Pith. sign in

REVIEW 4 major objections 6 minor 2 cited by

Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detection

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read AIGC detectors fail to generalize when they learn shortcuts tied to the initial latent noise vector rather than robust generative artifacts; the paper proposes on-manifold adversarial training that optimizes that noise and retrains the…

desk verdict Strong empirical gains from latent-optimized SDv1.4 examples, but the causal story is undercut by a missing random-zT control. read the letter →

arxiv 2506.00874 v1 pith:OUR2V6EP submitted 2025-06-01 cs.CV

Yue Zhou , Xinan He , KaiQing Lin , Bin Fan , Feng Ding , Bin Li This is my paper
classification cs.CV
keywords AIGCdetectionlatentpriorbiason-manifoldadversarialtrainingdiffusionmodelsgeneralizationCLIPGenImage++AI-generatedimageforensics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that AI-generated image detectors fail to generalize because they learn shortcuts tied to the initial latent noise vector $z_T$ of the training generator, a phenomenon it calls latent prior bias. To test this, the authors optimize $z_T$ under a fixed prompt to generate adversarial images that remain on the generator's manifold and reliably fool a trained detector. They then propose On-Manifold Adversarial Training (OMAT), fine-tuning the detector on a small set of 6,000 such images, and report that a CLIP+LoRA detector reaches 94.63% average accuracy on GenImage and 96.78% on the new GenImage++ benchmark that includes Flux.1 and SD3. The result matters because it suggests cross-generator robustness can be achieved without redesigning the detector or using massive augmentation.

What carries the argument

The central object is the initial latent noise vector $z_T$ of a DDIM-based text-to-image diffusion model. The paper optimizes $z_T$ by backpropagating the detector's BCE loss through the full denoising and decoding pipeline while the text prompt and generator weights stay fixed, so the resulting images remain on the generator's output manifold. These on-manifold adversarial examples, labeled as fake, are then added to the training set so that the $z_T$-dependent shortcuts stop minimizing the loss, forcing the detector to pick up generative artifacts that are shared across generators. LoRA fine-tuning of the CLIP backbone is the adaptation that gives the largest generalization gain.

What would settle it

Retrain the same CLIP+LoRA detector on the standard SDv1.4 training set augmented with 6,000 randomly sampled SDv1.4 images instead of the optimized-latent images; if the accuracy on GenImage and GenImage++ matches the reported 94.63% and 96.78%, the effect is not specific to optimizing $z_T$. A complementary check is to measure FID between the optimized-latent image set and a large standard SDv1.4 sample under the same 1,000 prompts; a large FID gap would contradict on-manifold status.

Watch

Extended reading notes

Core claim

The central claim is that the generalization gap in AIGC detection is driven in part by latent prior bias: detectors trained on images from a diffusion generator become sensitive to characteristics inherited from the particular initial noise vectors $z_T$ they saw, rather than to the stable artifacts of the generation process itself. The paper demonstrates this by a white-box attack that optimizes $z_T$ with the text condition and generator frozen, turning detectable images into undetectable ones in at most 100 steps for every one of 1,000 prompts. It then shows that fine-tuning on these on-manifold adversarial examples, labeled as fake, compels the detector to rely on more robust features, with the best model improving from 79.20% to 94.63% average on GenImage and reaching 96.78% on the newly introduced GenImage++ test set. The authors interpret the correlation between on-manifold attack robustness and generalization as evidence that mitigating latent prior bias is the operative mechanism.

Load-bearing premise

The 6,000 optimized-latent images must truly lie on the generator's normal output manifold and differ from ordinary Stable Diffusion v1.4 outputs mainly in $z_T$-influenced details; if they are atypical or degraded, the generalization gains could come from plain data augmentation rather than from removing a latent prior bias.

Editorial extensions

If this is right

  • Detectors trained with OMAT generalize to unseen generators, including DiT-based models like Flux.1 and SD3, without any architectural change.
  • A relatively small set of 6,000 optimized-latent images is sufficient to substantially change detector behavior.
  • On-manifold adversarial training outperforms pixel-space adversarial training with FGSM, PGD, and MI-FGSM for improving cross-generator accuracy.
  • Detector robustness to latent-space attacks correlates with generalization, indicating that the shortcut is being addressed.
  • GenImage++ provides a test-only benchmark that exposes large generalization gaps in existing detectors against modern generators.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The mechanism should transfer to other diffusion generators that take a $z_T$ input, so OMAT-like training could be run with a different generator in place of Stable Diffusion v1.4; this is a testable extension the paper does not run.
  • The latent-prior-bias diagnosis suggests that detector evaluation should sample multiple latent-noise vectors per prompt, not just fixed seeds, to avoid overestimating robustness.
  • Because image editing and inpainting initialize from non-random latents, detectors made robust to $z_T$ perturbations may also be more reliable on those tasks, an implication the paper flags as future work.
  • The reported gains might be partly attributable to generic augmentation if the optimized images are off-manifold; a control replacing them with random SDv1.4 images would separate the mechanisms.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper hypothesizes that AIGC detectors generalize poorly because they learn shortcuts tied to the initial latent noise zT of diffusion models ("latent prior bias"), rather than robust generative artifacts. To expose this bias, the authors propose a white-box on-manifold attack that optimizes zT under fixed conditioning and a frozen generator, producing a set Xadv of 6,000 adversarial images that still lie on the generator's output manifold. They then fine-tune baseline ResNet50 and CLIP detectors on the original SDv1.4 training set augmented with Xadv, calling the procedure On-Manifold Adversarial Training (OMAT). The paper reports substantial cross-generator gains: an average of 94.63% on GenImage for CLIP+LoRA (Rank 4), 66.05% on Chameleon, and 96.78% on a newly introduced GenImage++ benchmark, with a comparison showing that pixel-space adversarial training yields much smaller gains. A new test-only benchmark, GenImage++, containing images from FLUX.1, SD3, SDXL, and SD1.5 under standard, long-prompt, multi-style, and photorealistic conditions, is also introduced.

Significance. If the findings are robust, the paper makes a valuable and actionable contribution: a small set of latent-optimized examples can shift a detector toward more generalizable features without network redesign, and the GenImage++ benchmark addresses a real evaluation gap for contemporary diffusion models. The comparison in Table 5, cleanly separating on-manifold from L∞-bounded pixel-space adversarial examples, is a useful experimental design, and the multiple independent test sets (GenImage, Chameleon, GenImage++) are strengths because they are all disjoint from the Xadv training set. However, the central explanatory claim is currently underdetermined: the results do not distinguish the effect of zT optimization from the effect of adding more SDv1.4 training data or from hard-example mining. The re-attack evidence in Table 4 is also partly self-referential, and the evidence that Xadv is genuinely on-manifold and differs only in zT-influenced features rests on single-prompt, qualitative analyses. These issues are fixable with additional experiments, and the manuscript's scope and novelty are appropriate for the journal.

major comments (4)
  1. [§4, Appendix A.2, Table 1] The paper's central causal claim—that zT-optimized on-manifold examples, not merely additional SDv1.4 data, drive the observed generalization gains—is not tested against the natural null hypothesis. Xadv consists of 6,000 SDv1.4 outputs selected by optimizing zT against the baseline detector. Fine-tuning on the original SDv1.4 training set augmented with these images conflates three effects: (a) more SDv1.4 training data, (b) a distributional shift toward harder negatives, and (c) removal of the specific zT-influenced shortcut features. The pixel-space comparison in Table 5 controls for the adversarial-example source only in an off-manifold direction; it does not control for (a) or (b). To attribute the +15.43-point GenImage gain to latent prior bias, the authors should run the same fine-tuning recipe with randomly sampled SDv1.4 images at the same prompts, same count, and same checkpoint selection. Without such a control, the headline numbers are also compatible with ordinary data augmentation or hard-example mining.
  2. [§6.5, Table 4] The re-attack robustness experiment is partly self-referential. OMAT models were trained on Xadv generated by the same attack distribution (fixed 100 ImageNet labels, same optimization loop) used to re-attack them in Table 4. Reduced success rates and higher 'Avg Step' after OMAT could therefore reflect memorization of or overfitting to that attack distribution rather than improved robustness to latent perturbations in general. The claim that 'generalization correlates with on-manifold robustness' should be tested with attacks on fresh seeds and prompts outside the training set, and ideally with transfer attacks against a different detector. As it stands, Table 4 provides only weak evidence for the hypothesized mechanism.
  3. [§5, Appendix C, Table 3] The GenImage++ evaluation protocol is under-specified. The benchmark is described as 'test-only' and, for several subsets, explicitly lacks corresponding real images. The paper does not state which real images (if any) are combined with the generated images to compute the Accuracy numbers in Table 3, nor the real/fake ratio. If the reported accuracy is computed on fake-only subsets, it is not standard real-vs-fake accuracy and can be inflated by a detector that simply predicts 'fake'. The authors should specify the exact composition of each evaluation set or report separate fake-detection rates (e.g., TPR at fixed FPR) alongside balanced accuracy.
  4. [§3.4, Appendix B.1] The evidence that Xadv lies 'on-manifold' and differs from normal SDv1.4 outputs only in zT-derived characteristics is currently too thin to support the mechanism. The quantitative fidelity check is limited to a CLIP-score comparison for a single prompt ('photo of a cat'), where the mean shift is 0.13 on a scale around 28 (small relative to the std of roughly 0.8-0.96), and the t-SNE analysis in Figure 6 is also for a single prompt and is qualitative. These analyses do not rule out that Xadv consists of atypical or hard negatives that improve generalization through ordinary hard-example mining. I recommend additional quantitative evidence across many prompts—for example, FID/CLIP-score distributions, feature-space nearest-neighbor distances to standard SDv1.4 outputs, and a comparison against other hard-negative selection strategies.
minor comments (6)
  1. [Appendix A.2, Figure 4] The manuscript contains unfinished editorial placeholders: Appendix A.2 reads 'Confirm LR/BS if different' and Figure 4's caption contains '[Number]' as a sample count; these must be completed before publication.
  2. [Appendix B.1] Figure numbering is inconsistent: Figure 4 is referred to in B.1, and Figure 8 is referenced there and then appears later; check that all figure callouts match the numbered figures.
  3. [§6.1, Tables 1-3] No error bars or confidence intervals are reported; given the single-run nature of the results, at least one seed or a small variance estimate should be provided for the main claims.
  4. [§2, Table 1] Recent methods cited in the text, such as FakeInversion and RIGID, are not included in the experimental comparison; either include them or justify their absence.
  5. [Appendix A.2] The checkpoint selection criterion includes 'Adv Sample Acc', the accuracy on the adversarial training set itself; this can select models that overfit to Xadv. Consider reporting results with a selection criterion based solely on held-out validation accuracy.
  6. [§5] The GenImage++ benchmark is not yet publicly available; since it is a central contribution, releasing the prompt JSONs and generation code at publication would materially aid reproducibility.

Circularity Check

1 steps flagged · score 2.0 of 10

No significant circularity in the main cross-generator evaluation; one supporting robustness re-attack is partly self-referential because it reuses the same attack family used to build the training set.

  1. fitted input called prediction [Section 6.5 and Appendix A.2 (Table 4 and fine-tuning details)]
    "To investigate the relationship between generalization and on-manifold attack robustness, we re-attack three CLIP+Linear detector variants... The results, presented in Table 4, reveal a strong correlation between generalization capability and on-manifold robustness... This clear trend—where models demonstrating superior generalization are also substantially more resilient to on-manifold attacks targeting latent prior bias—provides strong evidence for our hypothesis."

    The robustness metric in Table 4 is the same latent-optimization attack family that produced the Xadv training set, and the fine-tuning protocol explicitly optimizes accuracy on Xadv via the checkpoint score 0.6*ValAcc + 0.4*AdvSampleAcc. Therefore the reported drop in attack success after OMAT is partly entailed by the training objective: the detector is directly penalized for misclassifying the very class of examples used to attack it. Using this self-referential re-attack as strong evidence for the latent-prior-bias mechanism partially reduces to a fit on the attack distribution. This does not undermine the main cross-generator claim, because the GenImage, Chameleon, and GenImage++ evaluations are external to Xadv.

full rationale

The paper's central claim—that adding 6,000 zT-optimized on-manifold examples improves cross-generator detection—is evaluated on GenImage, Chameleon, and the newly introduced GenImage++ benchmark, none of which are used to fit Xadv. These external evaluations prevent the headline generalization numbers from being circular. The paper contains no load-bearing self-citation: references to Xu et al. and Stutz et al. are external prior work, and the authors do not invoke any uniqueness theorem of their own. The main methodological weakness, the absence of a random-zT control, is an underdetermination of the mechanism rather than a circular reduction: it does not make the reported gains equivalent to the inputs by construction. The only partially self-referential element is Table 4, where robustness is measured by re-running the same latent-optimization attack whose examples form the adversarial training set and whose accuracy is explicitly included in model selection. That step is supporting evidence rather than the central result, so the overall circularity is minor.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper's results rest on hand-chosen hyperparameters (adversarial sample count, loss weighting, checkpoint selection, attack budget) rather than on fitted constants, and on domain assumptions inherited from prior work (seed classification, robustness-generalization link) and from the authors' own implementation choices (0.5 threshold, real-image availability for GenImage++). No new physical entities are introduced; latent prior bias is a conceptual label for an empirical phenomenon, not an entity with an independent falsifiable handle.

free parameters (4)
  • Number of adversarial examples N = 6000
    Chosen by hand as a practical budget (1000 ImageNet labels times 6 successes per label). The paper does not ablate N, and the training effect may depend on it.
  • Adversarial loss weight lambda_adv schedule = min(1.0 + 0.2 * epoch, 3.0)
    Hand-chosen ramp in Appendix A.2 that directly controls how much the adversarial examples influence fine-tuning and the reported accuracy.
  • Checkpoint selection weights = 0.6 * Val Acc + 0.4 * Adv Sample Acc
    Hand-chosen formula in Appendix A.2 used to pick the best model; different weights would likely change the reported results.
  • Attack hyperparameters = K=100, eta=1e-3, success threshold=0.5
    Hand-chosen in Appendix A.1. The attack's success rate and the resulting Xadv distribution depend on these values.
assumptions (5)
  • domain assumption The DDIM generation process is exactly x0 = SD(zT, c) with a deterministic mapping from latent and condition to image (Eq. 3).
    Used in Sections 3.2 and 3.3 to define the attack. Real samplers, classifier-free guidance, and stochasticity may break the exact mapping.
  • domain assumption Initial latent noise zT carries learnable, non-generalizable patterns (from Xu et al. [36]).
    This is the paper's premise for latent prior bias. It is cited from prior work, not re-derived here.
  • domain assumption On-manifold adversarial robustness is linked to generalization (Stutz et al. [31]).
    Invoked at the end of Section 4 to justify why OMAT improves generalization.
  • domain assumption Real images for computing GenImage++ accuracy exist and are matched or adequately paired with the generated subsets.
    Appendix C.4 notes real counterparts exist for ImageNet-derived subsets, but the paper never specifies the actual real-image set or class balance used in Table 3.
  • ad hoc to paper The 0.5 logit threshold is the operating point of the evaluated detectors.
    Defined in Algorithm 1 and used as the attack success criterion. The paper does not justify this threshold from detector calibration.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detection." pith.science (2026). https://pith.science/paper/OUR2V6EP

@misc{pith2026250600874,
  author       = {Pith},
  title        = {Pith review of: Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OUR2V6EP}},
  note         = {Machine review of arXiv:2506.00874}
}
read the original abstract

Current AIGC detectors often achieve near-perfect accuracy on images produced by the same generator used for training but struggle to generalize to outputs from unseen generators. We trace this failure in part to latent prior bias: detectors learn shortcuts tied to patterns stemming from the initial noise vector rather than learning robust generative artifacts. To address this, we propose On-Manifold Adversarial Training (OMAT): by optimizing the initial latent noise of diffusion models under fixed conditioning, we generate on-manifold adversarial examples that remain on the generator's output manifold-unlike pixel-space attacks, which introduce off-manifold perturbations that the generator itself cannot reproduce and that can obscure the true discriminative artifacts. To test against state-of-the-art generative models, we introduce GenImage++, a test-only benchmark of outputs from advanced generators (Flux.1, SD3) with extended prompts and diverse styles. We apply our adversarial-training paradigm to ResNet50 and CLIP baselines and evaluate across existing AIGC forensic benchmarks and recent challenge datasets. Extensive experiments show that adversarially trained detectors significantly improve cross-generator performance without any network redesign. Our findings on latent-prior bias offer valuable insights for future dataset construction and detector evaluation, guiding the development of more robust and generalizable AIGC forensic methodologies.

Figures

Figures reproduced from arXiv: 2506.00874 by the authors.

Figure 1
Figure 1. Illustration of our white-box attack methodology. The initial latent noise [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Distribution of optimization steps for successful on-manifold latent attacks targeting [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Example images from our proposed GenImage++ benchmark. Columns from left to right: [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Distribution of CLIP scores for images generated from original random latent noise ( [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: Comparison of adversarial examples for the prompt "photo of a cat" across multiple [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]
Figure 6
Figure 6. Figure 6: 3D t-SNE visualization of initial random latent vectors ( [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]
Figure 7
Figure 7. Figure 7: Sample images from multiple subsets of the GenImage++ dataset. Each block (from left to [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]
Figure 8
Figure 8. Figure 8: Qualitative comparison of adversarial examples generated for various ImageNet labels. [PITH_FULL_IMAGE:figures/full_fig_p023_8.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Rethinking the Readout: Unlocking Video Backbones for AI-Generated Video Detection

    cs.CV 2026-07 conditional novelty 6.0 of 10

    Replacing the global-pooling readout of a frozen video backbone with a velocity-gated, per-channel-magnitude readout improves AI-generated video detection cross-generator accuracy by several AUC points.

  2. AgentFoX: LLM Agent-Guided Fusion with eXplainability for AI-Generated Image Detection

    cs.CV 2026-03 conditional novelty 6.0 of 10

    An LLM agent guided by Expert and Clustering Profiles fuses heterogeneous AIGI detectors, resolves conflicts, and outputs explainable forensic reports that beat single experts and standard ensembles on high-conflict a...

Reference graph

Works this paper leans on

41 extracted references · 12 canonical work pages · cited by 2 Pith papers

  1. [1]

    Fakeinversion: Learning to detect images from unseen text-to-image models by inverting stable diffusion

    George Cazenavette, Avneesh Sud, Thomas Leung, and Ben Usman. Fakeinversion: Learning to detect images from unseen text-to-image models by inverting stable diffusion. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10759–10769, 2024

    work page 2024

  2. [2]

    DRCT: Diffusion reconstruction contrastive training towards universal detection of diffusion generated images

    Baoying Chen, Jishen Zeng, Jianquan Yang, and Rui Yang. DRCT: Diffusion reconstruction contrastive training towards universal detection of diffusion generated images. InForty-first International Conference on Machine Learning, 2024

    work page 2024

  3. [3]

    Xception: Deep learning with depthwise separable convolutions

    Francois Chollet. Xception: Deep learning with depthwise separable convolutions. In2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Jul 2017

    work page 2017

  4. [4]

    Scaling instruction-finetuned language models

    Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. Scaling instruction-finetuned language models. Journal of Machine Learning Research, 25(70):1–53, 2024

    2024

  5. [5]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

  6. [6]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018

    2018

  7. [7]

    Scaling rectified flow transformers for high-resolution image synthesis

    Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. InForty-first international conference on machine learning, 2024

    2024

  8. [8]

    Generative adversarial networks.Communications of the ACM, 63(11):139– 144, 2020

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks.Communications of the ACM, 63(11):139– 144, 2020

    2020

Show all 41 references
  1. [9]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  2. [10]

    The llama 3 herd of models

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al- Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  3. [11]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  4. [12]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Jun 2016

    2016

  5. [13]

    Rigid: A training-free and model-agnostic framework for robust ai-generated image detection.arXiv preprint arXiv:2405.20112, 2024

    Zhiyuan He, Pin-Yu Chen, and Tsung-Yi Ho. Rigid: A training-free and model-agnostic framework for robust ai-generated image detection.arXiv preprint arXiv:2405.20112, 2024

    2024 arXiv

  6. [14]

    Clipscore: A reference-free evaluation metric for image captioning.arXiv preprint arXiv:2104.08718, 2021

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning.arXiv preprint arXiv:2104.08718, 2021

    2021 arXiv

  7. [15]

    Lora: Low-rank adaptation of large language models.ICLR, 1(2):3, 2022

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models.ICLR, 1(2):3, 2022

    2022

  8. [16]

    Flux.https://github.com/black-forest-labs/flux, 2024

    Black Forest Labs. Flux.https://github.com/black-forest-labs/flux, 2024

    2024

  9. [17]

    Spatial-phase shallow learning: rethinking face forgery detection in frequency domain

    Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial-phase shallow learning: rethinking face forgery detection in frequency domain. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages ...

    2021

  10. [18]

    Global texture enhancement for fake face detection in the wild

    Zhengzhe Liu, Xiaojuan Qi, and Philip HS Torr. Global texture enhancement for fake face detection in the wild. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8060–8069, 2020

    2020

  11. [19]

    Generalizing face forgery detection with high- frequency features

    Yuchen Luo, Yong Zhang, Junchi Yan, and Wei Liu. Generalizing face forgery detection with high- frequency features. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16317–16326, 2021. 10

    2021

  12. [20]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  13. [21]

    Sdedit: Guided image synthesis and editing with stochastic differential equations.arXiv preprint arXiv:2108.01073, 2021

    Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations.arXiv preprint arXiv:2108.01073, 2021

    2021 arXiv

  14. [22]

    Towards universal fake image detectors that generalize across generative models

    Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24480–24489, 2023

    2023

  15. [23]

    Scalable diffusion models with transformers

    William Peebles and Saining Xie. Scalable diffusion models with transformers. InProceedings of the IEEE/CVF international conference on computer vision, pages 4195–4205, 2023

    2023

  16. [24]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023

    2023 arXiv

  17. [25]

    Thinking in frequency: Face forgery detection by mining frequency-aware clues

    Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-aware clues. InEuropean conference on computer vision, pages 86–103. Springer, 2020

    2020

  18. [26]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. InInternational conference on machine learning, pag...

    2021

  19. [27]

    E. Riba, D. Mishkin, D. Ponsa, E. Rublee, and G. Bradski. Kornia: an open source differentiable computer vision library for pytorch. InWinter Conference on Applications of Computer Vision, 2020

    2020

  20. [28]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

  21. [29]

    Denoising diffusion implicit models.arXiv preprint arXiv:2010.02502, 2020

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models.arXiv preprint arXiv:2010.02502, 2020

    2010 arXiv

  22. [30]

    Score-based generative modeling through stochastic differential equations.arXiv preprint arXiv:2011.13456, 2020

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations.arXiv preprint arXiv:2011.13456, 2020

    2011 arXiv

  23. [31]

    Disentangling adversarial robustness and generalization

    David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generalization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6976–6987, 2019

    2019

  24. [32]

    C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection

    Chuangchuang Tan, Renshuai Tao, Huan Liu, Guanghua Gu, Baoyuan Wu, Yao Zhao, and Yunchao Wei. C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages ...

    2025

  25. [33]

    Rethinking the up- sampling operations in cnn-based generative network for generalizable deepfake detection

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up- sampling operations in cnn-based generative network for generalizable deepfake detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pag...

    2024

  26. [34]

    Cnn-generated images are surprisingly easy to spot

    Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8695–8704, 2020

    2020

  27. [35]

    Dire for diffusion-generated image detection

    Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion-generated image detection. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 22445–22455, 2023

    2023

  28. [36]

    Good seed makes a good crop: Discovering secret seeds in text-to-image diffusion models

    Katherine Xu, Lingzhi Zhang, and Jianbo Shi. Good seed makes a good crop: Discovering secret seeds in text-to-image diffusion models. In2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 3024–3034. IEEE, 2025

    2025

  29. [37]

    A sanity check for ai-generated image detection.arXiv preprint arXiv:2406.19435, 2024

    Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie. A sanity check for ai-generated image detection.arXiv preprint arXiv:2406.19435, 2024. 11

    2024 arXiv

  30. [38]

    Golden noise for diffusion models: A learning framework.arXiv preprint arXiv:2411.09502, 2024

    Zikai Zhou, Shitong Shao, Lichen Bai, Zhiqiang Xu, Bo Han, and Zeke Xie. Golden noise for diffusion models: A learning framework.arXiv preprint arXiv:2411.09502, 2024

    2024 arXiv

  31. [39]

    photo of [ImageNet La- bel]

    Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: A million-scale benchmark for detecting ai-generated image.Advances in Neural Information Processing Systems, 36:77771–77782, 2023. 12 A Implement...

    2023

  32. [40]

    Using reverse image search is often infeasible for highly stylized or uniquely composed generations

    Copyright and Sourcing Challenges:Sourcing perfectly corresponding, high-quality real images for the vast array of styles, complex scenes, and specific portrait attributes generated by modern models poses significant copyright and practical challenges, especially avoiding the ...

  33. [41]

    better" initial noise vectors zT than random Gaussian samples to improve generation quality or efficiency, sometimes referred to as

    Focus on Generalizable Artifacts:Our primary aim is to test a detector’s ability to identify intrinsic generative artifacts (fgen) that are independent of specific semantic content. • For theBase LabelandRealistic Long-Promptsubsets, the underlying semantic cate- gories are la...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.