Aligned Datasets Improve Detection of Latent Diffusion-Generated Images
Authors: Anirudh Sundara Rajan
Utkarsh Ojha
Jedidiah Schloesser
Yong Jae Lee
Venue: ICLR 2025 Poster (2025)
Keywords: Image Forensics
Latent Diffusion
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: As latent diffusion models (LDMs) democratize image generation capabilities, there is a growing need to detect fake images. A good detector should focus on the generative model’s fingerprints while ignoring image properties such as semantic content, resolution, file format, etc. Fake image detectors are usually built in a data-driven way, where a model is trained to separate real from fake images. Existing works primarily investigate network architecture choices and training recipes. In this work, we argue that in addition to these algorithmic choices, we also require a well-aligned dataset of real/fake images to train a robust detector. For the family of LDMs, we propose a very simple way to achieve this: we reconstruct all the real images using the LDM's autoencoder, without any denoising operation. We then train a model to separate these real images from their reconstructions. The fakes created this way are extremely similar to the real ones in almost every aspect (e.g., size, aspect ratio, semantic content), which forces the model to look for the LDM decoder's artifacts. We empirically show that this way of creating aligned real/fake datasets, which also sidesteps the computationally expensive denoising process, helps in building a detector that focuses less on spurious correlations, something that a very popular existing method is susceptible to. Finally, to demonstrate the effectivenss of dataset alignment, we build a detector using images that are not natural objects, and present promising results. Overall, our work identifies the subtle but significant issues that arise when training a fake image detector and proposes a simple and inexpensive solution to address these problems.

Published as a conference paper at ICLR 2025.
ALIGNED DATASETS IMPROVE DETECTION OF LATENT DIFFUSION-GENERATED IMAGES
Anirudh Sundara Rajan
Utkarsh Ojha²
Jedidiah Schloesser
Yong Jae Lee
University of Wisconsin-Madison
(asundararaj2, uojha, jschloesserJewisc.euu
yongjaelee@cs. wwwssswwiic..........
ABSTRACT
As latent diffusion models (LDMs) democratize image generation capabilities, there is growing need to detect fake images. A good detector should focus on the generative model's fingerprints while ignoring image properties such as se- mantic content, resolution, file format, etc. Fake image detectors are usually built in a data-driven way, where model is trained to separate real from fake im- ages. Existing works primarily investigate network architecture choices and train- ing recipes. In this work, we argue that in addition to these algorithmic choices, we also require well-aligned dataset of real/fake images train robust de- tector. For the family of LDMs, we propose very simple way to achieve this: we reconstruct all the real images using the LDM's autoencoder, without any de- noising operation. We then train model to separate these real images from their reconstructions. The fakes created this way are extremely similar the real ones in almost every aspect (e.g., size, aspect ratio, semantic content), which forces the model to look for the LDM decoder's artifacts. We empirically show that this way of creating aligned real/fake datasets, which also sidesteps the compu- tationally expensive denoising process, helps in building a detector that focuses less spurious correlations, something that very popular existing method is susceptible to. Finally, to demonstrate the effectivenss of dataset alignment, we build detector using images that are not natural objects, and present promising results. Overall, our work identifies the subtle but significant issues that arise when training fake image detector and proposes simple and inexpensive solu- tion to address these problems. For implementation details, visit our project page: i imisundarl3 www....gttu........ wt/iii//lliii htt/Alignneooorssscccs/..
INTRODUCTION
There has been a transformation in the visual world of the internet with the rise of modern generative
models. Diffusion models (Sohl-Dickstein et al., 2015: Song & Ermon 2020 Ho al. 2020
Dhariwal & Nichol, 2021) have been central to this shift, aided by internetsccle scale vision- vision-language lanuuage datasets like LAION (Schuhmann et al., 2022), allowing users to create images from text (Ramesh) et al. 2022. Rombach et al., 2022 Saharia et al. 2022). Some welcome these tools for boosting creativity and productivity; others, less so. Recently, AI Al-generated images led Twitter users to falsely believe Donald Trump had been arrested") As these algorithms grow powerful, skepticism over online images rises. Consequently, the field of fake image detection has grown to try to address these issues.
Class-conditional pixel-space diffusion models (Saharia et al., 2022 Ramesh et al. 2022) are com- putationally demanding and difficult customize. Latent Diffusion Models (LDMs) Vahdat al.) 2021 Rombach et al.) 2022) mitigate these challenges, making diffusion models more accessible.
Recent open-source text-to-image models (Chen al. 2023 Li al. 2024 Podell al. 2023)
exemplify this shift, though the same efficiency also raises concerns about misuse. Existing works
(Corvi et al. 2002 Cozzolino et al. 2024: Ojha
2024) detect images from these generators
Equal contribution

---

Published as a conference paper at ICLR 2025.
Text dataset
Complete di ffusion
Only autoencoder
"At lody "Cat strting ... "Paza on
Many forward passes
Single forward pass
Existing paradigm
Proposed
paradigm
VS
VS
Generated images
Real images
Reconstructed images
Different ways of generating images with the aid of latent diffusion models (LDMs). The most popular way (left) is to start from noise and a text prompt and go through the denoising process over many steps using a particular configuration (e.g., guidance scale, resolution, aspect ratio). Our proposed approach is to take a set of real images (middle) in their original form (e.g.. aspect ratio) and reconstruct them using only the LDM's autoencoder (right) without the denoising process.
Figure I:
but often fail post-processed ones, thereby limiting their practical use. Therefore, rather than focusing on generalization to unseen generators, we aim to improve the reliable detection of fake images from latent diffusion models (fully generated, not partially inpainted).
The most effective way to detect fake images involves two steps: collecting real images and generat- ing fake ones, then training classifier to distinguish them. While much research focuses on training strategies such as using augmentations (Wang et al. 2020) or minimizing trainable parameters (Ojha et al. 2024 Ricker al. 2024) the choice of real/fake dataset remains crucial. Ideally, the only difference between the real and fake images should be the artifacts introduced due to the generative model. We believe that there is room for improvement in this area.
For training a fake image detector, dataset design of critical importance. During training, the detector could latch onto subtle differences between the real and fake images in the dataset. If these differences are not controlled, the detector could learn to focus on spurious patterns. We highlight some of these errors, and propose principled way to mitigate these issues. Our key contribution for better real/fake alignment is very simple we take a set of real images (Fig. [ reconstruct them using the generative model (Fig. rightt. These reconstructions are -eaatideetical to their real counterparts visually- e.g., in resolution, semantic content and color tone, except that they have artifacts introduced through the generative model. Hence, they serve as our fake images. With this improved alignment, observe that the detector focuses less the false patterns. With latent diffusion models, we can use their VAE (Kingma & Welling 2022 van den Oord et al.) (0188) reconstruct the real images. By doing so, we force the fake detector to focus the fingerprints of the VAE decoder. Since all kinds of generated images always pass through the decoder, they must share the same fingerprints.
middle) and
If we compare our method to the more common paradigm in which fake images are generated using the full denoising process (Ojha al., 2024: Corvi al., 2022 Cozzolino al. 2024), there many advantages. First, our way of getting the fake images for training is not as expensive. The standard way of generating images using diffusion models is an iterative, time consuming process. In our case, there is just one forward pass through the autoencoder. Second, in the standard setup, the real and fake images could have different properties beyond just the generative model's artifacts. For example, their resolutions could be different; and if they have to be resized to a fixed size, real and fake images could have different amount of resizing artifacts, something that the classifier can latch on to during training. We show that one of the most effective detectors (Corvi et al.) 2022] indeed suffers from this problem, and how our better aligned training data results in a much more robust detector. Third, since generating fake images aligned to set of real images is so simple using our method (we don't 't have to worry about setting the ideal guidance scale or prompt engineering). can any set of real images train the detector. To demonstrate this point,
2

---

Published as a conference paper at ICLR 2025.
collect algorithmically generated images using OpenGL, which look nothing like natural images [Baradad et al., 2023). Treating those as our real images, we obtain their reconstructions and train a detector to distinguish the two. The detector works well not just in detecting other algorithmically generated real/fake images, but also in detecting natural looking real/fake images. This unreasonable effectiveness points to principle about building robust detectors: it may be more important how real and fake images differ from each other, and less important how real images in themselves are.
We conduct extensive experiments to assess our method. We train on images generated by the orig- inal LDM model (Rombach et al. 2022), and test on images generated by later versions of Stable Diffusion as well as newer latent models such as Playground (Li et al., 2024). Kandinsky (Razzhi- gaev et al.] 2023), PixelArt-a (Chen et al., (2023) and Latent Consistency models (Luo et al. 2002)) We also test it on images generated by Midjourney (mid), a closed-source commercial model. Our method is able to match, and often outperform, the best existing detectors in detecting fake images. Using our approach, one can train a detector that is less-likely to focus on spurious patterns. Finally, since we generate fake training images using the LDM's autoencoder, without any denoising opera- tion, our approach is 10x less-expensive than state-of-the-arr methods. We also identify and explain the limitations of approach. Overall, we hope that our work highlights the subtle errors that can occur when training fake image detectors and encourages further research on training detectors without these errors.
RELATED WORK
Several algorithms to identify fake images have been proposed. Wang et al. (2020) fine-tunes a ResNet-50 (He et al. 2015) model to classify images as either real fake. It trains on fake images generated by ProGAN (Karras et al. 2018). Training with aggressive data augmentation enables the detector to successfully identify images generated by various CNN-based models. To better preserve low-level details of the image, Gragnaniello et al. (202T) removes the downsampling operations present in the initial layers of the neural network. Furthermore, Chai et al. (2020) trains a detector on image patches to force the model to learn local fingerprints. Combining the above practices, Corvi et al. (2022) trains a fake image detector for LDM generated images. Unlike previous methods that fine-tune the entire neural network, Ojha al. (2024) demonstrate that linear probing of pre-trained, frozen CLIP image encoder (Radford et al.] (022) can effectively detect fake images generated by wide range of models. Work by (oozooino et al. (2024) extends this approach to detect images generated by additional models. Despite these algorithmic advances, the real and fake images used for training these models are not well-aligned. Our work demonstrates the various benefits that come from creating aligned fake images that are reconstructions of real images.
The use of reconstructions for fake image detection has been explored in prior work. Chai et al. (2200 create dataset of GAN- generated fakes by reconstructing real images (Bau et al. 2019), find that detectors trained this way underperform compared to those trained on randomly gen- erated images-likely due to reconstruction inaccuracies. The most similar work to ours is DRCT (Chen et al.). which reconstructs real and fake images using DDIM inversion. However, their dataset remains misaligned since the fake images lack corresponding real counterparts. Moreover, DRCT depends on the costly and time-consuming DDIM inversion, while we show that simple VAE re- constructions suffice for training an effective LDM-image detector. In contrast to these works, use VAE reconstructions that efficiently preserve real image quality while outperforming detectors trained on iteratively denoised images.
Reconstruction- basse detection has also been studied for diffusion models. Wang et al. (002) use DDIM inversion (Song et al.) 2022) reconstruct images, training a classifier their difference (DIRE). Ricker et al. (2024) extend this to I.DMs, using VAR-based rec.osssteerrruuuaooeee...o reconstructions and LPIPS dis- tance (Zhang et al., 2018) for detection. However, these methods require access to the generative model at inference and fail under common post-processing, In contrast, our approach uses recon- structions only during training, enabling faster inference and greater robustness corruptions.
3 PRELIMINARIES
Our goal is build fake image detector to detect whether an image is real or fake, i.e., created with the aid of a generative model. We first explain our problem statement and then provide an overview of the existing paradigm.
3

---

Published as a conference paper at ICLR 2025.
3.1 PROBLEM SETUP
Recently, various image generation models have emerged. Among them, latent diffusion models (LDMs) (Vahdat et al. 2021 Rombach et al. 2022) and the subsequent stable diffusion (SD) series have become noticeably ubiquitous. This is because they strike a good balance: users get control (e.g., through text prompts) to generate quality synthetic images and the overall process computa- tionally more efficient than other text-to-image diffusion models (Saharia et al. 2022] Ramesh et al., 2022]. Hence, our specific goal in this work is to detect images generated by LDMs.
3.2 LATENT DIFFUSION MODELS
A latent diffusion model first compresses images into lower dimensional latent space using an autoencoder. The diffusion model then operates in this latent space. A text-conditioned latent diffu- sion model consists of an encoder (Benc), decoder (ddec) and UNet (Eş). Given a high dimensional image space X' and a lower-dimensional latent space 2, we train an encoder network to compress an image (æ: E X) into lower dimensional latent (z 2). The decoder is trained to reconstruct the image from the latent.
In order to generate an image based a conditioning signal (prompt, bounding box, reference image, etc.), we first sample žт from a fixed prior (gaussian noise), where 7 corresponds to the number of timesteps. We then denoise the image for I steps using the UNet get latent z0. We pass Zo through the decoder @dec to generate the image.
3.3 EXISTING FAKE DETECTION PARADIGM
Since we don't ' know what precisely makes a fake image fake and a real image real, a common and effective approach has been to learn that difference (Wang et al. 2020 Corvi et al.) 2022 Cozzolino jct al. 2024). The first step is to create a dataset consisting of two categories (i) R consisting of real images and (ii) F consisting of fake images sampled using a generative model G. The next step involves training a deep neural network on the collected dataset D = (R U F} for the task of binary classification,
that Vz E R, (x) = 0 and Vz F, ((x) = 1. The hope is that when & is learning to separate the distribution of F from R. it does so only by discovering G's artifacts F (something not present in R), and not by using some other spurious features. We explain what these spurious features can be with the help of an example prior work.
Imperfect alignment between R and F: The work of Corvi et al. 2022) trains detector in the same way discussed above. For the real data R. it uses MS COCO (Lin et al. 2015) and LSUN (Yu et al., 2016). For fake images F, it uses the text prompts from MS COCO to generate images from an LDM model at a fixed 256 256 resolution. The real images tend to be at higher resolution than fake images (see Appendix A.I.I for details). Fig. | (left) shows the discrepancy in the sizes of real and fake images. To make the detector robust to image resizing, the random resized crop [ data augmentation is used during training. By first cropping the image and then resizing the cropped image to fixed final resolution, the random resized crop introduces both upsampling and downsampling artifacts to the training data. However, due to the discrepancy in resolution between real and fake images, the random resized crop introduces different signals each distribution. Consequently, there is potential for v to use this signal in some capacity to separate R from F. Similar issues have been illustrated in prior works from Grommelt et al. (2024); Yan al.) 2024). Later on in Sec. [5] we show that the resulting detector indeed learns such spurious features and changes its prediction if the same image is saved different resolutions. We want to avoid such situations and instead look for principled way to learn a robust fake image detector.
OUR APPROACH
If we do not want 1/ to learn any spurious features, then we need to make sure they are not available for d to learn from the training data itself. So, our key idea is to align R and F as much as possible so that their only difference is due to G's artifacts. Note that prior methods (Ojha et al. 2024 Corvi
et al. 2022 Cozzolino et al. 2024 do try to align R and F in some capacity, For example, while
RandomRes zedCrop.

---

Published as a conference paper at ICLR 2025.
generating F, instead of using arbitrary prompts, they use R's image descriptions to generate images using LDM. However, such images are only similar to the real images in terms of semantics. We instead propose approach that can bring the distribution of F to be much closer to that of R, which can aid in subduing many of the other differences in image properties (e.g., aspect ratio).
Our solution is simple. To generate F, reconstruct images in R. using G's parameters. Typically, reconstructing an image x involves a multi-step inversion (e.g.. DDIM inversion (Song et al.) 2022)
from the image space the noise space compute latent Z.. such that ((zz) 2r. However, for the particular& G that is our target in this work, i.e., LDM/SD, there is a much simpler solution. Specifically, given real image I, we pass it only through the pre-trained autoencoder, without using the U-Net to do any forward/reverre process. Using the notations defined in Sec. 3.2 mathematically formulate the process in the following way:
we can
F @dec(
Vz E R}
The resulting reconstructed images can still be validly considered fake, at least for our task, since they necessarily contain artifacts introduced by ddec- We create this distribution of F from R. before any training begins. Once we have this data, we then train a deep neural network to using the same training recipe proposed in Corvi et al. (2022). Specifically, we use ResNet-50 (He et al. 2015) pretrained on ImageNet and finetune the whole backbone for real-vs-fake image classification. In each iteration, we sample a batch of real R2 and fake images Fú and train to using binary cross entropy loss (real: and fake: 1).
Within this framework, we consider two variants depending the composition of real and fake images in a batch (i). In one case, the batch could be a random assortment real and fake images where images in R, and F3 do not need have any correspondence between them. In the other case, each image in F; has a corresponding real image in R2 as part of the same batch, with identical data augmentations (e.g., crop). With this latter variant, the alignment between real and fake images is ensured not just at the dataset level, but also at the batch level in each iteration, and we explore if this further helps the model to focus on the desired features for fake detection. We call the two variants Ours and Ours-Syne respectively. For both, since we train y to focus on the artifacts of ddees the detector should detect even those images which have been produced through the full denoising process using the U-Net cg. This is because even those images will have their denoised latents go through the same decoder édec: and hence should have similar artifacts.
EXPERIMENTS
In this section, we demonstrate that using reconstructions provides very inexpensive way to create well-aligned real-vs-fake fake training dataset which in turn reduces the likelihood of detector learning spurious patterns. Our experiments show that a detector trained using our approach can effectively detect fake images generated by various other text-to-image latent diffusion models. Finally, show that as long as the real-vs-fake dataset is well-aligned, the content of the images is relatively less significant for training fake image detector.
5.1 BASELINES AND TRAINING DETAILS
We consider the following baselines for fake image detection: (i) CLIP-based detection (Ojha al. 2024), using linear probing on real/fake images with variants trained on GAN (Ojha-ProGAN) and
LDM (Ojha-LDM) data. (ii) Cozzolino-LDM (Cozzolino al. 2024 which improves dataset qual-
ity and leverages an improved CLIP backbone. (ii) AEROBLAVE LABEELADEE (Ricker et al. 2024), training- free method based on LDM autoencoder reconstructions. (iv) Corvi (Corvi al, 2022), a 55 trained on real (MS COCO + LSUN) and L.M -DM-geeertted images, combining augmentation-driven WWag et al. 2020) and patch-based based training (Chai al., 2020).
We dedicate the first part of our experiments to comparing our method exclusively to (Corvi et al.) 2022). There are two reasons. First, Corvi is one of the most effective methods for detecting fake images from various text-to-image latent diffusion models (we compare all methods later in Table I] Yet, the training pipeline used by Corvi gives rise to the classifier learning some spurious features, and hence is good test bed for our method, to see whether can avoid making detector learn those features, while still preserving or improving fake detection in a general sense. Second, since Corvi represents the existing paradigm of collecting fake images for training through
5

---

Published as a conference paper at ICLR 2025.
computationally intensive iterative denoising process, compare our approach to assess the increased efficiency of our dataset creation method.
combination of MS COCO (Lin al, 2013) and LSUN (Yu et al. 2016) as our real dataset, totaling 179257 images. We reconstruct them using the autoencoder of the LDM model proposed by RRobbcch al. (2022) to get the same number of fake images. Starting from ImageNet pretrained ResNet-50 as t we finetune on the
Training details: Similar to Corvi al. (2022),
real-vs-fake dataset. We optimize using Adam (Kingma & Ba 2015) with initial learning rate set to 0.0001. The rest of the training details can be found in Appendix A.I.I
5.2 SUBDUING SPURIOUS PEATURES
In our work, we emphasize that a well-aligned real-vs-fake dataset reduces susceptibility spurious features. Here, we test this by analyzing the detector's sensitivity to image resizing. We also study the sensitivity our detector to other post-processing operations in Appendix AA2.55)
Issue caused by lack of well-aligned data: Corvi et al. (2022) use LDM-generated images as fake and LSUN MS COCO as real. All fake images are 256x256, while LSUN images match this resolution. However, most COCO images higher resolution than fake ones. A key component in the data augmentation pipeline is the 'random resized crop' function, which works in the following way: random crop is taken a percentage of the whole image. This percentage is chosen uniformly from the range [8, 100]. The resulting crop is then resized to a fixed 256 256 resolution. Hence, resize cropped fake images have only up-scaling artifacts. On the other hand, many real images will have both up-scaling and down- scaling artifacts. In contrast, our method images are reconstructed from real ones, preserving their exact resolution. While we fine-tune the network similarly to Corvi, we show that these issues also affect other training- methods (c.g.. Ojha-LDM). See Appendix A.2.2 for a detailed analysis.
significantly larger, making real images, average,
the same real images (COCO + LSUN), but our fake
Experiment details: We create test set of real and fake images of increasing/decreasingg resolu- tions. For the real set, we randomly select 500 images from the Redcaps dataset (Desai et al.. (20TT) For fake images, we generate 500 images using SD 1.5 (prompts pertain to object categories from CIFAR (Krizheskyy et al., 2010)). The original resolution of both real and fake images is 512 x 512. We resize these images to different resolutions the range of [128, 1024] corresponding to scaling factors of 0.25 and 2.00 respectively. We then test both detectors, Corvi and ours, to how they perform on this dataset. Both methods produce the probability of an input image being fake.
Fake Images
Real Images
Probability of fakeness
1.0
Probability of fakeness
0.6
0.8
0.5
Ours
Ours- Durs-Sync
0.4
0.6
0.3
0.4
Corvi
0.7
Ours
0.1
Ours-Sync
0.0
0.0
0.75
1.00
1.25
1.50
1.75
0.25
0.50
0.75
1.00
2.00
Scaling Factor
Scaling Factor
Figure 2: Sensitivity of fake detectors to image resizing for set fake images (left) and set of real images (right). Corvi associates downsampling with real images and upsampling with fake images. Our detectors do not learn that false pattern, showing better robustness.
Results and analysis: In Fig- 2 left and right, we see the behavior of the two detectors on fake and real images respectively, where x-axis denotes the scaling factor of test images, and y-axis represents the fakeness score of the model. We first focus on the performance on fake images (left). Soon after we start downsizing from the base resolution (marked with the dotted line), the probability of the image being fake drops drastically. This makes sense since during training, the Corvi detector has only seen downsizing artifacts real images. Our method's performance declines much more gradually, struggling only under extreme downsampling. We attribute this drop to the lack of scale invariance in CNNs. Similarly, when upsampling real images (Fig. 2 right), the performance of

---

Published as a conference paper at ICLR 2025.
Real
SD
MJ
Kandinsky
Playground
PixelArt-o
LCM
AEROBLADE RRicker 2024]
96.58
74.50
99,50
99.26
14.87
75.93
99.96
Ojha-ProGAN Ujha et al 2024
95.13
17.84
12.96
23.56
21.03
19.73
23.93
OjMa-LDM (Ojha el al. 2024
54.16
69.56
69,40
90.70
92.16
90.73
73,66
Cozzolino-LDa LDM (Cozzolioo et al. 2024
85,36
47,36
50.93
51.06
59.73
59.52
34.70
Corvi (Corvi et al. 2022)
99.96
99.73
96,90
99,92
82.13
100
99.60
Ours Ours-Sync
99.93
99.31
98.50
99,92
94.85
100
100
99.76
99.57
99.37
99.57
99.48
100
100
Table 1: Generalization results. Accuracy of different methods for detecting real and fake images. The finetuning based detectors (Corvi, Ours, and Ours-Sync) generally outperform the training- free and linear probing based methods. Our approach is robust to drastic changes in the UNet architecture (Playground) showing a huge improvement (+12.72/+17.35 for Jurs/Ours-Syno" from the Corvi detector.
the baseline detector worsens since during training, up-sampling artifacts are seen more with fake real
images. Our detectors remain much more consistent on images throughout the resizing range. Overall, these results highlight the effectiveness of the simple way in which can make the detector much more robust through a better dataset alignment.
5.3 EVALUATION ON DIFFERENT TYPES OF REAL/FAKE IMAGES
Now that we have seen the benefits of our method in being able to avoid certain spurious correlations while being computationally very efficient, we now study how it fares in being able to detect different types of fake images produced by different types of latent diffusion models.
Test datasets: We compare all the detectors introduced Sec. 5.T to our method on the following datasets. (i) The Real set contains real images from multiple sources; 1000 images from Red- Caps (Desai et al. 2021), 800 images from LAION-Aesthetie (Schuhmann et al. 2022), 1000 im- ages from whichfaceisreal (whi) and 200 images from WikiArt (wik). For fake images, we collect images from the following sources. (ii) Different variants of Stable Diffusion (SD), which includes 1000 fake images from InstructPix2Pix (Brooks et al., 2023), 1000 images from Nights (Fu al.,
2023 dataset and 1000 DDIM inversion of real face images; (iii) 3000 images from Midjournyy (MJ) mid)) whose model architecture not public; (iv) 3000 images from Kandinsky (Razzhigaev et al. 2023) which has VAE of different architecture in comparison to the LDM model we train on; (v) 3000 images from Playground (Li et al. 2024) and (vi) 3000 from PixelArt-ar (Chen al.) 2023). which have similar VAEs as ours, but their U-Net is different; and (vii) 3000 images from Latent consistency model (LCM) (Luo et al. 2023) which was distilled from a finetuned version of SD 1.5 using the objective proposed by Song et al. (2023).
We create this overall test set to ensure that there is enough diversity natural and artistic looking images. The selected models offer wide range of architectural choices utilized by latent diffusion models. Furthermore, for these same real/fake images, we separately construct their post poot-proeeseed versions where we randomly add JPEG compression, blurring, color jitter, and resize each image. This enables us to test the robustness of detectors to common post-proces peocessecssingg operations. Following Ojha et al.) 2024). we use accuracy the evaluation metric with 0.5 as the threshold (threshold details for AEROBLADE can be found at Appendix A.1.3). We also report threshold-less metrics such average precision in Appendix A.2.3 Results and analysis: Tables D and show the performances of various baselines on our test set, before and after applying common post-processing operations. respectively. Overall, the methods that involve fine-tuning (Corvi and Ours) outperform the other methods that are either linear probing based (Ojha-ProGANN, Ojha-L.DM, Cozzolino-I.DM) or without training (AEROBLADE), Ours fur- ther outperforms Corvi, especially on post-processed images (Table Both Corvi and our method use the common image corruptions as data augmentations during training, however our method shows huge improvements; e.g., approach obtains +36.98/+52. improvement for Ours/Ours- Sync over Corvi on Playground generated images. Playground is built from SDXL (Podell et al. 2023), which uses fine-tuned version of the LDM autoencoder, but uses UNet with thrice many parameters compared to LDM. We hypothesize that since our method only focuses on the VAE, it is robust drastic changes in UNet architecture as opposed to Corvi which uses the UNet for training.
7

---

Published as a conference paper at ICLR 2025.
Real
SD
MJ
Kandinsky
Playground
PixelArt-a
LCM
AEROBLADE (Ricker al. 2024
96.85
28.10
61.80
27.60
3.17
10.22
4.60
Ojha-ProGAN Oh 2024
93.26
13.10
8.26
14.53
7.63
9.60
13.16
Ojha-LDM Ojha ct al. 2024
48.46
57.20
51.63
64.63
66.16
64.37
64.33
Cozzolino-LDMo (oozzolnoo al. 2024
76.63
52.80
59,43
59.63
73.36
66.22
60,93
Corvi Corvi et al. 2022
98.40
77.78
50.45
59.23
24.27
64,41
58.31
Ours
99.85
86.50
70.68
64.88
61.25
84.36
90,12
Owrs-Sync
99.50
88.06
72.36
68.60
76.36
86.10
91.08
Table 2: Sensitivity to common post-processing operations. Analogous to Table but the test images have undergone random compression, resizing, blur and color jitter. Our detectors show improved robustness over the baselines when detecting fake images from different latent diffusion models. Ensuring batch-level alignment (Ours-Sync) offers increased robustness.
Like Corvi, the other baselines also struggle with architectural differences used to process training data vs. testing data. For example, AEROBLADE uses the VAEs of SD 1.1, SD 2 and Kandinsky 2.1 and uses the smallest reconstruction error of the three to perform real/fake detection. It is unable to detect images from SD, Playground, and PixelArt-a AEROBLADE struggles to detect images that have been through common post-processing opera- tions. Interestingly, the Kandinsky VAE uses different architecture from the LDD VAE that trained on, as it replaces the convolutional decoder of LDM with a MoVQ decoder (Zheng et al.) 2022 for improved generation quality. We observe that our detector is less sensitive this change than other methods, likely because the other methods additionally utilize the UNet or are more sus- ceptible to spurious correlations due not enforcing aligned data during training, leading to larger distributional differences in the generated training vs. testing images. Finally, Ours-Sync surpasses Ours, suggesting that batch-level alignment during training improves generalization.
they use different VAE. Furthermore,
Our results confirm the advantage of using well-aligned real/fake training images from the LDM's VAF. This helps the detector focus on genuine signals, reduces spurious correlations, and improves robustness to UNet changes. While we use ResNet-50 backhone with ImageNet initialization, Appendix A.2.4 shows these findings hold across various architectures and initializations.
5.4 EFFECT OF DATASET SIZE
We study the effect of training dataset size on our methods and Corvi. Instead of training all 179,257 images, we try training each method using smaller dataset sizes. We test by sampling of 1000, 10,000, 50,000 and 100,000 real and fake images each from our training distribution and report the results here. We evaluate the detectors based on their performance on the whole test dataset from Section 5.3 Our real distribution has 6000 images, consisting of both the original and post-processed real images. We have 30,000 images in our fake distribution coming from the models that test Furthermore, in order disentangle the effects of resizing, we do not resizing as part of post-procn post-processing here. Due to the imbalanced nature of the dataset, we report the true positive (TPR) fixed false postive of 5%.
Dataset Composition
Corvi
Ours
Ours-Syne
Ik / lk
46.51
83.37
80.43
10k / 10k
87.64
98.13
98.58
50k / 50k
93.27
99.56
99.81
100k 100k
95.84
99.69
99.75
Table 3: Effects of varying the dataset size. We report the TPR@5FPR for detectors trained on lesser data. Using an aligned dataset helps the model learn good hypothesis with less data. Ours/Ours-Sync shows improvements of +36.86/33.9 +10.49/10.94, +6.29/6.54 and +3.85/3.91 over Corvi when trained with 1k, 10k, 50k and 100k images (cach) respectively.
We report our results in Table 3 When training on a small dataset size of Ik real and fake images each, the Corvi detector detect only 46.51 % of the fake images while allowing having 5%
8

---

Published as a conference paper at ICLR 2025,
Real Images
Fake Images
Real Images
Fake Images
Train Shaders Generated Images
Test Natural Images
Figure 3: We use OpenGL shader generated images [Baradad et al., 2023), as our real images and reconstruct them to obtain our fake images. We then train a detector using this dataset.
Original
With Post- Post-Procsssing
Corvi
Ours-Sync
Ours (shaders)
Ours-Sync (shaders)
Corvi
Ours-Sync
Ours (shaders)
Ours-Syne
(shaders)
Real
99.91
99.73
84.98
83.24
97.85
98.86
74.62
76.62
SD
99.68
99.80
99.75
99.44
78.05
84.73
77.82
72.30
MU
97.71
99.30
98.56
95.79
51.03
72.38
53.45
46.43
Kandinsky
99.88
99.80
98.23
58.68
69.02
67.87
Playground
86.25
98.80
99.82
99.90
24.11
63.83
52.65
54.66
PixelArt-a
100
100
100
100
63.34
80,99
69.65
68.81
LCM
99.65
99.93
99.78
99.84
50.63
82.83
63.14
60.81
Table 4: Generalization results. Comparing the model trained using the shaders dataset (Baradad cct al. 2023) to models trained on natural image datasets (Corvi, Ours-Sync). All models use threshold calibrated using validation set. The detectors trained shader images, show good performance on natural images. This shows that a well-aligned dataset is more important than the exact content of the images themselves.
false positive rate. Ours and Ours-Sync on the other hand, can detect 83.37% and 80.43% of the fake images respectively the same threshold. A similar pattern be seen with dataset sizes of 10k, 50k and 100k images each, this shows that Corvi needs a large dataset size in order to learn the correct hypothesis. As oppposed to ours, which learn it in data-efficient manner. Creation of the training dataset is also more efficient, which we show in Appendix A.2.I
5.5 CAN TRAIN ON IMAGES THAT ARE NATURAL?
Our experiments show that a properly aligned dataset can reduce spurious patterns, but both the training set and test settings still contain similar real-world concepts. But the goal of alignment to force the model to not look anything else but the LDM decoder's artifacts, can the detector learn those artifacts without being trained on any naturally occurring real images at all? To study this, next train detector using dataset which does not capture the semantic concepts that test the model on, and see if it succeeds in detecting the same real/fake images described in Tables Tand 2
similar motivation was discussed in Baradad et al. 2023). where the authors wanted to learn image representations without using real-world images. They proposed to generate images with 21,000 OpenGL fragment shaders, which are short programs that compute the color and transparency of every pixel in image. Sample images shown in Fig. 3 (left). Although the images are generated algorithmically, they do not involve a neural network. For our use case, we use these images as the "real" set. Specifically, our R consists of 100k such images of 384 384 resolution. We pass these images through the SD 1.5's VAE in order to get our reconstructions which serve our fake distribution F. We train the two versions of our detectors (normal and sync) in the same way as described in Sec. 4 (c.g.. using same ResNet-50 v)) and evaluate them the same test set from section [.3 We train detectors using random seeds and report the average values. Since, the model does not observe any natural images during training, it is not likely for those images to conform to 0.5 threshold, therefore, we calibrate the threshold using the same validation set. For further details, refer the reader to Appendix A.1
Results and Discussion: We report accuracy our shaders trained detectors in Table We also compare detectors trained on natural real/fake images (Corvi and our method). For uniformity,

---

Published as a conference paper at ICLR 2025.
train them using 100k real/fake images. First, notice that Ours (shaders)/Ours- (shaders) detect 44.98/83.24% of real images, compared to Corvi/Ours- which detects 99.91/99.773 7.7%% of real images. However, what is surprising is how effective our shaders-detectors to detect all types of fake images without perturbation, having almost the same accuracy as our detectors trained with natural images. If we especially compare them Corvi post-processed fake images (Table (right), we see that they have a much better accuracy in almost every case by decent margin; e.g.. Ours (shaders) shows improvements of +10.61, +28.54, +6.31 and +12.51 on Kandinsky, Playground, PixelArt and LCM respectively. However, while burs-shaders detectors do match the performance of our natural image trained detector (Ours-Sync) on clean fake images, they cannot do so post-processed fake images. Even given that the detectors proposed in this section are trained without ever training on natural real image or a properly generated (iteratively denoised) fake image, being able to outperform the best existing detector (Corvi) which has both of those things highlights the crucial role that dataset alignment can play in deploying robust detectors.
at being able
DISCUSSION AND LIMITATIONS
Aligning data using the LDM's autoencoder assumes that most properties of real images can be transferred to the reconstructed image. However, there might be some low-level properties that do not get transferred as effectively. As specific example, if real images are originally saved in .webp format, find that the reconstructions might not inherit those compression artifacts, and hence the resulting detector is not completely robust to .webp compression. This is depicted in Fig 4 which plots the effect of different levels of .webp compression (x-axis) on the model's output score, i.e., probability of the image being fake (y-axis). We start with clean set of 500 images generated by trained on real
SD 1.5 (compression quality = 100). Both Ours-Sync well Corvi, which images containing webp artifacts, correctly assign a high score to the images. As we increase the compression level, the models' scores drop drastically. This implies that the detector has learned to associate webp artifacts to real images. This is problematic as real images may contain unknown arbitrary properties, like wehp artifacts, which could make the detector sensitive to those features.
However, algorithmically generated images, like those discussed in Sec.(5.5 offer the ad- vantage of complete control over their cre- ation, allowing us to eliminate unnecessary artifacts. In fact, the detector trained on shaders generated images, Ours (Shaders), much more robust to .wehp compression.
Fake Images
Probability fakeness
1.0
Corvi
0.8
Curs-Sync
Ours (shaders)
0.6
0.4
Finally, while we have shown that our method be robust small architectural changes in the U-Net (e.g.. Playground) and VAE (Kandinsky), it struggles when there are ma- jor architectural differences in the VAE. As
0.0
20
60
100
WEBP compression quality
an example. we tested our detector on 1950 images generated by FLUX.1-der (Labs),
Figure 4: Sensitivity to webp compression
which utilizes a latent space of 16 channels (most SD variants have 4). The accuracy of Corvi, Ours, Ours-Sync in detecting them as fake are 3.18%, 9.59% 25.87%. Perhaps unsurprisingly, this means that models with vastly different architectures tend to produce very different kinds of artifacts.
CONCLUSION
In this work, we demonstrated the need to train fake image detectors using a completely aligned dataset. We introduced principled way to achieve this for Latent Diffusion Models. Through careful experimentation, we supported our claims. By training a fake image detector using OpenGL- generated texture images, we demonstrated the importance of focusing on the differences between the real and fake images, as opposed to the images themselves. An interesting future direction could be to study the application of this idea in the context of pixel-space diffusion models where the VAE is not available. We hope that our work highlights the importance dataset alignment and paves the way for robust fake image detectors that can help society combat misinformation.
10

---

Published as a conference paper at ICLR 2025.
8 REPRODUCIBILITY STATEMENT
We provide precise details on our experimental setup to ensure reproducibility. For our experiments training with natural-looking real images, we provide training details in SectionS5.Jaam and Appendix A.I.I Details of our test dataset can be found in Section 5.3 Details regarding our experiments on
shaders can be found in Section 5.3 and Appendix A.1.2 We also intend to release our pre-trained checkpoints, datasets, and code to ensure reproducibility, with all resources made publicly available on GitHub.
ETHICS STATEMENT
During our study, we made sure only publicly available data, respecting people's privacy line. We didn't I collect or analyze any personal or sensitive information. We believe our research can help tackle the spread of misinformation on the internet, contributing to safer and more trustworthy digital space.
10 ACKNOWLEDGMENTS
This work was supported in part by NSF IIS2404180, American Family Insurance, Institute of In- formation & communications Technology Planning & Evaluation(IITP)) grants funded by the Korea (overnmen((MSITT) (No. 2022-0-00871, Development of AI Autonomy and Knowledge Enhance- ment for AI Agent Collaboration) and (No. RS2022-00187258 Development of Large Korean Lan- guage Model Technology for Efficient Pre-training), and Microsoft Accelerate Foundation Models Research Program.
REFERENCES
Midjourney. https//wwww.midjornne.ccom.
Which face is real?
Wikiart. https://www.wikkintt www.www........rr.......
Manel Baradad, Chun-Fu Chen, Jonas Wulff, Tongzhou Wang, Rogerio Feris, Antonio Torralba, and Phillip Isola. Procedural image programs for representation learning, 2023. URL https:
David Bau, Jun- Yan Zhu, Jonas Wulff, William Peebles, Hendrik Strobelt, Bolei Zhou, and Antonio Torralba. Seeing what gan cannot generate, 2019. TRIlhttpes//arrdd..oo///aa
626
Tim Brooks, Aleksander Holynski, and Alexei A. Efros. Instructpix2pix: Learning to follow image editing instructions, 2023. URL.ntps::/arrvvv.orrr///e
09800
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers, 2021. URL https:
//axxiv.or//abstt 2104. 14294
Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? understanding properties that generalize, 2020. URL.
10588
Baoying Chen, Jishen Zeng, Jianquan Yang, and Rui Yang. Dret: Diffusion reconstruction con- trastive training towards universal detection of diffusion generated images. In Forty-first Interna- tional Conference on Machine Learning.
Junsong Chen, Jincheng Yu, Chongjian Ge, Lewei Yao, Enze Xie, Yue Wu, Zhongdao Wang, James Kwok, Ping Luo, Huchuan Lu, and Zhenguo Li. Pixart-a: Fast training of diffusion transformer for photorealistic toxt-to-image synthesis, 2023, URL https: arxiv. wttp:/o.rr//////...../ 00426

---

Published as a conference paper at ICLR 2025,
Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. On the detection of synthetic images generated by diffusion models, 2022. URL
org/ abs wttpg//b////oo 2211 00680
Davide Cozzolino, Giovanni Poggi, Riccardo Corvi, Matthias Nießner, and Luisa Verdoliva. Raising the bar of ai-generated image detection with clip, 2024. URL https:///axiiii
2312. 95
Karan Desai, Gaurav Kaul, Zubin Aysola, and Justin Johnson. Redcaps: web-curated image-text data created by the people, for the people, 2021. URL http:://axxx...rr//abb////
11431
Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans on image synthesis, 2021. URL
https: wttg//aa//////// http:////aaavv.oorr///////2///
05233
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale, 2021. URL https: /ttp//aaxvvv.//a////v www.wbsrggaaaaa..e 2010.00000..0 11929
Stephanie Fu, Netanel Tamir, Shobhita Sundaram, Lucy Chai, Richard Zhang, Tali Dekel, and Phillip Isola. Dreamsim: Learning new dimensions of human visual similarity using synthetic data, 2023. htttttt////:xiiti
httpr//ab//23000 09344
Diego Gragnaniello, Davide Cozzolino, Francesco Marra, Giovanni Poggi, and Luisa Verdoliva. Are gan generated images easy to detect? critical analysis of the state-of-the-an 2021. URL
htttss://axxis http://aaaii..oor/a///////////// wttp///ggg///uaoeeeeeeeeeeeesssa 02617
Patrick Grommelt, Louis Weiss, Franz-Josef Pfreundt, and Janis Keuper. Fake or jpeg? revealing common biases in generated image detection datasets, 2024. URL pittps://arxiin org/
abs/2403 17608
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition, 2015. URI//ttpps///rrav..orr///aa
03385
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models, 2020. URL https://arxiv:
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation, 2018. URL attps://arrivv.nng/bb//////
10196
Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. 2015.
Diederik P Kingma and Max Welling, Auto-encoding variational bayes, 2022. URL https:
/1t...111.6666 6114
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-10 (canadian institute for advanced re- search). URL http://ww. es. toronto. edu/kriz/cfaa. himl, 5(4):1, 2010.
Black Forest Labs. Flux1. https:/blaackforestlabaai
Daiqing Li, Aleks Kamko, Ehsan Akhgari, Ali Sabet, Linmiao Xu, and Suhail Doshi. Playground v2.5: Three insights towards enhancing aesthetic quality in text-to-image generation, 2024. URL
https://arxiz: wttp:/iwwwrr////////2033
Tsung- Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zimick, and Piotr Dollár. Microsoft coco: Common objects in context, 2015. URI.httss://arxiit
abs 11111111551112221
Jonathan Long, Evan Shelhamer, and Trevor Darrell. Fully convolutional networks for semantic segmentation, 2015. URL /// 4038
12

---

Published as a conference paper at ICLR 2025.
Simian Luo, Yiqin Tan, Longbo Huang, Jian Li, and Hang Zhao. Latent consistency models: Syn- thesizing high-resolution images with few-step inference, 2023. URL URRLhttpp:://ciiv.rrr abs/2310. 04378
Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize org/ 221.222222.11111
across generative models, 2024. URL
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis, 2023. URLhttts://aaxxx wttpa//wwwww.a.aaaaaaaaaaaaaa/aa attp:///bbb2232.000m 01952
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision, 2021. URL
https://arxiv.oo wttp://.rrrabbb///0000/ 00020
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents, 2022. URL htttss//arxxv..org
2204 06125
Anton Razzhigaev, Arseniy Shakhmatov, Anastasia Maltseva, Vladimir Arkhipkin, Igor Pavlov, Ilya Ryabov, Angelina Kuts, Alexander Panchenko, Andrey Kuznetsov, and Denis Dimitrov. Kandin- sky: an improved text-to-image synthesis with image prior and latent diffusion, 2023. URL fitts://aaxiv:
2310. 03502
Jonas Ricker, Denis Lukovnikov, and Asja Fischer. Aeroblade: Training-free detection of latent diffuusin images using autoencoder reconstruction error, 2024. URL htllhttss///rxi..rrrg
abs/2401. 17879
Robin Rombach, Andreas Blattmann, Dominík Lorenz, Patrick Esser, and Björ Ommer. High- resolution image synthesis with latent diffusion models, 2022. URL httpt:://axxii......
abs/2112.10755
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kam- yar Seyed Ghasemipour, Bureu Karagol Ayan, S. Sara Mahdavi, Rapha Gontijo Lopes, Tim Sal- imans, Jonathan Ho, David J Fleet, and Mohammad Norouzi. Photorealistic text-to-image dif- fusion models with deep language understanding, 2022. URL https://arxiv. wwtpexiii..rra/a.... abs/
2205. 487
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. Laion-5b: An open large-scale dataset for training next generation image-text models, 2022. URL
https::/aaxiv> http:///axxxiee.g//bbbsose/ www./o/g/////oooooooooooo/oosea/ 2210 08402
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition, 2015.
15596
Jascha Sohl-Dickstein, Eric A. Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics, 2015. URL htttp:://axxi.........
abss/150..m 03585
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models, 2022. URL
https://arxiv: hww.vorggaaaaoo wtrgg/bbs/2101 02502
Yang Song and Stefano Ermon. Generative modelin by estimating gradients of the data distribution, 2020. / /bbp////abb//00000/ 05600
Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models, 2023. URL htt.ps://arxiv.orr//Boss
Arash Vahdat, Karsten Kreis, and Jan Kautz, based generative modeling in latent space, 2021. URL
05931
13

---

Published as a conference paper at ICLR 2025.
Aaron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu. Neural discrete representation learn- ing, 2018.
wtt.oo/////aa/a/aaa .09937
Sheng- Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. Con-generated images are surprisingly easy to spot... for now, 2020. URL https://arxiv.org//
1912. 11035
Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. Dire for liffusion-generatee image detection, 2023. URL https::/arxiv.
org/ abs///b//aa 2303. 09295
Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Chengjie Wang, Shouhong Ding, Yunsheng Wu, and Li Yuan. Df40: Toward next-generation deepfake detection, 2024. URL http::////xxo...o/abbooobee
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop, 2016.
03365
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks, 2017. bttpsss:://axxx
bxc/abs/1605.0711
Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric, 2018.
18C1. 03924
Chuanxia Zheng, Long Tung Vuong, Jianfei Cai, and Dinh Phung. Movq: Modulating quantized vectors for high-fidelity image generation, 2022. URL httth:tt/tptttittte http://axiiv.orrra//////00
09:02
A APPENDIX
A.1 IMPLEMENTATION DETAILS
A.1.1 ADDITIONAL TRAINING DETAILS
We follow the training recipe used by Corvi et (2022). We train on 96 x 96 crops of the whole image using batch size of 128. The data augmentations include random JPG compression and blur from the pipeline proposed by Wang et al. (2020). Following Gragnaniello et al. (202T), grayscale, cutout and random noise are also used as augmentations. Finally, in order to make the network invariant towards resizing, the random resized crop was added. For our method as well as Corvi, we train the model using two different random seeds and report the average reading.
We use the validation set provided by Corvi et al. (2022) for our training. Just like our training set, the real images come from COCO/LSUN and the fake images generated at 256 x 256 using LDM. During training, if the validation accuracy does not improve by 0.1% in 10 epochs the learning rate is dropped by 10x. The training is terminated at learning rate 10-6
Dataset details: We use the dataset provided by Corvi et al. (202)). Half of the real images come from LSUN (Yu et al.] (016), the remaining comes from COCO (Lin et al. 2015). There total of 90,000 images from COCO out of which most of them are high resolution images. The most frequently occurring resolutions
640 480 and 640 427 which occur 19,581 and 11,292 times respectively. For further details, we refer the reader to the download link provided by Corvi et al. (2022)
A. 1.2 SHADERS EXPERIMENT DETAILS
Dataset details: All our images are at resolution of 384 x 384. By inspecting the code used by Baradad et al. (202)), we figure out the exact post- post-processing done on our images. They were saved in the JPG format. Therefore, we also save our fake images in the JPG format (quality ~ [70, 100)) to make sure that the detector does not focus on compression artifacts.
https: thw.thhubb... com.ub..comeeeo wnw.rr-pnniinn http://www.....ooooooooooooonnaa itg.ccoodoinnn_cooe
14

---

Published as a conference paper at ICLR 2025,
Training and Evaluation details: We train detectors using the configurations from before (refer Appendix A..II). addition, we use the same validation set to compute the threshold for classification. It is important to notice that validation set consists of natural looking images. We take 5000 real and fake images each from the validation set, and apply compression, resizing, blur and color jitter operations to these images. We evaluate all the models listed in Table 4 on the validation set, selecting the threshold for each model that achieves the best accuracy. We use this threshold when evaluating the model on the test set.
A.1.3 EVALUATION OF AEROBLADE
AEROBLADE (Ricker et al. 2024) is training-free reconstruction based fake image detection technique. The first requirement is collect ensemble of VAE's of prominent latent diffusion models. Given an image. it is first reconstructed using the VAE and then the reconstruction is saved. The original image as well the reconstruction are passed through the VGGI6 (Simonyan & Zisserman 2013) and the LPIPS distance is computed. The key hypothesis is that, fake image can be reconstructed in an easier manner than real image, therefore the distance will be lower. In the paper. the authors provide a plot showing the distribution of real and fake images. Based on this plot and our trials with the model, we pick threshold of 0.018 for classification.
A.2 ABLATIONS
A.2.1 COMPUTATIONAL EFFICIENCY
Training fake image detector requires generating large number of images. This can become computationally heavy when using latent diffusion models, which utilize multiple rounds of forward pass through the UNet (eg) and final decoding through the Odec- Additionally, a text encoder is also used to condition the generation on text prompts. Since our approach neither utilizes the text encoder the UNet, and only generates images with a single forward pass through dene and ditecs it much more efficient. We measure this difference in terms the number of multiply-accumulae operations needed generate the 179257 fake images. We ensure ours and the baseline are generating images at the same resolution.
GMACs Comparison
U-Net
Autoencoder Text Encoder
Figure Computational cost mea- sured in the number of multiply- accumulate operations. Ours is more than 10x efficient than the state-of-ther method of (Corvi jet al. (022). Note that text en- coder cost is relatively negligi- ble compared to the U-Net and autoencoder.
GMACs (10e8)
Corvi
Ours
Results and Discussion: Figure 5 shows the results, where our method of curating the dataset is ten times more cost-effective than the existing state-of-the-art approach. Unsurprisingly, majority of the cost comes from rumning the UNet. By skipping the UNet step, we are able to reduce the computational cost. Furthermore, our approach can maintain similar effectiveness data, compared to the full dataset, setting it apart from Corvi. We discuss this in detail in Appendix
with lesser
5.4
A.2.2 FALSE PATTERN LEARNING IN OJHA-LDM
Ojha et al. 2024 train a Universal Fake Image detector by linear probing a CLIP backbone on ProGAN (Krras et al. 2018) generated images. However, they also train version trained
LAION (Schuhmann et al., (022) and LDM (Rombach et al., 2022) images. This model (Ojha-
LDM) ends up associating downsampling with real images. We demonstrate this using a simple
15

---

Published as a conference paper at ICLR 2025.
experiment. First evaluate Ojha-LDM set of real images and SD generated images. Now downsample both sets of images to 256 x 256 and measure the performance again.
Real
SD
Original
54.16
69.56
Downsampled to 256 x 256
83.58
29.83
Table 5: Effects of resizing on Ojha-I.DM. Real accuracy improves when the same real images downsampled. The fake accuracy SD images also drops. This shows that images which have downsampling artifacts are likely to be identified as real images by Ojha-LDM.
Table 5 shows the results of our experiment. We can see that downsampling real images increases the chance of the detector identifying them. But at the same time, the fake accuracy decreases.
Analysis: Such false patterns also caused by lack of well-aligned real-vs-fake dataset. We look into the dataset that Ojha-LDM was trained on. Their fake images come from LDM, and are generated at a resolution of 256 x 256. However, their real images which come from LAION are present in variety of resolutions. However, they were resized to 256 x 256 during training. During training. the model is able use some of these artifacts to fit the training distribution. This further suggests that without proper dataset alignment, the detector can very easily pick up spurious features present in the data.
A.2.3 THRESHOLD-LESS EVALUATION
In Tables 2 and assess the accuracy of various detectors under fixed threshold, simulating a test environment. In this section, we present the results for two important evaluation metries: average precision (AP) and true positive rate 5% false positive rate (tpr@5fpr). These metrics serve as indicators of the classifier's maximum ability to correctly identify fake images. For our evaluation, use the same test dataset described in Section 5.3 Specifically, examine both the original images, as referenced in Table [ and the post-processed images, which are presented in Table 2 grouping them into the same category for comprehensive analysis. The dataset consists of 6000 real images and 6000 images for each of the respective categories.
The results for average precision (AP) and true positive rate at 5% false positive rate (tpr @5fpr) are reported in Tables 66) and respectively. From these tables, we observe that classifiers trained on well-aligned dataset demonstrate near-perfect separability, as evidenced by the high AP scores and the tpr @ 5fpr values. Furthermore, the linear- seear-probing based methods (Ojha et al., 2024 Cozzolino iet al. (024) as well as the training-free, reconstruction based method (Ricker et al. 20244) achieve low AP, tpr @ 5fpr. This shows that these approaches cannot be improved by calibrating the threshold.
A.2.4 IMPACT OF ARCHITECTURE CHOICE AND INITIALIZATION
In this section, experiment with different architectural choices and initializations in order to disentangle the effects that a particular architecture/miittaliztooo may have on the results. We exper- iment with the following variation,
Same Architecture, Different Initialization: We the same ResNet-50, but we the DINO initialization (Caron et al. 202T). DINO is a self-supervised, self-distillation based approach to pre-train image feature extractors. We also fine-tune a FCN (Long et al. 2015) backbone which was originally trained on the semantic segmentation task on the (Lin et al. 2015) dataset.
Different Architecture, Same Initialization: We fine-tune a Wide-ResNet (Zagoruyko & Komodakis 2017) pre-trained on ImageNet. Wide-ResNets are widened versions of original ResNet with decreased depth. We also perform the same experiment with the ViT- B/16 (Dosovitskiy et al.] 202T) architecture. For ViT-experiments, we crop the image to 224x224 due to the input resolution requirements.
Different Architecture, Diffferntt Initialization: We fine-tune a modified ResNet trained using the CLIP (Radford et al. 2021) objective. The CLIP ResNet is deeper and bigger
16

---

Published as a conference paper at ICLR 2025.
Method
SD
MJ
Kandinsky
Playground
PixelArt-a
LCM
AEROBLADE RRicker et al.
2024
90.81
96.48
94.03
71.53
87.84
89.99
Ojha-ProGAN Ohhh ct al. 2024
62.02
52.33
64.55
61.58
61.45
64.75
Ojha-LDM (Ojha al. 2024
61.93
61.72
74,21
69.39
68.72
70.05
Cozzolino-LDM. (Coz (oozoolioo al. 2024
71,63
73.72
74.16
74,52
75,90
70.95
Corvi Corvi et al. 2022
97.87
94.81
95.32
90.93
94.16
96.15
Ours
99.32
98.37
97.97
98.17
98.38
99.84
Ours-Sync
99.40
98.30
98.14
98.54
98.58
99.79
Table 6: Average Precision. AP of different methods for detecting real and fake images. Our approach shows better separability between real and fake images across various settings as indicated by the AP. We
SD
MJ
Kandinsky
Playground
PixelArt-a
LCM
AEROBLADE (Ricker et
2024
59.08
85.31
69.66
13.57
50.95
54.62
Ojha- Ojha-ProGAN (Otha et al. 2024
13.28
9.33
17.08
12.20
12.85
16.27
Ojha-LDM (Ojha el al. 2024
12.63
14.32
26.34
16.58
17.56
18.35
Cozzolino-LDii Cozzolino et al. 2024
18.66
21,46
21.70
20.21
24.10
20.76
Corvi (Corvi et al.
2022
91.69
81.46
83,86
65.75
83.66
84.32
Ours
96.82
92.19
91.00
91.52
94.25
99.02
Ours-Sync
97.08
91.77
91.08
92.88
94.58
98.53
Table 7: True Positive Rate (TPR) at 5%
False Positive Rate (FPR) for different methods across various evaluation settings. The best results for each setting are highlighted in bold.
than the ResNet that we used for our earlier experiments. In order to process images of varying scales, we replace the attention pooling with adaptive average pooling.
For our new variants, we follow the practice of Gragnaniello et al. (021I) by modifying the stem where we remove the downsampling operations. For each configuration, of them is trained on the dataset used by [Covii et al. (2022) and the other one trained on our dataset (Ours-Sync). We measure performance using the AP metric that used in Appendix A.2.3 We report the results in Table
train two variants, one
We observe that the detectors trained using aligned dataset exhibit superior performance their counterparts irrespective of the network architecture and initialization. Furthermore, among the detectors trained using the dataset used by Corvi al. (2022). we observe that the results are mostly similar, except for the -LIP-initialized Modified ResNet. The CLIP ResNet has more parameters in comparison the other networks, therefore we hypothesize that it might have overfit more the spurious correlations present in the training data. ViT-based detectors perform worse than CNN- based detectors, we hypothesize that this an effect of patch- based training in CNN-architectures which show better generalization.
A.2.5 ROBUSTNESS TO
Previously, we evaluated our model on several post-processing operations. We also examined the sensitivity of our approach to resizing (Fig 2 and .webp compression. In this section, study in-detail the robustness of our method to additional post-processing operations which are commonly found in the real world. We experiment with the following post- processinn operations,
Blur: We blur the images by using a gaussian kernel of size 9, We vary the standard deviation of the kernel, denoted by σ..
Gaussian Noise: We add gaussian noise original image. We control the standard devia- tion of the added noise in order to study the behaviour of our model.
JJPEG Compression: We study the effects JPEG compression by varying the compres- sion quality.
17

---

Published as a conference paper at ICLR 2025,
Initialization
Architecture
Dataset
SD
MJ
Kandinsky
Playground
PixelArt
LCM
Corvi
97.87
94.81
95.32
90.93
94.16
96.15
ImageNet
ResNet-50
Ours
99.40
98.3
98.14
98.54
98.58
99.79
Corvi
98.27
95.26
96.25
94.26
95.09
97.05
DINO
ResNet-50
Ours
99.52
98.52
98.81
98.96
99.09
99.84
Corvi
98.29
95.81
96.14
93,45
94.97
96.23
FCN
ResNet-50
Ours
99.27
98.4
97.86
98.88
99,12
99.83
Corvi
97.72
94.82
95.59
91.54
94.54
95.31
ImageNet
Wide-ResNet
Ours
99.06
98.22
97.23
97.12
98.13
99.51
Corvi
85.78
66.2
72.57
65.42
65.61
71.98
ImageNet
VIT-B/16
Ours
93.68
89.46
87.85
82.01
92.58
91.58
Corvi
93.86
93.39
93.6
9I.02
CLIP
Modified-ResSet
Ours
99.12
98.44
97.17
96.86
97.99
99.36
Table 8: Average Precision (AP) Across Architectures and Initializations. Performance of net- works with different initializations and architectures, trained on the dataset provided by Corvi and our dataset. A detector trained on well-aligned dataset consistently outperforms the Corvi base- line. This indicates that the positive effects of dataset alignment are independent of the choice of architecture and pretraining.
Our design of the perturbations follows AEROBLADE Ricker et al. 2024). For these experiments,
the same images from experiments in Section 5.2 Sensitivity of detector to blur,
noise and compression can be found in Fig 6
and g respectively.
Fake Images
Real Images
1.0
Probability of fakeness
Corvi
Probabiliy of fakeness
Corvi
0.8
0.8
Ours-Sync
Ours-Sync
0.6
0.6
0.2
0.2
0.0
2.0
2,5
3.0
4.5
5.0
0.0
1.5
2.0
2.5
4,0
4.5
Blur Sigma
Blur Sigma
Figure 6: Sensitivity of fake detectors to image blurring for set fake images (left) and set of real images (right). We use kernel size of 9 and vary the standard deviation. Ours-Syn shows increased robustness to blurring showing the importance batch-level alignment.
Fake Images
Real Images
1.0
1.0
Probability of fakeness
Corvi
Probabiiity of fakeness
Ours
Ours
Ours-Sync
Ours Syrs-Sync
0.6
0.6
0.4
0.4
0.2
0.2
0.0
0.0
0.100
0.200 0.250
0.050
0.075
0.175 Noise Level (Standard Deviation)
Noise Level (Standard Deviation)
Figure 7: Sensitivity of fake detectors to additive noise for set fake images (left) and set of real images (right). We control the noise level by varying the standard deviation of the added noise.
There is a huge performance gap between the Ours-Sync method and the others when the image blurred. This adds to our earlier observations from Tables D and 2 that ensuring batch-level alignment is very important design choice along with the design of the dataset. Furthermore. the general robustness observed also shows that our detectors are not just looking at some low-level traces which can be washed away by simple post-processing operations.
18

---

Published as a conference paper at ICLR 2025,
Fake Images
Real Images
1.0
Probability of fakeness
Probability of fakeness
Corvi
0.8
0.8
Ours-Sync
0.6
0.6
0.4
0.4
0.2
Ours Ours-Sync
0.2
0.0
60
100
100
JPEG Compression Quality
JPEG Compression Quality
Figure 8: Sensitivity fake detectors to JPEG Compression for a set fake images (left) and set of real images (right), We control the compression level by varying the JPEG compression quality.
19


Reviews:
[{"review_id": "Fdpru9onar", "reviewer": "Reviewer_uw3N", "summary": "This paper aims to detect fake images by improving the aspect of data alignment. The paper reconstructs all real images using the autoencoder of a latent diffusion model and then trains fake image detectors to distinguish between real and reconstructed images. The paper claims that this approach prevents the fake image detector from focusing on unwanted artifacts such as semantic content, resolution, or file format. Additionally, they argue that this method of data collection is more efficient than prior works which pair real images with generated images, as it avoids the expensive denoising process associated with generating fake images. The paper shows stronger results than prior works in detecting latent diffusion models and provides an analysis of potential pitfalls in prior works, such as detection bias stemming from resolution differences or compression artifacts between real and fake data.", "questions": "1. What is the rationale behind calibrating the threshold in Table 3? Why is this different than prior experiments (Tables 1 and 2), and what happens if you use the default threshold (0.5) similar to Tables 1 and 2?\n2. I'm curious what the authors' intuition behind why the models trained on shaders dataset show more sensitivity to post-processing than the ones trained on natural images.\n3. The Appendix A.2.1. shows that the proposed method can train the detector in a more data-efficient manner. I'm curious why this is the case. Is it because it only has to focus on single artifacts?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper proposes a simple and efficient way to collect data for fake image detection.\n2. The paper provides an analysis of common pitfalls of prior works, such as image resolution or compression artifacts.", "weaknesses": "1. It is unclear whether or not the proposed method would generalize well to architectures other than latent diffusion models. For example, would this generalize well to models such as VQ-VAE[1], VQ-GAN[2], or more recent models with very different autoencoder architectures? The paper mentions that it does not work well on models with vastly different architectures (e.g., FLUX.1-dev), but it is not clear to what extent of architectural changes the proposed method is robust to.\n2. The proposed method, by design, disregards semantic content. While the paper claims that this is a desired property, in some contexts, the semantic content may matter. With proper techniques, the autoencoder artifacts may be decimated [3]. In such cases, the proposed method may fail to properly distinguish fake and real. However, prior data-driven approaches may be able to pick up on semantic cues such as over-saturation or contrast, malformed objects, or unrealistic sceneries to detect generated images. \nThe performance differences after post-processing shown in Table 3, between detectors trained on natural images and shader images, may hint at the importance of semantics.\n3. The paper lacks a detailed analysis of sensitivity to various transformations. The paper claims that their method of training detectors is more robust as it forces the detectors to focus more on autoencoder artifacts. However, the experiments do not adequately demonstrate this property, as the paper only compares the performance of a single randomized post-processing technique in Tables 2 and 3. Including a detailed, separate analysis of the robustness to various transformations, similar to those shown in Figure 2 and the figure on page 10 would better illustrate this characteristic and provide better insights for future research.\n   - The figure on page 10 should be properly numbered and referenced in the main text.\n4. Accuracy is not the best metric for showing the performance of the detectors, as it is sensitive to thresholds. I recommend the authors to consider threshold-less metrics such as average precision (AP). For example, in Tables 1 and 2, applying post-processing actually improves the accuracy of certain detectors (e.g., Cozzolino-LDM). Using threshold-less metrics such as AP may provide a more accurate picture of performance degradation caused by post-processing.\n\nI will give borderline/weak accept for this round and update the rating after the discussion.\n\n&nbsp;\n\n***Minor comments:***\n- The figure on page 10 lacks proper numbering.\n- While the writing is clear, some of the writing seems less professional. Some examples:\n    - Lines 026-027: \"Just how effective ... can be\"\n    - Lines 121-122: \"report limitations that even our method cannot circumvent\"\n    - Lines 274-275: \"See how much more efficient our method ... is\"\n    - Lines 337-338: \"Synthesizing a lot of images ...\"\n    - Lines 517-518: \"This is where the promise of ... come\"\n    - I believe the writing quality could be improved if some of these writings were delivered in a more professional tone (e.g., \"a large number of images\" instead of \"a lot of images\").\n\n&nbsp;\n\n[1] Van Den Oord, Aaron, and Oriol Vinyals. \"Neural discrete representation learning.\" Advances in neural information processing systems 30 (2017).\n\n[2] Esser, Patrick, Robin Rombach, and Bjorn Ommer. \"Taming transformers for high-resolution image synthesis.\" In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 12873-12883. 2021.\n\n[3] Davide Cozzolino, Giovanni Poggi, Riccardo Corvi, Matthias Nießner, Luisa Verdoliva. \"Raising the Bar of AI-generated Image Detection with CLIP\". Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, 2024, pp. 4356-4366", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ReZ3INlMZM", "reviewer": "Reviewer_hbmp", "summary": "This paper is rooted in a key observation that training a naive binary classifier to detect real/fake might learn the spurious correlations, and thus cannot achieve a more robust detection result. To achieve the alignment of the training dataset, they propose a new dataset by using LDM’s autoencoder for reconstruction purposes. The authors also provide clear evidence and experiments to verify their observation.", "questions": "1. Does the detector primarily learn LDM-specific fake patterns, rather than a broader range of patterns such as those generated by GANs? Or does it learn only method-specific fake patterns unique to a particular LDM instance, failing to generalize across the LDM family?\n\n2. What is the clear and accurate definition of \"fake image\" in this work?\n\n3. What are the differences between CLIP and Res50 in the shortcut manner?\n\n4. Offline reconstruction and online reconstruction.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The paper is well-written and has a very clear research motivation.\n\n2. The dataset alignment is a critical problem that might cause the model to learn spurious correlation in the fake image detection field.\n\n3. The authors provide reasonable evidence to validate their findings and observations. Especially the effectiveness of downsampled before and after resizing (Table 5), which is insightful to me.", "weaknesses": "- A major limitation of this work is the generality of images generated by Latent Diffusion Models (LDM). Does the detector primarily learn LDM-specific fake patterns, rather than a broader range of patterns such as those generated by GANs? Or does it learn only method-specific fake patterns unique to a particular LDM instance, failing to generalize across the LDM family? A more robust evaluation of this generality would be beneficial.\n\n- This paper defines \"fake image detection\" as \"entire image synthesis.\" However, this scope does not cover other types of fake images, such as deepfakes (e.g., face-swapping) or talking-head videos. A further discussion of the results of these types of fake images would enhance the paper.\n\n- There is limited analysis of pre-trained models in this work. For instance, CLIP and ResNet-50 (trained on ImageNet) may detect fake images differently. Given CLIP’s rich knowledge, it may be less likely to focus on irrelevant patterns. A deeper analysis and discussion of these differences would strengthen the paper.\n\n- What are the advantages of conducting online reconstruction using LDM (as in previous works, such as ref[1]) compared to offline reconstruction (as used in this work)?\n\n- The alignment issue highlighted here is not entirely new; several prior studies, especially in deepfake detection, have addressed this challenge. For example, refs [2] and [3] discuss the importance of alignment for robust detector performance. Ref [2] shows that a resolution gap between real and fake images can bias models toward interpreting higher resolution as real and lower as fake, while ref [3] demonstrates that aligning real and corresponding fake samples in training improves detector robustness. Further discussion of these relevant works would help contextualize this study’s findings on alignment.\n\nref[1]: DIRE for Diffusion-Generated Image Detection, ICCV 2023.\n\nref[2]: DF40: Toward Next-Generation Deepfake Detection, NeurIPS 2024.\n\nref[3]: Transcending Forgery Specificity with Latent Space Augmentation for Generalizable Deepfake Detection, CVPR 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XseAaw2ltJ", "reviewer": "Reviewer_caUt", "summary": "This paper investigates the effectiveness of dataset alignment in fake image detection, specifically for images generated by latent diffusion models (LDMs). The authors propose a simple approach: reconstructing real images using the LDM's autoencoder and treating these reconstructions as fake images. This aligned dataset allows for training a classifier to distinguish real from fake images, focusing on the generative model's artifacts rather than spurious correlations such as resolution or content differences. Experimental results show that this alignment method improves the robustness and generalization of the detector across different generative models, while also being more computationally efficient.", "questions": "See the weakness section.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 1, "contribution": 3, "strengths": "1. The paper proposes an interesting framework for generating fake images by using only the LDM's autoencoder, rather than the full generative process, to train the detector. Experiments show this approach achieves better performance compared to using complete generated images, which is a noteworthy finding.\n\n2. The paper reveals the impact of scaling factors on detection methods, contributing valuable insights to the field.", "weaknesses": "1. Lack of technical contribution: Although the findings are interesting, the authors did not deeply explore the reasons behind the observed phenomena or how they could further benefit existing detection methods. They only conducted shallow comparative experiments using their generated data. Overall, the contribution feels insufficient.\n\n2. Limited comparison methods: The authors aim to prove their dataset has better generalization and performance than others, but they only compared it with two methods. These methods are not state-of-the-art (SOTA) on complex public datasets like GenImage. The lack of sufficient comparisons weakens the paper's persuasiveness. Additionally, the comparison datasets are not from AIGC detection benchmarks, making it difficult to determine a fair performance improvement.\n\n3. The proposed method of classifying only LDM-generated data can avoid some spurious features but also ignores certain important features, such as artifacts introduced during the diffusion process. The method is mainly effective for LDM-based generation techniques and less so for traditional GAN or diffusion models. It may be that the LDM itself removes diffusion artifacts, making it easier to detect LDM-specific artifacts. Moreover, the method cannot handle semantic inconsistencies left by some generative methods, such as incorrectly generated hands.\n\n4. The authors should conduct robustness tests, such as robustness against noise or JPEG compression, to further validate the method.\n\n5. The paper structure could be improved, with clearer diagrams and better formatting. The dataset descriptions are somewhat disorganized, and a more structured introduction is recommended.\n\nDespite these shortcomings, I still believe this discovery is valuable, and the relative improvements are significant. I encourage the authors to further explore this phenomenon in depth.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZlTE4N0ZWJ", "reviewer": "Reviewer_ecmv", "summary": "The paper mainly focuses on detecting the fake images generated by latent diffusion models (LDMs). It states that dataset alignment plays an important part in detecting LDM-based fake images and proposes a simple method to detect LDM-based fake images by training detectors with the aligned dataset (real images and fake images created by only LDM's autoencoder). Experiments show that the proposed method is inexpensive and effective in detecting LDM-based fake images.", "questions": "1. Why does the performance of detectors drop a lot facing fake images with small scaling factors or real images with large factors? Are there any reasonable explanations?\n2. Why does \"Ours-Sync\" outperform \"Ours\" in most cases, and why does \"Ours\" kick back in some special cases?\n3. The combination of the proposed method and Corvi should be reasonable and available. Does it perform remarkablely in detecting LDM-based fake image detection?\n4. It seems that the proposed method can enjoy a better performance with a large batch size. Would you mind a try?\n5. I understand that using ResNet-50 is for alignment in the network architecture to some baselines, but more experiments on different network architectures are suggested.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The proposed method is simple and can potentially be a useful baseline for LDM-based fake image detection.\n2. The proposed method is more effective and efficient than the paper's major baseline (Corvi).\n3. Extensive experiments provide sufficient support for the superior performance of the proposed method. 4. The paper is somewhat clear and well-written to me.", "weaknesses": "1. The title slightly disqualifies the paper's main topic since the authors pay attention to LDM-based fake images. However, many generative models can create general fake images, including AutoEncoder, GAN, VAE, and LDM. It seems more appropriate to add qualifiers in the title. \n2. Both Corvi and the proposed method remain vulnerable to minor changes. Although the proposed method shows wonderful performance against some LDM-based images, the comparison between results from Table 1 and Table 2 reveals both Corvi and the proposed method can be easily disturbed by post-processing like lossy compression.\n3. Lack of further insights between \"Ours\" and \"Ours-Sync\". In section 4 (Our Approach), two variants \"Our\" and \"Our-sync\" are introduced but with no extra explanations. In experiments, \"Ours-Sync\" shows superior performance in most cases than \"Ours\" with almost no analysis. \n4. The figure in the conclusion loses its caption. Help it.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)