{"id":"91f3a540-7546-4fe0-ae13-ac98ca882b11","arxiv_id":"2504.19876","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A LoRA-tuned CLIP-ViT with deep-shallow feature fusion and triplet loss detects images from unseen GANs and diffusion models at 89% average accuracy when trained only on four ProGAN classes.","lead":"DeeCLIP is a CLIP-based detector for AI-generated images that adds a feature fusion module and triplet loss to a LoRA-tuned vision transformer. Trained only on a small ProGAN subset, it reports 89% average accuracy across 19 unseen generators and improved robustness to blur.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 1 contradicts the abstract: DeeCLIP's 89.00% mean accuracy is below C2P-CLIP (93.79%), RINE (91.31%), and FatFormer (90.86%), so 'outperforms existing methods' is unsupported; JPEG rows likewise undercut the stated robustness gain.","rationale":"The paper contains internally consistent numbers and a plausible architecture; the code is public, so the empirical results are checkable. However, the central claim as written is a SOTA/robustness claim, and the paper's own tables undercut it: DeeCLIP is not the best on the main benchmark, and its robustness advantage is absent under JPEG. This is more decisive than the reader's baseline-comparability concern, which is real but would only matter if DeeCLIP were otherwise ahead; as reported, the 'outperforms' claim fails on the published numbers. I keep the conditional verdict because the underlying method is competitive and the issues are addressable in revision: soften or qualify the SOTA/robustness claims, report JPEG and blur averages separately, add ablations for DeeFuser and triplet loss, and either re-run baselines under a common pipeline or clearly label the comparison as cross-paper. The weaknesses are presentation/verification issues rather than a fundamental invalidation of the approach.","tokens_in":12441,"tokens_out":8276,"duration_ms":77415,"concrete_test":"Reproduce Table 1 under one shared pipeline: train DeeCLIP, C2P-CLIP, RINE, and FatFormer on the same 4-class ProGAN split with identical preprocessing (CLIP-style resize/normalization, same 3,000-image test subsets) and compute mean accuracy over the 19 subsets; if C2P-CLIP/RINE/FatFormer mAcc stays above 89.00%, the Abstract's 'outperforms existing methods' claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim 'DeeCLIP outperforms existing methods' (Abstract; also 'state-of-the-art' in Section 1) is contradicted by the paper's own Table 1 on the primary 19-subset UniversalFakeDetect benchmark: DeeCLIP's mean accuracy is 89.00%, while C2P-CLIP (camera/deepfake variant), RINE, and FatFormer reach 93.79%, 91.31%, and 90.86%. The prose in Section 3 downgrades to 'competitive' and 'one of the best-performing methods', so the headline overreaches. The robustness claim is equally selective: the 10.36% average gain over C2P-CLIP in Table 3 is driven by Gaussian blur, while under JPEG compression DeeCLIP is worse at every reported quality (q=80: 68.33 vs 69.32; q=70: 65.68 vs 70.54; q=60: 61.52 vs 68.70), yet the Abstract groups 'compression and blurring' as supported degradations. The reader's concern about copied baseline numbers is valid—Section 3 states baselines are taken from the original papers rather than re-run under DeeCLIP's preprocessing—but the internal contradiction in Table 1 means the SOTA/outperform claim fails even if those reported numbers are accepted at face value.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DeeCLIP, a transformer-based framework for detecting AI-generated images. It adapts a CLIP-ViT (ViT-L/14) image encoder using LoRA, introduces a DeeFuser module that fuses shallow and deep features via cross-attention, and trains with a combination of triplet loss and binary cross-entropy. The model is trained only on 4-class ProGAN data and evaluated on the 19-subset UniversalFakeDetect benchmark, where it reports 89.00% mean accuracy, as well as on a separate 12-subset held-out benchmark where it reports 78.99% accuracy. The paper additionally evaluates robustness to Gaussian blur and JPEG compression and reports an overall average accuracy of 71.91% versus 61.55% for C2P-CLIP. The authors claim that DeeCLIP outperforms existing methods despite having fewer trainable parameters.","tokens_in":12779,"tokens_out":4001,"duration_ms":36815,"significance":"If the results hold after scrutiny, DeeCLIP would offer a parameter-efficient CLIP-based detector that generalizes across GAN and diffusion generators, which is a practically relevant capability for AI-generated image forensics. The paper's strengths include a held-out evaluation on unseen generators (Table 2), which is a meaningful generalization test, and the release of code. The LoRA adaptation and multi-layer fusion are reasonable ideas that could be useful to the community. However, the current manuscript's headline claims of state-of-the-art performance and robustness to compression are not supported by its own reported numbers, and several core components are not ablated. The technical approach is plausible but needs corrected claims and additional experiments to be acceptable.","major_comments":[{"comment":"The claim that DeeCLIP \"outperforms existing methods\" (Abstract) and achieves \"state-of-the-art (SOTA) performance\" (Section 1) is contradicted by Table 1: DeeCLIP's mean accuracy of 89.00% is lower than C2P-CLIP (93.79%), RINE (91.31%), and FatFormer (90.86%). The Section 3 prose correctly downgrades the claim to \"competitive\" and \"one of the best-performing methods,\" but the abstract and introduction must be revised to match the evidence, or the claim needs to be justified with a specific criterion (e.g., parameter efficiency) rather than overall accuracy.","section":"Abstract; Section 1; Section 3, Table 1"},{"comment":"The robustness claim that DeeCLIP is robust to \"compression and blurring\" is only supported for Gaussian blur. Under JPEG compression, DeeCLIP is worse than C2P-CLIP at every reported quality level (q=80: 68.33 vs 69.32; q=70: 65.68 vs 70.54; q=60: 61.52 vs 68.70). The overall 10.36% average gain in Table 3 is driven primarily by the blur rows, where DeeCLIP is substantially better. The abstract's grouping of compression with blurring as equally supported degradations overstates the evidence.","section":"Abstract; Section 3, Table 3"},{"comment":"The baseline numbers in Tables 1 and 2 are taken from the original papers (\"we report the results presented in the original C2P-CLIP paper\" and RINE from its paper) rather than re-run under DeeCLIP's exact preprocessing, image resolution, class balance, and split protocol. This makes all head-to-head comparisons potentially incomparable. The authors should either re-run the baselines under the same pipeline or explicitly state this limitation throughout the paper and avoid strong comparative claims such as \"outperforms.\"","section":"Section 3, Baselines"},{"comment":"The ablation study only compares a fixed CLIP-ViT backbone against LoRA fine-tuning (84.53% vs 89.00%). DeeFuser and the triplet loss are presented as key contributions (Section 1), but no experiment removes or varies them, so the paper does not establish that these modules contribute to the reported accuracy or robustness. Ablations for DeeFuser and for the triplet loss (and their interaction) are needed to support the causal attribution in the conclusion.","section":"Section 3, Ablation study"},{"comment":"The statement in the Abstract that DeeCLIP achieves strong performance \"despite having fewer trainable parameters\" is contradicted by Table 2, which reports 306M parameters for DeeCLIP versus 304M for C2P-CLIP. If the intended comparison is to the number of trainable parameters under LoRA (not total parameters), this must be stated explicitly with the corresponding numbers; otherwise the claim is factually incorrect as written.","section":"Abstract; Table 2"}],"minor_comments":[{"comment":"There is a typo \"Figue 1\" in the paragraph introducing Figure 1; it should be \"Figure 1.\"","section":"Section 1"},{"comment":"The column header \"DallemAcc\" is malformed and should be split into \"DALL·E\" and \"mAcc\" for readability.","section":"Section 3, Table 1"},{"comment":"The method name \"FatchFor\" in the text appears to be a typo for \"PatchFor,\" which would match the row label in Table 1.","section":"Section 3, Baselines"},{"comment":"The 12-subset held-out dataset (ControlNet, DALL·E 3, DiffusionDB, IF, LaMA, LTE, SD2Inpaint, SDXL, SGXL, SD3) is introduced without a citation or a description of how the subsets were constructed and preprocessed; adding this information would improve reproducibility.","section":"Section 3, Generalization"},{"comment":"Figure 5 is described in the text but the plot itself is not discussed in detail; the caption should indicate how to read the curves (e.g., accuracy vs. severity) for readers unfamiliar with the format.","section":"Figure 5"}],"recommendation":"major_revision","confidential_remarks":"The central difficulty is that the reported numbers in Table 1 contradict the abstract's \"outperforms\" claim even under the authors' own baseline values. This is not a case of a subtle statistical error but a straightforward mismatch between headline and evidence. The held-out result in Table 2 is the paper's most credible contribution, but it needs a fair comparison with re-run baselines. The scope of revision is substantial: correcting claims, re-running or substantially justifying baselines, and adding ablations for DeeFuser and triplet loss. I therefore recommend major revision rather than reject, as the underlying method is plausible and the code is promised to be public."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"DeeCLIP is worth a serious look. The core result is a LoRA-tuned CLIP-ViT with a fusion module and triplet loss, trained only on 4-class ProGAN, reaching 89% mean accuracy on UniversalFakeDetect and 78.99% on a held-out benchmark. Those numbers are internally consistent, the held-out evaluation is genuine, and the authors ship code. The parameter count (306M) is lower than comparably performing methods. That makes this a real engineering contribution in the deepfake-detection subfield.\n\nThe paper is not, however, a state-of-the-art result. Table 1 puts DeeCLIP at 89.00%, below C2P-CLIP (93.79%), RINE (91.31%), and FatFormer (90.86%). The abstract's 'outperforms existing methods' and the introduction's 'SOTA' are contradicted by the paper's own numbers. Section 3 quietly downgrades to 'competitive' and 'one of the best-performing methods,' which is accurate. The robustness claim is similarly selective: the 10.36% average gain over C2P-CLIP is driven almost entirely by Gaussian blur, and under JPEG compression DeeCLIP loses at every reported quality level. The text admits this in places, but the abstract groups 'compression and blurring' together as if both were wins. That framing needs to change.\n\nTwo methodological soft spots. First, no ablations for the two named innovations: DeeFuser and triplet loss. The only ablation is LoRA versus fixed backbone. For a paper whose novelty claim rests on the fusion module and the triplet loss, this is a real gap. Second, baselines are taken from prior papers rather than re-run under the same preprocessing and splits. The reader flagged this as an assumption; it is a fair concern, though it does not invalidate the main generalization result, which stands on its own holdout.\n\nMinor issues: no error bars, t-SNE is illustrative only, and the JPEG degradation table actually undercuts the 'robust to compression' claim. These are fixable.\n\nWho is this for? Researchers working on synthetic-image detection who want a compact, reproducible baseline that generalizes across GANs and diffusion models. It is not a SOTA paper, but it is an honest engineering contribution with code and a clean holdout.\n\nRecommendation: accept for peer review, but expect major revision. The overclaiming must be fixed, the missing ablations added, and the comparison reframed as competitive rather than state-of-the-art. If those changes land, this is a useful paper.","headline":"DeeCLIP is a credible parameter-efficient CLIP detector with real generalization evidence, but the paper overclaims 'state-of-the-art' against its own Table 1 and skips ablations for its two named innovations.","tokens_in":824,"tokens_out":738,"would_cite":false,"duration_ms":16045,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Trained on only four ProGAN classes, DeeCLIP reports 89.00% mean accuracy across 19 AI-image generators and better robustness to blur and JPEG compression than prior CLIP detectors.","keywords":["AI-generated image detection","deepfake detection","CLIP","LoRA","feature fusion","triplet loss","cross-generator generalization","image forensics"],"falsifier":"Re-run all detectors, including DeeCLIP, from the same 4-class ProGAN split with identical preprocessing and the same evaluation code on the 19 UniversalFakeDetect subsets and on the blur/JPEG versions, and check whether DeeCLIP's 71.91% versus 61.55% robustness margin and 89.00% mean accuracy survive; if the margin disappears, the comparative claim collapses. An even more direct check is to test DeeCLIP on generator outputs that remove low-level artifacts, such as diffusion images passed through adversarial purification; chance-level accuracy there would show the detector is keyed to shallow artifacts rather than a general synthetic-image signature.","tokens_in":12273,"feed_emoji":"🕵️","tokens_out":11986,"duration_ms":105405,"temperature":0.7,"pith_summary":"This paper sets out to show that one detector can recognize images from generative models it never trained on, and keep working when those images are compressed or blurred. The proposed system, DeeCLIP, freezes the CLIP-ViT image encoder—a contrastively pretrained vision-language transformer—adapts it with low-rank LoRA updates, and sends both early-layer and late-layer features into a fusion module called DeeFuser before a linear classifier. Trained only on the horse, chair, cat, and car subsets of ProGAN, it reports 89.00% mean accuracy across 19 test subsets spanning GANs, diffusion models, deepfakes, and low-level vision models, and 78.99% mean accuracy on a separate 12-subset real-and-synthetic benchmark. Under Gaussian blur and JPEG compression, its average accuracy is 71.91% versus 61.55% for the C2P-CLIP baseline. The sympathetic reading is that pretrained visual-language features, combined with shallow texture cues, carry a generalizable signature of synthetic image generation.","feed_headline":"Four ProGAN classes train a detector that handles 19 AI generators","feed_subtitle":"It holds 71.91% accuracy under JPEG and Gaussian blur, beating prior CLIP detectors by 10.36 points.","key_machinery":"The load-bearing object is DeeFuser, a cross-attention fusion module: the high-level feature map $F_L$ from the last selected ViT layer acts as a query, the concatenation of earlier-layer maps $F_1,\\dots,F_{L-1}$ acts as the key/value source, and the attended output is refined by an MLP and a self-attention residual block before being added back to $F_L$ with a learnable scale. This lets the classifier see both semantic content and pixel-level texture artifacts. The supporting mechanisms are LoRA, which replaces each weight update by low-rank factors $\\mathbf{B}\\mathbf{A}$ so that $\\mathbf{W}' = \\mathbf{W} + \\mathbf{B}\\mathbf{A}$, and the combined triplet plus binary-cross-entropy loss, which separates real from fake embeddings. Together they carry the paper's claim that narrow ProGAN-only training transfers to unseen GAN and diffusion generators.","core_discovery":"The central claim is that multi-scale feature fusion inside a frozen-but-LoRA-adapted CLIP-ViT is what makes AI-image detection both generalizable and resistant to degradation. DeeFuser uses the deepest selected ViT layer as a query in cross-attention over concatenated shallow feature maps, then passes the result through an MLP, a self-attention block with a learnable residual weight, and a second learnable residual combination with the deep feature. Triplet loss pulls embeddings of the same class together and pushes real and fake apart, while binary cross-entropy supplies the final decision; LoRA keeps the pretrained backbone intact. With this setup, images synthesized by 19 unseen generators—including diffusion models—are detected at 89.00% mean accuracy after training on four ProGAN classes, and the detector remains at 71.91% average accuracy under JPEG and Gaussian blur, a 10.36-point margin over C2P-CLIP.","pith_inferences":["An untested implication is that DeeFuser's shallow-feature path is the main source of the robustness gain; ablating it under blur and compression would show whether the 10.36-point margin over C2P-CLIP comes from fusion, triplet loss, or LoRA.","If the detectable signature is carried by low-level artifacts, then future generators that explicitly suppress those artifacts, for example through adversarial purification or diffusion inversion, should disproportionately degrade DeeCLIP; the paper does not test such countermeasures.","The same frozen-encoder-plus-deep-shallow-cross-attention recipe may transfer to other vision-language backbones and to video or audio deepfake detection, but that is an extrapolation beyond the paper's experiments."],"forward_implications":["A detector trained on only four ProGAN object classes can recognize images from 19 unseen generators, including diffusion models, at 89.00% mean accuracy, so broad forensic coverage does not require training on every generator.","Combining shallow and deep features, rather than using only the deepest CLIP layer, is sufficient to keep detection alive under Gaussian blur and JPEG compression, with an overall 71.91% versus 61.55% mean accuracy against C2P-CLIP.","LoRA adaptation improves accuracy from 84.53% with a fixed backbone to 89.00%, so the CLIP backbone's pretrained knowledge can be adapted without full fine-tuning.","Prompt-free detection is viable: DeeCLIP classifies without task-specific text prompts, unlike prompt-tuned detectors.","The same 4-class-ProGAN-trained model transfers to an unrelated 12-subset benchmark at 78.99% mean accuracy, supporting deployment on data distributions not seen in training."],"supporting_citations":[{"why":"supplies the UniversalFakeDetect dataset and evaluation protocol used for Table 1.","marker":"[14]"},{"why":"defines the ProGAN training setup and the 20-subset benchmark the paper builds on.","marker":"[22]"},{"why":"source of most baseline accuracy numbers in Table 1 and the C2P-CLIP method DeeCLIP is compared against.","marker":"[18]"},{"why":"provides the multi-layer fusion design that DeeFuser modifies.","marker":"[1]"},{"why":"introduces the LoRA low-rank adaptation used to fine-tune CLIP-ViT.","marker":"[7]"},{"why":"supplies the triplet loss used to refine the embedding space.","marker":"[24]"},{"why":"prior CLIP-based detection work that motivates using a frozen CLIP backbone.","marker":"[3]"},{"why":"source of the RINE baseline results in the generalization comparison.","marker":"[10]"}],"fun_headline_variants":["ProGAN training on 4 classes detects 19 AI generators","Robust AI-image detection: 4-class training, 19 generators","Multi-scale fusion in CLIP-ViT detects unseen AI-generated images","4 ProGAN classes, 19 generators: robust detection via fusion","From 4 ProGAN classes to 19 generators with blur resistance"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The comparison against prior detectors assumes that the accuracies taken from the original C2P-CLIP and RINE papers were produced under the same preprocessing, input sizes, class balance, and evaluation splits as DeeCLIP's, because those baselines were not re-run in this pipeline.","fun_headline_variants_meta":{"raw":{"variants":["ProGAN training on 4 classes detects 19 AI generators","Robust AI-image detection: 4-class training, 19 generators","Multi-scale fusion in CLIP-ViT detects unseen AI-generated images","4 ProGAN classes, 19 generators: robust detection via fusion","From 4 ProGAN classes to 19 generators with blur resistance"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000652,"raw_usage":{"total_tokens":3006,"prompt_tokens":978,"completion_tokens":2028,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":594,"completion_tokens_details":{"reasoning_tokens":1936}},"tokens_in":594,"tokens_out":2028,"duration_ms":15343,"temperature":1.0,"reasoning_tokens":1936,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:41:47.417586+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run all detectors, including DeeCLIP, from the same 4-class ProGAN split with identical preprocessing and the same evaluation code on the 19 UniversalFakeDetect subsets and on the blur/JPEG versions, and check whether DeeCLIP's 71.91% versus 61.55% robustness margin and 89.00% mean accuracy survive; if the margin disappears, the comparative claim collapses. An even more direct check is to test DeeCLIP on generator outputs that remove low-level artifacts, such as diffusion images passed through adversarial purification; chance-level accuracy there would show the detector is keyed to shallow artifacts rather than a general synthetic-image signature.","supporting_citations":[{"cited_title":"Journal of machine learning research10(2) (2009)","cited_arxiv_id":null,"evidence_quote":"supplies the triplet loss used to refine the embedding space."}],"review_version":1}