{"id":"f877f7b5-8313-4e85-8a35-cd109c3e2b57","arxiv_id":"2608.09223","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Classifying from spatially aggregated DINO patch tokens instead of a single CLS token improves cross-dataset AI-generated image detection by about three percentage points average balanced accuracy.","lead":"This paper introduces PatchHead, a lightweight head that keeps the two-dimensional layout of DINO patch tokens and adds local spatial aggregation, instead of classifying from the usual single CLS token. Tested across nine AI-image benchmarks, it reports the best average and worst-case balanced accuracy over prior detectors while adding little computation.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline +3.0/+6.9 gains over the DDA prior are not controlled for the backbone and training protocol; the same-backbone head-only gain in Table 4 is +0.7 average and +0.5 worst-case, so the causal attribution to spatial aggregation is not supported by the headline numbers.","rationale":"The reader's identified weak assumption is that DDA-COCO and EvalGEN may be partially in-distribution because they come from the same source paper as the training set. That is a legitimate evaluation concern, but it is not the most load-bearing one here: removing those two benchmarks from Table 1 leaves the average gain at roughly 3.2 points (PatchHead 93.8 vs DDA 90.7) and does not change the minimum comparison, so even if those benchmarks are partially seen, the headline average and worst-case numbers are not substantially inflated. The more serious issue is attribution. The causal claim of the paper is that restoring spatial patch layout and applying depthwise convolution before pooling is what raises cross-dataset generalization. The evidence for that causal claim must come from controlled comparisons, and Table 4 is the relevant control: it shows only a 0.7-point average and 0.5-point worst-case gain over the same-backbone CLS head. The much larger gains in Table 1 over the DDA system mix in a different backbone and training protocol. The paper also reports worst-case accuracy as the minimum over whatever benchmark each method finds hardest, which is not an apples-to-apples measure of improvement. These issues do not invalidate the proposal; the controlled ablation still shows a small, mostly consistent positive effect, and the head is cheap. But the abstract and conclusions currently state the larger, uncontrolled deltas as though they came from the spatial head alone. The paper should be revised to report controlled same-backbone comparisons with error bars and to replace the minima-based claim with paired per-benchmark worst-case results. This is consistent with the reader's CONDITIONAL verdict, so the verdict should remain unchanged.","tokens_in":19485,"tokens_out":14985,"duration_ms":137691,"concrete_test":"Re-run the DDA/CLS-head baseline on the exact PatchHead protocol (DINOv3 ViT-L/16, LoRA rank 8, one epoch, DDA-aligned COCO-SD-2, lambda=0.5; i.e., CLSHead(Linear) from Table 4) across three seeds, and compute paired per-benchmark differences and per-benchmark minima. If the re-implementation lands at about 93.9 average and 88.9 minimum, the Table 1 deltas are confounded with the backbone/protocol change, and the abstract's +3.0/+6.9 claims must be restated as the controlled head-only margins (about +0.7/+0.5) with error bars; if it reproduces 91.6/82.4, the confound is absent.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim attributes the headline gains to the spatial aggregation head, but the comparison behind those numbers (Table 1) is not controlled: the DDA row is the prior system from Chen et al. 2025, not a re-implementation of a CLS head on the same DINOv3 + LoRA + contrastive protocol. The paper's own controlled baseline, CLSHead(Linear) in Table 4, reaches 93.9 average and 88.9 minimum on the same nine benchmarks; PatchHead improves this to 94.6 and 89.4. So the head-only margin is 0.7 and 0.5 points, not 3.0 and 6.9 points. The larger deltas are therefore largely explained by the backbone/training-protocol difference (e.g., DINOv3 with LoRA and the auxiliary contrastive loss) rather than by the spatial head. In addition, the reported 'worst-case' improvement compares the minimum over different benchmarks: DDA's 82.4 is on Chameleon while PatchHead's 89.4 is on SynthWildX, where PatchHead is actually below DDA (89.4 vs 90.9 in Tables 1 and 3). A paired, same-benchmark worst-case comparison is needed before claiming a 6.9-point worst-case gain.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PatchHead, a lightweight classification head for AI-generated image detection that replaces the conventional CLS-token interface of a frozen DINOv3 backbone with a spatial aggregation of patch tokens. The head reshapes patch tokens to their native 2D layout, applies a depthwise 3×3 convolution followed by a 1×1 projection and global average pooling, and trains end-to-end with only LoRA adapters plus an auxiliary contrastive loss on the CLS token, which is discarded at inference. The authors report cross-dataset balanced accuracy on nine benchmarks, claiming an average improvement of +3.0 points and a worst-case improvement of +6.9 points over the strongest prior method, DDA, while adding only 8.6% trainable parameters and 0.08% FLOPs. Controlled ablations compare PatchHead to CLS-based and GAP-based heads under the same training protocol, and additional analyses examine spatial response statistics, feature-space alignment, robustness to perturbations, and sensitivity to LoRA and contrastive-loss settings.","tokens_in":19756,"tokens_out":4059,"duration_ms":35695,"significance":"If the central attribution held, the paper would provide a simple and inexpensive interface change for foundation-model-based detectors, with careful single-model cross-dataset evaluation and a clear representation-level hypothesis. The controlled ablations in Table 4 are a genuine strength: they isolate the head choice under a shared backbone, data, augmentations, and objective, and the spatial-response and feature-space analyses offer falsifiable qualitative evidence that spatial aggregation changes where the detector attends. The architecture is simple, the overhead is small, and the nine-benchmark protocol without target adaptation is a useful contribution. However, the headline quantitative claims are not yet supported as stated, because the main comparison is not controlled for the backbone/training protocol and the worst-case margin is computed over different benchmarks.","major_comments":[{"comment":"The headline claim that PatchHead improves the strongest prior method by +3.0 average and +6.9 worst-case points is not a controlled comparison for the paper's causal claim. The DDA row in Table 1 is the prior system from Chen et al. 2025, which uses a different backbone and training protocol, whereas Table 4's same-backbone CLSHead(Linear) baseline differs from PatchHead by only +0.7 average and +0.5 minimum points on the same nine benchmarks. The large deltas in Table 1 are therefore largely attributable to the DINOv3+LoRA+contrastive protocol rather than to spatial aggregation, so the central statement that spatial patch aggregation transfers more reliably is not supported by the headline numbers. Please report the head-only comparison as the primary quantitative evidence, or provide a same-protocol DDA-equivalent baseline.","section":"Table 1 vs. Table 4 (Experiments, Comparison with State-of-the-Art Methods)"},{"comment":"The reported worst-case improvement of +6.9 points compares minima over different benchmarks: DDA's minimum (82.4) occurs on Chameleon, while PatchHead's minimum (89.4) occurs on SynthWildX, where PatchHead is actually below DDA (89.4 vs. 90.9). This per-benchmark minimum comparison inflates the robustness gain. Please report paired per-benchmark differences, the average of per-benchmark deltas, and the minimum per-benchmark delta, and avoid claiming a 'worst-case gain' unless the minima are computed on the same benchmark.","section":"Table 1 and Table 3 (Worst-case accuracy)"},{"comment":"The contrastive-loss weight λ=0.5 is selected via ablation in Figure 6 on the same nine evaluation benchmarks that are then used for the final reported numbers, and no validation split or multiple-seed error bars are provided. Because each ablation appears to be a single training run, selection on the evaluation set combined with the absence of variance estimates makes the reported margins, especially the 0.7-point gap in Table 4, statistically ungrounded. Please describe the selection procedure with a held-out split, report error bars over at least three seeds, and show the sensitivity of the Table 4 comparison to λ.","section":"Figure 6 and Equation (8)"},{"comment":"The claim that the nine benchmarks are unseen targets is not fully established for DDA-COCO and EvalGEN. Both come from Chen et al. 2025, the same source as the DDA-aligned COCO-SD-2 training set, and the paper does not demonstrate that their generator sources or alignment artifacts are disjoint from the training distribution. If these two benchmarks share distributional components with the training data, the average and worst-case gains in Table 1 are inflated. Please provide a disjointness analysis, for example a comparison of generator lists, alignment transforms, or a leakage probe.","section":"Datasets and Appendix B"}],"minor_comments":[{"comment":"The asterisks on the SAFE and AIDE rows (54.2 and 54.7) are unexplained; specify what values were corrected and why, matching the Table 1 footnote convention.","section":"Table 3"},{"comment":"The FLOPs column in Table 4 reports values such as '~0.45M' and '~242M', while the abstract states '0.08% additional FLOPs'; clarify the units, the reference point for the percentage, and how the head-only FLOPs are measured.","section":"Table 4 and Abstract"},{"comment":"The plot is difficult to read in grayscale; use distinct markers and, if possible, show per-seed points or error bars to support the claimed insensitivity to λ.","section":"Figure 6"},{"comment":"The supplement states that 'detailed statistics are provided in the supplementary material' for the nine benchmarks, but the full text only contains Table 7; ensure every referenced supplementary figure and table is present and numbered consistently.","section":"Appendix B"},{"comment":"Several 2026 references (e.g., DINOv3, SimLBR, MIRROR) are used; please mark which are preprints and ensure their publication status is correctly described.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is competently executed and the controlled Table 4 ablation is a useful step, but the central quantitative claims are overstated by an uncontrolled headline comparison and a per-benchmark worst-case computation. The core idea is plausible and the architecture is simple enough that a properly controlled and reframed version could be publishable. The absence of code and of multiple-seed error bars is a concern for a paper whose main evidence is empirical; I would like to see the authors either provide code or at least report variance over seeds. The overlap between the training set and DDA-COCO/EvalGEN also needs explicit handling before the cross-dataset claim can be accepted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper asks a good question and runs mostly careful controls, but the headline numbers overstate what the spatial head alone buys you. The +3.0 average / +6.9 worst-case margins over DDA come from comparing PatchHead (DINOv3 + LoRA + contrastive loss) against a prior system that doesn't share that backbone or training recipe. The paper's own controlled comparison in Table 4 shows the head-only gain over CLSHead(Linear) is +0.7 average and +0.5 worst-case. That's a real but modest effect, and the paper is honest about it in Table 4 — the abstract just doesn't carry that caveat.\n\nWhat's actually new: restoring DINO patch tokens to their native 2D layout and applying a depthwise conv before global pooling for AI-generated image detection. TAP already used patch tokens, but not explicit adjacency modeling; this is a genuine small extension. The ablations are the paper's strength: simple GAP is worse than CLS, shuffling positions hurts, a 3-layer MLP head doesn't match, and more complex spatial designs fail to generalize. The cost is negligible and the robustness table is useful.\n\nSoft spots, in proportion. The worst-case claim is misleading as stated: DDA's minimum is on Chameleon (82.4), PatchHead's minimum is on SynthWildX (89.4), where PatchHead is actually below DDA (89.4 vs 90.9). A paired, same-benchmark minimum comparison is needed. No error bars or multiple seeds are reported, and code is not released. The contrastive weight lambda is tuned on the same nine benchmarks and then reported on them, which is mild circularity. DDA-COCO and EvalGEN come from the same source paper as the training set and may be partially in-distribution. Finally, the spatial response analysis uses different attribution methods for the two architectures (Attention Rollout for CLS, CAM for PatchHead), so the qualitative account is suggestive rather than a clean comparison.\n\nWho this is for: people working on AIGID generalization, and anyone thinking about pooling interfaces for DINO features. The paper deserves a serious referee — the controlled comparison and breadth make it worth engaging even though the framing oversells the central effect. I'd send it to review.","headline":"Useful hypothesis and honest ablations, but the headline gain is mostly protocol, not the spatial head; still worth a serious referee.","tokens_in":20292,"tokens_out":2041,"would_cite":true,"duration_ms":19641,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Preserving the spatial layout of DINO patch tokens improves cross-dataset detection of AI-generated images.","keywords":["AI-generated image detection","cross-dataset generalization","DINO patch tokens","spatial aggregation","CLS token","LoRA fine-tuning","deepfake detection","out-of-distribution robustness"],"falsifier":"Retrain PatchHead on a source set built from generators unrelated to the DDA pipeline and evaluate on DDA-COCO and EvalGEN; if the average or worst-case gains over the CLS baseline fall below the claimed +3.0 and +6.9 points, part of the improvement is explained by training data overlap.","tokens_in":19273,"feed_emoji":"🔍","tokens_out":6085,"duration_ms":44496,"temperature":0.7,"pith_summary":"AI-generated image detectors that rely on a single global CLS token discard the spatial layout of image patches. This paper argues that generation traces are local and spatially distributed, so the detector interface should preserve patch positions and combine neighboring evidence before making a decision. PatchHead does this with a small convolutional head placed after a frozen DINOv3 backbone, and the paper reports that it raises average cross-dataset balanced accuracy from 91.6% to 94.6% and worst-case accuracy from 82.4% to 89.4% across nine benchmarks. The point is that how foundation-model features are aggregated matters as much as which features are used.","feed_headline":"Spatial patch layout lifts fake-image detection to 94.6 percent","feed_subtitle":"A lightweight head that keeps DINO patch tokens in 2D raises worst-case accuracy by 6.9 points.","key_machinery":"The central object is PatchHead, a lightweight spatial aggregation head. It takes the sequence of DINO patch tokens, reshapes it to a two-dimensional feature map, applies a $3\\times3$ depthwise convolution to exchange information among neighboring patches, a GELU activation, a $1\\times1$ pointwise convolution to project channels, and global average pooling before a linear classifier; the CLS token is used only in an auxiliary contrastive loss during training and discarded at inference. This mechanism is what tests the paper's hypothesis because it isolates spatially structured aggregation against global CLS compression while keeping the backbone and training protocol fixed.","core_discovery":"The paper claims that the standard practice of classifying AI-generated images from the CLS token underuses the spatial representations of DINO-family backbones, and that restoring patch tokens to their native two-dimensional layout before aggregation yields a more transferable authenticity signal. Trained on the DDA-aligned COCO-SD-2 dataset with the backbone frozen and LoRA adapters learned, PatchHead reshapes the patch token sequence into a spatial feature map $F_0 \\in \\mathbb{R}^{D \\times H_p \\times W_p}$, applies a $3 \\times 3$ depthwise convolution followed by a $1 \\times 1$ projection, pools globally, and classifies from that pooled patch representation. The reported result is first or second place on all nine cross-dataset benchmarks, with an average balanced accuracy of 94.6% and a worst-case accuracy of 89.4%, improving on the strongest prior method by 3.0 and 6.9 points respectively while adding only 8.6% trainable parameters and 0.08% FLOPs. Ablations show that simple patch averaging does not reproduce the gain and that shuffling patch positions degrades it, which the paper interprets as evidence that learnable spatial aggregation over the native layout is the active ingredient.","pith_inferences":["Beyond the paper, if the representation-interface account is right, applying the same spatial-aggregation idea to other vision foundation models and to other forensic tasks should reproduce the transfer gain; this is directly testable.","Beyond the paper, the claim that spatial evidence is authenticity-sensitive suggests that combining PatchHead with reconstruction-based or frequency-domain cues could push worst-case accuracy further, since blur and heavy post-processing remain hard for both interfaces.","Beyond the paper, a stricter evaluation protocol that excludes DDA-COCO and EvalGEN from the target list would clarify how much of the improvement is due to spatial aggregation rather than to benchmark overlap with the DDA training pipeline.","Beyond the paper, PatchHead's stability under resizing hints that the spatial head is more robust to geometric perturbations; testing stronger JPEG compression or combined degradations would show the limits."],"forward_implications":["A single trained PatchHead model, without target-specific fine-tuning or test-time adaptation, is competitive or best on datasets spanning GAN, diffusion, flow-matching, and in-the-wild sources.","Learnable spatial aggregation, not merely access to patch tokens, is required: global averaging of patches underperforms the CLS baseline.","Preserving the native 2D layout matters: a fixed random permutation of patch positions lowers average accuracy from 94.6% to 94.3%.","The spatial response analysis implies that detectors can be steered toward distributed authenticity evidence rather than content-salient regions, measurable in coverage and top-10% activation statistics.","Heavier spatial designs such as multi-scale, multi-level fusion, and HRM-inspired refinement do not automatically improve cross-domain accuracy; the simple depthwise-conv head is stronger."],"supporting_citations":[{"why":"Supplies the DDA-aligned COCO-SD-2 training set and the DDA baseline, and contributes the DDA-COCO and EvalGEN benchmarks.","marker":"(Chen et al. 2025)"},{"why":"Defines the DINOv3 ViT-L/16 backbone whose frozen patch tokens PatchHead spatially aggregates.","marker":"(Siméoni et al. 2026)"},{"why":"Motivates the DINO-family representation choice that the paper builds on.","marker":"(Oquab et al. 2024)"},{"why":"Provides the B-Free training paradigm and the BFree-Online in-the-wild benchmark used for spatial response statistics.","marker":"(Guillaro et al. 2025)"},{"why":"Contributes the Chameleon in-the-wild benchmark and the AIDE baseline compared against.","marker":"(Yan et al. 2025)"},{"why":"Contributes the SynthWildX benchmark and CLIP-based detection context.","marker":"(Cozzolino et al. 2024)"},{"why":"Contributes the WildRF in-the-wild benchmark.","marker":"(Cavia et al. 2024)"},{"why":"Introduces the depthwise convolution that carries local spatial interaction in PatchHead.","marker":"(Howard et al. 2017)"},{"why":"Contributes the AIGC benchmark and earlier patch-based forensic evidence.","marker":"(Zhong et al. 2023)"}],"fun_headline_variants":["Spatial patches lift fake-image detection to 94.6%","Spatial patch layout boosts cross-generator fake detection","PatchHead: spatial evidence beats global token for AI fakes","Spatial patches: 3.0-point average gain, 6.9-point worst-case","Lightweight patch head improves fake detection by 3.0 points"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported gains assume all nine target benchmarks are genuinely unseen at training time, even though DDA-COCO and EvalGEN come from the same research line that produced the training data.","fun_headline_variants_meta":{"raw":{"variants":["Spatial patches lift fake-image detection to 94.6%","Spatial patch layout boosts cross-generator fake detection","PatchHead: spatial evidence beats global token for AI fakes","Spatial patches: 3.0-point average gain, 6.9-point worst-case","Lightweight patch head improves fake detection by 3.0 points"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00084,"raw_usage":{"total_tokens":3736,"prompt_tokens":1097,"completion_tokens":2639,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":713,"completion_tokens_details":{"reasoning_tokens":2543}},"tokens_in":713,"tokens_out":2639,"duration_ms":16627,"temperature":1.0,"reasoning_tokens":2543,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:25:07.075454+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Retrain PatchHead on a source set built from generators unrelated to the DDA pipeline and evaluate on DDA-COCO and EvalGEN; if the average or worst-case gains over the CLS baseline fall below the claimed +3.0 and +6.9 points, part of the improvement is explained by training data overlap.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Motivates the DINO-family representation choice that the paper builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the B-Free training paradigm and the BFree-Online in-the-wild benchmark used for spatial response statistics."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Contributes the Chameleon in-the-wild benchmark and the AIDE baseline compared against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Contributes the SynthWildX benchmark and CLIP-based detection context."}],"review_version":2}