# CLIP-Flow: A Universal Discriminator for AI-Generated Images Inspired by Anomaly Detection

Zhipeng Yuan, Kai Wang, Weize Quan, Dong-Ming Yan, Tieru Wu

<figure><img src="image_1.png" /></figure>

## To cite this version:

Zhipeng Yuan, Kai Wang, Weize Quan, Dong-Ming Yan, Tieru Wu. CLIP-Flow: A Universal Discriminator for AI-Generated Images Inspired by Anomaly Detection. 1st Deepfake Forensics Workshop: Detection, Attribution, Recognition, and Adversarial Challenges in the Era of AI-Generated Media (DFF 2025) at ACM Multimedia 2025, Oct 2025, Dublin, Ireland. pp.1-9, 10.1145/3746265.3759663. hal-05296631

HAL Id: hal-05296631

https://hal.science/hal-05296631v1

Submitted on 7 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>
# CLIP-Flow: A Universal Discriminator for
AI-Generated Images Inspired by Anomaly
Detection

Zhipeng Yuan, Kai Wang, Weize Quan, Dong-Ming Yan, and Tieru Wu

## Abstract

With the rapid advancement of AI generative models, the visual quality of AI-generated images (AIIs) has become increasingly close to natural images, which inevitably raises security concerns. Most AII detectors often employ the conventional image classification pipeline with natural images and AIIs (generated by a generative model), which can result in limited detection performance for AIIs from unseen generative models. To solve this, we proposed a universal AI-generated image detector from the perspective of anomaly detection. Our discriminator does not need to access any AIIs and learn a generalizable representation with unsupervised learning. Specifically, we use the pre-trained CLIP encoder as the feature extractor and design a normalizing flow-like unsupervised model. Instead of AIIs, proxy images, e.g., obtained by applying a spectral modification operation on natural images, are used for training. Our models are trained by minimizing the likelihood of proxy images, optionally combined with maximizing the likelihood of natural images. Extensive experiments demonstrate the effectiveness of our method on AIIs produced by various image generators.

## Index Terms

Image forensics, anomaly detection, normalizing flow, CLIP

## I. INTRODUCTION

Nowadays, we can easily see fake pictures on the Internet, many of which are synthetic images generated by deep learning algorithms. Indeed, with the rapid development and maturity of deep generative models (such as generative adversarial models and diffusion models), people can easily generate the desired high-quality images. Although image generation technology benefits our lives in some aspects, there will inevitably be people who will use this technology maliciously. For example, AI-generated images (AIIs) can be used for personal and political attacks, making it easier for people to believe the content of fake news. Therefore, it is urgent to develop a universal discriminator of AIIs created by various generative models and tools.

By choosing a classifier and using two groups of natural images and AIIs as training samples, we can learn an image discriminator in a supervised manner, which is shown in the top of Fig. 1. This approach performs well in identifying generated images similar to those in the training set, but when tested on other types of generated images, the performance can drop drastically. For example, a classifier trained using natural images and ProGAN-generated images [1] can well identify images generated by ProGAN or generative models with similar structures to ProGAN (such as StyleGAN [2]). However, when faced with images created by other generative models with different structures (such as diffusion models), the classification performance can be very poor. Unfortunately, in the real world, new generative models are constantly emerging, and it is not realistic to update trained detectors at all times to deal with these new models. Our goal in this paper is to achieve high generalization performance for the AII detector, i.e., with high classification accuracy on AIIs created by unknown generative models, by exploring a new approach inspired by anomaly detection.

As mentioned above and observed in the influential paper of [3], the supervised learning approach may have limitations in learning only the very specific artifacts present in the AIIs in the training set, leading to limited generalization capability. This has motivated us to tackle the detector generalization problem by exploiting a different learning mechanism of anomaly detection [4]. In existing anomaly detection methods, training is usually performed only on normal samples and any sample that deviates significantly from the normal samples will be classified as an anomaly. Intuitively, in our AII detection task, normal samples correspond to natural images. Given this idea, we started by considering using only natural images to train anomaly detection methods. Unfortunately, limited generalization performance has been achieved with various anomaly detection algorithms and feature extractors, including the well-known CLIP embedding extractor [5] which has proven its great utility in AII detection as shown in [3]. One possible explanation for this limited generalization is the difficulty in using existing anomaly detection algorithms to capture the highly diverse representations of natural images. This has led us to reconsider the problem formulation and to better adapt the anomaly detection mechanism to our task of AII detection.

We assume that natural images follow an underlying distribution that is different from AIIs. As mentioned previously, it is difficult to identify AIIs by modeling this distribution, which has motivated us to rethink the problem from a new perspective

Z. Yuan and T. Wu are with Jilin University, Jilin, China. (Corresponding author: Tieru Wu.)

K. Wang is with Univ. Grenoble Alpes, CNRS, Grenoble INP, GIPSA-lab, Grenoble, France.

W. Quan and D.-M. Yan are with the MAIS & NLPR, Institute of Automation, Chinese Academy of Sciences, Beijing, China, and also with School of Artificial Intelligence, the University of Chinese Academy of Sciences, Beijing, China.
<figure><img src="image_3.png" /><figcaption>Fig. 1: The previous supervised methods used binary classification of natural image (NI) and AI-generated image (AII), and we use the flow model for likelihood optimization of proxy image (optionally also with NI) from the perspective of anomaly detection.</figcaption></figure>

with a focus on the so-called proxy images whose distribution deviates from that of natural images. Indeed, it is believed that despite the high visual quality, synthetic images in general exhibit deviations in the spatial domain (e.g., different correlations between pixel values) [6] or the frequency domain (e.g., artifacts in certain frequency bands) [7], [8]. Following this idea, we apply spatial or spectral operation (e.g., the random frequency masking [8] which shows the best performance in our study) on natural images to construct a group of processed images, regard them as anomalous samples, extract their CLIP features, and train a detector by minimizing their likelihood based on a normalizing flow-like model, a popular tool for anomaly detection [9]–[11] (bottom of Fig. 1). Well-constructed proxy images are expected to be closer to AIs than to natural images in the feature space. This “unconventional” anomaly detection framework called CILP-Flow shows very good performance on benchmark test sets of natural image and AII classification, notably by not using any AII during training. We further improve the generalization performance by proposing a self-supervised (in a loose sense) framework in which proxy images and their corresponding natural images are used together to train the flow model (still without using any AII during training), with minimization and maximization of the likelihood of the two types of images, respectively.

Our contributions are summarized as follows:

* To the best of our knowledge, we conducted a careful and exploratory study on the usefulness of methods in the field of anomaly detection to solve the problem of AII detection.

* When we only use anomalous frequency-masked proxy images for training, we achieve very competitive AII detection performance on popular benchmark test sets with an mAP of 93.85% and an accuracy of 84.93%.

* Our model has good flexibility and can also be trained in a self-supervised manner: when trained using both natural images and proxy images, the model achieves higher detection performance with an mAP of 95.56% and an accuracy of 87.30%.

* We proposed a novel approach to solving the AII detection problem that is inspired by anomaly detection, and we hope that our work can inspire future efforts in this promising research direction.

## II. RELATED WORK

### A. AI-Generated Image Detection

**Spatial-Based Approaches.** This kind of methods applies deep models to learn discrimination features in the pixel space directly. Wang et al. [12] explored two simple image augmentation operations (i.e., JPEG compression and Gaussian blur) to improve the CNN-based detector. Chai et al. [13] constructed a patch-based AII detector using the truncated part of CNN backbones (e.g., Xception and ResNet50). Natraj et al. [14] combined the co-occurrence matrix of the input pixels and CNN to distinguish between natural images and AIs, while Bai et al. [15] identified AI-generated images based on co-occurrence relations in the feature channels of CNN model. Ojha et al. [3] applied the ViT encoder of the pre-trained CLIP to detect
fake images and obtained decent generalization performance. With the help of a pre-trained diffusion model, Wang et al. [16] extracted the reconstruction error between the input image and its reconstructed version to distinguish between real images and diffusion-generated images.

**Frequency-Based Approaches.** This type of methods identifies fake images based on revealing traces in the frequency domain. Zhang et al. [17] and Frank et al. [18] designed classifiers that take the frequency spectrum as input, attempting to capture the artifacts caused by the up-sampler of GAN models. Durall et al. [19] and Dzanic et al. [20] developed AI-generated image discriminators based on the difference between natural images and AIs in the high-frequency component. Liu et al. [21] utilized the frequency spectrum information of learnable image noise patterns to detect AIs. Recently, authors of [8] and [22] explored frequency-based modification to improve the generalization of an AII detector with traditional binary cross-entropy loss.

## B. Anomaly Detection

Anomaly detection usually requires that only normal samples are used during training, and the model is asked to distinguish whether a sample is normal or anomalous during testing. Typical applications of anomaly detection include industrial defect detection, disease detection, video surveillance, etc. [4]. Recent anomaly detection methods for images can be roughly grouped into three main categories: reconstruction-based methods, distillation-based methods, and density-based methods.

**Reconstruction-Based Methods.** This kind of methods reconstructs normal samples in the training stage, and classifies samples that cannot be well reconstructed in testing as anomalies. GANomaly [23] uses the GAN structure as a reconstruction model. DRAEM [24] uses an autoencoder as a reconstruction model and, for better performance, also trains a discriminator to identify artificially generated anomalous samples using Perlin noise.

**Distillation-Based Methods.** STFPM [25] attempts to distinguish anomalous samples by training a student model to learn the intermediate layer features extracted by a teacher model for normal samples. After such a distillation procedure, the student model tends to have a higher loss on anomalous samples. RD [26] is another distillation-based method, where a one-class embedding is learned to represent normal data.

**Density-Based Methods.** Such methods extract features of normal samples and model the distribution of these features. An anomaly score can be derived usually based on the probability of a sample under the learned distribution. Different methods mainly differ in terms of feature extractor and distribution modeling [27], [28]. For example, PaDiM [28] detects anomalies by extracting features of local image patches and then learning a multivariate Gaussian distribution of normal patches during training. FastFlow [10] and CFlow [11] use the normalizing flow, a powerful generative model based on neural network, for the distribution learning. Considering the conceptual and computational simplicity of density-based approaches compared to other methods, we use the normalizing flow model in our work for AI-generated image discrimination.

# III. PROPOSED METHOD

The proposed method is illustrated in Fig. 2. Unlike previous supervised detectors, our method does not need any AI-generated image during training. Instead, we create and use proxy images, e.g., obtained by applying random frequency masking on natural images. We then use the CLIP model to extract features from the proxy images, adapt them with dimension reduction (DR) and normalization, and turn the distribution of adapted features into a normal distribution using unsupervised normalizing flow. Our model can also be jointly trained with unprocessed natural images (upper part of Fig. 2). During testing, we can calculate an anomaly score based on the flow model to classify images.

## A. Feature Extractor

In many computer vision tasks, the ViT encoder of the large-scale pre-trained CLIP model [5] is often used as the feature extraction backbone. Similarly, Ojha et al. [3] and Li and Wang [22] observed superior forensic performance in AI-generated image detection with CLIP features compared to other popular image embeddings. We have similar observations in our preliminary experiments when combining different image features with the flow model. Therefore, in order to construct a universal AII discriminator, in our work, we also choose the ViT encoder of CLIP to extract the image feature. Particularly, ViT extracts a high-dimensional feature from an image $x$, and we reduce its dimension to balance the performance and the computational cost. We then normalize it, and the feature adaptation process is written as follows:

$$z = \frac{DR(\phi(x))}{\|DR(\phi(x))\|_2}, \qquad (1)$$

where $\phi(.)$ is the CLIP feature extraction function and $DR(.)$ is the dimension reduction operation with a linear layer.
<figure><img src="image_4.png" /><figcaption>Fig. 2: Framework of CLIP-Flow.</figcaption></figure>

## B. Proxy Image Construction

We have attempted different methods to construct proxy images. Comparative experimental results are presented in Section IV, which show that operations in either spatial or spectral domain can work well in our proposed framework and that the frequency masking operation described below achieves the best detection performance.

There are many works that exploit frequency information for AII detection, with the basic idea that there is a telltale difference between natural and generated images in the frequency domain of the image. We also use frequency information, more specifically by applying random frequency masking [8] to process the original image. This is combined with a novel learning framework inspired by anomaly detection to achieve good generalization and flexibility. Let $x$ be a natural image, we first use the Fourier transform to convert it to the frequency domain. Then, we produce a random binary mask and use it to mask a ratio of a certain part (low, mid, high) of the frequency spectrum (please refer to [8] for more details). We convert this masked frequency spectrum back to RGB space with the inverse Fourier transform to obtain a proxy image $x'$. The whole process is as follows:

$$x' = ifft mask \odot ifft(x), \qquad (2)$$

where $fft(.)$ represents Fast Fourier transform, $mask$ is a random binary mask, $\odot$ is the element-wise multiplication, and $ifft(.)$ represents inverse Fast Fourier transform.

As mentioned in Section I, performance remains limited if we train only on natural images $x$ with anomaly detection algorithms, possibly due to the high diversity of natural images and the blindness regarding the anomalies to be detected. Instead, decent performance is achieved if we train a flow model only with proxy images $x'$ by minimizing their likelihood values (bottom branch of Fig. 2). This implies that frequency-masked proxy images are in general closer to AIIs than to natural images in the feature space. Performance can be further improved if we use both natural images $x$ and proxy images $x'$ for training (top and bottom branches of Fig. 2), by maximizing and minimizing the likelihood value, respectively. This can be loosely considered as a self-supervised learning method that demonstrates strong zero-shot performance on the AII detection task. Both learning methods are inspired by anomaly detection and, to the best of our knowledge, are new in the AII detection literature.

## C. Normalizing Flow and Training Objective

For distribution learning and sample likelihood estimation, we choose the normalizing flow model [29], [30], which is a popular probabilistic method for generative modeling. It is able to map a simple probability distribution (such as the Gaussian distribution) to a complex distribution via a series of reversible transformations with the trick of change of variable. With the flow model, it is also possible to transform a complex distribution into a simple one, e.g., the Gaussian distribution. In our CLIP-Flow method, we assume that the distribution of the adapted CLIP feature $z$ of natural image follows a (complex)
<table><caption>TABLE I: The performance (in AP, %) of our model and existing methods. In the last group of rows, N means model trained only on natural images with likelihood maximization, P means model trained only on proxy images with likelihood minimization, and N+P means model trained on both types of images above with likelihood maximization and minimization respectively. The symbols are the same in the following tables.</caption><thead><tr><th rowspan="2">Methods</th><th rowspan="2">Variant</th><th colspan="6">Generative Adversarial Networks</th><th colspan="2">Deep Fakes</th><th colspan="2">Low level vision</th><th colspan="2">Perceptual loss</th><th colspan="3">Guided</th><th colspan="4">Glide</th><th rowspan="2">DALL-E</th><th rowspan="2">Total</th></tr><tr><th>Pro-GAN</th><th>Cycle-GAN</th><th>Big-GAN</th><th>Style-GAN</th><th>Gau-GAN</th><th>Star-GAN</th><th>SITD</th><th>SAN</th><th>CRN</th><th>IMLE</th><th>200 steps</th><th>200 w/ CFG</th><th>100 steps</th><th>100 27</th><th>50 27</th><th>100 10</th><th>mAP</th></tr></thead><tbody><tr><td rowspan="10">Anomaly Detection</td><td>PaDiM</td><td>43.04</td><td>40.86</td><td>47.06</td><td>45.58</td><td>39.86</td><td>42.13</td><td>46.21</td><td>48.40</td><td>54.34</td><td>42.18</td><td>39.22</td><td>41.04</td><td>52.62</td><td>59.57</td><td>51.56</td><td>40.77</td><td>38.81</td><td>41.03</td><td>73.61</td><td>46.73</td></tr><tr><td>CFA</td><td>57.62</td><td>66.60</td><td>56.41</td><td>71.13</td><td>68.63</td><td>70.23</td><td>41.54</td><td>66.38</td><td>51.65</td><td>77.34</td><td>83.08</td><td>68.64</td><td>54.50</td><td>46.34</td><td>53.94</td><td>69.44</td><td>74.36</td><td>69.00</td><td>40.95</td><td>62.51</td></tr><tr><td>GANormaly</td><td>48.93</td><td>49.39</td><td>52.33</td><td>44.37</td><td>45.80</td><td>49.51</td><td>52.97</td><td>49.74</td><td>62.29</td><td>37.57</td><td>38.88</td><td>39.49</td><td>50.41</td><td>56.47</td><td>48.60</td><td>39.71</td><td>37.01</td><td>40.67</td><td>56.38</td><td>47.39</td></tr><tr><td>DSR</td><td>50.35</td><td>45.80</td><td>50.04</td><td>48.46</td><td>51.29</td><td>45.79</td><td>56.47</td><td>47.79</td><td>52.07</td><td>40.44</td><td>45.58</td><td>47.48</td><td>45.86</td><td>48.02</td><td>45.60</td><td>46.87</td><td>45.37</td><td>49.70</td><td>47.36</td><td>48.39</td></tr><tr><td>DRAEM</td><td>92.73</td><td>43.24</td><td>59.50</td><td>94.27</td><td>51.48</td><td>97.15</td><td>48.54</td><td>41.53</td><td>51.09</td><td>47.00</td><td>40.52</td><td>41.73</td><td>95.28</td><td>90.72</td><td>95.33</td><td>43.59</td><td>43.54</td><td>42.67</td><td>98.35</td><td>64.12</td></tr><tr><td>STFPM</td><td>53.60</td><td>55.16</td><td>47.89</td><td>45.88</td><td>53.32</td><td>62.27</td><td>51.11</td><td>52.85</td><td>58.08</td><td>44.64</td><td>49.31</td><td>41.79</td><td>51.69</td><td>53.11</td><td>51.11</td><td>43.77</td><td>41.05</td><td>46.75</td><td>60.58</td><td>50.73</td></tr><tr><td>RD</td><td>47.46</td><td>46.54</td><td>48.43</td><td>40.60</td><td>41.96</td><td>49.92</td><td>49.52</td><td>42.62</td><td>54.34</td><td>34.29</td><td>32.21</td><td>38.32</td><td>47.02</td><td>43.06</td><td>47.28</td><td>34.74</td><td>33.45</td><td>33.85</td><td>50.11</td><td>42.93</td></tr><tr><td>DFM</td><td>49.00</td><td>50.92</td><td>47.02</td><td>48.86</td><td>46.67</td><td>50.00</td><td>49.69</td><td>49.16</td><td>53.43</td><td>45.71</td><td>42.57</td><td>47.90</td><td>59.60</td><td>58.85</td><td>59.79</td><td>52.64</td><td>49.52</td><td>52.18</td><td>59.25</td><td>51.20</td></tr><tr><td>FastFlow</td><td>49.08</td><td>49.49</td><td>44.68</td><td>45.81</td><td>47.58</td><td>49.37</td><td>53.00</td><td>48.30</td><td>55.53</td><td>62.88</td><td>61.13</td><td>48.58</td><td>54.58</td><td>54.95</td><td>55.12</td><td>54.95</td><td>53.69</td><td>55.01</td><td>64.40</td><td>53.06</td></tr><tr><td>CFlow</td><td>48.97</td><td>55.10</td><td>51.05</td><td>50.44</td><td>47.34</td><td>45.87</td><td>48.09</td><td>48.65</td><td>49.38</td><td>45.88</td><td>53.92</td><td>40.88</td><td>75.21</td><td>59.88</td><td>76.73</td><td>50.40</td><td>47.72</td><td>44.60</td><td>56.43</td><td>54.33</td></tr><tr><td rowspan="3">CNNSpot</td><td>Blur+JPEG (0.1)</td><td><b>100.00</b></td><td>93.47</td><td>84.50</td><td>99.54</td><td>89.49</td><td>98.15</td><td>89.02</td><td>73.75</td><td>59.47</td><td>98.24</td><td>98.40</td><td>73.72</td><td>70.62</td><td>71.00</td><td>70.54</td><td>80.65</td><td>84.91</td><td>82.07</td><td>70.59</td><td>83.58</td></tr><tr><td>Blur+JPEG (0.5)</td><td><b>100.00</b></td><td>96.83</td><td>88.24</td><td>98.29</td><td>98.09</td><td>95.44</td><td>66.27</td><td>86.00</td><td>61.20</td><td><b>98.94</b></td><td><b>99.52</b></td><td>68.57</td><td>66.00</td><td>66.68</td><td>65.39</td><td>73.29</td><td>78.02</td><td>76.23</td><td>65.93</td><td>81.52</td></tr><tr><td>ViT:CLIP (B+J 0.5)</td><td>99.98</td><td>93.32</td><td>83.63</td><td>88.14</td><td>92.81</td><td>84.62</td><td>67.23</td><td><b>93.48</b></td><td>55.21</td><td>88.75</td><td>96.22</td><td>55.74</td><td>52.52</td><td>54.51</td><td>52.20</td><td>56.64</td><td>61.13</td><td>56.64</td><td>62.74</td><td>73.44</td></tr><tr><td rowspan="3">PatchForensics</td><td>ResNet50-Layer1</td><td>98.86</td><td>72.04</td><td>68.79</td><td>92.96</td><td>55.90</td><td>92.06</td><td>60.18</td><td>65.82</td><td>52.87</td><td>68.74</td><td>67.59</td><td>70.05</td><td>87.84</td><td>84.94</td><td>88.10</td><td>74.54</td><td>76.28</td><td>75.84</td><td>77.07</td><td>75.28</td></tr><tr><td>Xception-Block2</td><td>80.88</td><td>72.84</td><td>71.66</td><td>85.75</td><td>65.99</td><td>69.25</td><td>76.55</td><td>76.19</td><td>76.34</td><td>74.52</td><td>68.52</td><td>75.03</td><td>87.10</td><td>86.72</td><td>86.40</td><td>85.37</td><td>83.73</td><td>78.38</td><td>75.67</td><td>77.73</td></tr><tr><td>Co-Occur</td><td>99.74</td><td>80.95</td><td>50.61</td><td>98.63</td><td>53.11</td><td>67.99</td><td>59.14</td><td>68.98</td><td>60.42</td><td>73.06</td><td>87.21</td><td>70.20</td><td>91.21</td><td>89.02</td><td>92.39</td><td>89.32</td><td>88.35</td><td>82.79</td><td>80.96</td><td>78.11</td></tr><tr><td>FreqSpec</td><td>CycleGAN</td><td>55.39</td><td><b>100.00</b></td><td>75.08</td><td>55.11</td><td>66.08</td><td><b>100.00</b></td><td>45.18</td><td>47.46</td><td>57.12</td><td>53.61</td><td>50.98</td><td>57.72</td><td>77.72</td><td>77.25</td><td>76.47</td><td>68.58</td><td>64.58</td><td>61.92</td><td>67.77</td><td>66.21</td></tr><tr><td>DIRE</td><td>-</td><td><b>100.00</b></td><td>77.12</td><td>76.30</td><td>92.64</td><td>71.08</td><td><b>100.00</b></td><td><b>95.32</b></td><td>62.02</td><td>63.30</td><td>95.77</td><td>94.03</td><td>83.34</td><td>95.19</td><td>93.89</td><td>95.12</td><td>93.78</td><td>95.56</td><td>95.99</td><td>61.27</td><td>86.41</td></tr><tr><td>UnivFD</td><td>LC</td><td><b>100.00</b></td><td>99.46</td><td><b>99.59</b></td><td>97.24</td><td><b>99.98</b></td><td>99.60</td><td>82.45</td><td>61.32</td><td>79.02</td><td>96.72</td><td>99.00</td><td>87.77</td><td>99.14</td><td>92.15</td><td>99.17</td><td>94.74</td><td>95.34</td><td>94.57</td><td>97.15</td><td>93.38</td></tr><tr><td>Freq-mask</td><td>CLIP</td><td><b>100.00</b></td><td>99.04</td><td>96.89</td><td>92.66</td><td>99.83</td><td>98.86</td><td>77.17</td><td>67.41</td><td>75.80</td><td>78.83</td><td>95.85</td><td>81.77</td><td>95.45</td><td>80.93</td><td>96.48</td><td>90.66</td><td>91.71</td><td>90.23</td><td>86.73</td><td>89.28</td></tr><tr><td>OnlyReal</td><td>-</td><td>99.99</td><td><b>100.00</b></td><td>99.48</td><td><b>99.77</b></td><td>99.96</td><td><b>100.00</b></td><td>94.75</td><td>40.65</td><td>68.01</td><td>89.25</td><td>98.96</td><td><b>89.93</b></td><td><b>99.90</b></td><td><b>99.64</b></td><td><b>99.91</b></td><td>96.55</td><td>97.60</td><td>96.36</td><td><b>99.99</b></td><td>93.18</td></tr><tr><td rowspan="3">Ours</td><td>N</td><td>87.99</td><td>63.86</td><td>74.00</td><td>57.69</td><td>63.39</td><td>93.40</td><td>66.89</td><td>40.37</td><td>51.34</td><td>37.26</td><td>45.58</td><td>61.18</td><td>42.24</td><td>42.90</td><td>42.50</td><td>34.73</td><td>35.75</td><td>34.79</td><td>54.43</td><td>54.23</td></tr><tr><td>P</td><td>99.86</td><td>98.40</td><td>98.38</td><td>89.42</td><td>99.84</td><td>98.13</td><td>92.23</td><td>84.18</td><td>72.09</td><td>98.14</td><td>98.79</td><td>76.29</td><td>98.49</td><td>94.33</td><td>98.46</td><td>95.49</td><td>97.07</td><td>96.48</td><td>97.15</td><td>93.85</td></tr><tr><td>N+P</td><td>99.94</td><td>99.87</td><td>99.24</td><td>97.10</td><td>99.92</td><td>99.50</td><td>87.34</td><td>80.06</td><td><b>79.48</b></td><td>94.85</td><td>96.94</td><td>87.78</td><td>99.41</td><td>96.93</td><td>99.44</td><td><b>99.35</b></td><td><b>99.59</b></td><td><b>99.28</b></td><td>99.55</td><td><b>95.56</b></td></tr></tbody></table>

distribution as $z \sim p_Z(z)$, the chosen simple distribution is denoted $u \sim p_U(u)$, and the reversible bijective transformation between the two distributions is denoted $g^{-1}: Z \to U$. Then, the log-likelihood of any $z \in Z$ can be estimated as:

$$ \begin{aligned} \log p_Z(z, \theta) &= \log p_U(u) + \log |\det(J)| \\ &= \log p_U(g^{-1}(z)) + \log |\det(J)|, \end{aligned} \quad (3) $$

where the matrix $J = \nabla_z g^{-1}(z; \theta)$ is the Jacobian of a bijective invertible flow model parameterized by $\theta$.

We then calculate for $z$ a KL divergence to measure the difference between its distribution and the approximated distribution with the transformation of flow model:

$$ \begin{aligned} D_{KL}[p_Z^*(z)||p_Z(z)] &= -\mathbb{E}_{p_Z^*(z)}[\log p_Z(z; \theta) - \log p_Z^*(z)] \\ &= -\mathbb{E}_{p_Z^*(z)}[\log p_Z(z; \theta)] + c_1, \end{aligned} \quad (4) $$

where $p_Z^*$ represents the true distribution of $z$, $p_Z$ represents the approximated distribution by using the flow model parameterized by $\theta$, and $c_1$ is a term independent of $\theta$.

Here we propose a new flow model which can handle two types of features having “complementary” distributions. More specifically, for feature $z'$ of proxy image, we assume that it follows a distribution related to that of natural image as $z' \sim K/p_Z(z')$ (under the mild condition of $p_Z(z') \neq 0, \forall z'$), where $K$ is a normalization constant to ensure a valid probability density function integrating to 1. This is a reasonable assumption because at certain position in feature space with high probability density of natural image, it certainly leads to low probability density for artificial proxy image at that position, and vice versa. Similar to Eq. (4), we have:

$$ \begin{aligned} D_{KL}[p_{Z'}^*(z')||\frac{K}{p_Z(z')}] &= -\mathbb{E}_{p_{Z'}^*(z')}[\log(\frac{K}{p_Z(z'; \theta)})] + c_2 \\ &= \mathbb{E}_{p_{Z'}^*(z')}[\log p_Z(z'; \theta)] + c_3, \end{aligned} \quad (5) $$

where $p_{Z'}^*$ represents the true distribution of $z'$, $K/p_Z$ is the approximated distribution by using the flow model parameterized by $\theta$, and $c_2$ and $c_3$ are terms independent of $\theta$.

For the flow model to work properly, we need to minimize the KL divergences in Eqs. (4) and (5), which elegantly leads to a maximization of the log-likelihood of natural images and a minimization of the log-likelihood of proxy images, according to these two equations (please note their different signs for the non-constant term). Therefore, we use the likelihood estimation to obtain the following loss function to minimize:

$$ \mathcal{L}(\theta) = -\frac{1}{N_o} \sum_{n=1}^{N_o} \log p_Z(z_n; \theta) + \frac{1}{N_p} \sum_{m=1}^{N_p} \log p_Z(z'_m; \theta), \quad (6) $$
where $N_o$ is the number of natural images, $N_p$ is the number of proxy images, and $z_n$ and $z'_m$ represent respectively the feature of the natural and proxy image. The first term on the right side of Eq. (6) means to maximize the likelihood of natural images, while the second term means to minimize the likelihood of proxy images. We have a so-called self-supervised training when we use both terms. In contrast, when we use only one type of images for unsupervised training, one of the two terms vanishes, e.g., the first term vanishes when we train the flow model using only proxy images.

We set the transformed distribution as a multidimensional Gaussian distribution $u \sim N(0, I)$. At the same time, since the loss is the sum of each dimension, following [11] we divide it by the number of dimensions $C$ to normalize the loss. Finally, the training objective of the flow model is to minimize the following loss function:

$$Loss = - \frac{1}{2N_o} \sum_{n=1}^{N_o} \frac{\|u_n\|_2^2 - 2 \log |\det(J)|}{C} + \frac{1}{2N_p} \sum_{m=1}^{N_p} \frac{\|u'_m\|_2^2 - 2 \log |\det(J)|}{C}, \quad (7)$$

where $u_n = g^{-1}(z_n; \theta)$ and $u'_m = g^{-1}(z'_m; \theta)$ are the transformed features of the flow model corresponding to the natural image and the proxy image, respectively.

## D. Anomaly Score

Our goal is to determine whether an image is a natural image or an AII. For this purpose and as shown in Eq. (8) below, we naturally define and use an anomaly score based on the negative log-likelihood of the sample. The normalized log-likelihood term in Eq. (8) is exactly the same as that used in the flow model loss function in Eq. (7), where we minimize (or maximize) the log-likelihood of proxy images (or natural images). Therefore, natural images tend to have low values of this score (because of the negative sign before the log-likelihood term in the definition of the anomaly score), while AI-generated images tend to have high values.

$$score = - \frac{\log p_Z(z; \theta)}{C} = \frac{\|u\|_2^2 - 2 \log |\det(J)|}{2C}. \quad (8)$$

# IV. EXPERIMENTS

## A. Experimental Settings

**Datasets.** Following the representative methods on AII detection [3], [12], we used natural images from LSUN for training, with a size of 256 × 256 pixels and 20 categories. Detection models are evaluated on the benchmark (in total 19 datasets) shared by the above two references [3], [12], including six GAN models: ProGAN, CycleGAN, BigGAN, StyleGAN, GauGAN, and StarGAN; DeepFakes; two low-level vision models: SITD and SAN; two perceptual loss-based models: CRN and IMLE; three diffusion models: Guided, LDM (latent diffusion model) with three different generation modes, and Glide with three different variants; DALL-E. These tested samples have diverse content and can be used to comprehensively assess the performance of detection models.

**Metrics.** Following [3], [12], we use the average precision (AP) and classification accuracy for comparison. AP is a comprehensive reflection of the classification ability of our anomaly scores. In order to find a fixed threshold to calculate the accuracy, we created a validation set. Positive samples are LSUN natural images that are neither in the training set nor in the testing set, and negative samples are frequency-perturbed images by masking the frequency band of (30, 100), generated in a different way than the frequency masking used for the training set.

**Implementation Details.** Our model is implemented with PyTorch and trained on NVIDIA GeForce RTX GPU. We use Adam optimizer with a learning rate of 10⁻⁴ and batch size of 128. CLIP: ViT-L/14 is the feature extractor. The bijection mapping in the flow model is implemented with an affine coupling layer [29]. Proxy images are generated by random frequency masking [8] with the masking ratio of 1.0 (for P mode, our method trained only with proxy images) and 0.1 (for N+P mode, our method trained with both natural and proxy images) in the low part of the spectrum. Experimentally, for P mode, it is advantageous to use proxy images with large changes, in order to confidently minimize likelihood values on them. For N+P mode, since it is a self-supervised approach, we can use proxy images with small changes for strict distinction under the setting of a hard discrimination problem. Proxy images constructed with frequency masking achieve the best AII detection performance, and the results obtained with other types of proxy images are presented and compared later in this section. During training, all images are resized to 256 × 256 with bilinear interpolation and then randomly cropped to 224 × 224. The normalization uses the same mean and variance as in the CLIP model [5]. The P mode takes 30 epochs and the N+P mode takes 10 epochs. During testing, the central 224 × 224 crop of the 256 × 256 resized image is used for evaluation.
<table><caption>TABLE II: The performance (in Accuracy, %) of our model and existing methods.</caption><thead><tr><th rowspan="2">Methods</th><th rowspan="2">Variant</th><th colspan="5">Generative Adversarial Networks</th><th colspan="2">Low level vision</th><th colspan="2">Perceptual loss</th><th rowspan="2">Guided</th><th colspan="3">LDM</th><th colspan="2">Glide</th><th rowspan="2">DALL-E</th><th rowspan="2">Total</th></tr><tr><th>Pro-GAN</th><th>Cycle-GAN</th><th>Big-GAN</th><th>Style-GAN</th><th>Gau-GAN</th><th>Star-GAN</th><th>SITD</th><th>SAN</th><th>CRN</th><th>IMLE</th><th>200 steps</th><th>200 w/ CFG</th><th>100 steps</th><th>100 27</th><th>100 27</th><th>Avg. acc</th></tr></thead><tbody><tr><td rowspan="4">CNNSpot</td><td>Blur+JPEG (0.1)</td><td>99.99</td><td>85.20</td><td>70.20</td><td>85.70</td><td>78.95</td><td>91.70</td><td>53.47</td><td>66.67</td><td>86.31</td><td>86.26</td><td>60.07</td><td>54.03</td><td>54.96</td><td>54.14</td><td>60.78</td><td>63.80</td><td>65.66</td><td>55.58</td><td>69.58</td></tr><tr><td>Blur+JPEG (0.5)</td><td><b>100.00</b></td><td>80.77</td><td>58.98</td><td>69.24</td><td>79.25</td><td>80.94</td><td>51.06</td><td>56.94</td><td>48.69</td><td></td><td></td><td>51.33</td><td>51.93</td><td>51.28</td><td>54.43</td><td>55.97</td><td>54.36</td><td>52.26</td><td>64.73</td></tr><tr><td>Oracle (B+J 0.5)</td><td><b>100.00</b></td><td>90.88</td><td>82.40</td><td>93.11</td><td>93.52</td><td>87.27</td><td>62.48</td><td><b>76.67</b></td><td>57.04</td><td><b>95.28</b></td><td><b>96.93</b></td><td>65.20</td><td>63.15</td><td>62.39</td><td>61.50</td><td>65.36</td><td>69.52</td><td>66.18</td><td>60.10</td><td>76.26</td></tr><tr><td>ViT:CLIP (B+J 0.5)</td><td>98.94</td><td>78.80</td><td>60.62</td><td>60.56</td><td>66.82</td><td>62.31</td><td>52.28</td><td>65.28</td><td>47.97</td><td>64.09</td><td>79.54</td><td>50.66</td><td>50.74</td><td>51.04</td><td>50.76</td><td>52.15</td><td>53.07</td><td>52.06</td><td>53.18</td><td>60.57</td></tr><tr><td rowspan="2">PatchForensics</td><td>ResNet50-Layer1</td><td>94.38</td><td>67.38</td><td>64.62</td><td>82.26</td><td>57.19</td><td>80.29</td><td>55.32</td><td>64.59</td><td>51.24</td><td>54.29</td><td>55.11</td><td>65.14</td><td>79.09</td><td>76.17</td><td>79.36</td><td>67.06</td><td>68.55</td><td>68.04</td><td>69.44</td><td>68.39</td></tr><tr><td>Xception-Block2</td><td>75.03</td><td>68.97</td><td>68.47</td><td>79.16</td><td>64.23</td><td>63.94</td><td>75.54</td><td>75.14</td><td><b>75.28</b></td><td>72.33</td><td>55.30</td><td>67.41</td><td>76.50</td><td>71.00</td><td>75.77</td><td>74.81</td><td>73.28</td><td>68.52</td><td>67.91</td><td>71.24</td></tr><tr><td>Co-Occur</td><td>-</td><td>97.70</td><td>63.15</td><td>53.75</td><td>92.50</td><td>51.10</td><td>54.70</td><td>57.10</td><td>63.06</td><td>55.85</td><td>65.65</td><td>65.80</td><td>60.50</td><td>70.70</td><td>70.55</td><td>71.00</td><td>70.25</td><td>69.60</td><td>69.90</td><td>67.55</td><td>66.86</td></tr><tr><td>FreqSpec</td><td>CycleGAN</td><td>49.90</td><td><b>99.90</b></td><td>50.50</td><td>49.90</td><td>50.30</td><td>99.70</td><td>50.10</td><td>50.00</td><td>48.00</td><td>50.60</td><td>50.10</td><td>50.90</td><td>50.40</td><td>50.40</td><td>50.30</td><td>51.70</td><td>51.40</td><td>50.40</td><td>50.00</td><td>55.45</td></tr><tr><td>DIRE</td><td>-</td><td><b>100.00</b></td><td>67.50</td><td>64.53</td><td>83.40</td><td>63.03</td><td><b>99.95</b></td><td>93.27</td><td>56.67</td><td>63.47</td><td>55.54</td><td>55.55</td><td>75.35</td><td>88.15</td><td>89.10</td><td>89.50</td><td>87.15</td><td>90.35</td><td>91.40</td><td>62.90</td><td>77.73</td></tr><tr><td>UnivFD</td><td>LC</td><td><b>100.00</b></td><td>98.50</td><td><b>94.50</b></td><td>82.00</td><td><b>99.50</b></td><td>97.00</td><td>66.60</td><td>63.00</td><td>57.50</td><td>59.50</td><td>72.00</td><td>70.03</td><td>94.19</td><td>73.76</td><td>94.36</td><td>79.07</td><td>79.85</td><td>78.14</td><td>86.78</td><td>81.38</td></tr><tr><td>OnlyReal</td><td>-</td><td>99.15</td><td>93.50</td><td>89.90</td><td><b>98.05</b></td><td>80.50</td><td>99.60</td><td><b>85.00</b></td><td>49.50</td><td>71.50</td><td>50.10</td><td>50.10</td><td><b>81.10</b></td><td><b>97.59</b></td><td><b>97.40</b></td><td><b>98.10</b></td><td>88.40</td><td>91.90</td><td>87.20</td><td><b>98.10</b></td><td>84.58</td></tr><tr><td rowspan="3">Ours</td><td>N</td><td>81.75</td><td>54.85</td><td>58.84</td><td>59.46</td><td>56.38</td><td>50.06</td><td>49.94</td><td>50.00</td><td>52.05</td><td>50.00</td><td>50.00</td><td>53.65</td><td>49.05</td><td>48.00</td><td>48.45</td><td>46.97</td><td>47.30</td><td>46.30</td><td>51.60</td><td>52.88</td></tr><tr><td>P</td><td>95.76</td><td>91.74</td><td>92.72</td><td>75.09</td><td>98.26</td><td>90.26</td><td>83.16</td><td>76.11</td><td>56.62</td><td>92.61</td><td>93.34</td><td>60.55</td><td>92.45</td><td>80.40</td><td>92.80</td><td>82.94</td><td>86.75</td><td>84.75</td><td>87.30</td><td>84.93</td></tr><tr><td>N+P</td><td>99.22</td><td>93.67</td><td>90.80</td><td>84.42</td><td>88.11</td><td>96.65</td><td>66.77</td><td>54.44</td><td>68.49</td><td>84.79</td><td>85.12</td><td>78.55</td><td>96.80</td><td>88.35</td><td>96.50</td><td><b>96.30</b></td><td><b>97.25</b></td><td><b>96.10</b></td><td>96.55</td><td><b>87.30</b></td></tr></tbody></table>

## B. Comparison with Existing Methods

In this subsection, we compare our method with several advanced anomaly detection approaches: PaDiM [28], CFA [31], GANomaly [23], DSR [32], DRAEM [24], STFPM [25], RD [26], DFM [27], FastFlow [10], CFlow [11], and existing AI-generated image detectors: CNNSpot [12], PatchForensics [13], Co-Occur [14], FreqSpec [17], DIRE [16], UnivFD [3], Freq-mask [8] and OnlyReal [22]. The numerical results are reported in Table I. For anomaly detection methods, we train them completely according to the settings and instructions of the original models using only natural images in our training set and test them on the AII detection benchmark test sets. For most AI-generated image detection methods, we use the results as presented in the UnivFD paper [3]. Besides, we also compare with DIRE [16], Freq-mask [8] and OnlyReal [22] (all based on supervised learning algorithm), with the same setting of UnivFD.

From the first part of Table I, we can see that existing anomaly detection methods have limited performance on the task of AI-generated image detection, with mAP remaining quite low around 50% for the vast majority of tested methods (last column of Table I). These results are the outcome of our extensive study on the performance evaluation of recent anomaly detection methods on AII detection, to our knowledge the first time in the literature for such a study. Possible explanations of the limited performance, as mentioned before, are the insufficient ability of existing methods to capture the very diverse content of natural images and the blindness to anomalies to be detected. The DRAEM method [24] shows slightly better performance than other anomaly detection methods with mAP of around 64%. Upon inspection, we hypothesize that this better performance is mainly due to the construction of some artificial anomaly samples in the DRAEM method. This is in part in line with the idea of constructing proxy images in our method, which nevertheless shows much better AII detection performance, as presented in the following.

In the last group of rows of Table I, we show the test results of three modes of our model. N represents our model trained with likelihood maximization on 7,200 natural images, P represents our model trained with likelihood minimization on 7,200 proxy images, and N+P represents our model trained with both the likelihood maximization on natural images and likelihood minimization on proxy images (in total 14,400 images). We can see that when we only maximize the likelihood of natural images, the performance is not ideal, again probably due to the reasons mentioned in the last paragraph for existing anomaly detection methods. On the contrary, when we only minimize the likelihood of proxy images, the performance of our model has been significantly improved. The mAP of our method has reached a high value of 93.85%, while not using any AI-generated image for training. This implies that, despite their simplicity of construction, proxy images have distinctive differences from natural images, making them closer in the feature space to AII s generated by a variety of generative models, including GANs and diffusion models, than to natural images. Finally, if we jointly maximize the likelihood of natural images with the N+P mode, the mAP of our model can be further improved to 95.56%. Towards the end of Table I, we compare with the very recent method OnlyReal [22], which, similar to our method, does not use AII s to build a forensic detector. However, it is worth noting that the essential structure of OnlyReal remains a supervised binary model with the conventional cross-entropy loss and consistent with traditional AII detection methods, and that it cannot be trained using only a single class of images. In contrast, our method can be effectively trained in an unsupervised manner using only a single class of proxy images, making it more flexible and more inspiring for future research. Regarding the AII detection performance, we can see from Table I that OnlyReal achieves best performance on many test sets (such as CycleGAN, StarGAN and LDM), while the performance of our method (N+P mode) is very close on these datasets. On datasets where OnlyReal performs poorly (such as SITD and CRN), our model still performs well, so the final average performance mAP of our method is higher than OnlyReal (95.56% vs. 93.18%).

In Fig. 3, we show histograms of the anomaly scores of some test sets. It can be seen that, for ProGAN, StarGAN and LDM_200, with our method trained with P mode, the histograms of natural images and AII s remain different, but they are
<figure><img src="image_5.png" /><figcaption>Fig. 3: Histograms of anomaly scores on test sets of ProGAN, StarGAN, Guided, and LDM_200 (from left to right), for the P mode (top row) and the N+P mode (bottom row) of our method. The range of score values is different for the two modes due to different training losses (cf. main text). The scores of the proxy images, not shown here for the sake of brevity, are all densely clustered at very high values.</figcaption></figure>

close and have small overlap; when we use our model trained with N+P mode, the two histograms are very well separated with a gap between them. Similar to existing methods, our model has limited performance on Guided; nevertheless, the histogram separability is much improved with N+P mode than with P mode (third column of Fig. 3). The magnitude of the anomaly scores in the two modes is different, as shown in Fig. 3, and this is mainly due to the different training losses used in the two modes. For the P mode, the training strategy is to minimize the log-likelihood (thus maximizing the anomaly score) of the proxy images, while for the N+P mode, we additionally maximize the log-likelihood of the natural images. The more complex training loss in the N+P mode experimentally leads to anomaly scores of lower magnitude, probably due to the need to reach a trade-off between the losses of the two types of images.

Table II presents the test accuracy results of our model and representative existing methods. For our model, we choose a threshold based on a synthetic validation set as mentioned in Section IV-A. The average accuracy reaches 84.93% for N mode of our model, which is 3.55% higher than the reference UnivFD method. When we maximize the likelihood of natural images and minimize the likelihood of proxy images at the same time, i.e., N+P mode, the average accuracy of our model improves further and reaches 87.30%.

<table><caption>TABLE III: The performance (in AP, %) of different types of proxy images. FM stands for frequency masking.</caption><thead><tr><th rowspan="2">Mode</th><th rowspan="2">Type</th><th colspan="2">Generative Adversarial Networks</th><th colspan="2">Deep Fakes</th><th colspan="2">Low level vision</th><th colspan="2">Perceptual loss</th><th rowspan="2">Guided</th><th colspan="2">LDM</th><th colspan="3">Glide</th><th rowspan="2">DALL-E</th><th rowspan="2">Total</th></tr><tr><th>Pro-GAN</th><th>Cycle-GAN</th><th>Big-GAN</th><th>Style-GAN</th><th>Gau-GAN</th><th>Star-GAN</th><th>SITD</th><th>SAN</th><th>CRN</th><th>IMLE</th><th>200 steps</th><th>200 w/ CFG</th><th>100 steps</th><th>100</th><th>50</th><th>100</th><th>mAP</th></tr></thead><tbody><tr><td rowspan="5">N+P</td><td>Smoothing</td><td>96.41</td><td>68.84</td><td>74.09</td><td>84.56</td><td>88.84</td><td>48.36</td><td>42.69</td><td>67.86</td><td>59.21</td><td>80.09</td><td>85.49</td><td>61.61</td><td>89.19</td><td>78.36</td><td>88.48</td><td>83.72</td><td>85.67</td><td>84.02</td><td>83.13</td><td>76.25</td></tr><tr><td>Sharpening</td><td>99.66</td><td>96.22</td><td>98.59</td><td>88.49</td><td>97.94</td><td><strong>99.74</strong></td><td>79.05</td><td>77.89</td><td>67.66</td><td>44.84</td><td>80.11</td><td>79.33</td><td>96.99</td><td>92.87</td><td>96.63</td><td>65.93</td><td>70.97</td><td>69.34</td><td>99.56</td><td>84.31</td></tr><tr><td>Gaussian noise</td><td>99.73</td><td>96.35</td><td>96.82</td><td>88.82</td><td>98.88</td><td>98.89</td><td>69.30</td><td>73.18</td><td>63.22</td><td>90.33</td><td>96.83</td><td>73.54</td><td>95.93</td><td>90.42</td><td>95.80</td><td>70.16</td><td>78.13</td><td>73.36</td><td>99.13</td><td>86.78</td></tr><tr><td>Color jitter</td><td>99.87</td><td>98.73</td><td>97.90</td><td><strong>98.15</strong></td><td>97.88</td><td>99.57</td><td>81.71</td><td>70.94</td><td>71.05</td><td>76.70</td><td>96.79</td><td>82.18</td><td><strong>99.50</strong></td><td><strong>98.10</strong></td><td><strong>99.45</strong></td><td>97.79</td><td>98.52</td><td>98.17</td><td><strong>99.88</strong></td><td>92.78</td></tr><tr><td>FM (onlyphase)</td><td><strong>99.96</strong></td><td>99.86</td><td><strong>99.31</strong></td><td>96.11</td><td><strong>99.93</strong></td><td>99.73</td><td>85.78</td><td>79.52</td><td>79.31</td><td><strong>95.39</strong></td><td><strong>97.62</strong></td><td>87.66</td><td>99.20</td><td>95.98</td><td>99.14</td><td>98.93</td><td>99.32</td><td>98.87</td><td>99.32</td><td>95.31</td></tr><tr><td></td><td>FM</td><td>99.94</td><td><strong>99.87</strong></td><td>99.24</td><td>97.10</td><td>99.92</td><td>99.50</td><td><strong>87.34</strong></td><td><strong>80.06</strong></td><td><strong>79.48</strong></td><td>94.85</td><td>96.94</td><td><strong>87.78</strong></td><td>99.41</td><td>96.93</td><td>99.44</td><td><strong>99.35</strong></td><td><strong>99.59</strong></td><td><strong>99.28</strong></td><td>99.55</td><td><strong>95.56</strong></td></tr></tbody></table>

<table><caption>TABLE IV: The performance (in AP, %) of proxy image generation with the masking of different frequency parts. We randomly set the low, mid, and high part of the image spectrum (as defined in [8]) to 0 with a probability of 0.1.</caption><thead><tr><th rowspan="2">Mode</th><th rowspan="2">Frequency Part</th><th colspan="2">Generative Adversarial Networks</th><th colspan="2">Deep Fakes</th><th colspan="2">Low level vision</th><th colspan="2">Perceptual loss</th><th rowspan="2">Guided</th><th colspan="2">LDM</th><th colspan="3">Glide</th><th rowspan="2">DALL-E</th><th rowspan="2">Total</th></tr><tr><th>Pro-GAN</th><th>Cycle-GAN</th><th>Big-GAN</th><th>Style-GAN</th><th>Gau-GAN</th><th>Star-GAN</th><th>SITD</th><th>SAN</th><th>CRN</th><th>IMLE</th><th>200 steps</th><th>200 w/ CFG</th><th>100 steps</th><th>100</th><th>50</th><th>100</th><th>mAP</th></tr></thead><tbody><tr><td rowspan="3">N+P</td><td>Low</td><td>99.94</td><td><strong>99.87</strong></td><td><strong>99.24</strong></td><td>97.10</td><td><strong>99.92</strong></td><td><strong>99.50</strong></td><td>87.34</td><td>80.06</td><td><strong>79.48</strong></td><td><strong>94.85</strong></td><td>96.94</td><td><strong>87.78</strong></td><td><strong>99.41</strong></td><td>96.93</td><td>99.44</td><td><strong>99.35</strong></td><td><strong>99.59</strong></td><td><strong>99.28</strong></td><td>99.55</td><td><strong>95.56</strong></td></tr><tr><td>Mid</td><td>99.50</td><td>98.34</td><td>97.38</td><td><strong>98.83</strong></td><td>98.51</td><td>96.31</td><td>73.16</td><td>74.52</td><td>57.31</td><td>90.51</td><td>95.70</td><td>75.96</td><td>99.39</td><td><strong>98.07</strong></td><td><strong>99.45</strong></td><td>97.98</td><td>98.66</td><td>98.25</td><td><strong>99.79</strong></td><td>91.98</td></tr><tr><td>High</td><td><strong>99.96</strong></td><td>99.81</td><td>99.12</td><td>97.46</td><td>99.88</td><td>99.30</td><td><strong>88.80</strong></td><td><strong>80.43</strong></td><td>78.31</td><td>94.64</td><td><strong>97.01</strong></td><td>86.36</td><td>99.40</td><td>97.04</td><td>99.41</td><td>99.20</td><td>99.51</td><td>99.12</td><td>99.54</td><td>95.49</td></tr></tbody></table>
<figure><img src="image_6.png" /><figcaption>Fig. 4: Results of ablation studies regarding the DR layer.</figcaption></figure>

### C. Additional Results and Ablation Studies

**Other Types of Proxy Images.** As mentioned in Section III-B, we have also attempted to use proxy images constructed by other types of operations, including spatial operations such as smoothing, sharpening, Gaussian noise addition, and color jitter, as well as a variant of frequency masking that randomly masks only the phase while keeping the spectral amplitude unchanged. For the sake of brevity, we show in Table III the results in the N+P mode of our detector. The parameter setting of the new operations is similar to that of frequency masking, i.e., for the N+P mode a relatively small modification is introduced with appropriate parameters. For example, Gaussian noise was added with a moderate standard deviation of 5 (pixel value between 0 and 255) to produce noisy proxy images. It can be seen from Table III that routine spatial operations (smoothing, sharpening, and noise addition) result in limited detection performance, while color jitter leads to much better overall mAP. One possible explanation is that color jitter introduces a plausible color deviation from natural images. We notice that only masking the spectrum phase achieves a high mAP, very close to the frequency masking of both the phase and the amplitude. This observation is interesting and remains understandable because the spectrum phase is proven to carry important structural and perceptual information [33]–[35]. It is also encouraging to see that our method can cope well with both spatially (color jitter) and spectrally (frequency masking) modified proxy images for the training of an effective AII detector, while not mimicking specific artifacts of AIIs. Future research shall be devoted to understanding the effect of different operations and to constructing more effective proxy images.

**Spectrum Part for Frequency Masking.** In our work, we generate proxy images by randomly masking the low part of the image spectrum. What effect would masking information on the high part and the mid part have? The corresponding results are reported in Table IV. We can see that our method can perform properly in all three cases, with the low and high parts having a higher mAP than the mid part. AIIs of some models such as ProGAN, GauGAN, IMLE, and Glide can be distinguished very well when we mask either of the three parts of the spectrum to generate proxy images. AIIs of some other models such as DeepFakes, SAN, and Guided are much better distinguished when we mask the low or high part than the mid part. In general, the detection performance on each generative model and with each frequency part is different, and masking the low and high parts has better overall performance than masking the mid part, with the low part masking being slightly better than the high part masking. Therefore, we choose to perform random frequency masking in the low part of the spectrum of natural images to produce proxy images.

**Dimension Reduction.** We conducted ablation experiments to verify the impact of dimension reduction (DR) of the CLIP feature. In the experiments, we simultaneously maximized the likelihood of natural images and minimized the likelihood of proxy images, and kept other parameters unchanged while only varying the output dimension of the DR layer. As shown in the results of Fig. 4, if the DR layer is not used (the two “No DR” horizontal lines), not only the number of parameters will be very large, but also the model performance will decrease. Using the DR layer to reduce the feature dimension simplifies the model and improves the performance. Regarding the choice of the reduced feature dimension, we chose 128 which has a good trade-off between model complexity (its number of parameters) and performance (its mAP).

**Feature Normalization.** After the CLIP feature dimension is reduced by the linear layer of DR, we also normalize its magnitude to 1. Our intuitions behind this normalization are as follows: 1) The CLIP model was trained by contrastive learning with a cosine similarity loss, so its features are in theory independent of their magnitude; 2) With feature normalization, the
<table><caption>TABLE V: AP (%) on datasets from recent generative models. Our method has strong generalization to unseen generators.</caption><thead><tr><th>Generator</th><th>Ours</th><th>UnivFD</th></tr></thead><tbody><tr><td>DALL-E 3</td><td>90.48</td><td>61.78</td></tr><tr><td>DeepFloyd</td><td>97.17</td><td>86.47</td></tr><tr><td>RealVisXL v4.0</td><td>90.70</td><td>61.98</td></tr><tr><td>Stable Diffusion v1.5</td><td>94.93</td><td>85.96</td></tr><tr><td><strong>Average</strong></td><td><strong>93.32</strong></td><td><strong>74.05</strong></td></tr></tbody></table>

input distribution of the flow model is constrained on a unit hyper-sphere, which would be less complicated to learn than an arbitrary distribution and thus reduce the risk of overfitting. Experimentally, the mAP is 93.41% without normalization, while the mAP reaches 95.56% (an increase of 1.15%) with feature normalization.

## D. Evaluation on Emerging Generative Models

To further examine generalization, we built new test datasets based on prompt-driven image generation. Specifically, from real images, we used a vision-to-language model to generate prompts, then synthesized corresponding fake images using state-of-the-art generators, including DALLE 3, DeepFloyd, RealVisXL v4.0, and Stable Diffusion v1.5. Each new dataset comprises 1000 real and 1000 generated images. We compare our method with UnivFD [3]. As shown in Table V, our model (P mode, without any fine-tuning, i.e., the same model evaluated in previous subsections) achieves high AP (Average Precision) scores across the new test datasets. These emerging and unseen generators produce high-quality, semantically rich images that pose substantial challenges for AII detectors. Overall, our method demonstrates strong detection performance even on unseen and recently released generative models, suggesting enhanced generalization to real-world deployment settings. At last, we would like to clarify that our goal in this work is to explore AII detection from a new anomaly detection perspective. We do not aim to outperform every concurrent and recent method (mostly based on supervised learning), and we do not claim SOTA performance.

## V. CONCLUSION

Unlike the conventional AII detection pipeline that relies on supervised learning, we propose a universal and generalizable framework inspired by anomaly detection. Our model includes a CLIP-based feature extractor and a normalization flow-like module. Without requiring access to AI-generated images, our model is trained using anomalous frequency-masked images and optionally natural images by optimizing the image likelihood under the flow model. Experimental results demonstrate the strong generalization capability of our CLIP-Flow model on various AII detection benchmark datasets. In particular, our work shows the feasibility of leveraging anomaly detection with unsupervised or self-supervised learning for universal detection of AI-generated images. An interesting by-product of our study is a new flow model that can handle two types of samples of complementary distributions, and this new model could be useful in other data analysis applications. In the future, we would like to explore other proxy image generation approaches, propose new anomaly detection methods that can cope better with the AII detection problem, and extend our framework to other multimedia forensic challenges. Code is available at https://github.com/Yzp1018/CLIP-Flow.

## ACKNOWLEDGMENTS

This work is partially funded by the French National Research Agency (Grants numbers ANR-23-IAS4-0004-02 and ANR-15-IDEX-02) and the Excellent Youth Program of State Key Laboratory of Multimodal Artificial Intelligence Systems.

## REFERENCES

[1] T. Karras, T. Aila, S. Laine, and J. Lehtinen, "Progressive growing of GANs for improved quality, stability, and variation," in *International Conference on Learning Representations*, 2018, pp. 1-12.

[2] T. Karras, S. Laine, and T. Aila, "A style-based generator architecture for generative adversarial networks," in *IEEE/CVF Conference on Computer Vision and Pattern Recognition*, 2019, pp. 4401-4410.

[3] U. Ojha, Y. Li, and Y. J. Lee, "Towards universal fake image detectors that generalize across generative models," in *IEEE/CVF Conference on Computer Vision and Pattern Recognition*, 2023, pp. 24480-24489.

[4] G. Pang, C. Shen, L. Cao, and A. V. D. Hengel, "Deep learning for anomaly detection: A review," *ACM Computing Surveys*, vol. 54, no. 2, pp. 1-38, 2021.

[5] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., "Learning transferable visual models from natural language supervision," in *International Conference on Machine Learning*, 2021, pp. 8748-8763.

[6] W. Quan, P. Deng, K. Wang, and D.-M. Yan, "Cgformer: Vit-based network for identifying computer-generated images with token labeling," *IEEE Transactions on Information Forensics and Security*, vol. 19, pp. 235-250, 2024.

[7] M. Cai, H. Zhang, H. Huang, Q. Geng, Y. Li, and G. Huang, "Frequency domain image translation: More photo-realistic, better identity-preserving," in *IEEE/CVF International Conference on Computer Vision*, 2021, pp. 13930-13940.

[8] C. T. Doloriel and N.-M. Cheung, "Frequency masking for universal deepfake detection," in *IEEE International Conference on Acoustics, Speech and Signal Processing*, 2024, pp. 13466-13470.
[9] I. Kobyzev, S. J. Prince, and M. A. Brubaker, "Normalizing flows: An introduction and review of current methods," *IEEE Transactions on Pattern Analysis and Machine Intelligence*, vol. 43, no. 11, pp. 3964-3979, 2020.

[10] J. Yu, Y. Zheng, X. Wang, W. Li, Y. Wu, R. Zhao, and L. Wu, "FastFlow: Unsupervised anomaly detection and localization via 2D normalizing flows," *arXiv preprint arXiv:2111.07677*, pp. 1-11, 2021.

[11] D. Gudovskiy, S. Ishizaka, and K. Kozuka, "CFLOW-AD: Real-time unsupervised anomaly detection with localization via conditional normalizing flows," in *IEEE/CVF Winter Conference on Applications of Computer Vision*, 2022, pp. 98-107.

[12] S.-Y. Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros, "CNN-generated images are surprisingly easy to spot...for now," in *IEEE/CVF Conference on Computer Vision and Pattern Recognition*, 2020, pp. 8692-8701.

[13] L. Chai, D. Bau, S.-N. Lim, and P. Isola, "What makes fake images detectable? Understanding properties that generalize," in *European Conference on Computer Vision*, 2020, pp. 103-120.

[14] L. Natraj, T. Manhar Mohammed, S. Chandrasekaran, A. Flenner, A. K. Roy-Chowdhuri, and B. Manjunath, "Detecting GAN generated fake images using co-occurrence matrices," in *Electronic Imaging*, 2019, pp. 532:1-6.

[15] W. Bai, Z. Zhang, B. Li, P. Wang, Y. Li, C. Zhang, and W. Hu, "Robust texture-aware computer-generated image forensic: Benchmark and algorithm," *IEEE Transactions on Image Processing*, vol. 30, pp. 8439-8453, 2021.

[16] Z. Wang, J. Bao, W. Zhou, W. Wang, H. Hu, H. Chen, and H. Li, "DIRE for diffusion-generated image detection," in *IEEE/CVF International Conference on Computer Vision*, 2023, pp. 22 388-22 398.

[17] Z. Zhang, S. Karaman, and S.-F. Chang, "Detecting and simulating artifacts in GAN fake images," in *IEEE International Workshop on Information Forensics and Security*, 2019, pp. 1-6.

[18] J. Frank, T. Eisenhofer, L. Schonherr, A. Fischer, D. Kolossa, and T. Holz, "Leveraging frequency analysis for deep fake image recognition," in *International Conference on Machine Learning*, 2020, pp. 3247-3258.

[19] R. Durall, M. Keuper, and J. Keuper, "Watch your up-convolution: CNN based generative deep neural networks are failing to reproduce spectral distributions," in *IEEE/CVF Conference on Computer Vision and Pattern Recognition*, 2020, pp. 7887-7896.

[20] T. Dzanic, K. Shah, and F. D. Witherden, "Fourier spectrum discrepancies in deep network generated images," in *Advances in Neural Information Processing Systems*, 2020, pp. 3022-3032.

[21] B. Liu, F. Yang, X. Bi, B. Xiao, W. Li, and X. Gao, "Detecting generated images by real images," in *European Conference Computer Vision*, 2022, pp. 95-110.

[22] J. Li and K. Wang, "Detecting computer-generated images by using only real images," in *International Conference on Machine Vision*, 2024, pp. 1-13.

[23] S. Akcay, A. Atapour-Abarghouei, and T. P. Breckon, "GANomaly: Semi-supervised anomaly detection via adversarial training," in *Asian Conference on Computer Vision*, 2019, pp. 622-637.

[24] V. Zavrtanik, M. Kristan, and D. Skočaj, "DRM - A discriminatively trained reconstruction embedding for surface anomaly detection," in *IEEE/CVF International Conference on Computer Vision*, 2021, pp. 8330-8339.

[25] G. Wang, S. Han, E. Ding, and D. Huang, "Student-teacher feature pyramid matching for unsupervised anomaly detection," in *British Machine Vision Conference*, 2021, pp. 1-14.

[26] H. Deng and X. Li, "Anomaly detection via reverse distillation from one-class embedding," in *IEEE/CVF Conference on Computer Vision and Pattern Recognition*, 2022, pp. 9737-9746.

[27] N. A. Ahuja, I. Ndiour, T. Kalyanpur, and O. Tickoo, "Probabilistic modeling of deep features for out-of-distribution and adversarial detection," in *Bayesian Deep Learning Workshop*, 2019, pp. 1-5.

[28] T. Defard, A. Setkov, A. Loesch, and R. Audigier, "PaDiM: a patch distribution modeling framework for anomaly detection and localization," in *International Conference on Pattern Recognition*, 2021, pp. 475-489.

[29] L. Dinh, J. Sohl-Dickstein, and S. Bengio, "Density estimation using real NVP," in *International Conference on Learning Representations*, 2017, pp. 1-12.

[30] G. Papamakarios, E. Nalisnick, D. J. Rezende, S. Mohamed, and B. Lakshminarayanan, "Normalizing flows for probabilistic modeling and inference," *Journal of Machine Learning Research*, vol. 22, no. 57, pp. 1-64, 2021.

[31] S. Lee, S. Lee, and B. C. Song, "CFA: Coupled-hypersphere-based feature adaptation for target-oriented anomaly localization," *IEEE Access*, vol. 10, pp. 78 446-78 454, 2022.

[32] V. Zavrtanik, M. Kristan, and D. Skočaj, "DSR – A dual subspace re-projection network for surface anomaly detection," in *European Conference on Computer Vision*, 2022, pp. 539-554.

[33] A. V. Oppenheim and J. Lim, "The importance of phase in signals," *Proceedings of the IEEE*, vol. 69, no. 5, pp. 529-541, 1981.

[34] X. S. Ni and X. Huo, "Statistical interpretation of the importance of phase information in signal and image reconstruction," *Statistics & Probability Letters*, vol. 77, no. 4, pp. 447-454, 2007.

[35] E. Gladilin and R. Eils, "On the role of spatial phase and phase correlation in vision, illusion, and cognition," *Frontiers in Computational Neuroscience*, vol. 9, pp. 1-14, 2015.