SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Images often encounter degradation problems during propagation [31], such as low resolution, compression, and noise interference. Detectors are supposed to be robust to these challenges. To address this, we propose evaluating the performance of the detector on these degraded images, which
Table 4: Results of cross-validation on different training and test subsets using different methods. Eight models trained on eight generators are tested on one generator, and their average accuracy is each data point in the testing subset column.
Method	Testing Subset	Avg Acc.(%)
Midjourney	SD V1.4	SD V1.5	ADM	GLIDE	Wukong	VQDM	BigGAN
ResNet-50 [9]	59.0	72.3	72.4	59.7	73.1	71.4	60.9	66.6	66.9
DeiT-S [28]	60.7	74.2	74.2	59.5	71.1	73.1	61.7	66.3	67.6
Swin-T [17]	61.7	76.0	76.1	61.3	76.9	75.1	65.8	69.5	70.3
CNNSpot [31]	58.2	70.3	70.2	57.0	57.1	67.7	56.7	56.6	61.7
Spec [38]	56.7	72.4	72.3	57.9	65.4	70.3	61.7	64.3	65.1
F3Net [23]	55.1	73.1	73.1	66.5	57.8	72.3	62.1	56.5	64.6
GramNet [18]	58.1	72.8	72.7	58.7	65.3	71.3	57.8	61.2	64.7
Table 5: Model evaluation on degraded images. q denotes quality.
Method	Testing Subset	Avg Acc(%)
LR (112)	LR (64)	JPEG (q=65)	JPEG (q=30)	Blur (σ=3)	Blur (σ=5)
ResNet-50 [9]	96.2	57.4	51.9	51.2	97.9	69.4	70.6
DeiT-S [28]	97.1	54.0	55.6	50.5	94.4	67.2	69.8
Swin-T [17]	97.4	54.6	52.5	50.9	94.5	52.5	67.0
CNNSpot [31]	50.0	50.0	97.3	97.3	97.4	77.9	78.3
Spec [38]	50.0	49.9	50.8	50.4	49.9	49.9	50.1
F3Net [23]	50.0	50.0	89.0	74.4	57.9	51.7	62.1
GramNet [18]	98.8	94.9	68.8	53.4	95.9	81.6	82.2
more accurately simulate practical conditions, as shown in Table 5. After training the detector on our Stable Diffusion V1.4 subset, we employ a series of methods to degrade only the testing set images. Specifically, we downsample the images to resolutions of 112 and 64 only in the testing set. Furthermore, we utilize JPEG compression with quality ratios of 65 and 30, introducing compression artifacts. To introduce blurring effects, we incorporate Gaussian Blurring. As baseline models, ResNet-50, DeiT-S, and Swin-T all present similar results. They all detect images well for the low resolution at  $112 \times 112$ . However, for the lower resolution of  $64 \times 64$ , they present poorer results. The experimental results suggest that these models are more sensitive to resolution. For Gaussian blurring, these models also demonstrate similar performance. JPEG compression has a significant impact on these backbone models. It is worth noting that CNNSpot is robust to both JPEG compression and Gaussian blurring, which is basically due to the fact that CNNSpot uses JPEG compression and Gaussian blurring as additional data preprocessing during training. Therefore, designing a reasonable preprocessing method is a promising way to solve the degraded image classification problem in our dataset. By applying these detectors to degraded images, we gain valuable insights into their performance under various challenging conditions. This evaluation provides a more comprehensive understanding of the capability of the detector to handle practical image degradation.
5 GenImage Analysis
In this section, we conduct extensive experiments to investigate the characteristics of GenImage, and the effectiveness of this dataset.
5.1 Effect of Increasing the Number of Images
In general, increasing the scale of the dataset has been commonly believed to improve the performance of the classification model. However, this observation has not been fully explored in the fake image detection task. To assist the assessment of necessary data quantity, we conduct comprehensive experiments, as shown in Table 6. We conduct a preliminary experiment using Stable Diffusion V1.4 generated images. In particular, our training set is generated solely by Stable Diffusion V1.4. Two different settings are introduced in the testing set. In identical-generator setting, the testing set is composed of 6000 fake images. On the other hand, in the cross-generator setting, the testing set contains 50000 fake images from 8 different generators. The same number of real images is collected from ImageNet [4]. Firstly, we train a ResNet-50 on a dataset consisting of 10 classes, with each class containing 160 fake images. The number of real images is identical to the number of fake
Table 6: Results of increasing the number of images.
Total	Image Classes	Images Per Class	Identical-Generator Acc. (%)	Cross-Generator Acc. (%)
1600	10	160	73.6	60.9
1600	100	16	81.8	62.7
16000	100	160	97.7	68.7
16000	1000	16	96.3	68.4
162000	1000	162	99.9	72.1
Figure 2: Frequency analysis on real images and generated images.
images. The accuracy achieved on the identical-generator testing set was only  $73.6\%$ , and even lower on the cross-generator testing set. We further expand our training set from two aspects: by increasing the number of classes and by increasing the number of images within each class. Encouragingly, we observe that the performance substantially improves with both approaches. This observation underscores the significance of augmenting the training set.
5.2 Frequency Analysis
In Figure 2, we visualize the average spectral spectra of real images and fake images from different generators. Following CNNSpot [31], we use the discrete Fourier transform to investigate artifacts generated by the generative model. The noise residuals  $R$  can be computed by the formula  $R = X - F(X)$ , where  $X$  is the input image, and  $F(\cdot)$  is the denoising filter DCNN [37]. For each image source, we average the noise residuals of 1000 randomly selected images and use the Fourier transform of the results for spectral analysis. Comparing the real image, the image generated by the GAN, and the image generated by the Diffusion model, some interesting results can be discovered. The results show that for GAN, artifacts are shown in the form of a regular grid. Real images from ImageNet contain few artifacts, as well as diffusion models. These results reflect that images from the diffusion models are closer to the real image than BigGAN, and therefore diffusion models present a greater challenge for detection. Durall et al. [6] show that the up-sampling methods, such as the up-convolution or transposed convolution lead to the inability of GANs to correctly approximate the spectral distributions of training data, which explains why the artifacts occur in GANs. Richer et al. [24] observe that the diffusion models do not produce grid-like artifacts in the frequency spectrum, but exhibit a systematic mismatch towards higher frequencies. The hypothesis is that less weight is attached to the higher frequencies during training since matching lower frequencies is more important to the perceived quality of generated images.
5.3 Image Class Generalization
In order to verify that the detector trained on our dataset can well generalize to different contents of images, we sample three subsets of classes, i.e., 10, 50, and 100, for training ResNet-50. It can be seen that it is possible to generalize well to other classes of images using only a subset of the 1000 classes, and the more classes in the subset, the better the generalization performance. We use all the generators for training and testing. We first keep the number of training data constant, i.e., 12,800 images are generated. The testing set contains 1000 classes of images with 50 generated
images for each class. The training set and the testing set encompass the images generated by the eight generators. The number of real images in each class is identical to that of the fake images.
As shown in Table 7, training on only a subset of image classes can also achieve good results on 1000 classes of images, and more classes of images achieve higher accuracy. This result validates the generalization performance of our dataset over image classes, which also implies training on 1000 classes can achieve better results on unseen images. We also compare the accuracy under two settings: 100 classes of im
Table 7: Results of increasing the class.
Image Classes	Fake Images Per Class	Acc.(%)
10	1280	78.8
50	256	80.3
100	128	81.2
100	1300	98.4
ages with 128 images for each class and 100 classes of images with 1300 images for each class. It can be seen that increasing the number of images for each class improves the accuracy.
5.4 Generator Correlation Analysis
As the generator category is not commonly available as prior knowledge, we conduct an extensive evaluation on the cross-generator image classification task, encompassing eight different generative methods, as shown in Figure 3. ResNet-50 is the detector. It can be seen that the same generator achieves optimal performance in both training and testing. Generators exhibiting higher similarity tend to yield superior cross-generator performance. For instance, Stable Diffusion V1.4 and Stable Diffusion V1.5, sharing similar architecture, demonstrate good classification results when trained on the former and tested on the latter. Likewise, the detection model trained on Stable Diffusion models can effectively generalize to Wukong. From Figure 3 (a), we can see that training on Stable Diffusion V1.4, Stable Diffusion V1.5, and Wukong yields the best overall generalization performance. Midjourney poses the greatest challenge in terms of generalization. Figure 3 (a) is the accuracy score map, which shows the accuracies with different training and testing approaches. In Figure 3 (b), we compute Pearson correlation based on the accuracy score map. Pearson correlation coefficient is a measure of linear correlation between two sets of data. Figure 3 (b) highlights that models with similar architectures tend to exhibit higher relevance, such as Stable Diffusion V1.4, Stable Diffusion V1.5, and Wukong.
(a) Accuracy score map
Figure 3: A visualization of generator correlations.
(b) Accuracy correlation map
5.5 Image Content Generalization
Our dataset encompasses a broad range of image classes, extending beyond the conventional limitations of face and art images. As demonstrated in Table 8, our dataset exhibits notable content generalization capability. Specifically, a ResNet-50 trained on our dataset effectively works on face and art images. LFW [11] is a publicly available database of face images designed for face recognition problem. We have assembled 10,000 face images from the LFW dataset, complemented by an equal number of images generated using face labels from the same dataset. Laion-Art is a subset of Laion-5B [26]. Several lightweight models estimate how people would rate each image in Laion-5B based on aesthetics, and the images with high scores are kept for Laion-Art.
DiffusionDB [34] is a large-scale gallery dataset with 1.8 million unique prompts. We have accumulated 10,000 art images from Laion-Art, alongside 10,000 art images generated using prompts from DiffusionDB, as shown in Figure 4. For training, we employ the Stable Diffusion V1.4 subset of GenImage. Stable Diffusion V1.4 is also used to generate the face and art fake images. We
Table 8: Image content generalization.
Image
Content	Image Source	Acc. (%)
Real	Fake
Face	LFW	SD V1.4	99.9
Art	Laion-Art	SD V1.4	95.0
directly evaluate our model on the testing dataset without finetuning. As shown by the table, our dataset exhibits a commendable generalization capacity, achieving over  $95.0\%$  accuracy in identifying face and art images.
Figure 4: The visualization of the face images and art images.
This paper introduces GenImage, a dataset specifically designed for detecting fake images generated by generative models. GenImage serves as a million-scale benchmark, surpassing previous datasets and benchmarks in terms of the number of images, image content, and generator selection. We propose two tasks, namely cross-generator image classification and degraded image classification, to assess the detection performance of existing detectors on GenImage. Additionally, a detailed analysis of the dataset is provided, enabling us to gain insights into how GenImage can contribute to the development of detectors for real-world applications.
[1] Jordan J Bird and Ahmad Lotfi. Cifake: Image classification and explainable identification of ai-generated synthetic images. arXiv preprint arXiv:2303.14126, 2023.
[2] Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. arXiv preprint arXiv:1809.11096, 2018.
[3] Hao Dang, Feng Liu, Joel Stehouwer, Xiaoming Liu, and Anil K Jain. On the detection of digital face manipulation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern recognition, pages 5781-5790, 2020.
[4] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. IEEE, 2009.
[5] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems, 34:8780-8794, 2021.
[6] Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7890–7899, 2020.
[7] Apurva Gandhi and Shomik Jain. Adversarial perturbations fool deepfake detectors. In 2020 international joint conference on neural networks (IJCNN), pages 1-8. IEEE, 2020.
[8] Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10696-10706, 2022.
[30] Run Wang, Felix Juefei-Xu, Lei Ma, Xiaofei Xie, Yihao Huang, Jian Wang, and Yang Liu. Fakespotter: A simple yet robust baseline for spotting ai-synthesized fake faces. arXiv preprint arXiv:1909.06122, 2019.
[31] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8695-8704, 2020.
[32] Yabin Wang, Zhiwu Huang, and Xiaopeng Hong. Benchmarking deeppart detection. arXiv preprint arXiv:2302.14475, 2023.
[33] Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion-generated image detection. arXiv preprint arXiv:2303.09295, 2023.
[34] Zijie J. Wang, Evan Montoya, David Munechika, Haoyang Yang, Benjamin Hoover, and Duen Horng Chau. DiffusionDB: A large-scale prompt gallery dataset for text-to-image generative models. arXiv:2210.14896 [cs], 2022.
[35] Wukong. https://xihe.mindspore.cn/modelzoo/wukong. 2022.
[36] Xin Yang, Yuezun Li, and Siwei Lyu. Exposing deep fakes using inconsistent head poses. In ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 8261-8265. IEEE, 2019.
[37] Kai Zhang, Wangmeng Zuo, Yunjin Chen, Deyu Meng, and Lei Zhang. Beyond a gaussian denoiser: Residual learning of deep cnn for image denoising. IEEE transactions on image processing, 26(7):3142-3155, 2017.
[38] Xu Zhang, Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in gan fake images. In 2019 IEEE international workshop on information forensics and security (WIFS), pages 1-6. IEEE, 2019.
[39] Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In Proceedings of the IEEE international conference on computer vision, pages 2223-2232, 2017.