LLL640/RepostGuard-Lite-M2-train-v3

RepostGuard-Lite M2 — Community Forensics train-v3

M2 is a binary AI-generated image (AIGI) detector trained for robustness to common reposting and editing transformations. It combines a frozen OpenCLIP ViT-B/32 semantic branch with a DCT/SRM/NPR-inspired forensic branch and paired clean/degraded consistency training.

This repository provides a self-contained inference release. The full frozen OpenCLIP visual state is included, so inference does not download the base model and does not require retraining.

Release artifacts

File	Purpose
model.safetensors	Preferred full FP32 inference state dict
resolved_config.yaml	Frozen model, preprocessing, training, and evaluation configuration
thresholds.json	Frozen internal-validation operating threshold and score semantics
preprocessor_config.json	Portable input/preprocessing contract
inference_example.py	Minimal single-image safetensors inference example
requirements.txt	Additional Hub-side inference dependencies
SHA256SUMS.txt	SHA-256 for every published artifact except itself

The trusted source checkpoint used for the lossless safetensors conversion had SHA-256 468d3a58603fdf8dfe1b234a24fd8e52a99c6e4881e921bef6bb0cea64bbac34. Optimizer and recovery state are intentionally not published because they are unnecessary for frozen-weight inference.

Architecture and parameters

• Frozen semantic branch: OpenCLIP ViT-B-32, pretrained tag laion2b_s34b_b79k.
• Forensic inputs: RGB patches, DCT bands, 30-channel SRM responses, and 3-channel NPR residuals.
• Forensic encoder: trainable ResNet-18-style encoder with attention pooling.
• Fusion: projected 256-dimensional semantic and forensic representations.
• Total parameters: 99,423,442.
• Trainable parameters: 11,574,226.
• Frozen parameters: 87,849,216.
• Input: 224×224 RGB.
• Output: one AIGI logit; sigmoid converts it to a ranking score.

Evaluation

The principal external result uses a frozen 4,000-image expanded strict-unseen-generator set and 21 conditions (clean plus 20 transformed conditions). The test manifest and robustness matrix are identical to those used for the M3 release.

Metric	Value
Clean AUROC	0.9308195
Clean balanced accuracy	0.85775
Non-clean mean AUROC	0.9163169
Non-clean mean balanced accuracy	0.8370375
Worst AUROC	0.8524566
Worst condition	six-stage random reposting profile

The frozen decision threshold is 0.99658203125, selected only on the internal validation split. The sigmoid score is not a calibrated deployment-domain probability. Recalibrate on a target deployment domain rather than defaulting to 0.5.

Installation and loading

Use the repository code revision verified against this release:

python -m pip install "git+https://github.com/lsy640/TikTok_project_5.git@869b0a950fbd54defc5ab389be322b79556f2975"
python -m pip install "safetensors>=0.4,<1" "huggingface-hub>=1,<2"

Download the immutable v1.0.0 release and load the preferred safetensors file:

from pathlib import Path
import torch
from huggingface_hub import snapshot_download
from safetensors.torch import load_file
from repostguard.config import load_config
from repostguard.models import build_model

root = Path(snapshot_download(
    repo_id="LLL640/RepostGuard-Lite-M2-train-v3",
    revision="v1.0.0",
))
config = load_config(root / "resolved_config.yaml")
model = build_model(config, load_pretrained=False)
model.load_state_dict(load_file(root / "model.safetensors"), strict=True)
model.eval()

For single-image inference with the safe tensor release, run:

python inference_example.py /path/to/image.jpg --device cpu

model.safetensors is non-pickle tensor storage and is the only model-weight artifact published in this repository.

Reproducibility boundary

• inference_code_revision: 869b0a950fbd54defc5ab389be322b79556f2975 (strict loading and finite forward pass verified).
• training_code_revision: not recorded in the original run card. Do not treat the inference revision as proven byte-identical training code.
• Training manifest SHA-256: fc0a7ab732faeb604ed1e77281fada715d7cffb353974a4985820548d871d9d6.
• Internal validation manifest SHA-256: 11bfa4b6d7c538ce0a3d774c3f2902ac11ffc7dbe513de354f87fbaad1d6b6ba.
• Expanded strict-unseen 4k manifest SHA-256: 59ca2e4ca966dac9fa4fb55281153f93e5becdd3e25da83bc2dff3fad36126cd.
• Robustness matrix SHA-256: 69531f3f7111651808c99f14f89723bf631345878b1cbd0cbe0eee8531dde83c.

The release enables frozen-weight inference without retraining. Exact from-scratch training reproducibility additionally requires the original data revisions and the unrecorded training-time source state.

Limitations and intended use

• Intended for research and evaluation of AIGI detection under reposting transformations.
• Not a calibrated authenticity probability, legal determination, copyright judgment, or sole moderation signal.
• The principal strict-unseen test contains a limited set of generator and real-image sources and cannot represent all future models or domains.
• M2/M3 have known blind spots on Hourglass, DFGAN, and GALIP diagnostic slices.
• Current core results are from a single training seed.
• Low-FPR deployment performance and target-platform calibration require further work.
• Evaluate distribution shift, false-positive cost, and subgroup behavior before deployment.

License and attribution

Model weights are released under CC BY-NC-SA 4.0 to preserve the recorded upstream Community Forensics non-commercial ShareAlike constraints. Source code is MIT. OpenCLIP base weights and all datasets remain subject to their own licenses and terms; see LICENSE.md.

Project repository: https://github.com/lsy640/TikTok_project_5