually promote each other during joint training.

2.4 Boundary-aware uncertainty learning and interpretable output

In judicial forensics scenarios, if the prediction results of a deep learning model are presented merely as binary masks without quantitative explanations of the model’s own judgment reliability, they are difficult to admit as valid forensic support. Forensic examiners require not only the spatial location of tampered regions but also a clear understanding of the model’s prediction confidence for those regions and the geometric accuracy of boundary localization. To this end, this paper introduces variational Bayesian approximation in the decoding stage to quantify predictive uncertainty, designs boundary-aware loss constraints to enhance the localization accuracy of tampered region boundaries, and ultimately generates a triple output comprising a tampering mask, a confidence heatmap, and a consistency score. Figure 4 illustrates the schematic of uncertainty decoding and boundary-aware output.

image076.png

Figure 4. Schematic of uncertainty decoding and boundary-aware output

Bayesian convolutional layers are adopted in the last three convolutional layers of the decoder, imposing a Gaussian prior $w \sim N\left(0, \sigma_p^2 I\right)$ on the weight parameters, where, $\sigma_p^2$ is the hyperprior variance used to control the scale of the prior weight distribution. Since exact inference of the Bayesian posterior in deep networks is computationally intractable, this paper employs Monte Carlo dropout approximation as a surrogate for variational inference: during forward propagation, neuron outputs are randomly set to zero with a dropout rate $p_{\text {drop}}=0.3$. In the variational framework, this operation is equivalent to searching for an approximate distribution within the Bernoulli distribution family that minimizes the Kullback-Leibler (KL) divergence from the true posterior. After performing $M=30$ stochastic forward passes, the prediction distribution $\left\{\hat{y}_i^{(m)}\right\}_{m=1}^M$ is obtained for each pixel. Based on this distribution, epistemic uncertainty and aleatoric uncertainty can be computed respectively:

$U n c_{e p i}(i)=\frac{1}{M} \sum_{m=1}^M\left(\hat{y}_i^{(m)}-\bar{y}_i\right)^2, \bar{y}_i=\frac{1}{M} \sum_{m=1}^M \hat{y}_i^{(m)}$   (9)

$\operatorname{Unc}_{\text {ale}}(i)=\frac{1}{M} \sum_{m=1}^M \hat{y}_i^{(m)}\left(1-\hat{y}_i^{(m)}\right)$   (10)

where, epistemic uncertainty $U_{n c_{\text {epi}}}(i)$ measures the dispersion of prediction results across multiple samplings, reflecting the model's lack of knowledge regarding the classification decision for that pixel. Aleatoric uncertainty $U n c_{\text {ale}}(i)$ measures the fuzziness of the classification boundary in a single prediction, reflecting inherent noise or ambiguity in the input data. The final confidence heatmap is defined as $C_i=1$ -$U n c_{\text {epi}}(i)-U n c_{\text {ale}}(i)$, with a value range of [0,1]. Higher values indicate greater certainty in the model's prediction of the pixel's tampering probability. This design enables forensic examiners to intuitively identify regions of high prediction reliability and ambiguous regions requiring manual review.

The localization accuracy of tampered region boundaries directly impacts the quality of spatial references for evidence consistency verification. Significant boundary prediction offsets reduce the reliability of the overall tampered region localization. This paper proposes a dynamic annular residual module to impose additional structured supervision on tampering boundaries during training. Given the ground truth mask $Y$, dilation and erosion operations are sequentially applied with a dilation kernel radius and an erosion kernel radius $r_{\text {dil}}=5$, respectively, to extract the annular boundary band $r_{\text {ero}}=3$. Pixels within this boundary band $B=$ Dilate $(Y) \backslash \operatorname{Erode}(Y)$ correspond to the outer transition zone of the tampered region, representing the area most prone to classification errors. To assign differentiated gradient intensities to pixels at different positions within the boundary band, a distance-weighted loss is defined as follows:

$L_{\text {boundary}}=\frac{1}{|B|} \sum_{i \in B} L_{B C E}\left(\hat{y}_i, y_i\right) \cdot\left(1+\alpha \cdot e^{-\beta d_i}\right)$   (11)

where, $L_{B C E}$ is the binary cross-entropy loss, $d_i$ is the Euclidean distance from pixel $i$ to the nearest internal tampered pixel, normalized to [0,1], and $\alpha=2.0$ and $\beta=0.5$ are hyperparameters controlling the weight decay rate. This weighting strategy assigns approximately three times the loss weight to pixels immediately adjacent to the outer edge of the tampered region $\left(d_i \rightarrow 0\right)$, forcing the model to prioritize optimizing these boundary decisions during backpropagation, thereby effectively suppressing boundary localization offsets.

The total training loss function comprises three components: segmentation loss, cross-modal contrastive loss, and uncertainty loss:

$L_{\text {total}}=\lambda_1 L_{\text {seg}}+\lambda_2 L_{\text {contra}}+\lambda_3 L_{\text {unc}}$   (12)

where, $L_{\text {seg}}$ includes Dice loss, Focal loss, and the aforementioned boundary-weighted loss, supervising the pixel-level tampering localization accuracy. $L_{\text {contra}}$ is the cross-modal contrastive loss, constraining the consistency between visual representations and semantic logic. $L_{\text {unc}}$ is the uncertainty regularization term, computed from the KL divergence between the Bayesian convolutional layer weight prior and the variational posterior. The hyperparameters are set as $\lambda_1=1.0, \lambda_2=0.8$, and $\lambda_3=0.3$. It is worth noting that $L_{\text {unc}}$ may cause gradient oscillation in the early stages of training; therefore, a KL annealing strategy is introduced, multiplying it by a dynamic weight $\eta(t)=\min \left(1.0, t / t_{\text {warmup}}\right)$, where $t$ is the current iteration step and $t_{\text {warmup}}=5000$. This strategy gradually integrates the uncertainty loss into the total loss during the first 5,000 iterations, preventing overly strong prior constraints from prematurely dominating the optimization direction before features have sufficiently converged. After the aforementioned joint training, the decoder outputs a triple evidentiary result during inference: the pixel-wise tampering probability mask $\widehat{Y}$, the confidence heatmap $C$, and the global consistency score $\rho$ derived from the cross-modal contrastive loss. This provides forensic examiners with actionable decision support that combines spatial precision with confidence references.

2.5 Joint optimization objective and training strategy

The collaborative operation of the aforementioned components relies on a joint optimization objective that must simultaneously account for pixel-level segmentation accuracy, cross-modal semantic consistency, and the reliable calibration of prediction confidence. The total loss function is defined as a weighted sum of four loss components:

$L_{\text {total}}=\lambda_1 L_{\text {seg}}+\lambda_2 L_{\text {contra}}+\lambda_3 L_{\text {unc}}+\lambda_4 L_{\text {hard}}$   (13)

where, $L_{\text {seg}}$ is the segmentation loss, supervising the pixel-level accuracy of tampering localization. $L_{\text {contra}}$ is the global cross-modal contrastive loss, constraining the semantic alignment between overall image features and the case description. $L_{\text {unc}}$ is the uncertainty regularization term, computed from the KL divergence between the weight prior and the variational posterior in the Bayesian convolutional layers, serving to prevent the model from overconfidently outputting erroneous predictions. $L_{\text {hard}}$ is the dynamic hard example mining loss, imposing additional contrastive constraints on cross-level negative sample pairs. The hyperparameters for each loss component are tuned based on validation set performance and set as $\lambda_1=1.0, \lambda_2=0.8, \lambda_3=0.3$, and $\lambda_4=0.5$. Here, $\lambda_1$ is set as the baseline weight to maintain the dominant role of the segmentation task; $\lambda_2$ and $\lambda_4$ jointly control the strength of cross-modal alignment; while $\lambda_3$ is assigned a smaller value to prevent the uncertainty regularizer from excessively interfering with the learning of the main task.

The segmentation loss $L_{\text {seg}}$ is further decomposed into the sum of three terms:

$L_{\text {seg}}=L_{\text {Dice}}+L_{\text {Focal}}+L_{\text {boundary}}$   (14)

Among these, the Dice loss mitigates the class imbalance between tampered regions and the background. The Focal loss reduces the weight of easy-to-classify samples, forcing the model to focus on discriminating hard samples. The boundary loss $L_{\text {boundary}}$ applies distance-weighted supervision to pixels within the outer transition band of the tampered region. It is worth noting that $L_{\text {boundary}}$ participates only in gradient backpropagation during the training phase; its computation relies on morphological boundary extraction from the ground truth mask. This module is entirely removed during inference and thus incurs no additional computational overhead during deployment.

Training adopts a two-stage strategy to balance the convergence rates of visual feature learning and cross-modal semantic alignment. In the first stage, the CLIP text encoder is frozen, and only the parameters of the visual branch and the decoder are optimized for 50 epochs. The objective of this stage is to endow the visual feature extractor with robust tampering localization capabilities, preventing unoptimized visual features from propagating noisy gradients to the semantic branch. In the second stage, all network parameters are unfrozen for end-to-end fine-tuning over another 50 epochs, during which the strength coefficient $\lambda_{g r l}$ of the GRL linearly increases from 0 to 0.1 . This warmup scheduling strategy allows the visual branch to prioritize optimization for the segmentation task in the early stages, while gradually intensifying adversarial constraints from the semantic branch as training progresses, thereby achieving a smooth transition between localization accuracy and semantic consistency. The entire training process utilizes the AdamW optimizer with an initial learning rate of $1 \times 10^{-4}$, which decays $1 \times 10^{-6}$ to over the training cycle via a cosine annealing strategy. The batch size is set to 16 .