Manifold Induced Biases for Zero-shot and Few-shot Detection of Generated Images
Authors: Jonathan Brokman
Amit Giloni
Omer Hofman
Roman Vainshtein
Hisashi Kojima
Guy Gilboa
Venue: ICLR 2025 Poster (2025)
Keywords: zero-shot
few-shot
generated image detection
total-variation
curvature
score function
diffusion models
Primary area: generative models

Abstract: Distinguishing between real and AI-generated images, commonly referred to as  'image detection', presents a timely and significant challenge. Despite extensive research in the (semi-)supervised regime, zero-shot and few-shot solutions have only recently emerged as promising alternatives. Their main advantage is in alleviating the ongoing data maintenance, which quickly becomes outdated due to advances in generative technologies. We identify two main gaps: (1) a lack of theoretical grounding for the methods, and (2) significant room for performance improvements in zero-shot and few-shot regimes. Our approach is founded on understanding and quantifying the biases inherent in generated content, where we use these quantities as criteria for characterizing generated images. Specifically, we explore the biases of the implicit probability manifold, captured by a pre-trained diffusion model. Through score-function analysis, we approximate the curvature, gradient, and bias towards points on the probability manifold, establishing criteria for detection in the zero-shot regime. We further extend our contribution to the few-shot setting by employing a mixture-of-experts methodology. Empirical results across 20 generative models demonstrate that our method outperforms current approaches in both zero-shot and few-shot settings. This work advances the theoretical understanding and practical usage of generated content biases through the lens of manifold analysis.

Published as a conference paper at ICLR 2025
MANIFOLD INDUCED BIASES FOR ZERO-SHOT AND SHW-SHOT DETECTION OF GENERATED IMAGES
Jonathan Brokman
Amit Giloni*
Omer Hofman" * omer wuw.anfffuuuuuueeeuuuuuuuuuuuuu fujttssu.ouuttuuooo
jonathanrrok@maiil.c com
amit giloniffujiter com
Roman Vainshtein
Hisashi Kojima* hisashi. jomaa
Guy Gilboa*
roman, www..ennnteeeeeuuiteeeuuuuuu com
guy gilboagee..ee...eeeeoeee.oooooo technion. ac. 11
ABSTRACT
Distinguishing between real and Al Al-generated images, commonly referred to as 'image detection', presents timely and significant challenge. Despite extensive research in the asemi-Jsupervised regime, zero-shot and few-shot solutions have only recently emerged as promising alternatives. Their main advantage is in alleviating the ongoing data maintenance, which quickly becomes outdated due to advances in generative technologies. We identify two main gaps: (l) lack of theoretical grounding for the methods, and (2) significant room for performance improvements in zero-shot and few-shot regimes. Our approach is founded on understanding and quantifying the biases inherent in generated content, where we use these quantities criteria for characterizing generated images. Specifically, we explore the biases of the implicit probability manifold, captured by a pre-trained diffusion model. Through score-function analysis, we approximate the curvature, gradient, and bias towards points on the probability manifold, establishing criteria for detection in the zero-shot regime. We further extend our contribution to the few- shot setting by employing a mixture-of- across 20 generative models demonstrate that our method outperforms current approaches in both zero-shot and few-shot settings. This work advances the theoretical understanding and practical usage of generated content biases through the lens of manifold analysis.
methodology. Empirical results
INTRODUCTION
Advancements in generative models, particularly diffusion-based techniques, have resulted in the creation of synthesized images that are increasingly difficult to distinguish from authentic ones. This poses significant challenges in content verification, security and combating disinformation, driving the demand for reliable mechanisms to detect Al-generated images.
wide array of contemporary research has focused on this task, employing methods ranging from standard convolutional neural networks (CNNs) (Wang et al. 20200; BBrahhem & Nguyen 2023
Epstein et al. 2023 Bird & Lotf 2024) to approaches that distinguish hand-crafted and learned
characteristies [Bammey 2023] Maattin-Rodrguez et al.) 2023] Zhong et al., 2023; Wang et al. 2023 Tan et al. 2024 Chen et al., (2024). Despite these efforts, there is a consensus on the critical importance of generalization to unseen generative techniques in this field (Bontcheva et al.) 2024): These techniques evolve quickly, presenting substantial challenges in maintaining up-to up-to-date generated datasets, which are crucial for supervised detection methods. Methods that generalize to unseen generative techniques reduce the need for constant data collection and retraining.
Targeted efforts to enhance such generalization have been actively pursued in specific semi- supervised setting, where models are trained on one generative technique and evaluated on another (Ojha al. 2023 [hha et al. 2023). Notably, these methods still require data consisting of hundreds of thousands of diverse generated images. In recent months, zero-shot and few-shot techniques have emerged for this task (Cozzolino et al. 20244 Ricker et al., 2024 He et al.) 2024 Cozzolino et al. 20024b). Zero-shot methods use pre-trained models to solve tasks they were not trained for without designated (or any additional) training. Few-shot methods employ similar tactic but involve
Techhion Isracl Institute of Technology Fujjisu Research of Europe # Fujitsu Limited 'Equal contribution.

---

Published as a conference paper at ICLR 2025
minimal data to adapt the pre-trained model (e.g. incorporating lightweight classifier). While these methods hold great potential by eliminating the need for extensive training and data maintenance, there remains significant room for improvement in terms of operating wide array of (unseen) generative techniques. Moreover, current methods lack theoretical grounding a surprising gap given the success of Mitchell et al. (2023), which revolutionized zero-shot generated text detection using a theoretically grounded curvature criterion. They rely on the hypothesis that generated data lies on regions of local maxima of the learned data probability. However, their method uses the explicit probability modeling of LLMs, which is impractical when addressing the typically implicit approaches of image generative models.
This work advances solutions to these gaps. It is grounded in theoretical understanding capitalizing on the diffusion model's implicitly learned probability manifold p to quantify inherent biases of its generated outputs. Namely, we present novel derivations aimed at quantifying the stability of output images along the diffusion models' generation process, yielding a new stability criterion. By design, these stable points correspond to images the model is biased to produce. To this end, we leverage the ability of pre-trained diffusion models to approximate the score function, expressed as
S V logp.
(1)
and explore novel ways of analyzing the manifold defined by a function surface log p. We consider several criteria, such as
Vlog
H V
V logpl
the (hyper) surface curvature. This curvature is infact total-variation differential, and is explained Note that unlike S, it is not straightforward to access H. In our
below the local flux of |V log derivations, H emerges from expressing the similarity between signal and noise predictions alongside two additional quantities the gradient magnitude and a statistical bias- baas- quantity which capture generation biases as well. We develop mathemmttically-goundde
V log
methods to access these quantities and introduce a pioneering zero-shot diffusion model analysis for detecting generated images (Fig. D. Extended capabilities to the few-shot regime are provided as well.
Key Contributions:
We establish a theoretical framework by integrating manifold analysis with diffusion model score functions, introducing novel, bias-driven criterion for distinguishing real and gener- ated images. This sets the foundation for further theoretical investigations in the domain.
We propose the first zero-shot analysis pre-trained diffusion models for generated image detection. Remarkably this analysis demonstrates excellent generalization to unseen generative techniques.
Our method demonstrates superior performance over existing approaches in both zero-shot and few-shot settings, validated through comprehensive experiments on a diverse dataset of approximately 200,000 images across 20 generative models.
To reproduce results, official implementation
2 RELATED WORKS
The evolution of detecting Al-generated images has primarily relied on supervised learning method- ologies. The common approach utilizes standard CNNs trained on labelled datasets of real and generated images Wang al. (2020); Baraheem & Nguyen (2023); Epstein et al. (2023) Bird & Lotfi
(2024). Subsequent research by Bammey (2023): y; Maattin-Rodriuuee et al. (2023); Zhong ct al. (2023); Wang et al. (2023); Tan et al. (2024); CCen et al. | (2024) identified and integrated key phenomeno- logical features, enhancing performance. These relied on extensive generated image datasets from various generative techniques, limiting their generalizability unseen techniques Ojha et al. (2023).
Various high-dimensional curvature definitions exist, this is choice. Note that the TV-curvature connec- tion itself is not new see e.g. the mean curvature flow (MCF) perspective Kimmel et al. (197] g Aubert et al.
2006), and its generalization in Brokman & Gilboa (021)) y Brokman et al. (2024)
httpps www..hcc..mooo....
Tnduced-RR ases- for- Zaro--rrro-ot who--shtt-aatt -ad--and------- httae-ttttteeeooo----eeeeeeeeeee Tmage:
2

---

Published as a conference paper at ICLR 2025
Our Zero-shet Detection Method
Spherical Perturbations
Implicit Data Manifold Differentials
The mre-calibrate
dureshold oz real data
Input Sample
Model
Criterion Analysis
Real
%
Figure I: The proposed zero-shot detection pipeline, which circumvents the need for generated data. An input image zo is subjected to pre-trained diffusion model and spherical perturbations. This sets the stage for our mathematical characterization of To, resulting in criterion for the detection task.
Recent studies proposed alternative methods to enhance generalization to unseen generative tech- niques. Those unsupervised and semi-supervised methods Zhang al. (2022a by; Qiao al. (2024):
Cioni et al. (2024) reduce the reliance extensive labeled datasets; however, they still rely on access to generative methods during training. leading biases towards those generation techniques. Ojha et al. (2023) and (haa al. (2023) introduced notable CLIP-based approach to analyze content from limited set generative techniques, achieving unmatched generalization unseen methods. Cozzolino et al. (2024a) extends this approach and capitalizes generalization in the low-data regime. Using few-shot analysis with pre-trained CLIP, they outperform existing methods.
To eliminate data maintenance and training altogether, zero-shot approaches emerged. To the best of our knowledge, Ricker et al. 2024) and He et al. (2024) are the only such methods. The former employed pre-trained auto-encoder (AE) for out-of-distributio analysis technique, e.g. An & Cho (2015). Pre-trained on real images, the AE is expected to encode-decode them better than generated images. Therefore, the reconstruction error is their criterion for detection. He et al. (024) compares the image representation similarity between an image and its noise- perturbed counterpart, offering insights into the desired qualities representations for the detection task. Our proposed method is the first to analyze diffusion models in the zero-shot setting for the detection task, outperforming both Ricker et al. (2024) and He et (2024) in terms of operating on wide array of unseen generative techniques.
well-established
PRELIMINARIES
3.1 DIFFUSION MODEL SETTING
Diffusion models are generative models that operate by an itcrative generation process of noise reduction based pre-set noise schedule. Let the data manifold be Ω2 Rd where is the data dimensionality. and denote a sample x E S2. Each iteration involves denoising a noised signal zt via neural network [Ix, t; 0) (0 the tuneable weights), subsequently progressing _T- This sequence begins at l T by sampling a tensor of iid normally distributed entries i.e. IT ~ ~N I). and terminates xo E Ω, representing the final output. In setting To an image. This generation process is known reverse diffusion,, where during training, f optimized to reverse forward diffusion process, defined using scheduling parameter a, E I Vt. and noise e A (0. as follows
Et
VI agz0 + Vaye.
3.2 FCORE-FUNCTION IN DIFFUSION MODELS
The score-function is defined as log p x). where p(z) is the probability of z. Let Po. (xx) be the
probability of considering Equation (3) The founding works of today's diffusion models Song &
Ermon (2019) y020); Kadkhodaie & Simoncelli (202T) capitalize on Equation (3), analyzing from fcore-function perspective based on the following seminal result by Miyasawa al. (161))
V log Pa, (xx)
(VI aq [x) xz)
(4)
a4

---

Published as a conference paper at ICLR 2025
where Eg [z [ry] is the Minimum Mean-Squaree Seua-ed-uuurrrrree Error (MMSE) denoiser of rt. It replaced with the output denoising model 20 = f( t; 0), for which
v log (xt) = - (VII (x)(t;;;)))
(5)
at
Often, [11, 1; predicts noise, i.e. so VI-ai (ot yaus (aie 1; 1;)).. Finally, replacing far,, 1;0) with the true zo we have VlogPa, (x) vat i.e. Equation approximates
up known factor. It is straightforward that, despite 52 being zero-measure of Rd (Ω2 is assumed to have a dimension much lower than d), the probability of 2; is non-zero on the entire Fd space.
With V log the generation process can be simulated as Itö's SDE Ito et al. (951).
((T) V logp(a(T)) + /2w,,
(6)
where (T) is the time derivative of (.(T), and w, the time derivative of Brownian motion w(r). i.e.
it injects noise to the process. In [Soon & Ermon (2019), generative process that accounts for Pa: that changes in time was introduced generalizing Equation (6). With that said, this paper employs a
fixed-point analysis of Pa. for fixed at, Remark: The commonly used time here is reversed, i.c.
large implies small t. The consensus in diffusion models research and this paper is to reliably use t.
METHOD
Here we present our mathematical perspective. For illustrations see Figs. 3 (b-c).
4.1 KRY QUANTITIES AND CRITERIONS IN OUR FIXED-POINT GEOMETRIC ANALYSIS
In the setting of Sec. following Equation (6) (or its annealed version), generated sample 2n is expected to be near a stable local maximum the learned log probability manifold - namely a point of positive curvature and low gradient- i.e. the learned manifold is expected to be "bumpy", with generated data appearing near peaks. Conversely, real data points that are unlikely generated will not exhibit these characteristics. For graphical illustration, and a demonstration, see Figs. 3 a). This aligns with Mitchell et al. (2023); 's hypothesis on generated text. To test Zy for these characteristics, we work in its local neighbourhood. Let us employ fxee-point analysis, "freezing" the generative process at small fixed t. We assume a; is small enough for Pa. to approximate the data distribution and large enough for Paz, to be smooth. Since is fixed, we use a from now on. Relying pa smoothness, we use log Pa to construct a d-manifold in IR++1 as parametric hyper-surface of the form (z, lo Pa( for which the total-variation curvature Equation (2) applics.
Let Bo be the local neighbourhood of with boundary 3B. and denote their respective volumes as [Bol, [o..). Let (,,)). ||. ||2 denote the Euclidean inner product and norm. A gradient criterion
1
D(xo) = |aBol
|| log Pa (2)1,,,
JaBo
will be employed, as well as a curvature criterion
-1
/
V (a
<(zo)
V
V log (x))((2) dx.
(8)
Bol
Bo
Note the minus sign, which ensures that an inward pointing gradient (negative divergence) is associ- ated with positive curvature, and vice versa. We choose Bo be the ball
Bo for II azo æ|I2 Vda).
This Bg is practical: Its spherical boundary 2B, (and its close neighbourhood) is highly probable
under pa. and the score function on θBo can be approximated via the diffusion model at fixed /
Equation 5 34 Additionally, BBp is easily sampled as
ã = VI azg + Vaud,
(10)
This approximation is the concentration of measure, further reading: Giannopoulos & Milman 2000).
"To ensure xo Ba we require vT VT-a- <
4

---

Published as a conference paper at ICLR 2025
(a) Surface logPa
(b)
Implicit bumpy = loyPa
Color bumps logPa
(d)
(e)
(f) ak D(15)
D (7)
ak (8)
een
Real
Figure 2: Toy probability surface. Simulation of toy data probability in two-dimensional space (d = 2), structured along a one-dimensional manifold (Ωt is a curve). (a) The log probability surface of perturbed samples, considering a uniform probability on the Q curve. (b) A simulation of the hypothesis that generative models learn a bumpy version of the manifold: Bumps are randomly assigned to the manifold and visualized in color on the original surface. (c) The resulting bumpy surface. (d) Gradient magnitude of the bumpy manifold. (c) Total-variation curvature of the bumpy manifold. Demonstrates the differential property derived from our analysis, highlighting locally maximal regions of the bumps which correspond to likely generated data points. We mathematically establish a way to capture this property through a zero-shot analysis of the diffusion model.
where Unif(Sd-((V))) uniform distribution the (d 1)-dimensional sphere centered at Ō with radius Vd. Clarification: V log Po. (-) can be applied to samples of ž, yet the score function will be calculated for a sampled Ti, namely Equation (4. Equation (5) still hold, i.e.
- ov, 2) h(t),
V Po
a - oz, 8)
(11)
where (()) denotes the diffusiin-moder approximation of the score function. Notice the relation between ă. constructed with +- a, and xę: As d increases, the probability of ||c||2 (c of Equation (3)
concentrated around its mean vd, reducing the norm's stochasticity making uyg and (and
consequence and 2τ) interchangeable in high dimension d Laurent & Massart (2000), see Fig.
4.2 MATHEMATICAL CLAIMS: ACCESSING KEY QUANTITIES AND CRITERIONS
Claim 1. Given an image Dn and a sample x B|z0 drawn according to Equation we denote ua(z)=
Then the following relation holds:
V log (x)
E uno
ua(x))
Vlggp. k(xr)) D(wr).
(12)
V (x)
This provides characterization of zo stable maximal point under the backward diffusion process, Equation 6 quantifying both gradient magnitude (should be low) and curvature (should be high).
Proof Ouiline (full proof in the Appendix D
First we use Gauss divergence theorem for the curvature term
V log (x)
lo log (x) f)dz.
- -(Bol((Zo))
log [2) dx
(13)
Bo
JBB.
'Thus. model trained to denoise æ., will perform well for V log
Po, (āt) in the sense of Equation 5 since
sub-sphere of p(xx). Infact, in our high dimensional setting, sampling 37 that is far away from ao is highly improbable.
3e samples from the gighess--probbbiie
"The notation of uæ as function of z, i.e. ua(x), expresses the fact that ua(x), are constructed as pair drawing the same noise. We use this when explicitly formulating expectation an integral, where it is crucial to decide variable (us
integrate upon
5

---

Published as a conference paper at ICLR 2025
Probeciity Dasiy Conegence
(4)
Logeling
Sunnar Sundarr Dev lutinn of
Cirde
K-I442
Se OeticO
508 cade
200
Number Bounday Samples
Number of Bounbey Samples
Figure 3: a) The Local Maxima Region Property. We trained a diffusion model on a 3-modal Gaussian Mixture Model (GMM) (details in Appendix [ implementation based on Brokman et al. (2025). ). The colormap shows the learned PDF, with reverse diffusion trajectories overlaid. Starting points (green circles) converge toward local maxima of the probability(red stars). For statistics scale see Fig. 7 b) Expected Behavior of the Curvature Criterion 6. We compute λ on two marked circles centered local maxima and saddle points of differentiable analytic function (details in Appendix A). As expected, is higher for the local maxima. c) Error Analysis of Estimators. We experiment with both values from b), and approximate them with increasing no. of spherical samples based on (Equation (3). We average 100 runs and show std as error bars. Results confirm reliability: 1) The mean remains close to the true value even with few samples (unbiased estimator). 2) Separation between maxima and saddle points is maintained, even with as few samples. d) Consistency and Convergence is plotted against the number of spherical boundary samples in log-log plot. Linear regression applied to quantify the rate of convergence, showing a good fit with negative regression slopes, confirming exponential convergence. Combined with the empirical unbiasedness demonstrated in b), this establishes that the x estimators are empirically consistent.
Estimators. The standard deviation of y estimators
where á denote the outward-pointing normals to the sphere dB. Using the properties of Zz/20. which uniformly distributed on 0B,, we have that Eg=ijz (.) Tanol Song (.). Moreover, by
construction á x-vI-aa
#a(w) Vd
Ve E aBn Hence we
VVl-000- #
<(z)) = |0Bol
Vlogno (x)
E
E
Ma(x)).
(14)
/olBol
V Pa (x)ll2
We then use the same properties of the uniform distribution 8. and obtain D(ro)
Eywer an lo thus
V (m) V log Finally- by properties the hyper-sphere we have ValBol
8
log (x)
-
ua(x)) + V log (l) = k( - D(xo).
(15)
v log Pa
Corollary 2. In the setting of claim
we furthermore have the following approximation
log Pa (x)
1 _x(x0) Dxxo)
St) As
(16)
V log (x)
Va
Proof Outline (full proof in the Appendix D
By linearity we decompose the expectation to summands via Equation We have
v log
Exaalso
0,
(17)
V log (x)
since integration of normals over the sphere zero, and (x) approximates the uniform spherical noise. Thus, Eg- < dividing the (remaining two) summands by a leads to Equation T6 and we are done.
log (=)]]] /1 axa) Rs 0, since To is deterministic. From here,
log (u)
Corollary Let by represent the statistical bias of predictor io. defined as by = Dg Ex too (2o). Transitioning from score-function to the denoising perspective of diffusion models, the summand

---

Published as a conference paper at ICLR 2025
(4)
Real and generated images histogram pre-calibrated threshold
(b)
Impact of incrersing dimensioealitt d the concentration of around the sphere
Concentration of measure visualization
Keal JuAD
LDNN
d-
d-2
d-16
Norm of Guassian RV
Rebative Varimnce
d-16
d21
d-128
d-1024
Empincal Mon Norms
[[[[]] Arg over 64 Sumple.
Thorecical
Single Sample
Robeive Varince 1IMI
0.2 0.4
06 04
Our Criterion
Dimensiomality
Figure 4: (a) We calibrate decision threshold based on the mean and standard deviation of 1,000 real image criteria, ensuring it's free from generated data influence. Criteria from another dataset's 's real and generated images are also displayed.
(b) As result of ||e]| ~ x-distribution, d increases, concentrates around a spherical thin shell, with radii vd. This demonstrates interchangeable use ate and Æ in high-dimensional space. (c) 2D Visualization of the Concentration of Measure: For each d, the radii and samples' are set as the d-dimensional [E|||] and var([ell) respectively. Correspondingly, the radii increases while the variance converges with d, effectively simulating the phenomenon in 2D.
which is approximately zero in Corollary 2 given by Ex-aflro
(oV ( zo) satisfies
Pog
avd Em-alpa
(o)
zb),
(18)
V log Pa (r)
see proof in the Appendix. This is yet another quantity, capturing bias towards generating To. where:
1. This summand equals zero for unbiased noise predictors.
2. If not zero, higher values occur when bo is (anti- jcorrelated with zo, indicating bias in the (negative) noise prediction towards the clean image. It is intuitive that the noise prediction steers the iteratively denoised generated image towards its inherent biases expressed by this summand.
3. In score function analysis settings. the noise predictor is approximated by an MMSE denoiser, which is unbiased, indeed leading to this summand being zero.
4.3 NUMERICAL FORMULATION AND BEST PRACTICES
Given Zo. we approximate a three-term criterion of x(zo), D(xo). , (bo. zn) via the approximations
expressed in Corrs. The implementation, illustrated in Fig. [ involves the following steps:
1) Sampling Perturbations:
We generate spherical perturbations {u² Ji=1 to produce samples
{=())== according to Eq. Equation (10). These perturbations simulate variations around #o 2) Noise predictions: Feed each perturbed sample g(() to the diffusion model choice to obtain noise
predictions ())()) of Eq. Equation 11 3) Criterion: Compute:
C(ro) = Σ
|1(T aul bh(((1) + eviroo)
-h(((9)
Va
where a, e are scalars that determine the constants 61, 02, C3- The factor Vi-a omitted, as common across terms and can be absorbed into the selection of of c.
Practical choices. We map ua, ht 2o to CLIP Radford et al. (021)) before calculating C(zo). With stable diffusion, we first decode from latent space to image space, then map to CLIP. We set a= == b = c = 1, though tuning is possible. In CLIP space, cosine similarity is used as the correct way to multiply embeddings. Dynamic range is adjusted to approximate [0, 1] by scaling with and adding (a minus sign instead of adding will work, however will flip the criteria order). For threshold calibration, recommend using real images only avoid bias, see Fig.
+
7

---

Published as a conference paper at ICLR 2025
Table I: Comparison of zero-shot detection methods across various metries. We report average AUC, AP, and Accuracy. Additionally, we include top-10 generative technique performance, where for each detection method the 10 best-performing cases are selected, and all detection methods are compared on them. Our method significantly surpasses existing methods.
RIGID
AEROBLADE Top 10 Accuracy
Ours Top 10 Accuracy
Model
AUC
AP
Accuracy
Top 10 Accuracy
RIGID
0.439
0,519
0,555
0.666
0.569
0.482
AEROBLADE
0,444
0,492
0,464
0,492
0.565
0,438
Ours
0.835
0.832
0.741
0.678
0.739
0.839
Important take-away: (2x)) approximates manifold-biaz criteria. Another surprising perspective that it measures similarity between the predictions of noise and data. Nevertheless, this is a result of our mathematical derivations and is supported hereafter by thorough evidence.
EVALUATION
In this section, we empirically validate hypothesis: Bias-driven quantities, such as stable points in the generative process can serve as robust criteria for detecting generated images.
5.1 EXPERIMENTAL SETTINGS
Datasets. Our method is evaluated on a combination from three benchmark datasets featuring diverse generative techniques: CNNSpot Wang et al. (2020) comprises real and generated images from 20 categories of the LSUN Yu et al. 2015) dataset, featuring images produced by over ten generative models, primarily GANS. The Universal Fake Detect Ojha et al. (023) dataset extends CNNSpot with generated images from newer models, primarily diffusion models. The GenImage Zhuu et al. (2023) dataset features images produced by commercial generative tools, including Midjourney. In total, our aggregated dataset consists of 100K of real images and additional 100K images produced from 20 different generation techniques Karras et al. (2017) y Zhu et al. (2017); Karras et al. (201));
Dhariwal & Nichol (2021); |Ramesh et al. Rombacc et al. (2022); Midjourney (024)). For the
complete list of generative models used in our evaluation, see Appendix
diffusion model and LLaVA Liu et al. (2023) for generating text captions required as input by this model. Criterion hyper-parameters were follows: 1) No. of spherical noises was set to 64; 2) Perturbation strength ald 1.28, determining Bo radii and 3) A small scalar 5 10-8 was added to the criterion denominator to ensure it is strictly positive. Code and datasets are detailed in Appendix C
Implementation Details. We used Stable Diffusion 1.4 Rombach et al. (2022)
5.2 EMPIRICAL CASES AND RESULTS
We compare our method against SOTA zero-shot methods. We also test it in a mixture-of-expeer (MoE), combined with leading few-shot method. Ablation and sensitivity analyses are provided.
Zero-shot Comparison Across 20 Generation Techniques. In this experiment, we benchmark our method against two leading zero-shot image detectors: AEROBLADE Ricker et al. (2024) and RIGID He et al. 2024) under zero-shot settings. AEROBLADE Ricker et al. (2024) uses the reconstruction error for a given image obtained from a pre-trained variational autoencoder as the criterion for the detection task. RIGID He et al. (2024) compares the image representation of the original image and its noise-perturbed counterpart in a pre-trained feature space and uses their similarity the detection criterion. Our implementation strictly adheres to the specifications detailed in their publications, utilizing their publicly available code. All methods used the same calibration set of 1K real images for threshold calibration and were evaluated with the test set deseribed in Sec. [5.1 covering 20 diverse generation techniques to assess generalizability. More details in Appendix F.2
Table I compares zero detection methods across key performance metrics, showing the average score among all generative techniques. Our method outperforms existing methods by a significant margin. Fig. 5 provides in-depth analysis featuring bar plots that summarize outcomes across
8

---

Published as a conference paper at ICLR 2025
GANs
Difflssin Midalls
h Commercial
ADIC Score
(a.1)
0.55
(a.2)
11.55
Tools
Wallong
VDQM
AIM
Glide
Difiusion Models
0.56
Hadporeeyy
Glde
0.38
0.37
0,40
DALLEE
Oxaded
Progen
Commercial Tools
[a.3)
Stalguuz
LDN 250
0.72
0.79
v1.4
0-46
GANS
Gaagen
Cyclegas
CRN
Sigpus
V1.
20.10
ACROBLADE
Figure 5: Zero-shot comparison. Plots a.1-a.3 demonstrate the superior AUC performance of our method across the three main generative technique groups. Error bars represent variability in AUC between techniques within each group, with our method showing the least variation. Plot b details AUC per technique, where our method achieves the highest scores in most cases. Although our criterion originates from zero-shot analysis of an LDM model, it empirically generalizes well to other techniques. Competitors show sensitivity to changes in technique, which hampers their generalization capabilities (clarified by detailed histograms the Appendix, Fig.
Generata boundary Catorlto Threned
0.875
0.850
02
0.825
Ours
0.750
86
Cocalino
0.725
cors e Commding
Caroules
86
0.700
300
1000
10000
100000
Cazzolino ct. al. & Ojha et. al. no. of training samples
Cuzzolino et. al. 2024
Figure 6: Few-shot Performance. Left performance improvement in the MoE setting with Cozzolino al. (2024a), in few-shot regime. We report results of MoE with ours vs other zero-shot methods, and the original Ojha et al.) (2023); Cozzolino et al. (2024a). Our efficacy proves to be the best. Right scatter plot of our criterion Cozzolino al. (2024a). The decision boundary was obtained in our MoE setting using SVM. Significant improvement of separability can be observed.
various groups of generative techniques, including GANs, diffusion models, and commercial tools like Midjourney and DALL-E. This is complemented by high-resolution polar plot comparing per-generative technique performance. Note: For the per-technique evaluation of Fig. S we have re-balanced the test sets per generative technique, making sure that each technique is evaluated on an equal number of real and generated images. Our method consistently outperforms AEROBLAD and RIGID across all groups and in the majority of generative techniques. Our competitors exhibit low AUC in generative techniques like Glide and CRN due to variations in their criteria across different generative techniques, see the per-technique histograms provided in the appendix, Fig. 8
Mixture of Experts with Few-shot Approaches. While zero-shot scenarios often reflect real- world situations where data is unavailable or not worth managing, some cases may justify handling small amounts of generated data for significant performance gains. Recently, Cozzolino et al. (2024a) introduced a few-shot detection method leveraging a pre-trained CLIP. They established new benchmarks for generalization to unseen techniques in data-limited scenarios, reducing data maintenance costs yet not eliminating it altogether. To prove the applicability zero-shot methods in the few-shot regime, we integrate them into mixture-of-expert (MoE) framework alongside few-shot approaches, enhancing performance while remaining in the few-shot bounds. Utilizing an extra small set of examples, trained lightweight classifier combine the outputs from

---

Published as a conference paper at ICLR 2025
Table 2: Sensitivity and ablation analyses. The table highlights the method's robustness across various configurations, including base models, number of perturbations S, spherical noise levels (radii=av d), and image corruption techniques. The results show consistent performance with slight variations. Base settings are: SD v1.4 Model, S 64, a 0.01 and without image corruption.
Exp.
Number of Perturbations (SD v1.4 Model)
Level of Spherical Noises (SD v1.4 Model)
Setting
4
8
16
32
64
o=0.01
a=0.1
a=1
AUC
0.828
0.829
0.8308
0.833
0.835
0.835
0.82
0.815
Exp.
Image Corruption Techniques (SD v1.4 Model)
Various Base Models
Setting
Without
Jpeg compression
Gaussian blur
Sd v1.4
SD v2 base
Kandinsky 2.1
AUC
0.835
0.79
0,822
0.835
0.831
0.826
zero-shot method and Cozzolino et al. (2024a), forging a hybrid approach. In all MoE experiments, additional 1K labeled samples where used to train the fight-weight classifier these where randomly selected in an additional train-test split, implemented on the dataset initially used for zero-shot testing.
For the MoE approach we choose random forest classifier. To visualize the MoE approach, employ an SVM for its smoother decision boundary see Fig. 6 While all zero-shot methods enhance performance, our method consistently outperforms others. For users willing invest in managing a small amount of data, our method serves as an easy-to-integrate plugin that enhances few-shot frameworks, offering trade-off between data availability and performance improvement.
Sensitivity and Ablation Analysis. We conducted evaluations to verify the robustness of our method across diverse configurations. This section provides key insights from these evaluations with the main results summarized in Table 2 and further details provided in the Appendix G.2 Various stable diffusion models. While our method focused on Stable Diffusion v1.4, 1.4, here we also evaluated Stable Diffusion v2 Base and Kandinsky 2.1, which differ in size and technique. Results showed consistent performance with slight AUC decreases. Various no. of perturbations S. We explore different perturbation No. to assess their impact on the detection performance. The results reveal that increasing S consistently enhances detection performance, which aligns with our research thesis. Various spherical noise levels. We varied the spherical noise levels (i.e., radii). These adjustments resulted in AUC decreases of 1.5% and 2%. Image corruption techniques. In real-world scenarios, adversaries may compression blurring to obscure traces of image generation. To address this, we evaluated our method under JPEG compression (AUC drop of 3.45%) and Gaussian blur (Kernel Size = 3, AUC drop of 1. 1.2%), demonstrating its robustness such techniques.
6 LIMITATIONS
Our derivations and the resulting quantities are induced by the learned manifold biases of the analyzed diffision model. While detection of images generated by this model is expected, interestingly, our method shows good detection of generations from other models, some from completely different generative groups (Fig. 5). This cross-model capability is a notable strength. however there is no comprehensive theory explain it. We hypothesize that different models, especially those trained on similar datasets, might exhibit similar characteristics within their probability manifolds and generated images Nalisnick al. (2018); Kornblith al. (2019). Further research is needed to substantiate this.
7 CONCLUSION
We introduced a novel zero-shot method to detect Al-generated images, capitalizing on biases inherent to the implicitly learned manifold of a pre-trained diffusion model. By combining ecore-function analysis with non-Euclidean manifold geometry, we deepen the theoretical understanding of manifold biases and use this framework to quantify differences between real and generated images. Our main hypothesis- that such bias-driven quantities can effectively detect generated content has proven viable: Evaluations confirm that our method sets a new benchmark for zero-shot methods. Furthermore, we enhance few-shot performance showing superior performance here as well. This establishes foundation for further research into diffusion-model biases and their applications.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGEMENTS
GG would like to acknowledge support by the Israel Science Foundation (Grant 1472/23) and by the Ministry of Science and Technology (Grant No. 5074/22).
REFERENCES
Jinwon An and Sungzoon Cho. Variational autoencoder based anomaly detection using reconstruction probability. Special lecture on IE, (1):1-18, 2015.
Gilles Aubert, Pierre Korprobbst and Giles Aubert. Mathematical problems in image processing:
partial differential equations and the calculus of variations, volume 147. Springer, 2006.
Quentin Bammey. Synthbuster: Towards detection of diffusion model generated images. IEEE Open
Journal of Signal Processing, 2023.
Samah S Baraheem and Tam V Nguyen, Ai vs. ai: Can ai detect ai ai-generated images? Journal of Imaging, 9(10):199 2023.
Jordan J Bird and Ahmad Lotfi Cifake: Image classification and explainable identification of ai-generated synthetic images. IEEE Access, 2024.
Kalina Bontcheva, Symeon Papadopoulous, Filareti Tsalakanidou, Riccardo Gallotti, Noémie Krack, Denis Teyssou, Agent France-Presse, Luca Cuccovillo, and Luisa Verdoliva. Generative ai and disinformation: Recent advances, challenges, and opportunities. European Digital Media Observatory, 2024.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. arXiv preprint arXiv:/809) 1096, 2018.
Jonathan Brokman and Guy Gilboa. Nonlinear spectral processing of shapes via coo-hhomogeeeuss flows. In International Conference on Scale Space and Variational Methods in Computer Vision, pp. 40-51. Springer, 2021.
Jonathan Brokman, Martin Burger, and Guy Gilboa. Spectral total-variation processing of theory and applications. ACM Transactions on Graphics, 43(2):1-20, 2024.
Jonathan Brokman, Amit Giloni, Omer Hofman, Roman Vainshtein, Hisashi Kojima, and Guy Gilboa.
Identifying memorization of diffusion models through p-laplace analysis. arXiv preprini, accepted for the 10th International Conference on Scale Space and Variational Methods in Computer Vision. 2.Xx::2505.08246. 2025.
Chen Chen, Qifeng Chen, Jia Xu, and Vladlen Koltun. Learning to see in the dark. Proceedings of the IEEE conference computer vision and pattern recognition, pp. 3291-3300, 2018.
Jiaxuan Chen, Jieteng Yao, and Li Niu. single simple patch is all you need for ai ai-generated image detection. arXiv preprint arXiv:2402.011 123, 2024.
Qifeng Chen and Vladlen Koltun. Photographic image synthesis with cascaded refinement networks. In Proceedings of the IEEE international conference on computer vision, pp. 1511-1520, 2017.
Yunjey Choi, Minje Choi, Munyoung Kim, Jung-Woo Ha, Sunghun Kim, and Jaegul Choo. Star- gan: Unified generative adversarial networks for multi-domain image-to-image translation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 8789-8797, 2018.
Dario Cioni, Christos Tzelepis, Lorenzo Seidenari, and Ioannis Patras. Are clip features all you need for universal synthetic image origin attribution? arXiv preprint arXiv:2408.09) 00153,,,00 2024.
Davide Cozzolino, Giovanni Poggi. Riccardo Corvi, Matthias Nießner, and Luisa Verdoliva. Raising the bar ai- ai-generated image detection with clip. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4356 2024a.
11

---

Published as a conference paper at ICLR 2025
Davide Cozzolino, Giovanni Poggi, Matthias Nießner, and Luisa Verdoliva. Zero-shot detection of ai ti-generated images. In European Conference on Computer Vision, pp. 54-72. Springer, 2024b.
Tao Dai, Jianrui Cai, Yongbing Zhang, Shu-Tao Xia, and Lei Zhang. Second- attention network for single image super-resolution. Proceedings of the IEEE/CVF conference on computer vision and patlern recognition, pp. 1065-11074, 2019.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780-8798 2021.
David C. Epstein, Ishan Jain, Oliver Wang, and Richard Zhang. Online detection of ai- ai-generated images. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops, pp. 382-392, October 2023.
Apostolos A Giannopoulos and Vitali D Milman. Concentration property on probability spaces. Technical report, SCAN-0005095, 2000.
Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to- image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 10766, 2022.
Zhiyuan He, Pin-Yu Chen, and Tsung- Yi Ho. Rigid: A training-free and model-agnostic framework for robust ai-generated image detection. arXiv preprint arXiv:2405.20112, 2024.
Kiyosi Ito, Kiyosi Itô, Kiyosi Itō, Japon Mathématicien, Kiyosi Itō, and Japan Mathematician. On stochastic differential equations, volume 4. American Mathematical Society New York, 1951.
Zahra Kadkhodaic and Eero Simoncelli. Stochastic solutions for linear inverse problems using the prior implicit in a denoiser. Advances in Neural Information Processing Systems, 14:12242-13254, 2021.
Zahra Kadkhodaie, Florentin Guth, Eero P Simoncelli, and Stéphane Mallat. Generalization in diffu- sion models arises from geometry-adaptive harmonic representations, In The Twelfth International Conference on Learning Representations, 2024. URL
net nww./oruutttt
Id=ANvm/S22r0
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint 1rXiv: 2017.
Tero Karras, Samuli Laine, and Timo Aila. style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 4401-4410, 2019.
Kimmel, Sochen, and Malladi. From high energy physics to low level vision. In International Conference on Scale-Space Theories in Computer Vision, pp. 236-247. Springer, 1997.
Simon Korbblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. network representations revisited. In International conference machine learning, pp. 3519-3529. PMLR, 2019.
Similarity of neural
Beatrice Laurent and Pascal Massart. Adaptive estimation of quadratic functional by model selection. Annals of statistics, pp. 1302-1338, 2000.
Ke Li, Tianhao Zhang, and Jitendra Malik. Diverse image synthesis from semantic layouts via conditional imle. 2019 ieee. In CVF International Conference on Computer Vision (ICCV), pp- 4219 4228, 2019.
Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. Improved baselines with visual instruction tuning. arXiv preprint arXiv:2310.03744, 2023.
Fernando Martin Rodriguuz Rocio Garcia-Mojos and Monica Fernandez- Barciila.. Detection of ai-created images using pixel-wise feature extraction and convolutional neural networks. Sensors, 23(22):9037, 2023.
12

---

Published as a conference paper at ICLR 2025
Midjourney. Midjourney: An independent research lab exploring new mediums of thought. https
www..iidjourney.......o.o com/ 2024. Accessed: 2024-05-18.
MindSpore. Wukong: A pre-trained model for chinese text-to- tomeeagemeeaaaaa generation. https://xtt /iie
mindspore wwt wokogoogg//ooooooooooooooooooooo 2024. Accessed: 2024-05-18.
Eric Mitchell, Yoonho Lee. Alexander Khazatsky, Christopher D Manning. and Chelsea Finn. generated text detection using probability curvature. In International Conference on Machine Learning, pp. 24950-24962. PMLR, 2023.
Detectgpt: Zero-shot machine machine-generated
Koichi Miyasawa et al. An empirical bayes estimator of the mean of normal population. Bull. Inst. Internat. Statist, 38(181-188):1- 1961.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know? arXiv preprint arXiv:1810.09136, 2018.
Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint ar 12. 10741, 2021.
Utkarsh Ojha, Yuheng Li, and Yong Jac Lee. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2023.
Taesung Park, Ming-Yu Yu Liu, Ting-Chun Wang, and Jun-Yan Zhu. Semantic image synthesis with spatially-adaptiv normalization. In Proceedings the and pattern recognition, pp. 2337-2346, 2019.
the IEEF/CVF conference on computer vision
Pedregosa, G. Varoquaux, A. Gramfort, Michel, B. Thirion, O. Grisel, M. Blondel, Pretten- hofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825 12:2825-2830, 2011.
Tong Qiao, Hang Shao. Shichuang Xie, and Ran Shi. Unsupervised generative fake image detector. IEEE Transactions on Circuits and Systems for Video Technology, 2024.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748-8763. PMLR, 2021.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International conference on machine learning, pp. 8821-8831. Pmlr, 2021.
Jonas Ricker, Denis Lukovnikov, and Asja Fischer. Aeroblade: Training- friii detection of latent diffu- sion images using autoencoder reconstruction error. In I Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9130-9140, 2024.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias NieBner. Faceforensics+4: Learning to detect manipulated facial images. In Proceedings of the IEEE/CVF international conference computer vision, pp. 1-11, 2019.
Zeyang Sha, Zheng Li, Ning Yu, and Yang Zhang. De-fake: Detection and attribution of fake images generated by text-to-image generation models. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 3418 -432,, 2023.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems, 32, 2019.
13

---

Published as a conference paper at ICLR 2025
Yang Song and Stefano Ermon. Improved techniques for training score- score-based generative models. Advances in neural information processing systems, 33:12438 12448, 2020.
Chuangchuang Tan, Ping Liu, RenShuai Tao, Huan Liu, Yao Zhao, Baoyuan Wu, and Yunchao Wei. Pata-independent operator: training-free artifact representation extractor for generalizable deepfake detection. arXiv preprint ar (Xix:2403.0680) 2024.
Sheng- Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei Efros. Con-generated images surprisingly casy to spot... for now. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 8695-8704, 2020.
Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion -enneiiongeeerated image detection. Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 22445-22455, 2023.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint wro.iv::506.3330 2015.
Mingxu Zhang, Hongxia Wang, Peisong He, Asad Malik, and Hanqing Liu. Exposing unseen gan-generated image using unsupervised domain adaptation. Knowledge-Bon Based Systems, 257: 109905, 2022a.
Mingxu Zhang, Hongxia Wang, Peisong He, Asad Malik, and Hanqing Liu, Improving gan-generated image detection generalization using unsupervised domain adaptation. In 2022 IEEE International Conference on Multimedia and Expo (ICME), pp. 1-6. IEEE, 2022b.
Nan Zhong, Yiran Xu, Zhenxing Qian, and Xinpeng Zhang. Rich and poor texture contrast: A simple yet effective approach for ai-generated image detection. arXiv preprint arXiv:2311.12397 2023.
Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. Proceedings of the IEEE international conference computer vision, pp. 2223-2233 2017.
Mingjian Zhu, Hanting Chen, Qiangyu YAN, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: A million-scale benchmark for detecting ai di-generated image. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances Neural Information Processing Systems, volume 36, pp. 77771-77782. Curran Associates, Inc., 2023. URL http::::///. / (0000021110111000
files/
and Bnd_Benchmarks.pe
APPENDIX
In this Appendix, we provide additional information relevant to proofs, experimental settings, and experimental results. This document presented as follows:
Reproducibility and Code - links to our code project and dataset, as well as additional
details regarding the implementation of our zero-shot method in our evaluation procedure.
Full Proofs detailed steps and justifications of our theoretical findings, which further support the claims presented in the main paper.
Experimental Settings Additional Information description regarding our used dataset and implementations.
Experimental Results Additional Information - An extended analysis of the experimental results from the main manuscript.
14

---

Published as a conference paper at ICLR 2025
A EXPERIMENTAL DETAILS FOR ERROR ANALYSIS EXPERIMENTS
In this appendix, we provide the full experimental details to re-produce Fig. 3 b-d) for estimating the curvature criterion x using spherical boundary samples. An extended version is available in Fig. [1 The experiments are designed to validate the approximation of through averaging over the sphere, leveraging the Gauss Divergence Theorem. The results demonstrate the effectiveness of our method in distinguishing between local maxima and saddle points of a differentiable analytic function.
We define two-dimensional differentiable analytic function f : RR² IR, inspired by MATLAB's peaks function, which exhibits multiple peaks and valleys. The function is given by:
1 f(x,y) C 3(1 2 =² (v+1)²
I
x²
56)
(x+1)²-
where C' is a normalization constant ensuring that the integral of f over the domain is 1. Values of f below a threshold (e.g.. x 10 10-5) are set to zero maintain non-negativity.
We select two circles centered at specific points to evaluate The first circle is centered at local maximum (1.2, 0.8), and the second is centered saddle point (-0.475, -0.7). Both circles have a radius of R 0.5. These points represent distinct features of the function f. allowing us to assess to curvature differences.
sensitivity
For each circle, the true value of x. is computed using the volume integral of Equation ( denote the circle of radius R centered Numerical integration performed by summing over the grid points inside each circle.
Let (n(c)
We approximate x using discrete samples along the boundary of each circle, discretizing Equa- tion (3)). The number of boundary samples Nhoundary is varied as 2, 4, 8, 16, 32, 64, 128, 256. To reduce sampling bias, random angular offset is introduced to the uniformly spaced boundary points in each run.
Boundary points are computed as:
(x,, Uk) = (Zeenter + R cos 0,, Veenter + R sin 0,),
where 0, are the sampled angles. Gradients are interpolated these boundary points, and the normalized gradient components are used to compute the dot product with the inward-pointing normal vector:
2; Feenter
nin
R
y: Vcenter
Vf
a Ox
O Oy
M
Din
+
Ny.
The approximate x is then computed as:
Naunsaayy
R
Ki Kapprox
|
nim
As
As
N
boundary
For each Nboundary, 100 independent runs performed compute the mean and standard deviation of Rapprox. Error bars represent the standard deviation.
The results validate the approximation, showing that the mean of Rapprox aligns with the true demonstrating unbiasedness. The variance of Kapprox decreases as Nhoundary increases, indicating improved accuracy with more samples. Even with low Nboundary the estimated values for the local maximum and saddle point are distinctly separated within error margins, supporting the reliability of the method.
B EXPERIMENTAL DETALS FOR THE LOCAL PROBABILITY MAXIMA PROPERTY VERIFICATION.
In this section, we present a the experimental details of Fig. 3 (a) to illustrate how generated samples from diffusion model tend converge stable local maxima the learned probability manifold.
15

---

Published as a conference paper at ICLR 2025
The learned manifold is approximated using Kemel Density Estimation (KDE) of the generated samples. Statistics at scale are provided below, Fig. 7
We constructed synthetic dataset by sampling from Gaussian Mixture Model (GMM) in covariances
{
(-B)
2D with the following parameters:
means
{(or 0.1 D
0.1 0.1).... ( 0 o
..).. 0.1
} and weights
0.1
For the training set we 3 3
produce 1000 training data points from the defined GMM.
We trained diffusion model this dataset to learn the underlying data distribution. The key components of the training process we used: T 100 diffusion steps and define linear noise schedule with 3, linearly spaced between 1 x 10-4 and 0.02. The denoising model is a simple neural network consisting fully connected layers with ReLU activation. Standard diffusion model training is done for Nlppochs 1000 epochs, were a simple MSE loss between predicted and true noise is used.
We use the trained diffusion model to generate Negen_sampies 1000 new samples. For random subset of Puaaectories = 5 samples, we record their trajectories during the reverse diffusion process to analyze their paths towards convergence. Furthermore, approximate the learned probability manifold, apply Kernel Density Estimation (KDE) on the generated samples. Fig. (a) it is indeed observed that the generation trajectories terminate at local maximas
lermination
(p-value: 1.528e-3/)
Observed Reach 0.84
nese an, 0,9e)
Beotstrapped
125
Fraqucncy
100
75
50
23
0.58
1.00
Fraction of Terminations Near Maxima
Figure 7: Termination Analysis of Diffusion Trajectories Near Local Maxima. The plot shows the fraction of 100 diffusion trajectories terminating near one of the maxima of the Gaussian mixture model (GMM). A trajectory is considered terminate within a Mahalanobis distance of 2.45 from any of the GMM component means, corresponding to approximately 95% of the mass of 2D Gaussian. The red dashed line represents the observed termination-neat wewtoon--nar--aaaaaaa maxima fraction (0.94), while the black dashed lines indicate the 95% confidence interval (0.89 0.98), derived via bootstrapping. In the bootstrapping process, the termination data (binary values indicating whether each of the 100 trajectories terminates near maximum) was resampled with replacement 1,000 times to compute the distribution of termination fractions. The histogram and KDE curve illustrate this bootstrapped distribution. The p-value from binomial test (p 1.528 10 10-37) confirms that the observed termination fraction significantly deviates from random chance, supporting strong convergence of trajectories toward maxima.
local maximum if its final point lies
C REPRODUCIBILITY AND CODE
To ensure reproducibility, we provide our code and a detailed description of our computational environment.
16

---

Published as a conference paper at ICLR 2025
Code. The implementation of our zero-shot detection method, as well as the train and test sets available at the following link: https:: /ttns////inuu...... zeroshot imp.emmmtaaaiiii reproduce our results follow the readme file. Hardware and Programs. All of the experiments were conducted on the Ubuntu 20.04 Linux operating system, equipped with a Standard NC48ads A 100 v4 configuration, featuring 4 virtual GPUs and 440 GB of memory. The experimental code base was developed in Python 3.8.2, utilizing PyTorch 2.1.2 and the NumPy 1.26.3 package for computational tasks.
To
D MATHEMATICAL FULL PROOFS
Claim 1. Given vo, consider Equation 10 for which samples - (r drawn uniformly from
the sphere 0oo and each is drawn with corresponding ud(x) 2- aan V-ogpa(-) obtain
Then we can use
Va
Po (x)
-g V (x))(] ud(x) + log = k(xo) D(xo).
(19)
This provides characterization of zn as a stable maximal point under the backward diffusion process, Equation (6). quantifying both gradient magnitude (should be low) and curvature (should be high) aspects.
Proof. Let us begin with the curvature term. By Gauss divergence Thm. we have
V VlogPo(2) dx
V (o)
-|Bola(ro)
(20)
V log Pa (2)
aBo lag)a(())l
Bo
where are the outward-pointing normals to the sphere 0Bg. By construction we have á Vx E 0Bo thus
-T-arg- -a
ma(x)
Po (x)
A)dx 1
log Po
Ua da(x))dd..
(21)
V log Pa
Vd JaB.
V Po (x)ll2
OB
Using the properties of o, No. which is uniformly distributed on dBg we have
aB, V log Pa (x) ua(x))dr= |@Bol
Pogga (x)
Pog (x)
Egwid
log Pa (z) ua(x)),
(22)
Vd
Vd
where [BB]] denotes the volume of 3Bg Tracing this back (Equation (0 we have
10B
Po Pa
<(zo) =
E mo
ua(x)).
(23)
Vd Bol
V log Pa (x)ll2
Finally, we use the known formula for the ratio between d-dimensional ball's volume and its boundary-sphere volume plugging radii v as follows
²B, d radii
Vd,
Ba
resulting with |8B.1 vd Bpl
1. Thus
10
log Pa (x)
<(zp) =
E pn
ua(x)).
(24)
VdlBo
log Pa (z)ll2
Let us now analyze the gradient term. We similarly use properties of the uniform distribution T lagg and get
1
D(ro)=
V log Pa (z))lade E (no V log (x)
(25)
J8no
The notation of as function of ir, i.c. ua(x), expresses the fact that they are constructed using the same noise. We use this under the integration sign when expressing explicitly expectations, where it is crucial to decide variable integrate upon
17

---

Published as a conference paper at ICLR 2025
For convenience, let plug
V (a))ll2
aal lo Pa
V log Pa
V log (x))) and get
VlogPa (x)
D(zo) = (
V (l))
(26)
v log Pax (z)]12
Finally, by linearity
V logPo (x)
E go ino
V log Pa ud(()) Vlogpa k((r)) D(vo).
(27)
Corollary 2. In the setting of claim
we furthermore have the following approximation
v (z)
vI-a
1
-Epoat Jato
fo) - (xx)).
(28)
V P
Proof. By the score-function approximation Equation and due and ud being ap- proximately interchangeable in our high- -igeddimensional setting, we have vI ado = I + h(Ø) R
-I- - azo + Vaus + alogpa(T). Thus
log Pa (z)
log Pa
VI aEraal logpo (x)]|2
20) = Exuiizo
VI azoo log Pa
V log (x))22
(29)
Notice that
V log (x)
V Pa
v1 - (Kto)) = (Epwaluo
.1 - a 2 0, (30)
log (x)
V log (z)
since integration of normals over the sphere zero, and V log (x) approximates the uniform spherical noise. Thus by linearity of the expectation
V logga((1) v1 azo ta
V log
Epwa {
Ex
V log Pa (x)
V log Pa
(31)
Tracing back to Equation
29 and dividing by we get
log Pa .u)) E
V Pa) =a((x) + V Pa
E Eg
Pa (z)
V l
va
(32)
Finally, similarly Equation
27 and by linearity of the expectation, get
V Po
1
Ez
.0)
- D(zo).
(33)
a
V Po
Va
Corollary 3. Let by represent the bias of predictor bn in the statistical sense, defined as bo = Ji Euweelz (fo). Transitioning from score-function back the denoising perspective of diffusion models, the zeroized summand of Corollary given by E back to:
v log (x)
20)) can be traced
(og V
E Eg za
avd (bo, v1 -azo),
(34)
log Pa (x)))l222))))
which is yet another quantity that captures bias towards generating To. where:
This summand is effectively zeroized for unbiased noise predictors.
If not zeroized, higher values occur when is (anti-)correll Jcorrelated with Tu. indicating a bias in the (minus) noise prediction towards the clean image. Since diffusson models denoise pure noise it is intuitive that the noise prediction steers the resulting generated image towards its inherent biases is captured by this summand.
18

---

Published as a conference paper at ICLR 2025
3. In score function analysis settings. the noise predictor is approximated by MMSE denoiser, which is assumed to unbiased, indeed leading to the zeroizing of this summand.
Proof.
V log Pa
1 x v1 - a.to, No)
-Egvi/20
Pa -1/
Egwi/ea
d v1 0:00 ||
(z v1 a x0)
Exvālea
Vad
1
(Eenelao (V1 axo + ud - v1 - atto,
Vd
1
(VI azo Exreilzo (ud) v1 a. ap (8p), 20)
avd
v1 a
(Du + Exgnt ano (oo), mo)
avd
-1-a. a
(00
Enwaflar (fo),
avd -1-a a
(bu. v7)
avd
First transition follows Equation (4) Equation ( and plugs Equation (1O.. The second transition the noise estimation perspective, where ang perturbation predictions should have approximately avd norm.
The other transitions use linearity of the expectation, and the zero mean of the spherical noise uaa
APPROXIMATION DISCUSSION
Reminder:
1
D(ro)= |rBol JaB
V log Pa (2)
E /ro
V Vlogpa
(35)
x(xo) 10Bol
log (a(x))).
E 120
(36)
Bol
V log Pa (x)||2²
1 (V1 a.E [xo
Vlogpa = a
8) a
af,, 8) h)#),
(37)
C(zo): = v1 - a
-h(
|1h(600]12 20) - -Dxo))
EXPERIMENTAL SETTINGS ADDITIONAL INFORMATION
F.1 DATASETS
As mention in the main manuscript, the evaluation of our proposed method incorporates three benchmark datasets, namely, CNNSpot Wang et al. (2020). Universal Fake Detect Ojha et al. (2023) and GenImage Zhu et al. (2023) datasets. In our evaluation,
extracted subset from each dataset, containing real images and fake images generated from the following generative models: ProGAN
Karras al. 2017). StyleGAN Karreaaaaarrass et al. (209)), BigGAN Brock al. 2018), Park et al.
19

---

Published as a conference paper at ICLR 2025
(019)) CycleGAN Zhu et al. (2017), StarGAN Choi et al. (2018). Cascaded Refinement Networks
(CRN) Chen & Koltun (0177) ). Implicit Maximum Likelihood Estimation (IMLE) Li et al. (2019).
SAN SANDai et al. (2019), sccing- dark Chen et al. 2018). deepfake Rossler et al. (2019), Midjourney
Midjourney (202)). Stable Diffusion V1.4 Rombach et al. al.] (2022), Stable Diffusion V1.5 Rombach
al. (2022), ADM [Dhariwal & Nichol (202T), Wukong MindSpore (2024) VQDM Gu et al. (2022).
LDM Rombach et al. (2022) and Glide Nichol et (2021). In Figure 5 in the main manuscript, we divided our dataset into three groups: images generated by GANs (produces by ProGAN, StyleGAN, StyleGan2, BigGAN, GauGAN, CycleGAN, and CRN models), diffusion models(produces by LDM, Glide, Stable Diffusion V1.4, Stable Diffusion V1.5 and Guided diffusion models), and commercial tools (produces by Midjourney. Wukong, VQDM and DALL-E tools). Additionally, for the real images we used the LSUN, MSCOCO, ImageNet and LAION datasets.
To construct the calibration set for the zero-shot methods, we extracted 1,000 real samples from the datasets. For the test set, we selected 200,000 samples, ensuring a representative volume from each generation technique.
F.2 METHODS FOR COMPARISON
We benchmarked our method against two recent and leading image detection zero-shot methods Ricker et al.] (2024); He et al. (2024). These state-of-the-arr methods are designed to enhance generalization by detecting generated images in zero-shot settings. The implementations closely follow the specifications outlined in their respective publications. Specifically, we applied Ricker et al. (2024) directly by employing the code provided in their published paper, selecting the parameters leading to the highest performance according to their report (such as using the Kandinsky 2.1 model with the LPIPS similarity metric). Since He et al. (2024) was not available at the time of paper submission, we carefully reconstructed their implementation based on the details they provided, applying identical parameters, such as applying the DINO model with perturbation noise level of 0.05 and threshold value of 95%.
In the mixture-of of expert (MoE) experiment we utilized two additional leading image detection methods Cozzolino et al. (2024a); Ojha et al. (2023). These few-shot and semi-supervised methods are designed to enhance generalization in detecting images created by unseen generative techniques. The implementations closely follow the specifications outlined in their respective publications. Specifically, the detection models are trained on images generated by a single model (ProGAN Karras al. (2017) from the CNNSpot WWan al. (2020) dataset) and tested on images from various other models. In implementing both methods, we initially employed the CLIP embedder war---ittlar-ppateeee
Radford et al. (2021) using the open-source
model. For ForOjja et al. (2023), we utilized a KNN model with k = 9 and cosine similarity, as this configuration was reported to achieve the best results in their paper. For Cozzolino et al. (2024a), we employed a standard SVM model [Pedregosa et al. (201T). Training of both methods was conducted with 10 different seeds (1, 5, 9, 16, 17, 24, 43, 54, 59, 65), and the final detection results were averaged to ensure robustness.
G EXPERIMENTAL RESULTS ADDITIONAL INFORMATION
G.1 COMPLEMENTARY RESULTS
In Fig. S statistics are gathered from all zero-shot methods to shed light on the variability of the different criteria (ours, RIGID, and AEROBLADE) across generative techniques. The competitors exhibit high variability, demonstrating their lack of generalizability. In the main text, under in some cases the competitors have surprisingly low AUCs This is due to their criteria being overly sensitive as shown in the attached histograms. While in some techniques generated images obtain higher criteria values compared to real ones (e.g.. Wukong), others (e.g.. Glide 50) demonstrate a reverse trend. This makes the setting of global threshold, such as the proposed 95% percentile of real images in RIGID, ineffective in some generative techniques it became reducing their overall AUC. While incorporating information about the specific generative technique could improve their performance, it would compromise real-world practicality, and violate the standard testing for generalization to unseen techniques.
20

---

Published as a conference paper at ICLR 2025
Ours
RIGID
AEROBLADE
RIGID, all
AEROBLADE, all
10000
3000
4000
3000
2000
2000
2020
2009
677
0.0
0.9
0.06
0.00
gauggnn
RIGID, gaugan
AEROBLADE, gaugan
170
80-
100
10
200
150
100
50
10-
0.4
0.8
0.0
1.0
8.75
0.80
0.05
0.50
0.90
3.00
0.02
0.04
0.06
RIGID, glide 50
AEROBLADE, glide 50
100
75
50
25
0.4
0.5
0.8
1.0
0.70
0.75
0:00
0.85
0350
0.5
1.00
0.00
0.02
5.04
0.06
wukong
RIGID, wukong
AEROBLADE, wukang
400
125
8:00
030
15
100
230
0.4
0.6
0.8
1.0
0.60
0.25
0.50
0.50
1.00
0.00
0,02
0.04
0.05
Figure 8: Histograms of the criterion proposed by method and the competitors, for all the data as well as per-generative-techiig between real (blue) and generated (red, "fake") images, their inconsistent behavior-whers the real histograms are sometimes below and sometimes above the fake -peeennss setting a reliable global threshold. This inconsistency makes them less suitable for the task of generalization to unseen techniques, where we assume that the tested technique is unknown. For instance, RIGID's incosistency between Wukong and glide 50 observed here, translates in the polar-plot of Fig. ()b) to good AUC for Wukong, but almost opposite (close to zero) AUC for Glide 50. In contrast, our method exhibits consistent behavior across generative techniques, which is hallmark of good cross-technique generalization.
cases. While some cases the competitors exhibit high separability
21

---

used: decision Published as a conference paper at ICLR 2025
Decision MOE
0.875
0.075
0.050
0.825
0.825
Accuracy
0.800
0.800
0.775
0.750
Oyha et.
Cozzolina
Ojha et.
ours Cozzolino et.
ours Cozzolino
AEROBLADE Cozzolnoo
AFRORI AnP Coorainoo
0.700
1000
10000
Ojha training samples
Cozzolioo et. and Ojha et.al. no. training samples
Logistic Regression MOE
0.875
0.00
0.82
Accursty
Acouracy
0.78
0.775
0.750
Cozzolino ct.
Cozzolno et. al
Ojha et.
0.74
Otha et.
Cozzolnoo
Cazzolino
0.725
AEROBLADE
AEROBLADE
RIGID Cozzolino et.
RIGID Cozzolino et.
0.700
0.70
100
10000 Cozzolino et. al. and Ujha et.al. no. training samples
1000
100000
100
10000 cozzolino et. al. and Githa et.ll. no. training samples
1000
100000
Figure 9: Few-shot MoE. Results of our MoE experiment using different classification algorithms. All combinations outperform Cozzolino significantly. Our method's efficacy proves to be the best.
G.2 SENSITIVITY AND ABLATION ANALYSIS ADDITIONAL INFORMATION
Various stable diffusion models. Our approach exploits the implicitly learned probability manifold of diffusion models to distinguish Al-generated images. While we demonstrated the robustness of our methodology using the Stable Diffusion v1.4 model, it is critical to verify that our results are not unduly influenced by specific characteristics of the used model. Consequently, we broadened assessment scope to include newer models such as Stable Diffusion v2 Base and Kandinsky 2.1, noting these versions exhibit variations architecture scale and generative algorithms. The methodology deployed in these expanded evaluations the (described in Sec. [.1 of our manuscript), maintaining consistency in the calibration and test sets employed. This consistent experimental framework ensures that any observed performance variations are attributable solely to the model differences rather than experimental conditions. Preliminary findings indicate modest performance decrement of approximately 2% with both Stable Diffusion v2 Base and Kandinsky 2.1, suggesting slight variances in generative fidelity and stability across model versions.
our original experiments
Various classification algorithms for MoE settings. In the main manuscript, we present the results of our MoE experiment when using random forest algorithm to combine results of the methods used in the MoE. Fig. presents the results when different classification algorithms tree, cupport-vector-ie machine (SVM), K-nearest- nniirbst (KNN), and logistic regression. All models set using the default parameters of the scikit-leam Python library. As can be seen in Fig. 9 our method's efficacy proves to be the best regardless of the algorithm used.
Various of perturbations S. One of the hyperparameters of our method is the volume of perturbations. In this experiment, we explore different perturbation sizes to assess their impact on the detection performance. For consistency, we maintained the same experiment methodologies
22

---

Published as a conference paper at ICLR 2025
YDOM
ADM
Glide
Pertabetion Streegt 501
Wallong
Glde 103 27
Ferturtactios
Wilking
Pestatetiia Streegts
Det Ietatteion Streegha 9.1
Midjorrnyy
Ferturfactares
Gldde 30
16 Pertaraations
DALLIE
Grdddd
64 Perturaaionn
32 Perturbations
TAIC
Grioo
Progin
Strlepaz2
Slybean
5D V1A
Geogsn
Qyllegee
Riggse
Oydogas
Rigen
Figure 10: AUC Using Varying Hyper-parameter Values, across Different Generation Tech- niques: The hyper-parameters sensitivity analysis, summarized in Table detailed per-model. Left: The number of perturbations (s) shows minimal impact on performance. Right: Varying perturbation strengths (a)). Interestingly, performance is affected differently across models.
as described in Sec. of our manuscript, focusing solely on variations in perturbation size. We tested perturbation sizes of 4, 8, 16, 32, and 64, as implemented in our method. The corresponding average AUC detection results were 0.828, 0.829, 0.830, 0.833, and 0.835 respectively. The results reveal clear trend: increasing S consistently enhances detection performance, which aligns with research thesis. These findings reveal a clear trend: as the number of perturbations S iincreases, so does the detection performance. This progression supports our research theory since higher volume of perturbations provide better approximations of the numerical quantities.
Various spherical noise levels. Another hyperparameter in method involves the levels of spherical noise, specifically the radii. In this experiment, we systematically adjusted the noise by reducing the radii, first by a factor of 10 and subsequently by a factor of 100. Additionally, scaled down the test set to 16, 000 images for this scall-scale study, though the variety of generative techniques assessed remained constant. These modifications led performance decreases of 1.5% and 2%, respectively. These results help us understand the impact of noise adjustments on the robustness of our detection capabilities.
Robustness to JPEG. In real-world scenarios, images are frequently compressed to JPEG format for easier storage and transmission. assess our method's practicality, we evaluated its performance on both real and generated JPEG-compressed images. For this small-scale study, reduced the test set to 16,000 images, while maintaining the same variety generative techniques. The results indicated modest decrease in accuracy of 3, 3,45%, demonstrating minimal impact the method's 's detection effectiveness
G.3 RUN-TIME ANALYSIS
We performed runtime analysis to evaluate the computational efficiency of our method compared to existing approaches. Using single A100 GPU, we could process in parallel batch of 4 samples using 16 perturbations, and observed a runtime of 2.1 seconds per sample. Importantly, this implies 64-perturbation setup can be fully parallelized on a single A100 GPU with batches of 1. For comparison, our primary competitor, AEROBLADE, on the same A100 GPU requires 5.4 seconds per sample, making our method significantly more computationally efficient terms of runtime. We do note AEROBLADE: official implementation at the time of the experiment was not compatible with batch parallel processing thus we believe it could be sped up.
G.4 DETAILED ZERO-SHOT COMPARISON
Tables 3 shows the entire zero-shot comparison for each detection method, over each detection technique using the accuracy, area-under-the-curee (AUC) and average precision (AP) metrics.
23

---

Published as a conference paper at ICLR 2025
Table 3: Performance metrics across different models and methods
Model
Accuracy
AUC
RIGID
AEROBLADE
Ours
RIGID
AEROBLADE
RIGID
AEROBLADE
ADM
0.5144
0.5065
0.5727
0.5715
0.5079
0.6811
0.5635
0.5701
0.6541
BigCian
0.5298
01,8311
0.7756
0.5300
0.5932
0.8575
0,5400
0.61322
0.8680
CRN
0,5000
0,3065
0.7302
0.0945
0.1875
0.8637
0,3202
0.3411
CycleGan
0.4640
0.5611
0.7342
0.3760
0,5911
0,9013
0,4119
0.5617
0,9052
DALL-E
0.5071
11,4016
0.7772
0.4951
0,3852
0.8660
0,5152
0.4104
0.8810
GauGan
0,4804
0,5759
0.8794
0.31811
0.6212
0.9770
0.3924
0.6315
0,9792
Glide 100 10
0.4591
1124439
0.8831
0.0484
0,0588
0.9534
0.3120
0.3142
0. 0,9588
Glide 100 27
0.4594
0,3026
0.8713
0.0662
0,10
0.9462
0,3139
0.3252
0.9533
Glide
0,4591
0,3000
0,8843
0.0471
0.0754
0,9588
0,3114
0.3159
0,9625
Guided
0,4803
0,5421
0.7390
0.3513
0.5590
0.8540
0.4135
0.5883
0.8594
IMLE
0,5000
0,3316
0.7311
0.0502
0.2310
0.8699
0,3128
0.3524
0.8763
LDM
0.4685
0.4295
0.8232
0.3241
0.4489
0.8781
0,3890
0,4423
0,9096
LDM 200
0,4669
0,4353
0.8268
0.3284
0,4587
0,8758
0.3923
0,4449
0,9081
Midjoumey
0,9407
0.4020
0.5545
0,9890
0,3808
0.6278
0.9906
0.4057
0.6086
SAN
0,3485
0.6000
0.3516
0,3985
SD v1.4
0.8696
0.5264
0.6196
0.9555
0.5747
0.7818
0.9535
0.5403
0.7230
SD v1.5
0,8718
0,5512
0.6300
0,9543
0.6027
0.7955
0.9514
0.5764
0.7339
Stylegan
0,5335
0,6081
0.7045
0.5932
0.6496
0.7225
0.7649
Stylegan2
0.4705
0.6467
0.6422
0,4641
0.7125
0.7100
0145665
0.6836
0.7275
ProGan
0.4769
0,5306
0,9032
0.3216
0,5493
0.9689
0.3935
0.5450
0,9738
VDQM
0,5282
0.7686
0.4852
0.5486
0.8744
Wukong 0.8777
0.5135
0.6539
0.9471
0,5502
0.7935
0,9552
0.5249
0,7662
Average 0.5557
0.4648
0,7411
0.4392
0,4448
0.8350
0.5194
0.4925
0.8330
H LOCAL MAXIMA PREVIOUS OBSERVATIONS
In Fig. 12
we provide excerpts of other works that include relevant observations regarding the tendency to learn distributions with local maximas.
24

---

Published as a conference paper at ICLR 2025
Histograms of Estimates, No. Boundary Samples
104TS, AT1
frequency
Exlimwieed
Convergence Estimates All Circles
T maccgrrcee Crcee
chole
Croee
The diclee
Estimated K
Delmeer
Eatimates Crcle
sotimee cince
Number of Boundary Samples
Log-Log Std of k Estimates
10a
Rog
Standard Deviation of
10"1
Beg (slppen 1.337 CRc
Dog 2.35
10-1
10-3
256
Number Boundary Samples
Figure 11: The same experiment in Fig- 3 b-d), but with all 5 interest points and their corresponding neighborhoods. The circle colors are consistent across all subplots and associated measurements. We still get consistent estimator of к. We also still get good separability between local maximas and saddle points even upon low sample sizes, as shown in the second row, and in more detail in the histograms (top right): These further demonstrate that saddle points (colored red and orange) are distinguishable from local maxima (colored green, blue, and black), despite errors induced by low number of boundary samples s In other words good robustness to the hyper- aperrpparaeetrr is observed in terms of distinguishing local maximas from saddle points. This settles well with the robustness to s terms of detecting generated images, demonstrated in Table and Fig. T0).
25

---

Published as a conference paper at ICLR 2025
Data sconds
Estiated scones
Legloriteed
X
Proviaus diflusion Inaining
Figure 12: Top Left: Excerpt from Mitchell et al. (023), Fig. 2, showing their hypothesis that generated text lies near local maxima points of the learned probability. Top Right: Excerpt from Song & Ermon (211)). Fig. 2. A diffusion model was trained on data from a bi-modal GMM. We can that the true data probability has basins of attraction: A narrow basin across the diagonal, that leads to a saddle point, and two other basins leading to local maxima. However, the modeled score function learned by diffusion model predominantly learns the 2 maxima basins, which "overtake" most of the the non-local-oee maximma basin. Bottom: An excerpt from Kadkhodaie et al.) (2024) that illustrates how diffusion models may have bias due training data (in this case, the small size training set causes memorization) which turn results in bumps in the implicitly learned probability desnity function.
Figure 13: Score-function fields: True vs Learned. We experimented with the 2D GMM data of
Fig. B(a and 2 additional cases, each case with re-drawn parameeasssstrrs... A diffusion model was trained on the data as in Fig. B(a). The quiver plots show the normalized score-function as learned by the diffusion model, and its ground the local maxima basins of attraction in the learned probability "take over" regions where the true field low. This supports the assumption that the learned reverse diffusion terminates near local maxima. Formally, the field f was normalized as, [normed(2 +100 (our method uses the
counterpart obtained from the true probability. Clearly,
f(x)
same normalization for the generated image detection criterion). For this visualization, xr is sampled uniformly on the X-Y grid.
26


Reviews:
[{"review_id": "DTvKaB0u0s", "reviewer": "Reviewer_Xh3J", "summary": "This paper introduces a zero/few-shot framework for detecting AI-generated images by analyzing the inherent biases of a pre-trained diffusion model. The authors hypothesize that generated images are more likely to occupy stable local maxima on this learned manifold, characterized by specific curvature and gradient properties. By approximating these properties, they create a criterion to distinguish between real and generated images without requiring large datasets or retraining. Empirical results show their method outperforms other detection approaches across multiple generative models.", "questions": "See weaknesses.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- Zero-shot and few-shot capability makes the method practical.\n- The theoretical perspective is interesting.\n- Empirical results seem promising.", "weaknesses": "1. Some theoretical assertions, such as the assumption that generated samples are more likely to be stable local maxima on the learned manifold, are not fully justified. This assumption underpins the detection criterion, but the paper does not offer a thorough mathematical or empirical rationale to support it.\n2. The paper relies heavily on approximations in score-function and curvature estimations (e.g., Eq.5, 16-18). However, there is limited discussion or analysis of the tightness of these approximations. This could lead to questions about the reliability of the approximations, especially when they form the foundation of the theoretical claims. It would be beneficial if the authors provided error bounds analysis or empirical justifications for these approximations.\n3. In line 122, the authors argue that previous methods still rely on access to generative methods during training, leading to biases towards those generation techniques. However, the proposed approach also relies on a pre-trained SD1.4. How does the proposed approach avoid the bias from it? For example, a realistic sample generated from a more recent model may not sit on a stable local maximum in the learnt log probability manifold of SD1.4.\n4. The presentation can be improved. The mathematical analysis can benefit from illustrative examples, while the detailed proof can be moved to appendix.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dO61g8VgK0", "reviewer": "Reviewer_DPAQ", "summary": "The paper explores a novel method to detect AI-generated images, focusing on zero-shot and few-shot regimes. It identifies key challenges in the field, such as the need for data upkeep with traditional supervised learning methods and limited theoretical grounding for current approaches. The authors propose a framework based on the implicit biases within the manifold of a pre-trained diffusion model, leveraging score-function analysis to approximate manifold curvature and gradient in the zero-shot setting. They extend the method for few-shot scenarios by incorporating a mixture-of-experts strategy. The proposed method demonstrates enhanced performance across 20 generative models.", "questions": "1. The proposed method relies on pre-trained diffusion models and manifold analysis, which are implemented in high-dimensional space, potentially increasing computational costs. Could the authors provide an analysis of inference time and memory requirements?\n\n2. The method depends on certain hyperparameters, such as perturbation strength and the number of spherical noises. How robust is the method to these parameters across different models, and what guidelines can be provided for selecting these parameters?\n\n3. The authors tested the impact of JPEG compression on the method and reported a slight performance decrease. How does the method perform with other types of image post-processing, such as augmentation, denoising, and flipping?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The idea of leveraging manifold-induced biases from pre-trained diffusion models to detect generated images is novel and interesting.\n- The methodology, essential theoretical formulations, and results are well-articulated, with equations and definitions supporting the approach.\n- Experimental results are promising, and Figures 1 and 2 are intuitive and easy to understand.", "weaknesses": "The primary concern is the robustness; please see the Questions below.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "m7QMtH2q5a", "reviewer": "Reviewer_GHKQ", "summary": "This work addresses the challenge of distinguishing between real and AI-generated images by analyzing biases on the probability manifold of pre-trained diffusion models. The authors develop a method that offers a scalar criterion for classification in zero-shot settings, and experiments demonstrate its effectiveness against current methods.", "questions": "The author choose SD-1.4 to implement the proposed method, have the author tried other diffusion models, especially recently more advanced methods, such as SDXL and SD3. Does this helps improve the performance?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "The theoretical analysis of current diffusion models’ score functions is comprehensive and novel, potentially inspiring further research in this area.\n\nThe proposed method generalizes well to unseen generative techniques and achieves superior performance over existing approaches in both zero-shot and few-shot settings.", "weaknesses": "The implementation details in Section 4.3 should be elaborated further to enhance readability and reproducibility.\n\n\nTypo errors:\n- L153 and L149, inconsistent use of $\\mathcal N$ and $N$.\n- L146 and L170, inconsistent use of $\\mathbb{R}$ and $R$\n- L157, better use latex log $\\log$ for clarity.\n- L191, use latex \\` for upper quotas.\n- inconsistent use of Sec. and Section\n- L298-L299, unexpected equation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "sC0RocaajX", "reviewer": "Reviewer_qnVq", "summary": "The paper presents a novel approach to detecting AI-generated images using a zero-shot and few-shot framework. By analyzing biases inherent in the manifold of pre-trained diffusion models, the authors introduce a new mathematical criterion based on score functions, curvature, and gradient analysis. This approach generalizes well to unseen generative techniques and outperforms existing methods in both zero-shot and few-shot scenarios. Extensive experiments across a diverse set of generative models further validate the effectiveness of the proposed method.", "questions": "Please see weakness.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper provides a sound theoretical foundation by integrating manifold analysis with diffusion models, advancing the field of generated image detection.\n\nThe empirical results show strong performance, with the proposed method outperforming current state-of-the-art approaches.\n\nThe authors conducted experiments across various datasets and generative techniques, including GANs, diffusion models, and commercial tools, providing strong evidence for the robustness of the method.", "weaknesses": "According to the article, the proposed curvature and gradient based metric for detecting generated images is closely related to the score function. However, it is unclear why this method also performs well with models where score functions are not inherently applicable, such as CycleGAN. The authors are encouraged to clarify this connection and explain why the proposed metric shows strong performance even in such cases where score function analysis is not directly relevant.\n\nThere are citation issues on page 7 of the article, where footnotes and page numbers are not correctly referenced. The authors should revise the citation formatting to ensure all references are accurate and properly aligned with the content.\n\nThe proposed method appears to fit naturally within a zero-shot framework, relying solely on input samples and corresponding perturbations. It is unclear why the few-shot setting was introduced, given that zero-shot scenarios are typically more challenging and often reflect real-world situations. The authors are encouraged to clarify the need for a few-shot setting and explain why zero-shot alone would not suffice as a more compelling and realistic approach.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)