Research map / Adversarial robustness and security / Certified and empirical robustness
Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes on-manifold adversarial training (OMAT) that optimizes diffusion initial noise z_T to create on-manifold adversarial fakes for retraining AIGC detectors, and introduces the GenImage++ test-only benchmark with FLUX.1 and SD3 outputs.
Problem
AIGC image detectors reach near-perfect accuracy on their training generator but generalize poorly to unseen generators, which the authors attribute partly to shortcut learning tied to the initial latent noise z_T (latent prior bias).
Approach
Instead of pixel-space perturbations, optimize only the initial diffusion noise z_T under a fixed prompt and frozen Stable Diffusion generator to find on-manifold adversarial examples that fool the detector, then adversarially fine-tune the detector on these examples, with LoRA on CLIP giving the best generalization.
Key results
- OMAT CLIP+LoRA (Rank 4) reaches 94.63% average accuracy across GenImage subsets, up from 79.20% for the CLIP+Linear baseline.
- On the GenImage++ benchmark, OMAT CLIP+LoRA (Rank 4) averages 96.78%, versus 69.43% for DRCT/UniFD.
- On Chameleon, the OMAT model reaches 66.05% accuracy, above the 65.77% AIDE result reported for models trained on full GenImage.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add on-manifold latent adversarial examples using CLIP+LoRA rank 4 | CLIP+Linear · GenImage AVG | accuracy (%): 79.20 -> 94.63; +15.43% | Helped |
| Add on-manifold latent adversarial examples using CLIP+LoRA rank 4 | CLIP+Linear · Chameleon test set | accuracy (%): 62.60 -> 66.05 | Helped |
| Add on-manifold latent adversarial examples using CLIP+LoRA rank 4 | CLIP+Linear · GenImage++ AVG | accuracy (%): 69.43 -> 96.78 | Helped |
| Add on-manifold latent adversarial examples | ResNet50 · GenImage AVG | accuracy (%): 70.18 -> 74.13 | Mixed |
| Add on-manifold latent adversarial examples using full fine-tuning | CLIP+Linear · GenImage AVG | accuracy (%): 79.20 -> 84.98 | Mixed |
| Add on-manifold latent adversarial examples while fine-tuning only the linear head | CLIP+Linear · GenImage AVG | accuracy (%): 79.20 -> 84.07 | Mixed |
| Use LoRA rank 8 instead of rank 4 (ablation) | CLIP+Linear with OMAT · GenImage AVG | accuracy (%): 94.63 -> 91.27 | Hurt |
| Use LoRA rank 16 instead of rank 4 (ablation) | CLIP+Linear with OMAT · GenImage AVG | accuracy (%): 94.63 -> 91.84 | Hurt |
| Use FGSM pixel-space adversarial examples (ε=0.1) instead of on-manifold examples (ablation) | CLIP+LoRA (Rank 4) · GenImage AVG | accuracy (%): 94.63 -> 83.49 | Hurt |
| Use PGD pixel-space adversarial examples (ε=0.1, α=0.02, T=40) instead of on-manifold examples (ablation) | CLIP+LoRA (Rank 4) · GenImage AVG | accuracy (%): 94.63 -> 83.11 | Hurt |
| Use MI-FGSM pixel-space adversarial examples (ε=0.1, α=0.015, T=30) instead of on-manifold examples (ablation) | CLIP+LoRA (Rank 4) · GenImage AVG | accuracy (%): 94.63 -> 83.16 | Hurt |
| Add on-manifold adversarial training | CLIP+Linear · Latent optimization attack on 100 ImageNet labels | attack success (%): 75 -> 57 | Helped |
Limitations
- Adversarial training data is generated only against SD v1.4 with prompts of the form 'photo of a [label]', so coverage of other generators is limited to the authors' evaluation.
- Detector comparisons on GenImage++ use baselines trained only on SDv1.4 and CLIP+LoRA hyperparameters were selected on the reported benchmarks.
- Some implementation details (e.g., learning rate for linear-only CLIP fine-tuning) are marked as unconfirmed in the appendix.
Experimental setup
Datasets: GenImage SDv1.4 subset ImageNet-1k labels On-manifold adversarial set X_adv (6000 images)
Benchmarks: GenImage Chameleon GenImage++
Metrics: accuracy
Baselines: CNNSpot GramNet UniFD SRM AIDE DIRE DRCT NPR SPSL F3Net Xception FGSM
Builds on: LoRA DDIM UnivFD DRCT
Closest papers by meaning
- A Bias-Free Training Paradigm for More General AI-generated Image Detection (CVPR 2025 · similarity 0.88)
- Community Forensics: Using Thousands of Generators to Train Fake Image Detectors (CVPR 2025 · similarity 0.88)
- BIAS-ID: A Framework for Analyzing Transformation Biases in AI-Generated Image Detectors (NeurIPS 2026 · similarity 0.86)
- Detecting Adversarial Data Using Perturbation Forgery (CVPR 2025 · similarity 0.85)
- Is Artificial Intelligence Generated Image Detection a Solved Problem? (NeurIPS 2025 · similarity 0.85)
- Manifold Induced Biases for Zero-shot and Few-shot Detection of Generated Images (ICLR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.