{"id":"b68a2b00-ef80-441b-93ab-d0a53f066db0","arxiv_id":"2608.00716","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"AI-generated images can be detected by measuring how much their features change when a pre-trained vision model is pruned or fine-tuned to unlearn them, and the resulting gap beats several existing detectors.","lead":"This paper shows that when a large pre-trained vision model is pruned, its features for AI-generated images change far more than for natural images, and this difference can be used to detect fakes. The authors turn machine unlearning into a detection method, with a training-free pruning detector and a fine-tuned version that outperform many existing detectors on several benchmarks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Assumption 3.3 is the phenomenon being exploited, and Proposition 3.4 only guarantees a sensitivity gap for small pruning perturbations, so the theory does not cover the actual 90%-fc2 pruning regime; the data-free signal may be generic OOD sensitivity.","rationale":"The manuscript's main contribution is the data-free pruning detector, and its generality claim rests on the sensitivity gap. The reader's conditional verdict already captures this, and my reading does not move it: the paper should remain CONDITIONAL until the core premise is validated empirically and the small-perturbation condition is checked. The recommended test is computationally feasible using released DINOv2 and public datasets. If the test supports the assumption, the method's empirical backbone is strengthened; if not, the theoretical section should be relabeled as motivation and the claims about generated-image-specific forgetting should be tempered. This is not an objection to the extensive empirical results themselves, which are reproducible in principle and show a real effect; it is a request to verify that the proposed mechanism, rather than a more general distribution-shift effect, is what drives the observed signal.","tokens_in":20876,"tokens_out":6109,"duration_ms":59036,"concrete_test":"Use DINOv2-L/14 and the exact fc2/block-16 pruning recipe; for natural ImageNet, generated GenImage, and natural OOD sets (e.g., Describable Textures, Sketch, EuroSAT), compute the finite-difference estimate of S_D(Δθ) from Eq. 9 and the score distribution s(x) from Eq. 4. If S_Dgen - S_Dnat is not positive for the actual pruning direction, Assumption 3.3 fails in the operating regime; if S_Dood_natural is comparable to S_Dgen, the detector is measuring OOD shift, not syntheticity.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that generated images degrade faster than natural images under pruning. The formal result, Proposition 3.4, is conditional on Assumption 3.3, which simply postulates exactly this gap (Eq. 10): S_Dgen - S_Dnat >= omega ||Δθ||^2. The proof then shows that if this gap exceeds C_f ||Δθ||^3, the output difference is larger for generated images. Thus, the theory is not an independent derivation; it is a restatement of the assumption plus a small-perturbation condition. The method, however, prunes 90% of the minimum-magnitude weights in fc2 of block 16, so ||Δθ|| is not small, and no evidence is given that the condition omega > C_f ||Δθ|| holds in that regime. The paper's own limitation (A.2) concedes the gap depends on current natural-dominated pretraining corpora, reinforcing that the mechanism is an empirical regularity, not a robust property of generated images. Moreover, the paper explicitly models generated images as distribution-shifted samples, so the observed lower cosine similarity may reflect generic out-of-distribution sensitivity rather than a specifically synthetic-image property. If natural images from an unusual domain are also forgotten at the same rate, the detector would false-positive on legitimate OOD photographs, and the generated-images-are-easier-to-forget claim would need to be narrowed to distribution-shifted images are easier to forget.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes detecting AI-generated images by exploiting the observation that, when a large pretrained vision model is degraded via machine unlearning, its representations of generated images change more rapidly than those of natural images. The authors introduce two detectors built on the cosine similarity between original and pruned (or unlearned) features: a data-free method that prunes 90% of the smallest-magnitude weights in the fc2 layer of the 16th block of DINOv2 ViT-L/14, and a data-driven method that fine-tunes DINOv2 with LoRA using an unlearning objective that pushes generated-image representations away from the original model while preserving natural-image representations. Experiments are reported on ImageNet, GenImage, DiffusionForensics, DRCT-2M, LSUN-BEDROOM, Chameleon, and on Sora/OpenSora video-derived images. The paper also presents a local perturbation analysis, Proposition 3.4, intended to explain why pruning amplifies representation differences for generated images.","tokens_in":21163,"tokens_out":6081,"duration_ms":56992,"significance":"If the empirical finding holds, the proposed approach is practically significant: a single pruning operation on an off-the-shelf pretrained model yields a training-free detector that shows strong generalization to unseen generators, including the Sora evaluation. The paper's strengths are its broad benchmark coverage, the direct test on inaccessible generators (Sora and OpenSora), the clean ablations over backbones, pruning locations, pruning ratios, and pruning strategies, and the explicit threshold-sensitivity analysis. The data-free method is indeed training-free apart from validation-set-based hyperparameter and threshold selection, and the data-driven method's reported gains on several benchmarks are substantial. However, the theoretical contribution is conditional in a way that partly restates the phenomenon, and the empirical claim of universal superiority over prior methods is not supported by all tables. The absence of a non-synthetic out-of-distribution negative set leaves open whether the signal is specific to generated images or is a generic distribution-shift effect.","major_comments":[{"comment":"The formal result does not provide an independent derivation of the detection signal. Assumption 3.3 postulates exactly the phenomenon to be explained: that generated images have larger directional representation sensitivity than natural images along the pruning direction, quantified by omega > 0. Proposition 3.4 then shows that this assumed gap carries over to output differences when omega dominates a higher-order term, but the proof does not establish the assumption or verify condition (12). In the actual method, 90% of the fc2 weights in block 16 are pruned, which is not a small-perturbation regime, and no measurement of S_Dgen - S_Dnat or of the local smoothness constant C_f along the realized pruning direction is provided. Moreover, the paper's own limitation (Appendix A.2) concedes that the gap depends on current natural-dominated pretraining corpora, which is consistent with the assumption being an empirical regularity rather than a robust property. I recommend either removing the formal proposition and presenting Eq. (10) as an empirical observation supported by Figures 2 and 4, or adding direct measurements of the sensitivity gap and validating the local expansion in the deployed pruning regime.","section":"Section 3.3, Assumption 3.3 (Eq. 10) and Proposition 3.4"},{"comment":"The abstract and Section 4.2 state that the unlearning approach outperforms conventional detectors, but the data-free variant is not consistently better across benchmarks. On ImageNet (Table 1), data-free unlearning averages 92.20 AUROC while FatFormer attains 93.68 and AIDE 93.71. On GenImage (Table 3), data-free unlearning averages 81.8 ACC, below FatFormer (88.9), DRCT (89.4), and SAFE (87.2). Even the data-driven variant is not uniformly superior per generator: for Midjourney it reaches 90.8 versus FatFormer's 92.7 and SAFE's 98.3, and for SD V1.4 it reaches 95.6 versus FatFormer's 100.0. The claims should be qualified to average or selected-metric performance, and because the main tables report no error bars or significance tests, the reported margins need accompanying variability estimates; Appendix A.12 states that results are averaged over five seeds, so these estimates should be reported in the main tables.","section":"Section 4.2, Tables 1 and 3"},{"comment":"Because Assumption 3.3 frames generated images as distribution-shifted samples, the score s(x) in Eq. (4) may be a general out-of-distribution detector rather than a synthetic-image detector. The paper does not measure false-positive rates on natural images from domains that are also distribution-shifted relative to the pretraining data, such as medical images, aerial images, artwork, or sketches. If such images are forgotten at similar rates, the central claim 'generated images are easier to forget' should be narrowed to 'distribution-shifted images are easier to forget,' and the practical detector would be unreliable for legitimate OOD photographs. I ask for a dedicated negative-set experiment with non-synthetic OOD natural images and a report of the resulting AUROC or ACC, together with a comparison of the score distributions against the generated-image score distributions.","section":"Section 3.3 and Section 4 (OOD natural-image evaluation)"},{"comment":"The detector uses cosine similarity between original and pruned representations, but Proposition 3.4 is stated for mean squared L2 output differences. A larger L2 displacement does not imply a lower cosine similarity, because the norm of the features can also change; the paper does not provide a mathematical or empirical bridge between Eq. (8) and Eq. (4). Please add a direct analysis of the cosine score, or present the L2 result only as supporting intuition and validate the cosine link empirically, for example by showing that the L2 gap and the cosine gap rank the same images.","section":"Section 3.2-3.3, Eq. (4) versus Eq. (8)"}],"minor_comments":[{"comment":"The block numbering is inconsistent: the main text says pruning is applied to the fc2 layer of the 16th transformer block, while Appendix A.11 says 'we prune the weights of block 15' and Table 18 reports results for blocks 16 through 23. Please clarify the indexing convention.","section":"Section 4.1 and Appendix A.11"},{"comment":"The use of LCE on l2-normalized features, with one normalized vector treated as logits and the other as a soft target, is not a standard cross-entropy operation; please define precisely how the logits and soft targets are formed, including any temperature or smoothing, so that the loss is reproducible.","section":"Eq. (14)"},{"comment":"The threshold-sensitivity analysis shows that classification accuracy varies noticeably with the generator used to calibrate the threshold; since the main tables report ACC using thresholds chosen on a ProGAN-based validation set, this caveat should be stated wherever ACC is reported, or threshold-free metrics such as AUROC and AP should be made primary.","section":"Appendix A.13, Table 13"},{"comment":"There is a typo in the Chameleon paragraph: 'a a very challenging' should be 'a very challenging.'","section":"Appendix A.14"},{"comment":"The data-free method is called 'training-free' and 'data-free,' but it uses 1k natural images and ProGAN generated images for hyperparameter and threshold selection; please clarify that no images from the target test generators are used rather than claiming the method has no data dependence at all.","section":"Section 3.2"}],"recommendation":"major_revision","confidential_remarks":"The central empirical observation is interesting and the benchmark coverage is strong, but the theoretical section currently restates the phenomenon as an assumption and the headline 'outperforms' claim is not uniformly true. The most important additions are a natural OOD negative-set experiment, error bars on the main tables, and either a direct validation of Assumption 3.3 or a reframing of the theory as an empirical observation. These are substantial but feasible revisions, so I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The empirical core of this paper is real and worth your time: pruning a DINOv2 model and measuring feature similarity between the original and pruned versions separates generated from natural images surprisingly well, including on unseen Sora frames. The data-driven LoRA variant does even better, and the method is simple enough to re-implement from the text alone. That is a genuinely useful result for the synthetic-image-detection subfield.\n\nWhat is new: the reframing of detection as unlearning, the training-free pruning-based score, and the breadth of evaluation across ImageNet, GenImage, Chameleon, LSUN-BEDROOM, DRCT-2M, DiffusionForensics, plus a held-out Sora test. The paper is also honest about a key limitation in A.2: the effect may weaken if future pretraining corpora include many synthetic images.\n\nThe soft spots are real but mostly fixable. The theory in Section 3.3 is not a theory of the phenomenon; Assumption 3.3 simply postulates that generated images have larger directional sensitivity along the pruning direction, which is exactly the effect being exploited. Proposition 3.4 is a Taylor expansion that restates this gap under a small-perturbation condition. The actual method prunes 90% of the fc2 weights in block 16, so the perturbation is not small, and the condition linking omega and ||Delta theta|| is never checked. I would call this a conjecture or an empirical premise, not a derivation.\n\nTwo more concerns. First, the main tables lack error bars; the appendix mentions standard deviations only for one ablation figure. Second, the data-free variant does not beat all training-based baselines on ImageNet or GenImage; the paper’s blanket claim that the unlearning approach outperforms conventional methods holds for the data-driven variant but not for the data-free one. The threshold is selected on a validation set, which is acceptable, and they do report threshold sensitivity.\n\nThe bigger conceptual worry, which the paper does not address, is that the mechanism may be generic out-of-distribution sensitivity rather than something specific to synthetic images. If you point the detector at legitimate but distribution-shifted natural images (artwork, medical scans, heavy filters), they might also show a large feature drop under pruning. The paper only tests natural images from standard benchmarks, so this remains an open question. The authors’ own limitation note leans in that direction.\n\nBottom line: this deserves a serious referee. The empirical result is plausible and useful, and the method is easy to reproduce. A good review would push the authors to add error bars, separate claims per variant, test on OOD natural images, and reframe the theory as a stated conjecture rather than a proven mechanism. I would send it to review.","headline":"A simple pruning-based feature-similarity score detects generated images surprisingly well, but the theory assumes the very gap it claims to explain.","tokens_in":21688,"tokens_out":1823,"would_cite":true,"duration_ms":18192,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"When a vision model is made to forget, generated images lose their features faster than natural images, and this asymmetry alone can detect AI-generated images without any training.","keywords":["generated image detection","machine unlearning","weight pruning","large-scale vision models","synthetic image detection","feature similarity","data-free detection","domain shift"],"falsifier":"Take any vision model pretrained on natural-image-dominated data, prune the same small-magnitude weights, and measure whether images from a held-out generator show larger feature displacement than natural images; if a generator that the paper did not test produces no separation under the cosine-similarity score, or if a model pretrained with substantial synthetic data no longer shows the gap, the central claim fails.","tokens_in":20644,"feed_emoji":"🔍","tokens_out":7089,"duration_ms":58100,"temperature":0.7,"pith_summary":"This paper claims that the act of forgetting, not learning, is what separates AI-generated images from natural ones. Large vision models pretrained on natural-image-dominated data represent both kinds of images with comparably low loss, but when the model is degraded by pruning weights, the representations of generated images shift far more than those of natural images. The authors turn this asymmetry into a detector by scoring an image with the cosine similarity between its features in the original and the pruned model, with a larger drop signaling a generated image. If the claim holds, one pretrained model plus a parameter-pruning step yields a training-free detector that generalizes to generators never seen during development, and using a few generated images during unlearning makes detection stronger. This positions the task as a matter of selectively damaging a model's knowledge of one class rather than drawing a boundary between classes.","feed_headline":"One pruning step turns any vision model into an AI-image detector","feed_subtitle":"No training data needed: forgetting a model's weights makes synthetic images stand out.","key_machinery":"The carrying object is the pruning-induced output shift analyzed through the Jacobian of the representation with respect to model parameters. Assumption 3.3 posits a directional representation sensitivity gap along the pruning direction $\\Delta\\theta=\\theta-\\theta'$: generated images have larger expected squared Jacobian-vector norm than natural images, $S_{D_{\\mathrm{gen}}}(\\Delta\\theta)-S_{D_{\\mathrm{nat}}}(\\Delta\\theta)\\ge \\omega\\|\\Delta\\theta\\|_2^2$. Proposition 3.4 then shows, under local smoothness, that the pruning-induced output difference is larger for generated images when $\\omega > C_f\\|\\Delta\\theta\\|_2$, which is exactly what makes the cosine-similarity score in Eq. (4) discriminative. The data-driven variant replaces passive pruning with an explicit unlearning loss that retains natural-image similarity and enforces a margin $\\gamma$ between original and unlearned features for generated images.","core_discovery":"On the paper's own terms, the central discovery is disparate forgetting dynamics: during machine unlearning, feature degradation for generated images escalates faster than for natural images. The detector score is $s(x)=\\cos(F(x;\\theta_F), F(x;\\theta'_F))$, the cosine similarity between representations under the original and the unlearned model; natural images keep high similarity while generated images' features drift. In the main data-free setup the unlearned model is obtained by pruning 90% of the smallest-magnitude weights in the fc2 layer of block 16 of DINOv2 ViT-L/14, and the paper reports that this score exceeds conventional detectors on ImageNet, GenImage, Chameleon, LSUN-BEDROOM, DiffusionForensics, DRCT-2M, and on images sampled from Sora and Open Sora videos. When generated images are available, a data-driven variant fine-tunes the model with LoRA to push the same score separation further, with the paper reporting average AUROC of 98.29 versus 92.20 for the data-free version on ImageNet.","pith_inferences":["In the paper's own terms, the sensitivity gap is about distribution shift, not about generative models specifically; a natural image that lies in a long-tail or out-of-distribution region of the pretraining data should also produce a large similarity drop, so the same score may flag unusual natural images as well.","The directional sensitivity gap could be measured directly on a small calibration set, turning hyperparameter selection (which block, which pruning ratio) into an automatic procedure rather than a manual choice.","If synthetic images keep entering pretraining corpora, the asymmetry may invert or vanish, so a future detector may need to prune in a direction that specifically amplifies rare natural images or to re-derive the score from a model whose pretraining distribution is known."],"forward_implications":["A training-free detector can be instantiated from any pretrained vision model by pruning a layer and comparing features before and after, with no labels and no generator-specific training data.","Because the score comes from a distributional asymmetry rather than a learned boundary, it transfers to generators unseen at development time, including video-based image samples the paper tests.","Access to a modest set of generated images improves the score further: the data-driven unlearning variant raises average AUROC on ImageNet from 92.20 to 98.29 in the paper's setup.","The detection threshold is not fixed at 0.5; it must be calibrated on a validation set, and the paper reports that accuracy varies noticeably with the threshold choice."],"supporting_citations":[{"why":"Supplies the DINOv2 backbone whose pruned variant defines the detection score.","marker":"Oquab et al., 2024"},{"why":"Provides the compression-forgets-long-tail observation that motivates the sensitivity-gap assumption.","marker":"Hooker et al., 2019"},{"why":"Supplies the magnitude-based weight pruning operation used for data-free unlearning.","marker":"Han et al., 2015"},{"why":"Provides the LoRA adaptation used by the data-driven unlearning objective.","marker":"Hu et al., 2022"},{"why":"Defines the CNNspot baseline and the JPEG and blur augmentation protocol adopted for robustness evaluation.","marker":"Wang et al., 2020"},{"why":"Supplies the UnivFD baseline and the linear-classification comparison on a frozen backbone.","marker":"Ojha et al., 2023"},{"why":"Provides the DIRE baseline and the DiffusionForensics benchmark.","marker":"Wang et al., 2023"},{"why":"Supplies the Chameleon benchmark and the AIDE baseline used for cross-generator evaluation.","marker":"Yan et al., 2024"}],"fun_headline_variants":["Prune a vision model to catch AI images via faster forgetting","Machine unlearning reveals synthetic images: forget to detect","Unlearning-based detector spots AI images without training data","Data-free AI detection: pruning makes fake images stand out","Forgetting dynamics expose AI images: a new detection paradigm"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that generated images really are more sensitive than natural images to the particular pruning direction; the paper assumes this sensitivity gap ($\\omega>0$) instead of proving it, and it notes that the gap may shrink as future pretraining corpora include more synthetic images.","fun_headline_variants_meta":{"raw":{"variants":["Prune a vision model to catch AI images via faster forgetting","Machine unlearning reveals synthetic images: forget to detect","Unlearning-based detector spots AI images without training data","Data-free AI detection: pruning makes fake images stand out","Forgetting dynamics expose AI images: a new detection paradigm"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000823,"raw_usage":{"total_tokens":3628,"prompt_tokens":1004,"completion_tokens":2624,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":620,"completion_tokens_details":{"reasoning_tokens":2544}},"tokens_in":620,"tokens_out":2624,"duration_ms":17599,"temperature":1.0,"reasoning_tokens":2544,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:17:19.650563+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take any vision model pretrained on natural-image-dominated data, prune the same small-magnitude weights, and measure whether images from a held-out generator show larger feature displacement than natural images; if a generator that the paper did not test produces no separation under the cosine-similarity score, or if a model pretrained with substantial synthetic data no longer shows the gap, the central claim fails.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the DINOv2 backbone whose pruned variant defines the detection score."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the magnitude-based weight pruning operation used for data-free unlearning."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the CNNspot baseline and the JPEG and blur augmentation protocol adopted for robustness evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the UnivFD baseline and the linear-classification comparison on a frozen backbone."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the DIRE baseline and the DiffusionForensics benchmark."}],"review_version":2}