RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry

Congcong Bian; Hui Li; Xinchang Wang; Xingjun Ma; Yuechen Zhang; Yunhao Chen; Zihao Guo

REVIEW 4 major objections 6 minor 13 references

The paper claims that real and synthetic images can be told apart by how their learned representations react to a small, semantics-preserving perturbation, and that this 'robustness asymmetry' is a universal signal strong enough to power a

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 19:34 UTC pith:Z3E5MNIW

load-bearing objection RA-Det's learned behavioral probe is a genuine step forward, but the universal claim rides on a benchmark confound that the paper itself documents and never controls for. the 4 major comments →

arxiv 2603.01544 v2 pith:Z3E5MNIW submitted 2026-03-02 cs.CV

RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry

Xinchang Wang , Yunhao Chen , Yuechen Zhang , Congcong Bian , Zihao Guo , Xingjun Ma , Hui Li This is my paper

classification cs.CV

keywords AI-generated image detectionrobustness asymmetryfeature shiftmemorizationGAN detectiondiffusion detectioncross-generator generalization

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that natural and synthetic images differ not in how they look but in how they behave: nudge both with the same small, semantics-preserving perturbation, and a frozen vision encoder's embedding of a real image barely moves while a generated image's embedding drifts noticeably. It calls this robustness asymmetry, proves a lower bound linking the size of the drift gap to how much the generator memorized its training data, and builds a detector, RA-Det, that learns a perturbation and reads the resulting drift. On a 16-generator benchmark, with training only on one GAN, RA-Det averages 93.47% accuracy and 97.00% average precision, beating the strongest baseline by 7.81 accuracy points. If true, a single detector can flag images from unseen generators by probing stability rather than matching forensic cues.

Core claim

The paper's core discovery is robustness asymmetry: for a frozen vision encoder, the cosine similarity between the embedding of a clean real image and the same image after a small, semantics-preserving perturbation stays high, while for a generated image it drops markedly. The paper provides a lower-bound theorem showing that the expected shift gap between generated and real distributions is bounded below by a term that grows as the generator memorizes its training data more (smaller SIDE divergence), which explains why the phenomenon appears across GANs, diffusion models, and commercial platforms. It then converts this into RA-Det, a multi-branch detector that trains a conditional UNet to p

What carries the argument

The central object is the feature-shift operator Shift_epsilon(x) = E||f(x+δ)-f(x)||^2, evaluated in a frozen foundation encoder under a small isotropic probe. The paper proves Theorem 4.3, which lower-bounds the difference in expected shift between generated and real distributions by (ε²/n)(Δ − B√(M/2)) + O(ε⁴), where M is the SIDE memorization divergence and Δ measures the encoder's Jacobian-energy surplus around training neighborhoods. RA-Det's differential robustness probing module—a conditional UNet—learns a bounded perturbation that amplifies this gap, and the multi-branch detector reads the gap through an embedding-distance branch, a vector-difference branch, a diagonal-restricted cov

Load-bearing premise

The load-bearing premise is that the benchmark's real and synthetic images differ only in how they were created; in fact the real photos are JPEG-compressed at varying quality and the synthetic images are lossless PNGs at fixed resolutions, a format mismatch that Appendix A itself documents when explaining another detector's inflated scores—and RA-Det's own probing and residual branches are never tested on a format-equalized control.

What would settle it

Re-run the 16-generator benchmark with all images re-encoded to a single format (all PNG or all JPEG at matched quality and resolution) and compare RA-Det's accuracy; if the margin over baselines collapses, the robustness asymmetry is at least partly a compression artifact. Independently, train a generator with explicit anti-memorization regularization and check whether the measured feature-shift gap shrinks as Theorem 4.3 predicts.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

A detector trained only on one GAN can flag images from diffusion models and commercial platforms it never saw, with accuracy above 93% on average.
Robustness asymmetry persists under JPEG compression and Gaussian blur, so behavioral detection survives post-processing much better than artifact-driven detectors.
The theoretical link predicts that as generators memorize less—through more diverse training data or explicit anti-memorization regularization—the detectable asymmetry shrinks, putting pressure on both detector design and generator development.
Because the signal lives in behavior rather than appearance, the detector can be rebuilt on any frozen encoder (the paper shows results with both CLIP and a DINO-style backbone), making the approach backbone-agnostic.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The memorization link implies an arms race: a generator trained to avoid memorizing its training set could erode the very signal RA-Det exploits, so a natural next test is to measure RA-Det's margin on a generator explicitly regularized against memorization.
The paper's own Appendix A documents that the benchmark's real photos are JPEG-compressed while synthetic images are lossless PNGs at fixed resolutions; a same-format control would reveal how much of RA-Det's transfer margin comes from true behavioral asymmetry rather than encoding artifacts.
The same behavioral probing idea could transfer to other modalities—audio, video, text—where 'real' signals have stable semantic representations under mild perturbations and synthetic ones drift.
A direct empirical test of Theorem 4.3 would correlate each test generator's measured memorization (e.g., via extraction or membership-inference success) with the observed shift gap; the paper only uses training epochs as a proxy.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

RA-Det's learned behavioral probe is a genuine step forward, but the universal claim rides on a benchmark confound that the paper itself documents and never controls for.

read the letter

Short take: the behavioral-probe idea is good, and the average results are strong, but the paper's universal claim is not yet supported because it evaluates on the very benchmark whose format bias it flags for DIRE — without running a format-equalized control for its own method. That is the thing to fix before the strong conclusion stands.

Credit where due. The observation that real images keep their embeddings stable under small perturbations while generated images drift is a useful complement to appearance-based detection. It is not brand new — RIGID already used Gaussian-noise similarity — but RA-Det's move is to learn the perturbation with DRP instead of fixing it, and the multi-branch fusion of semantic, discrepancy, and residual evidence is a sensible way to operationalize the signal. The ablation shows the discrepancy branch matters most, and swapping DINOv3 for CLIP still works, which supports the backbone-agnostic claim. The theory connecting the shift gap to memorization via SIDE divergence is a plausible explanation for why the asymmetry might be universal, and the appendix's non-monotonic shift-vs-noise curves are a reasonable sanity check. Code is public, which helps reproducibility.

Now the soft spots, in proportion. The main one is the evaluation. Appendix A argues that DIRE's inflated scores on the ProGAN benchmark come from format bias — real photos stored as JPEG with varying compression, synthetic images as lossless PNG at fixed resolution, citing Grommelt et al. That is exactly the benchmark in Table 1. RA-Det includes a median-filter residual branch and a learned perturbation module; both are well positioned to pick up those same format differences. Disabling JPEG/blur augmentation during training does not remove the static format mismatch between classes. So the 7.81-point gain over FerretNet cannot yet be confidently attributed to robustness asymmetry. The stress-test note lands. Second, results are single-run with no error bars; some per-generator numbers are close enough between methods that a second seed could move them. Third, the theory's Assumption 4.1 (tangent/normal anisotropy) is unmeasured, and the bound is derived for isotropic Gaussian noise while DRP learns a structured perturbation — the bridge between the two is asserted more than demonstrated. Also, on whichfaceisreal, RIGID beats RA-Det by about 16 ACC points; that is an odd place for a universal detector to lose.

Bottom line: the idea is worth referee time, but the manuscript overclaims universality without a format-equalized evaluation. I would send it to peer review and ask for repeated-seed results plus at least one controlled benchmark (e.g., real images re-saved as PNG or fake images re-compressed to JPEG) before the central claim is accepted. It would also be a good reading-group case study on benchmark confounds in generated-image detection.

Referee Report

4 major / 6 minor

Summary. The paper proposes that natural images preserve stable semantic representations under small structured perturbations, while AI-generated images exhibit larger feature drift, a phenomenon the authors call 'robustness asymmetry.' They formalize this with a theoretical lower bound connecting the asymmetry to memorization in generative models (Theorem 4.3), and introduce RA-Det, a multi-branch detector that combines a frozen foundation encoder, a learned perturbation module (DRP), discrepancy features, and a low-level residual stream. Training is on ProGAN-generated images and real photos; evaluation is on 16 generators with unseen architectures (Table 1), where RA-Det reports 93.47% average ACC / 97.00% AP, outperforming the best baseline FerretNet by 7.81 points ACC. The paper also includes ablations, robustness tests under JPEG compression and blur, and an appendix with a proof and an empirical check of the lower bound.

Significance. If the central claim is correct, shifting synthetic-image detection from appearance to behavioral robustness would be a valuable and general principle, especially as generators remove low-level artifacts. The paper ships with public code, a clear multi-branch architecture, and a theoretical argument aiming at a mechanistic explanation via memorization. However, the empirical foundation is weakened by a known dataset-format confound that the paper itself documents in Appendix A but does not control for in the main evaluation, and by the absence of any variance estimates. The theoretical section also rests on a tailored manifold/anisotropy assumption that is close to the phenomenon being explained. The idea is promising and the engineering is solid, but the universality claim needs stronger evidence before it can be accepted.

major comments (4)

[Appendix A; §5.1.1; Table 1] The paper itself states in Appendix A that the widely used ProGAN benchmark is biased: real photographs are JPEG with varying compression/resolution while synthetic images are lossless PNG at fixed resolutions, citing Grommelt et al. (2024). RA-Det is evaluated on exactly this benchmark (§5.1.1, Table 1) with no format-equalized control. Its low-level median-filter residual branch and the learned DRP perturbation (§3.2.1, §3.2.3) can both exploit static class-conditional encoding differences; disabling JPEG/blur augmentation during training (§5.1.2) removes augmentation, not the dataset's format asymmetry. Hence the headline average 93.47% ACC and the 7.81-point gain over FerretNet cannot currently be attributed to robustness asymmetry rather than to compression/resolution cues. A control that equalizes image encoding across classes is required.
[Table 1, whichfaceisreal row] RA-Det obtains 72.20/81.13 ACC/AP on whichfaceisreal, substantially below RIGID (88.40/95.06) and UniFD (86.90/96.73), and only slightly above chance. This large exception to the 'universal' claim is not discussed in the text. The strong average arises from large gains on other generators; without an explanation for the whichfaceisreal failure, the claim that robustness asymmetry provides a universal, generator-agnostic signal is overstated. A breakdown by dataset and a discussion of this failure case should be included.
[§4, Assumption 4.1; Appendix B.1] Theorem 4.3's lower bound rests on Assumption 4.1, a manifold/anisotropy condition (λ_min^⊥ > λ_max^T) that is essentially a formal version of the robustness-asymmetry phenomenon being explained. In addition, the derivation of Lemma 4.2 in Appendix B.1 appears to assume (1/N)Σ_i G(x_i) ≥ E_p[G] when it subtracts E_p[G] after averaging over the anchors; without that extra condition, the claimed Δ ≥ c0 > 0 does not follow. The Appendix B.2 empirical validation uses training epochs as a proxy for SIDE memorization and assumes a monotone relation M(E1)>M(E2) without measuring M, so it does not directly test the bound. Please either supply independent evidence for the anisotropy/training-anchor conditions or weaken the theoretical claims accordingly.
[§5.1.4; Table 1] All results are single runs with no error bars, confidence intervals, or multiple seeds. The central empirical claim is a 7.81-point average ACC improvement over FerretNet; without variance estimates, it is impossible to judge whether this difference is significant. I request repeated runs (at least 3 seeds) or bootstrap CIs for the main table and ablations.

minor comments (6)

[Abstract vs §5.1.1/Table 1] The model count is 16 in Table 1 but 14 in the abstract; harmonize.
[Eq. (3)–(4)] DCA is defined with population expectations but used as a per-sample feature; clarify how Σ_ee′ is estimated in practice.
[Figure 2] Caption does not state dataset, perturbation type/magnitude, or encoder details; add them.
[§3.2.1] DRP architecture (UNet depth, channels, cross-attention details, parameter count) is not specified; add for reproducibility.
[Figure 4] Radar chart is not referenced in the text; either cite it or remove.
[Table 1, comparison paragraph] RA-Det's relatively low score on whichfaceisreal is not mentioned in the comparison paragraph; at minimum note it when discussing limitations.

Circularity Check

0 steps flagged

No circular step found; only a minor self-citation (SIDE) in the explanatory theory, not in the fitted evaluation chain.

full rationale

RA-Det's detection pipeline is not circular: the DRP module, discrepancy branches, and residual branch are trained with a supervised BCE plus contrastive margin on ProGAN real/fake data and then evaluated on 15 unseen generators; no fitted value is recycled as a prediction. The robustness-asymmetry phenomenon is defined by comparing embedding similarity under perturbation, independently of the detector that later exploits it. Theorem 4.3 is a conditional inequality derived from the SIDE divergence definition (Chen et al., 2024b) and Assumption 4.1; even if the theory were weakened, Table 1's comparison against external baselines (CNNSpot, UniFD, NPR, FerretNet, RIGID, DIRE, etc.) stands on its own. The use of SIDE from the authors' prior work is a minor self-citation and is not load-bearing for the empirical result: memorization prevalence is additionally supported by external works (Carlini et al., 2021, 2023; Hayes et al., 2019; Hilprecht et al., 2019), and the lower bound is not used to fit any parameter. The Appendix A observation about JPEG/PNG format biases is a genuine external-validity/confound concern for the benchmark, but it is not a circularity: the paper does not define robustness asymmetry in terms of those format cues, nor does it fit the detector to the test-set labels. Hence score 2 at most for the minor self-citation, with no actual circular step.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The detector itself introduces no new physical entities. The theory rests on an ad hoc anisotropy assumption about encoders and on a self-cited memorization divergence; the empirical validation adds an unproven monotonicity assumption between training epochs and SIDE divergence. These are the main unpaid premises in the paper.

free parameters (3)

contrastive margin gamma = 0.1
Set by hand in Sec. 3.3 and used in L_ra; no sensitivity analysis is reported.
perturbation scale epsilon (DRP tanh scaling) = not reported
Sec. 3.2.1 states the perturbation is scaled by epsilon but the numerical value is omitted from implementation details.
noise radius epsilon_0 in theoretical bound = chosen small; grid values in Appendix B.2
The lower-bound theorem requires epsilon_0 in (0, epsilon_bar_0] and small epsilon; the empirical validation chooses epsilon values by hand but does not use them to fit the detector.

axioms (4)

ad hoc to paper Assumption 4.1: natural images lie on an m-dimensional manifold and the fixed C^2 encoder has reduced Jacobian sensitivity along tangent directions and larger sensitivity along normal directions, with a Hessian margin lambda_min^perp > lambda_max^T.
Introduced in Sec. 4 and used to prove Lemma 4.2 (Delta > 0), which makes the Theorem 4.3 bound non-vacuous. The assumption is supported only by citation, not measured for the actual encoders used.
domain assumption SIDE memorization divergence M = D_KL(q_eps0 || p_theta) is a valid and interpretable measure of generator memorization.
The definition and interpretation come from the authors' own prior work (Chen et al., 2024b; Chen et al., 2025); Theorem 4.3's lower bound depends on this divergence being small for memorizing models.
domain assumption Training epochs are a monotonic proxy for SIDE memorization divergence.
Appendix B.2 substitutes training epochs for M, asserting M(E1) > M(E2) for E1 < E2 without proof; the empirical validation of the theorem depends on this unproven monotonic relation.
standard math Standard regularity: Jacobian energy G is bounded on X, f is C^2, and Hoeffding/Donsker-Varadhan inequalities apply.
These are conventional assumptions used in the Appendix B derivation and are acceptable background math.

pith-pipeline@v1.3.0-alltime-deepseek · 17970 in / 13021 out tokens · 130242 ms · 2026-08-02T19:34:31.728634+00:00 · methodology

0 comments

read the original abstract

Recent image generators produce photo-realistic content that undermines the reliability of downstream recognition systems. As visual appearance cues become less pronounced, appearance-driven detectors that rely on forensic cues or high-level representations lose stability. This motivates a shift from appearance to behavior, focusing on how images respond to controlled perturbations rather than how they look. In this work, we identify a simple and universal behavioral signal. Natural images preserve stable semantic representations under small, structured perturbations, whereas generated images exhibit markedly larger feature drift. We refer to this phenomenon as robustness asymmetry and provide a theoretical analysis that establishes a lower bound connecting this asymmetry to memorization tendencies in generative models, explaining its prevalence across architectures. Building on this insight, we introduce Robustness Asymmetry Detection (RA-Det), a behavior-driven detection framework that converts robustness asymmetry into a reliable decision signal. Evaluated across 14 diverse generative models and against more than 10 strong detectors, RA-Det achieves superior performance, improving the average performance by 7.81 percent. The method is data- and model-agnostic, requires no generator fingerprints, and transfers across unseen generators. Together, these results indicate that robustness asymmetry is a stable, general cue for synthetic-image detection and that carefully designed probing can turn this cue into a practical, universal detector. The source code is publicly available at Github.

Figures

Figures reproduced from arXiv: 2603.01544 by Congcong Bian, Hui Li, Xinchang Wang, Xingjun Ma, Yuechen Zhang, Yunhao Chen, Zihao Guo.

**Figure 1.** Figure 1: Robustness asymmetry between natural and synthetic images in embedding spaces (CLIP (Radford et al., 2021), DINO (Simeoni et al. ´ , 2025)). Under perturbation, show minimal embedding displacement, while synthetic images exhibit large representation drift (high displacement). 1. Introduction In recent years, generative models have evolved from early experimental frameworks into mature systems capable of … view at source ↗

**Figure 2.** Figure 2: Backbone-agnostic evidence of robustness asymmetry. We measure embedding stability as the cosine similarity between features extracted from the clean image and its perturbed counterpart. Real images maintain higher similarity than synthetic images, and the separation remains consistent for both DINOv3 and CLIP. large pre-trained vision models such as CLIP (Radford et al., 2021), DINOv2(Oquab et al., 2023)… view at source ↗

**Figure 3.** Figure 3: Overview of RA-Det. The framework processes real and fake images through three key phases to identify generative content: (I) Differential Robustness Probing (DRP) generates targeted perturbations to amplify the robustness asymmetry between real and synthetic images. (II) The Multi-Branch Detector aggregates complementary forensic evidence by analyzing high-level semantic features, quantifying feature-spac… view at source ↗

**Figure 4.** Figure 4: Radar chart comparison of multiple detectors. with the SIDE divergence M(D; pθ, ε0). In other words, more memorization of the training data provably creates a larger robustness asymmetry in the small-noise regime. Prior works on extraction and membership inference in different generative models demonstrate that such memorization is prevalent across GANs, diffusion models, and even the large language model… view at source ↗

**Figure 5.** Figure 5: Performance comparison under common image perturbations. The plots show detector performance against (a) JPEG compression (QF = 95, 90 and 85) and (b) Gaussian blur (σ = 0.8, 1.0 and 1.5). The mean scores (diamonds) indicate that our method, RA-Det, maintains the highest accuracy and AP, demonstrating superior robustness. and RA-Det operate in foundation feature space, where semantic representations are m… view at source ↗

**Figure 6.** Figure 6: Empirical validation of the lower bound. Left column: average differential shift Shiftgen − Shiftreal versus probe magnitude ε, showing the predicted rise at small ε and decline at larger ε. Right column: average differential versus training epochs (used as a practical proxy for memorization since SIDE divergence is expensive to compute). Larger epoch counts correspond to stronger memorization and yield la… view at source ↗

discussion (0)

Reference graph

Works this paper leans on

13 extracted references · 7 linked inside Pith

[1]

ε:The average difference ∆(ε) across a grid of Gaussian perturbation magnitudes ε

Differential shift vs. ε:The average difference ∆(ε) across a grid of Gaussian perturbation magnitudes ε. This curve reflects how the differential shift evolves with probing noise intensity
[2]

inverted U-shape

Differential shift vs. training epochs:The mean differential shift aggregated over ε values, plotted as a function of the number of training epochs, to examine how memorization impacts∆. Findings and interpretation.The results are summarized in Figures 6a–h. Across all encoders, we consistently observe the two–phase structure predicted by theory. At small...
[5]

Hounie, I., Chamon, L

URL https://petsymposium.org/ popets/2019/popets-2019-0067.pdf. Hounie, I., Chamon, L. F., and Ribeiro, A. Automatic data augmentation via invariance-constrained learning. InInternational Conference on Machine Learning, pp. 13410–13433. PMLR, 2023a. Hounie, I. et al. Automatic data augmentation via invariance- constrained learning. InProceedings of the 40...

Pith/arXiv arXiv 2019
[6]

com/content_CVPR_2019/papers/Karras_ A_Style-Based_Generator_Architecture_ for_Generative_Adversarial_Networks_ CVPR_2019_paper.pdf

URL https://openaccess.thecvf. com/content_CVPR_2019/papers/Karras_ A_Style-Based_Generator_Architecture_ for_Generative_Adversarial_Networks_ CVPR_2019_paper.pdf. Le, B. M. and Woo, S. S. Add: Frequency attention and multi-view based knowledge distillation to detect low-quality compressed deepfake images, 2021. URL https://arxiv.org/abs/2112.03553. 9 RA-...

Pith/arXiv arXiv 2021
[8]

cc/paper_files/paper/2022/file/ ec795aeadae0b7d230fa35cbaf04c041-Paper-Conference

URL https://papers.neurips. cc/paper_files/paper/2022/file/ ec795aeadae0b7d230fa35cbaf04c041-Paper-Conference. pdf. Sim´eoni, O., V o, H. V ., Seitzer, M., Baldassarre, F., Oquab, M., Jose, C., Khalidov, V ., Szafraniec, M., Yi, S., Rama- monjisoa, M., Massa, F., Haziza, D., Wehrstedt, L., Wang, J., Darcet, T., Moutakanni, T., Sentana, L., Roberts, C., Ve...

Pith/arXiv arXiv 2022
[10]

Yu, P., Fei, J., Gao, H., Feng, X., Xia, Z., and Chang, C

URL https://proceedings.mlr.press/ v216/xu23b/xu23b.pdf. Yu, P., Fei, J., Gao, H., Feng, X., Xia, Z., and Chang, C. H. Unlocking the capabilities of large vision-language mod- els for generalizable and explainable deepfake detection. arXiv preprint arXiv:2503.14853, 2025. Zhang, Y . and Xu, X. Diffusion noise feature: Accurate and fast generated image det...

Pith/arXiv arXiv 2025
[11]

12 RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry By orthogonality and isotropy, E∥t∥2 = ε2 0 N trPT = ε2 0 N m,E∥s∥ 2 = ε2 0 N (N−m)

Let PT (y)andP N (y) =I−P T (y)be the orthogonal projectors ontoT yMandN yM, and decompose t:=P T (y)η∈T yM, s:=P N (y)η∈N yM,η=t+s. 12 RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry By orthogonality and isotropy, E∥t∥2 = ε2 0 N trPT = ε2 0 N m,E∥s∥ 2 = ε2 0 N (N−m). Sincef∈C 2,G(x) =∥J f (x)∥2 F isC 2 onU. A second-or...
[300]

URL https://doi

doi: 10.1145/3703626. URL https://doi. org/10.1145/3703626. Wang, Z., Bao, J., Zhou, W., Wang, W., Hu, H., Chen, H., and Li, H. Dire for diffusion-generated image detec- tion, 2023. URL https://arxiv.org/abs/2303. 09295. Wu, H., Zhou, J., and Zhang, S. Generalizable synthetic image detection via language-guided contrastive learn- ing, 2025. URL https://ar...

doi:10.1145/3703626 2023
[2019]

He, Z., Chen, P.-Y ., and Ho, T.-Y

URL https://petsymposium.org/ popets/2019/popets-2019-0008.pdf. He, Z., Chen, P.-Y ., and Ho, T.-Y . Rigid: A training-free and model-agnostic framework for robust ai-generated image detection, 2024. URL https://arxiv.org/ abs/2405.20112. Hilprecht, B., H ¨arterich, M., and Bernau, D. Monte carlo and reconstruction membership inference at- tacks against g...

Pith/arXiv arXiv 2019
[2020]

io/papers/CCS20-GAN-Leaks.pdf

URL https://yangzhangalmo.github. io/papers/CCS20-GAN-Leaks.pdf. Chen, S., Luss, R., Vaidyanathan, R., and Aravkin, A. A group-theoretic framework for data augmentation. arXiv preprint arXiv:1907.10905, 2019. URL https: //arxiv.org/abs/1907.10905. Chen, Y ., Wang, X., Zou, J., and Ma, R. Surrogate con- ditional data extraction from diffusion models (side)...

Pith/arXiv arXiv 1907
[2021]

Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Se- hwag, V ., Tram `er, F., Balle, B., Ippolito, D., and Wallace, E

URL https://www.usenix.org/system/ files/sec21-carlini-extracting.pdf. Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Se- hwag, V ., Tram `er, F., Balle, B., Ippolito, D., and Wallace, E. Extracting training data from dif- fusion models. InUSENIX Security Symposium,
[2022]

com/content/CVPR2022/papers/Rombach_ High-Resolution_Image_Synthesis_With_ Latent_Diffusion_Models_CVPR_2022_ paper.pdf

URL https://openaccess.thecvf. com/content/CVPR2022/papers/Rombach_ High-Resolution_Image_Synthesis_With_ Latent_Diffusion_Models_CVPR_2022_ paper.pdf. Ronneberger, O., Fischer, P., and Brox, T. U-net: Convolu- tional networks for biomedical image segmentation, 2015. URLhttps://arxiv.org/abs/1505.04597. Runway. Runway (gen-3 alpha). Software platform, 202...

Pith/arXiv arXiv 2015
[2023]

Caron, M., Touvron, H., Misra, I., et al

URL https://www.usenix.org/system/ files/usenixsecurity23-carlini.pdf. Caron, M., Touvron, H., Misra, I., et al. Emerg- ing properties in self-supervised vision trans- formers. InICCV 2021, 2021. URL https: //openaccess.thecvf.com/content/ ICCV2021/papers/Caron_Emerging_ Properties_in_Self-Supervised_Vision_ Transformers_ICCV_2021_paper.pdf. Chen, B., Zen...

2021

[1] [1]

ε:The average difference ∆(ε) across a grid of Gaussian perturbation magnitudes ε

Differential shift vs. ε:The average difference ∆(ε) across a grid of Gaussian perturbation magnitudes ε. This curve reflects how the differential shift evolves with probing noise intensity

[2] [2]

inverted U-shape

Differential shift vs. training epochs:The mean differential shift aggregated over ε values, plotted as a function of the number of training epochs, to examine how memorization impacts∆. Findings and interpretation.The results are summarized in Figures 6a–h. Across all encoders, we consistently observe the two–phase structure predicted by theory. At small...

[3] [5]

Hounie, I., Chamon, L

URL https://petsymposium.org/ popets/2019/popets-2019-0067.pdf. Hounie, I., Chamon, L. F., and Ribeiro, A. Automatic data augmentation via invariance-constrained learning. InInternational Conference on Machine Learning, pp. 13410–13433. PMLR, 2023a. Hounie, I. et al. Automatic data augmentation via invariance- constrained learning. InProceedings of the 40...

Pith/arXiv arXiv 2019

[4] [6]

com/content_CVPR_2019/papers/Karras_ A_Style-Based_Generator_Architecture_ for_Generative_Adversarial_Networks_ CVPR_2019_paper.pdf

URL https://openaccess.thecvf. com/content_CVPR_2019/papers/Karras_ A_Style-Based_Generator_Architecture_ for_Generative_Adversarial_Networks_ CVPR_2019_paper.pdf. Le, B. M. and Woo, S. S. Add: Frequency attention and multi-view based knowledge distillation to detect low-quality compressed deepfake images, 2021. URL https://arxiv.org/abs/2112.03553. 9 RA-...

Pith/arXiv arXiv 2021

[5] [8]

cc/paper_files/paper/2022/file/ ec795aeadae0b7d230fa35cbaf04c041-Paper-Conference

URL https://papers.neurips. cc/paper_files/paper/2022/file/ ec795aeadae0b7d230fa35cbaf04c041-Paper-Conference. pdf. Sim´eoni, O., V o, H. V ., Seitzer, M., Baldassarre, F., Oquab, M., Jose, C., Khalidov, V ., Szafraniec, M., Yi, S., Rama- monjisoa, M., Massa, F., Haziza, D., Wehrstedt, L., Wang, J., Darcet, T., Moutakanni, T., Sentana, L., Roberts, C., Ve...

Pith/arXiv arXiv 2022

[6] [10]

Yu, P., Fei, J., Gao, H., Feng, X., Xia, Z., and Chang, C

URL https://proceedings.mlr.press/ v216/xu23b/xu23b.pdf. Yu, P., Fei, J., Gao, H., Feng, X., Xia, Z., and Chang, C. H. Unlocking the capabilities of large vision-language mod- els for generalizable and explainable deepfake detection. arXiv preprint arXiv:2503.14853, 2025. Zhang, Y . and Xu, X. Diffusion noise feature: Accurate and fast generated image det...

Pith/arXiv arXiv 2025

[7] [11]

12 RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry By orthogonality and isotropy, E∥t∥2 = ε2 0 N trPT = ε2 0 N m,E∥s∥ 2 = ε2 0 N (N−m)

Let PT (y)andP N (y) =I−P T (y)be the orthogonal projectors ontoT yMandN yM, and decompose t:=P T (y)η∈T yM, s:=P N (y)η∈N yM,η=t+s. 12 RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry By orthogonality and isotropy, E∥t∥2 = ε2 0 N trPT = ε2 0 N m,E∥s∥ 2 = ε2 0 N (N−m). Sincef∈C 2,G(x) =∥J f (x)∥2 F isC 2 onU. A second-or...

[8] [300]

URL https://doi

doi: 10.1145/3703626. URL https://doi. org/10.1145/3703626. Wang, Z., Bao, J., Zhou, W., Wang, W., Hu, H., Chen, H., and Li, H. Dire for diffusion-generated image detec- tion, 2023. URL https://arxiv.org/abs/2303. 09295. Wu, H., Zhou, J., and Zhang, S. Generalizable synthetic image detection via language-guided contrastive learn- ing, 2025. URL https://ar...

doi:10.1145/3703626 2023

[9] [2019]

He, Z., Chen, P.-Y ., and Ho, T.-Y

URL https://petsymposium.org/ popets/2019/popets-2019-0008.pdf. He, Z., Chen, P.-Y ., and Ho, T.-Y . Rigid: A training-free and model-agnostic framework for robust ai-generated image detection, 2024. URL https://arxiv.org/ abs/2405.20112. Hilprecht, B., H ¨arterich, M., and Bernau, D. Monte carlo and reconstruction membership inference at- tacks against g...

Pith/arXiv arXiv 2019

[10] [2020]

io/papers/CCS20-GAN-Leaks.pdf

URL https://yangzhangalmo.github. io/papers/CCS20-GAN-Leaks.pdf. Chen, S., Luss, R., Vaidyanathan, R., and Aravkin, A. A group-theoretic framework for data augmentation. arXiv preprint arXiv:1907.10905, 2019. URL https: //arxiv.org/abs/1907.10905. Chen, Y ., Wang, X., Zou, J., and Ma, R. Surrogate con- ditional data extraction from diffusion models (side)...

Pith/arXiv arXiv 1907

[11] [2021]

Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Se- hwag, V ., Tram `er, F., Balle, B., Ippolito, D., and Wallace, E

URL https://www.usenix.org/system/ files/sec21-carlini-extracting.pdf. Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Se- hwag, V ., Tram `er, F., Balle, B., Ippolito, D., and Wallace, E. Extracting training data from dif- fusion models. InUSENIX Security Symposium,

[12] [2022]

com/content/CVPR2022/papers/Rombach_ High-Resolution_Image_Synthesis_With_ Latent_Diffusion_Models_CVPR_2022_ paper.pdf

URL https://openaccess.thecvf. com/content/CVPR2022/papers/Rombach_ High-Resolution_Image_Synthesis_With_ Latent_Diffusion_Models_CVPR_2022_ paper.pdf. Ronneberger, O., Fischer, P., and Brox, T. U-net: Convolu- tional networks for biomedical image segmentation, 2015. URLhttps://arxiv.org/abs/1505.04597. Runway. Runway (gen-3 alpha). Software platform, 202...

Pith/arXiv arXiv 2015

[13] [2023]

Caron, M., Touvron, H., Misra, I., et al

URL https://www.usenix.org/system/ files/usenixsecurity23-carlini.pdf. Caron, M., Touvron, H., Misra, I., et al. Emerg- ing properties in self-supervised vision trans- formers. InICCV 2021, 2021. URL https: //openaccess.thecvf.com/content/ ICCV2021/papers/Caron_Emerging_ Properties_in_Self-Supervised_Vision_ Transformers_ICCV_2021_paper.pdf. Chen, B., Zen...

2021