Beyond Visual Forensics: Auditing Multimodal Robustness for Synthetic Medical Image Detection

Source: arXiv:2606.25375 · Published 2026-06-24 · By Ching-Hao Chiu, Hao-Wei Chung, Gelei Xu, Xueyang Li, Pin-Yu Chen, John Kheir et al.

TL;DR

This paper addresses a critical and underexplored problem in synthetic medical image detection: the multimodal robustness of vision-language models (VLMs) when jointly analyzing medical images and accompanying structured metadata. Prior research largely focused on image-only detection, but in clinical practice, images are interpreted alongside metadata such as patient records, which can influence authenticity judgments. The authors reveal a multimodal vulnerability where VLMs can overly rely on the textual metadata context, causing the same image to be classified differently solely because of changes in its accompanying metadata provenance field (e.g., flagged as AI-edited vs hospital source). This text-induced decision shift can degrade detection accuracy significantly and threatens real-world deployment robustness for medical AI applications.

To systematically audit this, the authors propose a paired benchmark that holds the medical image fixed while swapping controlled metadata variants differing only in the provenance source field. They generate synthetic edit pairs in multiple medical datasets including NIH ChestX-ray14, ISIC2019 skin lesion images, and a private pediatric chest X-ray set. Diverse open-weight and state-of-the-art commercial API VLMs are evaluated under multimodal settings, exposing widespread accuracy collapse and flipped authenticity judgments caused purely by textual provenance changes. This reveals that VLMs often overweight metadata context, undermining reliance on visual evidence. This benchmark provides a novel and reproducible tool to quantify multimodal robustness beyond traditional image-only evaluations.

The results demonstrate pervasive failures across multiple model families and input conditions, highlighting the urgent need to improve fusion strategies and resistance to misleading metadata cues in deployed VLM-based medical image forensics. The benchmark also gives insights into model biases and offers a framework for more realistic robustness audits of multimodal deepfake detection systems in healthcare.

Key findings

• Adding a provenance metadata field indicating AI-editing (Source: AI-edited) reduces accuracy on authentic images by an average of 61.1% across all evaluated models and datasets.
• MedGemma-27B accuracy on NIH-CXR14 authentic images drops from 97.6% with Base Metadata to 0.0% when adding Source: AI-edited field.
• Switching only the metadata provenance field can flip authenticity decisions despite identical visual inputs, revealing text-induced decision shifts.
• Many models have low baseline accuracy (<50%) detecting synthetic (Fake) images from image alone across NIH-CXR14, ISIC2019, and PediCXR, showing the challenge of highly realistic edits.
• Source-AI metadata often inflates detection accuracy on Fake images by biasing decisions through provenance cues, rather than improved visual artifact recognition.
• Increasing model size or capacity does not consistently improve multimodal robustness; for example, Qwen3-VL 32B model collapses on real images whereas its 8B counterpart is more robust.
• Visual verdicts (image-only judgments) generally remain stable under provenance changes, but final multimodal answers can flip, indicating models overweight textual metadata for integrated decisions.
• DetectFake VLMs trained on general domains perform poorly in the multimodal medical setting, likely due to domain mismatch and lack of record inputs.

Threat model

The adversary controls the textual metadata provenance field accompanying a fixed medical image input to a VLM-based synthetic image detection system. Their goal is to manipulate metadata provenance indicators to flip authenticity judgments, either causing authentic images to be flagged as fake or vice versa, thereby overriding correct visual evidence. The adversary does not alter the image itself in this setting. Defense models receive both image and metadata inputs and must resist undue influence from misleading provenance cues.

Methodology — deep read

The study begins with the threat model assuming deployed vision-language models (VLMs) receive multimodal inputs consisting of a medical image plus accompanying structured metadata records. The adversary's aim is to exploit biases by injecting misleading metadata provenance fields to influence synthetic image detection. The key assumption is that VLMs leverage both image and text, but may over-rely on textual provenance indicators despite unchanged visual data.

For data, the authors use three medical image benchmarks spanning multiple modalities: NIH Chest X-ray14 (NIH-CXR14), ISIC2019 dermoscopy images, and a private pediatric chest X-ray dataset (PediCXR). They build paired synthetic data by generating fake images from authentic originals via an LLM-guided edit–verify–refine pipeline using Gemini-2.5 tools. Each synthetic image pairs with its real counterpart, preserving plausibility and medical validity through both LLM verification and human clinician review.

Metadata is retained from original records (Base Metadata containing demographics and diagnostic labels) and augmented with a single controlled 'Source' provenance field: either 'Hospital' or 'AI-edited' annotation. This Source field forms a controlled intervention to audit how strong provenance cues shift model decisions. The data splits use the official test sets, retaining 500 valid samples each for public datasets and 200 for the private one.

For model evaluation, four input conditions are tested: Image-only (I-Only), Image plus Base Metadata (I+Base), Image plus Source-Hospital field (I+Source-H), and Image plus Source-AI-edited field (I+Source-AI). Models include open-weight medical VLMs (e.g., MedGemma, Lingshu, HuatuoGPT-Vision), open-weight general VLMs (InternVL-3.5, Qwen3-VL, Llama-3.2-Vision), frontier APIs (GPT-5 series, Gemini models), and DetectFake VLMs designed for synthetic detection.

Each model is prompted with a standardized forensic template involving a checklist of visual cues and contradictions, outputting a final multimodal verdict and a visual-only verdict within the same generation. The final multimodal verdict is treated as primary. Evaluation metrics include True Negative Rate (TNR) on authentic data and True Positive Rate (TPR) on synthetic data under all input conditions. The authors analyze text-induced decision shift by measuring flip cases where changing only the provenance field alters correctness.

Experiments run on NVIDIA A10 GPUs using default model decoding settings. Capacity effects are explored by comparing different sized variants (e.g., 4B vs 27B MedGemma). Flip signature analyses quantify whether decision flips correspond to changes in integrated final answers vs the image-only visual verdict, using checklist polarity changes to detect reasoning rewrites.

This end-to-end framework evaluates multimodal robustness and systematically isolates the impact of textual provenance variations on synthetic image detection. The dataset and code for the paired benchmark are released to support reproducibility and further research.

Technical innovations

• Paired benchmark framework holding the medical image fixed while swapping only the controlled metadata provenance field to audit multimodal robustness.
• Controlled provenance intervention as a task-aligned upper-bound stress test to quantify text-induced decision shifts in authenticity predictions.
• Integrated forensic prompting producing joint visual and multimodal verdicts to disentangle image-based reasoning from metadata influence.
• Cross-family and cross-capacity evaluation exposing inconsistent effects of model scale on multimodal robustness in synthetic medical image detection.

Datasets

• NIH Chest X-ray14 (NIH-CXR14) — 500 paired samples — public
• ISIC2019 — 500 paired samples — public
• PediCXR — 200 paired samples — private in-house

Baselines vs proposed

• MedGemma-27B (NIH-CXR14 Real images): accuracy drops from 97.6% (I+Base) to 0.0% (I+Source-AI)
• MedGemma-4B (NIH-CXR14 Real images): accuracy drops from 100.0% (I+Base) to 7.6% (I+Source-AI)
• InternVL-3.5-8B (ISIC2019 Fake images): accuracy drops from 32.4% (I-Only) to 10.0% (I+Base)
• Gemini-3-Flash (PediCXR Fake images): accuracy decreases from 19.0% (I+Base) to 12.0% (I+Source-H)
• Qwen3-VL 32B vs 8B (Real images): 32B collapses across all datasets under provenance shifts while 8B remains more robust
• FakeVLM (general domain): performs comparatively better under provenance shifts than frontier API models

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.25375.

Fig 1: Research concept: auditing multimodal robustness for synthetic med-

Fig 2: Main results: text-induced decision shift and flip signatures. (A) TNR

Limitations

• The provenance field intervention is intentionally strong and explicit, possibly overestimating typical real-world metadata variations.
• Synthetic data generation relies on LLM-guided edits and clinician verification but may not capture all clinically realistic attack scenarios.
• Evaluation datasets, especially the private PediCXR, limit reproducibility and external validation by independent researchers.
• Experiments focus on structured provenance metadata and do not evaluate unstructured record texts or more subtle metadata perturbations.
• No targeted adversarial attacks or distribution shifts beyond provenance swaps were conducted to test worst-case robustness.
• Some model capacity comparisons are inconclusive or inconsistent, possibly due to varied training data or architectures.

Open questions / follow-ons

• How does multimodal robustness degrade under more naturally occurring metadata variations beyond controlled provenance fields?
• Can training or alignment strategies mitigate metadata overweighting while preserving accurate multimodal fusion?
• What is the impact of unstructured or free-text medical record context on synthetic image detection robustness?
• How do adversarial attacks targeting multimodal components collaboratively affect detection performance?

Why it matters for bot defense

This work highlights that synthetic medical image detectors based on vision-language models may be vulnerable to textual context manipulations that override visual evidence, a risk potentially analogous to CAPTCHA and bot-defense scenarios where multimodal inputs exist. Bot-defense engineers should be aware that input modalities beyond images—such as metadata or contextual signals—can significantly bias multimodal detection outcomes. Designing detection systems to resist such text-induced decision shifts requires careful auditing under paired condition benchmarks like the one proposed here. Additionally, this work suggests the importance of disentangling modality contributions and ensuring that visual evidence remains the anchor for final decisions, a principle relevant to CAPTCHAs integrating text and image cues. Finally, explicit stress tests targeting record provenance or metadata fields can surface hidden failure modes in deployed multimodal classifiers critical for security-sensitive applications.

Cite

@article{arxiv2606_25375,
  title={ Beyond Visual Forensics: Auditing Multimodal Robustness for Synthetic Medical Image Detection },
  author={ Ching-Hao Chiu and Hao-Wei Chung and Gelei Xu and Xueyang Li and Pin-Yu Chen and John Kheir and Meysam Ghaffari and Carlos Morato and Ahmed Abbasi and Yiyu Shi },
  journal={arXiv preprint arXiv:2606.25375},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.25375}
}

Read the full paper

• arXiv:2606.25375 (abstract)
• arXiv:2606.25375 (PDF)