Pith. sign in

REVIEW 3 major objections 3 minor 69 references

Explaining AI-Image Detection: What the Heatmap Actually Shows

T0 review · 3 major / 3 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that naive AI-image detection scores are mostly compression-format detection, that only a symmetric final encode removes that shortcut, and that whether an attribution heatmap beats a trivial control depends on the detector

desk verdict The detection-side story is strong and worth engaging; the explanation-side positive localisation claim rests on a mask set that fails its own spec, but the negative result is robust. read the letter →

arxiv 2607.29581 v1 pith:DH2YWXNB submitted 2026-07-31 cs.CV

Leonid Kuturin , Ilya Sotnikov , Mark Khusnutdinov , Mikhail Potemkin , Pavel Baranas , Aleksandra Korepanova , Alexander Kalashnikov This is my paper
classification cs.CV
keywords AI-imagedetectioncompression-historyshortcutdatasetbiasattributionmapsheatmapevaluationcausalcontrolsproduct-disjointsplitmarketplacereviewphotos
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Across 186,527 marketplace review photos, the paper shows that a detector trained on data as collected can report 0.9999 PR-AUC while reading nothing but file format: real photos arrive as WebP and synthetic ones as JPEG. Re-encoding the synthetic class to the real class's format drops the score to 0.7254, and re-encoding only one class moves the cue rather than removing it, so native fakes receive a median probability of synthesis of 0.0004. Putting both classes through one identical final encode repairs the shortcut, and a three-seed factorial credits the encoding change with the whole gain (+0.176 ± 0.009 PR-AUC), with no contribution from dropping the hand-designed forensic features. On the explanation side, the paper tests seventeen attribution maps causally against controls that never consult the detector; no map separates from random when the detector is saturated, twelve of seventeen do on the selected detector, and perturbation methods lead while no gradient-CAM variant shows a positive advantage. The paper concludes that clearing a detector-blind control is not yet a faithful explanation, and that its own recommended map is a localiser, not an explanation.

What carries the argument

The load-bearing objects are the three compression axes — asymmetric (synthetics re-encoded into the real class's format), symmetric (both classes through one identical final WebP encode), and native (files as users upload them) — read off a product-disjoint split of 186,527 images. The mechanism carrying the argument is a factorial over encoding and forensic features that isolates the active fix, plus a causal protocol for explanations: a map counts only if deleting the region it highlights moves the detector's logit more than deleting what the best trivial control (random, centre, or edge) highlights, with a cluster-bootstrap lower bound above zero. Everything that follows is measured agai

What would settle it

Rebuild the localisation mask set to the paper's own specification — lossless storage, verified held-out provenance of originals, and masks for requested, applied, and actually-realised edits — then re-measure region_ensemble against the centre prior on the small-edit bucket, where the paper reports +0.098 [0.026, 0.169] over the prior. If that advantage collapses to zero or the ordering flips, the localisation claim is an artefact of the leaky gpt masks rather than a property of the method. A second check: train the same detector recipe on a different marketplace corpus; if the symmetric-enco

Watch

Extended reading notes

Core claim

The central discovery is that compression history, not synthesis, drives naive evaluation, and that the only effective repair is to apply one identical final encode to both classes. The strongest model reaches 0.9999 PR-AUC on a product-disjoint split, falls to 0.7254 after re-encoding synthetics into the real class's format, and a three-seed factorial attributes the entire recovery (+0.176 ± 0.009 PR-AUC) to the symmetric encoding alone; hand-crafted forensic features contribute nothing on average and leave a residual channel that separates classes at 0.7145 against a 0.254 base rate. On attribution, the paper establishes that whether any map beats a random control is a property of the dete

Load-bearing premise

The localisation results depend on the 368 reference masks marking the regions the editing tools actually changed; the paper itself measures that these masks leak heavily for the dominant generator family (gpt triples leak a median 34.5% of actually-changed pixels outside the mask), so if the masks do not track the real edits, the pixel-AP rankings could reorder.

Editorial extensions

If this is right

  • Product-disjoint splits are not a defence against file-provenance shortcuts; evaluators must also align or report the compression history of both classes.
  • Symmetric final encoding is the effective repair for the format channel, and gains from it should be credited to the encoding change rather than to accompanying architectural choices.
  • Attribution rankings are detector-conditional: a method that fails on a saturated detector can pass on a responsive one, so explanation evaluation should state which bundle the maps were measured on.
  • Trivial controls that never consult the detector are the bar; on fully generated images the centre prior is worse than random, so methods should be scored against the best control per axis.
  • The serving map is offered as a localiser, not an explanation, and empty maps on real photos are an honest answer.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If compression-history shortcuts are as dominant as the paper suggests, existing public detection benchmarks that store classes in different formats likely overstate field performance; re-scoring them under a symmetric encode would test that directly.
  • The centre prior's win on large edits indicates that any learned localiser trained on centre-biased masks will inherit that bias; rebuilding the mask set with verified, lossless intervention masks — the paper's own future work — is a prerequisite for trusting pixel-AP rankings.
  • The detector-dependence of attribution rankings implies that explanation methods for a given detector must be re-validated whenever the detector is updated, since a map that clears the control on one bundle may fail on the next.
  • A practical extension: serve the detector's verdict alongside a sparsified regional map only when the detector fires; the paper's data implies that on frames the detector calls real, maps are near-empty by construction.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper studies detection of fully AI-generated and locally edited images in marketplace review photos, and evaluates whether post-hoc attribution maps can serve as evidence. Stage 1 builds a detector on 186,527 images with a product-disjoint split, reporting 0.9999 PR-AUC on the corpus as collected, which collapses to 0.7254 after re-encoding the synthetic class into the real class's WebP format; five public detectors move by at most 0.07 under the same re-encoding. A first asymmetric repair relocates the shortcut rather than removing it (native fakes receive median P(fake)=0.0004). A three-seed 2×2 factorial attributes the gain to a symmetric final encode for both classes (+0.176±0.009 PR-AUC), with no main effect from dropping forensic features. Stage 2 defines explanation success as beating detector-blind controls under causal deletion with cluster-bootstrapped intervals, and reports detector-conditional results: on the first-fix detector no map beats random; on the selected detector 12/17 maps beat random on the edits axis and 8/17 on the generation axis, with perturbation methods leading and no gradient-CAM variant showing a positive advantage. The paper's regional ensemble takes the top pixel-AP point estimate, is level with the center prior, and the authors explicitly state they demonstrate no faithful explanation.

Significance. If the claims hold, the paper is a valuable measurement contribution. It shows that a product-disjoint split does not protect against file-provenance shortcuts, that one-sided repair relocates the cue, and that attribution rankings can be a property of the detector rather than of the method. The evaluation is unusually disciplined: external public-detector controls, a completed factorial with pooled standard errors, pre-registered zeros for invalid maps and detector misses, scene-clustered bootstrap intervals, a full provenance table, and repeated statements of what the paper does not show. The decision to treat 'beats a detector-blind control' as necessary but not sufficient is the right bar, and the reporting of failures (e.g., RISE on 5 valid maps, chefer_relevance producing blank maps) is exemplary. The central detector-side claims are well supported. The explanation-side positive localisation claims, however, rest on a mask anchor that the authors themselves audit as defective for the dominant generator, which is why the paper needs a targeted revision rather than acceptance as is.

major comments (3)
  1. [Sec. 4.4, Tab. 2] The only localisation result in which a real method beats the strongest trivial control is the small-bucket advantage of region_ensemble over the center prior: +0.098 [+0.026, +0.169] (scene-clustered). This bucket is 78/101 gpt triples, and the gpt masks have 34.5% median realized-change leakage outside the requested mask; in 37 triples more realized change lies outside than inside. Pixel AP against M_requested rewards a map for tracking the region the tool was asked to change, not necessarily the region the detector actually responds to. Since the realized-change masks are computable from the image pairs and the paper already ships audit scripts, please re-score the localisation metrics against M_realized, or at minimum report a sensitivity analysis that excludes or reweights the gpt triples. Without this, the paper's positive localisation claim and the recommendation to ship region_en
  2. [Sec. 4.4, Tab. 2] The 'top pixel AP' claim for region_ensemble is a selected maximum: the paper states that the chronology matters because point estimates chose the method, but it does not address selection bias or multiplicity across the 17 maps. The point estimate 0.466 [0.425, 0.506] overlaps the center control's 0.462 [0.420, 0.504] almost entirely, so the ranking is fragile. Please provide a selection-aware analysis (e.g., a holdout or split-half selection step), or weaken the summary claim to 'level with the center prior' rather than 'takes the top pixel AP'.
  3. [Sec. 3.4, Tab. 1] The factorial is well executed, but the interaction is estimated from three seeds per cell and the paper reads its sign and order of magnitude only. That is appropriate. However, the simple-effect interpretation ('forensic branch costs 0.036 while the shortcut is open and buys 0.036 once both classes pass the same final encode') is presented as if it resolves the role of the forensic features, while the feature-channel probe (Tab. A4) shows only +0.0009 validation PR-AUC from adding forensics to the visual branch on the symmetric corpus. The apparent tension between +0.036 native-test simple effect and +0.0009 validation effect is not discussed. Please clarify whether this reflects the native-versus-validation axis, the different head fits, or another source.
minor comments (3)
  1. [Sec. 4.4] The small-bucket counts differ across runs: the 368-mask release has 101 small triples (78 gpt), while the unified run on the selected detector has 58 small frames. The text should state both numbers and which run each bucket claim comes from, to avoid confusion.
  2. [App. M] The provenance table is commendable, but the reproducibility caveat is important: raw per-run artefacts live in the cluster store, so a reader can verify the procedure but not re-derive a specific number. Please state this limitation in the main text, not only in the appendix.
  3. [Sec. 4.3] The sentence 'The controls that never consult the detector never clear it either' is slightly ambiguous: the edge control has a positive point estimate on the edits axis (+0.015) but its interval includes zero. Consider rewording to 'no trivial control clears the random control with an interval excluding zero'.

Circularity Check

1 steps flagged · score 2.0 of 10

No derivation-level circularity; one disclosed evaluator/method circularity (occlusion vs blur AOPC) is controlled by a mean-replacement run.

  1. self definitional [Appendix E, 'Acknowledged protocol weakness'; cf. Sec. 4.3]
    "The protocol has one weakness we state in advance. The only replacement strategy is blur, and occlusion is itself built on blur. This circularity gives the perturbation family an advantage. We report a control run with mean replacement in Sec. I, and it reverses the sign of the region family's advantage."

    AOPC faithfulness is measured by blurring ranked regions and recording logit drops, while occlusion's relevance is exactly the logit drop when that patch is blurred. Thus occlusion's top-ranked regions are the regions that maximise the evaluator's own quantity, so its AOPC advantage over random is partly an artefact of using the same perturbation operator for both method and metric. The paper discloses this and shows with mean replacement that the region family's advantage reverses sign, which converts the circularity into a protocol-dependence caveat; the quoted step remains a same-operator evaluation.

full rationale

This is a measurement paper rather than a derivation. The detector result is obtained by training on a product-disjoint split and reading held-out test files, with external public-detector controls and the native-file axis serving as independent checks; the repair claim is isolated by a 2x2 factorial over measured cell means, not by a fitted parameter renamed as a prediction. The explanation-side claims are benchmarked against detector-blind trivial controls (random, center, edge) with bootstrap intervals, and the central negative statement ('we demonstrate no faithful explanation') is not forced by the method definitions. There is no load-bearing self-citation chain or imported uniqueness theorem; the cited prior work on format bias and explanation fragility is external and independently established. The one genuinely circular element is the faithfulness evaluation using blur replacement when occlusion itself is built on blur, which the paper explicitly acknowledges and then bounds with a mean-replacement control. The mask-set audit (leakage, unconfirmed provenance) is a data-quality weakness in the localisation anchor that could reorder point estimates, but it does not make the evaluation definitionally circular. Overall score 2: no significant circularity in the central derivation, with one disclosed and controlled evaluator/method confound.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

The reader pays for: the assumed validity of counterfactual deletion as a faithfulness test, the assumed usability of the reference masks as a localisation anchor (the mask set admits it fails its own spec), the frozen-backbone training choice (argued, not measured), and validation-fitted calibration/threshold/class-weight hyperparameters. No new physical or formal entities are introduced: region_ensemble, pool_* and the trivial controls are methods or control procedures, not entities.

free parameters (6)
  • Positive-class weight pos_weight = 3.2 (retuned from 6.0 after balance shift)
    Validation-tuned MLP-head hyperparameter (Sec. 3.2, App. B). Affects all thresholds and decision-rate numbers.
  • Platt calibration (one logistic rescaling) = fitted on validation
    All calibrated P(fake) values (e.g. median 0.0004, 0.9999) depend on this fit (Sec. 3.2, App. D).
  • Decision threshold = 0.6443 (selected bundle)
    Chosen on validation only; every 'caught at validation threshold' rate (24.7%, 68.6%) depends on it (Tab. A19).
  • region_ensemble display parameters = 48 SLIC segments; quantile-0.80 background floor
    Hand-chosen for the shipped map; the floor costs 0.486→0.434 pixel AP and roughly doubles relevance mass (Sec. 4.4, Tab. A14).
  • Generator sampling weights = w ∝ 10^(elo/400)/cost^0.684, ~$0.038 per image
    Calibrated to a generation budget; shapes the synthetic class composition (App. B, Tab. A1).
  • Curation gates = CLIP QC 0.65/0.75, max product 0.35; face threshold 0.5
    Chosen thresholds that filter the real class before collection (App. B).
assumptions (6)
  • domain assumption Deleting (or blur-replacing) the highlighted region measures what the detector responds to
    Core of the causal faithfulness test (Sec. 4.1). The paper itself flags that deletion leaves the data distribution (refs 14,15) and that blur is the only replacement strategy, which circularly advantages occlusion (App. E).
  • domain assumption Reference masks mark the region the editing tool was asked to change and are a usable localisation target
    Anchor for all pixel-AP/RMA/pointing claims (Sec. 4.1). Violated in places: App. L reports 15 strict-composition violations, median 17.5% leakage outside masks, bimodal by generator (gpt 34.5%).
  • domain assumption A frozen backbone with a light head is the right training regime for this data
    Sec. 3.2 argues rather than measures: 13,350 synthetic images do not constrain a large ViT. No end-to-end fine-tuning was run, so the alternative is unbounded by measurement.
  • standard math Product-disjoint splitting prevents content leakage
    Split geometry in App. B: StratifiedGroupKFold(5), group intersection raised on non-zero overlap, verified by code.
  • standard math Bootstrap resampling and ±1/2 factorial contrasts give valid inference at 3 seeds per cell
    Intervals are 2000-resample cluster bootstraps over scenes (Sec. 4.1); the paper itself notes 3 seeds estimate the interaction poorly (Sec. 3.4).
  • domain assumption Forensic features (32 FFT radial bins + 12 SRM statistics) sense compression history, and switching them off treats the format shortcut
    Premise behind the 'visual-only' cell of the factorial and the residual-channel probe (Sec. 3.2, Sec. 3.5).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Explaining AI-Image Detection: What the Heatmap Actually Shows." pith.science (2026). https://pith.science/paper/DH2YWXNB

@misc{pith2026260729581,
  author       = {Pith},
  title        = {Pith review of: Explaining AI-Image Detection: What the Heatmap Actually Shows},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DH2YWXNB}},
  note         = {Machine review of arXiv:2607.29581}
}
read the original abstract

A marketplace review photograph is a document: platforms approve refunds on it, and generative models drove the cost of forging one to zero. We study that detection problem, so we build a detector and attach an attribution map as its evidence, then measure what that pair delivers on 186,527 images under controls designed to change our conclusions when something is wrong. Compression history, not synthesis, drives naive evaluation: our strongest model reaches 0.9999 PR-AUC (area under the precision-recall curve) on a product-disjoint split, yet falls to 0.7254 once we re-encode synthetics into the real class's format, while five public detectors move by at most 0.07. Aligning one class relocates the cue rather than removing it, and the repaired model then assigns native files a median probability of synthesis of 0.0004. One identical final encode for both classes repairs that, and a three-seed factorial credits the encoding change with the whole gain (+0.176 +- 0.009 PR-AUC). That encode equalises the last stage only: forensic features alone still separate the classes at 0.7145 against a base rate of 0.254. For evidence we test maps causally, against controls that never consult the detector. Whether an attribution ranking exists at all depends on whether the detector reacts to the image. On our first-fix detector, which calls 96 of 100 edited frames real, no map beats a random one. On the detector we selected, twelve of seventeen maps clear that control on edited images and eight on generated ones; perturbation leads both axes and no gradient-CAM variant shows a positive advantage. The trivial controls never clear it, and on generated images the centre prior is worse than random. Our ensembled regional map clears both axes and takes the top pixel AP at 12.4 s per map against 44.9 for occlusion. Clearing a detector-blind control is not yet a faithful explanation, and we demonstrate none.

Figures

Figures reproduced from arXiv: 2607.29581 by the authors.

Figure 1
Figure 1. A marketplace review photo with a local AI edit. The outline is the region the editing tool was asked to change. Middle: region_ensemble, the map we selected, puts its relevance on the edited object. Right: the center prior never consults the detector and misses here, yet priors like it win pooled localisation metrics on centre-biased benchmarks. Chips: P(fake), the detector’s probabil￾ity of synthesis for the photo… view at source ↗
Figure 2
Figure 2. One bundle, one run, two metrics: the detector we selected, trained on symmetric webp2 data with the forensic features on. (a) Seventeen maps on the same 200 locally edited frames. Across: AOPC advantage over the random map, the causal test. Up: pixel AP against the reference edit mask, overlap. Both carry 95% cluster-bootstrap intervals, and a horizontal interval is heavy when it clears zero, which twelve do. The d… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

69 extracted references · 2 linked inside Pith

  1. [1]

    Cnn-generated images are surprisingly easy to spot... for now,

    S.-Y . Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros, “Cnn-generated images are surprisingly easy to spot... for now,” inCVPR, 2020

    2020

  2. [2]

    Towards universal fake image detectors that generalize across generative models,

    U. Ojha, Y . Li, and Y . J. Lee, “Towards universal fake image detectors that generalize across generative models,” inCVPR, 2023

    2023

  3. [3]

    On the detection of synthetic images gen- erated by diffusion models,

    R. Corvi, D. Cozzolino, G. Zingarini, G. Poggi, K. Nagano, and L. Verdoliva, “On the detection of synthetic images gen- erated by diffusion models,” inIEEE ICASSP, 2023

    2023

  4. [4]

    Fake or jpeg? revealing common biases in generated image detection datasets,

    P. Grommelt, L. Weiss, F.-J. Pfreundt, and J. Keuper, “Fake or jpeg? revealing common biases in generated image detection datasets,” 2024. arXiv preprint. 8

    2024

  5. [5]

    Sanity checks for saliency maps,

    J. Adebayo, J. Gilmer, M. Muelly, I. Goodfellow, M. Hardt, and B. Kim, “Sanity checks for saliency maps,” inNeurIPS, 2018

    2018

  6. [6]

    Bias-id: A framework for analyzing transformation biases in ai-generated image detectors,

    J. Ricker, A. Fischer, and E. Quiring, “Bias-id: A framework for analyzing transformation biases in ai-generated image detectors,” 2026. arXiv preprint

    2026

  7. [7]

    Sanity checks for saliency metrics,

    R. Tomsett, D. Harborne, S. Chakraborty, P. Gurram, and A. D. Preece, “Sanity checks for saliency metrics,” inAAAI, pp. 6021–6029, 2020

    2020

  8. [8]

    Genimage: A million-scale benchmark for detecting ai-generated image,

    M. Zhu, H. Chen, Q. Yan, X. Huang, G. Lin, W. Li, Z. Tu, H. Hu, J. Hu, and Y . Wang, “Genimage: A million-scale benchmark for detecting ai-generated image,” inNeurIPS, 2023

    2023

Show all 69 references
  1. [9]

    How fragile are training-free ai- generated image detectors? a controlled audit of score direc- tion, preprocessing, and compression,

    J. Zhou and M. Wang, “How fragile are training-free ai- generated image detectors? a controlled audit of score direc- tion, preprocessing, and compression,” 2026. arXiv preprint

    2026

  2. [10]

    Dual data alignment makes ai-generated image detector easier generalizable,

    R. Chen, J. Xi, Z. Yan, K.-Y . Zhang, S. Wu, J. Xie, X. Chen, L. Xu, I. Guan, T. Yao, and S. Ding, “Dual data alignment makes ai-generated image detector easier generalizable,” in NeurIPS, 2025

    2025

  3. [11]

    Interpretation of neural networks is fragile,

    A. Ghorbani, A. Abid, and J. Zou, “Interpretation of neural networks is fragile,” inAAAI, 2019

    2019

  4. [12]

    The (un)reliability of saliency methods,

    P.-J. Kindermans, S. Hooker, J. Adebayo, M. Alber, K. T. Schütt, S. Dähne, D. Erhan, and B. Kim, “The (un)reliability of saliency methods,” 2017. arXiv preprint

    2017

  5. [13]

    A comparative evaluation of explainability techniques for image data,

    M. Skliarov, R. E. Shawi, C. Dhaoui, and N. Ahmed, “A comparative evaluation of explainability techniques for image data,”Scientific Reports, 2025

    2025

  6. [14]

    A bench- mark for interpretability methods in deep neural networks (roar),

    S. Hooker, D. Erhan, P.-J. Kindermans, and B. Kim, “A bench- mark for interpretability methods in deep neural networks (roar),” inNeurIPS, 2019

    2019

  7. [15]

    A consistent and efficient evaluation strategy for attribution methods,

    Y . Rong, T. Leemann, V . Borisov, G. Kasneci, and E. Kasneci, “A consistent and efficient evaluation strategy for attribution methods,” inICML, 2022

    2022

  8. [16]

    Counterfactual visual explanations,

    Y . Goyal, Z. Wu, J. Ernst, D. Batra, D. Parikh, and S. Lee, “Counterfactual visual explanations,” inICML, 2019

    2019

  9. [17]

    Discriminative attribution from counterfactuals,

    N. Eckstein, A. S. Bates, G. S. X. E. Jefferis, and J. Funke, “Discriminative attribution from counterfactuals,” 2021. arXiv preprint

    2021

  10. [18]

    Evaluating weakly supervised object localization methods right,

    J. Choe, S. J. Oh, S. Lee, S. Chun, Z. Akata, and H. Shim, “Evaluating weakly supervised object localization methods right,” inCVPR, 2020

    2020

  11. [19]

    The central fixation bias in scene viewing: Selecting an optimal viewing position independently of motor biases and image feature distributions,

    B. W. Tatler, “The central fixation bias in scene viewing: Selecting an optimal viewing position independently of motor biases and image feature distributions,”Journal of Vision 7(14):4, 2007

    2007

  12. [20]

    What do different evaluation metrics tell us about saliency models?,

    Z. Bylinskii, T. Judd, A. Oliva, A. Torralba, and F. Durand, “What do different evaluation metrics tell us about saliency models?,”IEEE TPAMI 41 :740–757, 2019

    2019

  13. [21]

    Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization,

    F. Guillaro, D. Cozzolino, A. Sud, N. Dufour, and L. Ver- doliva, “Trufor: Leveraging all-round clues for trustworthy image forgery detection and localization,” inCVPR, 2023

    2023

  14. [22]

    Weakly-supervised deepfake localization in diffusion-generated images,

    D.-C. ¸ Tân¸ taru, E. Oneata, and D. Oneata, “Weakly-supervised deepfake localization in diffusion-generated images,” in IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 2024. arXiv:2311.04584

    2024 arXiv

  15. [23]

    SIDA: Social media image deep- fake detection, localization and explanation with large multi- modal model,

    Z. Huang, J. Hu, X. Li, Y . He, X. Zhao, B. Peng, B. Wu, X. Huang, and G. Cheng, “SIDA: Social media image deep- fake detection, localization and explanation with large multi- modal model,” inIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025. arXiv:2412.04292

    2025 arXiv

  16. [24]

    Aigi-holmes: Towards explainable and generalizable ai-generated image detection via multimodal large language models,

    Z. Zhou, Y . Luo, Y . Wu, K. Sun, J. Ji, K. Yan, S. Ding, X. Sun, Y . Wu, and R. Ji, “Aigi-holmes: Towards explainable and generalizable ai-generated image detection via multimodal large language models,” inICCV, 2025

    2025

  17. [25]

    Raising the bar of ai-generated image detection with clip,

    D. Cozzolino, G. Poggi, R. Corvi, M. Nießner, and L. Verdo- liva, “Raising the bar of ai-generated image detection with clip,” inCVPR Workshops, 2024

    2024

  18. [26]

    Dinov2: Learning robust visual features without supervision,

    M. Oquab, T. Darcet, T. Moutakanni, H. V o, M. Szafraniec, V . Khalidov, P. Fernandez, D. Haziza, F. Massa, A. El-Nouby, M. Assran, N. Ballas, W. Galuba, R. Howes, P.-Y . Huang, S.- W. Li, I. Misra, M. Rabbat, V . Sharma, G. Synnaeve, H. Xu, H. Jegou, J. Mairal, P. Labatut, A....

  19. [27]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever, “Learning transferable visual models from natural language supervision,” inICML, 2021

    2021

  20. [28]

    Sigmoid loss for language image pre-training,

    X. Zhai, B. Mustafa, A. Kolesnikov, and L. Beyer, “Sigmoid loss for language image pre-training,” inICCV, 2023

    2023

  21. [29]

    Perception encoder: The best visual em- beddings are not at the output of the network,

    D. Bolya, P.-Y . Huang, P. Sun, J. H. Cho, A. Madotto, C. Wei, T. Ma, and J. Zhi, “Perception encoder: The best visual em- beddings are not at the output of the network,” inNeurIPS, 2025

    2025

  22. [30]

    On calibra- tion of modern neural networks,

    C. Guo, G. Pleiss, Y . Sun, and K. Q. Weinberger, “On calibra- tion of modern neural networks,” inICML, 2017

    2017

  23. [31]

    Rise: Randomized input sampling for explanation of black-box models,

    V . Petsiuk, A. Das, and K. Saenko, “Rise: Randomized input sampling for explanation of black-box models,” inBMVC, 2018

    2018

  24. [32]

    Eraser: A benchmark to evaluate rationalized nlp models,

    J. DeYoung, S. Jain, N. F. Rajani, E. Lehman, C. Xiong, R. Socher, and B. C. Wallace, “Eraser: A benchmark to evaluate rationalized nlp models,” inACL, 2020

    2020

  25. [33]

    On the (in)fidelity and sensitivity of explana- tions,

    C.-K. Yeh, C.-Y . Hsieh, A. S. Suggala, D. I. Inouye, and P. Ravikumar, “On the (in)fidelity and sensitivity of explana- tions,” inNeurIPS, 2019

    2019

  26. [34]

    On the faithfulness of vision transformer explanations,

    J. Wu, W. Kang, H. Tang, Y . Hong, and Y . Yan, “On the faithfulness of vision transformer explanations,” inCVPR, 2024

    2024

  27. [35]

    Top-down neural attention by excitation back- prop,

    J. Zhang, S. A. Bargal, Z. Lin, J. Brandt, X. Shen, and S. Sclaroff, “Top-down neural attention by excitation back- prop,”IJCV 126 :1084–1102, 2018

    2018

  28. [36]

    Slic superpixels compared to state-of-the-art superpixel methods,

    R. Achanta, A. Shaji, K. Smith, A. Lucchi, P. Fua, and S. Süsstrunk, “Slic superpixels compared to state-of-the-art superpixel methods,”IEEE TPAMI 34 :2274–2282, 2012. 9

    2012

  29. [37]

    "why should i trust you?

    M. T. Ribeiro, S. Singh, and C. Guestrin, “"why should i trust you?": Explaining the predictions of any classifier,” inACM SIGKDD, 2016

    2016

  30. [38]

    Understanding deep networks via extremal perturbations and smooth masks,

    R. Fong, M. Patrick, and A. Vedaldi, “Understanding deep networks via extremal perturbations and smooth masks,” in IEEE/CVF International Conference on Computer Vision (ICCV), pp. 2950–2958, 2019

    2019

  31. [39]

    Transformer interpretability beyond attention visualization,

    H. Chefer, S. Gur, and L. Wolf, “Transformer interpretability beyond attention visualization,” inCVPR, 2021

    2021

  32. [40]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” inICLR, 2021

    2021

  33. [41]

    De-fake: Detection and attribution of fake images generated by text-to-image generation models,

    Z. Sha, Z. Li, N. Yu, and Y . Zhang, “De-fake: Detection and attribution of fake images generated by text-to-image generation models,” inACM CCS, 2023

    2023

  34. [42]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” inICCV, 2017

    2017

  35. [43]

    Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks,

    A. Chattopadhay, A. Sarkar, P. Howlader, and V . N. Balasub- ramanian, “Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks,” inWACV, 2018

    2018

  36. [44]

    Layercam: Exploring hierarchical class activation maps for localization,

    P.-T. Jiang, C.-B. Zhang, Q. Hou, M.-M. Cheng, and Y . Wei, “Layercam: Exploring hierarchical class activation maps for localization,”IEEE Transactions on Image Processing, vol. 30, pp. 5875–5888, 2021

    2021

  37. [45]

    Score-cam: Score-weighted visual explanations for convolutional neural networks,

    H. Wang, Z. Wang, M. Du, F. Yang, Z. Zhang, S. Ding, P. Mardziel, and X. Hu, “Score-cam: Score-weighted visual explanations for convolutional neural networks,” inCVPR Workshops, 2020

    2020

  38. [46]

    Ablation-cam: Visual ex- planations for deep convolutional network via gradient-free localization,

    S. Desai and H. G. Ramaswamy, “Ablation-cam: Visual ex- planations for deep convolutional network via gradient-free localization,” inWACV, 2020

    2020

  39. [47]

    Axiomatic attribution for deep networks,

    M. Sundararajan, A. Taly, and Q. Yan, “Axiomatic attribution for deep networks,” inICML, 2017

    2017

  40. [48]

    Smoothgrad: removing noise by adding noise,

    D. Smilkov, N. Thorat, B. Kim, F. Viégas, and M. Wattenberg, “Smoothgrad: removing noise by adding noise,” 2017. arXiv preprint

    2017

  41. [49]

    Visualizing and understanding convolutional networks,

    M. D. Zeiler and R. Fergus, “Visualizing and understanding convolutional networks,” inECCV, 2014

    2014

  42. [50]

    A unified approach to inter- preting model predictions,

    S. M. Lundberg and S.-I. Lee, “A unified approach to inter- preting model predictions,” inNeurIPS, 2017

    2017

  43. [51]

    Efficient graph- based image segmentation,

    P. F. Felzenszwalb and D. P. Huttenlocher, “Efficient graph- based image segmentation,”IJCV 59 :167–181, 2004

    2004

  44. [52]

    Segment anything,

    A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.-Y . Lo, P. Dollár, and R. Girshick, “Segment anything,” inICCV, 2023

    2023

  45. [53]

    Quantifying attention flow in transformers,

    S. Abnar and W. Zuidema, “Quantifying attention flow in transformers,” inACL, 2020

    2020

  46. [54]

    Vit-cx: Causal explanation of vision transformers,

    W. Xie, X.-H. Li, C. C. Cao, and N. L. Zhang, “Vit-cx: Causal explanation of vision transformers,” inIJCAI, 2023

    2023

  47. [55]

    Legrad: An explainability method for vision transformers via feature formation sensitivity,

    W. Bousselham, A. Boggust, S. Chaybouti, H. Strobelt, and H. Kuehne, “Legrad: An explainability method for vision transformers via feature formation sensitivity,” 2025. arXiv preprint

    2025

  48. [56]

    Token transformation matters: Towards faithful post-hoc explanation for vision transformer,

    J. Wu, B. Duan, W. Kang, H. Tang, and Y . Yan, “Token transformation matters: Towards faithful post-hoc explanation for vision transformer,” inCVPR, 2024

    2024

  49. [57]

    Quantus: An explainable ai toolkit for responsible evaluation of neural network explanations and beyond,

    A. Hedström, L. Weber, D. Krakowczyk, D. Bareeva, F. Motzkus, W. Samek, S. Lapuschkin, and M. M.-C. Höhne, “Quantus: An explainable ai toolkit for responsible evaluation of neural network explanations and beyond,”JMLR 24 :1–11, 2023

    2023

  50. [58]

    The meta-evaluation prob- lem in explainable ai: Identifying reliable estimators with metaquantus,

    A. Hedström, P. Bommer, K. K. Wickstrøm, W. Samek, S. La- puschkin, and M. M.-C. Höhne, “The meta-evaluation prob- lem in explainable ai: Identifying reliable estimators with metaquantus,”TMLR, 2023

    2023

  51. [59]

    A meaningful perturbation metric for evaluating explainability methods,

    D. Cohen, H. Chefer, and L. Wolf, “A meaningful perturbation metric for evaluating explainability methods,” 2025. arXiv preprint

    2025

  52. [60]

    Saliency benchmarking made easy: Separating models, maps and met- rics,

    M. Kümmerer, T. S. A. Wallis, and M. Bethge, “Saliency benchmarking made easy: Separating models, maps and met- rics,” inECCV, 2018

    2018

  53. [61]

    Hierar- chical fine-grained image forgery detection and localization,

    X. Guo, X. Liu, Z. Ren, S. Grosz, I. Masi, and X. Liu, “Hierar- chical fine-grained image forgery detection and localization,” inCVPR, 2023

    2023

  54. [62]

    Iml- vit: Benchmarking image manipulation localization by vision transformer,

    X. Ma, B. Du, X. Liu, A. Y . A. Hammadi, and J. Zhou, “Iml- vit: Benchmarking image manipulation localization by vision transformer,” 2023. arXiv preprint

    2023

  55. [63]

    Learning jpeg compression artifacts for image manipulation detection and localization (cat-net),

    M.-J. Kwon, S.-H. Nam, I.-J. Yu, H.-K. Lee, and C. Kim, “Learning jpeg compression artifacts for image manipulation detection and localization (cat-net),”IJCV, 2022

    2022

  56. [64]

    Casia image tampering detec- tion evaluation database,

    J. Dong, W. Wang, and T. Tan, “Casia image tampering detec- tion evaluation database,” inIEEE ChinaSIP, 2013

    2013

  57. [65]

    Imd2020: A large- scale annotated dataset tailored for detecting manipulated images,

    A. Novozámský, B. Mahdian, and S. Saic, “Imd2020: A large- scale annotated dataset tailored for detecting manipulated images,” inIEEE WACV Workshops, 2020

    2020

  58. [66]

    Au- tosplice: A text-prompt manipulated image dataset for media forensics,

    S. Jia, M. Huang, Z. Zhou, Y . Ju, J. Cai, and S. Lyu, “Au- tosplice: A text-prompt manipulated image dataset for media forensics,” inCVPR Workshops, 2023

    2023

  59. [67]

    Magicbrush: A manually annotated dataset for instruction-guided image editing,

    K. Zhang, L. Mo, W. Chen, H. Sun, and Y . Su, “Magicbrush: A manually annotated dataset for instruction-guided image editing,” inNeurIPS, 2023. 10 Appendix A. Extended Related Work Sec. 2 states our positioning in short. This section is the full discussion, and it cites the sa...

    2023

  60. [68]

    one reference → one model → one composite prompt → one image

    pairs detection with mask prediction on a 300k-image social-media corpus, and adds a separately tuned explanation stage. So does [24], with a multimodal language model. We train no localiser and propose no new one. Our question is not how well a trained localiser segments an e...

    2026

  61. [69]

    check passed

    is the agreement between the importance ordering and the actual influence, in[−1,1]. We build the target normalisation once, on the pair of original and fully perturbed baseline. On degenerate contrast we flag the exampleinsufficient_target_contrast in- stead of inflating the ...

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.