# Simple Detection of AI-Generated Images based on Noise Correlation

Antoine Mallet, Arthur Méreur, Minoru Kuribayashi, Rémi Cogranne, Patrick Bas

► To cite this version:

Antoine Mallet, Arthur Méreur, Minoru Kuribayashi, Rémi Cogranne, Patrick Bas. Simple Detection of AI-Generated Images based on Noise Correlation. International conference on Advanced Machine Learning and Data Science (AMLDS) 2025, Jul 2025, Tokyo, Japan. hal-05041276

HAL Id: hal-05041276

https://hal.science/hal-05041276v1

Submitted on 21 Apr 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Simple Detection of AI-Generated Images based on Noise Correlation

Antoine Mallet*

Computer Sc. and Digital Society Lab.
University of Technology of Troyes

Troyes, France

antoine.mallet@utt.fr

*Corresponding author

Rémi Cogranne

Computer Sc. and Digital Society Lab.
University of Technology of Troyes

Troyes, France

remi.cogranne@utt.fr

Arthur Méreur

University of Technology of Troyes
Troyes, France

arthur.mereur@utt.fr

Minoru Kuribayashi

Center for Data-Driven Science and AI
Tohoku University

Sendai, Japan

kminoru@tohoku.ac.jp

Patrick Bas

UMR 9189 CRISTAL

Univ. Lille, CNRS, Centrale Lille
Lille, France

patrick.bas@cnrs.fr

**Abstract**—The present paper deals with the problem of the detection of AI-generated images. It first proposes a forensic analysis, based on spatial correlations of the noise present in images, that can be used as fingerprints of both real and generated images. In particular, fingerprints can be extracted in each color channel, and complement each other during detection. The proposed detection scheme is a 3-step classifier, consisting only of a set of simple log-linear classifiers. This scheme is shown to perform much better than a standalone detector. The performance of the method is first assessed in an In-Distribution scenario, where an error probability of less than 1% is achieved on uncompressed images. It is then compared to state-of-the-art detectors in an out-of-distribution scenario, where significant performance gains are achieved. Results highlight the good generalization performances to unseen generators and the liability of color channels, specifically the chrominance CbCr for current state-of-the-art generators. A robustness analysis to JPEG compression also shows promising results for our method.

**Index Terms**—Forensics, Synthetic image detection, image processing, statistical correlation, machine learning.

## I. INTRODUCTION

Recent advances in generative AI have democratized access to fake image synthesis. While this helps users who can easily create image content, it also creates serious societal concerns, such as the need of trust in digital media veracity. For instance, the United States and the European Union already issued notices asking to watermark generated content. In response to these concerns, researchers have produced a large literature on detection methods for images synthesized by generative adversarial networks (GANs) and, more recently, diffusion models (DMs).

Current state-of-the art models are able to produce images that are indistinguishable from a real photography by the naked eye. This level of realism forces the community away from purely semantic feature analyses, such as incongruous

shapes or textures [24]. On the other hand, it is now well known that both GANs and DMs leave "fingerprints" on the images, that can be used for forensic analyses [7]. Detectors based on Deep Learning (DL) have been investigated, either taking these fingerprints as input [27], or to extract them directly [2]. While it generally offers good performances for in-distribution (ID) data, DL-based detection does not ensure good generalization to out-of-distribution (OOD) test samples, on top of introducing a "black-box" relationship with respect to the detection tools.

This paper studies the statistical distribution of the noise in AI-generated images, and aims to show that it differs from the one found in natural photographs. More particularly, we will investigate, based on previous observations, such as in [31], the exploitability of this distribution gap in different color channels, and their complementarity, when put together for classification. On top of this feature, a 3-step classification process based on logistic regression classifiers is proposed. Put back in context, we believe that this study can help to better understand current exploitable caveats of the generators, and, similarly to previous works, to show that both good performance and generalization can be achieved even without DL-based detectors. The key contributions of the present work are the following:

1. A novel simple statistical analysis illustrating a current caveat of synthetic image generators exploitable for detection, and with room for improvement via a rich-model approach.

2. A DL-free holistic detection scheme offering convincing performances in both ID and OOD scenarios.

The rest of the paper is organized as follows: Section II presents the strengths and limitations of the state-of-the-art. Section III details and illustrates the proposed method. Section IV describes the experimental setup and section V analyzes the results showing their promises and shortcomings.

<footnote>This work has been funded by the French ANR PACES project No. ANR-21-CE39-0002.</footnote>
Finally, Section VI draws future leads and concludes.

## II. RELATED WORK

There is a vast and rapidly expanding literature about AI-generated images detection. A large part of it relies – at least in part – on DL techniques, be it for feature extraction [2], [8], classification with handcrafted features [3], [27] or both [1], [17]. As one can notice, DL-based methods are not employed in complete black-box setups, but are often complemented with "manual" forensic analyses.

Researchers have, for instance, extracted features directly from the spatial representation of the image. Nataraj et al. [27] computes co-occurrence matrices directly on the pixels separated in different channels; Barni et al. [3] augments this approach with cross-channel co-occurrences. Both then use an identical convolutional neural network (CNN) as a classifier. Tan et al. [30] proposes to look at neighbouring pixel dependencies, similar to co-occurrence, as input to a ResNet block-based classifier. Siamese networks are used in [17] to exploit noise pattern inconsistencies of face manipulation methods.

Another popular case is to look at the spectral representation of the image. Let us mention first the SynthBuster method [2], that learns to detect discriminative frequencies in the Fourier domain. Note that this analysis is commonly used to illustrate the upsampling fingerprint found in both GANs and DMs [6], [7], [11], [33].

There is also a branch of research focusing on embedded representations of samples. Most recently, the contrastive language-image pre-training (CLIP) embedding has received particular attention [8], [9], [16]. The former, for instance, feeds CLIP embeddings to a simple classifier and shows good performances, with small training sets. This approach was also explored using deep layers of a ResNet architecture [21], or to build a residual extractor [20].

On another note, as recently highlighted [31], color channels bear a lot of discriminative information. This has been frequently leveraged in the literature, such as with the approach based on co-occurrence between color channels, presented in [3], [27], [28]. Finally, it appears from [4], [18], [25] that chrominance components (i.e. the YCbCr color space) perform the best.

## III. METHODOLOGY

### A. Rationale

Natural image acquisition is a stochastic process due to the quantum nature of light. As a result, any natural image captured with a camera comes with an inherent noise that follows an univariate Gaussian distribution in the RAW domain [10]. After in-camera and post-processing, however, spatial dependencies necessarily occur between neighbouring pixels. The resulting multivariate distribution of image noise is an effective tool in image forensics for image source identification [23], steganography [12], [14], [29] and to characterize cover sources in operational steganalysis [22].

<figure><img src="image_2.png" /><figcaption>Fig. 1: Correlation matrices averaged from 80 images over different sources and filters computed on 8 × 4 patches. Top to bottom: Dreamshaper v7, Pixart-α, Kandinsky v2.1, Playground-2.5, Alaska. Left to right: Y, Cb, Cr.</figcaption></figure>

While state-of-the-art image generators now compete with real images in terms of semantics, there is evidence that they do not replicate realistic noise [8], [19]. In terms of spatially distributed correlation of the noise, the differences between 3 generators (Pixart-α, Kandinsky-v2.1 and Playground-v2.5) and real images coming from the Alaska dataset [5] are illustrated in Fig. 1. The correlation matrices describe the averaged local dependencies of the pixel noise, and are computed on 4 × 8 neighbourhoods in the luminance (Y) and chrominance (Cb and Cr) channels.

### B. Noise Correlation Matrix Estimation

Extracting the noise from an image without side-information is uneasy [13]. To get rid of the semantics while preserving pixel correlation, we have analysed the impact of several more or less sophisticated noise extraction methods. In the present paper, we suggest using common noise extraction methods, such as the following trivial Laplace filter:

$$ \mathcal{L}_4 = \begin{bmatrix} 0 & 1 & 0 \\ 1 & -4 & 1 \\ 0 & 1 & 0 \end{bmatrix}. \qquad (1) $$
Recent works have shown that such a simple tool is indeed adequate [26] in extracting a fingerprint of the processing pipeline.

Once we compute the noise residual of any color channel $\mathcal{F}^c = I^c \circled_4$, where 'circled' the 2D convolution operator, we still need to extract the regions of the image, which are the least impacted by the content. The correlation over whole noise residuals of size $M \times M$ is intractable as a forensic feature, it would result in $M^4$ correlation coefficients per color channel. And as we compute the sampled correlation matrix, noted $R$, we therefore decide to divide our noise residuals into 8 × 8 blocks, which we vectorize and note $b_i^c, 0 \le i < (\frac{M}{8})^2, 0 \le c \le 2$. Note that the block size is chosen to capture the impact of the JPEG compression pipeline.

Now, to limit the presence of the content in the final correlation estimation, we sample the set of blocks $\mathfrak{B}_{\mathcal{F}^c}$ that are jointly the lowest ranked in terms of intra-mean and intra-variance:

$$ \mathfrak{B}_{\mathcal{F}^c} = \left\{ b_i^c / b_i^c \in \min_i^T \mathrm{Var}[b_i^c] \cup \min_i^T \mathrm{Var}[b_i^c] \right\}, \quad (2) $$

where $\mathrm{Var}[\cdot]$ is the variance, $\mathbb{E}[\cdot]$ the mean value, and $\min_i^T S$ is the set of the $T$ lowest elements of set $S$. The selected blocks are therefore ensured to contain both the lowest amount of shapes and textures. The correlation matrix $R^c$ is then computed between the samples in the set $\mathfrak{B}_{\mathcal{F}^c}$:

$$ R^c = (r^c)_{u,v} = \frac{\mathrm{Cov}(b_u^c, b_v^c)}{\sqrt{\mathrm{Var}(b_u^c)\mathrm{Var}(b_v^c)}}. \quad (3) $$

And since the correlation matrix is symmetrical and its diagonal is constant at 1, we build the correlation feature $S_{R^c}$ with the lower triangle coefficients of the correlation matrix:

$$ S_{R^c} = \mathrm{tri}(R^c). \quad (4) $$

### C. Hypothesis Framework

Before detailing the proposed three-step detection method, let us briefly recall some primers from hypothesis testing. Mathematically, a statistical test is a discrete mapping $\delta : \mathbb{R} \to \{\mathcal{H}_0, \dots, \mathcal{H}_N\}$ between a given observation $\mathbf{x} \in \mathcal{X}$ and the set of all possible statistical hypotheses denoted $\{\mathcal{H}_0, \dots, \mathcal{H}_N\}$. In our case, the observation is the correlation between pixels, as described in Equation 4. As the goal is to detect synthetic images, we decide between the following binary hypotheses: $\mathcal{H}_0$: “the inspected image is a genuine photograph” and $\mathcal{H}_1$: “the inspected image comes from an AI-generative model”.

In the present paper, we will assume that a binary classifier is based on a scoring function $\lambda : \mathcal{X} \to [0, 1]$ assigning a real value to an image, presumably telling us whether it detects the sample as real or fake. The ensuing classifier $\delta : \mathbb{R} \to \{\mathcal{H}_0, \mathcal{H}_1\}$ is then defined as:

$$ \delta(\mathbf{x}) = \begin{cases} \mathcal{H}_0 & \text{if } \lambda(\mathbf{x}) \le \tau, \\ \mathcal{H}_1 & \text{if } \lambda(\mathbf{x}) > \tau \end{cases}, \quad (5) $$

where $\tau$ the threshold minimizing the error rate.

<figure><img src="image_3.png" /><figcaption>Fig. 2: Illustration of the proposed three-step methodology: (a) a multi-class classifier predicts which generator a given image comes from; (b) a pool of binary classifiers trained on each AI-generator; (c) a final binary score is given aggregating outputs of (a) and (b).</figcaption></figure>

Similarly, we will assume that a multi-class classifier is based on a $N$-valued scoring function $\phi : \mathcal{X} \to [0, 1]^N$, $\phi(\mathbf{x}) = (\phi_1(\mathbf{x}), \dots, \phi_N(\mathbf{x}))$, where $\sum_i \phi_i(x) = 1$. Typically, the class (i.e. the generative model), from which the sample $\mathbf{x}$ comes, can be associated with the largest score:

$$ \delta(\mathbf{x}) = \arg\max_n \phi_n(\mathbf{x}). \quad (6) $$

Last but not least, the performance of our detector will be assessed using the minimal probability of error $P_E$ under equal prior probabilities:

$$ P_E = \min_{\tau \in \mathbb{R}} \frac{1}{2} \mathbb{P}(\lambda(\mathbf{x}) > \tau | \mathcal{H}_0) + \mathbb{P}(\lambda(\mathbf{x}) \le \tau | \mathcal{H}_1), \quad (7) $$

This allows for considering the case of unbalanced classes, which is the case in the present paper.

### D. Detection Scheme

We propose a three-step classification process based on the correlation feature, schematized in Fig. 2.

The first step (a) consists of a multi-classifier $f : \mathcal{X} \to [0, 1]^N$, with $f(\mathbf{x}) = (f_1(\mathbf{x}), \dots, f_N(\mathbf{x}))$, that classifies images between the $N$ generative models considered in the training phase.

The second step (b) is a pool $g$ of $N$ real/fake binary classifiers trained for specific generators $g = \{g_i : \mathcal{X} \to [0, 1], \forall i \in \mathbb{N}, 1 \le i \le N\}$, and $g(\mathbf{x}) = (g_1(\mathbf{x}), \dots, g_N(\mathbf{x}))$.

The third step (c) is a binary classifier $h : [0, 1]^{2N} \to [0, 1]$, that takes as input the concatenation of the output vectors $f(\mathbf{x})$ and $g(\mathbf{x})$, and outputs the final score $h(f(\mathbf{x}), g(\mathbf{x}))$.

Finally, the proposed detection scheme is:

$$ \delta(\mathbf{x}) = \begin{cases} \mathcal{H}_0 & \text{if } h(f(\mathbf{x}), g(\mathbf{x})) \le \tau, \\ \mathcal{H}_1 & \text{if } h(f(\mathbf{x}), g(\mathbf{x})) > \tau \end{cases}, \quad (8) $$

To highlight the relevance of this method, all detectors are set as simple logistic regression classifiers. We expect that, for a synthetic image, the multi-classifier will be able to identify the generator of the image accurately; on the opposite, we expect it to be indecisive for a real image. Therefore,
<table><caption>TABLE I: List of generators used to create our training and ID-testing datasets and OOD-testing set.</caption><thead><tr><th></th><th>Train/ID-test</th><th>#imgs</th></tr></thead><tbody><tr><td rowspan="12">Diffusion models</td><td>Animagine XL-3.1</td><td>12K</td></tr><tr><td>DeepFloyd XL</td><td>12K</td></tr><tr><td>DreamLike-Phr 2.0</td><td>12K</td></tr><tr><td>Kandinsky v2.1</td><td>12K</td></tr><tr><td>Pixart-α</td><td>12K</td></tr><tr><td>Playground v2</td><td>12K</td></tr><tr><td>Shifted Diff.</td><td>12K</td></tr><tr><td>Stable-Diff. v1.5</td><td>12K</td></tr><tr><td>Stable-Diff. v2.1</td><td>12K</td></tr><tr><td>Stable-Diff. XL</td><td>12K</td></tr><tr><td>Dreamshaper v7</td><td>12K</td></tr><tr><td>Latent Diff.</td><td>12K</td></tr><tr><td rowspan="3">GANs</td><td>gigaGAN</td><td>12K</td></tr><tr><td>StyleGAN 2</td><td>12K</td></tr><tr><td>StyleGAN 3</td><td>12K</td></tr></tbody></table><table><thead><tr><th></th><th>OOD-test</th><th>#imgs</th></tr></thead><tbody><tr><td rowspan="7">SynthBuster [2]</td><td>dalle2</td><td>1K</td></tr><tr><td>dalle3</td><td>1K</td></tr><tr><td>Firefly</td><td>1K</td></tr><tr><td>Glide</td><td>1K</td></tr><tr><td>midjourney-v5</td><td>1K</td></tr><tr><td>Stable-Diff. v1.3</td><td>1K</td></tr><tr><td>Stable-Diff. v1.4</td><td>1K</td></tr><tr><td rowspan="3">Additional</td><td>Stable-Diff. v2</td><td>1K</td></tr><tr><td>Stable-Diff. XL</td><td>1K</td></tr><tr><td></td><td></td></tr><tr><td></td><td>Leonardo</td><td>0.1K</td></tr><tr><td></td><td>LongCaptions</td><td>0.1K</td></tr><tr><td></td><td>Midjourney-v6</td><td>0.1K</td></tr><tr><td></td><td>Lexica</td><td>0.1K</td></tr><tr><td></td><td>α-genmo</td><td>0.1K</td></tr><tr><td></td><td>Gemini</td><td>0.1K</td></tr></tbody></table>

<figure><img src="image_4.png" /><figcaption>Fig. 3: ROC curves of the different feature aggregations on the ID-test set. The x-axis gives the probability of false-alarm for a given threshold $\tau$, commonly noted $\alpha_0(\tau)$, while the y-axis gives the power of the test $\beta(\tau)$.</figcaption></figure>

combining the outputs of both steps would benefit the overall accuracy score.

## IV. EXPERIMENTAL SETUP

### A. Image Datasets

To perform synthetic image detection using the proposed method, we generated a large training dataset based on a wide range of text-to-image generators, shown in the left column of table I, consisting of 12 DMs and 3 GANs. For each, 7000 images are kept for the training, and the rest (approximately 5000 each) is kept for the ID-testing evaluation.

For testing, we used the well-known SynthBuster dataset [2], that consists in 9 sets of 1000 images, coming from 9 different generators. Additionally, we report results for a smaller amount of images from a few proprietary generators. The list of the generators in the OOD-testing set is given in the right column of table I.

For the opposite class of real images, we chose the images from the ALASKA#2 dataset [5], as they are very diverse by design, ensuring they constitute a challenging counterpart to the diversity of generated images, in both the training and testing phases.

### B. Comparative baselines

To evaluate the relevance of our approach, we compare it with several methods from the literature. First, we selected some "off-the-shelf" tools, meaning that we kept the weights given by the authors, and directly tested them on our OOD-testing images. In this fashion, we selected the works from Corvi et al. [7], Wang et al. [32], and Gragnaniello et al. [15]. Then, we also compared our approach with feature-based ones, that we retrained on the ID images listed in table I. We include the works of Nataraj et al. [27], Barni et al. [3], which propose single-channel and cross-channel co-occurrence matrices, respectively. The proposed features are of dimensions 256 × 256 per co-occurrence matrices, i.e. times 3 and 6 respectively. These dimensions are intractable for log-linear classifiers. Therefore, we reduce the dimensionality of

the features to 6000 dimensions via a principal component analysis on each co-occurrence matrix separately, retaining over 99.99% of the total initial variance. Note that, while this dimensionality reduction is not present in the original methods, it preserves the information contained in the original features. For both methods, we extract the features for the whole dataset, and use them to train the same classifier as the one presented in section III-D.

## V. RESULTS AND ANALYSES

### A. In-Distribution Accuracy

Let us first compare the performances obtained by the proposed methods with the different feature aggregations. Results in the form of minimal probability of error, as in Eq 7, are provided in table II. The highest performance is obtained, unsurprisingly, when aggregating the information from the 3 color channels. Furthermore, the complementarity of luminance and chrominance is well illustrated here, since the single color features as well as the Cb+Cr one perform worse than the luminance-chrominance aggregations.

While the results are lower for the co-occurrence matrices, a similar comment can be made. To emphasize the performances of our method, we also provide the ROC curves for the same methods in Fig. 3. Note that the y-axis only displays the tests with a power $\beta > 0.95$. The ROC curves, beside the overall good performances, highlight that our method can operate even at low false alarm rates in the ID scenario.

### B. Out-of-Distribution Robustness

The performance of the proposed method is then assessed against the methods described in section IV-B. Results are given in table III. Notice that this time the best feature is the Y+Cb aggregation, although closely followed by the Y+Cb+Cr. On average, the proposed method largely outperforms the competition. Note, however, that the performances of the co-occurrence features are significantly higher in the OOD test scenario than in the ID test one. Also,
<table><caption>TABLE II: In-distribution $P_E$ (in %) for the different input features used to train the proposed detector.</caption><thead><tr><th></th><th>Y</th><th>Cb</th><th>Cr</th><th>Y-Cb</th><th>Y-Cr</th><th>Cb-Cr</th><th>Y-Cb-Cr</th><th>Nataraj et al. [27]</th><th>Barni et al. [3]</th></tr></thead><tbody><tr><th>P<sub>E</sub></th><td>1.82</td><td>2.36</td><td>2.07</td><td>0.81</td><td>0.68</td><td>1.14</td><td>0.62</td><td>20.98</td><td>18.02</td></tr></tbody></table>

<figure><img src="image_5.png" /><figcaption>Fig. 4: ROC curves of the Y-Cb-Cr feature aggregation against different JPEG QFs, and without compression.</figcaption></figure>

the method from Corvi et al. [7] outperforms the proposed method on Midjourney-v5 and the stable-diffusion 1.X family. This is because this model is trained on images coming from similar models to these images. In particular, around 1% error is obtained for the images from Adobe Firefly. This source is consistently easy (at least relative to the average performance on the OOD test set) for all methods. A visual investigation showed that many of the images of this set in particular had poor quality color channels, or appeared like grayscale, indicating that the color channels were almost similar. This resulted in almost diagonal co-occurrence between color channels, explaining the detectability.

Contrarily to the ID test scenario, this time the chrominance channels are more discriminative than the luminance, for which the $P_E$ is multiplied by a factor of 5. In comparison, the $P_E$ of chrominances stays relatively even from the ID to the OOD tests. Once again, we highlight the power hidden in the distribution of the colors of generated images that forensic methods can leverage.

### C. Effect of JPEG Compression

In this last section, we repeat our experiment, but we first compress all our images with JPEG at quality factors in {60, 70, 80, 90}. The results in ID and OOD tests are shown in table IV. Considering that the JPEG format heavily tackles the noise in images, the drop in accuracy is surprisingly low, showing that not only the high frequencies are important for synthetic image detection of deepfakes. Staying below 10% $P_E$ is an encouraging result for this method, designed to be sensitive to noise reduction techniques. ROC curves for the ID test case are provided in figure 4. Progressive decrease in the AUC is also visible when decreasing the quality factor.

## VI. CONCLUSION AND FUTURE WORK

In this work we investigated the correlation matrix of the noise as a novel simple forensic feature for synthetic image detection. Combined with the proposed 3-steps architecture, this completely DL-free approach has demonstrated very promising performances, as well as an encouraging resistance to JPEG compression.

The room for improvement for this approach is still large. While one can explore and aggregate more color spaces, another can also explore noise extraction methods, such as residual or fingerprint extraction.

## REFERENCES

[1] Weiming Bai, Yufan Liu, Zhipeng Zhang, Xinyi Zhang, Bo Wang, Chengwei Peng, Weiming Hu, and Bing Li. Learn from noise: Detecting deepfakes via regional noise consistency. In 2024 International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE, 2024.

[2] Quentin Bammey. Synthbuster: Towards detection of diffusion model generated images. IEEE Open Journal of Signal Processing, 2023.

[3] Mauro Barni, Kassem Kallas, Ehsan Nowroozi, and Benedetta Tondi. Cnn detection of gan-generated face images based on cross-band co-occurrences analysis. In 2020 IEEE international workshop on information forensics and security (WIFS), pages 1–6. IEEE, 2020.

[4] Beijing Chen, Xin Liu, Yuhui Zheng, Guoying Zhao, and Yun-Qing Shi. A robust gan-generated face detection method based on dual-color spaces and an improved xception. IEEE Transactions on Circuits and Systems for Video Technology, 32(6):3527–3538, 2021.

[5] Rémi Cogranne, Quentin Giboulot, and Patrick Bas. Alaska# 2: Challenging academic research on steganalysis with realistic images. In 2020 IEEE WIFS, 2020.

[6] Riccardo Corvi, Davide Cozzolino, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. Intriguing properties of synthetic images: from generative adversarial networks to diffusion models. In Proceedings of the IEEE/CVF Conference on CVPR, pages 973–982, 2023.

[7] Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. On the detection of synthetic images generated by diffusion models. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE, 2023.

[8] Davide Cozzolino, Giovanni Poggi, Riccardo Corvi, Matthias Nießner, and Luisa Verdoliva. Raising the bar of ai-generated image detection with clip. In Proceedings of the IEEE/CVF Conference on CVPR, pages 4356–4366, 2024.

[9] Vincenzo De Rosa, Fabrizio Guillaro, Giovanni Poggi, Davide Cozzolino, and Luisa Verdoliva. Exploring the adversarial robustness of clip for ai-generated image detection. In 2024 IEEE International Workshop on Information Forensics and Security (WIFS), pages 1–6. IEEE, 2024.

[10] Alessandro Foi, Mejdi Trimeche, Vladimir Katkovnik, and Karen Egiazarian. Practical poissonian-gaussian noise modeling and fitting for single-image raw-data. IEEE transactions on image processing, 17(10):1737–1754, 2008.

[11] Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In International conference on machine learning, pages 3247–3258. PMLR, 2020.

[12] Eva Giboulot, Patrick Bas, and Rémi Cogranne. Multivariate side-informed gaussian embedding minimizing statistical detectability. IEEE TIFS, 17:1841–1854, 2022.

[13] Quentin Giboulot. Statistical Steganography based on a Sensor Noise Model using the Processing Pipeline. PhD thesis, Université de Technologie Troyes, 2022.
<table><caption>TABLE III: Minimum probability of error of the proposed method and comparative baselines. The best score is underlined for each generator. Note that for the off-the-shelf methods, the generated images were directly fed to the detectors, and no reprocessing, such as cropping, were performed. This resulted in incompatibilities for the images from the Leonardo generator, hence the missing results.</caption><thead><tr><th></th><th>Method</th><th>dalle2</th><th>dalle3</th><th>Firefly</th><th>Glide</th><th>midj-v5</th><th>SD-1.3</th><th>SD-1.4</th><th>SD-2</th><th>SD-XL</th><th>Bing Creator</th><th>LongCaptions</th><th>Midj-v6</th><th>Lexica</th><th>α-genmo</th><th>Meta AI</th><th>Avg</th></tr></thead><tbody><tr><td rowspan="3">Of-the-shelf</td><td>Corvi et al. [7]</td><td>47.50</td><td>48.05</td><td>11.80</td><td>38.80</td><td><strong>0.15</strong></td><td><strong>0.05</strong></td><td><strong>0.00</strong></td><td><strong>1.30</strong></td><td>0.85</td><td>2.00</td><td>7.50</td><td>5.1</td><td>9.64</td><td><strong>0.00</strong></td><td>11.00</td><td>12.25</td></tr><tr><td>Wang et al. [32]</td><td>28.75</td><td>49.85</td><td>19.95</td><td>44.65</td><td>41.70</td><td>38.65</td><td>38.50</td><td>45.50</td><td>43.80</td><td>37.00</td><td>16.50</td><td>16.50</td><td>16.50</td><td>16.50</td><td>43.00</td><td>33.16</td></tr><tr><td>Grag. et al. [15]</td><td>12.65</td><td>49.65</td><td>6.85</td><td>30.15</td><td>22.95</td><td>18.35</td><td>18.20</td><td>28.85</td><td>15.20</td><td>35.50</td><td>24.58</td><td>16.50</td><td>16.50</td><td>16.50</td><td>39.00</td><td>23.43</td></tr><tr><td rowspan="2">Retrained</td><td>Nataraj et al. [27]</td><td>13.59</td><td>21.70</td><td>0.97</td><td>39.41</td><td>8.49</td><td>25.94</td><td>27.48</td><td>26.38</td><td>21.07</td><td>9.50</td><td>7.50</td><td>5.21</td><td>6.20</td><td>10.50</td><td>0.50</td><td>14.96</td></tr><tr><td>Barni et al. [3]</td><td>9.47</td><td>26.31</td><td>1.30</td><td>36.86</td><td>6.97</td><td>23.41</td><td>25.18</td><td>25.51</td><td>19.27</td><td>5.00</td><td>11.00</td><td>6.25</td><td>5.11</td><td>8.00</td><td><strong>0.00</strong></td><td>13.98</td></tr><tr><td rowspan="8">Ours</td><td>Y</td><td>34.25</td><td>39.19</td><td>13.62</td><td>10.85</td><td>4.46</td><td>3.10</td><td>3.10</td><td>6.09</td><td>7.90</td><td>6.98</td><td>9.88</td><td>10.64</td><td>9.77</td><td>1.52</td><td>15.50</td><td>11.79</td></tr><tr><td>Cb</td><td><strong>2.95</strong></td><td>0.35</td><td><strong>0.29</strong></td><td>16.50</td><td>1.40</td><td>3.80</td><td>3.40</td><td>2.32</td><td>0.20</td><td><strong>0.00</strong></td><td>0.58</td><td><strong>5.32</strong></td><td><strong>0.57</strong></td><td>0.51</td><td>0.50</td><td>2.58</td></tr><tr><td>Cr</td><td>3.40</td><td>1.77</td><td><strong>0.29</strong></td><td>23.55</td><td>1.85</td><td>1.00</td><td>1.05</td><td>3.32</td><td>0.30</td><td><strong>0.00</strong></td><td>1.16</td><td>7.45</td><td><strong>0.57</strong></td><td>1.01</td><td><strong>0.00</strong></td><td>3.11</td></tr><tr><td>Y+Cb</td><td>5.50</td><td><strong>0.10</strong></td><td>1.78</td><td><strong>10.30</strong></td><td>1.15</td><td>1.75</td><td>1.05</td><td>2.06</td><td>0.25</td><td><strong>0.00</strong></td><td>1.16</td><td>6.38</td><td><strong>0.57</strong></td><td>0.51</td><td>1.50</td><td><strong>2.27</strong></td></tr><tr><td>Y+Cr</td><td>5.00</td><td>0.20</td><td>1.49</td><td>15.45</td><td>1.55</td><td>1.05</td><td>0.85</td><td>3.07</td><td><strong>0.10</strong></td><td><strong>0.00</strong></td><td>1.74</td><td><strong>5.32</strong></td><td><strong>0.57</strong></td><td>0.51</td><td>1.00</td><td>2.53</td></tr><tr><td>Cb+Cr</td><td>2.50</td><td>0.30</td><td><strong>0.29</strong></td><td>18.40</td><td>1.25</td><td>1.40</td><td>1.45</td><td>1.91</td><td>0.60</td><td><strong>0.00</strong></td><td><strong>0.58</strong></td><td><strong>5.32</strong></td><td><strong>0.57</strong></td><td>0.51</td><td>0.50</td><td>2.37</td></tr><tr><td>Y+Cb+Cr</td><td>3.65</td><td><strong>0.10</strong></td><td>0.86</td><td>12.85</td><td>2.25</td><td>1.40</td><td>0.95</td><td>4.18</td><td>0.10</td><td><strong>0.00</strong></td><td>1.16</td><td><strong>5.32</strong></td><td><strong>0.57</strong></td><td>0.51</td><td>0.50</td><td>2.29</td></tr><tr><td>JPEG QF</td><td>Ø</td><td>90</td><td>80</td><td>70</td><td>60</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ID</td><td>0.62</td><td>5.91</td><td>6.64</td><td>7.79</td><td>8.95</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>OOD</td><td>2.34</td><td>6.43</td><td>7.38</td><td>11.09</td><td>8.54</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

<table><caption>TABLE IV: ID and OOD $P_E$ (in %) for the Y+Cb+Cr features when applying different JPEG compression factors.</caption><tr><td>JPEG QF</td><td>Ø</td><td>90</td><td>80</td><td>70</td><td>60</td></tr><tr><td>ID</td><td>0.62</td><td>5.91</td><td>6.64</td><td>7.79</td><td>8.95</td></tr><tr><td>OOD</td><td>2.34</td><td>6.43</td><td>7.38</td><td>11.09</td><td>8.54</td></tr></table>

[14] Quentin Giboulot, Rémi Cogranne, and Patrick Bas. Detectability-based jpeg steganography modeling the processing pipeline: The noise-content trade-off. *IEEE TIFS*, 16:2202–2217, 2021.

[15] Diego Gragnaniello, Davide Cozzolino, Francesco Marra, Giovanni Poggi, and Luisa Verdoliva. Are gan generated images easy to detect? a critical analysis of the state-of-the-art. In *2021 IEEE international conference on multimedia and expo (ICME)*, pages 1–6. IEEE, 2021.

[16] Sohail Ahmed Khan and Duc-Tien Dang-Nguyen. Clipping the deception: Adapting vision-language models for universal deepfake detection. In *Proceedings of the 2024 International Conference on Multimedia Retrieval*, pages 1006–1015, 2024.

[17] Staffy Kingra, Naveen Aggarwal, and Nirmal Kaur. Siamnet: exploiting source camera noise discrepancies using siamese network for deepfake detection. *Information Sciences*, 645:119341, 2023.

[18] Haodong Li, Bin Li, Shunquan Tan, and Jiwu Huang. Identification of deep network generated images using disparities in color components. *Signal Processing*, 174:107616, 2020.

[19] Yanhao Li, Quentin Bammey, Marina Gardella, Tina Nikoukhah, Jean-Michel Morel, Miguel Colom, and Rafael Grompone Von Gioi. Masksim: Detection of synthetic images by masked spectrum similarity analysis. In *Proceedings of the IEEE/CVF Conference on CVPR*, 2024.

[20] Bo Liu, Fan Yang, Xiuli Bi, Bin Xiao, Weisheng Li, and Xinbo Gao. Detecting generated images by real images. In *European Conference on Computer Vision*, pages 95–110. Springer, 2022.

[21] Peter Lorenz, Ricard L Durall, and Janis Keuper. Detecting images generated by deep diffusion models using their local intrinsic dimensionality. In *Proceedings of the IEEE/CVF International Conference on Computer Vision*, pages 448–459, 2023.

[22] Antoine Mallet, Rémi Cogranne, and Patrick Bas. Linking intrinsic difficulty and regret to properties of multivariate gaussians in image steganalysis. In *12th ACM Workshop on Information Hiding and Multimedia Security (ACM IH&MMSEC’24)*. ACM, 2024.

[23] Antoine Mallet, Rémi Cogranne, Patrick Bas, and Quentin Giboulot. Identification de développements d’images par matrices de corrélations. In *XXIXème Colloque Francophone de Traitement du Signal et des Images*, 2023.

[24] Falko Matern, Christian Riess, and Marc Stamminger. Exploiting visual artifacts to expose deepfakes and face manipulations. In *2019 IEEE Winter Applications of Computer Vision Workshops (WACVW)*, pages 83–92. IEEE, 2019.

[25] Songwen Mo, Pei Lu, and Xiaoyong Liu. Ai-generated face image identification with different color space channel combinations. *Sensors*, 22(21):8228, 2022.

[26] Arthur Méreur, Rémi Cogranne, Antoine Mallet, and Minoru Kuribayashi. Forensics analysis of residual noise texture in digital images for detection of deepfake. In *IEEE, editor, ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)*, 2025.

[27] Lakshmanan Nataraj, Tajuddin Manhar Mohammed, Shivkumar Chandrasekaran, Arjuna Flenner, Jawadul H Bappy, Amit K Roy-Chowdhury, and BS Manjunath. Detecting gan generated fake images using co-occurrence matrices. *arXiv preprint arXiv:1903.06836*, 2019.

[28] Tong Qiao, Yuxing Chen, Xiaofei Zhou, Ran Shi, Hang Shao, Kunye Shen, and Xiangyang Luo. Csc-net: Cross-color spatial co-occurrence matrix network for detecting synthesized fake images. *IEEE Transactions on Cognitive and Developmental Systems*, 16, 2023.

[29] Théo Taburet, Patrick Bas, Wadih Sawaya, and Rémi Cogranne. Jpeg steganography and synchronization of det coefficients for a given development pipeline. In *Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security*, pages 139–149, 2020.

[30] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up-sampling operations in cnn-based generative network for generalizable deepfake detection. In *Proc. of the IEEE/CVF Conference on CVPR*, pages 28130–28139, 2024.

[31] Lea Uhlenbrock, Davide Cozzolino, Denise Moussa, Luisa Verdoliva, and Christian Riess. Did you note my palette? unveiling synthetic images through color statistics. In *Proceedings of the 2024 ACM Workshop on Information Hiding and Multimedia Security*, pages 47–52, 2024.

[32] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. In *Proc. of the IEEE/CVF conference on computer vision and pattern recognition*, pages 8695–8704, 2020.

[33] Xu Zhang, Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in gan fake images. In *2019 IEEE international workshop on information forensics and security (WIFS)*, pages 1–6. IEEE, 2019.