{"id":"2307a5a8-0784-47b3-ad10-efa32b6f5023","arxiv_id":"2507.05162","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A benchmark showing lightweight off-the-shelf models can exceed 99% accuracy on GenImage for AI-image detection, with spectral inputs and decision fusion, at a fraction of larger models' compute.","lead":"This paper benchmarks off-the-shelf lightweight neural networks for detecting AI-generated images, testing spatial, frequency-domain, and fused inputs. It reports that small models reach above 99% accuracy on the GenImage benchmark while using far less compute than big detectors.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The robustness claim is contradicted by the paper's own blur results: Table III shows all models near chance under Gaussian blur in every setting, yet Section VII concludes 'strong resilience'; this directly undermines the 'even under adversarial conditions' part of the central claim.","rationale":"Good-faith summary: LAID is an empirical benchmark with a transparent protocol, a public code link, and internally consistent clean-accuracy and efficiency measurements. The strongest claim, however, is not only that lightweight models are efficient; it is that they are competitive 'even under adversarial conditions' while incurring lower costs. I searched for the weakest point in that claim and found it inside the paper's own results. Table III is the only direct evidence for adversarial robustness, and its blur row shows a complete collapse across every model and every input domain. This is not an external assumption about what a real adversary might do; it is a contradiction between the reported data and the Section VII conclusion. If a standard, non-optimized Gaussian blur at the tested strengths sends all detectors to chance, then the phrase 'strong resilience to basic adversarial perturbations' and the abstract's 'even under adversarial conditions' are inaccurate, regardless of whether the perturbations are generic or model-aware. The missing SOTA baseline is a separate weakness concerning the clean-accuracy comparison; the blur finding directly defeats the robustness half of the central claim. A re-run at mild blur strength, with per-strength reporting, would clarify whether the collapse is a numerical artifact or a true limitation. I therefore keep the conditional verdict because the paper needs revision, but I shift the justification from the reader's 'attacks are generic' concern to the more concrete internal contradiction in the reported robustness results.","tokens_in":15471,"tokens_out":9496,"duration_ms":117576,"concrete_test":"Fix the blur protocol to a single realistic strength and rerun the full spatial/spectral/fusion evaluation for at least the three best clean models (FastViT, MobileNetV2, EdgeNeXt) on the same 16,000-image test set, using Gaussian blur with kernel=3 and sigma=1.0, the mildest parameter values in Section V.E. Report accuracy per strength rather than averaging over the full range. If fusion accuracy remains near chance (below ~60%), the 'strong resilience' conclusion is false for a common, non-adversarial image degradation. If accuracy recovers above 90%, the Table III collapse is an artifact of overly aggressive blur, and the paper should report per-strength results and temper the conclusion accordingly.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim in the abstract ('competitive accuracy, even under adversarial conditions') and the conclusion (Section VII: LiMs exhibit 'strong resilience to basic adversarial perturbations') is not supported by the paper's own adversarial results. Under Gaussian blur (Section V.E: kernel 3-9, sigma 1-4), Table III shows that every evaluated model in every input domain falls to near-chance accuracy: spatial accuracy is 51-56%, spectral accuracy is ~50%, and fusion accuracy is only 53-57% (best fusion model, FastViT, at 56.50%). This is not an optimized, model-aware attack; Gaussian blur is one of the five 'basic adversarial perturbations' the authors themselves selected, and it is a routine social-media post-processing operation. The paper even acknowledges in Section VI.B.1 that 'Blurring... attacks lead to the greatest performance degradation with accuracies dropping to near-random levels,' yet Section VII concludes that LiMs show strong resilience. This internal contradiction means the robustness half of the central claim is not merely unverified; it is contradicted by the reported experiments. A detector that fails on a standard Gaussian blur is not robust in the deployment scenarios named in the paper, such as social-media image pipelines. Clean accuracy and efficiency measurements are internally consistent, but the robustness claim is a load-bearing part of the abstract and conclusion and must be revised or re-tested with a less destructive protocol.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces LAID, a benchmark and evaluation framework for AI-generated image (AIGI) detection using off-the-shelf lightweight neural networks. The authors select ten lightweight models via an efficiency score that combines ImageNet top-1 accuracy, FLOPs, and parameter count, then fine-tune each model independently on spatial images and on zero-centered 2D FFT spectral representations from a representative subset of the GenImage dataset. They report clean detection accuracy, adversarial robustness under five perturbations (cropping, Gaussian blur, Gaussian noise, JPEG compression, and their combination), and efficiency metrics. Clean results show high performance (most models above 92% spatial accuracy and above 99% spectral accuracy), while adversarial results show near-chance accuracy under blur and a universal collapse of spectral-only models under all attacks. The paper concludes that lightweight models achieve competitive accuracy even under adversarial conditions and exhibit strong resilience to basic perturbations.","tokens_in":15725,"tokens_out":4421,"duration_ms":53145,"significance":"If the claims held, the paper would provide a useful practical benchmark showing that lightweight architectures are viable for large-scale, real-time AIGI detection. The study has notable strengths: the model-selection protocol is transparent, the efficiency accounting is explicit, the use of standardized model hubs improves reproducibility, the GenImage subset is clearly described, and source code is promised. However, the paper's own results contradict the robustness half of the central claim: Table III shows that all models fall to near-chance accuracy under Gaussian blur, and Section VI.B.1 explicitly acknowledges that blurring and compression cause near-random accuracy. In addition, the claim of competitiveness with state-of-the-art methods is not directly tested, because no large current SOTA detector is evaluated under the same protocol. The clean-domain efficiency results are internally consistent, but the adversarial-robustness conclusion and the SOTA-competitiveness claim are load-bearing parts of the abstract and conclusion and are not supported by the reported experiments.","major_comments":[{"comment":"The paper's central robustness claim is contradicted by its own results. Under Gaussian blur (kernel size 3-9, sigma 1-4), every evaluated model in every input domain falls to near-chance accuracy: spatial accuracies are 51-56%, spectral accuracies are approximately 50%, and the best fusion accuracy is 56.50% (FastViT). Section VI.B.1 explicitly states that 'Blurring and compression attacks lead to the greatest performance degradation with accuracies dropping to near-random levels,' yet Section VII concludes that 'LiMs exhibit strong resilience to basic adversarial perturbations' and the Abstract claims 'competitive accuracy, even under adversarial conditions.' Since Gaussian blur is one of the five basic perturbations the authors themselves selected and is a routine social-media post-processing operation, the robustness half of the central claim is not merely unverified; it is contradicted by the reported experiments. The abstract, conclusion, and contribution list should be revised to reflect the actual findings, or the adversarial evaluation should be re-designed to distinguish mild from destructive perturbation strengths.","section":"Section VI.B.1, Table III, vs. Section VII and Abstract"},{"comment":"The claim that lightweight models are 'competitive' with state-of-the-art AIGI detectors is not directly tested. No large current SOTA detector (e.g., DIRE, LGrad, BiHPF, CNNSpot) is run under the same training and evaluation protocol. The two baselines, Ladevic et al. and SpottingDiffusion, are themselves lightweight methods, and one has 13.46 GFLOPs per sample while the other has 23M parameters, so they do not represent the heavy SOTA architectures the paper criticizes. Accuracy comparisons to numbers reported in prior literature are not controlled because datasets, splits, and preprocessing differ. To support the 'competitive with SOTA' wording, the authors should either include head-to-head experiments under a shared protocol with representative SOTA detectors or narrow the claim to competitiveness with lightweight baselines.","section":"Section VI.A and Section V.C"},{"comment":"The fusion evaluation results are interpreted in a way that overstates the contribution of the spectral branch. Under the fusion success rule (yp = G) ∨ (yf = G), fusion accuracy should be at least the maximum of the two component accuracies. Many fusion results are far above that maximum (e.g., MobileViT under compression: 99.50% fusion versus 65.06% spatial and approximately 50% spectral), which indicates that the spatial and spectral errors are complementary. However, because all spectral-only models are near chance under every attack, the robust performance of fusion is entirely carried by the spatial model; the spectral branch contributes no signal of its own. The statement in Section VI.B.3 that fusion provides 'substantial improvement in adversarial robustness' and the suggestion that spectral features help in adversarial settings should be re-framed accordingly.","section":"Section V.D, Eq. (5), and Table III"},{"comment":"The spectral representation is not specified sufficiently for reproducibility. The paper says spectral images are 'zero-centered 2D Fast Fourier Transforms' that are 'strictly normalized to [0, 255]', but it does not state how the complex FFT output is converted to a real-valued image, whether magnitude or log-magnitude is used, how the dynamic range is scaled, or how color channels are handled. Since the spectral domain is central to the paper's clean-performance results (Table II), this missing detail is load-bearing for reproducing the reported >99% spectral accuracies.","section":"Section IV.A and Section V.B"},{"comment":"All experimental results come from a single training run and a single fixed split, with no error bars, confidence intervals, or multiple seeds. The paper makes comparative statements about model rankings and about differences between LiViTs and LiCNNs that are based on small accuracy margins (e.g., Table II spatial accuracies 92-99%). Without variance estimates, these comparisons are not statistically grounded. At minimum, key results should be reported over at least three random seeds or with appropriate confidence intervals.","section":"Section V and Table II/III"}],"minor_comments":[{"comment":"In the adversarial testing formulas, the spectral evaluation uses Mp instead of Mf: yf = Mp(Îadv) and the fusion equation also use Mp for the spectral branch. These should be Mf(Îadv) to match the text.","section":"Section V.D, Eqs. (4)-(5)"},{"comment":"The notation is inconsistent between 'FLOPs' and 'FLOPS'; the standard form 'FLOPs' should be used consistently.","section":"Throughout"},{"comment":"There is a typo in the sentence 'both the relatively narrow performance gape between LiMs'; 'gape' should be 'gap'.","section":"Section VI.C"},{"comment":"The cropping attack description contains a duplicated word: 'resizes the image to to 256 × 256 pixels'.","section":"Section V.E"},{"comment":"The text states that 'noising and other spectral attacks target an image's frequency distribution,' but the noising attack in Section V.E adds Gaussian noise in the spatial domain; calling it a spectral attack is imprecise.","section":"Section VI.B.3"},{"comment":"The R² values in Figure 4 are computed from only eight data points (after omissions); the caption should state the number of points and the regression method so readers can judge the strength of the trends.","section":"Figure 4"}],"recommendation":"major_revision","confidential_remarks":"The paper's clean-domain efficiency analysis is a useful contribution, and the transparency of the protocol is commendable. However, the robustness claim in the abstract and conclusion is directly contradicted by the paper's own Table III, and the SOTA-competitiveness claim lacks a direct comparison. These are central, not peripheral, issues. The stress-test concern raised by the reader is valid and should be the first point communicated to the authors. I would recommend major revision rather than rejection because the experimental protocol appears sound and the claims could be revised or supplemented with targeted experiments within the scope of the manuscript."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nLAID is worth knowing about for the clean-domain results: a systematic benchmark of ten off-the-shelf lightweight models on a subsampled GenImage set across spatial, spectral, and fusion inputs. Clean accuracies are high (most models >99% spectral), the efficiency accounting is clear, and the code is public. That part is a solid empirical contribution.\n\nThe soft spot is the robustness story, and it is not minor. Table III shows every model at or near chance under Gaussian blur — spatial accuracies cluster around 51–56%, spectral around 50%, fusion only up to 56.5%. The authors themselves write in Section VI.B.1 that blurring 'leads to the greatest performance degradation with accuracies dropping to near-random levels.' Yet the abstract claims 'competitive accuracy, even under adversarial conditions' and the conclusion says LiMs show 'strong resilience to basic adversarial perturbations.' That is an internal contradiction in the paper's own results. A detector that fails on a routine social-media blur is not robust in the deployment scenarios named.\n\nTwo further issues, in proportion. First, the headline comparison to 'state-of-the-art' is never directly tested: no large SOTA detector is run under the same protocol, so the claim that lightweight models match them remains an inference from the literature. Second, there are no error bars, only a single run, and the seed and split details are missing, so exact replication is not possible from the text. The 'adversarial' perturbations are generic corruptions, not model-aware attacks, so the robustness evidence is narrower than the language suggests.\n\nNone of this undermines the clean-detection benchmark. For a reader looking for efficient detectors at social-media scale, the measurements are useful. But the paper needs major revision: fix the robustness claims to match Table III, add at least one large SOTA baseline under the same protocol, and report variance or a second run.\n\nMy recommendation: this deserves peer review, but a serious referee should flag the contradiction and the missing baseline. I would cite it for the benchmark artifact, but not for the robustness conclusions. Bring it to the reading group if you care about lightweight AIGI detection; otherwise a skim of Tables II and III suffices.","headline":"Useful clean-domain lightweight AIGI benchmark, but the robustness claims in the abstract and conclusion are contradicted by the paper's own blur results.","tokens_in":16259,"tokens_out":3160,"would_cite":true,"duration_ms":33673,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Lightweight neural networks under 10 million parameters can detect AI-generated images with over 99% accuracy in the spectral domain, at a fraction of the compute of current detectors.","keywords":["AI-generated image detection","lightweight neural networks","spectral domain analysis","adversarial robustness","model efficiency","GenImage dataset","vision transformers","convolutional neural networks"],"falsifier":"Run the same LAID models under model-aware adversarial perturbations that a determined attacker could craft, such as small gradient-based pixel changes that preserve visual quality, and compare lightweight accuracy with heavy state-of-the-art baselines on the same GenImage subset; if lightweight accuracy falls to near chance while heavy models stay high, the claim that lightweight models remain competitive under adversarial conditions would not extend to adaptive adversaries.","tokens_in":1755,"feed_emoji":"🔍","tokens_out":2323,"duration_ms":85858,"temperature":0.7,"pith_summary":"The paper tries to establish that heavy, high-parameter detectors are not necessary for practical AI-generated image detection. It benchmarks off-the-shelf lightweight models under 10 million parameters or 1 GFLOP per inference on spatial, spectral, and fused inputs drawn from a subset of the GenImage dataset. Reported clean accuracy exceeds 99% for most models in the spectral domain and 92-99% spatially, while spectral inputs collapse to chance under adversarial corruption and fusion recovers much of the lost robustness. The payoff, if the claims hold, is that real-time large-scale screening on social-media workloads could use small models with a small fraction of the memory and compute of current state-of-the-art detectors.","feed_headline":"Tiny neural nets hit 99% AI-image accuracy at low cost","feed_subtitle":"LAID finds sub-10M-parameter models rival heavy AI-image detectors at a fraction of the compute.","key_machinery":"The carrying mechanism is LAID's two-branch evaluation: an architecturally identical lightweight model is trained separately on raw spatial pixels and on zero-centered 2D-FFT spectral images, and at test time the two predictions are combined by decision-level OR-fusion. Model selection uses an efficiency score $E = \\lambda_1 \\frac{\\text{Acc}}{\\max \\text{Acc}} + \\lambda_2 \\frac{\\min \\text{FLOPs}}{\\text{FLOPs}} + \\lambda_3 \\frac{\\min \\text{Params}}{\\text{Params}}$ with $\\lambda = (0.5, 0.25, 0.25)$, after filtering candidates to fewer than 10 million parameters or under 1 GFLOP per inference. The spectral branch carries the clean-detection performance; the spatial branch carries most of the robustness; the fusion step combines these complementary failure modes.","core_discovery":"The central claim is that lightweight models are competitive with state-of-the-art AIGI detectors when given the right input representation. LAID trains each selected model twice, once on raw pixels and once on zero-centered 2D-FFT spectral images, then combines predictions by OR-fusion at test time. In clean settings, spatial accuracy ranges from 78% (MnasNet) to 99.22% for a custom lightweight CNN baseline, with most models above 92%, while spectral accuracy exceeds 99% for every model except MnasNet. Under adversarial perturbations (cropping, Gaussian blur, Gaussian noise, JPEG compression, and their combination), spectral accuracy drops to near 50% for all models, but fusion with the spatial branch yields many accuracies above 90% under noise and compression. The paper also reports that lightweight CNNs tolerate JPEG compression better than lightweight vision transformers, and that ShuffleNet gives the best accuracy per parameter and per FLOP.","pith_inferences":["An implication the paper leaves implicit is that its robustness evidence covers common post-processing, not adaptive adversaries; gradient-based attacks optimized against the detector would be a stronger and untested challenge.","Because spectral input alone collapses under any spatial transform, the clean spectral advantage looks fragile, which suggests spectral information is best used as a fusion feature or with adversarial training rather than as a standalone input.","The efficiency score's weighting ($\\lambda = (0.5, 0.25, 0.25)$) is one choice among many, and the paper itself notes that alternative weightings could reorder the models; a natural extension is to treat the score as a tunable selection tool and validate it on other datasets."],"forward_implications":["Clean spectral detection with lightweight models exceeds 99% accuracy for almost every architecture tested, so frequency-domain input alone can make small models sufficient for clean detection.","Under noise and JPEG compression, fusing spatial and spectral predictions restores many accuracies above 90%, suggesting a cheap OR-fusion rule is an effective robustness strategy.","Lightweight CNNs such as ShuffleNet, MobileNetV3, and SqueezeNet keep 80%+ accuracy under JPEG compression while lightweight vision transformers fall to 65% or below, so architecture choice matters for compression-heavy deployments.","Efficiency metrics show ShuffleNet delivers the highest accuracy per parameter and per FLOP, while the two heavier baselines are dramatically less efficient, which favors lightweight models for resource-constrained platforms.","Spectral-only models collapse to chance under every tested adversarial perturbation, so spectral input alone is not a robust deployment choice."],"supporting_citations":[{"why":"Supplies the GenImage dataset with 1.33M natural and 1.35M synthetic images from 8 generators, which LAID subsamples for training and evaluation.","marker":"[44]"},{"why":"Establishes that CNN generators leave detectable spectral artifacts, motivating the spectral-domain branch of LAID.","marker":"[11]"},{"why":"Provides the CNNSpot ResNet50 spatial-inconsistency baseline that LAID's lightweight spatial models are compared against conceptually.","marker":"[25]"},{"why":"Shows that frequency-domain filtering improves synthetic-image detection, supporting the value of spectral representations.","marker":"[14]"},{"why":"Serves as a lightweight CNN baseline whose 97.32% CIFAKE accuracy is a comparison point for LAID's clean detection results.","marker":"[39]"},{"why":"Serves as the MobileNetV2-based SpottingDiffusion baseline for detecting latent-diffusion-generated images.","marker":"[40]"},{"why":"Part of the attack literature that informs the five adversarial perturbations used in Section V-E.","marker":"[16]"},{"why":"Provides DCT-based frequency analysis for deepfake detection, supporting the choice of spectral features.","marker":"[30]"},{"why":"Establishes GAN fingerprinting in the frequency domain, which LAID's spectral branch builds on.","marker":"[31]"},{"why":"Integrates DCT component analysis with a ResNet50 classifier, supplying another baseline that frequency-domain inputs should match or beat.","marker":"[32]"}],"fun_headline_variants":["Tiny nets rival heavy AI detectors at fraction of compute","LAID shows small models match big ones on AI images","99% accuracy from sub-10M models with spectral input","Lightweight CNNs: efficient fake-image detection","Spatial-spectral fusion lets small nets win"],"cache_read_input_tokens":18432,"weakest_assumption_plain":"The paper's robustness claim rests on assuming that five common image corruptions—cropping, blurring, noise, JPEG compression, and their combination—stand in for the 'adversarial conditions' a deployed detector will face; these are ordinary post-processing transforms, not perturbations crafted to fool a specific model.","fun_headline_variants_meta":{"raw":{"variants":["Tiny nets rival heavy AI detectors at fraction of compute","LAID shows small models match big ones on AI images","99% accuracy from sub-10M models with spectral input","Lightweight CNNs: efficient fake-image detection","Spatial-spectral fusion lets small nets win"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000412,"raw_usage":{"total_tokens":2128,"prompt_tokens":940,"completion_tokens":1188,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":556,"completion_tokens_details":{"reasoning_tokens":1109}},"tokens_in":556,"tokens_out":1188,"duration_ms":12024,"temperature":1.0,"reasoning_tokens":1109,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T19:30:54.948791+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same LAID models under model-aware adversarial perturbations that a determined attacker could craft, such as small gradient-based pixel changes that preserve visual quality, and compare lightweight accuracy with heavy state-of-the-art baselines on the same GenImage subset; if lightweight accuracy falls to near chance while heavy models stay high, the claim that lightweight models remain competitive under adversarial conditions would not extend to adaptive adversaries.","supporting_citations":[{"cited_title":"Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions,","cited_arxiv_id":null,"evidence_quote":"Establishes that CNN generators leave detectable spectral artifacts, motivating the spectral-domain branch of LAID."},{"cited_title":"Bihpf: Bilateral high-pass filters for robust deepfake detection,","cited_arxiv_id":null,"evidence_quote":"Shows that frequency-domain filtering improves synthetic-image detection, supporting the value of spectral representations."},{"cited_title":"Detec- tion of ai-generated synthetic images with a lightweight cnn,","cited_arxiv_id":null,"evidence_quote":"Serves as a lightweight CNN baseline whose 97.32% CIFAKE accuracy is a comparison point for LAID's clean detection results."},{"cited_title":"Spottingdiffusion:re using transfer learning to detect latent diffusion model-synthesized images,","cited_arxiv_id":null,"evidence_quote":"Serves as the MobileNetV2-based SpottingDiffusion baseline for detecting latent-diffusion-generated images."},{"cited_title":"Leveraging frequency analysis for deep fake image recogni- tion,","cited_arxiv_id":null,"evidence_quote":"Provides DCT-based frequency analysis for deepfake detection, supporting the choice of spectral features."}],"review_version":1}