SafeGuard: A Multi-Agent Perception-Reasoning Framework for Social-Risk AI-Generated Video Detection¶

Conference: ECCV 2026
Paper: ECCV Official
Code: https://github.com/williamw99/SafeGuard
Area: Multimodal VLM / VLM Reasoning
Keywords: AI-Generated Video Detection, Multi-Agent Collaboration, Perception-Reasoning Gap, Social Risk Safety, Physical Consistency Verification

TL;DR¶

To tackle the fundamental "perception-reasoning gap" in detecting high-fidelity social-risk AI-generated videos, SafeGuard coordinates a hierarchical perceptual solver for fine-grained physical forensic cue extraction with a self-reflective verifier for semantic-physical consistency checking, substantially outperforming prior specialized detectors and generalist vision-language models without end-to-end task retraining.

Background & Motivation¶

Recent advances in generative video models have progressed from localized manipulation and face swapping toward full-scene synthesis. Modern generative architectures (such as Sora, Pika, Wan, and CogVideoX) produce globally coherent, semantically consistent videos with exceptional visual fidelity, making synthetic footage virtually indistinguishable from authentic camera captures. Consequently, synthetic content increasingly poses severe societal risks: generative systems are no longer restricted to identity manipulation, but can synthesize entire events involving disinformation, violent altercations, and sensitive political scenarios. However, conventional AI-generated video detection benchmarks (such as GenVideo, DVF, and GenVidBench) exhibit a pronounced distribution bias toward benign, everyday scenes (e.g., natural landscapes and daily human routines), largely neglecting high-risk, semantically complex scenarios that demand rigorous reasoning over physical laws, structural coherence, and social logic.

Under complex social-risk circumstances, existing detection paradigms fall into an intrinsic "Perception–Reasoning Gap". On one hand, task-specific discriminative detectors (e.g., DeMamba, FTCN, NPR) excel at capturing low-level pixel irregularities, frequency-domain artifacts, or optical flow noise, yet completely lack higher-level semantic scene comprehension and causal reasoning capabilities; as a result, their generalization performance collapses when confronted with unseen generative generators or high-fidelity content. On the other hand, generalist vision-language foundation models (e.g., GPT-4o, Qwen3-VL, InternVL3.5) possess superior semantic abstraction and logical deduction abilities, yet their downsampled visual tokens render them largely blind to subtle, localized forensic cues (such as micro-level geometric warping, boundary high-frequency noise, or sudden frame-level motion inconsistencies), causing them to be misled by superficial visual realism into predicting "authentic". Preserving fine-grained forensic sensitivity while maintaining high-level semantic reasoning creates an inherent tension that has bottlenecked modern forensics.

To address this challenge, this paper decouples low-level forensic evidence extraction from high-level semantic reasoning, unifying them into an agentic closed loop via collaborative specialization and reflective verification. Core idea: propose SafeGuard, a multi-agent framework comprising a Hierarchical Perceptual Solver and a Self-Reflective Verifier, which first formulates risk-aware hypotheses to guide spatial-temporal video cropping and multi-dimensional physical forensic extraction, and subsequently enforces bidirectional semantic-physical consistency auditing and closed-loop refinement to establish an interpretable, evidence-grounded decision chain.

Method¶

Overall Architecture¶

SafeGuard structures video forgery detection into a closed-loop inference process: "semantic suspicion formulation $\to$ targeted evidence search $\to$ evidence-grounded reasoning $\to$ self-reflective consistency auditing". The framework operates through two collaborative modules: the Hierarchical Perceptual Solver hierarchically parses global scene dynamics, localizes high-risk candidate regions, and invokes a specialized forensic toolbox across multiple physical dimensions to formulate an initial verdict; the Self-Reflective Verifier functions as an active logic gatekeeper that audits the entire execution trace for evidence-hypothesis coherence and triggers closed-loop reflective refinement whenever discrepancies or hallucinations emerge.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Input Video V"] --> B["1. Risk-Aware Hypothesis Generation and Routing<br/>Extract scene context C, generate hypothesis Ht and candidate region Rt"]
    B --> C["2. Language-Guided Localization and Forensic Extraction<br/>Grounding DINO + SAM 2 extract masks and query physical toolbox"]
    C --> D["3. Evidence-Grounded Reasoning<br/>Jointly model physical scores and global context for initial verdict yt and score st"]
    D --> E["4. Evidence-Hypothesis Consistency Checking<br/>Self-Reflective Verifier audits reasoning trace and outputs Sver and feedback Ft"]
    E -->|Sver < γ and t ≤ L| F["5. Closed-Loop Reflective Refinement<br/>Incorporate feedback Ft to update hypothesis Ht+1 and re-initiate cycle"]
    F --> B
    E -->|Sver ≥ γ or t > L| G["Output final detection verdict and interpretable forensic report"]

Key Designs¶

1. Risk-Aware Hypothesis Generation and Routing: Semantic-guided attention on high-risk interaction zones

In full-scene synthetic videos, static background elements (such as buildings or roads) are frequently rendered with high stability, whereas complex human body postures, close physical interactions, or fast-moving contact zones concentrate the vast majority of generative flaws. Processing full frames indiscriminately dilutes critical forensic signals across benign backgrounds. This module first deploys a large vision-language model to summarize the input video $V$ into a global dynamic context $C$ (e.g., "a chaotic street riot with intense physical altercations") and generates a risk-aware forgery hypothesis $H_t$ that hypothesizes plausible manipulation categories (e.g., identity distortion, unnatural limb blending, or temporal tearing): $$H_t = \text{LVLM}_{\text{H}}(C)$$ Guided by $C$ and $H_t$, a routing agent filters out benign backgrounds and pinpoints the most suspicious spatial-temporal candidate region query $R_t$: $$R_t = \text{LVLM}_{\text{rout}}(V, C, H_t)$$ This semantic abstraction concentrates subsequent forensic scrutiny exclusively on high-risk interaction zones, enhancing detection precision and compute efficiency.

2. Language-Guided Localization and Forensic Extraction: Multi-dimensional physical toolbox for targeted evidence collection

High-level multimodal models cannot directly observe low-level pixel irregularities; they require quantitative physical confidence scores provided by specialized discriminative tools. This design adopts a two-stage language-guided segmentation pipeline coupled with a multi-perspective physical toolbox: conditioned on the query $R_t$, Grounding DINO predicts bounding boxes $\{B_i^t\}_{i=1}^N$ across $N$ sampled frames, after which SAM 2 generates fine pixel-level masks $M_t = \{M_i^t\}_{i=1}^N$. The video is cropped to isolate the target interaction content $V_t^{\text{crop}} = V \odot M_t$. Next, a specialized toolbox $\mathcal{T} = \{f_o, f_d, f_a, f_p\}$ inspects the cropped region across four complementary physical dimensions: - Optical Flow Tool $f_o$ (built on RAFT): captures temporal motion discontinuities, frame-to-frame limb trajectory jumps, and unnatural ghosting; - Geometric Depth Tool $f_d$ (built on Depth Anything V2): evaluates 3D structural plausibility to detect impossible mesh penetration or volume collapse; - Appearance Representation Tool $f_a$ (built on DINOv2): verifies identity preservation and texture consistency across frames; - Pixel-Level Signal Tool $f_p$ (built on D3 second-order features): analyzes high-frequency boundary noise and subtle localized synthesis residues.

The toolbox outputs a structured physical evidence vector $E_t^{\text{phy}}$: $$E_t^{\text{phy}} = \begin{bmatrix} f_o(V_t^{\text{crop}}) \\ f_d(V_t^{\text{crop}}) \\ f_a(V_t^{\text{crop}}) \\ f_p(V_t^{\text{crop}}) \end{bmatrix} \in (0, 1)^4$$ where each scalar represents the estimated probability that the cropped region is authentic. The multi-dimensional cues cross-calibrate one another, mitigating false positives caused by isolated artifact detectors.

3. Evidence-Grounded Reasoning: Joint inference over physical cues and semantic causal context

Raw numerical forensic scores cannot directly serve as a final verdict, as natural rapid motion, camera shake, or environmental occlusions can also induce optical flow turbulence or high-frequency pixel anomalies. To prevent misleading classifications, the reasoning agent $\text{LVLM}_{\text{reason}}$ interprets the physical evidence $E_t^{\text{phy}}$ strictly under the joint constraints of global context $C$ and forgery hypothesis $H_t$. The module evaluates whether the observed physical irregularities causally align with the generative anomaly mechanism postulated in $H_t$ (e.g., verifying whether an optical flow disruption stems from impossible anatomical limb generation rather than normal motion blur): $$(y_t, s_t) = \text{LVLM}_{\text{reason}}(H_t, C, E_t^{\text{phy}})$$ This transforms isolated numerical signals into an initial verdict $y_t \in \{\text{Real}, \text{Synthesized}\}$ accompanied by a confidence score $s_t$, ensuring that each verdict is anchored in concrete physical evidence.

4. Evidence-Hypothesis Consistency Checking: Bidirectional multi-criteria logic gatekeeper

Preliminary verdicts generated by large models can still suffer from spurious correlations or hallucinations. The Self-Reflective Verifier acts as an independent forensic auditor, examining the entire execution trace across multiple criteria: - whether the hypothesis $H_t$ logically conforms to the social-risk context $C$; - whether the segmentation mask $M_t$ accurately isolates the targeted query region $R_t$; - whether the deployed tools in $\mathcal{T}$ suit the dynamic scene characteristics, and whether the physical cues $E_t^{\text{phy}}$ logically substantiate the verdict $y_t$.

The verifier produces a reliability score $S_t^{\text{ver}}$ alongside actionable natural-language feedback $F_t$: $$(S_t^{\text{ver}}, F_t) = \text{LVLM}_{\text{check}}(C, H_t, R_t, M_t, \mathcal{T}, E_t^{\text{phy}}, y_t, s_t)$$ If $S_t^{\text{ver}}$ falls below a critical reliability threshold $\gamma$ (set to 0.5), the initial verdict is rejected, and reflective refinement is triggered.

5. Closed-Loop Reflective Refinement: Adaptive error correction through iterative state cycles

When verification fails, rather than repeating identical steps, the system incorporates the diagnostic feedback $F_t$ (e.g., "the detected motion discontinuity occurs solely along static background boundaries and lacks causal alignment with the foreground subject; re-localize the primary interaction") to update the hypothesis from $H_t$ to $H_{t+1}$: $$H_{t+1} = \begin{cases} H_t, & \text{if } S_t^{\text{ver}} \ge \gamma \text{ or } t > L \\ \text{LVLM}_{\text{H}}(C, H_t, F_t), & \text{otherwise} \end{cases}$$ The solver re-executes localized routing and forensic extraction under $H_{t+1}$ until the trace passes consistency checking or reaches the maximum cycle limit $L$ (set to 3). This closed loop significantly suppresses artifact-induced false alarms.

A Worked Example¶

Consider an AI-generated video depicting a violent physical brawl in front of a glass entrance: 1. Global Context & Hypothesis Formulation: $\text{LVLM}_H$ summarizes the scene context $C$ as "two adult males engaged in an intense physical brawl near an indoor doorway" and constructs hypothesis $H_1$ emphasizing that "intense physical conflict frequently induces anatomical warping and environmental mesh collision errors"; 2. Spatial-Temporal Routing & Localization: $\text{LVLM}_{rout}$ identifies the candidate query $R_1$ as "the interaction contact zone between the two combatants and the adjacent glass door", prompting Grounding DINO and SAM 2 to generate fine masks $M_1$ and isolate $V_1^{\text{crop}}$; 3. Toolbox Extraction & Quantified Cues: Optical flow analysis indicates severe temporal tearing ($f_o = 0.08$, highly synthetic); depth estimation reveals that the victim's 3D mesh physically penetrates the rigid planar surface of a solid glass door without shattering or deforming the glass ($f_d = 0.05$); conversely, appearance and pixel analyzers output $f_a = 0.88$ and $f_p = 0.79$, misled by high-fidelity rendering; 4. Evidence-Grounded Reasoning: $\text{LVLM}_{reason}$ contextualizes the inputs, concluding that despite high visual rendering quality, the physical penetration of a rigid glass door and temporal flow discontinuities represent non-negotiable physical law violations, producing initial verdict $y_1 = \text{Synthesized}$ with confidence $s_1 = 0.90$; 5. Consistency Checking: The verifier $\text{LVLM}_{check}$ confirms that the geometric penetration evidence logically proves the hypothesized conflict manipulation, validating tool reliability and assigning $S_1^{\text{ver}} = 0.95 \ge 0.5$, thereby approving the final forensic report.

Key Experimental Results¶

Main Results¶

The authors curate SafeVid, the first AI-generated video detection benchmark dedicated to social safety (comprising 20,356 videos: 10,178 real videos and 10,178 synthetic videos generated by 21 state-of-the-art models across 10 social risk categories). SafeGuard is benchmarked on SafeVid (In-Domain ID and Out-of-Domain OOD splits) and four established public benchmarks (GenVideo, DVF, LOKI, GenVidBench).

Table 1 summarizes comparative results across task-specific detectors, generalist foundation models, human evaluators, and SafeGuard:

Category	Method	SafeVid ID Acc (%)	SafeVid ID F1 (%)	SafeVid OOD Acc (%)	SafeVid OOD F1 (%)	SafeVid Avg Acc (%)	GenVideo Acc (%)	DVF Acc (%)	LOKI Acc (%)	GenVidBench Acc (%)	Overall Avg Acc (%)
Human	Human Evaluator	77.0	85.4	80.9	80.0	79.2	-	-	-	-	79.2
Task-Specific	NPR [CVPR'24]	71.6	75.5	62.8	63.3	65.0	85.3	54.6	57.2	53.0	63.0
Task-Specific	FTCN [ICCV'21]	82.3	82.5	41.6	44.4	51.6	95.6	83.4	68.1	65.3	72.8
Task-Specific	DeMamba [SCIS'26]	78.8	80.3	43.0	48.5	51.8	94.4	90.1	69.0	71.4	75.5
Task-Specific	BusterX++ [arXiv'25]	69.7	68.8	64.7	55.2	66.8	76.1	70.4	70.4	51.6	67.1
Generalist VLM	InternVL3.5-38B	42.9	18.1	52.7	19.7	48.5	58.5	61.2	56.3	47.3	54.4
Generalist VLM	Qwen3-VL-32B	62.0	60.2	62.1	47.2	62.1	78.4	75.0	70.0	58.3	68.8
Generalist VLM	GPT-4o (Zero-Shot)	65.9	70.1	63.7	52.0	64.6	77.6	74.5	55.8	61.5	66.8
Generalist VLM	Gemini-2.5-Pro	64.3	59.0	58.4	39.6	61.0	83.2	76.8	59.6	54.6	67.1
Agentic Framework	SafeGuard (Qwen3-VL)	92.2	90.0	76.2	71.2	82.9	97.2	96.3	84.7	80.6	88.3
Agentic Framework	SafeGuard (GPT-4o)	93.0	90.7	80.1	72.8	85.5	97.9	97.0	81.7	84.6	89.3

Ablation Study¶

Table 2 details the incremental ablation of each architectural component and the step-by-step contribution of the forensic toolbox:

Group	Variant	SafeVid Avg Acc (%)	SafeVid Avg F1 (%)	GenVideo Acc (%)	DVF Acc (%)	LOKI Acc (%)	GenVidBench Acc (%)	Overall Avg Acc (%)
Architecture	Baseline (GPT-4o alone)	64.6	60.5	77.6	74.5	55.8	61.5	66.8
Architecture	+ Hypothesis & Routing (SHGR)	66.0	59.1	77.7	75.0	59.9	63.8	68.5
Architecture	+ Video Cropping (SHGR + VC)	67.5	71.0	84.3	80.9	64.4	65.0	72.4
Architecture	+ Self-Reflective Verifier (SHGR + VC + SRV)	74.5	71.8	92.3	91.6	77.6	73.1	81.8
Architecture	+ Forensic Trace Extraction (SHGR + VC + FTE)	79.0	76.0	93.0	94.0	79.3	75.4	84.1
Architecture	SafeGuard (Full System)	85.5	80.9	97.9	97.0	81.7	84.6	89.3
Toolbox	w/o tool use	74.5	71.8	92.3	91.6	77.6	73.1	81.8
Toolbox	+ Optical Flow ($w/ f_o$)	75.6	74.7	93.1	93.6	78.2	74.6	83.0
Toolbox	+ Depth ($w/ f_o + f_d$)	78.5	78.4	95.1	94.0	78.7	78.7	85.0
Toolbox	+ Appearance ($w/ f_o + f_d + f_a$)	83.3	79.5	96.2	96.3	81.6	82.5	88.0
Toolbox	Full Toolbox ($w/ f_o + f_d + f_a + f_p$)	85.5	80.9	97.9	97.0	81.7	84.6	89.3

Key Findings¶

Task-specific detectors collapse on out-of-domain videos: Models like FTCN and DeMamba achieve over 94%~95% accuracy on GenVideo (their training domain), yet their accuracy plunges to 41.6% and 43.0% on SafeVid OOD splits—worse than random guessing. Purely fitting low-level statistical artifacts fails to generalize across emerging generative architectures.
Generalist VLMs suffer from a severe perceptual realism bias: Zero-shot GPT-4o and Gemini-2.5-Pro hover between 61% and 65% accuracy on SafeVid because realistic rendering and plausible lighting deceive their holistic evaluations; open-source VLMs without forensic grounding perform even worse (InternVL3.5 drops to 48.5%).
Depth geometry and appearance features provide the largest boosts: In the toolbox ablation, incorporating depth estimation $f_d$ and appearance consistency $f_a$ yields the steepest performance leaps (overall accuracy rising from 83.0% to 88.0%), confirming that 3D geometric stability and multi-frame subject identity consistency represent the most discriminative vulnerabilities of contemporary video generators.
Reflective verification requires physical grounding: Activating the Self-Reflective Verifier without forensic trace extraction (w/ SRV without FTE) yields 81.8% overall accuracy, whereas integrating both reaches 89.3%. Textual self-reflection cannot hallucinate physical reality; it requires quantitative forensic evidence as an immutable anchor.

Highlights & Insights¶

Collaborative Perceptual-Reasoning Specialization: SafeGuard elegantly reconciles the conflict between low-level forensic sensitivity and high-level semantic reasoning by assigning them to dedicated, specialized agents (Solver as probe, Verifier as magistrate).
Training-Free, Highly Interpretable Inference: The core multi-agent framework requires zero end-to-end task fine-tuning on detection datasets, linking semantic suspicion, localized evidence extraction, and logical deduction into a transparent, reproducible audit trail.
Benchmark Pioneering Social Safety: SafeVid fills a critical void by moving beyond mundane, benign scenes to evaluate real-world forensic resilience across 10 critical social risk categories and 21 state-of-the-art generators.

Limitations & Future Work¶

Inference Latency and Iteration Overhead: Running object detection, frame-wise SAM 2 segmentation, multi-tool forward passes, and multi-turn LLM reasoning incurs substantial compute cost, rendering it unsuitable for millisecond-level online live-stream moderation.
Cascading Errors in Challenging Segmentations: In extreme crowd scenarios with heavy occlusion, segmentation drift in Grounding DINO or SAM 2 can corrupt cropped physical cues, occasionally exhausting the maximum reflection budget ($L=3$).
Future Directions: Exploring offline distillation of multi-agent reasoning traces into a unified, lightweight multimodal model, and integrating audio-visual cross-modal consistency tools into the forensic suite.

vs DeMamba / FTCN / NPR (Discriminative Baselines): Traditional detectors model spatial-temporal residuals or frequency artifacts, achieving strong in-domain accuracy but failing dramatically on unseen out-of-domain distributions; SafeGuard leverages VLM-guided routing and semantic arbitration to surpass FTCN by nearly 40% accuracy on SafeVid OOD.
vs GPT-4o / Gemini-2.5-Pro / VideoLLaMA3 (Generalist Foundation Models): Foundation VLMs possess macro-level semantic understanding but lack micro-level forensic vision, easily falling prey to high-fidelity visual aesthetics; SafeGuard equips them with a physical toolbox and reflective validation, grounding textual reasoning in empirical physical evidence.
vs LAVID / BusterX++ (Agentic / Explanatory Models): Existing agentic frameworks rely primarily on coarse, frame-level textual reasoning without fine-grained pixel segmentation or bidirectional reflective auditing; SafeGuard's closed-loop gatekeeper prevents error propagation and hallucinated decisions.

Rating¶

Novelty: ⭐⭐⭐⭐⭐ Introduces the task of social-risk video generation detection and decouples perception from reasoning via an elegant multi-agent architecture.
Experimental Thoroughness: ⭐⭐⭐⭐⭐ Thoroughly evaluated on the 20K SafeVid benchmark and 4 public datasets, benchmarking against dozens of discriminative and generalist baselines with extensive ablations.
Writing Quality: ⭐⭐⭐⭐⭐ Rigorous motivation, lucid methodological explanations, and well-structured empirical analyses.
Value: ⭐⭐⭐⭐⭐ Highly impactful for AI safety governance, public security moderation, and multimodal forensic tool design.