SEED: A Large-Scale Benchmark for Provenance Tracing in Sequential Deepfake Facial Edits Mengieong Hoi1 , Zhedong Zheng1 , Ping Liu2 B, and Wei Liu3 B University of Macau, Macau, China [email protected], [email protected] 2 University of Nevada, Reno, NV, USA [email protected] 3 Huazhong University of Science and Technology, Wuhan, China [email protected]
arXiv:2604.10522v1 [cs.CR] 12 Apr 2026
1
B Corresponding authors
Abstract. Deepfake content on social networks is increasingly produced through multiple sequential edits to biometric data such as facial imagery. Consequently, the final appearance of an image often reflects a latent chain of operations rather than a single manipulation. Recovering these editing histories is essential for visual provenance analysis, misinformation auditing, and forensic or platform moderation workflows that must trace the origin and evolution of AI-generated media. However, existing datasets predominantly focus on single-step editing and overlook the cumulative artifacts introduced by realistic multi-step pipelines. To address this gap, we introduce Sequential Editing in Diffusion (SEED), a large-scale benchmark for sequential provenance tracing in facial imagery. SEED contains over 90K images constructed via one to four sequential attribute edits using diffusion-based editing pipelines, with fine-grained annotations including edit order, textual instructions, manipulation masks, and generation models. These metadata enable step-wise evidence analysis and support forgery detection, sequence prediction. To benchmark the challenges posed by SEED, we evaluate representative analysis strategies and observe that spatial-only approaches struggle under subtle and distributed diffusion artifacts, especially when such artifacts accumulate across multiple edits. Motivated by this observation, we further establish FAITH, a frequency-aware Transformer baseline that aggregates spatial and frequency-domain cues to identify and order latent editing events. Results show that high-frequency signals, particularly wavelet components, provide effective cues even under image degradation. Overall, SEED facilitates systematic study of sequential provenance tracing and evidence aggregation for trustworthy analysis of AI-generated visual content. Keywords: DeepFake Detection · Sequential Facial Manipulation
2
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB
Fig. 1: Overview of SEED and supported provenance analysis tasks. SEED targets diffusion-based sequential facial editing and provides supervision for three complementary tasks: Authenticity Analysis, which distinguishes real images from sequentially edited ones; Editing Trace Analysis, which characterizes the edited attributes and their sequential patterns; and Spatial Evidence Analysis, which analyzes manipulated regions using edit masks. The bottom example illustrates a real face progressively edited into a fake through a sequence of attribute edits such as lip, hat, eyes, and eyebrows, together with corresponding manipulation masks that support fine-grained evidence analysis.
1
Introduction
Recent progress in diffusion models has enabled highly realistic and controllable face synthesis and editing at scale [7, 25, 28]. While these tools benefit content creation, they also blur the boundary between authentic and manipulated imagery, amplifying the need for reliable visual provenance analysis [10, 29]. Importantly, practical editing workflows are rarely single-shot. Users can perform sequential attribute edits (e.g., hair, eyes, eyebrows, accessories), producing a final image that reflects an ordered chain of operations. Such multi-step pipelines are particularly challenging for forensics because evidence is non-stationary: later edits may overwrite earlier traces, distributed, and entangled across attributes. Despite strong progress in face forensics benchmarks and detectors, existing datasets predominantly emphasize isolated manipulations or global authenticity labels. Classic benchmarks such as FaceForensics++ [29] and DeeperForensics1.0 [10] focus on detection under controlled or real-world distortions. Large-scale datasets such as ForgeryNet [9] and OpenForensics [12] provide rich supervision for detection, but do not model editing histories. More recently, diffusion-era resources and detectors (e.g., diffusion-generated detection via reconstruction error [41] and diffusion-focused datasets [4]) highlight the new threat landscape,
Title Suppressed Due to Excessive Length
3
Table 1: Comparison of image-based deepfake/AIGC datasets by supervision and supported tasks. Scale is reported in thousands of images (K) without separating real/fake. Dataset
Mod.
Scale
Seq
A. Image Detection OpenForensics [12] ForgeryNet [9] DeepFakeFace-DFF [33] DiffusionFace [4] GenImage [48] DRCT-2M [3] ImagiNet [2] Fake2M [20]
I I I I I I I I
115.8K 2900.0K 120.0K 630.0K 2000.0K† 2000.0K 200.0K 2087.0K
-
B. Provenance Tracing Seq-DeepFake-Comp [30] Seq-DeepFake-Attr [30] Seq-DeepFake-P [31] SEED (Ours)
I I I I
35.2K 49.9K 85.1K 91.5K
28 26 54 200
Supervision Ord Attr Txt Loc ✓ ✓
✓
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
✓
✓ ✓ ✓ ✓
✓
✓ ✓ ✓ ✓
✓ ✓ ✓ ✓
Tasks Det Prov Loc
✓
✓
✓ ✓ ✓
✓ ✓ ✓ ✓
✓
Supervision: Ord = edit order; Attr = attribute label; Txt = text instruction; Mask = spatial mask. Tasks: Det = detection; Prov = provenance tracing; Loc = localization. Seq: number of sequence types; “-” indicates not applicable. † GenImage reports >1M real-fake pairs.
yet still largely assume single-edit settings. The only widely-used sequential benchmark, Seq-DeepFake [30], is built upon GAN-based pipelines, which limits its coverage of diffusion-based sequential edits. This gap makes it difficult to systematically study how provenance cues evolve across multiple diffusion edits, and how to recover attribute identity and temporal order from subtle evidence. To address this need, we introduce SEquential Editing in Diffusion (SEED), the first large-scale benchmark for diffusion-based sequential provenance tracing in facial imagery. SEED contains 91,526 face images generated by applying one to four attribute edits sequentially, using modern diffusion editing pipelines such as LEDITS [39], SDXL [25], and SD3 [7] style rectified-flow models [7]. Crucially, each sample is paired with step-wise provenance metadata, including the edited attribute sequence, textual instructions, and manipulation masks. As summarized in Figure 1 and Table 1, this design enables three complementary tasks: (i) Authenticity Analysis (real vs. sequentially edited), (ii) Editing Trace Analysis (predicting edited attributes and their order), and (iii) Spatial Evidence Analysis (localizing manipulated regions). We further benchmark representative analysis strategies on SEED and observe that spatial-only approaches are often insufficient under subtle diffusion artifacts, especially as the edit chain becomes longer. Motivated by findings that mid-to-high frequency behaviors remain informative for synthetic imagery [6, 36], we establish FAITH as a frequency-aware Transformer diagnostic baseline for sequential provenance tracing. FAITH is not proposed as a state-of-the-art solution, but is designed to isolate and study the contribution of frequency-domain signals when recovering attribute identity and temporal order under multi-step diffusion edits. Concretely, FAITH aggregates spatial features with frequency-domain
4
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB
cues to support controlled analyses of which signals persist, degrade, or become confounded as edits accumulate. In summary, our contributions are threefold: – We present SEED, the first large-scale benchmark for diffusion-based sequential provenance tracing in facial imagery, comprising 91,526 images with step-wise annotations (edit order, attribute labels, prompts, and masks) for explainable analysis. – We provide systematic benchmarking on SEED, highlighting the difficulty of recovering complete edit histories under multi-step diffusion edits and motivating evidence aggregation beyond purely spatial cues. – We establish FAITH as a frequency-aware diagnostic baseline that integrates spatial and frequency cues for sequential provenance tracing, enabling controlled studies of robustness and signal contribution.
2
Related Work
Face Forensics Benchmarks and Supervision. Early and large-scale benchmarks have driven progress in deepfake detection. FaceForensics++ [29] standardized evaluation for manipulated facial videos, while DeeperForensics-1.0 [10] emphasized scale and real-world perturbations. Celeb-DF [15] improved visual quality for face-swapping evaluation. Beyond global labels, richer supervision has been introduced via mega-scale resources such as ForgeryNet [9] and OpenForensics [12], and DF-Platter [22] further highlights real-world variability, including multi-subject settings. These datasets enable comprehensive detection studies and motivate more generalizable and interpretable detectors [16, 38, 44, 45], but they largely treat each sample as a single manipulation outcome and do not explicitly represent multi-step editing histories. Diffusion-era resources have recently emerged as diffusion models become dominant for synthesis and editing. DiffusionDB [42] provides large-scale prompt-image pairs for text-to-image generation analysis, and DiffusionFace [4] targets diffusion-based face forgery analysis, together with diffusion-oriented representation learning and prompt-based forensics efforts [5, 14]. However, these datasets primarily support detection or categorization under single-generation/single-edit assumptions. In contrast, SEED focuses on diffusion-based sequential edits and records step-wise provenance (order, prompts, masks), enabling provenance tracing beyond binary authenticity labels. Diffusion and Sequential Forensics. For diffusion-generated imagery, recent work explores signals that remain discriminative despite improved realism. DIRE [41] proposes diffusion reconstruction error for diffusion-generated image detection, while analyses of synthetic image properties show systematic mid-tohigh frequency irregularities across generators [6, 17, 26]. Generalizable deepfake detection has also been advanced by explicitly modeling generator-induced artifacts, including up-sampling traces [36] and localized artifact attention [8, 23, 49], and related image manipulation detection under limited supervision has also been explored [46]. Beyond detection, weakly-supervised localization for diffusiongenerated images has been studied to provide spatial evidence maps rather than only binary predictions [34, 37]. Sequential provenance tracing is inherently more
Title Suppressed Due to Excessive Length
5
Fig. 2: Overview of the SEED dataset construction pipeline. We generate masks and prompts, apply step-wise diffusion editing with per-step model sampling, and finally compute quality metrics while recording step-wise provenance annotations.
challenging than single-step detection: as edits accumulate, the model must determine not only which attributes were modified, but also the order in which those modifications occurred. Seq-DeepFake [30] formulates sequential manipulation as an image-to-sequence problem and provides step-wise order supervision, and subsequent work improves robustness under post-processing perturbations [31]. Nevertheless, existing sequential benchmarks and methods are largely built on GAN-era editing pipelines, and their coverage of diffusion-based sequential edits remains limited. SEED complements this line by providing a diffusion-era sequential benchmark with fine-grained, step-wise provenance annotations for detection.
3
SEED: A Benchmark for Sequential Visual Provenance Tracing
We introduce SEED, the first large-scale benchmark for sequential visual provenance tracing in facial imagery. SEED contains 91,526 images built from highquality real face datasets (FFHQ [11] and CelebAMask-HQ [13]) and edited by diffusion-based pipelines. Unlike prior benchmarks that focus on isolated manipulations, SEED targets sequential editing: each sample is produced by applying one to four attribute edits in order, where later operations may partially overwrite earlier traces. For each step, we record provenance annotations including the edited attribute, the textual instruction, the spatial mask, and the editing model, yielding trajectory-level supervision (the edit sequence) together with step-level evidence for analysis. 3.1 Dataset Construction SEED is constructed via three stages: preprocessing, sequential manipulation, and quality evaluation (Figure 2).
6
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB Fig. 3: Sequential edit examples and edit order. Each row shows a multi-step editing trajectory in SEED.
Table 2: Prompt templates used in SEED data generation. Curly braces denote placeholders sampled from predefined vocabularies to diversify linguistic realizations while keeping edit intent fixed. Attribute
Instruction template
Caption template
Placeholders
Eyes Lip
Make the eyes {color}. Change the lipstick color to {color}. Turn the hair {color}. Make the hair {style}. Make the eyebrows {style}. Add a pair of {glasses}. Add a {hat}.
A person with {color} eyes. A person with {color} lipstick. A person with {color} hair. A person with {style} hair. A person with {style} eyebrows. A person wearing {glasses}. A person wearing a {hat}.
red, blue, black, . . . red, blue, black, . . . red, blue, black, . . . curly, straight, . . . thick, . . . glasses, sunglasses hat, . . .
Hair Eyebrows Glasses Hat
Preprocessing: spatial and textual conditions. We build attribute-specific spatial and textual conditions for localized, instruction-driven edits. For intrinsic attributes (eyes, lips, hair, eyebrows), we obtain region masks using CelebAMaskHQ parsing [13]. For accessories (glasses, hats), we use scalable geometric priors (e.g., dilated eye/upper-face regions). To introduce linguistic variation without changing edit intent, we generate multiple candidate prompts per attribute using LLaVA [18] and randomly sample instruction-style or description-style templates per step. Table 2 summarizes representative prompt templates used in SEED data generation.
Sequential manipulation. We sample the sequence length L ∈ {1, 2, 3, 4}, choose an attribute at each step, and apply a diffusion editor. To diversify editor-specific behaviors, we sample the per-step model from a pool including LEdits [39], SDXL [25], and SD3 [7] fine-tuned with UltraEdit [47]. The output of each step becomes the input to the next, forming a cumulative editing chain with explicit provenance logs.
Quality evaluation. We filter degenerate outputs and retain trajectories with reasonable semantic and structural consistency. We compute perceptual and semantic similarity measurements to avoid obvious collapses, and store the raw scores as metadata for subsequent analysis. Detailed definitions, thresholds, and the full metadata schema are provided in the supplementary.
Title Suppressed Due to Excessive Length
7
Fig. 4: SEED dataset distributions. (a) Distribution of sequence length. (b) Distribution of diffusion editing models. (c) Distribution of manipulated attribute categories.
3.2
Dataset Distributions
Figure 4 summarizes SEED statistics from three perspectives. (1) The sequencelength distribution is relatively balanced, with 29.91%, 26.21%, 21.88%, and 22.00% of samples having L = 1, 2, 3, 4 edits, respectively (Fig. 4a). (2) SEED mixes multiple diffusion editors to discourage over-specialization to a single generator (Fig. 4b), including UltraEdit (38.28%), LEdits (37.34%), and SDXL (24.38%). (3) SEED covers both intrinsic facial attributes and accessories (Fig. 4c), including Lip (28%), Eyebrow (18%), Eye (17%), Hat (14%), Hair (14%), and Glasses (9%). 3.3
Balanced Partition and Split Protocol
Identity-disjoint split. SEED adopts an identity-disjoint split for training, validation, and testing, where identities do not overlap across splits. This reduces identity leakage and encourages models to rely on provenance cues rather than subject memorization. Sequence-length-balanced partition. Sequential provenance tracing becomes progressively harder as edit chains grow, therefore length imbalance can bias both training and evaluation. To control for this factor, we construct a length-balanced partition for benchmarking. Specifically, we sample 20,000 images for each edited length L ∈ {1, 2, 3, 4} and additionally include 20,000 unedited real images (L = 0) from FFHQ and CelebAMask-HQ, yielding 100,000 images in total with each length accounting for 20%. We then split this partition into train/val/test sets with an 8:1:1 ratio while preserving the length distribution.
4
FAITH: Frequency-Aware Identification Transformer for Sequential Editing Detection
Existing sequential facial editing detectors, such as SeqFakeFormer [30], mainly rely on spatial-domain representations. This design can be insufficient for subtle
8
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB
Fig. 5: Overview of the proposed FAITH architecture. The model explicitly integrates high-frequency domain information extracted by Discrete Wavelet Transform (DWT) and spatial-domain features via a Transformer-based encoder-decoder structure, significantly enhancing sequential facial editing detection accuracy.
and realistic diffusion-based edits [27], where spatial cues are weak and accumulated artifacts are distributed. Moreover, attention maps derived solely from label embeddings may fail to consistently highlight manipulated regions, especially under multi-step edits. To address these limitations, we propose FAITH, a frequency-aware encoder-decoder Transformer baseline for sequential editing detection on SEED. As illustrated in Figure 5, FAITH couples spatial features with high-frequency guidance extracted by DWT, and injects such guidance into the decoder cross-attention to improve sensitivity to subtle editing traces. Problem Setup and Notation. Given an input face image x ∈ RH×W ×3 , the goal is to predict an ordered attribute sequence that describes the sequential edits (up to four steps in SEED). Let the ground-truth edit sequence be y = (y1 , . . . , yT ) with length T ∈ {0, 1, 2, 3, 4}, where each yi is an attribute token from the vocabulary V (e.g., Hat, Eye, Eyebrow, Lip). We prepend a start token ⟨SOS⟩ and append an end token ⟨EOS⟩ to indicate termination, yielding (⟨SOS⟩, y1 , . . . , yT , ⟨EOS⟩). When T = 0 (no edit), the target sequence naturally reduces to ⟨SOS⟩ → ⟨EOS⟩, which avoids introducing a separate “real” label outside the sequence formulation. 4.1
Spatial Feature Extraction and Encoding
Spatial tokenization. FAITH first extracts coarse spatial features f cor via a CNN backbone, then adds positional embeddings and flattens them into a token sequence f spa : \begin {aligned} f^{\mathrm {cor}} &= \mathrm {CNN}(\mathbf {x}),\quad f^{\mathrm {spa}} &= \mathrm {Flatten}\!\left (f^{\mathrm {cor}} + f^{\mathrm {pos}}\right ), \end {aligned} \label {eq:faith_spatial_tokenize}
(1)
where f pos denotes the learnable positional embedding broadcastable to f cor . After flattening, f spa is a sequence of L spatial tokens.
Title Suppressed Due to Excessive Length
9
Transformer encoder. We refine f spa with an N -layer Transformer encoder to obtain refined spatial features f s . For clarity, we write one encoder layer using the standard attention-then-MLP residual form: \begin {aligned} Q &= f^{\mathrm {spa}} W_Q,\quad K = f^{\mathrm {spa}} W_K,\quad V = f^{\mathrm {spa}} W_V,\\ f^{\mathrm {mid}} &= f^{\mathrm {spa}} + \mathrm {SoftMax}\!\left (\frac {QK^{\top }}{\sqrt {d}}\right )V,\\ f^{\mathrm {s}} &= f^{\mathrm {mid}} + \mathrm {MLP}(f^{\mathrm {mid}}), \end {aligned} \label {eq:faith_encoder_layer} (2)
where WQ , WK , WV ∈ Rd×d are learnable projections (applied per head in the multi-head implementation), and d is the hidden dimension. Stacking N layers yields the final spatial representation f s , which serves as the encoder memory for decoding. 4.2
Frequency-domain Feature Extraction and Guidance Construction
DWT-based high-frequency features. To explicitly highlight subtle manipulation traces, FAITH leverages the discrete wavelet transform (DWT) and focuses on the HH sub-band, which captures high-frequency details along both horizontal and vertical directions. We encode HH with a lightweight convolutional head to obtain frequency features f f : \{\mathrm {LL}, \mathrm {LH}, \mathrm {HL}, \mathrm {HH}\} = \mathrm {DWT}(\mathbf {x}), \quad f^{f} = \mathrm {Conv}(\mathrm {HH}). \label {eq:faith_freq_feature}
(3)
where HH denotes the extracted high-frequency component after wavelet decomposition. Frequency guidance map. To match the decoder cross-attention operation in Figure 5, we convert f f into an additive guidance term M f that modulates attention scores over spatial tokens. Concretely, we align f f to the spatial-token resolution and project it to an attention bias: \begin {aligned} M^{f} &= \mathrm {Flatten}\!\left (\mathrm {Proj}\!\left (\mathrm {Align}(f^{f})\right )\right ), \end {aligned} \label {eq:faith_freq_guidance}
(4)
where Align(·) denotes resolution alignment (e.g., interpolation to the encoder token grid), and Proj(·) denotes a learnable projection (e.g., 1 × 1 convolution) to produce a token-wise bias compatible with attention logits. This design preserves the figure-level semantics: f f is computed from HH, and M f is the guidance injected into cross-attention. 4.3
Cross-attention based Sequential Edit Prediction
Tokenization and decoder input. We tokenize each edited attribute and insert special tokens to form the target sequence. Let S t = (s0 , s1 , . . . , sT , sT +1 ) denote the token sequence where s0 = ⟨SOS⟩ and sT +1 = ⟨EOS⟩. The decoder maintains an auto-regressive hidden state and predicts tokens step by step.
10
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB
Frequency-aware cross-attention. At decoding step i, let the decoder produce a query representation (after its self-attention) denoted as ui . We compute crossattention between ui (query) and the refined spatial features f s (keys and values), while injecting M f as an additive bias to guide attention toward high-frequency suspicious regions: \begin {aligned} Q_i &= \mathbf {u}_i W_Q^{\mathrm {d}},\quad K = f^{\mathrm {s}} W_K^{\mathrm {d}},\quad V = f^{\mathrm {s}} W_V^{\mathrm {d}},\\ f^{\mathrm {mid}'}_i &= \mathrm {SoftMax}\!\left (\frac {Q_i K^{\top }}{\sqrt {d}} + M^{f}\right ) V,\\ f^{\mathrm {dec}}_i &= f^{\mathrm {mid}'}_i + \mathrm {MLP}\!\left (f^{\mathrm {mid}'}_i\right ), \end {aligned} \label {eq:faith_decoder_cross_attn} (5)
d where WQd , WK , WVd ∈ Rd×d are learnable projections for the decoder crossattention. The guidance term M f is shared across decoding steps and biases the attention distribution over spatial tokens. Attribute prediction and termination. The predicted attribute distribution at step i is computed by a linear classifier followed by SoftMax:
\begin {aligned} p_{\theta }(s_i \mid s_{<i}, \mathbf {x}) &= \mathrm {SoftMax}\!\left (f^{\mathrm {dec}}_i W_O\right ), \end {aligned} \label {eq:faith_token_prediction}
(6)
where WO ∈ Rd×|V∪{⟨EOS⟩}| . Inference proceeds auto-regressively until ⟨EOS⟩ is generated, or a maximum length is reached (four edit tokens plus ⟨EOS⟩), consistent with the SEED protocol. 4.4
Training Objective
We train FAITH with teacher forcing using the standard cross-entropy loss over the full token sequence (including ⟨EOS⟩): \begin {aligned} \mathcal {L} &= - \sum _{i=1}^{T+1} \log p_{\theta }(s_i^{*}\mid s_{<i}^{*}, \mathbf {x}), \end {aligned} \label {eq:faith_loss}
(7)
where s∗i denotes the ground-truth token at position i. This objective directly supervises both the ordered attribute predictions and the termination behavior, enabling FAITH to model sequential edits under a unified formulation while leveraging M f for frequency-aware detection cues during decoding. During training, the decoder conditions on the ground-truth prefix s∗<i , which stabilizes optimization and encourages each next-token distribution to be locally consistent with the true edit history. At inference time, we decode autoregressively from ⟨BOS⟩ until ⟨EOS⟩ (or the maximum length), allowing FAITH to recover edit order and termination jointly while leveraging the frequency-aware branch M f to provide complementary cues when spatial traces are subtle or partially overwritten.
5
Experiment
5.1
Implementation Details
For FAITH, we use a ResNet-50 backbone pre-trained on ImageNet for spatial feature extraction. The encoder-decoder Transformer contains 2 encoder layers
Title Suppressed Due to Excessive Length
11
Table 3: Performance on SEED across sequence length L (number of sequential edits). We compare adapted manipulation detectors, a sequential baseline, and FAITH with frequency transforms (DCT, FFT, DWT). We report Fixed-Acc, Adaptive-Acc, and Full-Acc, where Full-Acc requires the entire predicted edit sequence to exactly match the ground truth. Best and second-best results in each row are marked by bold and underline, respectively. FAITH columns are highlighted in light blue. Settings
Shuai et al. [32]
FreqNet [35]
Ba et al. [1]
SeqFakeFormer [30]
Fixed Adaptive (no edits) Full
99.95 99.80 99.80
100 100 100
99.99 99.95 99.95
100 100 100
100 100 100
100 100 100
100 100 100
L=1
Fixed Adaptive Full
97.32 90.15 89.50
93.77 80.37 79.01
93.25 87.98 86.61
98.00 92.80 92.11
98.10 93.10 92.48
98.29 93.60 93.21
98.24 93.40 93.01
L=2
Fixed Adaptive Full
78.12 56.88 52.25
74.01 49.82 46.09
68.01 48.62 52.31
89.50 79.44 76.75
89.76 79.82 77.10
89.70 79.62 77.00
89.69 79.62 77.10
L=3
Fixed Adaptive Full
53.66 35.53 22.45
51.34 32.54 25.57
52.60 40.62 26.58
70.44 61.56 48.55
71.12 62.21 49.65
71.61 62.67 49.25
72.50 63.84 50.35
L=4
Fixed Adaptive Full
28.45 28.45 5.70
26.93 26.93 10.92
34.20 34.20 7.20
50.14 50.14 24.55
49.51 49.51 22.95
49.14 49.14 23.05
48.93 48.93 24.50
Avg.
Fixed Adaptive Full
71.50 54.07 48.72
70.08 52.59 48.27
68.78 54.80 50.80
81.62 68.53 66.97
81.70 68.56 67.02
81.75 68.58 67.03
81.87 68.84 67.26
L=0
FAITH(DCT) FAITH(FFT)
FAITH(DWT)
and 2 decoder layers, each with 4 attention heads. We train for 170 epochs using a 20-epoch warm-up, followed by step-wise learning rate decay every 50 epochs. The initial learning rates are 1 × 10−3 for the Transformer and 1 × 10−4 for the ResNet backbone, and the batch size is 40 with sequence padding up to length 4. All experiments are implemented in PyTorch and run on three NVIDIA RTX 3090 GPUs, and we adopt SAM to improve generalization. For comparison, we adapt representative face manipulation detectors from binary classification to a 200-way multi-class setting, assessing how well non-sequential designs transfer to sequential provenance tracing. We further include SeqFakeFormer as a sequential baseline that relies only on spatial cues, isolating the benefit of explicitly incorporating frequency-domain information in FAITH. 5.2
Results and Analysis
We study whether frequency-domain cues help recover sequential facial edit histories. To this end, we instantiate FAITH with three standard transforms (DCT, FFT, DWT) and compare them with adapted manipulation detectors and a sequential baseline. Table 3 reports results across sequence length L and three complementary metrics (Fixed-Acc, Adaptive-Acc, and Full-Acc). Two trends are consistent throughout the table. First, detectors designed for single-step manipulation show limited transfer to sequential provenance tracing. While they saturate at L=0, their performance drops substantially once the task requires predicting an ordered edit sequence. This indicates that sequential provenance is not merely “detecting edits”, but separating multiple attribute traces that can be weak or partially overwritten by later operations.
12
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB
Table 4: Robustness on the SEED test set under two common post-processing conditions: (a) JPEG compression (25%, 50%, 75%) and (b) Gaussian noise (10%, 15%, 20%). We report Fixed-Acc, Adaptive-Acc, and Full-Acc. Best and second-best results in each column are marked by bold and underline, respectively. FAITH variants are highlighted in light blue and separated from prior baselines by a horizontal rule. (a) Methods
Compress – 25%
Compress – 50%
Compress – 75%
Fixed
Adaptive
Full
Fixed
Adaptive
Full
Fixed
Adaptive
Full
Shuai et al. [32] FreqNet [35] Ba et al. [1] SeqFakeFormer [30]
63.98 63.20 63.15 78.12
50.21 50.03 50.36 63.67
47.81 47.09 47.47 60.60
61.06 60.73 59.93 75.83
48.68 48.70 48.98 62.01
46.29 46.04 45.90 59.24
56.87 56.41 56.76 66.63
36.22 36.43 36.41 44.41
32.69 32.44 33.01 39.33
FAITH (DCT) FAITH (FFT) FAITH (DWT)
78.68 78.83 78.92
63.93 63.98 64.13
61.41 61.43 61.91
76.89 76.64 76.92
62.09 62.10 62.75
59.78 59.37 59.86
66.80 66.93 67.19
44.36 44.69 44.79
39.18 39.60 39.71
(b)
Methods
Noise intensity – 10%
Noise intensity – 15%
Noise intensity – 20%
Fixed
Adaptive
Full
Fixed
Adaptive
Full
Fixed
Adaptive
Full
Shuai et al. [32] FreqNet [35] Ba et al. [1] SeqFakeFormer [30]
49.23 48.88 49.32 62.39
29.46 29.03 30.03 34.59
25.66 25.38 25.76 31.62
43.09 42.84 42.98 55.61
18.97 18.96 18.99 23.40
15.05 15.78 15.80 19.28
40.72 40.36 40.53 51.21
15.81 15.82 16.22 20.27
8.12 8.26 8.49 11.31
FAITH (DCT) FAITH (FFT) FAITH (DWT)
62.68 62.91 63.07
35.52 34.37 34.69
32.16 55.71 31.76 55.28 31.88 55.84
23.59 23.06 24.38
19.48 51.32 18.95 51.51 19.60 51.70
20.26 20.39 20.83
11.49 11.83 12.19
Second, accuracy decreases as L increases for all approaches, and the drop is most visible under Full-Acc. Because Full-Acc requires an exact match of the entire sequence, any step-wise mistake (wrong attribute, wrong order, or early stopping) collapses the score. In contrast, Fixed-Acc and Adaptive-Acc allow partial credit at the token level, so they degrade more gently, suggesting that many predictions remain partially correct. Within sequential methods, adding frequency-domain features improves FAITH across metrics in most settings. The gains are most meaningful on FullAcc, implying that frequency cues help reduce hard sequence-level failures such as ordering drift or missing steps. Among the three transforms, DWT achieves the highest average performance. Compared to DCT/FFT, DWT provides localized high-frequency decomposition, which better preserves edge and texture changes introduced by attribute edits, especially when multiple edits accumulate. This interpretation is supported by the qualitative robustness examples in Fig. 6, where our method maintains the full edit sequence under Compress-50% and Noise intensity-15%, while baselines more often terminate early or deviate from the correct order. At the same time, L=4 remains difficult for all methods and the margin between strong sequential models narrows, highlighting that long edit chains still pose substantial challenges.
Title Suppressed Due to Excessive Length
13
Clean GT Ours SeqFakeFormer FreqNet
Lipstick \to Hat \to Eye \to Eyebrow Lipstick \to Hat \to Eye \to Eyebrow Lipstick \to Hat \to Eye \to Eyebrow Lipstick \to Eye \to EOS
Compress-50% GT Ours SeqFakeFormer FreqNet
Lipstick \to Hat \to Eye \to Eyebrow Lipstick \to Hat \to Eye \to Eyebrow Lipstick \to Hat \to EOS Lipstick \to EOS
Noise intensity-15% GT Ours SeqFakeFormer FreqNet
Lipstick \to Hat \to Eye \to Eyebrow Lipstick \to Hat \to Eye \to Eyebrow Lipstick \to Hat \to Eye \to EOS Lipstick \to EOS
Clean GT Ours SeqFakeFormer FreqNet
Glasses \to Eyebrow \to Lipstick \to Hat Glasses \to Eyebrow \to Lipstick \to Hat Glasses \to Hat \to Eyebrow \to Lipstick Glasses \to Hat \to EOS
Compress-50% GT Ours SeqFakeFormer FreqNet
Glasses \to Eyebrow \to Lipstick \to Hat Glasses \to Eyebrow \to Lipstick \to Hat Glasses \to Hat \to Lipstick \to EOS Glasses \to Hat \to EOS
Noise intensity-15% GT Ours SeqFakeFormer FreqNet
Glasses \to Eyebrow \to Lipstick \to Hat Glasses \to Eyebrow \to Lipstick \to Hat Glasses \to Eyebrow \to EOS Glasses \to Hat \to EOS
Fig. 6: Qualitative robustness examples under Compress-50% and Noise intensity-15%. Tokens are replaced with semantic attributes. EOS denotes early stopping. Correct tokens are highlighted in light green and incorrect tokens in light red. Ground truth is shown in olive-green text.
5.3
Robustness Study
In realistic image transmission and storage, post-processing operations can distort provenance cues. We therefore evaluate robustness under JPEG compression and additive Gaussian noise, as summarized in Table 4. JPEG compression. Table 4a shows that all methods degrade as compression becomes stronger, and the drop is most pronounced at 75% compression. This is consistent with JPEG removing high-frequency details through quantization, which can weaken both spatial textures and frequency-domain signals. Even under these conditions, FAITH variants remain strong relative to baselines and maintain higher Full-Acc across compression levels. Among the three transforms, FAITH(DWT) is consistently best or second-best in most columns, suggesting that its multi-resolution decomposition retains useful cues even when fine details are partially suppressed. Gaussian noise. Table 4b reports results under increasing noise intensity. Unlike compression, additive noise perturbs nearly all frequencies and directly corrupts both edges and textures, so degradation is visible for every method. Despite this, FAITH(DWT) attains the best Full-Acc at higher noise levels and remains comparatively stable relative to baselines, indicating that directional high-frequency representations still provide discriminative signals under moderate stochastic corruption. At the same time, performance under severe noise remains low for all models, which highlights an open robustness gap for sequential provenance tracing in uncontrolled environments.
14
5.4
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB
Qualitative Robustness Analysis under Compression and Noise
To complement the quantitative robustness results, we present representative qualitative cases under two common post-processing perturbations, i.e., Compress50% and Noise intensity-15% (Fig. 6). We replace token IDs with semantic facial attributes and highlight position-wise correctness: green indicates a token matching the ground-truth attribute at the same step, while red denotes an incorrect token or early stopping (EOS). This visualization reveals how perturbations affect sequential provenance tracing beyond aggregate accuracy. Across both examples, our method preserves the complete manipulation trajectory under clean as well as degraded inputs, consistently recovering the full four-step sequences. In contrast, competing baselines often exhibit two dominant failure modes under compression or noise: (1) premature termination (early EOS), leading to missing later edits, and (2) step-wise drift where the predicted attribute at a given step shifts or swaps the intended order. Notably, under Compress-50%, SeqFakeFormer frequently collapses to shorter sequences, while FreqNet tends to terminate even earlier, suggesting that their evidence is less stable once high-frequency cues are attenuated. Under Noise intensity-15%, the baselines further suffer from occasional step mismatches, indicating increased uncertainty in deciding both what was edited and when it occurred. These observations support the key advantage of our frequency-aware design: by leveraging frequency-domain guidance to stabilize cross-step evidence, the model remains less sensitive to post-processing artifacts that obscure subtle traces. As a result, our predictions are not only more accurate, but also more complete (avoiding early stopping) and more order-consistent (maintaining correct step-wise alignment). This qualitative analysis aligns with the robustness tables and suggests that frequency-aware cues are particularly beneficial for sequential provenance tracing where each step may leave weak, partially overwritten footprints that are easily disrupted by compression and noise.
6
Conclusion
We introduce SEED, the first large-scale benchmark for sequential visual provenance tracing in facial imagery, with over 90,000 diffusion-edited images and fine-grained metadata (edit order and prompts). SEED models ordered edit trajectories and provides a sequence-length-balanced split and sequence-centric metrics that separate token-level correctness from strict history recovery. Our evaluation shows that single-step manipulation detectors transfer poorly to sequential tracing and that performance degrades as chain length increases, highlighting the challenge of compositional and partially overlapping edits. To support benchmarking, we further introduce FAITH, a frequency-aware Transformer baseline that integrates spatial and high-frequency signals. FAITH provides stable improvements across sequence lengths and under common post-processing perturbations, with wavelet components yielding the most consistent gains.
Title Suppressed Due to Excessive Length
15
References 1. Ba, Z., Liu, Q., Liu, Z., Wu, S., Lin, F., Lu, L., Ren, K.: Exposing the deception: Uncovering more forgery clues for deepfake detection. Proceedings of the AAAI Conference on Artificial Intelligence 38(2), 719–728 (2024). https://doi.org/ 10.1609/aaai.v38i2.27829, https://ojs.aaai.org/index.php/AAAI/article/ view/27829 2. Boychev, D., Cholakov, R.: Imaginet: A multi-content benchmark for synthetic image detection. arXiv preprint arXiv:2407.20020 (2024), https://arxiv.org/pdf/ 2407.20020? 3. Chen, B., Zeng, J., Yang, J., Yang, R.: DRCT: Diffusion reconstruction contrastive training towards universal detection of diffusion generated images. In: Proceedings of the 41st International Conference on Machine Learning. Proceedings of Machine Learning Research, vol. 235, pp. 7621–7639. PMLR (2024), https://proceedings. mlr.press/v235/chen24ay.html 4. Chen, Z., Sun, K., Zhou, Z., Lin, X., Sun, X., Cao, L., Ji, R.: Diffusionface: Towards a comprehensive dataset for diffusion-based face forgery analysis. arXiv preprint arXiv:2403.18471 (2024) 5. Cocchi, F., Cornia, M., Baraldi, L., Nicolosi, A., Cucchiara, R.: Contrasting deepfakes diffusion via contrastive learning and global-local similarities. In: Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., Varol, G. (eds.) Computer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LXIII. Lecture Notes in Computer Science, vol. 15121, pp. 199–216. Springer (2024). https://doi.org/10.1007/978-3-031-73036-8_12, https://doi.org/10.1007/978-3-031-73036-8_12 6. Corvi, R., Cozzolino, D., Poggi, G., Nagano, K., Verdoliva, L.: Intriguing properties of synthetic images: From generative adversarial networks to diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops. pp. 973–982 (2023), https://openaccess.thecvf.com/ content/CVPR2023W/WMF/html/Corvi_Intriguing_Properties_of_Synthetic_ Images_From_Generative_Adversarial_Networks_to_CVPRW_2023_paper.html 7. Esser, P., Kulal, S., Blattmann, A., Entezari, R., Müller, J., Saini, H., Levi, Y., Lorenz, D., Sauer, A., Boesel, F., Podell, D., Dockhorn, T., English, Z., Lacey, K., Goodwin, A., Marek, Y., Rombach, R.: Scaling rectified flow transformers for high-resolution image synthesis. In: Proceedings of the 41st International Conference on Machine Learning (2024) 8. Gu, Z., Yao, T., Chen, Y., Ding, S., Ma, L.: Hierarchical contrastive inconsistency learning for deepfake video detection. In: Avidan, S., Brostow, G.J., Cissé, M., Farinella, G.M., Hassner, T. (eds.) Computer Vision - ECCV 2022 - 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XII. Lecture Notes in Computer Science, vol. 13672, pp. 596–613. Springer (2022). https: //doi.org/10.1007/978-3-031-19775-8_35, https://doi.org/10.1007/978-3031-19775-8_35 9. He, Y., Gan, B., Chen, S., Zhou, Y., Yin, G., Song, L., Sheng, L., Shao, J., Liu, Z.: Forgerynet: A versatile benchmark for comprehensive forgery analysis. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 4360–4369 (2021), https://openaccess.thecvf.com/content/ CVPR2021/html/He_ForgeryNet_A_Versatile_Benchmark_for_Comprehensive_ Forgery_Analysis_CVPR_2021_paper.html
16
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB
10. Jiang, L., Li, R., Wu, W., Qian, C., Loy, C.C.: Deeperforensics-1.0: A largescale dataset for real-world face forgery detection. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 2889–2898 (2020), https://openaccess.thecvf.com/content_CVPR_2020/html/ Jiang_DeeperForensics-1.0_A_Large-Scale_Dataset_for_Real-World_Face_ Forgery_Detection_CVPR_2020_paper.html 11. Karras, T., Laine, S., Aila, T.: A style-based generator architecture for generative adversarial networks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 4396–4405 (2019). https://doi.org/ 10.1109/CVPR.2019.00453 12. Le, T.N., Nguyen, H.H., Yamagishi, J., Echizen, I.: Openforensics: Large-scale challenging dataset for multi-face forgery detection and segmentation in-the-wild. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 10117–10127 (2021), https://openaccess.thecvf.com/content/ICCV2021/ html/Le_OpenForensics_Large-Scale_Challenging_Dataset_for_Multi-Face_ Forgery_Detection_and_Segmentation_ICCV_2021_paper.html 13. Lee, C.H., Liu, Z., Wu, L., Luo, P.: Maskgan: Towards diverse and interactive facial image manipulation. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2020) 14. Li, D., Zhu, J., Fu, X., Guo, X., Liu, Y., Yang, G., Liu, J., Zha, Z.: Noise-assisted prompt learning for image forgery detection and localization. In: Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., Varol, G. (eds.) Computer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part XI. Lecture Notes in Computer Science, vol. 15069, pp. 18–36. Springer (2024). https://doi.org/10.1007/978-3-031-73247-8_2, https://doi.org/10.1007/978-3-031-73247-8_2 15. Li, Y., Yang, X., Sun, P., Qi, H., Lyu, S.: Celeb-df: A large-scale challenging dataset for deepfake forensics. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 3207–3216 (2020) 16. Lin, Y., Song, W., Li, B., Li, Y., Ni, J., Chen, H., Li, Q.: Fake it till you make it: Curricular dynamic forgery augmentations towards general deepfake detection. In: Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., Varol, G. (eds.) Computer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LXXXVI. Lecture Notes in Computer Science, vol. 15144, pp. 104–122. Springer (2024). https://doi.org/10.1007/978-3-03173016-0_7, https://doi.org/10.1007/978-3-031-73016-0_7 17. Liu, B., Yang, F., Bi, X., Xiao, B., Li, W., Gao, X.: Detecting generated images by real images. In: Avidan, S., Brostow, G.J., Cissé, M., Farinella, G.M., Hassner, T. (eds.) Computer Vision - ECCV 2022 - 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XIV. Lecture Notes in Computer Science, vol. 13674, pp. 95–110. Springer (2022). https://doi.org/10.1007/9783-031-19781-9_6, https://doi.org/10.1007/978-3-031-19781-9_6 18. Liu, H., Li, C., Wu, Q., Lee, Y.J.: Visual instruction tuning. Advances in neural information processing systems 36, 34892–34916 (2023) 19. Liu, P., Tao, Q., Zhou, J.T.: Evolving from single-modal to multi-modal facial deepfake detection: Progress and challenges (2024). https://doi.org/10.48550/ arXiv.2406.06965, https://arxiv.org/abs/2406.06965 20. Lu, Z., Huang, D., Bai, L., Qu, J., Wu, C., Liu, X., Ouyang, W.: Seeing is not always believing: Benchmarking human and model perception of ai-generated images (2023) 21. Mahara, A., Rishe, N.: Methods and trends in detecting generated images: A comprehensive review (2025). https://doi.org/10.48550/arXiv.2502.15176
Title Suppressed Due to Excessive Length
17
22. Narayan, K., Agarwal, H., Thakral, K., Mittal, S., Vatsa, M., Singh, R.: Df-platter: Multi-face heterogeneous deepfake dataset. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 9739–9748 (2023), https://openaccess.thecvf.com/content/CVPR2023/html/Narayan_ DF-Platter_Multi-Face_Heterogeneous_Deepfake_Dataset_CVPR_2023_paper. html 23. Nguyen, D., Mejri, N., Singh, I.P., Kuleshova, P., Astrid, M., Kacem, A., Ghorbel, E., Aouada, D.: Laa-net: Localized artifact attention network for quality-agnostic and generalizable deepfake detection. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 17395–17405 (2024), https://openaccess.thecvf.com/content/CVPR2024/ html/Nguyen_LAA-Net_Localized_Artifact_Attention_Network_for_QualityAgnostic_and_Generalizable_Deepfake_CVPR_2024_paper.html 24. Nguyen-Le, H.H., Tran, V.T., Nguyen, D.T., Le-Khac, N.A.: Passive deepfake detection across multi-modalities: A comprehensive survey (2024). https://doi. org/10.48550/arXiv.2411.17911 25. Podell, D., English, Z., Lacey, K., Blattmann, A., Dockhorn, T., Müller, J., Penna, J., Rombach, R.: Sdxl: Improving latent diffusion models for high-resolution image synthesis (2023), https://arxiv.org/abs/2307.01952 26. Qian, Y., Yin, G., Sheng, L., Chen, Z., Shao, J.: Thinking in frequency: Face forgery detection by mining frequency-aware clues. In: Vedaldi, A., Bischof, H., Brox, T., Frahm, J. (eds.) Computer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XII. Lecture Notes in Computer Science, vol. 12357, pp. 86–103. Springer (2020). https://doi.org/10.1007/9783-030-58610-2_6, https://doi.org/10.1007/978-3-030-58610-2_6 27. Ricker, J., Damm, S., Holz, T., Fischer, A.: Towards the detection of diffusion model deepfakes. arXiv preprint arXiv:2210.14571 (2022) 28. Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 10684–10695 (2022), https://openaccess.thecvf.com/content/CVPR2022/html/Rombach_ High - Resolution _ Image _ Synthesis _ With _ Latent _ Diffusion _ Models _ CVPR _ 2022_paper.html 29. Rössler, A., Cozzolino, D., Verdoliva, L., Riess, C., Thies, J., Niessner, M.: Faceforensics++: Learning to detect manipulated facial images. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 1– 11 (2019), https://openaccess.thecvf.com/content_ICCV_2019/html/Rossler_ FaceForensics_Learning_to_Detect_Manipulated_Facial_Images_ICCV_2019_ paper.html 30. Shao, R., Wu, T., Liu, Z.: Detecting and recovering sequential deepfake manipulation. In: Computer Vision – ECCV 2022. Lecture Notes in Computer Science, vol. 13673, pp. 712–728. Springer (2022). https://doi.org/10.1007/978-3-031-19778-9_ 41, https://www.ecva.net/papers/eccv_2022/papers_ECCV/papers/136730710. pdf 31. Shao, R., Wu, T., Liu, Z.: Robust sequential deepfake detection. International Journal of Computer Vision 133(6), 3278–3295 (2025) 32. Shuai, C., Zhong, J., Wu, S., Lin, F., Wang, Z., Ba, Z., Liu, Z., Cavallaro, L., Ren, K.: Locate and verify: A two-stream network for improved deepfake detection. In: Proceedings of the 31st ACM International Conference on Multimedia (MM
18
Mengieong Hoi, Zhedong Zheng, Ping LiuB, and Wei LiuB
’23). pp. 7131–7142 (2023). https://doi.org/10.1145/3581783.3612386, https: //doi.org/10.1145/3581783.3612386 33. Song, H., Huang, S., Dong, Y., Tu, W.W.: Robustness and generalizability of deepfake detection: A study with diffusion models (2023). https://doi.org/10. 48550/arXiv.2309.02218 34. Sun, K., Liu, H., Yao, T., Sun, X., Chen, S., Ding, S., Ji, R.: An information theoretic approach for attention-driven face forgery detection. In: Avidan, S., Brostow, G.J., Cissé, M., Farinella, G.M., Hassner, T. (eds.) Computer Vision - ECCV 2022 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XIV. Lecture Notes in Computer Science, vol. 13674, pp. 111–127. Springer (2022). https://doi.org/10.1007/978-3-031-19781-9_7, https://doi.org/10.1007/ 978-3-031-19781-9_7 35. Tan, C., Zhao, Y., Wei, S., Gu, G., Liu, P., Wei, Y.: Frequency-aware deepfake detection: Improving generalizability through frequency space domain learning. Proceedings of the AAAI Conference on Artificial Intelligence 38(5), 5052–5060 (2024). https://doi.org/10.1609/aaai.v38i5.28310, https://ojs.aaai.org/ index.php/AAAI/article/view/28310 36. Tan, C., Zhao, Y., Wei, S., Gu, G., Liu, P., Wei, Y.: Rethinking the up-sampling operations in cnn-based generative network for generalizable deepfake detection. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 28130–28139 (2024), https://openaccess.thecvf.com/content/ CVPR2024/html/Tan_Rethinking_the_Up-Sampling_Operations_in_CNN-based_ Generative_Network_for_Generalizable_CVPR_2024_paper.html 37. Tantaru, D.C., Oneata, E., Oneata, D.: Weakly-supervised deepfake localization in diffusion-generated images. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). pp. 6258–6268 (2024), https://openaccess.thecvf.com/content/WACV2024/html/Tantaru_WeaklySupervised_Deepfake_Localization_in_Diffusion- Generated_Images_WACV_ 2024_paper.html 38. Tian, J., Yu, C., Wang, X., Chen, P., Xiao, Z., Dai, J., Han, J., Chai, Y.: Real appearance modeling for more general deepfake detection. In: Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., Varol, G. (eds.) Computer Vision ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LII. Lecture Notes in Computer Science, vol. 15110, pp. 402–419. Springer (2024). https://doi.org/10.1007/978-3-031-72943-0_23, https://doi.org/10.1007/978-3-031-72943-0_23 39. Tsaban, L., Passos, A.: Ledits: Real image editing with ddpm inversion and semantic guidance (2023). https://doi.org/10.48550/arXiv.2307.00522, https://arxiv. org/abs/2307.00522 40. Wang, T., Liao, X., Chow, K.P., Lin, X., Wang, Y.: Deepfake detection: A comprehensive survey from the reliability perspective. ACM Computing Surveys (2024). https://doi.org/10.1145/3699710 41. Wang, Z., Bao, J., Zhou, W., Wang, W., Hu, H., Chen, H., Li, H.: Dire for diffusion-generated image detection. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 22445–22455 (2023), https: //openaccess.thecvf.com/content/ICCV2023/html/Wang_DIRE_for_DiffusionGenerated_Image_Detection_ICCV_2023_paper.html 42. Wang, Z.J., Montoya, E., Munechika, D., Yang, H., Hoover, B., Chau, D.H.: Diffusiondb: A large-scale prompt gallery dataset for text-to-image generative models (2022), https://arxiv.org/abs/2210.14896
Title Suppressed Due to Excessive Length
19
43. Xie, S., Qiao, T., Li, S., Zhang, X., Zhou, J., Feng, G.: Deepfake detection in the aigc era: A survey, benchmarks, and future perspectives. Information Fusion (2025). https://doi.org/10.1016/j.inffus.2025.103740 44. Zhang, D., Xiao, Z., Li, S., Lin, F., Li, J., Ge, S.: Learning natural consistency representation for face forgery video detection. In: Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., Varol, G. (eds.) Computer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LXXXIII. Lecture Notes in Computer Science, vol. 15141, pp. 407–424. Springer (2024). https://doi.org/10.1007/978-3-031-73010-8_24, https://doi.org/ 10.1007/978-3-031-73010-8_24 45. Zhang, Y., Colman, B., Guo, X., Shahriyari, A., Bharaj, G.: Common sense reasoning for deepfake detection. In: Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., Varol, G. (eds.) Computer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LXXXVIII. Lecture Notes in Computer Science, vol. 15146, pp. 399–415. Springer (2024). https: //doi.org/10.1007/978-3-031-73223-2_22, https://doi.org/10.1007/978-3031-73223-2_22 46. Zhang, Z., Li, M., Li, X., Chang, M., Hsieh, J.: Image manipulation detection with implicit neural representation and limited supervision. In: Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., Varol, G. (eds.) Computer Vision ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LXXXVIII. Lecture Notes in Computer Science, vol. 15146, pp. 255–273. Springer (2024). https://doi.org/10.1007/978-3-031-73223-2_15, https://doi.org/10.1007/978-3-031-73223-2_15 47. Zhao, H., Ma, X., Chen, L., Si, S., Wu, R., An, K., Yu, P., Zhang, M., Li, Q., Chang, B.: Ultraedit: Instruction-based fine-grained image editing at scale. In: Advances in Neural Information Processing Systems (2024), https://proceedings.neurips. cc/paper_files/paper/2024/file/05a30a0fc9e6bacdd3abd4ca8508a9e6-PaperDatasets_and_Benchmarks_Track.pdf 48. Zhu, M., Chen, H., Yan, Q., Huang, X., Lin, G., Li, W., Tu, Z., Hu, H., Hu, J., Wang, Y.: Genimage: A million-scale benchmark for detecting ai-generated image. Advances in neural information processing systems 36, 77771–77782 (2023) 49. Zhuang, W., Chu, Q., Tan, Z., Liu, Q., Yuan, H., Miao, C., Luo, Z., Yu, N.: Uia-vit: Unsupervised inconsistency-aware method based on vision transformer for face forgery detection. In: Avidan, S., Brostow, G.J., Cissé, M., Farinella, G.M., Hassner, T. (eds.) Computer Vision - ECCV 2022 - 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part V. Lecture Notes in Computer Science, vol. 13665, pp. 391–407. Springer (2022). https://doi.org/10.1007/9783-031-20065-6_23, https://doi.org/10.1007/978-3-031-20065-6_23
Supplementary Material for SEED: A Large-Scale Benchmark for Provenance Tracing in Sequential Deepfake Facial Edits
A
Supplementary Dataset Protocol Details
Table S1 complements the dataset comparison table in the main paper by documenting protocol-level details that are difficult to communicate through a compact checkmark matrix. Across deepfake detection and synthetic image forensics, recent surveys consistently argue that reported generalization and robustness are highly contingent on dataset construction and evaluation design, including the choice of generation/editing pipelines, the presence of standardized perturbation suites, the extent of in-the-wild post-processing, and whether the intended evaluation emphasizes cross-generator or cross-domain transfer [19, 24, 40, 43]. In other words, superficially similar “detection” settings can correspond to different threat models and difficulty factors once the underlying protocol is made explicit. Protocol-oriented reviews of AI-generated image detection further highlight this issue by organizing widely used benchmarks according to their generation sources, annotation availability, and evaluation setups, and by discussing representative datasets such as GenImage and ImagiNet in the context of diffusion-era detection cues and robustness testing [21, 43]. Motivated by these observations, Table S1 summarizes for each dataset (i) the major generation/editing pipelines and data sources, (ii) dataset-provided supervision (e.g., order, attribute labels, prompts, and spatial annotations when available), and (iii) the dataset-defined evaluation protocol, including perturbations and any prescribed cross-generator or cross-domain splits. By making these protocol choices explicit, Table S1 enables readers to interpret cross-dataset comparisons under a consistent understanding of what each benchmark is designed to test and why protocol differences materially affect conclusions.
B
SEED Dataset Completeness and Utility
B.1
Step-wise Quality Measurements
For each edit step t, we log four complementary quality measurements: (i) CLIPSim, text-image alignment between the instantiated prompt and the edited image; (ii) DINOv2-Sim, semantic similarity between the pre-edit and postedit images in DINOv2 feature space; (iii) SSIM, structural similarity between the pre-edit and post-edit images; and (iv) CLIP-Image-Sim, image-image similarity in CLIP space. These scores are recorded for auditing dataset difficulty
Supplementary Material
21
Table S1: Protocol-level details for image-based deepfake benchmarks. We summarize major editing/generation methods and the dataset-specific evaluation or perturbation protocols. Dataset
Forgery / Editing Methods
Annotations, Tasks, and Protocol (incl. perturbations if defined)
A. Image Detection / Localization OpenForensics [12] In-the-wild multi-face forgery benchmark with diverse manipulation sources; emphasizes realistic, unconstrained scenarios.
ForgeryNet [9]
DeepFakeFace-DFF [33]
DiffusionFace [4]
GenImage [48]
DRCT-2M [3]
ImagiNet [2]
Fake2M [20]
Provides face-wise spatial supervision for localization (e.g., masks/boundaries) in addition to detection; includes challenge settings with difficulty-aware evaluation and augmentation-based configurations (not a single fixed perturbation suite). Mega-scale benchmark with heterogeneous Supports detection and (for many subsets) synthesis/editing pipelines; covers localization with rich metadata; protocol is identity-replaced and identity-remained dataset-driven rather than a single manipulations (we use the image subset in mandatory suite, and is commonly our comparison). evaluated under cross-domain and distortion robustness settings. Diffusion-centric fake face generation (e.g., Primarily designed for diffusion-era Stable Diffusion v1.5 and inpainting-style detection; generation-focused setup and generation), plus toolbox-based synthesis typically used without a standardized variants. perturbation suite defined by the dataset. Diffusion-based face forgery dataset Provides generator/category metadata to spanning multiple categories (e.g., T2I, I2I, support diffusion forensics; focuses on generation diversity, and protocols are inpainting, and swap-style settings) built typically cross-generator generalization from multiple diffusion models. tests rather than a single unified perturbation suite. Large-scale benchmark for synthetic image Evaluation emphasizes cross-generator and detection across multiple generators cross-domain generalization; commonly (GANs and diffusion models), designed for reports robustness under standard generalizable detection. degradations such as JPEG compression, resizing, and blur (dataset provides standard splits and guidance). Large-scale diffusion-generated image Evaluation-oriented benchmark detection benchmark covering multiple highlighting generalization across diffusion diffusion model families and settings. models and data sources; commonly used with cross-model testing, without enforcing a single fixed perturbation suite. High-resolution benchmark with matched Supports detection (real vs. synthetic) and, real and synthetic images across diverse in some configurations, generator content types (including faces); includes attribution; evaluation often reports multiple generators (as reported). robustness under common post-processing such as resizing/compression. Large-scale synthetic image benchmark Protocol emphasizes large-scale evaluation with millions of AI-generated images and, in some uses, human perceptual paired with real photographs, used for analysis; not restricted to a single fixed detection and perception studies. perturbation suite, with perturbations often applied as evaluation-time stress tests.
B. Provenance Tracing (Sequential) Seq-DeepFake GAN-based sequential component (components) [30] manipulation (e.g., transplanting facial parts) with multi-step trajectories.
Seq-DeepFake (attributes) [30]
Seq-DeepFake-P [31]
SEED (Ours)
GAN-based sequential attribute editing using StyleGAN-style editing pipelines (e.g., Talk-to-Edit), forming multi-step trajectories. Robustness extension of Seq-DeepFake (components + attributes) to stress-test sequential detection/tracing. Diffusion-based sequential, localized, instruction-driven edits with per-step editor sampling (e.g., LEdits, SDXL, SD3-based pipelines), producing 1–4 step trajectories.
Provides step-wise edit order supervision and component-level labels for sequence prediction (provenance tracing); the base dataset does not define a standardized perturbation protocol. Provides step-wise edit order supervision and attribute labels for sequence prediction; the base dataset does not define a standardized perturbation protocol. Defines a standardized perturbation suite: 6 perturbations × 3 levels plus mixed settings (e.g., JPEG, WGN, blur, saturation, contrast, block-wise distortion). Records step-wise provenance (attribute, prompt, mask, editor) and quality measurements as metadata, enabling detection, localization, and edit-order recovery; dataset release focuses on provenance logging rather than enforcing a single fixed perturbation suite (perturbations are applied consistently at evaluation time).
Remark. We omit compact columns (e.g., Mod./Scale/Seq/Sup.) to allocate space to protocol descriptions; the omitted fields are reported in the main paper.
22 Table S2: Step-wise quality statistics in SEED (without counts). We report mean, Std, and percentiles (P25/P50/P95) for each metric at edit index t. All values are rounded to two decimals. t
Metric
Mean
Std
P25
P50
P95
1
CLIP-Sim DINOv2-Sim SSIM CLIP-Image-Sim
0.23 0.94 0.85 0.91
0.04 0.07 0.07 0.07
0.20 0.93 0.80 0.86
0.23 0.97 0.85 0.92
0.29 1.00 0.95 0.99
2
CLIP-Sim DINOv2-Sim SSIM CLIP-Image-Sim
0.22 0.95 0.89 0.92
0.04 0.07 0.07 0.06
0.20 0.94 0.85 0.89
0.22 0.98 0.91 0.94
0.29 1.00 0.97 0.99
3
CLIP-Sim DINOv2-Sim SSIM CLIP-Image-Sim
0.22 0.95 0.90 0.93
0.03 0.07 0.06 0.05
0.19 0.95 0.87 0.91
0.22 0.98 0.92 0.95
0.28 1.00 0.97 0.99
4
CLIP-Sim DINOv2-Sim SSIM CLIP-Image-Sim
0.22 0.96 0.91 0.94
0.03 0.05 0.06 0.04
0.19 0.96 0.88 0.92
0.21 0.99 0.93 0.95
0.28 1.00 0.98 0.99
and for downstream analysis of edit reliability and trace preservation, rather than enforcing narrow acceptance bands. Table S2 reports step-wise statistics grouped by edit index t ∈ {1, 2, 3, 4}, including the mean, standard deviation, and percentile summary (P25/P50/P95). Overall, image-image similarity metrics (DINOv2/SSIM/CLIP-Image-Sim) remain high across steps, while CLIP-Sim exhibits a mild decrease as the edit chain grows longer, consistent with later edits being applied on an already edited face where textual grounding can be less deterministic. B.2
Metadata Schema and File Organization
SEED is released with per-sample JSONL metadata, where the first line stores trajectory-level information and each subsequent line corresponds to one edit step. This design enables faithful reconstruction of the full provenance chain and supports evaluation for trajectory prediction and spatial evidence analysis. Table S3 summarizes the metadata schema. We use file_name to index samples, sequence to store the ordered attribute chain, and model_sequence to record the diffusion editor identifier at each step. Each step line includes the attribute label (seq), editor index (model_idx), prompt/caption, mask information, generation hyperparameters (e.g., num_inversion_steps, guidance_scale,
Supplementary Material
23
Table S3: SEED metadata schema (JSONL). The first line is trajectory-level metadata; each subsequent line corresponds to one edit step. Level
Field
Description
Trajectory
file_name sequence model_sequence prompts
Sample identifier (used to locate images and masks). Ordered attribute IDs, length L ∈ {1, 2, 3, 4}. Ordered editor IDs aligned with sequence. Instantiated prompts used at each step (optional redundancy for convenience).
Step
seq model_idx num_inversion_steps guidance_scale image_guidance_scale seed prompt / caption mask_exists mask_path
Attribute ID of the current step. Editor ID used at this step. Inversion or editing steps for the diffusion editor. Classifier-free guidance scale (editor-dependent). Image guidance scale (editor-dependent). Random seed (optional; present for some editors). Instruction-style prompt and its caption-style form. Whether a valid spatial mask is used. Path to mask file (typically relative to the sample directory). Step-wise scores: clip_sim, clip_image_sim, dinov2_sim, ssim.
metrics
image_guidance_scale), and step-wise metrics. Some fields such as seed may be present for specific editors. JSONL example. {"file_name":"99930","sequence":[1,2,6,3],"model_sequence":[2,2,2,1], "prompts":["Change her eyes color to blue.","Turn her lipstick color to blue.", "Make her eyebrow thick.","A girl with purple hair."]} {"seq":1,"model_idx":2,"num_inversion_steps":60,"guidance_scale":8,"image_guidance_scale":2, "prompt":"Change her eyes color to blue.","caption":"A girl with blue eyes.", "mask_exists":false,"mask_path":"./mask/12.png", "metrics":{"clip_sim":0.2639,"clip_image_sim":0.8182,"dinov2_sim":0.9937,"ssim":0.9549}}
B.3
Split Protocol
SEED uses an identity-disjoint split for training, validation, and testing. Specifically, identities do not overlap across splits, preventing identity leakage and ensuring that reported results are not inflated by subject memorization. Since the split is identity-based by design, we do not additionally report a separate “cross-identity generalization” setting beyond the standard held-out test split. Figure S1 visualizes the core challenge targeted by SEED. For L = 1, evidence is relatively localized and often dominated by a single semantic change. As L increases to 2–4, edits become compositional (intrinsic attributes and accessories), and later operations can suppress earlier traces, producing realistic images whose provenance history is harder to reconstruct from the final output alone. These examples motivate benchmarks with step-wise provenance supervision and analysis
24
L=1
L=2
L=3
L=4
Fig. S1: Representative SEED trajectories with increasing sequence length. Each group corresponds to a sequence length L ∈ {1, 2, 3, 4}. Labels under each example denote the ordered edit chain (e.g., Hair-Glasses or Eyebrows-Hat-Eyes-Lip), illustrating compositional attribute edits and the growing difficulty of recovering complete provenance histories as the edit chain becomes longer.
methods that can aggregate weak evidence across space to recover both attribute identity and temporal order under diffusion-based sequential editing.
C
Experimental Details
This supplementary section provides additional experimental specifications to facilitate reproducibility and clarify evaluation choices summarized in the main paper. In particular, we detail the sequence-level metrics used for edit-trace recovery, report the implementation configuration of FAITH/SeqFakeFormer, and provide runtime efficiency measurements and error-mode analysis to contextualize model behavior under increasing edit-chain length. C.1
Evaluation Metrics
Motivation and sources. Sequential provenance tracing is naturally formulated as an image-to-sequence prediction problem, where a model outputs an ordered chain of manipulated attributes, consistent with prior sequential deepfake manipulation settings [30, 31]. Following standard practice in sequence prediction, we report (i) token-level accuracy under a fixed horizon (to reflect per-step correctness), (ii) strict exact-match accuracy (to reflect complete history recovery),
Supplementary Material
25
and (iii) an overlap-only variant that reduces the dominance of padded positions when sequences are shorter than the maximum length. Notation. Let the ground-truth attribute sequence be y = (y1 , . . . , yT ) with length T = |y|, and the predicted sequence be ŷ = (ŷ1 , . . . , ŷT̂ ) with T̂ = |ŷ|. We set the maximum evaluated length to Tmax = 4 (the SEED protocol). Let ∅ denote the padding token no-manipulation. Define the padding operator Pad(·) that maps any sequence to length Tmax : \tilde {\mathbf {y}} = \mathrm {Pad}(\mathbf {y}) \in (\mathcal {V}\cup \{\varnothing \})^{T_{\max }},\quad \tilde {y}_i = \begin {cases} y_i, & i \le \min (T,T_{\max }),\\ \varnothing , & \text {otherwise}, \end {cases} \label {eq:pad_def}
(1)
˜ = Pad(ŷ). and similarly ŷ Fixed-Acc (position-wise accuracy under fixed length). We compare the padded sequences at all Tmax positions: \mathrm {Fixed\mbox {-}Acc}(\hat {\mathbf {y}},\mathbf {y}) = \frac {1}{T_{\max }} \sum _{i=1}^{T_{\max }} \mathbb {I}\!\left [\tilde {\hat {y}}_i=\tilde {y}_i\right ]. \label {eq:fixed_acc}
(2)
This metric penalizes both wrong attributes and wrong sequence lengths, because missing edits become mismatches against non-padding targets, and extra edits become mismatches against ∅. Adaptive-Acc (overlap-only prefix accuracy). To avoid overweighting padded positions, we compare only the overlapping prefix up to m = min(T̂ , T ):
\mathrm {Adaptive\mbox {-}Acc}(\hat {\mathbf {y}},\mathbf {y}) = \begin {cases} 1, & m=0 \ \text {and}\ \hat {T}=T=0,\\ 0, & m=0 \ \text {and}\ (\hat {T}\neq 0 \ \text {or}\ T\neq 0),\\ \frac {1}{m}\sum _{i=1}^{m}\mathbb {I}\!\left [\hat {y}_i=y_i\right ], & m>0. \end {cases} \label {eq:adaptive_acc}
(3)
Thus Adaptive-Acc focuses on correctness where both sequences overlap, and is less sensitive to trailing missing or extra steps. Full-Acc (strict exact match). We count a sample as correct only when the entire predicted sequence exactly matches the ground-truth in both length and content: \mathrm {Full\mbox {-}Acc}(\hat {\mathbf {y}},\mathbf {y}) = \mathbb {I}\!\left [\hat {T}=T\right ]\cdot \prod _{i=1}^{T} \mathbb {I}\!\left [\hat {y}_i=y_i\right ]. \label {eq:full_acc}
(4)
This is the strictest metric and directly measures complete edit-history recovery. Single illustrative example. Let Tmax = 4, ground-truth y = [Lip, Hat, Eyes], and prediction ŷ = [Lip, Hat] (an under-prediction case). After padding: GT: [ Lip , Hat , Eyes , no-manipulation ] PR: [ Lip , Hat , no-manipulation , no-manipulation ] Fixed-Acc: Fixed-Acc = 3/4 by Eq. (2). Adaptive-Acc: Adaptive-Acc = 2/2 by Eq. (3). Full-Acc: Full-Acc = 0 by Eq. (4).
26 Table S4: Implementation configuration of FAITH/SeqFakeFormer. Component
Setting
Backbone
ResNet-50; sine positional embedding; FrozenBN: False
Input
Image size: 512 × 512
Transformer
Hidden dim: 512; FFN dim: 512; heads: 4; dropout: 0.1; pre-norm: True Encoder layers: 2; Decoder layers: 2 Vocab size: 9; max position embeddings: 5 (output length L = 4) Tokens: SOS=0, EOS=7, PAD=8
Optimization
Batch size: 48; epochs: 150; weight decay: 10−4 ; grad clip: 0.1 LR (backbone): 10−4 ; LR (others): 10−3 Warm-up: 25 epochs; LR milestones: [50, 75, 100]
Interpretation. Fixed-Acc reflects both attribute correctness and length errors under a fixed horizon, Adaptive-Acc isolates correctness on the overlapping portion (reducing padding bias), and Full-Acc enforces strict recovery of the complete edit history, penalizing any mistake in attribute identity, order, or length. C.2
Implementation Configuration
Table S4 lists the configuration used for FAITH/SeqFakeFormer, including the backbone, transformer capacity, and optimization schedule. C.3
Runtime Efficiency and Throughput
To quantify inference cost, we benchmark end-to-end decoding throughput under the same autoregressive protocol used in evaluation (maximum length 4 with early stopping by EOS). We report parameter count, throughput (images per second), latency (milliseconds per image), and GPU memory usage. The benchmark uses batch size 16 with AMP enabled, a 10-batch warm-up, and times inference over 512 images. Peak memory is measured using torch.cuda.max_memory_allocated and torch.cuda.max_memory_reserved during the benchmark window. Table S5: Runtime efficiency of FAITH/SeqFakeFormer (end-to-end decoding). Throughput and latency include full autoregressive decoding up to length 4 with early stopping. AMP is enabled, batch size is 16, warm-up is 10 batches, and timing is over 512 images. Params
Batch
Throughput
Latency
Peak Mem
33.51 (M)
16
100.15 (img/s)
9.98 (ms/img)
927.17 (MB)
Additional memory note. In the same run, the peak reserved memory is 1064.0 MB, while the current allocated memory after benchmarking is 137.21
Supplementary Material
27
Table S6: Error-mode breakdown by ground-truth length L. Values are percentages and sum to 100% within each L. L
Full-correct
Early-stop
Over-length
Swap-only
Wrong-attribute
1 2 3 4
93.01 77.10 50.35 24.74
0.00 1.93 6.52 6.63
1.24 2.53 3.25 0.00
0.00 10.41 35.01 67.85
5.75 8.03 4.87 0.78
MB. We report both allocated and reserved memory in the released benchmark logs for completeness. C.4
Error-Mode Breakdown by Sequence Length
To better understand failure cases under sequential provenance tracing, we categorize prediction errors into mutually exclusive types, computed per sample by comparing the non-padding predicted sequence ŷ and ground-truth y: (i) Full-correct, exact match in both order and length; (ii) Early-stop, T̂ < T (premature termination); (iii) Over-length, T̂ > T (spurious extra edits); (iv) Swap-only, T̂ = T and the multiset of predicted attributes matches the ground-truth but with a different order; (v) Wrong-attribute, all remaining mismatches (including wrong attribute identity within the overlap). This analysis directly complements Full-Acc by revealing whether failures are dominated by length errors, order errors, or attribute confusion. Table S6 reports the breakdown by ground-truth sequence length L ∈ {1, 2, 3, 4}. We use a balanced evaluation with N =2000 samples per length to avoid dominance by any single length group. As L increases, the dominant error mode transitions from mild over-length or attribute mistakes to order errors (Swap-only), indicating that recovering the correct temporal ordering becomes the primary bottleneck for long edit chains. Notably, Swap-only accounts for 35.25% of errors at L = 3 and 67.85% at L = 4, consistent with the fact that later edits can partially overwrite earlier traces and make order-specific cues weak in the final image. Implications for the three metrics. Order-dominant failures (Swap-only) sharply reduce Full-Acc because exact match requires the correct temporal ordering. Fixed-Acc penalizes Swap-only errors at the mismatched positions, while Adaptive-Acc can remain relatively higher when early steps match but later order diverges. Length errors (Early-stop and Over-length) are penalized by Fixed-Acc due to padding mismatches and by Full-Acc due to length mismatch, while Adaptive-Acc is comparatively less sensitive because it evaluates only the overlapping prefix.