# Building a Universal Detector of AI-Generated Images Without Training on Them

Ji Li, Kai Wang

► To cite this version:

Ji Li, Kai Wang. Building a Universal Detector of AI-Generated Images Without Training on Them. International Journal of Intelligent Systems, 2025, 2025, Article ID 8530953, 23 p. 10.1155/int/8530953. hal-05294996

HAL Id: hal-05294996

https://hal.science/hal-05294996v1

Submitted on 2 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Research Article

# Building a Universal Detector of AI-Generated Images Without Training on Them

Ji Li and Kai Wang

GIPSA-Lab, CNRS, Grenoble INP, Univ. Grenoble Alpes, Grenoble, France

Correspondence should be addressed to Ji Li; ji.li@gipsa-lab.grenoble-inp.fr and Kai Wang; kai.wang@gipsa-lab.grenoble-inp.fr

Received 31 January 2025; Revised 5 August 2025; Accepted 4 September 2025

Guest Editor: Beijing Chen

Copyright © 2025 Ji Li and Kai Wang. International Journal of Intelligent Systems published by John Wiley & Sons Ltd. This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

Deep generative models are now capable of generating synthetic images with very high visual realism, often indistinguishable from real-world photographs. Such AI-generated images (AIGIs) can pose serious security concerns if used maliciously. Conventional AIGI detection methods are based on supervised learning and may have limited generalization ability. In this paper, we build a novel universal detector of AIGIs without the need to perform training on these images. Starting with a study on the effectiveness of various pretrained image models for the AIGI detection task, we then chose to build our detector based on the features of the popular CLIP model. Unlike existing methods, we use a small number of real images and their carefully processed counterparts as AIGI proxies during training, combined with a novel margin-based loss to promote generalization. Extensive experiments demonstrate the effectiveness of our method, outperforming existing supervised methods while not using any AIGI for training.

**Keywords:** AI-generated image; fake image detection; generalization; image forensics; pretrained image model

## 1. Introduction

The ubiquity of smartphones and social media platforms has transformed modern communication, making the creation, sharing, and consumption of digital images nearly effortless. This digital revolution has also led to the increasing accessibility of sophisticated image synthesis technologies. Advanced tools can now produce synthetic images of as- tonishing visual realism, blurring the line between authentic and artificial content. AI-generated images (AIGIs), while demonstrating impressive technological advances, pose significant risks when used maliciously. These computer- generated visual contents, which have no connection to scenes in the physical world, can distort reality and have far- reaching societal implications. For example, AIGIs can be used in disinformation campaigns to influence public opinion during elections, in fraudulent advertising to mis- lead consumers, and even in criminal contexts to fabricate evidence that could obstruct justice. Such misuse is no longer speculation and has become a daily challenge, as

malicious actors exploit this technology to erode people's trust in digital images.

The rapid evolution of deep generative models has fueled this challenge. Researchers have developed increasingly sophisticated techniques for such models, for example, the generative adversarial networks (GANs) [1] and the state-of-the-art diffusion models [2]. These models are now capable of producing images (as shown in Figure 1) that are often indistinguishable from real-world photographs, even to trained observers. However, the same qualities that make these tools revolutionary also make them dangerous, as they can be used maliciously to generate AIGIs for disinformation purposes. In response to these growing threats, the field of image forensics has emerged as a critical area of research. Over the past 2 decades, researchers have introduced a variety of techniques to detect fake images [3–5], including AIGIs. These methods leverage advances and tools in machine learning, signal processing, and statistical analysis to uncover subtle traces left by the generation processes of AIGIs. Despite these efforts, the rapid pace of innovation in
<figure><img src="image_2.png" /><figcaption>FIGURE 1: AI-generated images (AIGIs) created by different deep generative models. (a) Diffusion models. (b) GANs.</figcaption></figure>

generative models continue to present a moving target, requiring forensic techniques to adapt and evolve continuously.

Deep learning-based methods have demonstrated promising results across various tasks [6–8]. In the field of image forensics, particularly in AIGI detection, convolutional neural network (CNN)-based approaches have gained significant attention [9–11]. These methods are predominantly employed in fully supervised settings, where the availability of large-scale labeled training data allows them to achieve strong performance. Typically, deep learning-based classifiers are trained on datasets comprising real images and AIGIs created by a generative model, such as a GAN or a diffusion model. These classifiers often exhibit impressive performance when tasked with detecting AIGIs from the same generative model family [12, 13]. For example, a classifier trained on a dataset of real images and AIGIs generated by a specific GAN model may achieve high accuracy (ACC) not only on AIGIs from the same GAN model used during training but also on AIGIs produced by other GAN models with similar architectures. However, this strong performance tends to diminish when the classifier encounters AIGIs from significantly different generative paradigms, such as diffusion models. The generalization challenge is particularly pronounced when classifiers are confronted with out-of-domain generative models that remain unseen during the training phase. This limitation highlights a critical gap in current forensic methodologies for detecting AIGIs: the ability to generalize across diverse generative architectures. Moreover, a significant barrier to the widespread adoption of existing methods is their dependence on large quantities of labeled training data. Acquiring such data is often labor-intensive and expensive, particularly when new generative models emerge at a rapid pace, necessitating constant updates to training datasets. Addressing these challenges requires innovative approaches that minimize data dependence while maintaining generalizable detection capabilities.

One of our primary objectives is to develop a data-efficient framework for AIGI detection that demonstrates superior generalization capabilities while requiring minimal training data. In particular, we propose a novel AIGI detection method, which does not use any AIGI during the training phase. For the training of our universal detector, only a small number of real images and carefully designed proxy images are used, combined with a novel loss function favoring better generalization on unseen AIGIs, as shown in Figure 2. Our contributions in this paper are as follows:

<figure><img src="image_3.png" /><figcaption>FIGURE 2: Illustrations of different detectors. (a) Panel shows a domain-specific detector trained on AIGIs from a specific generative model, which fails to generalize to AIGIs of unseen generative models. (b) Panel illustrates our universal detector, trained on proxy samples, achieving better generalization across domains.</figcaption></figure>

* We conduct a comprehensive analysis of the ability of various large pretrained models to adapt to the task of AIGI detection. Specifically, we investigate how different pretraining strategies, as well as the scale and quality of pretraining data, influence the transferability of models' feature representations for this challenging task.
* We propose a novel strategy to generate diverse proxy samples from real images using domain-agnostic transformations, such as color transfer (CT) and elastic transform (ET). Unlike prior methods that rely on AIGI data from specific generators, our approach introduces controlled variations in color and structure that help define a more robust decision boundary. Feature space analysis shows that these proxies enhance the training of a universal detector with reinforced discrimination between real and fake classes, thereby improving generalization to unseen generators and reducing dependency on model-specific data.
* We propose a novel margin-based loss function to address the limitations of the commonly used binary cross-entropy (BCE) loss in AIGI detection tasks. This new loss facilitates the learning of more discriminative features by incorporating flexible margins, thereby promoting better class separation and improved generalization performance.
* Extensive experiments on various generative models demonstrate the effectiveness of our method, achieving high detection ACC while maintaining strong generalization across unseen domains. Our method outperforms existing supervised methods, notably by not using any AIGI for training.

This work is an extended and improved version of our previous conference paper [14]. Compared to the conference version, in this paper, we present more in-depth studies and analyses on the pretrained large image models and proxy samples, propose a new proxy image generation scheme based on ET, and design a novel margin-based loss function; as a result, we obtain better forensic performance of the new AIGI detector presented in this paper.

The paper is structured as follows. Section 2 reviews related work. Section 3 analyzes pretrained image models. Section 4 outlines our proposed approach. Section 5 introduces the concept of proxy samples. Section 6 presents and discusses the experimental results. Finally, Section 7 concludes the paper and suggests directions for future research.

## 2. Related Work

### 2.1. Image Generation Models.
The advent of deep generative models has substantially advanced the field of image synthesis, enabling the modeling and replication of complex data distributions inherent in natural images. Major generative frameworks include GANs [1], variational autoencoders (VAEs) [15], autoregressive models [16], normalizing flows [17], and diffusion models [2]. Each framework offers unique strategies for generating high-quality and diverse images, while GANs and diffusion models remain two very important families of generative models.

GANs have become a cornerstone in image generation, with landmark architectures such as ProGAN and StyleGAN [18, 19] demonstrating the ability to produce high-resolution images with exceptional realism. GANs employ an adversarial framework comprising two neural networks: a generator that synthesizes images and a discriminator that evaluates their authenticity. This adversarial interplay enables GANs to iteratively refine image quality, achieving impressive perceptual fidelity and computational efficiency.

Diffusion models, on the other hand, have introduced a fundamentally different approach to image generation. These models generate data by reversing a noise perturbation process, progressively refining corrupted samples over multiple denoising steps [2, 20]. This iterative refinement process enables the creation of highly detailed and diverse images. Recent advancements, including Stable Diffusion [21] and DALL-E 2 [22], have demonstrated the potential of diffusion models in tasks such as photorealistic image synthesis from textual prompts, highlighting their adaptability and creative applications.

While GANs are recognized for their ability to efficiently generate high-resolution images, diffusion models excel in robustness, diversity, and adaptability. These complementary strengths have driven significant progress in generative modeling, bridging the gap between natural and AIGIs, and

expanding synthetic image generation applications in fields such as design, entertainment, and scientific visualization.

### 2.2. AIGI Detection.
AIGIs often exhibit distinct traces of the generative process, referred to as artificial fingerprints. These fingerprints capture unique characteristics of the underlying generative mechanisms, making them valuable cues for distinguishing between real images and AIGIs.

Zhang et al. [23] proposed a GAN simulator to replicate artifacts arising from the shared operational pipelines of GAN architectures. Frank et al. [24] investigated artifacts introduced by upsampling techniques used in GANs, demonstrating their utility in deepfake image detection. However, Chandrasegaran et al. [25] highlighted that high-frequency spectral decay artifacts are not universal to all CNN-generated images and can be mitigated through minor architectural modifications, limiting the reliability of frequency-based detectors. Nataraj et al. [11] presented a method combining pixel co-occurrence matrices and deep learning to detect GAN-generated images. Mishra et al. [26] introduced a modified Swin transformer architecture specifically designed for deepfake image classification, demonstrating strong performance across multiple datasets. Wang et al. [12] showed that CNN-generated images exhibit systematic flaws compared to real images, enabling detection. Using a ResNet-50 classifier trained on ProGAN images, they demonstrated generalization across other GAN architectures. However, this approach struggled with diffusion-generated images, where classification ACC could drop below 60% for images generated by diffusion models.

To detect AIGIs generated by diffusion models, Wang et al. [13] introduced diffusion reconstruction error (DIRE), which measures the discrepancy between an input image and its reconstruction by a trained diffusion model. This innovative approach improved generalization across various diffusion models. Ma et al. [27] leveraged deterministic reverse and denoising computation errors for detecting diffusion-generated images. Luo et al. [28] proposed a reconstruction-based feature method by analyzing latent space reconstructions. Ricker et al. [29] observed that generated images are more accurately reconstructed by autoencoders than real images and proposed a training-free detection method based on autoencoder reconstruction error. Chen et al. [30] generated challenging samples through high-quality diffusion reconstructions and used contrastive training to guide detectors in learning diffusion-specific artifacts, significantly enhancing their generalization capability. While promising, these approaches target specific architectures, their performance remained inconsistent when applied to completely unseen generative models or domains. Doloriel and Cheung [31] explored the use of spatial and frequency domain masking as data augmentation techniques during training to improve the generalization of deepfake detectors across different generators. Tan et al. [32] established a generalized representation of synthetic artifacts by leveraging the local interdependence among image pixels introduced by upsampling operators in GANs and diffusion models.
Ojha et al. [33] highlighted a critical limitation in the detection method proposed by Wang et al. [12], noting that the decision boundary primarily relied on low-level fingerprints unique to the training generative model, such as ProGAN. Consequently, the classifier exhibited limited generalization capability when faced with unseen generative models that lacked these specific artifacts. To address this, Ojha et al. leveraged the pretrained contrastive language-image pretraining (CLIP) image encoder (vision transformer [ViT]-L/14)) [34] to extract robust and high-quality feature embeddings. By employing techniques such as nearest neighbor classification and linear probing, they achieved promising results across datasets from diverse domains. Similarly, Cozzolino et al. [35] demonstrated that a CLIP-based detector, when provided with only a small number of example images from a single generative model, could achieve remarkable generalization and robustness across different architectures. This underscores the potential of leveraging pretrained models such as CLIP for enhancing detection capabilities in diverse generative contexts. Koutlis and Papadopoulos [36] utilized image representations extracted from intermediate transformer blocks of CLIP's image encoder. These representations were mapped to a learnable forgery-aware vector space using a lightweight network. This novel methodology showed very satisfactory generalization, further validating the effectiveness of CLIP-based feature extraction in detecting AIGIs across various generative model architectures.

## 3. Foundation Models

This study aims to develop a data-efficient framework for detecting AIGIs with high ACC. Transfer learning [37] plays a crucial role in this endeavor by enabling the adaptation of knowledge from large-scale datasets to smaller, task-specific datasets. This approach is particularly advantageous in domains with limited annotated data, where training models from scratch is often infeasible. Large pretrained models, also known as foundation models, have demonstrated remarkable success across a wide range of downstream tasks due to their ability to capture rich, transferable feature representations [38, 39].

Building upon prior research highlighting the effectiveness of large pretrained models such as CLIP in improving generalization for AIGI detection, this study explores two key factors influencing their performance in the context of AIGI detection: (1) Pretraining strategies: The impact of different pretraining methodologies, such as contrastive learning and other self-supervised objectives, on the model's capability to distinguish real images from AI-generated ones. (2) Pretraining data: The extent to which the size and quality of pretraining datasets enhance model robustness and adaptability to novel generative models.

To address these questions, a comprehensive analysis is conducted, focusing on the adaptability of large-scale pretrained models to the task of AIGI detection. The primary model under investigation is the ViT (ViT-L/14) encoder from CLIP [34], recognized for its state-of-the-art performance in tasks requiring robust and expressive feature

representations. In addition, a range of open-source pretrained models based on the ViT architecture is evaluated for comparative analysis. The models considered include the following:

* ViT-L/16 [40]: Supervised classification on ImageNet-22K, consisting of over 14 million images across approximately 22,000 classes.

* Swin transformer-L [41]: Supervised classification on ImageNet-22K.

* BEiT-L [42]: Masked image modeling (self-supervised learning) on ImageNet-22K.

* Swag [43]: Supervised classification on Instagram-3.6B, a dataset containing approximately 3.6 billion images sourced from Instagram, spanning a wide range of real-world scenarios and contexts.

* Masked autoencoder (MAE) [44, 45]: Masked autoencoding (self-supervised learning) on Instagram-3B, a dataset of around 3 billion images from Instagram.

* MAE with supervision (MAWS) [45]: A hybrid approach combining masked autoencoding and supervised classification on Instagram-3B.

* DINOv2 [46]: Self-supervised learning with a distillation-based approach on LVD-142M, a dataset containing 142 million images curated for large visual diversity.

* OpenCLIP [47]: Contrastive language-image training on LAION-400M, a dataset comprising 400 million image-text pairs collected from the web.

These models encompass a diverse range of methodologies and were pretrained on various large-scale datasets, with detailed descriptions available in their respective publications. Following the approach outlined in [12, 33], we utilized the pretrained models as frozen feature extractors, adding a linear layer as the classification head for downstream binary classification tasks. To evaluate the performance of these models under constrained conditions with limited labeled data, we randomly selected 8000 real and ProGAN-generated images from the training dataset of [12]. These detectors were trained in a supervised manner using the BCE loss function and tested on images from diverse generative models, including GANs and diffusion models. The average classification accuracies obtained from these experiments are summarized in Table 1.

It is important to note that, with the exception of the Swin transformer, all models evaluated in this study employed the ViT-L architecture as the feature extractor. Our comparative analysis yielded several notable findings as follows:

1. Comparison of supervised models: The ViT/L-16 and Swin transformer-L, both trained on ImageNet-22K using supervised classification, exhibited significant differences in performance. The Swin transformer outperformed the ViT/L-16, demonstrating superior feature extraction capabilities. This result underlines
<table><caption>TABLE 1: Comparison of different large pretrained models, including their pretraining datasets, learning strategies, authors, and average accuracies (in %), on detecting AIGIs created by different generative models.</caption><thead><tr><th>Model</th><th>Pretraining dataset</th><th>Learning strategy</th><th>Author</th><th>Accuracy</th></tr></thead><tbody><tr><td>ViT/L-16</td><td rowspan="3">ImageNet-22K</td><td>Supervised</td><td>Google</td><td>57.82</td></tr><tr><td>Swin transformer-L</td><td>Supervised</td><td>Microsoft</td><td>80.56</td></tr><tr><td>BEiT-L</td><td>Masked autoencoder</td><td>Microsoft</td><td>61.25</td></tr><tr><td>Swag</td><td>Instagram-3.6B</td><td>Supervised</td><td>Meta</td><td>79.35</td></tr><tr><td>MAE</td><td rowspan="2">Instagram-3B</td><td>Masked autoencoder</td><td>Meta</td><td>83.79</td></tr><tr><td>MAWS</td><td>Masked autoencoder + supervised</td><td>Meta</td><td>84.31</td></tr><tr><td>DINOv2</td><td>LVD-142M</td><td>Self-supervised with distillation</td><td>Meta</td><td>81.26</td></tr><tr><td>OpenCLIP</td><td>LAION-400M</td><td>Contrastive language-image learning</td><td>LAION</td><td>82.69</td></tr><tr><td>CLIP</td><td>WIT-400M</td><td>Contrastive language-image learning</td><td>OpenAI</td><td><strong>89.88</strong></td></tr></tbody></table>

Note: Tested on images generated by ProGAN, CycleGAN, BigGAN, StyleGAN, GauGAN, StarGAN, FaceForensics, guided diffusion model, LDM, GLIDE, and DALL-E (details of generative models are presented in Section 6.1). The best result is highlighted in bold.

the effectiveness of Swin transformer's hierarchical architecture and its ability to capture both local and global features efficiently.

2. Impact of dataset scale: Scaling up the pretraining dataset positively influenced model performance. For instance, Swag, a supervised model pretrained on the Instagram-3.6B dataset, outperformed ViT/L-16, which was pretrained on ImageNet-22K. This finding highlights the value of leveraging large-scale pre-training datasets in enhancing feature generalization.

3. Self-supervised pretraining: Models pretrained using masked autoencoding, including BEiT-L, MAE, and MAWS, demonstrated that larger pretraining datasets improved model robustness and transferability. Specifically, increasing the dataset size from ImageNet-22K to Instagram-3B yielded better results. Moreover, the superior performance of the self-supervised pretraining strategy in the AIGI detection task was evident. This observation is further supported by DINOv2, which employs a self-supervised distillation-based approach and achieved competitive ACC. We conjecture that this is because supervised pretraining tends to produce task-specific features, whereas self-supervised pretraining encourages the learning of more general and versatile features, which are particularly advantageous for transferring to downstream tasks such as AIGI detection.

4. CLIP's superior performance: Among all evaluated models, the CLIP encoder achieved the highest classification ACC. This can be attributed to its robust feature extraction capabilities, derived from a particular multimodal self-supervised pretraining on a curated dataset of 400 million image-text pairs and employing a contrastive learning objective for aligning visual and textual features. These findings are in line with prior research [48–50], which consistently highlights CLIP's state-of-the-art performance across diverse downstream tasks compared to other large-scale pretrained models.

5. CLIP vs. OpenCLIP: A notable performance difference was observed between CLIP and OpenCLIP, despite their similar pretraining scales. The superior results of CLIP are likely attributable to the higher quality of the WIT-400M dataset compared to LAION-400M, underscoring the importance of dataset quality in pretraining.

To better understand the feature representations learned by different pretrained models, we utilize t-SNE to project their embeddings into a 2D space. The t-SNE visualization, shown in Figure 3, illustrates the clustering of features extracted from real images and AIGI samples using various pretrained models. Clear separations or overlaps in the clusters reveal the discriminative capability and domain generalization of each model. Notably, among all pretrained models, CLIP embeddings for LSUN real images exhibit less overlap with embeddings of various AIGIs, suggesting that CLIP offers better separation between real and synthetic image representations. In all, our analysis highlights the importance of selecting an appropriate pretrained model for the downstream AIGI detection task.

## 4. Approach

Based on the analysis conducted in Section 3, we adopt CLIP: ViT-L/14 as the backbone for our model due to its superior performance in transfer learning and generalization capabilities. The pipeline of our proposed method is illustrated in Figure 4. Our model consists of four main components: a feature extractor based on CLIP (Section 4.1), a feature fusion block (Section 4.2), a feature adapter block (Section 4.3), and a classification head (Section 4.4). During training, the model uses real and proxy images (Section 5). To enhance its generalization capability, we propose a novel loss function (Section 4.5), which helps the model learn more discriminative features and improve performance on AIGI detection.

### 4.1. CLIP Feature Extraction.
CLIP is a powerful multimodal framework designed to learn joint representations of image and text. It employs a contrastive learning approach to align
<figure><img src="image_4.png" /><figcaption>FIGURE 3: t-SNE visualization of features extracted from samples of real images (LSUN) and AIGIs (BigGAN, LDM_100, ProGAN, and guided) using different pretrained models. (a) ViT-L/16. (b) Swin transformer-L. (c) BEiT-L. (d) Swag. (e) MAE. (f) MAWS. (g) DINOv2. (h) OpenCLIP. (i) CLIP.</figcaption></figure>

visual and textual features in a shared embedding space. The core objective is to maximize the similarity between matching image-text pairs while minimizing it for

mismatched pairs. CLIP leverages a large dataset of image-text pairs ($x_{image}, x_{text}$). During pretraining, the model minimizes a symmetric contrastive loss $L_{CLIP}$ as
<figure><img src="image_5.png" /><figcaption>FIGURE 4: Overview of the proposed detection framework. The model integrates a CLIP-based backbone, fusion and adapter modules, and a classification head. It is trained with real and proxy images, guided by a custom loss to improve generalization to AI-generated content.</figcaption></figure>

$$ \mathcal{L}_{\text{CLIP}} = \frac{1}{2} (\mathcal{L}_{\text{image}} + \mathcal{L}_{\text{text}}), \quad (1) $$

where

$$ \mathcal{L}_{\text{image}} = \frac{-1}{N} \sum_{i=1}^{N} \log \frac{\exp(\text{sim}(\mathbf{z}_{\text{image}}^{i}, \mathbf{z}_{\text{text}}^{i}) / \tau)}{\sum_{j=1}^{N} \exp(\text{sim}(\mathbf{z}_{\text{image},j}^{i}, \mathbf{z}_{\text{text},j}^{i}) / \tau)}, \quad (2) $$

and $\mathcal{L}_{\text{text}}$ is defined analogously. Here, $\text{sim}(\cdot, \cdot)$ denotes cosine similarity, $\tau$ is a temperature parameter, $N$ is the batch size, and the embeddings $\mathbf{z}_{\text{image}}$ and $\mathbf{z}_{\text{text}}$ represent the learned feature vectors of images and texts, respectively.

In the CLIP image encoder, input image representations are processed through a stack of $L$ transformer blocks [51], each of which updates token embeddings to encode progressively refined information about the input image.

An input image $\mathbf{x} \in \mathbb{R}^{H \times W \times C}$ is divided into $N_p$ patches, linearly projected, and combined with a class token and positional encodings to form the initial sequence of embeddings as follows:

$$ \mathbf{Z}^{(0)} = [\mathbf{z}_{\text{cls}}^{(0)}; \mathbf{z}_{1}^{(0)}; \dots; \mathbf{z}_{N_p}^{(0)}] \in \mathbb{R}^{(N_p+1) \times d}. \quad (3) $$

Each transformer block $l \in \{1, 2, \dots, L\}$ processes the sequence $\mathbf{Z}^{(l-1)}$ using multihead self-attention (MSA) and a feed-forward network (FFN) with residual connections and layer normalization as

$$ \mathbf{Z}^{(l)} = \text{LayerNorm}(\mathbf{Z}^{(l-1)} + \text{MSA}(\mathbf{Z}^{(l-1)})), \quad (4) $$

$$ \mathbf{Z}^{(l)} = \text{LayerNorm}(\mathbf{Z}^{(l)} + \text{FFN}(\mathbf{Z}^{(l)})), \quad (5) $$

The output of each block, $\mathbf{Z}^{(l)} = [\mathbf{z}_{\text{cls}}^{(l)}; \mathbf{z}_{1}^{(l)}; \dots; \mathbf{z}_{N_p}^{(l)}] \in \mathbb{R}^{(N_p+1) \times d}$, serves as a progressively refined feature representation of the image.

## 4.2. Feature Fusion.
The intermediate representations $\mathbf{Z}^{(l)}$ from the transformer blocks capture progressively deeper features of the input image. The class token $\mathbf{z}_{\text{cls}}^{(l)}$ aggregates global information, while patch tokens $\mathbf{z}_{i}^{(l)}$ retain localized details. Previous work [33] uses only the final class token $\mathbf{z}_{\text{cls}}^{(L)}$ as the feature representation, followed by a linear classifier for AIGI detection. However, we argue that relying solely on the final class token may result in the loss of valuable information from intermediate layers. In addition, the final output of large pretrained models often captures high-level features aligned with the pretraining objective (e.g., image-text similarity), which may not be optimal for transferability to downstream tasks. To address these limitations, a recent study [36] proposes a trainable block to fuse features by calculating the weighted average of projected features obtained from each $\mathbf{z}_{\text{cls}}^{(l)}$ of transformer blocks. Building upon this, we propose and study a number of different feature fusion strategies as follows.

1. Mean fusion: It computes the average value of the class tokens from all transformer blocks. Specifically, the class token from the $i$-th block is denoted as $\mathbf{Z}_i[0] \in \mathbb{R}^d$. The final representation $\mathbf{F}$ is computed as

$$ \mathbf{F} = \text{Avg}(\{\mathbf{Z}_i[0]\}_{i=1}^L) \in \mathbb{R}^d, \quad (6) $$
where Avg denotes the average operation along the dimension of L transformer blocks.

2. Weighted sum (ws) fusion: It assigns a learnable weight $w_i$ to the class token from each transformer block, enabling the model to adaptively prioritize features from different layers. The weights $w_i$ are normalized using a softmax function. The final representation F is computed as

$$w_i = \frac{\exp(a_i)}{\sum_{j=1}^{L} \exp(a_j)}, \qquad (7)$$

$$F = \sum_{i=1}^{L} w_i \cdot Z_i[0], \qquad (8)$$

where $a_i$ is a learnable scalar for each block i, and $w_i$ represents the normalized weight.

3. MSA: It applies MSA on the class tokens $z_{cls}^{(l)}$ from all blocks to compute attention-weighted features. Let $Q, K, V$ be the query, key, and value matrices derived from concatenated class tokens as follows:

$$\begin{aligned} Q &= Z_{cls} W_Q, \\ K &= Z_{cls} W_K, \\ V &= Z_{cls} W_V, \end{aligned} \qquad (9)$$

where $W_Q, W_K$, and $W_V$ are learnable projection matrices, and $Z_{cls} = [z_{cls}^{(1)}; z_{cls}^{(2)}; \dots; z_{cls}^{(L)}]$. The attention scores and output are computed as

$$\text{attention}(\mathbf{Q}, \mathbf{K}, \mathbf{V}) = \text{softmax}\left(\frac{\mathbf{Q}\mathbf{K}^{\top}}{\sqrt{d}}\right)\mathbf{V}. \qquad (10)$$

The final fused representation F is obtained by averaging across the attention-weighted class tokens as

$$F = \text{Avg}(\text{attention}(\mathbf{Q}, \mathbf{K}, \mathbf{V})). \qquad (11)$$

### 4.3. Feature Adapter.
Following the feature fusion step, a feature adapter is applied to bridge the gap between the high-dimensional, task-agnostic features extracted by the pretrained model and the requirements of the specific downstream task. The feature adapter serves as a dimensionality reduction mechanism while maintaining the salient information necessary for classification. In our study, we explored the following configurations:

1. Linear layer: This configuration consists of a single linear layer that projects the fused representation F into a lower-dimensional space as

$$F_{\text{adapted}} = \text{Dropout}_{(0.5)}(\mathbf{W}_{\text{Linear}}\mathbf{F} + \mathbf{b}_{\text{Linear}}), \qquad (12)$$

where $W_{Linear}$ and $b_{Linear}$ are the learnable weights and bias of the linear layer, respectively. A dropout layer with a probability of 0.5 is applied to prevent overfitting.

2. Convolutional layer: This configuration employs a 1D convolutional layer with a kernel size of 1 to project F into a lower-dimensional space as

$$F_{\text{adapted}} = \text{Dropout}_{(0.5)}(\text{Conv1D}(\mathbf{F})), \qquad (13)$$

where the Conv1D layer applies learnable convolutional filters to the input features. Similar to the linear layer, a dropout layer with a probability of 0.5 is used to improve generalization.

### 4.4. Classification Head.
The final component of the architecture is the classification head, which maps the adapted feature $F_{adapted}$ to the output logits. The classification head is composed of a ReLU activation function followed by a linear layer. The logits $y_{logits}$ are computed as

$$y_{\text{logits}} = \text{Linear}(\text{ReLU}(F_{\text{adapted}})), \qquad (14)$$

where the Linear(.) function represents the linear layer that outputs logits corresponding to the number of classes in the downstream task.

### 4.5. A New Loss Function.
Unlike the commonly used BCE loss in binary classification tasks, we propose a novel margin-based loss function called Donut loss, inspired by hinge loss. Generative models are evolving rapidly, and BCE loss might struggle to generalize to such cases due to its reliance on training-specific distribution with prediction probability optimization on each training sample, which might lead to overfitting the specific training domain and a lack of robustness to diverse data distributions of unseen domains. In contrast, the proposed Donut loss operates on the margin between two classes and is less dependent on the training data distribution. This produces a classifier with less risk of overfitting the training distribution, thus improving generalization to unseen data.

The Donut loss is defined as follows based on the ground truth label $y_{true} \in \{0, 1\}$:

$$\mathcal{L}_{\text{Donut}} = \begin{cases} \max(\|y_{\text{logits}}\| - m_{\text{Real}}, 0), & \text{if } y_{\text{true}} = 0 (\text{Real}), \\ \max(m_{\text{AIGI}} - \|y_{\text{logits}}\|, 0), & \text{if } y_{\text{true}} = 1 (\text{AIGI}), \end{cases} \qquad (15)$$

where

* $\|y_{logits}\|$ denotes the $l_2$ norm of the model's output logits.

* $m_{Real}$ is the threshold for real images.

* $m_{AIGI}$ is the threshold for AIGIs.

* We have $m_{AIGI} > m_{Real}$, so the logits' norm of the real image is expected to be smaller than the logits' norm of AIGI.

The Donut loss penalizes the model based on the logits' norm of a training sample compared to predefined thresholds with a margin as the difference between the two
thresholds. For a real image ($y_{true} = 0$), it penalizes when the norm of logs exceeds the threshold $m_{Real}$, otherwise the loss is 0 according to the first row of equation (15). Similarly, for an AIGI ($y_{true} = 1$), it penalizes when the norm of the logs is smaller than the threshold $m_{AIGI}$, according to the second row of equation (15). The two classes are expected to be distinguished with a margin of ($m_{AIGI} - m_{Real}$), and this encourages a stronger separation between real and AIGIs.

For prediction, the $\ell_2$ norm $||\hat{\mathbf{y}}_{logits}||$ of a test sample is used as a score. The decision rule is as follows:

$$ \text{prediction:} \quad \left\{ \begin{array}{ll} \text{Real, if } & ||\hat{\mathbf{y}}_{logits}|| < \frac{m_{\text{Real}} + m_{\text{AIGI}}}{2}, \\ \text{AIGI, if } & ||\hat{\mathbf{y}}_{logits}|| \ge \frac{m_{\text{Real}} + m_{\text{AIGI}}}{2}. \end{array} \right. \qquad (16) $$

For the sake of simplicity and for a fair comparison with other methods, we set in the above equation the decision threshold simply as the mean value of $m_{Real}$ and $m_{AIGI}$.

The rationale behind this design is rooted in the observation that natural images intuitively share common statistical features. Thus, for real images, the loss enforces their $\ell_2$ norms to lie within a compact region (norm smaller than or equal to $m_{Real}$). In this way, we make efforts to ensure that real images from different domains (e.g., different lighting conditions, resolutions, or scenes) remain consistent in the feature space. Conversely, for AIGIs, the loss allows their features to occupy a broader space (norm larger than or equal to $m_{AIGI}$). This design accounts for the diverse nature of generative models, which can produce highly varied synthetic data. Such flexibility enhances the model's capacity to generalize to unseen AIGI types. Experimental results in Section 6 show the superiority of this new margin-based loss, which is to some extent consistent with the study in [52], claiming a positive relationship between class margin and generalization.

## 5. Proxy Samples

Training a model exclusively with samples from a single class often results in feature collapse [53], where the model fails to learn discriminative features effectively. The rapid advancements in generative models further exacerbate this issue, as these models can produce synthetic images with diverse and unknown distributions, making it increasingly challenging to generalize classifiers to such unseen data. Intuitively, natural images exhibit relatively stable and consistent characteristics within their domain. A model pretrained on a large corpus of natural images may capture these intrinsic characteristics, potentially enabling it to distinguish real images from synthetic ones. However, training solely on real images may not adequately prepare the model for detecting AIGIs generated through novel and previously unseen techniques, possibly due to the aforementioned feature collapse issue.

To address this challenge, we propose using proxy samples, transformed variants derived from real images, crafted to resemble fake AIGI samples in the general sense, without inheriting specific artifacts from any known generative model. These samples occupy regions in the feature space that are close to real images while introducing distinct discriminative features, encouraging the model to refine and reinforce its decision boundary for better generalization. Importantly, these proxy samples are label-free, model-agnostic, and constructed using simple transformations.

The methods for proxy sample construction are as follows:

* CT: Inspired by [54], CT modifies the color distribution of a source image to match the statistics of a target image as follows.

1. Color space conversion: It converts both the source and target images from the RGB color space to the LAB color space, which separates color information into luminance and chromaticity.

2. Statistical computation: It computes the mean ($\mu$) and standard deviation ($\sigma$) for each color channel of the source and target images as

$$ \mu_S = \frac{1}{N} \sum_{i=1}^{N} S_i, \qquad (17) $$

$$ \sigma_S = \sqrt{\frac{1}{N} \sum_{i=1}^{N} (S_i - \mu_S)^2}, \qquad (18) $$

$$ \mu_T = \frac{1}{N} \sum_{i=1}^{N} T_i, \qquad (18) $$

$$ \sigma_T = \sqrt{\frac{1}{N} \sum_{i=1}^{N} (T_i - \mu_T)^2}, \qquad (18) $$

where $S_i$ and $T_i$ are pixel channel values, and $N$ is the total number of pixels.

3. Adjustment: It transforms the source image's color channels to align with the target's statistics as

$$ S'_{i} = \frac{\sigma_{T}}{\sigma_{S}} (S_{i} - \mu_{S}) + \mu_{T}. \qquad (19) $$

4. Reconversion: It converts the adjusted image back to RGB color space.

* ET: Besides color, another important information of images is the geometric shape. ET introduces spatial distortions to the image as follows.

1. Displacement fields: It generates random displacement fields $\Delta_x$ and $\Delta_y$, sampled from a normal
distribution, and smooths them using a Gaussian filter. Specifically,

$$ \Delta_x, \Delta_y \sim \mathcal{N}(0, \alpha^2), \qquad (20) $$

$$ \Delta_x = \text{GaussianFilter}(\Delta_x, \sigma), \qquad (21) $$

$$ \Delta_y = \text{GaussianFilter}(\Delta_y, \sigma), $$

where $\alpha$ controls the strength, and $\sigma$ determines the smoothness of the displacements.

2. Pixel displacement: It adjusts pixel positions based on the displacement fields as

$$ x' = x + \Delta_x, \qquad (22) $$

$$ y' = y + \Delta_y. $$

3. Resampling: It resamples pixel values at displaced positions of the output image $X'$ using linear interpolation as

$$ X'(x', y') = \text{LinearInterpolate}(X, x', y'). \qquad (23) $$

For this study, we used $\alpha = 50$ and $\sigma = 5$ to achieve moderate distortions.

* Mix-Up (MU): Based on [55], MU creates new samples by linearly interpolating between two real images $x_i$ and $x_j$ as

$$ \tilde{x} = w x_i + (1 - w) x_j, \qquad (24) $$

where $w \in [0, 1]$ is a mixing weight. In this work, $w$ is set to 0.5, ensuring equal contribution from both images. This technique generates intermediate samples that provide sufficient variation to enhance the training process.

* Patch shuffling (PS): PS divides an image into non-overlapping patches of size $P \times P$ and randomly rearranges them to create a new composition. For an image $X \in \mathbb{R}^{H \times W \times 3}$, the number of patches is $p = (H \cdot W)/P^2$. By shuffling these patches, spatial relationships are disrupted while preserving low-level features within patches. We use a patch size of $P = 32$ in our experiments.

Figures 5, 6, and 7 illustrate the effects of the proposed transformations. All proxy samples are treated as negative examples in the Donut loss, enabling the model to establish a more robust margin from the real-image cluster. This strategy mitigates overfitting during training and enhances generalization to unseen generative patterns.

# 6. Experiments

This section evaluates the performance of our proposed method through a comprehensive set of experiments. We begin by presenting the implementation details, datasets, and evaluation metrics (Section 6.1). Then, we assess the detection performance using different proxy samples (Section 6.2) and compare our method with existing approaches

(Section 6.3). We further conduct ablation studies on fusion strategies and adapter configurations (Section 6.4), as well as the influence of the proposed Donut loss (Section 6.5). In addition, we investigate the robustness of our detector to image processing operations and adversarial attacks (Section 6.6), the generalization ability when trained on different real image sources (Section 6.7), and its effectiveness on images generated by recent AI models (Section 6.8).

## 6.1. Implementation Details, Datasets, and Evaluation Metrics

### 6.1.1. Implementation Details.
In our model, we adopt mean fusion and a linear adapter as the default configuration. These design choices strike a balance between simplicity and effectiveness, providing stable feature integration and adaptation while avoiding unnecessary architectural complexity. For the margin-based Donut loss, we set the threshold for real as $m_{Real} = 0.5$ and for AIGI as $m_{AIGI} = 2.5$, based on preliminary experiments that favored a wide margin separation for the two classes. Unless otherwise specified, all experiments in Section 6 are conducted under this default configuration.

Our model leverages CLIP features with a dimension $d = 1024$. The feature adapter reduces this dimensionality to 256. The model is trained with a batch size of 128 and a learning rate of $1 \times 10^{-4}$ for three epochs using the AdamW optimizer. During training, data augmentation techniques of Gaussian blur and JPEG compression are applied with a probability of 0.1, followed by random cropping to a resolution of 224 x 224 pixels. For testing, only center cropping of 224 x 224 is performed. All experiments were conducted on a single NVIDIA GeForce RTX 4090 GPU.

### 6.1.2. Datasets.
To evaluate the effectiveness of our method, we test our model across various generative models spanning multiple domains, as outlined in related work [33, 36]. The generative models considered include the following:

* GANs: ProGAN, CycleGAN, BigGAN, StyleGAN, GauGAN, and StarGAN.

* Diffusion models: Latent diffusion model (LDM) (three variants: LDM 200, LDM 200 w/CFG, and LDM 100), GLIDE (three variants: GLIDE 100-27, GLIDE 50-27, and GLIDE 100-10), and guided diffusion model.

* Autoregressive model: DALL-E.

* Facial manipulation with deep learning: FaceForensics++.

Each test set comprises an equal number of real images and AIGIs. Detailed descriptions of these datasets are provided in Table 2.

The training dataset, as described in [12, 33], comprises 720K images, evenly split between 360K real images from LSUN [56] and 360K AIGIs created by ProGAN. To evaluate the data efficiency of our method, we randomly select 4K real images from the training set. It is important to note that we
<figure><img src="image_6.png" /><figcaption>FIGURE 5: Visualization of color transfer. (a) Source. (b) Target. (c) CT.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>FIGURE 6: Visualization of Mix-Up. (a) Image A. (b) Image B. (c) MU.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>FIGURE 7: Visualization of patch shuffling and elastic transform. (a) Original. (b) PS. (c) ET.</figcaption></figure>

<table><caption>TABLE 2: Detailed information about benchmark test sets.</caption><thead><tr><th>Family</th><th>Generative model</th><th>Real images source</th><th>Number of images</th></tr></thead><tbody><tr><td rowspan="3">Unconditional</td><td>ProGAN</td><td>LSUN</td><td>8.0K</td></tr><tr><td>CycleGAN</td><td>Style/object transfer</td><td>2.6K</td></tr><tr><td>BigGAN</td><td>ImageNet</td><td>4.0K</td></tr><tr><td rowspan="3">Conditional</td><td>StyleGAN</td><td>LSUN</td><td>12.0K</td></tr><tr><td>GauGAN</td><td>COCO</td><td>10.0K</td></tr><tr><td>StarGAN</td><td>CelebA</td><td>4.0K</td></tr><tr><td>Deepfake</td><td>Face forensics</td><td>Videos of faces</td><td>5.4K</td></tr><tr><td>Conditional</td><td>Guided</td><td>ImageNet</td><td>2.0K</td></tr><tr><td rowspan="3">Text-to-image</td><td>LDM<sup>†</sup></td><td rowspan="3">LAION</td><td>6.0K</td></tr><tr><td>GLIDE<sup>‡</sup></td><td>6.0K</td></tr><tr><td>DALL-E</td><td>2.0K</td></tr></tbody></table>

do not use ProGAN images during training. Instead, we employ 4K proxy negative samples as a substitute for AIGIs to train our model.

### 6.1.3. Evaluation Metrics.
To ensure comparability with prior works, we evaluate our method using the following metrics:

* ACC: It measures the proportion of correctly classified samples.

* Average precision (AP): It evaluates the precision-recall trade-off across varying classification thresholds.

Both metrics are calculated for each test set to provide a comprehensive assessment of the method's performance.

<footnote>†Three variants, LDM 200 (200 steps of noise refinement), LDM 200 w/CFG (with classifier-free guidance), and LDM 100 (faster sampling with 100 steps).</footnote>

<footnote>‡Three variants, GLIDE 100-27 (100 steps for a low-resolution image at 64 × 64, followed by 27 steps for upsampling to 256 × 256), GLIDE 50-27 (50 steps for the low-resolution stage and 27 for upsampling), and GLIDE 100-10 (100 steps for the low-resolution stage and 10 for upsampling).</footnote>
The average values of both metrics across all benchmark test sets are also provided.

## 6.2. Detection Performance With Different Proxy Samples.
We first evaluate the performance of our model trained with various proxy samples, specifically using 4K real images and 4K proxy images. For both CT and MU, we adopt a consistent method: for a real image from a given LSUN semantic category, we randomly choose a target image from a different LSUN semantic category. This cross-category pairing introduces diversity in visual characteristics and semantics, encouraging the model to form a more robust decision boundary between real and fake images. The results, summarized in Tables 3 and 4, report the ACC and AP metrics across different generative models.

Our findings reveal that even without using AIGIs during training, our approach achieves competitive detection performance across diverse domains. When trained with ET images as proxy negative samples, the model demonstrates satisfactory average ACC and mean AP (mAP), validating the effectiveness of ET in simulating discriminative features. Training with CT images yields even better results, achieving an average ACC of **91.08%** and a mAP of **97.63%**. This emphasizes the efficacy of leveraging carefully constructed proxy images that retain real-image characteristics while introducing meaningful variations.

Notably, combining CT and ET images further enhances detection performance. Specifically, using a mix of 2K CT images and 2K ET images for training results in an average ACC of **95.58%** and a mAP of **99.39%**, surpassing the performance achieved when training our model with real and ProGAN images (i.e., the row of ProGAN in Tables 3 and 4), a common practice in prior studies. The results indicate that training on real and ProGAN images yields strong performance within the GAN domain but may not be able to generalize effectively to other domains, such as guided diffusion, with a relatively low ACC in the row of ProGAN in Table 3. In contrast, the model trained with proxy samples CT + ET demonstrates improved generalization across diverse unseen generators, thereby highlighting the effectiveness of proxy samples in enhancing model robustness. We attribute this improvement to the complementary nature of the modifications: CT focuses on altering color information, while ET introduces shape distortions. Together, they provide a diverse set of proxy samples that help the model learn more discriminative features with improved generalization.

Conversely, the performance of PS and MU methods is less satisfactory. While these methods yield acceptable mAP scores, they exhibit relatively low ACC. We hypothesize that the distributions of proxy images generated by PS and MU diverge too significantly from that of real images. As a result, the classifier overfits to artifacts specific to these proxy samples, often misclassifying most images as “real.” This leads to suboptimal detection performance and highlights the importance of selecting proxy generation methods that align closely with the distribution of real images.

To investigate why training a model with real and proxy images enables generalization for detecting AIGIs, we analyzed the similarity between different image pairs in both the spatial domain and the CLIP feature domain. Table 5 presents the PSNR and SSIM values in the spatial domain, alongside cosine similarity and Euclidean distance metrics derived from embeddings generated by the CLIP image encoder.

From the table, we observe that most proxy image generation methods report similar PSNR values, with the exception of ET images, which exhibit slightly higher values. While methods such as PS and MU significantly disrupt the structural information of the images, CT images maintain relatively high SSIM scores. The SSIM values for ET images vary depending on the chosen $\alpha$ parameter, reflecting the degree of spatial distortion introduced.

In the CLIP embedding feature space, CT and ET images demonstrate higher similarity to real images, as evidenced by high cosine similarity and low Euclidean distance values. In contrast, PS and MU images exhibit lower similarity in this domain. Detection results in Tables 3 and 4 reveal a trend: models trained with PS or MU tend to predict the majority of samples as “real.” A similar tendency, as shown in Table 6, is observed for models trained with ET images, when the $\alpha$ value is set too high, resulting in similarity metrics of Table 5 comparable to those of PS and MU proxy images. These observations suggest that the classifier may overfit to artifacts in these proxy samples, often misclassifying most images as “real.” Conversely, when a low $\alpha$ value is used for ET, the proxy images become overly similar to real images, causing the model to fail at differentiating between the two. This phenomenon highlights the importance of maintaining a balanced similarity between proxy and real images. Proxy images should not be too close to, nor too far from, real images in terms of their distribution. Striking this balance (e.g., by using in our method ET_50 with $\alpha$ = 50) allows the model to learn discriminative features with better generalization capabilities.

Furthermore, in Table 5, we also compare best-matched real and fake images (e.g., ProGAN and LDM_100 samples) in the CLIP embedding space. We find that fake images show lower similarity to real images compared to CT and ET_50 proxies. This finding indicates that proxy samples, by design, act as harder negative examples than AIGIs, forcing the model to learn more refined decision boundaries. Consequently, the model trained on such hard examples generalizes more effectively to diverse, unseen fake images that are farther from the real class in the feature space. Moreover, as further illustrated in the t-SNE visualization discussed in a later subsection (Figure 8), proxies not only serve as sentinels surrounding the real image cluster but also tend to “wrap around” the fake image distribution from various directions. This spatial arrangement implies that proxy samples could effectively capture the general features of diverse fake images, helping the model form robust and tight decision boundaries.

## 6.3. Comparison With Existing Methods.
We compared our approach with several existing methods for detecting AIGIs. These methods include the following:
<table><caption>TABLE 3: Detection accuracy (in %) of different proxy sample construction methods.</caption><thead><tr><th colspan="2">GANs</th><th colspan="10">Diffusion models</th><th colspan="2">Total</th></tr><tr><th>Negative samples</th><th>ProGAN</th><th>CycleGAN</th><th>BigGAN</th><th>StyleGAN</th><th>GauGAN</th><th>StarGAN</th><th>Face forensics</th><th>200s</th><th>LDM 200s w/CFG</th><th>100s</th><th>Guided</th><th>100-27.00</th><th>50-27.00</th><th>100-10.00</th><th>DALL-E</th><th>Avg ACC</th></tr></thead><tbody><tr><td>ProGAN</td><td><strong>99.95</strong></td><td><strong>98.85</strong></td><td><strong>99.50</strong></td><td>93.85</td><td><strong>99.35</strong></td><td>99.40</td><td>78.15</td><td>98.15</td><td>91.95</td><td><strong>98.30</strong></td><td>71.40</td><td>86.80</td><td>92.30</td><td>87.25</td><td>98.10</td><td>92.89</td></tr><tr><td>PS</td><td>54.90</td><td>57.00</td><td>57.60</td><td>50.10</td><td>60.10</td><td>50.15</td><td>50.00</td><td>51.60</td><td>50.45</td><td>51.95</td><td>50.00</td><td>50.60</td><td>50.65</td><td>50.55</td><td>51.45</td><td>52.47</td></tr><tr><td>MU</td><td>95.75</td><td>85.50</td><td>80.25</td><td>70.10</td><td>97.45</td><td>85.45</td><td>59.20</td><td>71.80</td><td>56.15</td><td>74.95</td><td>55.40</td><td>56.25</td><td>58.00</td><td>55.60</td><td>62.05</td><td>70.93</td></tr><tr><td>ET</td><td>95.85</td><td>95.55</td><td>94.05</td><td>77.40</td><td>95.75</td><td>88.40</td><td>82.30</td><td>81.00</td><td>64.95</td><td>81.70</td><td>71.50</td><td>92.95</td><td>92.60</td><td>93.75</td><td>81.65</td><td>85.96</td></tr><tr><td>CT</td><td>97.55</td><td>96.10</td><td>95.30</td><td>95.85</td><td>88.60</td><td><strong>99.60</strong></td><td>55.85</td><td><strong>98.30</strong></td><td><strong>97.40</strong></td><td>98.25</td><td>75.45</td><td>87.80</td><td>91.85</td><td>88.90</td><td><strong>99.40</strong></td><td>91.08</td></tr><tr><td>CT + ET</td><td>99.50</td><td>98.30</td><td>90.80</td><td><strong>97.85</strong></td><td>91.20</td><td>99.15</td><td><strong>90.05</strong></td><td>96.90</td><td>95.60</td><td>97.05</td><td><strong>92.85</strong></td><td><strong>95.50</strong></td><td><strong>95.75</strong></td><td><strong>95.95</strong></td><td>97.30</td><td><strong>95.58</strong></td></tr></tbody></table>

Note: The best result in each column is highlighted in bold.
<table><caption>TABLE 4: Average precision results (in %) of different proxy sample construction methods.</caption><thead><tr><th colspan="10">GANs</th><th colspan="5">Diffusion models</th><th colspan="2">Total</th></tr><tr><th>Negative samples</th><th>ProGAN</th><th>CycleGAN</th><th>BigGAN</th><th>StyleGAN</th><th>GauGAN</th><th>StarGAN</th><th>Face forensics</th><th>LDM 200s w/ CFG</th><th>Guided 100s</th><th>GLIDE 100-27.00</th><th>50-27.00</th><th>100-10.00</th><th>DALL-E</th><th>mAP</th></tr></thead><tbody><tr><td>ProGAN</td><td>100.00</td><td>99.99</td><td>99.94</td><td>99.72</td><td>100.00</td><td>100.00</td><td>97.93</td><td>99.89</td><td>99.04</td><td>99.85</td><td>91.97</td><td>98.14</td><td>98.15</td><td>99.88</td><td>98.84</td></tr><tr><td>PS</td><td>99.04</td><td>99.13</td><td>99.09</td><td>89.30</td><td>99.26</td><td>99.88</td><td>73.97</td><td>94.68</td><td>86.81</td><td>94.73</td><td>66.63</td><td>81.04</td><td>84.13</td><td>83.11</td><td>96.01</td><td>89.79</td></tr><tr><td>MU</td><td>99.71</td><td>98.65</td><td>97.54</td><td>93.70</td><td>99.85</td><td>99.93</td><td>92.42</td><td>96.89</td><td>85.78</td><td>97.16</td><td>84.86</td><td>86.35</td><td>90.69</td><td>86.86</td><td>90.94</td><td>93.42</td></tr><tr><td>ET</td><td>99.78</td><td>99.65</td><td>98.18</td><td>93.34</td><td>99.77</td><td>99.95</td><td>95.41</td><td>93.55</td><td>81.21</td><td>93.28</td><td>94.91</td><td>98.29</td><td>98.32</td><td>98.60</td><td>93.71</td><td>95.86</td></tr><tr><td>CT</td><td>99.80</td><td>99.88</td><td>98.81</td><td>99.55</td><td>98.59</td><td>100.00</td><td>88.76</td><td>99.79</td><td>99.69</td><td>99.81</td><td>83.77</td><td>98.39</td><td>98.98</td><td>98.60</td><td>99.99</td><td>97.63</td></tr><tr><td>CT + ET</td><td>99.99</td><td>100.00</td><td>99.66</td><td>99.83</td><td>99.96</td><td>100.00</td><td>96.77</td><td>99.79</td><td>99.13</td><td>99.80</td><td>98.27</td><td>99.12</td><td>99.25</td><td>99.23</td><td>99.99</td><td>99.39</td></tr></tbody></table>

Note: The best result in each column is highlighted in bold.
<table><caption>TABLE 5: Comparison of spatial domain and CLIP embedding metrics.</caption><thead><tr><th rowspan="2">Images</th><th colspan="3">Spatial domain</th><th colspan="2">CLIP embedding</th></tr><tr><th>SSIM</th><th>PSNR</th><th>CosSim</th><th>EuDist</th></tr></thead><tbody><tr><td>PS</td><td>0.1716</td><td>28.33</td><td>0.6599</td><td>14.75</td></tr><tr><td>MU</td><td>0.5819</td><td>27.94</td><td>0.6807</td><td>14.33</td></tr><tr><td>CT</td><td>0.7864</td><td>28.05</td><td>0.9094</td><td>7.61</td></tr><tr><td>ET_30</td><td>0.7625</td><td>32.48</td><td>0.9391</td><td>6.12</td></tr><tr><td>ET_50</td><td>0.6372</td><td>31.60</td><td>0.8403</td><td>10.11</td></tr><tr><td>ET_100</td><td>0.4770</td><td>30.68</td><td>0.6509</td><td>15.48</td></tr><tr><td>ProGAN</td><td>—</td><td>—</td><td>0.7507</td><td>13.63</td></tr><tr><td>LDM_100</td><td>—</td><td>—</td><td>0.6443</td><td>15.98</td></tr></tbody></table>

Note: Three variants of ET proxy samples: ET_30, ET_50, and ET_100, where the numbers represent the alpha values used to construct elastic transformed images.

<table><caption>TABLE 6: Detection performance when trained on ET with different α.</caption><thead><tr><th>ACC (in %)</th><th>ET_30</th><th>ET_50</th><th>ET_100</th></tr></thead><tbody><tr><td>Real</td><td>75.90</td><td>96.01</td><td>99.81</td></tr><tr><td>Fake</td><td>82.50</td><td>75.91</td><td>28.46</td></tr><tr><td>Mean</td><td>79.20</td><td>85.96</td><td>64.14</td></tr></tbody></table>

* CNNSpot [12]: It fine-tunes a ResNet-50 model on 720K real/ProGAN images for classification.

* Patch forensics [23]: It detects image fingerprints in the frequency domain.

* Co-occurrence [11]: It combines co-occurrence matrices with deep learning for image classification.

* DIRE [13]: It utilizes reconstruction errors to detect AIGIs.

* UnivFD [33]: It employs CLIP features, followed by linear probing, to classify real images and AIGIs.

* RINE [36]: Leverages representations from intermediate transformer blocks of CLIP's image encoder, using a learnable block to construct the detector.

For fair comparison and as proposed in [12], all baseline methods were trained on the same supervised and balanced dataset comprising 720K real and ProGAN images, except RINE, which was trained on 144K real and ProGAN images as in its original paper.

Tables 7 and 8 summarize the average classification ACC and mAP results for these methods, respectively. Despite being trained on only 4K real images and 4K proxy images, our method outperforms the baselines, achieving an average ACC of 95.58% and a mAP of 99.39%. A key observation from the results in Tables 7 and 8 is that methods trained on real/ProGAN images generally perform well within the GAN domain but often fail to generalize to other generative domains, such as diffusion or autoregressive models. In contrast, our approach demonstrates superior generalization across various domains.

Comparing UnivFD with CNNSpot, patch forensics, co-occurrence, and DIRE, we observe that CLIP-based detectors demonstrate better performance and improve generalization across diverse AIGI domains. Comparing RINE and UnivFD, we find that leveraging intermediate CLIP

features significantly enhances detection performance, even when trained on fewer samples (144K for RINE vs. 720K for UnivFD). This highlights the advantage of extracting and utilizing richer feature representations from CLIP.

Our method requires less computational cost compared to RINE. When trained on even fewer hybrid proxy images (8K vs. 144K), it achieves superior detection performance with better generalization. This efficiency and effectiveness can be attributed to the use of proxy images as negative samples and the proposed Donut loss function, which allows our model to be less sensitive to the domain-specific bias and distribution in the training data.

### 6.4. Ablation Studies and Component Analysis.
We conduct ablation studies to analyze the impact of different design choices in our model, including the fusion block and adapter layer. In addition, we evaluate how different margin settings in the Donut loss influence performance.

#### 6.4.1. Fusion and Adapter Designs.
Table 9 presents the detection ACC of the three fusion strategies mentioned in Section 4.2, and the results reveal that the simple averaging block (avg) outperforms the other two methods. While MSA (SA_avg) can capture dependencies between features, it introduces unnecessary complexity that may lead to overfitting, especially in low-data regimes. Similarly, the ws approach fails to outperform the simple average, likely due to the additional learnable parameters being more prone to overfitting.

We compared the linear layer and the convolutional layer (as presented in Section 4.3) for adapting the CLIP features to the task of AIGI detection. As shown in Table 10, the linear layer outperforms the convolutional layer. We hypothesize that the linear adapter, being simpler, is less likely to overfit during knowledge transfer from the large-scale pretrained CLIP model. Conversely, the complexity of the convolutional layer may overfit the specific patterns in the dataset, leading to suboptimal performance. These findings show the importance of architectural simplicity when transferring knowledge from a large-scale model to our domain-specific task.

#### 6.4.2. Margin Hyperparameters.
We conduct hyperparameter tuning experiments to evaluate the effect of the margin parameters $m_{Real}$ and $m_{AIGI}$ in equation (15), as
<figure><img src="image_9.png" /><figcaption>FIGURE 8: t-SNE visualization of some test sets in the feature space output by the adapter of our model. Circles indicate correctly predicted samples, while crosses represent misclassified samples. (a) BCE. (b) Donut.</figcaption></figure>

summarized in Table 11. The results demonstrate that our method remains relatively stable across a range of values for these parameters, indicating that the Donut loss is not overly sensitive to their exact settings. Notably, the model consistently achieves over 99% mAP and approximately 95% average ACC under all configurations. Among the tested values, a very satisfying overall performance is observed with $m_{Real} = 0.5$ and $m_{AIGI} = 2.5$, which we choose as the default setting.

**6.5. Effect of Donut loss.** To enhance the generalization ability of AIGI detection, we proposed the Donut loss function. In this section, we evaluate its effectiveness compared to the commonly used BCE loss.

The radar chart in Figure 9 illustrates the detection ACC on the test sets across various generative models. The results clearly demonstrate the advantage of the Donut loss, as it consistently improves detection ACC across almost all generators. Notably, when training the model with CT images or the hybrid combination of CT and ET images, the Donut loss delivers substantial gains, demonstrating its ability to enhance model generalization across diverse AIGI domains.

To further investigate the effectiveness of the Donut loss, we visualized the distributions of adapted features of some test sets using t-SNE, as shown in Figure 8. The t-SNE plot highlights two key findings:

* Features from models trained with the Donut loss are more closely clustered, enhancing their discriminative power. This clustering implies that the model can better separate real and AIGIs.

* The right portion of Figure 8 reveals that proxy images serve as sentinels (orange and green point clouds for, respectively, CT and ET proxy images), effectively separating real images from AIGIs. This behavior aligns with our motivation for using proxy images as a means of enhancing feature diversity and improving model generalization.

In all, these results demonstrate that the Donut loss not only improves detection ACC but also enhances feature separability, making it a crucial component of our approach.

**6.6. Robustness to Image Processing Operations and Adversarial Attacks.** To evaluate the robustness of our detector to image postprocessing operations and adversarial perturbations, we conduct experiments involving JPEG compression, Gaussian blur, and adversarial attacks using the fast gradient sign method (FGSM) [57].

For postprocessing operations, we apply JPEG compression with quality factors of 90, 80, and 70 and Gaussian blur with $\sigma$ values of 0.5, 1.0, and 1.5 (kernel size = 3) to the test images. For adversarial robustness, we generate perturbed samples with FGSM at varying perturbation strengths ($\epsilon$ values). We compare our method (ours [proxy]) with two baselines: UnivFD [33] and our model trained using ProGAN-generated samples (Ours [ProGAN], corresponding to the row ProGAN in Tables 3 and 4.

As shown in Figure 10, for postprocessing, all three models exhibit a similar trend of reduced ACC as JPEG compression quality factors decrease and Gaussian blur sigma values increase. This confirms that, when trained with proxy images, our model demonstrates comparable robustness to postprocessing operations as when trained with ProGAN images. Regarding adversarial attacks, while adversarial perturbations degrade performance across all models, ours (proxy) consistently maintains higher ACC under attack compared to both baselines. The ACC of UnivFD continues to drop as $\epsilon$ increases, whereas the ACC of both ours (proxy) and ours (ProGAN) remains stable at certain $\epsilon$ values. This offers encouraging evidence that training with diverse proxy samples and using margin-based objectives can improve robustness to a meaningful extent. Understanding the observed performance fluctuations, such as the slight increase in ACC for larger $\epsilon$ values, and further enhancing robustness against postprocessing and attacks will be explored in future work.
<table><caption>TABLE 7: Generalization results (ACC, in %) with comparisons to other methods.</caption><thead><tr><th rowspan="2">Method</th><th rowspan="2">Data source</th><th rowspan="2">Data scale</th><th colspan="10">GANs</th><th colspan="5">Diffusion models</th><th rowspan="2">Total</th></tr><tr><th>ProGAN</th><th>CycleGAN</th><th>BigGAN</th><th>StyleGAN</th><th>GauGAN</th><th>StarGAN</th><th>Face forensics</th><th>200s</th><th>LDM 200s w/CFG</th><th>100s</th><th>Guided</th><th>GLIDE 100-27</th><th>50-27</th><th>100-10</th><th>DALL-E</th><th>Avg ACC</th></tr></thead><tbody><tr><td>CNNSpot</td><td>LSUN/ProGAN</td><td>360K/360K</td><td>99.99</td><td>85.20</td><td>70.20</td><td>85.70</td><td>78.95</td><td>91.70</td><td>53.47</td><td>54.03</td><td>54.96</td><td>54.14</td><td>60.07</td><td>60.78</td><td>63.80</td><td>65.66</td><td>55.58</td><td>68.95</td></tr><tr><td>Patch forensics</td><td>LSUN/ProGAN</td><td>360K/360K</td><td>75.03</td><td>68.97</td><td>68.47</td><td>79.16</td><td>64.23</td><td>63.94</td><td>75.54</td><td>76.50</td><td>76.10</td><td>75.77</td><td>67.41</td><td>74.81</td><td>73.28</td><td>68.52</td><td>67.91</td><td>71.71</td></tr><tr><td>Co-occurrence</td><td>LSUN/ProGAN</td><td>360K/360K</td><td>97.70</td><td>63.15</td><td>53.75</td><td>92.50</td><td>51.10</td><td>54.70</td><td>57.10</td><td>70.70</td><td>70.55</td><td>71.00</td><td>60.50</td><td>70.25</td><td>69.60</td><td>69.90</td><td>67.55</td><td>68.00</td></tr><tr><td>DIRE</td><td>LSUN/ProGAN</td><td>360K/360K</td><td>100.00</td><td>67.73</td><td>64.78</td><td>83.08</td><td>65.30</td><td>100.00</td><td>94.75</td><td>82.70</td><td>84.05</td><td>84.25</td><td>83.20</td><td>87.10</td><td>90.80</td><td>90.25</td><td>58.75</td><td>82.45</td></tr><tr><td>UnivFD</td><td>LSUN/ProGAN</td><td>360K/360K</td><td>100.00</td><td>98.50</td><td>94.50</td><td>82.00</td><td>99.50</td><td>97.00</td><td>66.60</td><td>94.19</td><td>73.76</td><td>94.36</td><td>70.03</td><td>79.07</td><td>79.85</td><td>78.14</td><td>86.78</td><td>86.28</td></tr><tr><td>RINE</td><td>LSUN/ProGAN</td><td>72K/72K</td><td>100.00</td><td>99.30</td><td>99.60</td><td>99.90</td><td>99.80</td><td>99.50</td><td>80.60</td><td>98.30</td><td>88.20</td><td>98.60</td><td>76.10</td><td>88.90</td><td>92.60</td><td>90.70</td><td>95.00</td><td>93.07</td></tr><tr><td>Ours</td><td>LSUN/CT + ET</td><td>4K/4K</td><td>99.50</td><td>98.30</td><td>90.80</td><td>97.85</td><td>91.20</td><td>99.15</td><td>90.05</td><td>96.90</td><td>95.60</td><td>97.05</td><td>92.85</td><td>95.50</td><td>95.75</td><td>95.95</td><td>97.30</td><td>95.58</td></tr></tbody></table>

Note: The best result in each column is highlighted in bold.
<table><caption>TABLE 8: Generalization results (AP, in %) with comparisons to other methods.</caption><thead><tr><th rowspan="2">Method</th><th rowspan="2">Data source</th><th rowspan="2">Data scale</th><th colspan="10">GANs</th><th colspan="5">Diffusion models</th><th rowspan="2">Total mAP</th></tr><tr><th>ProGAN</th><th>CycleGAN</th><th>BigGAN</th><th>StyleGAN</th><th>GauGAN</th><th>StarGAN</th><th>Face forensics</th><th>200s</th><th>LDM 200s w/CFG</th><th>Guided 100s</th><th>GLIDE 100-27</th><th>50-27</th><th>100-10</th></tr></thead><tbody><tr><td>CNNSpot</td><td>LSUN/ProGAN</td><td>360K/360K</td><td><strong>100.00</strong></td><td>93.47</td><td>84.50</td><td>99.54</td><td>89.49</td><td>98.15</td><td>89.02</td><td>70.62</td><td>71.00</td><td>70.54</td><td>73.72</td><td>80.65</td><td>84.91</td><td>82.07</td><td>70.59</td><td>89.02</td></tr><tr><td>Patch</td><td>LSUN/ProGAN</td><td>360K/360K</td><td>80.88</td><td>72.84</td><td>71.66</td><td>85.75</td><td>65.99</td><td>69.25</td><td>76.55</td><td>87.10</td><td>86.72</td><td>86.40</td><td>75.03</td><td>85.37</td><td>83.73</td><td>78.38</td><td>75.67</td><td>78.75</td></tr><tr><td>Co-occurrence</td><td>LSUN/ProGAN</td><td>360K/360K</td><td>99.74</td><td>80.95</td><td>50.61</td><td>98.63</td><td>53.11</td><td>67.99</td><td>59.14</td><td>91.21</td><td>89.02</td><td>92.39</td><td>70.20</td><td>89.32</td><td>88.35</td><td>82.79</td><td>80.96</td><td>79.63</td></tr><tr><td>DIRE</td><td>LSUN/ProGAN</td><td>360K/360K</td><td><strong>100.00</strong></td><td>76.73</td><td>72.80</td><td>97.06</td><td>68.44</td><td><strong>100.00</strong></td><td><strong>98.55</strong></td><td>95.17</td><td>95.43</td><td>95.77</td><td>94.29</td><td>96.18</td><td>97.30</td><td>97.53</td><td>68.73</td><td>90.26</td></tr><tr><td>UnivFD</td><td>LSUN/ProGAN</td><td>360K/360K</td><td><strong>100.00</strong></td><td>99.46</td><td>99.59</td><td>97.24</td><td>99.98</td><td>99.60</td><td>82.45</td><td>99.14</td><td>92.15</td><td>99.17</td><td>87.77</td><td>94.74</td><td>95.34</td><td>94.57</td><td>97.15</td><td>95.89</td></tr><tr><td>RINE</td><td>LSUN/ProGAN</td><td>72K/72K</td><td><strong>100.00</strong></td><td><strong>100.00</strong></td><td><strong>99.90</strong></td><td>99.40</td><td><strong>100.00</strong></td><td><strong>100.00</strong></td><td>97.90</td><td><strong>99.80</strong></td><td>98.30</td><td><strong>99.90</strong></td><td>96.40</td><td>98.80</td><td><strong>99.30</strong></td><td>98.90</td><td>99.30</td><td>99.19</td></tr><tr><td>Ours</td><td>LSUN/CT + ET</td><td>4K/4K</td><td>99.99</td><td>99.99</td><td>99.66</td><td><strong>99.83</strong></td><td>99.96</td><td><strong>100.00</strong></td><td>96.77</td><td>99.79</td><td><strong>99.13</strong></td><td>99.80</td><td><strong>98.27</strong></td><td><strong>99.12</strong></td><td>99.25</td><td><strong>99.23</strong></td><td><strong>99.99</strong></td><td><strong>99.39</strong></td></tr></tbody></table>

Note: The best result in each column is highlighted in bold.
<table><caption>TABLE 9: Ablation on fusion block, with ACC in %.</caption><thead><tr><th>Fusion block</th><th>GANs</th><th>Diffusion models</th><th>Autoregressive model</th><th>Face forensics</th><th>Mean</th></tr></thead><tbody><tr><td>SA_avg</td><td>91.82</td><td>88.72</td><td>92.00</td><td>82.65</td><td>89.78</td></tr><tr><td>ws</td><td>94.24</td><td>95.33</td><td>96.85</td><td>80.35</td><td>94.00</td></tr><tr><td>Avg</td><td>96.13</td><td>95.66</td><td>97.30</td><td>90.05</td><td>95.58</td></tr></tbody></table>

Note: The results in the table are obtained using the linear layer variant for the adapter as the default setting. Generators are grouped into different categories for comparison.

<table><caption>TABLE 10: Ablation on adapter, with ACC in %.</caption><thead><tr><th>Adapter</th><th>GANs</th><th>Diffusion models</th><th>Autoregressive model</th><th>Face forensics</th><th>Mean</th></tr></thead><tbody><tr><td>Conv</td><td>88.43</td><td>89.66</td><td>92.30</td><td>71.10</td><td>88.11</td></tr><tr><td>Linear</td><td>96.13</td><td>95.66</td><td>97.30</td><td>90.05</td><td>95.58</td></tr></tbody></table>

Note: The results in the table are obtained using the mean variant for the fusion block as the default setting. Generators are grouped into different categories for comparison.

<table><caption>TABLE 11: The impact of hyperparameters $m_{Real}$ and $m_{AIGI}$.</caption><thead><tr><th>m<sub>Real</sub></th><th>m<sub>AIGI</sub></th><th>Avg ACC (in %)</th><th>mAP (in %)</th></tr></thead><tbody><tr><td>0.5</td><td>1.5</td><td>95.11</td><td>99.15</td></tr><tr><td>0.5</td><td>2.5</td><td><strong>95.58</strong></td><td><strong>99.39</strong></td></tr><tr><td>0.5</td><td>3.5</td><td>93.68</td><td>99.32</td></tr><tr><td>0.5</td><td>2.5</td><td><strong>95.58</strong></td><td>99.39</td></tr><tr><td>1.0</td><td>2.5</td><td>94.90</td><td>99.24</td></tr><tr><td>1.5</td><td>2.5</td><td>95.42</td><td><strong>99.56</strong></td></tr></tbody></table>

Note: The best result is highlighted in bold.

<figure><img src="image_10.png" /><figcaption>FIGURE 9: Detection accuracy (in %) across different image generators when training the model with BCE loss and Donut loss. (a) Results using only CT images as proxy samples. (b) Results using a hybrid combination of CT and ET images as proxy samples.</figcaption></figure>

6.7. *Influence of Different Real Image Sources.* To investigate the adaptability of our method to different real-image domains, we conducted additional experiments using different real images for training, sourced from datasets other than LSUN. Specifically, we experimented with real images from both ImageNet and COCO.

For ImageNet, we randomly sampled 4K real images from the ImageNet validation set (which are not in any AIGI detection test sets) and generated their corresponding proxy samples using the hybrid CT and ET strategy. The model trained under this setup achieved a detection ACC of 94.17% and a mAP of 98.50%. For COCO, we used the full validation set, which contains 5K real images, along with their proxy samples. The model trained with COCO achieved a detection ACC of 94.26% and a mAP of 98.72%. We note that the

COCO validation set overlaps with one of our test sets. However, this overlap accounts for only one out of the 15 test sets, and does not compromise the overall evaluation.

Table 12 compares the detection ACC and mAP of our method trained on different real image sources. It can be observed that all models exhibit similar average ACC and mAP values, indicating comparable detection confidence. These results demonstrate that our approach maintains robust performance even when the source of real images changes, supporting the domain-agnostic design of our proxies.

6.8. *Evaluation on Recent AI Image Generators.* To further assess the generalization capability of our method, we introduce a newly collected dataset featuring images generated
<figure><img src="image_11.png" /><figcaption>FIGURE 10: Robustness to image postprocessing and adversarial attacks. (a) Detection accuracy under different JPEG compression quality factors. (b) Detection accuracy under various sigma values for Gaussian blur. (c) Detection accuracy under adversarial attacks with different FGSM perturbation strengths (ε).</figcaption></figure>

<table><caption>TABLE 12: Detection performance of our method trained on different real image sources.</caption><thead><tr><td>Real image source</td><td>Avg ACC (in %)</td><td>mAP (in %)</td></tr></thead><tbody><tr><td>LSUN</td><td>95.58</td><td>99.39</td></tr><tr><td>ImageNet</td><td>94.17</td><td>98.50</td></tr><tr><td>COCO</td><td>94.26</td><td>98.72</td></tr></tbody></table>

<table><caption>TABLE 13: Detection performance (ACC, in %) on recent generators.</caption><thead><tr><td>Model</td><td>Stable Diffusion v1.5</td><td>DALL-E 3</td><td>DeepFloyd</td><td>RealVisXL_V4.0</td><td>StyleGAN2</td><td>VAR</td></tr></thead><tbody><tr><td>UnivFD [33]</td><td>53.90</td><td>49.55</td><td>53.35</td><td>49.65</td><td>75.65</td><td>75.65</td></tr><tr><td>Ours (ProGAN)</td><td>61.85</td><td>50.25</td><td>66.45</td><td>50.10</td><td>89.05</td><td><strong>81.95</strong></td></tr><tr><td>Ours (proxy)</td><td><strong>81.30</strong></td><td><strong>79.90</strong></td><td><strong>88.10</strong></td><td><strong>80.40</strong></td><td><strong>94.00</strong></td><td>79.25</td></tr></tbody></table>

Note: The best result is highlighted in bold.

by recent state-of-the-art generative models, including Stable Diffusion v1.5, DALL-E 3, DeepFloyd, RealVisXL_V4.0, StyleGAN2, and visual autoregressive (VAR) models.

Specifically, we first generate prompts by applying the BLIP [58] captioning model to the LSUN dataset. These prompts are then used to generate images from Stable Diffusion v1.5, DALL-E 3, DeepFloyd, and RealVisXL_V4.0, with 50 images generated for each of 20 LSUN categories. For VAR, we randomly sample 20 classes from ImageNet and generate 1000 images. The StyleGAN2 images are collected directly from publicly available sources online. This dataset complements existing benchmarks by introducing more recent and diverse generative models, offering a broader evaluation of detection performance against emerging threats in generative AI.

We apply trained detectors without fine-tuning on this new dataset to test their out-of-distribution performance. As shown in Table 13, our approach continues to deliver satisfying detection ACC, demonstrating that the proxy-based training strategy effectively enables generalization to unseen generators. Notably, the proposed method outperforms existing baselines when tested on the same dataset.

In addition, we evaluated our method on the challenging Chameleon dataset [59], which was specifically designed to expose the limitations of current detectors. As reported in the original paper, most existing methods fail on this benchmark, often predicting nearly all samples as real. Our method achieves 79.1% ACC on real images and 22.2% on fake images, showing a more balanced, albeit still limited, performance. This highlights both the difficulty of the dataset and the potential of our proxy-based design to maintain some level of discriminative ability in such challenging scenarios.

## 7. Conclusion and Future Work

In this paper, we proposed a novel data-efficient framework for detecting AIGIs that leverages proxy samples and a newly designed Donut loss function to enhance detection ACC and generalization across unseen domains. Our approach addresses key limitations of existing methods, such as their reliance on domain-specific data and their reduced effectiveness in cross-domain scenarios. By training on a combination of real images and hybrid proxy samples, our
method demonstrates satisfying detection performance on diverse generative models, including GANs, diffusion models, and autoregressive frameworks. The source code of our method will be shared online upon publication.

Comprehensive experiments confirmed the effectiveness of our approach in terms of ACC and generalization, while not using any AIGI for training. Notably, the Donut loss function proved instrumental in improving the model's discriminative capability by enforcing a more structured feature space and enhancing the separability of real and AIGIs. Visualizations, such as t-SNE plots, further validated our method, showing that proxy images act as sentinels in the feature space, guiding the model to better detect AIGIs.

We also conducted ablation studies to evaluate the contributions of key components, such as fusion block choices and adapter designs. Results have revealed that a simple averaging fusion mechanism outperforms more complex alternatives, and the linear adapter effectively transfers knowledge from CLIP's large-scale pretrained features to the detection task. These insights highlight the importance of simplicity and careful architectural choices when adapting foundation models for detection tasks under distribution shifts, especially in data-efficient training scenarios.

While our method achieves strong results with limited training data, several limitations remain. First, the design of proxy samples remains heuristic, and their quality directly impacts the effectiveness of the training process. Proxies overly similar to real ones can lead to reduced discriminability, whereas overly divergent proxies may harm generalization. Second, although our model shows resilience against common image postprocessing operations and adversarial attacks, it is not designed as a dedicated defense method and may still be vulnerable to stronger or adaptive attacks. Third, we observe that color correction operations, such as gamma adjustment, can negatively impact the detection performance on real images. When the gamma value deviates from 1, the detection ACC decreases, correlating with lower PSNR values compared to the unprocessed images. This highlights a potential limitation in differentiating between routine postprocessing and synthetic generation. In addition, the current framework assumes access to a large-scale pretrained model such as CLIP, and using CLIP as the backbone may introduce an overdependence on its feature representation, which could limit portability to other domains.

In conclusion, this work introduces a robust and generalizable detection framework that employs domain-agnostic proxy samples and a margin-aware objective to address the challenge of detecting diverse AIGIs in data-limited scenarios. The use of proxy samples as domain-agnostic negatives aligns with data-efficient learning and domain generalization, where robustness to distribution shifts is critical for real-world deployment. We hope this study provides a foundation for future research on lightweight, generalizable detection systems that enable the trustworthy use of generative technologies.

For future work, we plan to investigate more principled strategies for proxy sample generation and selection,

potentially leveraging optimized transformation, contrastive learning, or representation-level matching to obtain effective proxy candidates. We will also consider latent space data augmentation to expand proxy diversity and improve generalization. Enhancing robustness to diverse post-processing operations and adaptive attacks is another key direction. In addition, since CLIP emphasizes semantic-level features, we aim to incorporate low-level contextual or textural cues to enrich the learned representation. Finally, beyond detecting AIGIs, our framework could be extended to tackle other emerging challenges, such as identifying manipulated videos or deepfake audio.

## Data Availability Statement

The data that support the findings of this study are available from the corresponding author upon reasonable request.

## Disclosure

The preprint of our conference paper is available at https://hal.science/hal-04751823.

## Conflicts of Interest

The authors declare no conflicts of interest.

## Author Contributions

Conceptualization and methodology: Ji Li and Kai Wang.
Validation: Ji Li. Writing: Ji Li and Kai Wang.
Supervision: Kai Wang.

## Funding

This work was partially funded by the French National Research Agency (Grants nos. ANR-23-IAS4-0004-02 and ANR-15-IDEX-02).

## Acknowledgments

The authors would like to thank Dr. Patrick Bas, Dr. Georges Quénot, and Dr. Rony Abecidan for helpful discussions and for pointing out some references. The authors are grateful to Thai Ngoc Toan Truong for his help with some experiments. Kai Wang would like to thank NVIDIA for a GPU gift.

## References

[1] I. Goodfellow, J. Pouget-Abadie, M. Mirza, et al., “Generative Adversarial Nets,” *Advances in Neural Information Processing Systems* 27 (2014): 2672–2680.

[2] J. Ho, A. Jain, and P. Abbeel, “Denoising Diffusion Probabilistic Models,” *Advances in Neural Information Processing Systems* 33 (2020): 6840–6851.

[3] A. Piva, “An Overview on Image Forensics,” *ISRN Signal Processing* 2013, no. 1 (2013): 496701–496722, https://doi.org/10.1155/2013/496701.

[4] L. Verdoliva, “Media Forensics and Deepfakes: An Overview,” *IEEE Journal of Selected Topics in Signal Processing* 14, no. 5 (2020): 910–932, https://doi.org/10.1109/jstsp.2020.3002101.
[5] I. Castillo Camacho and K. Wang, "A Comprehensive Review of Deep-Learning-Based Methods for Image Forensics," *Journal of Imaging* 7, no. 4 (2021): 69, https://doi.org/10.3390/jimaging7040069.

[6] J. Redmon, S. Divvala, R. Girshick, and A. Farhadi, "You Only Look Once: Unified, Real-Time Object Detection," in *Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition* (2016), 779-788, https://doi.org/10.1109/cvpr.2016.91.

[7] O. Ronneberger, P. Fischer, and T. Brox, "U-Net: Convolutional Networks for Biomedical Image Segmentation," in *Proceedings of the International Conference on Medical Image Computing and Computer-Assisted Intervention* (2015), 234-241, https://doi.org/10.1007/978-3-319-24574-4_28.

[8] S. Ranjan Mishra, H. Mohapatra, and S. Saxena, "Leveraging Data Analytics and a Deep Learning Framework for Advancements in Image Super-Resolution Techniques: From Classic Interpolation to Cutting-Edge Approaches," in *Data Analytics and Machine Learning: Navigating the Big Data Landscape* (Springer, 2024), 105-126.

[9] W. Quan, K. Wang, D.-M. Yan, and X. Zhang, "Distinguishing Between Natural and Computer-Generated Images Using Convolutional Neural Networks," *IEEE Transactions on Information Forensics and Security* 13, no. 11 (2018): 2772-2787, https://doi.org/10.1109/tifs.2018.2834147.

[10] W. Bai, Z. Zhang, B. Li, et al., "Robust Texture-Aware Computer-Generated Image Forensic: Benchmark and Algorithm," *IEEE Transactions on Image Processing* 30 (2021): 8439-8453, https://doi.org/10.1109/tip.2021.3114989.

[11] L. Nataraj, T. M. Mohammed, B. S. Manjunath, et al., "Detecting GAN Generated Fake Images Using Co-Occurrence Matrices," *Electronic Imaging* 31, no. 5 (2019): 532-1-7, https://doi.org/10.2352/issn.2470-1173.2019.5.mwsf-532.

[12] S.-Yu Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros, "CNN-Generated Images Are Surprisingly Easy to Spot for Now," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2020), 8695-8704.

[13] Z. Wang, J. Bao, W. Zhou, et al., "DIRE for Diffusion-Generated Image Detection," in *Proceedings of the IEEE/CVF International Conference on Computer Vision* (2023), 22445-22455.

[14] Ji Li and K. Wang, "Detecting Computer-Generated Images by Using Only Real Images," in *Proceedings of the International Conference on Machine Vision* (2024), 1-13.

[15] D. P. Kingma, "Auto-encoding Variational Bayes," *arXiv preprint arXiv:1312.6114* (2013).

[16] M. Chen, A. Radford, R. Child, et al., "Generative Pretraining from Pixels," in *Proceedings of the International Conference on Machine Learning* (2020), 1691-1703.

[17] L. Dinh, J. Sohl-Dickstein, and S. Bengio, "Density Estimation Using Real NVP," in *International Conference on Learning Representations* (2017), 1-12.

[18] T. Karras, "Progressive Growing of GANs for Improved Quality, Stability, and Variation," *arXiv preprint arXiv:1710.10196* (2017).

[19] T. Karras, "A Style-Based Generator Architecture for Generative Adversarial Networks," *arXiv preprint arXiv:1812.04948* (2019).

[20] J. Song, C. Meng, and S. Ermon, "Denoising Diffusion Implicit Models," in *Proceedings of the International Conference on Learning Representations* (2020), 1-12.

[21] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, "High-Resolution Image Synthesis with Latent Diffusion Models," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2022), 10684-10695.

[22] A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen, "Hierarchical Text-Conditional Image Generation With CLIP Latents," *arXiv preprint arXiv:2204.06125* (2022).

[23] X. Zhang, S. Karaman, and S.-F. Chang, "Detecting and Simulating Artifacts in GAN Fake Images," in *Proceedings of the IEEE International Workshop on Information Forensics and Security* (2019), 1-6.

[24] J. Frank, T. Eisenhofer, L. Schönherr, A. Fischer, D. Kolossa, and T. Holz, "Leveraging Frequency Analysis for Deep Fake Image Recognition," in *Proceedings of the International Conference on Machine Learning* (2020), 3247-3258.

[25] K. Chandrasegaran, N.-T. Tran, and N.-M. Cheung, "A Closer Look at Fourier Spectrum Discrepancies for CNN-Generated Images Detection," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2021), 7200-7209.

[26] S. R. Mishra, H. Mohapatra, S. A. Edalatpanah, and M. K. Gourisaria, "Advanced Deepfake Detection Leveraging Swin Transformer Technology," *Engineering Review* 44, no. 4 (2024): 45-56, https://doi.org/10.30765/er.2583.

[27] R. Ma, J. Duan, F. Kong, X. Shi, and K. Xu, "Exposing the Fake: Effective Diffusion-Generated Images Detection," *arXiv preprint arXiv:2307.06272* (2023).

[28] Y. Luo, J. Du, Ke Yan, and S. Ding, "Lare2: Latent Reconstruction Error Based Method for Diffusion-Generated Image Detection," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2024), 17006-17015, https://doi.org/10.1109/cvpr52733.2024.01609.

[29] J. Ricker, D. Lukovnikov, and A. Fischer, "Aeroblade: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2024), 9130-9140, https://doi.org/10.1109/cvpr52733.2024.00872.

[30] B. Chen, J. Zeng, J. Yang, and R. Yang, "DRCT: Diffusion Reconstruction Contrastive Training towards Universal Detection of Diffusion Generated Images," in *Proceedings of the International Conference on Machine Learning* (2024), 7621-7639.

[31] C. T. Doloriel and N. M. Cheung, "Frequency Masking for Universal Deepfake Detection," in *Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing* (2024), 13466-13470, https://doi.org/10.1109/icassp48485.2024.10446290.

[32] C. Tan, H. Liu, Y. Zhao, et al., "Rethinking the Up-Sampling Operations in CNN-Based Generative Network for Generalizable Deepfake Detection," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2024), 28130-28139, https://doi.org/10.1109/cvpr52733.2024.02657.

[33] U. Ojha, Y. Li, and Y. J. Lee, "Towards Universal Fake Image Detectors that Generalize across Generative Models," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2023), 24480-24489, https://doi.org/10.1109/cvpr52729.2023.02345.

[34] A. Radford, J. W. Kim, C. Hallacy, et al., "Learning Transferable Visual Models from Natural Language Supervision," in *Proceedings of the International Conference on Machine Learning* (2021), 8748-8763.

[35] D. Cozzolino, G. Poggi, R. Corvi, M. Nießner, and L. Verdoliva, "Raising the Bar of AI-Generated Image Detection with CLIP," in *Proceedings of the IEEE/CVF Conference on Computer Vision on Computer Vision and Pattern Recognition* (2022), 10684-10695.
and Pattern Recognition Workshops (2024), 4356-4366, https://doi.org/10.1109/cvprw63382.2024.00439.

[36] C. Koutlis and S. Papadopoulos, "Leveraging Representations from Intermediate Encoder-Blocks for Synthetic Image Detection," in *Proceedings of the European Conference on Computer Vision* (2025), 394-411, https://doi.org/10.1007/978-3-031-73220-1_23.

[37] F. Zhuang, Z. Qi, K. Duan, et al., "A Comprehensive Survey on Transfer Learning," *Proceedings of the IEEE* 109, no. 1 (2021): 43-76, https://doi.org/10.1109/jproc.2020.3004555.

[38] S. Shen, L. H. Li, H. Tan, et al., "How Much Can CLIP Benefit Vision-And-Language Tasks?" *arXiv preprint arXiv: 2107.06383* (2021).

[39] R. Zhang, W. Zhang, R. Fang, et al., "Tip-Adapter: Training-Free Adaption of CLIP for Few-Shot Classification," in *Proceedings of the European Conference on Computer Vision* (2022), 493-510, https://doi.org/10.1007/978-3-031-19833-5_29.

[40] A. Dosovitskiy, L. Beyer, A. Kolesnikov, et al., "An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale," *arXiv preprint arXiv:2010.11929* (2020).

[41] Z. Liu, Y. Lin, Y. Cao, et al., "Swin Transformer: Hierarchical Vision Transformer Using Shifted Windows," in *Proceedings of the IEEE/CVF International Conference on Computer Vision* (2021), 10012-10022.

[42] H. Bao, L. Dong, S. Piao, and F. Wei, "BEiT: Bert Pre-training of Image Transformers," *arXiv preprint arXiv:2106.08254* (2021).

[43] M. Singh, L. Gustafson, A. Adcock, et al., "Revisiting Weakly Supervised Pre-training of Visual Perception Models," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2022), 804-814.

[44] K. He, X. Chen, S. Xie, Y. Li, P. Dollár, and R. Girshick, "Masked Autoencoders Are Scalable Vision Learners," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2022), 16000-16009.

[45] M. Singh, Q. Duval, K. V. Alwala, et al., "The Effectiveness of MAE Pre-pretraining for Billion-Scale Pretraining," in *Proceedings of the IEEE/CVF International Conference on Computer Vision* (2023), 5484-5494.

[46] M. Oquab, T. Darcet, T. Moutakanni, et al., "Dinov2: Learning Robust Visual Features without Supervision," *arXiv preprint arXiv:2304.07193* (2023).

[47] M. Cherti, R. Beaumont, R. Wightman, et al., "Reproducible Scaling Laws for Contrastive Language-Image Learning," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2023), 2818-2829, https://doi.org/10.1109/cvpr52729.2023.00276.

[48] Z. Lin, S. Geng, R. Zhang, et al., "Frozen CLIP Models Are Efficient Video Learners," in *Proceedings of the European Conference on Computer Vision* (2022), 388-404, https://doi.org/10.1007/978-3-031-19833-5_23.

[49] M. Barraco, M. Cornia, S. Cascianelli, L. Baraldi, and R. Cucchiara, "The Unreasonable Effectiveness of CLIP Features for Image Captioning: an Experimental Analysis," in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition* (2022), 4662-4670.

[50] T. Huang, B. Dong, Y. Yang, et al., "CLIP2Point: Transfer CLIP to Point Cloud Classification with Image-Depth Pre-training," in *Proceedings of the IEEE/CVF International Conference on Computer Vision* (2023), 22157-22167.

[51] A. Vaswani, N. Shazeer, N. Parmar, et al., "Attention Is All You Need," *Advances in Neural Information Processing Systems* 30 (2017): 1-11.

[52] Y. Jiang, D. Krishnan, H. Mobahi, and S. Bengio, "Predicting the Generalization Gap in Deep Networks with Margin Distributions," *arXiv preprint arXiv:1810.00113* (2019).

[53] P. Perera and V. M. Patel, "Learning Deep Features for One-Class Classification," *IEEE Transactions on Image Processing* 28, no. 11 (2019): 5450-5463, https://doi.org/10.1109/tip.2019.2917862.

[54] E. Reinhard, M. Adhikhmin, B. Gooch, and P. Shirley, "Color Transfer between Images," *IEEE Computer Graphics and Applications* 21, no. 4 (2001): 34-41, https://doi.org/10.1109/38.946629.

[55] H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz, "Mixup: Beyond Empirical Risk Minimization," in *Proceedings of the International Conference on Learning Representations* (2018), 1-13.

[56] Y. Fisher, A. Seff, Y. Zhang, S. Song, T. Funkhouser, and J. Xiao, "LSUN: Construction of a Large-Scale Image Dataset Using Deep Learning with Humans in the Loop," *arXiv preprint arXiv:1506.03365* (2015).

[57] I. J. Goodfellow, J. Shlens, and C. Szegedy, "Explaining and Harnessing Adversarial Examples," in *Proceedings of the International Conference on Learning Representations* (2015), 1-11.

[58] J. Li, D. Li, C. Xiong, and S. Hoi, "BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generation," in *Proceedings of the International Conference on Machine Learning* (2022), 12888-12900.

[59] S. Yan, O. Li, J. Cai, et al., "A Sanity Check for AI-Generated Image Detection," in *Proceedings of the International Conference on Learning Representations* (2025), 1-19.