Pith. sign in

REVIEW 3 major objections 4 minor 72 references

Frozen-network geometry repairs blind spots in face-forgery detectors

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 14:21 UTC pith:DVC4V4QV

load-bearing objection GLID is a carefully argued, empirically disciplined paper that makes a modest but real improvement on cross-generator face forgery detection, with the caveat that its headline design was chosen on the very benchmark it reports. the 3 major comments →

arxiv 2607.18770 v1 pith:DVC4V4QV submitted 2026-07-21 cs.CR cs.CV

GLID: Gated Local Intrinsic Dimension Repairs the Blind Spots of Face-Forgery Detectors

Guang Yang , Fengchen Liu This is my paper
classification cs.CR cs.CV
keywords face forgery detectionlocal intrinsic dimensionblind axescross-generator generalizationconfidence gatingGAN vs. diffusion artifactstraining-free detectionfine-tuning absorption
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that a frozen vision transformer already contains a signal that covers generator families a fine-tuned detector has never seen: the local intrinsic dimension of a single image's patch-token manifold. It proposes GLID, a score that adds a training-free LID profile through a confidence gate to the detector's logit, and reports 0.805 mean AUC over sixteen axes, lifting generation axes by +0.084 AUC while barely moving reenactment. The design rests on two empirical laws: generated faces bend the token manifold at family-specific depths (GAN artifacts at the deepest block, diffusion artifacts mid-network), and fine-tuning absorbs auxiliary gains exactly where training data covers them. If right, the method gives practitioners a cheap, deterministic way to repair blind spots without retraining.

Core claim

The central discovery is that the manifold geometry of a single image's 256 patch tokens, measured by local intrinsic dimension at several depths of a frozen vision transformer, carries a deterministic, label-free signal that separates GAN and diffusion forgeries from reals. GLID combines this geometry with a fine-tuned detector through the score GLID = z + α*g·w_ℓ·s_ℓ, where the geometric term enters only when the detector is uncertain (gate g = 4p(1−p)) and a single scalar α is calibrated purely in-distribution. The paper claims this yields 0.805 mean AUC on a 16-axis cross-generator benchmark, first among retrained state-of-the-art baselines, never significantly behind the strongest rival

What carries the argument

The load-bearing object is the multi-depth LID profile: for a frozen ViT-L/16, the paper treats the 256 ℓ2-normalized patch tokens at blocks 6, 12, 18, and 23 as a manifold and estimates local intrinsic dimension with the maximum-likelihood estimator on cosine distances, for neighborhood sizes 8, 16, and 32, giving a 12-coordinate per-image vector. The deployable score pools blocks 23 and 12 with a signed sum (s_ℓ), a magnitude weight (w_ℓ), and a confidence gate that opens only where the detector is unsure. The family–depth law is what makes this pooling principled: GAN artifacts peak at the deepest block, diffusion artifacts mid-network, and the direction is stable across backbones and dim

Load-bearing premise

The gate's signed pooling assumes a stable law—GAN artifacts disturb the deepest block, diffusion artifacts the mid-network, with a consistent direction—across every unseen generator family, yet the paper demonstrates the pattern on only two face-generation sources and acknowledges its 256-token LID estimator is biased at small k.

What would settle it

Take a generator family not in the paper (for example, a current latent diffusion model or an atypical GAN architecture) and compute the depth-wise oriented LID AUC on real versus fake faces. If the new family's profile peaks at an unpredicted depth, or the sign of the deep-minus-mid difference inverts relative to the paper's convention, the gated geometric term would push scores in the wrong direction on that axis, falsifying the core repair claim.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Auxiliary signals should be evaluated on axes outside training coverage; the paper's absorption law predicts their gains disappear where data already covers the family.
  • The family–depth signature implies no single best layer exists for forgery detection—the generator family sets the depth, so detectors should read several depths.
  • A label-free geometric signal can be added to a fine-tuned detector at small cost (4.1 ms per image) and cuts per-seed cross-seed spread in accuracy 5.5×.
  • Adding just 1% of target-family training data erases a +0.100 geometric gain, so data is the cheap fix for known families and GLID is the fix for unknown ones.
  • The method is reported to never lose significantly to the strongest retrained baseline on any of the 16 axes, while winning significantly on several generation and reenactment axes.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural extension: measure whether the family–depth signature also holds for newer generator architectures not covered by the paper, and whether the sign convention needs recalibration when it fails.
  • The same absorption law, if general, means negative results for auxiliary signals on covered axes are expected rather than evidence that the signal is useless—a caution for how such methods are compared.
  • Because a generator regularized toward real-face token dimensionality could evade the geometric term, GLID is best deployed as a complement to learned detectors rather than alone.
  • The paper's frame-level protocol leaves temporal cues unused; combining the LID profile with video-level aggregation might lift the currently weak reenactment and lip-sync axes.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes GLID, a face-forgery detector that augments a fine-tuned CLIP-L detector with a training-free local intrinsic dimension (LID) profile computed from the patch tokens of a frozen ViT at four depths and three neighborhood sizes. A confidence gate g=4p(1−p) multiplies a signed, depth-pooled geometric term, and a single scalar α is calibrated using an in-distribution rule that never touches evaluation data. On a 16-axis benchmark, GLID reports 0.805 mean AUC, first among retrained baselines, with a +0.084 AUC gain on generation axes and −0.005 on reenactment. The paper also claims two empirical laws: (1) a family–depth signature (GAN artifacts peak at the deepest ViT block, diffusion artifacts at mid-depth) and (2) an absorption boundary (1% target-family training data erases the geometric gain). The authors report multi-seed training, bootstrap confidence intervals, paired bootstrap tests, a failed preregistered variant, and extensive ablations.

Significance. If the claims hold, GLID is a meaningful contribution: it shows that a frozen vision transformer's token-manifold geometry carries a forgery signal that complements fine-tuned detectors on unseen generation families, and it does so with unusually careful protocol controls — identical crops and schedules for all baselines, multi-seed evaluation, preregistered analysis gates including a reported negative result, per-image score dumps, and a deterministic signal that stabilizes seed variance. The proposed 'absorption boundary' law, if confirmed, has practical value for when to use data versus geometry. However, the magnitude of the claimed blind-spot repair depends on the stability of the family–depth signature across generator families and on design choices that were partly selected using the evaluation benchmark itself.

major comments (3)
  1. [§3.3, Eq. (2); §5.1; Appendix C] The deployable score's block pooling (blocks 23 and 12) and its signed direction convention are selected using the evaluation benchmark. Appendix C reports that this pooling 'gives 0.816 generation and 0.805 overall' and compares it against four-block and single-block alternatives on the same 16 axes. This is selection on test data, which can make the reported +0.084 generation lift and the 'never significantly behind' claim optimistic. Only α is calibrated in-distribution; the pooling choice and sign convention are not. Please provide a validation-based rule for these choices or explicitly report the benchmark as partially used for design, and show the results of all pooling variants as a multiple-testing analysis.
  2. [§3.2, §6.2, §7] Law 1, the family–depth signature that justifies the fixed depth pooling and sign in Eq. (2), rests on exactly one face GAN source (StyleGAN) and one mixed text-to-image diffusion pool. The paper's own limitation statement admits the 'face-domain generation sources are thin.' If an unseen face generator peaks at a different depth, or produces a LID deviation of opposite sign at blocks 23 and 12, the gate would open on blind axes and the injected term would push scores in the wrong direction, turning the +0.084 generation repair into a penalty. The ProGAN non-face and estimator/backbone replications help but do not remove this risk. Please evaluate at least one additional face GAN (e.g., StyleGAN2/3) and one additional diffusion-based face generator to demonstrate that the depth and sign pattern, and hence the single deployable score, generalizes.
  3. [§4, Table 1] The '16-axis cross-generator benchmark' includes two axes, FF-FS and FF-NT, drawn from the same FF++ c23 manipulation families used for training. These are in-distribution axes (with held-out identities but the same manipulation methods), so the overall 0.805 mean AUC and the 'first among retrained baselines' claim are partly driven by easy axes that a detector trained on FF++ c23 already handles. The generation-group repair is the substantively interesting result, but the headline mean should be recomputed excluding FF-FS and FF-NT (or presented separately) to avoid conflating in-distribution and true cross-generator performance.
minor comments (4)
  1. [Abstract; §3.3] The abstract calls the signal '12-dimensional, training-free,' but the deployable score uses only a pooled scalar from blocks 23 and 12. The 12-dimensional profile is the measurement instrument; please clarify this distinction in the abstract or early in Section 3.
  2. [§5, Table 2] The mean AUC difference between GLID (0.805) and Effort (0.790) is reported without a bootstrap CI on the paired mean difference. Given that some per-axis intervals are wide, adding a CI for the overall mean delta would strengthen the 'first among retrained baselines' claim.
  3. [§6.2, Appendix B] The text says 'The GAN profile rises monotonically to the last block,' but Appendix B reports that for EVA-02 on ProGAN and for CLIP on StyleGAN the peak is at 75% depth with the last-block value close behind. Please soften 'monotonically' to reflect the measured variability.
  4. [§5, Table 5] The abstract's phrase 'never significantly behind the strongest of them on any axis' is ambiguous: GLID loses significantly to SBI on T2I and WildDeepfake (Table 5). If 'strongest' means the best overall retrained baseline (Effort), state this explicitly in the abstract to avoid the impression that GLID never loses to any baseline.

Circularity Check

1 steps flagged

Block-pooling design is selected on the same generation axes used to report the +0.084 blind-spot repair; the alpha* calibration itself is clean and there is no self-citation chain.

specific steps
  1. fitted input called prediction [Section 3.2 / Section 5.1 (Block pooling) / Appendix C; Eq. (2)]
    "The deployable score below pools only the deepest and mid blocks, one per family regime; Section 5.1 shows that pooling all four blocks dilutes the direction with near-chance shallow coordinates and lowers accuracy. ... At α∗ this choice gives 0.816 generation and 0.805 overall."

    The composition of the geometry term in Eq. (2) — which blocks to pool (23 and 12) and with what sign — is justified by LID-alone oriented AUC measured on the very evaluation axes that the headline result uses: StyleGAN peaks at the deepest block (0.863) and T2I peaks mid-network (0.892) (Section 3.2, Fig. 3A). The reported +0.084 generation-group lift and 0.805 mean AUC are then measured on those same axes, so the generation repair is an in-sample feature-selection outcome rather than an out-of-sample prediction. The α* selection is genuinely in-distribution and the exact AUC improvement is not directly optimized, so this is partial, not total, circularity.

full rationale

No self-citations appear (references include no work by Yang and Liu), so the self-citation and imported-uniqueness patterns do not apply. There is no algebraic equivalence making Eq. (2) equal to its LID input, and α* is calibrated on training frames only. The main circularity concern is design supervision: the family-depth signature and the block/sign choice for the deployable score are derived from the same StyleGAN/T2I evaluation axes on which the blind-spot repair is claimed. The paper reports these choices transparently and also evaluates on 14 additional axes, giving the overall claim independent content. Still, the central 'generation repair' claim is not a fully held-out prediction, warranting a moderate score of 4 rather than 0. Section 7's limitations about thin face-generation sources and the bias absorbed into direction conventions are robustness caveats, not additional circularity.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

The central claim rests on a small set of modeling assumptions and tuned constants: α is in-distribution calibrated, but the block/direction choices are benchmark-informed, the gate shape is ad hoc, and the family–depth signature is an empirical regularity on limited generation sources.

free parameters (5)
  • α* = 0.1
    Gate strength selected by the in-distribution rule (largest α with in-distribution AUC drop ≤0.002). Calibrated on training frames only, but still a free hyperparameter.
  • Block/depth pooling choice = blocks 23 and 12; k in {8,16,32}
    The deployable score pools only the deepest and mid blocks; Section 5.1 and Appendix C show this choice was validated against all-four-block and single-block alternatives on the benchmark, i.e., model selection informed by evaluation data.
  • Signed direction convention for s_ℓ = sign of standardized block means; direction marked per axis
    The paper 'mark[s] direction failures rather than silently flipping them' and absorbs estimator bias into direction conventions (Section 7), so the injection sign is a data-driven convention.
  • Gate shape g = 4p(1−p)
    Hand-chosen uncertainty heuristic; no derivation from calibrated probabilities. Cross-generator ECE is 0.126 (Section 6.6), so the gate may not be the optimal uncertainty measure on blind axes.
  • Temperature T = 1.75 = 1.75
    Fitted on validation frames for the calibration analysis in Section 6.6; not part of the central GLID score but a tuned constant.
axioms (5)
  • domain assumption The 256 patch tokens of a single image form a sample from a low-dimensional manifold whose LID is well-defined.
    Section 3.1 treats T(b) as a manifold sample; with only 256 tokens this is a strong modeling assumption rather than a theorem.
  • standard math The Levina–Bickel maximum-likelihood estimator gives a meaningful LID value on these token clouds.
    Eq. (1) uses the classical estimator; the paper acknowledges it is biased at small k (Section 7) and absorbs the bias into direction conventions.
  • domain assumption Frozen ViT features preserve generator-specific geometric artifacts that survive standardization and are not destroyed by the fine-tuned detector.
    The whole signal depends on frozen-feature geometry being informative for unseen generator families (Sections 3.2, 6.2).
  • ad hoc to paper The confidence gate g = 4p(1−p) reflects detector uncertainty on blind axes.
    The gate shape is introduced ad hoc (Eq. 2); Section 6.6 shows calibration is substantially worse across the 16 axes (ECE 0.126), so this assumption is only approximately true.
  • domain assumption The family–depth signature (GAN-deep, diffusion-mid) is transferable to unseen generator families.
    Law 1 is established on StyleGAN, one T2I pool, and ProGAN; the deployable score's block pooling depends on this transferring to new families.

pith-pipeline@v1.3.0-alltime-deepseek · 18653 in / 12383 out tokens · 122126 ms · 2026-08-01T14:21:18.538020+00:00 · methodology

0 comments
read the original abstract

Fine-tuned foundation-model detectors dominate face-forgery benchmarks, yet they stay blind to generator families absent from training. We present GLID, a detector that repairs this blind spot with geometry instead of data. GLID treats the patch tokens of a single image as a sample from a manifold and estimates their local intrinsic dimension (LID) at several depths of a frozen vision transformer. This 12-dimensional, training-free signal enters a fine-tuned detector through a confidence gate whose strength is calibrated purely in-distribution. On a 16-axis cross-generator benchmark, GLID reaches 0.805 mean AUC, first among retrained state-of-the-art baselines and never significantly behind the strongest of them on any axis. It lifts the generation axes by +0.084 AUC while moving reenactment by only -0.005. Two empirical laws explain the design. First, forged faces bend the token manifold at family-specific depths: GAN artifacts peak at the last layer, diffusion artifacts peak mid-network, and the pattern survives four backbones, three dimension estimators, and non-face imagery. Second, fine-tuning absorbs auxiliary gains exactly where training data covers: injecting 1% target-family images erases a +0.100 gain, so geometric signals matter precisely where data is unavailable. The deterministic signal also cuts the cross-seed spread of accuracy 5.5x. Code, preregistered analysis gates, and per-image scores accompany the paper.

Figures

Figures reproduced from arXiv: 2607.18770 by Fengchen Liu, Guang Yang.

Figure 1
Figure 1. Figure 1: GLID at a glance. Method (top): a frozen ViT yields a training-free, deterministic LID profile across four depths; a fine-tuned detector yields a logit and a confidence gate g = 4p(1 − p); the gated geometric term joins the always-present base logit as GLID = z + α ∗ g wℓsℓ. Experiments (bottom): train once on FF++ c23, calibrate α ∗ purely in-distribution, evaluate on a frozen 16-axis benchmark with retra… view at source ↗
Figure 2
Figure 2. Figure 2: The GLID signal. (A) A frozen ViT maps the 16 × 16 patches of one face to N=256 tokens; within a single image these tokens form a manifold. The cloud is a PCA view for display only — every distance is measured in the original 1024-D feature space. (B) The Levina–Bickel estimator reads the local intrinsic dimension of that manifold from each token’s k cosine neighbors (rk+1 sets the local boundary; neighbor… view at source ↗
Figure 3
Figure 3. Figure 3: Why several depths, and how the signal enters. (A) Measured LID-alone AUC across depth: diffusion (T2I) peaks mid-network and collapses at the last block, while GANs peak at the last block — StyleGAN faces and ProGAN non-face imagery share the same pattern (§6.2). No single layer covers both families, so GLID measures a multi-depth profile. (B) The profile enters a fine-tuned detector through the confidenc… view at source ↗
Figure 4
Figure 4. Figure 4: Per-axis AUC with 95% bootstrap intervals for the six strongest methods. GLID (blue [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: GLID predictions on unseen-source faces (all correct; [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: (A) Generation–reenactment trade-off as α sweeps; the knee sits near α=0.2, and the in-distribution rule picks α ∗=0.1 without seeing any evaluation axis. α=1 overshoots. (B) The selection rule: largest α with at most a 0.002 in-distribution drop [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: The family–depth signature is estimator-independent. Three intrinsic-dimension estimators [PITH_FULL_IMAGE:figures/full_fig_p008_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: B overlays depth profiles for four backbones on three generation sources. The GAN profile rises monotonically to the last block (StyleGAN faces; ProGAN objects [66, 67]), the diffusion profile peaks at 50–75% and collapses at depth. Three estimators agree ( [PITH_FULL_IMAGE:figures/full_fig_p009_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: PCA of LID profiles (fitted on real faces). GAN and diffusion fakes exit the real cloud along [PITH_FULL_IMAGE:figures/full_fig_p010_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Corruption sweeps for three training-free signals. LID degrades smoothly and never flips [PITH_FULL_IMAGE:figures/full_fig_p011_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: (A) Seed standard deviation on generation axes: detector, detector+LID, and a permuted deterministic control. (B) Mean accuracy against seed spread: only LID moves up and left. 7 Limitations Face-domain generation sources are thin: one GAN corpus and one mixed T2I pool; the cross-domain and cross-estimator checks mitigate but do not remove this. On T2I, self-blending training remains significantly stronge… view at source ↗
Figure 12
Figure 12. Figure 12: (A) Extended success matrix: four examples per source, all correctly scored by GLID. (B) Failure cases: the most confident mistakes per source. Three patterns dominate. (1) Reenactment and lip-sync forgeries that alter a small mouth region leave both the semantic features and the token manifold nearly intact. (2) Strong compression (DFDC-like) flattens the geometric evidence. (3) Occlusions, heavy makeup,… view at source ↗
Figure 13
Figure 13. Figure 13: Gate behavior. (A) The confidence gate opens far more often on blind axes than in￾distribution. (B) Injected term against detector logit on the StyleGAN axis: the injection concentrates where the detector is uncertain and pushes fakes upward. 25 50 75 100 depth (%) StyleGAN T2I ProGAN (non-face) CelebDF FF-NT DINOV3 25 50 75 100 depth (%) DINOV2 25 50 75 100 depth (%) CLIP 25 50 75 100 depth (%) EVA-02 0.… view at source ↗
Figure 14
Figure 14. Figure 14: Depth–axis AUC heatmaps for four backbones. The family–depth signature (GAN deep, [PITH_FULL_IMAGE:figures/full_fig_p020_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Raw SD ϵ-error as a single scorer across the 16 axes. The direction inverts on T2I (values far below 0.5): images from the generator family of the scoring model reconstruct too well. Direction instability, not weak magnitude, is what disqualifies reconstruction scores as deployable single detectors. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_15.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

72 extracted references · 16 linked inside Pith

  1. [1]

    Generative adversarial nets

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. InAdvances in Neural Information Processing Systems, volume 27, 2014

    2014

  2. [2]

    A style-based generator architecture for generative adversarial networks

    Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019

    2019

  3. [3]

    Analyzing and improving the image quality of StyleGAN

    Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of StyleGAN. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020

    2020

  4. [4]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, volume 33, 2020

    2020

  5. [5]

    Diffusion models beat GANs on image synthesis

    Prafulla Dhariwal and Alex Nichol. Diffusion models beat GANs on image synthesis. In Advances in Neural Information Processing Systems, volume 34, 2021

    2021

  6. [6]

    High- resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022

    2022

  7. [7]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. InInterna- tional Conference on Machine Learning, 2021

    2021

  8. [8]

    FaceForensics++: Learning to detect manipulated facial images

    Andreas Rössler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner. FaceForensics++: Learning to detect manipulated facial images. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019

    2019

  9. [9]

    Orthogonal subspace decomposition for generalizable AI-generated image detection

    Zhiyuan Yan, Jiangming Wang, Peng Jin, Ke-Yue Zhang, Chengchun Liu, Shen Chen, Taiping Yao, Shouhong Ding, Baoyuan Wu, and Li Yuan. Orthogonal subspace decomposition for generalizable AI-generated image detection. InInternational Conference on Machine Learning, 2025

    2025

  10. [10]

    Towards universal fake image detectors that generalize across generative models

    Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023

    2023

  11. [11]

    Elizaveta Levina and Peter J. Bickel. Maximum likelihood estimation of intrinsic dimension. In Advances in Neural Information Processing Systems, volume 17, 2004

    2004

  12. [12]

    When detectors forget forensics: Blocking semantic shortcuts for generalizable AI-generated image detection.arXiv preprint arXiv:2603.09242, 2026

    Chao Shuai, Shaojing Fan, Chenlin Zou, Bin Gong, Weichen Lian, Xiuli Bi, Zhenguang Liu, Zhongjie Ba, and Kui Ren. When detectors forget forensics: Blocking semantic shortcuts for generalizable AI-generated image detection.arXiv preprint arXiv:2603.09242, 2026

    Pith/arXiv arXiv 2026

  13. [13]

    V o, Maximilian Seitzer, Federico Baldassarre, Maxime Oquab, Cijo Jose, Vasil Khalidov, Marc Szafraniec, et al

    Oriane Siméoni, Huy V . V o, Maximilian Seitzer, Federico Baldassarre, Maxime Oquab, Cijo Jose, Vasil Khalidov, Marc Szafraniec, et al. DINOv3.arXiv preprint arXiv:2508.10104, 2025

    Pith/arXiv arXiv 2025

  14. [14]

    MesoNet: A compact facial video forgery detection network

    Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. MesoNet: A compact facial video forgery detection network. InIEEE International Workshop on Information Forensics and Security (WIFS), 2018

    2018

  15. [15]

    Thinking in frequency: Face forgery detection by mining frequency-aware clues

    Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-aware clues. InEuropean Conference on Computer Vision (ECCV), 2020. 12

    2020

  16. [16]

    Spatial-phase shallow learning: Rethinking face forgery detection in fre- quency domain

    Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial-phase shallow learning: Rethinking face forgery detection in fre- quency domain. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021

    2021

  17. [17]

    Face X-ray for more general face forgery detection

    Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo. Face X-ray for more general face forgery detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020

    2020

  18. [18]

    What makes fake images detectable? Understanding properties that generalize

    Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? Understanding properties that generalize. InEuropean Conference on Computer Vision (ECCV), 2020

    2020

  19. [19]

    Leveraging representations from intermediate encoder-blocks for synthetic image detection

    Christos Koutlis and Symeon Papadopoulos. Leveraging representations from intermediate encoder-blocks for synthetic image detection. InEuropean Conference on Computer Vision (ECCV), 2024

    2024

  20. [20]

    Detecting deepfakes with self-blended images

    Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022

    2022

  21. [21]

    Lips don’t lie: A generalisable and robust approach to face forgery detection

    Alexandros Haliassos, Konstantinos V ougioukas, Stavros Petridis, and Maja Pantic. Lips don’t lie: A generalisable and robust approach to face forgery detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021

    2021

  22. [22]

    Exploring temporal coherence for more general video face forgery detection

    Yinglin Zheng, Jianmin Bao, Dong Chen, Ming Zeng, and Fang Wen. Exploring temporal coherence for more general video face forgery detection. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021

    2021

  23. [23]

    Leveraging real talking faces via self-supervision for robust forgery detection

    Alexandros Haliassos, Rodrigo Mira, Stavros Petridis, and Maja Pantic. Leveraging real talking faces via self-supervision for robust forgery detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022

    2022

  24. [24]

    Rethinking the up-sampling operations in CNN-based generative network for generalizable deepfake detection

    Chuangchuang Tan, Huan Liu, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up-sampling operations in CNN-based generative network for generalizable deepfake detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024

    2024

  25. [25]

    DIRE for diffusion-generated image detection

    Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. DIRE for diffusion-generated image detection. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023

    2023

  26. [26]

    Exposing the fake: Effective diffusion-generated images detection.arXiv preprint arXiv:2307.06272, 2023

    Ruipeng Ma, Jinhao Duan, Fei Kong, Xiaoshuang Shi, and Kaidi Xu. Exposing the fake: Effective diffusion-generated images detection.arXiv preprint arXiv:2307.06272, 2023

    Pith/arXiv arXiv 2023

  27. [27]

    LaRE 2: Latent reconstruction error based method for diffusion-generated image detection

    Yunpeng Luo, Junlong Du, Ke Yan, and Shouhong Ding. LaRE 2: Latent reconstruction error based method for diffusion-generated image detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024

    2024

  28. [28]

    AEROBLADE: Training-free detection of latent diffusion images using autoencoder reconstruction error

    Jonas Ricker, Denis Lukovnikov, and Asja Fischer. AEROBLADE: Training-free detection of latent diffusion images using autoencoder reconstruction error. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024

    2024

  29. [29]

    RIGID: A training-free and model-agnostic framework for robust AI-generated image detection.arXiv preprint arXiv:2405.20112, 2024

    Zhiyuan He, Pin-Yu Chen, and Tsung-Yi Ho. RIGID: A training-free and model-agnostic framework for robust AI-generated image detection.arXiv preprint arXiv:2405.20112, 2024

    Pith/arXiv arXiv 2024

  30. [30]

    Un- derstanding and improving training-free AI-generated image detections with vision foundation models.arXiv preprint arXiv:2411.19117, 2024

    Chung-Ting Tsai, Ching-Yun Ko, I-Hsin Chung, Yu-Chiang Frank Wang, and Pin-Yu Chen. Un- derstanding and improving training-free AI-generated image detections with vision foundation models.arXiv preprint arXiv:2411.19117, 2024

    Pith/arXiv arXiv 2024

  31. [31]

    Manifold induced biases for zero-shot and few-shot detection of generated images

    Jonathan Brokman, Amit Giloni, Omer Hofman, Roman Vainshtein, Hisashi Kojima, and Guy Gilboa. Manifold induced biases for zero-shot and few-shot detection of generated images. In International Conference on Learning Representations, 2025. 13

    2025

  32. [32]

    Dimensional coactivation for representational consistency in frozen vision foundation models.arXiv preprint arXiv:2605.08249, 2026

    Izaldein Al-Zyoud and Abdulmotaleb El Saddik. Dimensional coactivation for representational consistency in frozen vision foundation models.arXiv preprint arXiv:2605.08249, 2026

    Pith/arXiv arXiv 2026

  33. [33]

    SPLIT: Training-free AI-generated and partially edited video detection via spatial patch-level incoherence and temporal roughness.arXiv preprint arXiv:2607.02886, 2026

    Jongyeop Hyun and Hyounghun Kim. SPLIT: Training-free AI-generated and partially edited video detection via spatial patch-level incoherence and temporal roughness.arXiv preprint arXiv:2607.02886, 2026

    Pith/arXiv arXiv 2026

  34. [34]

    Rethinking cross-generator image forgery detection through DINOv3.arXiv preprint arXiv:2511.22471, 2025

    Zhenglin Huang, Jason Li, Haiquan Wen, Tianxiao Li, Xi Yang, Lu Qi, Bei Peng, Xiaowei Huang, Ming-Hsuan Yang, and Guangliang Cheng. Rethinking cross-generator image forgery detection through DINOv3.arXiv preprint arXiv:2511.22471, 2025

    arXiv 2025

  35. [35]

    How fragile are training-free AI-generated image detec- tors? A controlled audit of score direction, preprocessing, and compression.arXiv preprint arXiv:2606.20488, 2026

    Jingwen Zhou and Mingzhe Wang. How fragile are training-free AI-generated image detec- tors? A controlled audit of score direction, preprocessing, and compression.arXiv preprint arXiv:2606.20488, 2026

    Pith/arXiv arXiv 2026

  36. [36]

    Estimating the intrinsic dimension of datasets by a minimal neighborhood information.Scientific Reports, 7:12140, 2017

    Elena Facco, Maria d’Errico, Alex Rodriguez, and Alessandro Laio. Estimating the intrinsic dimension of datasets by a minimal neighborhood information.Scientific Reports, 7:12140, 2017

    2017

  37. [37]

    Houle, Ken-ichi Kawarabayashi, Miloš Radovanovi´c, and Weeris Treeratanajaru

    Laurent Amsaleg, Oussama Chelly, Michael E. Houle, Ken-ichi Kawarabayashi, Miloš Radovanovi´c, and Weeris Treeratanajaru. Intrinsic dimensionality estimation within tight localities: A theoretical and experimental analysis.arXiv preprint arXiv:2209.14475, 2022

    Pith/arXiv arXiv 2022

  38. [38]

    Macke, and Davide Zoccolan

    Alessio Ansuini, Alessandro Laio, Jakob H. Macke, and Davide Zoccolan. Intrinsic dimension of data representations in deep neural networks. InAdvances in Neural Information Processing Systems, volume 32, 2019

    2019

  39. [39]

    The intrinsic dimension of images and its impact on learning

    Phillip Pope, Chen Zhu, Ahmed Abdelkader, Micah Goldblum, and Tom Goldstein. The intrinsic dimension of images and its impact on learning. InInternational Conference on Learning Representations, 2021

    2021

  40. [40]

    Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E

    Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. InInternational Conference on Learning Representations, 2018

    2018

  41. [41]

    Unfolding local growth rate estimates for (almost) perfect adversarial detection.arXiv preprint arXiv:2212.06776, 2022

    Peter Lorenz, Margret Keuper, and Janis Keuper. Unfolding local growth rate estimates for (almost) perfect adversarial detection.arXiv preprint arXiv:2212.06776, 2022

    Pith/arXiv arXiv 2022

  42. [42]

    Intrinsic dimension estimation for robust detection of AI-generated texts

    Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavskii, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of AI-generated texts. InAdvances in Neural Information Processing Systems, volume 36, 2023

    2023

  43. [43]

    Durall, and Janis Keuper

    Peter Lorenz, Ricard L. Durall, and Janis Keuper. Detecting images generated by deep diffusion models using their local intrinsic dimensionality.arXiv preprint arXiv:2307.02347, 2023. Retracted by the authors

    Pith/arXiv arXiv 2023

  44. [44]

    Generative image inpainting with submanifold alignment

    Ang Li, Jianzhong Qi, Rui Zhang, Xingjun Ma, and Kotagiri Ramamohanarao. Generative image inpainting with submanifold alignment. InProceedings of the 28th International Joint Conference on Artificial Intelligence (IJCAI), 2019

    2019

  45. [45]

    Rethinking the use of vision transformers for AI-generated image detection.arXiv preprint arXiv:2512.04969, 2025

    NaHyeon Park, Kunhee Kim, Junsuk Choe, and Hyunjung Shim. Rethinking the use of vision transformers for AI-generated image detection.arXiv preprint arXiv:2512.04969, 2025

    arXiv 2025

  46. [46]

    Intermediate representations are strong AI-generated image detectors.arXiv preprint arXiv:2605.04358, 2026

    Zhenhan Huang, Pin-Yu Chen, Tejaswini Pedapati, and Jianxi Gao. Intermediate representations are strong AI-generated image detectors.arXiv preprint arXiv:2605.04358, 2026

    Pith/arXiv arXiv 2026

  47. [47]

    When semantics regulate: Rethinking patch shuffle and internal bias for generated image detection with CLIP.arXiv preprint arXiv:2511.19126, 2025

    Beilin Chu, Weike You, Mengtao Li, Tingting Zheng, Kehan Zhao, Xuan Xu, Zhigao Lu, Jia Song, Moxuan Xu, and Linna Zhou. When semantics regulate: Rethinking patch shuffle and internal bias for generated image detection with CLIP.arXiv preprint arXiv:2511.19126, 2025

    arXiv 2025

  48. [48]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. InInternational Conference on Learning Representations, 2021. 14

    2021

  49. [49]

    YuNet: A tiny millisecond-level face detector.Machine Intelligence Research, 20(5):656–665, 2023

    Wei Wu, Hanyang Peng, and Shiqi Yu. YuNet: A tiny millisecond-level face detector.Machine Intelligence Research, 20(5):656–665, 2023

    2023

  50. [50]

    SDXL: Improving latent diffusion models for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023

    Pith/arXiv arXiv 2023

  51. [51]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. InProceedings of the IEEE International Conference on Computer Vision (ICCV), 2015

    2015

  52. [52]

    Celeb-DF: A large-scale challeng- ing dataset for DeepFake forensics

    Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-DF: A large-scale challeng- ing dataset for DeepFake forensics. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020

    2020

  53. [53]

    DF40: Toward next-generation deepfake detection

    Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Chengjie Wang, Shouhong Ding, Yunsheng Wu, and Li Yuan. DF40: Toward next-generation deepfake detection. InAdvances in Neural Information Processing Systems, volume 37, 2024

    2024

  54. [54]

    SimSwap: An efficient framework for high fidelity face swapping

    Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge. SimSwap: An efficient framework for high fidelity face swapping. InProceedings of the 28th ACM International Conference on Multimedia, 2020

    2020

  55. [55]

    BlendFace: Re-designing identity encoders for face-swapping

    Kaede Shiohara, Xingchao Yang, and Takafumi Taketomi. BlendFace: Re-designing identity encoders for face-swapping. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023

    2023

  56. [56]

    First order motion model for image animation

    Aliaksandr Siarohin, Stéphane Lathuilière, Sergey Tulyakov, Elisa Ricci, and Nicu Sebe. First order motion model for image animation. InAdvances in Neural Information Processing Systems, volume 32, 2019

    2019

  57. [57]

    SadTalker: Learning realistic 3D motion coefficients for stylized audio-driven single image talking face animation

    Wenxuan Zhang, Xiaodong Cun, Xuan Wang, Yong Zhang, Xi Shen, Yu Guo, Ying Shan, and Fei Wang. SadTalker: Learning realistic 3D motion coefficients for stylized audio-driven single image talking face animation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023

    2023

  58. [58]

    K. R. Prajwal, Rudrabha Mukhopadhyay, Vinay P. Namboodiri, and C. V . Jawahar. A lip sync expert is all you need for speech to lip generation in the wild. InProceedings of the 28th ACM International Conference on Multimedia, 2020

    2020

  59. [59]

    Thin-plate spline motion model for image animation

    Jian Zhao and Hui Zhang. Thin-plate spline motion model for image animation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022

    2022

  60. [60]

    The DeepFake detection challenge (DFDC) dataset.arXiv preprint arXiv:2006.07397, 2020

    Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer. The DeepFake detection challenge (DFDC) dataset.arXiv preprint arXiv:2006.07397, 2020

    Pith/arXiv arXiv 2006

  61. [61]

    WildDeepfake: A challenging real-world dataset for deepfake detection

    Bojia Zi, Minghao Chang, Jingjing Chen, Xingjun Ma, and Yu-Gang Jiang. WildDeepfake: A challenging real-world dataset for deepfake detection. InProceedings of the 28th ACM International Conference on Multimedia, 2020

    2020

  62. [62]

    V o, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, et al

    Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy V . V o, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, et al. DINOv2: Learning robust visual features without supervision.Transactions on Machine Learning Research, 2024

    2024

  63. [63]

    EV A-02: A visual representation for Neon Genesis.arXiv preprint arXiv:2303.11331, 2023

    Yuxin Fang, Quan Sun, Xinggang Wang, Tiejun Huang, Xinlong Wang, and Yue Cao. EV A-02: A visual representation for Neon Genesis.arXiv preprint arXiv:2303.11331, 2023

    Pith/arXiv arXiv 2023

  64. [64]

    Fine-tuning can distort pretrained features and underperform out-of-distribution

    Ananya Kumar, Aditi Raghunathan, Robbie Jones, Tengyu Ma, and Percy Liang. Fine-tuning can distort pretrained features and underperform out-of-distribution. InInternational Conference on Learning Representations, 2022

    2022

  65. [65]

    Gradient starvation: A learning proclivity in neural networks

    Mohammad Pezeshki, Sékou-Oumar Kaba, Yoshua Bengio, Aaron Courville, Doina Precup, and Guillaume Lajoie. Gradient starvation: A learning proclivity in neural networks. InAdvances in Neural Information Processing Systems, volume 34, 2021. 15

    2021

  66. [66]

    Progressive growing of GANs for improved quality, stability, and variation

    Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of GANs for improved quality, stability, and variation. InInternational Conference on Learning Representa- tions, 2018

    2018

  67. [67]

    Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. CNN- generated images are surprisingly easy to spot... for now. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020

    2020

  68. [68]

    On the stability of fine- tuning BERT: Misconceptions, explanations, and strong baselines

    Marius Mosbach, Maksym Andriushchenko, and Dietrich Klakow. On the stability of fine- tuning BERT: Misconceptions, explanations, and strong baselines. InInternational Conference on Learning Representations, 2021

    2021

  69. [69]

    torch.manual_seed(3407) is all you need: On the influence of random seeds in deep learning architectures for computer vision.arXiv preprint arXiv:2109.08203, 2021

    David Picard. torch.manual_seed(3407) is all you need: On the influence of random seeds in deep learning architectures for computer vision.arXiv preprint arXiv:2109.08203, 2021

    Pith/arXiv arXiv 2021

  70. [70]

    Weinberger

    Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. InInternational Conference on Machine Learning, 2017

    2017

  71. [71]

    Reti- naFace: Single-stage dense face localisation in the wild

    Jiankang Deng, Jia Guo, Yuxiang Zhou, Jinke Yu, Irene Kotsia, and Stefanos Zafeiriou. Reti- naFace: Single-stage dense face localisation in the wild. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020

    2020

  72. [72]

    General facial representation learning in a visual- linguistic manner

    Yinglin Zheng, Hao Yang, Ting Zhang, Jianmin Bao, Dongdong Chen, Yangyu Huang, Lu Yuan, Dong Chen, Ming Zeng, and Fang Wen. General facial representation learning in a visual- linguistic manner. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 16 A Success and failure cases real p=0.17 Real (FF++) fake p=0....

    2022